Data packet detection method, device, apparatus, storage medium and program

Abstract

This application provides a data packet detection method, apparatus, device, storage medium, and program. The method includes: acquiring multiple network data packets in network hardware and storing them in a virtual address space; the graphics processor includes multiple computing units; acquiring the load status of each computing unit; based on the load status of each computing unit, performing parallel processing on the multiple network data packets through the multiple computing units to obtain the target processing result corresponding to each network data packet; for any given network data packet, if the target processing result corresponding to the network data packet is abnormal, generating detection alarm information for the target processing result of the network data packet, the detection alarm information being used to indicate a security event notification. The method of this application can improve the processing efficiency of data packet detection.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data packet detection method, apparatus, device, storage medium, and program. Background Technology

[0002] Packet inspection can be applied to intrusion detection systems (IDS), intrusion prevention systems (IPS), firewalls, traffic monitoring, and behavioral analysis.

[0003] In existing technologies, data acquisition can be performed based on the DPDK framework, and analysis can be performed in conjunction with GPUs. However, in the DPDK and GPU collaborative architecture, data packets need to undergo multiple memory copies between acquisition and analysis, resulting in complex data transmission paths, high latency, and low processing efficiency for data packet detection. Summary of the Invention

[0004] This application provides a data packet detection method, apparatus, device, storage medium, and program to solve the technical problem of low processing efficiency in data packet detection.

[0005] Firstly, this application provides a data packet detection method, including:

[0006] Multiple network data packets are acquired in the network hardware and stored in the virtual address space;

[0007] Obtain the load status of each computing unit in the multiple computing units of the graphics processor;

[0008] Based on the load status of each computing unit, the multiple computing units process the multiple network data packets in parallel to obtain the target processing result corresponding to each network data packet.

[0009] For any network data packet, if the target processing result corresponding to the network data packet is abnormal, a detection alarm message for the target processing result corresponding to the network data packet is generated, and the detection alarm message is used to indicate a security event notification.

[0010] This application can reduce the overhead of central processing unit interrupts and memory management, thereby improving the processing efficiency of packet detection.

[0011] Optionally, based on the load status of each computing unit, the multiple computing units perform parallel processing on the multiple network data packets to obtain the target processing result corresponding to each network data packet, including:

[0012] Based on the load status of each computing unit, the multiple network data packets are allocated to the task queues corresponding to each computing unit.

[0013] For any given network data packet, the computing unit corresponding to the network data packet analyzes and processes the network data packet based on the task queue corresponding to the network data packet to obtain the target processing result.

[0014] In this application, a dynamic load balancing mechanism is used to optimize GPU resource allocation, avoid idle or overloaded computing units, and further improve GPU utilization and task processing throughput.

[0015] Optionally, the network data packets are analyzed and processed to obtain the target processing result, including:

[0016] Determine the target protocol type of the network data packet;

[0017] Based on the target protocol type, determine the target parsing template corresponding to the target protocol type from the preset rule template library;

[0018] Based on the target parsing template, feature extraction processing is performed on the network data packets to obtain multiple feature fields;

[0019] Based on the multiple feature fields, the target processing result corresponding to the network data packet is determined.

[0020] In this application, the protocol adaptive parsing template is used to dynamically adapt to the parsing requirements of different protocols, avoiding the need to develop a separate parsing module for each protocol, improving multi-protocol compatibility and parsing efficiency, and reducing system development and maintenance costs.

[0021] Optionally, the target processing result corresponding to the network data packet is determined based on the plurality of feature fields, including:

[0022] The multiple feature fields are hashed to obtain the feature hash value corresponding to the network data packet;

[0023] If a historical processing result corresponding to the feature hash value exists in the preset shared hash table, then the historical processing result is determined as the target processing result;

[0024] If the historical processing result corresponding to the feature hash value does not exist in the preset shared hash table, then the multiple feature fields are parsed to obtain the target processing result.

[0025] In this application, by using GPU multi-level caching and duplicate data packet hash filtering mechanism, the invalid computing resource consumption of GPU can be significantly reduced, and the system's throughput and detection response speed in high-repetition traffic scenarios can be improved.

[0026] Optionally, the load status is the load utilization rate; according to the load status of each computing unit, the plurality of network data packets are allocated to the task queues corresponding to each computing unit, including:

[0027] The unit load type corresponding to each computing unit is determined based on the preset minimum load threshold and maximum load threshold corresponding to the load utilization rate.

[0028] The polling weight corresponding to each computing unit is determined based on the unit load type corresponding to each computing unit.

[0029] Based on the polling weights corresponding to each computing unit, the multiple network data packets are allocated to the task queues corresponding to each computing unit.

[0030] In this application, load balancing of each computing unit is achieved to avoid overload or idle resources of a single unit, thereby improving the overall computing throughput and data packet processing efficiency of the GPU.

[0031] Optionally, storing the plurality of network data packets in a virtual address space includes:

[0032] The multiple network data packets are written into a preset continuous content block to obtain the target physical address corresponding to each network data packet;

[0033] The target physical address corresponding to each network data packet is stored in the virtual address space via a high-speed serial bus.

[0034] In this application, by pre-setting contiguous content blocks and the PCIe bus, the transmission latency of data packets between the CPU and GPU is reduced; the contiguous address characteristics of the pre-set contiguous content blocks reduce memory management overhead, and the direct address passing of the PCIe bus avoids CPU involvement in data movement, thereby improving data transmission efficiency.

[0035] Optionally, generating detection alarm information for the target processing result corresponding to the network data packet includes:

[0036] Store the target processing result corresponding to the network data packet into a preset circular buffer;

[0037] Based on the preset circular buffer, detection alarm information corresponding to the target processing result is generated.

[0038] In this application, the GPU can continuously acquire new data packets for parallel processing without waiting for the CPU to process alarms. At the same time, the CPU can independently complete alarm generation, distribution and storage, thereby decoupling GPU computing resources and CPU processing resources and improving the overall system throughput, detection response speed and resource utilization.

[0039] Secondly, embodiments of this application provide a data packet detection device, including a first acquisition module, a storage module, a second acquisition module, a parallel processing module, and a generation module:

[0040] The first acquisition module is used to acquire multiple network data packets from the network hardware;

[0041] The storage module is used to store the plurality of network data packets into a virtual address space;

[0042] The second acquisition module is used to acquire the load status of each computing unit in the multiple computing units of the graphics processor;

[0043] The parallel processing module is used to process the multiple network data packets in parallel through the multiple computing units based on the load status of each computing unit, so as to obtain the target processing result corresponding to each network data packet.

[0044] The generation module is used to generate detection alarm information for the target processing result corresponding to any network data packet if the target processing result of the network data packet is abnormal. The detection alarm information is used to indicate a security event notification.

[0045] Thirdly, embodiments of this application provide an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0046] The memory stores computer-executed instructions;

[0047] The processor executes computer execution instructions stored in the memory to implement the method as described in any of the second aspects.

[0048] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method described in the second aspect.

[0049] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the method described in any of the second aspects.

[0050] The packet detection method, apparatus, device, storage medium, and program provided in this application can acquire multiple network packets in network hardware and store them in a virtual address space. The virtual address space is a shared memory area between the Central Processing Unit (CPU) and the Graphics Processing Unit (GPU). The load status of each computing unit of the GPU is acquired, and based on this load status, multiple computing units process the multiple network packets in parallel to obtain the target processing result for each network packet. If the target processing result for a network packet is abnormal, a detection alarm message for that result is generated. Packets can be directly acquired from the network hardware, avoiding context switching and memory copying steps in the kernel protocol stack. Simultaneously, the virtual address space maps packet addresses to the GPU for multi-threaded parallel processing, shortening the path of packets from the network hardware to the GPU's video memory. This reduces CPU interrupt and memory management overhead, thereby improving the processing efficiency of packet detection. Attached Figure Description

[0051] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0052] Figure 1 A schematic diagram illustrating the application scenarios provided in the embodiments of this application;

[0053] Figure 2 A flowchart illustrating a data packet detection method provided in an embodiment of this application;

[0054] Figure 3 A system framework diagram of a data packet detection method provided in an embodiment of this application;

[0055] Figure 4 A flowchart illustrating another data packet detection method provided in an embodiment of this application;

[0056] Figure 5 A schematic diagram of the architecture of a data packet detection method provided in an embodiment of this application;

[0057] Figure 6 This is a schematic diagram of the structure of a data packet detection device provided in an embodiment of this application;

[0058] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0059] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0060] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0061] Figure 1 This is a schematic diagram illustrating an application scenario provided in an embodiment of this application. Please refer to [link / reference]. Figure 1 This technology is applicable to packet inspection scenarios in high-speed network environments, such as cloud computing data centers with 10Gbps and above links, industrial internet control systems, and 5G communication base stations. In this scenario, user equipment 101 and processing equipment 102 may be involved. The network traffic between user equipment 101 and processing equipment 102 is characterized by high concurrency, multiple protocols, and dynamic changes, and real-time identification and response to abnormal behaviors (such as Distributed Denial of Service (DDoS) attacks, protocol violations, and data leaks) are required.

[0062] After user equipment 101 sends data packets to processing device 102, processing device 102 uses the Data Plane Development Kit (DPDK) to achieve zero-copy high-speed acquisition, directly sending the data packets to the graphics processing unit (GPU) memory, and performing deep analysis (such as protocol parsing, regular expression matching, and AI model inference) in conjunction with a parallel computing framework. The detection results are then fed back to the upper-layer security platform or triggered to respond to the mechanism, forming an end-to-end low-latency detection closed loop.

[0063] In related technologies, data acquisition can be performed based on the DPDK framework and combined with GPU for analysis. However, in the DPDK and GPU collaborative architecture, data packets need to undergo multiple memory copies between acquisition and analysis, resulting in complex data transmission paths, high latency, and low processing efficiency for data packet detection.

[0064] The packet detection method provided in this application can acquire multiple network packets in network hardware and store them in a virtual address space. The virtual address space is a shared memory area between the Central Processing Unit (CPU) and the Graphics Processing Unit (GPU). The method acquires the load status of each computing unit of the GPU and, based on the load status of each computing unit, processes the multiple network packets in parallel through multiple computing units to obtain the target processing result corresponding to each network packet. If the target processing result corresponding to the network packet is abnormal, a detection alarm message for the target processing result corresponding to the network packet is generated.

[0065] During the above execution process, data packets can be directly obtained from the network hardware, avoiding context switching and memory copying steps in the kernel protocol stack. At the same time, the address of the data packet is mapped to the graphics processor through the virtual address space for multi-threaded parallel processing. The path of the data packet from the network hardware to the graphics processor's video memory is shortened, which can reduce the overhead of CPU interrupts and memory management, thereby improving the processing efficiency of data packet detection.

[0066] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0067] Figure 2 This is a flowchart illustrating a data packet detection method provided in an embodiment of this application. Please refer to [link / reference]. Figure 2 The method may include:

[0068] S201. Obtain multiple network data packets from the network hardware.

[0069] The execution subject of this application embodiment can be a processing device or a data packet processing device installed on the processing device. The data packet processing device can be implemented by software or by a combination of software and hardware.

[0070] Multiple network data packets can be obtained directly from the network hardware, which can be a network card. The DPDK user-space driver does not need to go through the kernel protocol stack.

[0071] S202. Store multiple network data packets in the virtual address space.

[0072] Multiple network data packets can be stored in the virtual address space using a zero-copy mechanism.

[0073] Zero-copy mechanisms refer to data packets being transferred directly through hardware address mapping or shared memory mechanisms without undergoing a memory copy from kernel mode to user mode. For example, DPDK's large page memory pool and GPU memory DMA passthrough (or address mapping).

[0074] Actual data packets can be directly transmitted from the network hardware (NIC) to the GPU memory through the address mapping relationship of this virtual address space, avoiding the CPU as an intermediary.

[0075] A graphics processing unit can include multiple computing units, which are streaming multiprocessors (SMs) of the GPU. Each computing unit can support multiple threads to execute data processing tasks in parallel.

[0076] S203. Obtain the load status of each computing unit in multiple computing units.

[0077] The load status of each computing unit can be obtained through GPU hardware performance counters. GPU hardware performance counters refer to the monitoring modules built into the GPU, which are used to collect the operating status of the computing units.

[0078] Load status can include the utilization of the computing unit's SM (Streaming Multiprocessor), GPU memory bandwidth utilization, number of active threads, instruction execution efficiency, etc.

[0079] S204. Based on the load status of each computing unit, multiple network data packets are processed in parallel by multiple computing units to obtain the target processing result corresponding to each network data packet.

[0080] Parallel processing refers to the parallel execution of tasks such as data packet parsing, feature extraction, or model inference on a GPU through multiple threads.

[0081] Based on the load status, the task allocation of data packets in the GPU can be dynamically adjusted in combination with preset load thresholds (such as SM utilization threshold and memory bandwidth utilization threshold).

[0082] In some embodiments, multiple network data packets are allocated to the task queues corresponding to each computing unit according to the load status of each computing unit; for any given network data packet, the computing unit corresponding to the network data packet is scheduled and executed sequentially based on the task queue corresponding to the network data packet to analyze and process the network data packet and obtain the target processing result.

[0083] At the memory allocation level, the memory allocation strategy is optimized in conjunction with the NUMA (Non-uniform memory access) architecture. Large page memory pools are preferentially allocated to physical memory regions on the same NUMA node as the current CPU core, reducing memory access latency across NUMA nodes and improving overall memory access efficiency. At the same time, the GPU memory mapping region is bound to the memory region of the corresponding NUMA node to further reduce data access overhead.

[0084] The target processing results are used to indicate whether network data packets are abnormal, the type of abnormality (such as DDoS attack, protocol violation, data leakage), and key characteristic information (such as source IP, destination IP, port combination), etc.

[0085] For example, when a computing unit is overloaded (e.g., SM utilization exceeds a preset threshold of 80% or memory bandwidth utilization exceeds a preset threshold of 90%), new tasks are assigned to idle computing units with lower loads (e.g., SM utilization is below a preset threshold of 50%), or the granularity of CUDA thread blocks and the batch size of tasks are adjusted to balance the load.

[0086] In this application, a dynamic load balancing mechanism can be used to optimize GPU resource allocation, avoid idling or overloading of computing units, and further improve GPU utilization and task processing throughput, especially adapting to task scheduling needs such as sudden traffic and dynamic traffic fluctuations in high-speed network scenarios.

[0087] S205. For any network data packet, if the target processing result corresponding to the network data packet is abnormal, generate detection alarm information for the target processing result corresponding to the network data packet.

[0088] If the target processing result indicates an anomaly (such as being marked as a DDoS attack, protocol violation, data leakage, etc.), an alarm generation process is triggered; if the target processing result is a normal data packet, only lightweight statistical information (such as the number of communication between source and destination IPs, protocol type) is recorded, and no alarm is generated.

[0089] Alarm information can be used to indicate security incident notifications. For example, alarm logs generated after a DDoS attack is detected can help operations and maintenance personnel quickly locate the attack source, assess the scope of impact, and coordinate with protective devices to perform blocking operations.

[0090] The packet detection method provided in this application can directly obtain packets from network hardware, avoiding context switching and memory copying steps in the kernel protocol stack. Simultaneously, it maps packet addresses to the graphics processor through a virtual address space, enabling multi-threaded parallel processing. This shortens the path of packets from network hardware to the graphics processor's video memory, reducing CPU interrupts and memory management overhead, thereby improving the processing efficiency of packet detection. It also reduces the number of memory copies, freeing up CPU resources to focus more on scheduling and result processing, while allowing the GPU to continuously acquire analysis tasks, avoiding idle time.

[0091] Figure 3 This is a system framework diagram of a data packet detection method provided in an embodiment of this application. Please refer to [link / reference]. Figure 3 This includes the Central Processing Unit (CPU) and the Graphics Processing Unit (GPU). By bypassing the kernel protocol stack through the DPDK user-space driver, it rapidly captures raw data packet streams from network hardware (such as network interface cards). A zero-copy mechanism stores the data packets in a large page memory pool, and through virtual address space or DMA pass-through, maps the packet addresses to GPU memory, achieving efficient data transfer from the CPU to the GPU. It monitors the load status of each GPU computing unit in real time (such as SM utilization and memory bandwidth usage), dynamically adjusts the data packet allocation strategy based on the load status, and assigns tasks to the corresponding task queues of each computing unit, achieving load balancing of GPU resources.

[0092] The GPU parallel computing framework parses data packets in a thread-level parallel manner, generating target processing results containing information such as anomaly markers and attack types. The CPU side receives the target processing results returned by the GPU side, generates standardized detection alarm information, and completes the distribution, storage, and response triggering of alarms.

[0093] High-speed data exchange is achieved between the CPU and GPU sides via the PCIe bus, supporting efficient transmission of data packets from the CPU side to the GPU side for parallel processing, and also supporting rapid transmission of detection results from the GPU side back to the CPU side for subsequent processing.

[0094] Figure 4 This is a flowchart illustrating another data packet detection method provided in an embodiment of this application. Please refer to... Figure 4 ,exist Figure 2 Based on the illustrated embodiments, the method may include:

[0095] S401. Acquire multiple network data packets in the network hardware.

[0096] The execution process of S401 can be found in the execution process of S201, and will not be repeated here.

[0097] S402. Write multiple network data packets into a preset continuous content block to obtain the target physical address corresponding to each network data packet.

[0098] Pre-defined contiguous blocks of content can be large page memory pools provided by the operating system and optimized for NUMA architecture (allocated and managed via the DPDK user-space driver) to reduce page table lookup overhead and memory fragmentation. For example, DPDK can allocate 2MB or 1GB of large page memory.

[0099] The size of the preset contiguous content block is set to match the maximum transfer block size and effective bandwidth of the PCIe bus, so that the data length of a single PCIe transfer is aligned with the size of the large page memory block, making full use of the PCIe bus bandwidth and avoiding the decrease in bandwidth utilization caused by multiple small-granularity transfers.

[0100] Before writing network data packets into a preset contiguous content block using a zero-copy mechanism, the memory allocation strategy is optimized in conjunction with the NUMA architecture. The large page memory pool is allocated to the physical memory region of the CPU core currently executing the acquisition task on the same NUMA node, avoiding memory access latency across NUMA nodes. At the same time, the physical address of the large page memory pool is bound to the corresponding NUMA node to ensure that the storage location of the data packets in memory is aligned with the local memory region of the CPU core, thereby improving memory access efficiency.

[0101] By adopting a continuous physical address pre-allocation method, multiple data packets are sequentially written into the same large page memory block, so that the address mapping range remains continuous and without gaps, avoiding discrete fragmentation during the address mapping process.

[0102] After writing a network data packet into a preset contiguous content block using a zero-copy mechanism, the target physical address of the network data packet stored within the preset contiguous content block can be obtained (i.e., the actual physical address of the data packet in the large page memory pool).

[0103] S403. The target physical address corresponding to each network data packet is stored in the virtual address space via a high-speed serial bus.

[0104] The virtual address space is the address space of the GPU's video memory. Through the address mapping mechanism of the PCIe bus (such as PCIe Address Translation Service (ATS) and Input / Output Memory Management Unit (IOMMU) address translation), the physical address of the CPU-side large page memory is mapped to the virtual address of the video memory that the GPU can directly access, so as to enable the GPU to directly read data packets and avoid the CPU to transfer them.

[0105] By using IOMMU to map contiguous large physical address pages as a whole into contiguous GPU virtual address ranges, the mapped address space is ensured to be continuous and regular, thus avoiding address mapping fragmentation at the source.

[0106] The high-speed serial bus can be a PCIe bus (e.g., PCIe 4.0 / 5.0 specification) to connect the CPU and GPU. Through DMA (Direct Memory Access) mapping and address translation mechanism, it realizes the direct mapping of data packet physical address and the GPU's direct access to the CPU's large page memory.

[0107] For example, through the address mapping mechanism of the PCIe bus, the physical address of network data packets is mapped to the virtual address of GPU memory, allowing the GPU to directly read data packets in large pages of memory through this virtual address.

[0108] In this application, memory fragmentation and page table lookup overhead can be reduced by pre-setting contiguous content blocks. The physical address of the data packet is directly mapped to the GPU's virtual address space via the PCIe bus, enabling the GPU to directly access the data packet in the CPU's large page memory, completely skipping the CPU's data transfer and copying process.

[0109] By combining pre-defined contiguous content blocks with the PCIe bus, the transmission latency of data packets between the CPU and GPU is reduced; the contiguous address characteristics of the pre-defined contiguous content blocks reduce memory management overhead, and the direct address passing of the PCIe bus avoids CPU involvement in data movement, further improving data transmission efficiency on the basis of zero copy.

[0110] S404. Obtain the load status of each computing unit in multiple computing units.

[0111] The execution process of S404 can be found in the execution process of S203, and will not be repeated here.

[0112] S405. Based on the load status of each computing unit, allocate multiple network data packets to the corresponding task queue of each computing unit.

[0113] The load status is represented by the load utilization rate, which can be a composite utilization rate obtained by weighting key indicators such as SM utilization and GPU memory bandwidth utilization. This quantitative combination of indicators ensures the comprehensiveness and accuracy of the load status assessment. For example, if SM utilization has a weight of 0.6 and memory bandwidth utilization has a weight of 0.4, the composite utilization rate = SM utilization × 0.6 + memory bandwidth utilization × 0.4.

[0114] Specifically, the unit load type corresponding to each computing unit is determined based on the minimum and maximum load thresholds corresponding to the load utilization rate; the polling weight corresponding to each computing unit is determined based on the unit load type corresponding to each computing unit; and multiple network data packets are allocated to the task queue corresponding to each computing unit based on the polling weight corresponding to each computing unit.

[0115] The task queue and CUDA thread blocks adopt a mapping rule from queue to thread block pool. Each computing unit (SM) is configured with a dedicated thread block pool for its task queue. The initial size of the thread block pool is preset according to the hardware resources of the SM (such as the number of registers and the size of shared memory) (for example, each SM is bound to 8-16 thread blocks, and each thread block contains 128-256 threads). Data packets in the task queue are allocated according to the batch allocation principle. Each batch of tasks corresponds to the processing capacity of one thread block, realizing a one-to-one mapping and scheduling between task queues and thread blocks, and ensuring the efficient utilization of SM resources.

[0116] You can first preset specific load threshold ranges, for example, set the minimum load threshold to 30% and the maximum load threshold to 70%.

[0117] Unit load types can include idle units, normal load units, and overload units. Specifically, computing units with a load utilization rate greater than the maximum load threshold (e.g., 70%) are defined as overload units; computing units with a load utilization rate less than or equal to the maximum load threshold (e.g., 70%) and greater than the minimum load threshold (e.g., 30%) are defined as normal load units; and computing units with a load utilization rate less than or equal to the minimum load threshold (e.g., 30%) are defined as idle units.

[0118] The polling weights corresponding to the load types of each unit can be preset. The value of the polling weight is positively correlated with the remaining processing capacity of the computing unit. The task allocation ratio can be precisely controlled by quantifying the weights.

[0119] For example, idle units (load utilization ≤ 30%) have sufficient remaining processing capacity, and the corresponding polling weight is set to 3, allowing them to be allocated 3 tasks within the scheduling cycle; normal load units (30% < load utilization ≤ 70%) have processing capacity at the critical saturation point, and the corresponding polling weight is set to 1, allowing them to be allocated 1 task within the scheduling cycle; overload units (load utilization > 70%) have no extra processing resources, and the corresponding polling weight is set to 0. A weight of 0 indicates that no new tasks will be allocated for the time being, and existing tasks will be processed first.

[0120] In this application, load types can be divided by preset load thresholds and tasks can be dynamically allocated based on polling weights to achieve load balancing of each computing unit, avoid overload of a single unit or idle resources, and improve the overall computing throughput and data packet processing efficiency of the GPU.

[0121] After the data packet is allocated, the length of the corresponding task queue and the number of tasks to be processed are updated, and a scheduling signal is sent to the corresponding computing unit to trigger the next round of execution of the task queue. If all computing units are overloaded, the data packet is temporarily stored in the CPU-side big page memory buffer queue and then allocated again after the load decreases.

[0122] The processing progress of the task queue and the load changes of the computing unit are monitored in real time. If the load of a computing unit is continuously higher than the maximum load threshold for a short period of time (such as 50ms-100ms, which can be configured as needed), its polling weight is dynamically adjusted to reduce the allocation of subsequent data packets until the load returns to the normal range.

[0123] S406. For any network data packet, the network data packet is analyzed and processed by the computing unit corresponding to the network data packet and based on the task queue corresponding to the network data packet to obtain the target processing result.

[0124] In some embodiments, the target protocol type of the network data packet is determined, and the target parsing template corresponding to the target protocol type is determined from a preset rule template library based on the target protocol type; based on the target parsing template, feature extraction processing is performed on the network data packet to obtain multiple feature fields; based on the multiple feature fields, the target processing result corresponding to the network data packet is determined.

[0125] The target protocol type can include TCP / IP, HTTP, DNS, Modbus, and other protocols. For example, configurable parsing templates can be designed for the characteristic fields of different protocols (such as IP header length, TCP flags, and DNS query type), and protocol field extraction can be performed in parallel at the GPU thread level.

[0126] The preset rule template library refers to a high-speed database that resides in the GPU memory and stores structured parsing rules for various network protocols. All protocol parsing templates are preloaded and stored during the system initialization phase, eliminating the need to dynamically read them from CPU memory or external storage during packet parsing and avoiding the latency overhead caused by real-time loading.

[0127] For example, parsing logic including field offsets, data lengths, and validation rules for protocols such as TCP / IP, HTTP, and DNS.

[0128] Feature fields refer to key information in data packets used for security detection, and are divided into basic feature fields and protocol-specific feature fields. For example, basic feature fields include source IP address, destination port number, and protocol type identifier; protocol-specific feature fields include HTTP request method, DNS query domain name, and Modbus function code.

[0129] When GPU threads process data packets in parallel, they first identify the target protocol type through the protocol identification field in the packet header (such as the Protocol field in the IP header and the transport layer port number). Based on the protocol type, they quickly switch from the preset rule template library in the GPU memory and call the corresponding target parsing template by index lookup. There is no need to reload or parse the template file, and the protocol switching overhead is extremely low. Feature fields are extracted through bit operations and conditional branches.

[0130] For example, a TCP protocol parsing template can extract the source port, destination port, and TCP flags, while an HTTP protocol parsing template can extract the request method, URL path, and response status code.

[0131] In this application, the protocol adaptive parsing template is dynamically adapted to the parsing requirements of different protocols, avoiding the need to develop a separate parsing module for each protocol. Based on GPU parallel processing, it improves multi-protocol compatibility and parsing efficiency, and reduces system development and maintenance costs.

[0132] Specifically, multiple feature fields are hashed to obtain the feature hash value corresponding to the network data packet; if there is a historical processing result corresponding to the feature hash value in the preset shared hash table, the historical processing result is determined as the target processing result; if there is no historical processing result corresponding to the feature hash value in the preset shared hash table, multiple feature fields are parsed to obtain the target processing result, and the feature hash value and the corresponding processing result are written into the preset shared hash table.

[0133] Hash processing can be performed using a preset hash algorithm (such as MD5, SHA-1, or Cuckoo Hash).

[0134] A multi-level GPU caching mechanism can be adopted (L1 cache is thread-private, L2 cache is shared across threads). The preset shared hash table can be located in the GPU L2 cache, and all computing units can access the preset shared hash table.

[0135] After the computing unit parses the data packet, it generates a hash value for the feature fields (such as the combination of source IP + destination IP + port) and writes it to a preset shared hash table. When the hash value of a new data packet matches an existing entry in the preset shared hash table, the deep analysis step is skipped, and only lightweight statistical operations (such as accumulating the number of data packets and updating the last occurrence timestamp) are performed.

[0136] For example, in a DDoS attack scenario, attackers may send a large number of duplicate malicious data packets. Traditional solutions require parsing and analyzing them one by one, while this solution quickly identifies duplicate packets through hash matching and performs in-depth analysis (including full protocol parsing and AI model attack type determination) only on the first packet, which greatly reduces GPU load while maintaining detection accuracy.

[0137] In this application, by using GPU multi-level caching and duplicate data packet hash filtering mechanism, the invalid computing resource consumption of GPU can be significantly reduced, and the system's throughput and detection response speed in high-repetition traffic scenarios can be improved.

[0138] S407. For any network data packet, if the target processing result corresponding to the network data packet is abnormal, the target processing result corresponding to the network data packet is stored in a preset circular buffer.

[0139] A pre-defined circular buffer refers to a fixed-size video memory structure that is used in a circular manner to temporarily store the processing results of data packets. It can provide lock-free concurrent access synchronized with FIFO (First In First Out) and atomic operations, ensuring the safety and consistency of GPU multi-threaded writing and CPU single-threaded reading.

[0140] For example, by using read and write pointers in a pre-defined circular buffer to independently manage data enqueueing and dequeueing, the write pointer is concurrently updated by the GPU thread through an atomic increment operation (writing abnormal results) to avoid multi-threaded write conflicts; the read pointer is safely updated by the CPU-side control module through an atomic compare-and-swap operation (reading abnormal results) to prevent data corruption caused by cross-read and write pointers, ultimately achieving asynchronous decoupling and lock-free efficient collaboration between the GPU and CPU.

[0141] A pre-defined circular buffer temporarily stores exception handling results after the GPU completes parallel processing, avoiding the high latency and bus occupation caused by the GPU directly writing to the CPU main memory.

[0142] By using the address mapping mechanism of the PCIe bus, the detection results (such as anomaly markers, attack types, and risk levels) in the buffer are read, alarm information is generated, and sent to the upper-layer business platform through standardized interfaces (such as REST API and Syslog protocol interfaces).

[0143] S408. Based on the preset circular buffer, generate detection alarm information corresponding to the target processing result.

[0144] The occupancy rate of the circular buffer is monitored in real time. When the occupancy rate exceeds the first preset threshold (e.g., 60%), a batch reading process is initiated to prioritize processing existing data. If the occupancy rate continues to climb to the second preset threshold (e.g., 90%, which is close to the upper limit of the buffer), emergency processing logic is triggered. On the one hand, new result writing on the GPU side is suspended (by notifying the GPU thread through atomic flag bits) to avoid buffer overflow. On the other hand, the highest priority reading task is started on the CPU side to quickly release the buffer space. After the occupancy rate drops below the safe threshold (e.g., 50%), the flag bits are reset through atomic operations to restore the GPU writing function.

[0145] The exception handling results of the preset circular buffer are read directly through the address mapping mechanism to obtain structured fields (such as alarm ID, exception type, source and destination IP, feature hash value, etc.).

[0146] The alarm fields are encapsulated according to a preset format, and information such as alarm classification (high / medium / low risk) and handling suggestions are added to generate standardized detection alarm information.

[0147] Alarm information is asynchronously pushed to the upper-layer security platform and operation and maintenance management system, and simultaneously written to a distributed log database (such as Elasticsearch) for subsequent attack tracing and auditing.

[0148] In this application, a circular buffer can be used to temporarily store and asynchronously transmit exception handling results, and atomic operations can be used to achieve lock-free synchronization of read and write pointers. Combined with dual-threshold emergency handling logic, buffer overflow is avoided, and direct data interaction between the GPU and CPU is prevented. This allows the GPU to continuously acquire new data packets for parallel processing without waiting for the CPU to process alarms, while the CPU can independently complete alarm generation, distribution, and storage. This decouples GPU computing resources from CPU processing resources, further improving the overall system throughput, detection response speed, and resource utilization.

[0149] The data packet detection method provided in this application can achieve low-latency acquisition, high-throughput parallel processing, and accurate anomaly detection of data packets in high-speed network environments by using a zero-copy transmission architecture of large page memory and address mapping, combined with GPU thread-level parallel computing and dynamic load balancing scheduling, protocol adaptive parsing template, and L2 cache shared hash deduplication mechanism. This significantly improves the system's adaptability to 10Gbps and above links, multi-protocol compatibility, and resource utilization efficiency.

[0150] Figure 5 This is a schematic diagram illustrating the architecture of a data packet detection method provided in an embodiment of this application. Please refer to [link / reference]. Figure 5The system initialization includes: initializing the DPDK environment, configuring the network card, and initializing the GPU analysis environment and model; high-speed data acquisition, which bypasses the kernel protocol stack through the DPDK user-space driver to acquire raw data packet streams from network hardware at high speed; data buffering and transmission, which achieves efficient transmission of data packets from CPU-side large page memory to GPU video memory through a large page memory pool and PCIe bus address mapping mechanism; GPU parallel detection, which dynamically allocates tasks based on the load status of each GPU computing unit, and performs parallel parsing, feature extraction, and deep analysis of data packets based on protocol adaptive parsing templates and shared hash deduplication mechanisms to generate target processing results; and result aggregation and output, which temporarily stores the anomaly processing results in a GPU video memory-side circular buffer, which is asynchronously read by the CPU-side control module to generate standardized detection alarm information, which is then pushed to the upper-layer security platform or triggers a response mechanism to achieve real-time, uninterrupted detection of high-speed network traffic.

[0151] Figure 6 This is a schematic diagram of a data packet detection device provided in an embodiment of this application. Please refer to... Figure 6 The data packet detection device 600 may include a first acquisition module 601, a storage module 602, a second acquisition module 603, a parallel processing module 604, and a generation module 605.

[0152] The first acquisition module 601 is used to acquire multiple network data packets in the network hardware;

[0153] Storage module 602 is used to store multiple network data packets into a virtual address space;

[0154] The second acquisition module 603 is used to acquire the load status of each computing unit among the multiple computing units of the graphics processor;

[0155] The parallel processing module 604 is used to process multiple network data packets in parallel through multiple computing units based on the load status of each computing unit, so as to obtain the target processing result corresponding to each network data packet.

[0156] The generation module 605 is used to generate detection alarm information for the target processing result of any network data packet if the target processing result of the network data packet is abnormal. The detection alarm information is used to indicate security event notification.

[0157] Optionally, the parallel processing module 604 is specifically used for:

[0158] Based on the load status of each computing unit, multiple network data packets are allocated to the corresponding task queue of each computing unit.

[0159] For any given network data packet, the corresponding computing unit analyzes and processes the network data packet based on the corresponding task queue to obtain the target processing result.

[0160] Optionally, the parallel processing module 604 is specifically used for:

[0161] Determine the target protocol type of the network data packet;

[0162] Based on the target protocol type, determine the target parsing template corresponding to the target protocol type from the preset rule template library;

[0163] Based on the target parsing template, feature extraction processing is performed on network data packets to obtain multiple feature fields;

[0164] Based on multiple feature fields, the target processing result corresponding to the network data packet is determined.

[0165] Optionally, the parallel processing module 604 is specifically used for:

[0166] Multiple feature fields are hashed to obtain the feature hash value corresponding to the network data packet;

[0167] If a historical processing result corresponding to a feature hash value exists in the preset shared hash table, then the historical processing result is determined as the target processing result;

[0168] If the historical processing result corresponding to the feature hash value does not exist in the preset shared hash table, then multiple feature fields are parsed and processed to obtain the target processing result.

[0169] Optionally, the load status is the load utilization rate; the parallel processing module 604 is specifically used for:

[0170] The unit load type corresponding to each computing unit is determined based on the minimum and maximum load thresholds corresponding to the preset load utilization rate.

[0171] The polling weight for each computing unit is determined based on the unit load type corresponding to each computing unit.

[0172] Based on the polling weights corresponding to each computing unit, multiple network data packets are allocated to the task queues corresponding to each computing unit.

[0173] Optionally, the storage module 602 is specifically used for:

[0174] Multiple network data packets are written into a preset continuous content block to obtain the target physical address corresponding to each network data packet;

[0175] The target physical address corresponding to each network data packet is stored in the virtual address space via a high-speed serial bus.

[0176] Optionally, the generation module 605 is specifically used for:

[0177] Store the target processing result corresponding to the network data packet into a preset circular buffer;

[0178] Based on a preset circular buffer, detection alarm information corresponding to the target processing result is generated.

[0179] The data packet detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be described again here.

[0180] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Please refer to... Figure 7 The electronic device 700 may include a processor 701 and a memory 702 communicatively connected to the processor 701. Exemplarily, the processor 701 and the memory 702 are interconnected via a bus 703.

[0181] Memory 702 stores instructions executed by the computer;

[0182] The processor 701 executes computer execution instructions stored in the memory 702, causing the processor 701 to perform the data packet detection method as shown in the above method embodiment.

[0183] Accordingly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the data packet detection method of the above-described method embodiments.

[0184] Accordingly, embodiments of this application may also provide a computer program product, including a computer program, which, when executed by a processor, can implement the data packet detection method shown in the above method embodiments.

[0185] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0186] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0187] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0188] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0189] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.

[0190] When integrated units / modules are implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.

[0191] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0192] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0193] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0194] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method of detecting a data packet, characterized by, include: Multiple network data packets are acquired in the network hardware and stored in the virtual address space; Obtain the load status of each computing unit in the multiple computing units of the graphics processor; Based on the load status of each computing unit, the multiple computing units process the multiple network data packets in parallel to obtain the target processing result corresponding to each network data packet. For any network data packet, if the target processing result corresponding to the network data packet is abnormal, a detection alarm message for the target processing result corresponding to the network data packet is generated, and the detection alarm message is used to indicate a security event notification.

2. The method of claim 1, wherein, Based on the load status of each computing unit, the multiple computing units perform parallel processing on the multiple network data packets to obtain the target processing result corresponding to each network data packet, including: Based on the load status of each computing unit, the multiple network data packets are allocated to the task queues corresponding to each computing unit. For any given network data packet, the computing unit corresponding to the network data packet analyzes and processes the network data packet based on the task queue corresponding to the network data packet to obtain the target processing result.

3. The method of claim 2, wherein, The network data packets are analyzed and processed to obtain the target processing result, including: Determine the target protocol type of the network data packet; Based on the target protocol type, determine the target parsing template corresponding to the target protocol type from the preset rule template library; Based on the target parsing template, feature extraction processing is performed on the network data packets to obtain multiple feature fields; Based on the multiple feature fields, the target processing result corresponding to the network data packet is determined.

4. The method of claim 3, wherein, Based on the multiple feature fields, the target processing result corresponding to the network data packet is determined, including: The multiple feature fields are hashed to obtain the feature hash value corresponding to the network data packet; If a historical processing result corresponding to the feature hash value exists in the preset shared hash table, then the historical processing result is determined as the target processing result; If the historical processing result corresponding to the feature hash value does not exist in the preset shared hash table, then the multiple feature fields are parsed to obtain the target processing result.

5. The method of claim 2, wherein, The load status refers to load utilization; based on the load status of each computing unit, the multiple network data packets are allocated to the task queues corresponding to each computing unit, including: The unit load type corresponding to each computing unit is determined based on the minimum and maximum load thresholds corresponding to the load utilization rate. The polling weight corresponding to each computing unit is determined based on the unit load type corresponding to each computing unit. Based on the polling weights corresponding to each computing unit, the multiple network data packets are allocated to the task queues corresponding to each computing unit.

6. The method of claim 1, wherein, Storing the plurality of network data packets into a virtual address space includes: The multiple network data packets are written into a preset continuous content block to obtain the target physical address corresponding to each network data packet; The target physical address corresponding to each network data packet is stored in the virtual address space via a high-speed serial bus.

7. The method of claim 1, wherein, The detection alarm information for generating the target processing result corresponding to the network data packet includes: Store the target processing result corresponding to the network data packet into a preset circular buffer; Based on the preset circular buffer, detection alarm information corresponding to the target processing result is generated.

8. A data packet inspection apparatus, characterized by It includes a first acquisition module, a storage module, a second acquisition module, a parallel processing module, and a generation module: The first acquisition module is used to acquire multiple network data packets from the network hardware; The storage module is used to store the plurality of network data packets into a virtual address space, and the graphics processor includes a plurality of computing units; The second acquisition module is used to acquire the load status of each computing unit in the multiple computing units of the graphics processor; The parallel processing module is used to process the multiple network data packets in parallel through the multiple computing units based on the load status of each computing unit, so as to obtain the target processing result corresponding to each network data packet. The generation module is used to generate detection alarm information for the target processing result corresponding to any network data packet if the target processing result of the network data packet is abnormal. The detection alarm information is used to indicate a security event notification.

9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions that, when executed by a processor, are used to implement the method described in any one of claims 1-7.

11. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-7.

Images