Packet scheduling method, feature library updating method, packet scheduling system and network edge device

Abstract

The application discloses a message scheduling method, a feature library updating method, a message scheduling system and a network edge device, and relates to the technical field of networks, and comprises the following steps: capturing data messages flowing through the network edge device and extracting plaintext feature information; matching the extracted plaintext feature information with records in a local first feature library; when the matching is successful, determining a target priority for forwarding scheduling based on a corresponding service category identifier; when no record is matched, forwarding at a default priority, and uploading the message or a feature digest thereof to an artificial intelligence server as a to-be-processed object; receiving a second feature library issued by the artificial intelligence server and updating the first feature library; the second feature library is obtained by updating the first feature library according to an analysis result of the to-be-processed object by using a large language model deployed by the artificial intelligence server. The application realizes automatic updating of a feature library relied on by new application traffic classification and priority allocation.

Description

Technical Field

[0001] This invention relates to the field of network technology, and in particular to a packet scheduling method, a feature database update method, a packet scheduling system, and a network edge device. Background Technology

[0002] With the diversification of network applications, network edge devices (such as routers and home gateways) need to simultaneously handle various types of data traffic, including games, audio and video, and file transfers. Different types of data traffic have significantly different requirements for network Quality of Service (QoS): real-time interactive traffic (such as online games and video conferencing) has high requirements for transmission latency and jitter, while non-real-time traffic (such as file downloads and system updates) is less sensitive to latency and can tolerate certain bandwidth limitations.

[0003] In existing technologies, QoS scheduling of data packets by network edge devices relies on manually pre-configured static classification rules, such as classifying and prioritizing data packets based on specific IP addresses, port numbers, or domain name keywords. When new application data streams appear in the network, the update of the feature library upon which the network edge device classifies and prioritizes these application data streams depends on manual operation, resulting in a low degree of automation. Summary of the Invention

[0004] This invention provides a message scheduling method, a feature database update method, a message scheduling system, and a network edge device to solve the technical problem that feature database updates, on which network edge devices rely, depend on manual operation and have a low degree of automation in the prior art.

[0005] In a first aspect, embodiments of the present invention provide a packet scheduling method applied to a network edge device, the method comprising: Capture data packets flowing through network edge devices and extract plaintext feature information from the data packets; The plaintext feature information is matched with records in the first feature library currently loaded by the network edge device; wherein each record in the first feature library defines the correspondence between specific plaintext feature information and specific service category identifier; When the plaintext feature information successfully matches a record in the first feature library, the service category identifier in that record is obtained, the target priority is determined based on the service category identifier, and the traffic scheduling unit forwards and schedules the data packet according to the target priority. When the plaintext feature information does not match any record in the first feature library, the traffic scheduling unit forwards the data packet according to the default priority; and identifies the data packet or the feature digest generated based on the data packet as the object to be processed, and uploads the object to be processed to the remote artificial intelligence server; receives the second feature library issued by the artificial intelligence server, and updates the first feature library using the second feature library; wherein, the second feature library is obtained by the artificial intelligence server using the deployed large language model to analyze the object to be processed, and updates the first feature library according to the analysis results.

[0006] Secondly, embodiments of the present invention provide a feature library update method applied to an artificial intelligence server, wherein the artificial intelligence server is used to connect to a network edge device, the network edge device including a network edge device implementing the above-described packet scheduling method, the method comprising: Receive objects to be processed uploaded by network edge devices; The object to be processed is input into a pre-deployed large language model to obtain the business category identifier corresponding to the object to be processed. A new record is generated, which defines the correspondence between the plaintext feature information of the object to be processed and the obtained business category identifier; The newly added records are incorporated into the first feature library to obtain the second feature library; The second feature library is distributed to the network edge device.

[0007] Thirdly, embodiments of the present invention provide a message scheduling system, including a network edge device and an artificial intelligence server; The network edge device is configured to capture data packets flowing through it, extract plaintext feature information from the data packets, match the plaintext feature information with records in a first feature library currently loaded by the network edge device, wherein each record in the first feature library defines a correspondence between specific plaintext feature information and a specific service category identifier; when the plaintext feature information matches a record in the first feature library, the service category identifier in that record is obtained, a target priority is determined based on the service category identifier, and the traffic scheduling unit forwards the data packets according to the target priority; when the plaintext feature information does not match any record in the first feature library, the traffic scheduling unit forwards the data packets according to a default priority; and identify the data packets or feature digests generated based on the data packets as objects to be processed, and upload the objects to be processed to the artificial intelligence server. The artificial intelligence server is used to analyze the object to be processed using a deployed large language model, and update the first feature library based on the analysis results to obtain a second feature library. The network edge device is also used to receive a second feature library from the artificial intelligence server and to update the first feature library using the second feature library.

[0008] Fourthly, embodiments of the present invention provide a network edge device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the packet scheduling method described above.

[0009] The beneficial effect of a technical solution provided by this invention is as follows: When a network edge device fails to match the plaintext feature information of a data packet in its local first feature library, it does not simply forward and schedule the data packet with the default priority. Instead, it synchronously identifies the data packet or a feature digest generated based on the data packet as an object to be processed and uploads it to an artificial intelligence server. The artificial intelligence server then analyzes the object to be processed using a deployed large language model, updates the first feature library based on the analysis results, and generates a second feature library. The network edge device receives the second feature library and uses it to update the first feature library. The synergistic effect between these technical features enables the network edge device to automatically trigger a closed-loop update process with the remote artificial intelligence server when it encounters a new application data stream that it cannot recognize locally. Thus, without manual intervention in configuring rules, the automatic updating of the feature library upon which the classification and priority allocation of new application data streams depend is achieved. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a schematic diagram of a message scheduling system according to an embodiment of the present invention; Figure 2 This is a flowchart of a message scheduling method according to an embodiment of the present invention; Figure 3 This is a flowchart of a feature library update method in one embodiment of the present invention; Figure 4 This is a schematic diagram of a network edge device in one embodiment of the present invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] The message scheduling method and feature database update method provided in this invention can be applied to, for example... Figure 1 The packet scheduling system shown includes network edge devices and an artificial intelligence (AI) server. These devices can communicate with each other via a network. Network edge devices are gateway devices located at the network edge, used to connect internal and external networks. These include, but are not limited to, routers, home gateways, enterprise access gateways, and wireless access points—network devices with data packet forwarding capabilities. Network edge devices carry network data packets initiated and received by smart terminals (i.e., intranet terminals). Smart terminals include, but are not limited to, personal computers, laptops, smartphones, tablets, smart TVs, and IoT devices. Network edge devices prioritize and forward data packets according to a preset Quality of Service (QoS) policy. An AI server is a server deployed in the cloud or a remote data center, capable of deploying and running large language models. It can be implemented using a standalone server or a server cluster. The artificial intelligence server communicates with one or more network edge devices via the network to receive objects to be processed uploaded by the network edge devices, uses a deployed large language model to intelligently analyze the objects to be processed, obtains the corresponding business category identifier, and generates an updated feature library based on the analysis results and feeds it back to the network edge devices, thereby enabling the network edge devices to adaptively identify and differentiate the scheduling of unknown application traffic.

[0014] Firstly, such as Figure 2 As shown, this embodiment of the invention provides a message scheduling method, which is applied to... Figure 1 Taking a network edge device as an example, the following steps are included: S101: Capture data packets flowing through network edge devices and extract plaintext feature information of the data packets.

[0015] As an example, a network edge device can use its built-in packet capture module (such as a packet recognizer) to capture all data packets flowing through its network interfaces in real time. Data packets include uplink data packets initiated by a smart terminal and sent to an external network, and downlink data packets received from an external network and forwarded to a smart terminal, or processed by the network edge device itself. During the packet capture process, the packet capture module does not perform decryption; it only extracts the plaintext information from the unencrypted portion of the data packet. The network edge device extracts plaintext feature information from the unencrypted portion of the captured data packet. Plaintext feature information refers to information that reflects the communication attributes or application characteristics of the data packet and can be obtained without decryption.

[0016] S102: Match the plaintext feature information with the records in the first feature library currently loaded by the network edge device; wherein each record in the first feature library defines the correspondence between specific plaintext feature information and specific service category identifier.

[0017] As an example, the network edge device loads a first feature library in its memory. This first feature library can be an initial feature library received and loaded by the network edge device from a remote AI server upon startup, or a currently used feature library formed after being replaced by a second feature library issued by the AI ​​server during use. The first feature library stores multiple mapping records, each defining a correspondence between a specific plaintext feature and a specific service category identifier.

[0018] In one implementation, the network edge device can compare the plaintext feature information extracted in step S101 with each record in the first feature database to determine whether there is a record that matches the plaintext feature information. When at least one feature in the plaintext feature information matches the feature information defined in a record in the first feature database, the network edge device determines that the match is successful; when none of the features in the plaintext feature information can be found to match in the first feature database, the network edge device determines that no record has been matched.

[0019] S103: When the plaintext feature information is successfully matched with a record in the first feature library, the business category identifier in the record is obtained, the target priority is determined based on the business category identifier, and the traffic scheduling unit forwards and schedules the data packets according to the target priority.

[0020] One possible implementation involves a network edge device (NAD) determining that its plaintext feature information matches a record in a first feature database. The NAD retrieves the corresponding service category identifier from that matching record. Based on the retrieved service category identifier, the NAD determines a target priority and submits a data packet carrying that target priority to a traffic scheduling unit. The traffic scheduling unit can be a QoS tool within the NAD, such as iptables or a tc queue. The traffic scheduling unit then schedules the forwarding of the data packet according to the target priority; that is, it can determine the forwarding order and bandwidth allocation of the data packet based on the target priority.

[0021] In this system, data packets with higher target priority are sent before those with lower target priority and receive more bandwidth resources during network congestion. This ensures that the data packet receives a transmission service quality commensurate with its service requirements. In other words, when bandwidth resources are limited, the traffic scheduling unit can prioritize allocating available bandwidth to data packets with higher target priority, thereby guaranteeing the transmission latency and jitter requirements of high-priority data packets and limiting the bandwidth consumption of low-priority data packets.

[0022] S104: When no record is matched in the first feature library for plaintext feature information, the traffic scheduling unit forwards and schedules the data packet according to the default priority; and identifies the data packet or the feature summary generated based on the data packet as the object to be processed, and uploads the object to be processed to the remote artificial intelligence server; receives the second feature library issued by the artificial intelligence server, and uses the second feature library to update the first feature library; wherein, the second feature library is obtained by the artificial intelligence server using the deployed large language model to analyze the object to be processed, and updating the first feature library according to the analysis results.

[0023] One possible approach is that when a network edge device determines that no record is matched in the first feature database for the plaintext feature information, the network edge device executes two parallel processing branches simultaneously.

[0024] In the first processing branch, the network edge device submits the data packet to the traffic scheduling unit, which then forwards and schedules the data packet according to a preset default priority. The default priority typically corresponds to a lower scheduling level to effectively prevent unidentified packets from affecting identified high-priority services.

[0025] In the second processing branch, the network edge device identifies the data packet or a feature summary generated based on the data packet as the object to be processed and uploads it to the artificial intelligence server. Upon receiving the object, the artificial intelligence server analyzes it using a deployed large language model and updates the first feature library based on the analysis results, generating a second feature library. The artificial intelligence server then distributes the generated second feature library to the network edge device. The network edge device receives the second feature library and uses it to update the currently loaded first feature library, completing the update of its local feature library.

[0026] As can be seen, through the above process, while ensuring the basic forwarding of unidentified packets, the network edge device collaborates with the remote artificial intelligence server to automatically update the feature database, enabling subsequent packets with the same characteristics to be accurately identified and given the corresponding priority scheduling, thus improving the automation level of packet scheduling.

[0027] It should be understood that updating the first feature library using the second feature library may include, but is not limited to: replacing the first feature library entirely with the second feature library; or appending new records to the first feature library based on the new records in the second feature library. The second feature library (i.e., the updated first feature library) is used for plaintext feature information matching of subsequently captured data packets.

[0028] In summary, the beneficial effects of a technical solution provided by this embodiment of the invention include: when a network edge device fails to match the plaintext feature information of a data packet in its local first feature library, it does not simply forward and schedule the data packet with the default priority. Instead, it simultaneously identifies the data packet or a feature digest generated based on the data packet as an object to be processed and uploads it to an artificial intelligence server. The artificial intelligence server then analyzes the object to be processed using a deployed large language model, updates the first feature library based on the analysis results, and generates a second feature library. The network edge device receives the second feature library and uses it to update the first feature library. The synergistic effect between these technical features enables the network edge device to automatically trigger a closed-loop update process with the remote artificial intelligence server when encountering new application data streams that cannot be recognized locally. Thus, without manual intervention in configuring rules, the automatic updating of the feature library upon which the classification and priority allocation of new application data streams depend is achieved.

[0029] Compared to existing technologies where feature library updates rely on manual operation, this solution significantly improves the automation level of feature library updates. Furthermore, this solution eliminates the need to decrypt encrypted data packets; it achieves business category identification simply by extracting plaintext feature information from the unencrypted portion of the data packet, ensuring user data privacy and security. In addition, deploying the large language model on a remote AI server effectively avoids the occupation and upgrade of embedded hardware resources on network edge devices, reducing implementation costs and deployment difficulty, and facilitating widespread application in existing network environments. Moreover, the AI ​​server can communicate with multiple network edge devices, and the updated second feature library can be simultaneously distributed to all associated network edge devices, achieving multi-device synchronous updates and further improving the efficiency and coverage of feature library updates. Through this solution, network edge devices can continuously and automatically learn and adapt to the ever-changing network application environment, effectively solving the problem in existing technologies where delayed feature library updates limit the matching effect between new application data stream scheduling priorities and business needs, thus improving overall network service quality and user experience.

[0030] In one embodiment, specifically step S101, which involves extracting the plaintext feature information of the data packet, the following steps are included: S111: Extract the first type of feature information of the data packet. The first type of feature information includes one or more of the following: source Internet Protocol address, destination Internet Protocol address, source port number, destination port number, and protocol type of the data packet. S112: When the data packet contains a Transport Layer Security Protocol (TLS) handshake message, extract the second type of feature information from the plaintext payload of the TLS handshake message. The second type of feature information includes a server name indication field, JA3 fingerprint feature, JA3S fingerprint feature, TLS version identifier, and one or more items from the list of cipher suites. S113: Use the second type of feature information and / or the first type of feature information as plaintext feature information.

[0031] As an example, the first type of feature information refers to general flow features applicable to all data packets, the extraction of which is independent of whether the data packet is encrypted. One implementation involves the network edge device parsing the Internet Protocol (IP) header of the data packet, reading the source IP address and destination IP address from the source IP address field and destination IP address field, respectively. The network edge device then determines the transport layer protocol type of the data packet: if the protocol type is Transmission Control Protocol (TCP), it parses the TCP header, reading the source port number and destination port number from the source port field and destination port field; if the protocol type is User Datagram Protocol (UDP), it parses the UDP header, reading the source port number and destination port number from the source port field and destination port field. The network edge device uses one or more of the extracted source IP address, destination IP address, source port number, destination port number, and identified transport layer protocol type as the first type of feature information. This first type of feature information reflects the basic network transmission attributes of the data packet, such as the network addresses of the communicating parties, the transport layer protocol used, and the session port.

[0032] For example, when a personal computer on an intranet (IP address 192.xxx.1.xxx) browses a webpage using the Hypertext Transfer Protocol (HTTP), it sends an HTTP request to an external news website server (IP address 93.xxx.216.xxx). After capturing this data packet, the network edge device parses its Internet Protocol (IP) header, extracting the source IP address as "192.xxx.1.xxx" and the destination IP address as "93.xxx.216.xxx". The network edge device identifies the transport layer protocol as Transmission Control Protocol (TCP), parses the TCP header, and extracts the source port number as "12345" and the destination port number as "80". The network edge device records the protocol type as "TCP". The above "192.xxx.1.xxx", "93.xxx.216.xxx", "12345", "80", and "TCP" together constitute the first type of characteristic information of this data packet.

[0033] One possible implementation involves a network edge device detecting whether a data packet contains a Transport Layer Security (TLS) handshake message. This detection can include: determining whether the destination port number of the data packet is 443, and combining this with a comprehensive assessment of whether the first few bytes of the data packet payload conform to the format characteristics of a TLS handshake message (e.g., the first byte being 0x16 indicates the handshake protocol type). When a TLS handshake message is detected in the data packet, the network edge device further extracts a second type of feature information from the plaintext payload of that TLS handshake message. Specifically, the network edge device parses the ClientHello and ServerHello messages: It extracts the server name indicator field value from the extended fields of the ClientHello message, i.e., the domain name of the target server the client expects to access; according to the JA3 fingerprint calculation method, it extracts the values ​​of five fields from the ClientHello message: transport layer security protocol version, cipher suite list, extended list, elliptic curve list, and elliptic curve format list. These values ​​are then concatenated in a predetermined order and their MD5 hash value is calculated to obtain the JA3 fingerprint feature string. Similarly, it extracts the values ​​of three fields from the ServerHello message: transport layer security protocol version, cipher suite, and extended list. These values ​​are then concatenated in a predetermined order and their MD5 hash value is calculated to obtain the JA3S fingerprint feature string. The transport layer security protocol version identifier is read from either the ClientHello or ServerHello message. The cipher suite list is extracted from the ClientHello message. The server name indicator field, JA3 fingerprint feature string, JA3S fingerprint feature string, transport layer security protocol version identifier, and one or more items from the cipher suite list extracted from the transport layer security protocol handshake message together constitute the second type of feature information. The second type of feature information is extracted from data packets encrypted by transport layer security protocols. It can obtain important information reflecting the identities and application characteristics of the communicating parties without decrypting the packet content.

[0034] For example, a smartphone (IP address 192.xxx.1.xxx) on the intranet launches an online game application. The game client establishes an encrypted connection with a remote game server (IP address 203.xxx.113.xxx). The network edge device captures a ClientHello datagram during this connection establishment process. Its destination port number is 443, and the first byte of the payload is 0x16. The network edge device extracts the following first type of characteristic information: source Internet Protocol address "192.xxx.1.xxx", destination Internet Protocol address "203.xxx.113.xxx", source port number "34567", destination port number "443", and protocol type "TCP". Because the data packet contains a Transport Layer Security (TLS) handshake message, the network edge device further extracts a second type of feature information: It extracts the server name indicator field from the extended fields of the ClientHello message, finding the value to be "game.example.com"; calculates the JA3 fingerprint feature string as "abc123xxx456"; reads the TLS version identifier as "TLS1.2"; and extracts the cipher suite list, which includes "TLS_ECDHE_RSA_WITH_AES_xxx_GCM_SHA256", etc. This information collectively constitutes the second type of feature information.

[0035] Furthermore, the network edge device uses the extracted second type of feature information and / or the first type of feature information as the plaintext feature information of the data packet. For unencrypted packets that do not contain transport layer security protocol handshake messages (such as the HTTP web browsing packet mentioned above), their plaintext feature information may only contain the first type of feature information. For encrypted packets that contain transport layer security protocol handshake messages (such as the game ClientHello packet mentioned above), their plaintext feature information may contain both the first type of feature information and the second type of feature information.

[0036] As can be seen, this embodiment achieves adaptive feature extraction for both encrypted and unencrypted messages by distinguishing the extraction conditions and content of the first type of feature information and the second type of feature information, and by illustrating this with specific examples.

[0037] Based on the above example, the following further explains the specific matching process in step S102 of matching plaintext feature information with records in the first feature database.

[0038] For example, in the aforementioned HTTP web browsing data packet, the plaintext feature information extracted by the network edge device includes the destination IP address "93.xxx.216.xxx" and the destination port number "80". The network edge device searches for a record in the first feature database with the feature type "destination IP address" and the feature value "93.xxx.216.xxx", but finds none; it continues searching for a record with the feature type "destination port number" and the feature value "80", but also finds none. Since this data packet does not contain a transport layer security protocol handshake message, there is no second type of feature information, such as a server name indication field, available for further matching. In this case, all features in the plaintext feature information fail to find matching feature information in the first feature database, and the network edge device determines that no record has been matched.

[0039] For example, in the ClientHello data packet of the aforementioned online game, the plaintext feature information extracted by the network edge device includes the server name indication field value "game.example.com". The network edge device compares this feature with the records in the first feature database and finds a record with the feature type "server name indication", the feature value "game.example.com", and the business category identifier "game". Since the feature information of the two is consistent, the network edge device determines that the match is successful.

[0040] It should be noted that the above are merely examples and do not constitute a limitation on the present invention.

[0041] In one embodiment, specifically step S103, which involves determining the target priority based on the business category identifier, the following steps are included: S131: Query the preset priority mapping table by business category identifier, obtain the priority value corresponding to the business category identifier, and use the priority value as the target priority.

[0042] The priority mapping table defines the correspondence between different business categories and their corresponding priority values. Business categories can include, but are not limited to, games, social networking, information retrieval, audio / video, shopping, file transfer, system, and other categories. The priority of each business category, from highest to lowest, is as follows: games, social networking, audio / video, information retrieval, shopping, file transfer, system, and other. Higher priority business categories correspond to lower priority values.

[0043] As an example, the specific meanings of each service category can be as follows: gaming services refer to real-time interactive game applications with high requirements for network transmission latency and jitter; social services refer to applications such as instant messaging and social network information stream refresh; audio and video services refer to applications such as streaming media playback, video conferencing, and live web broadcasting; information query services refer to applications such as web browsing, search engine queries, and news reading; shopping services refer to applications such as e-commerce and online shopping; file transfer services refer to applications such as file download, cloud storage synchronization, and online software updates; system services refer to system background traffic such as operating system updates, network time protocol synchronization, and device management signaling; other services refer to other network traffic that cannot be classified into the above seven categories.

[0044] The priority mapping table can be stored as a data structure in the storage unit of the network edge device. This priority mapping table defines a one-to-one correspondence between different service category identifiers and different priority values. The priority correspondence defined in the priority mapping table is as follows: game category corresponds to priority value "1"; social category corresponds to priority value "2"; audio and video category corresponds to priority value "3"; information query category corresponds to priority value "4"; shopping category corresponds to priority value "5"; file transfer category corresponds to priority value "6"; system category corresponds to priority value "7"; and other categories correspond to priority value "8". The smaller the priority value, the higher the corresponding scheduling priority.

[0045] In one implementation, the network edge device can use a service category identifier obtained from a first feature database matching record as the query basis to access a pre-set local priority mapping table, retrieve the priority value uniquely corresponding to the current service category identifier from the priority mapping table, and append this priority value as the target priority to the internal description structure of the data packet. The internal description structure can be the priority field in the socket buffer structure corresponding to the data packet in the operating system kernel, or it can be marking information that the flow control subsystem can recognize.

[0046] For example, if the matched service category identifier is "games," the network edge device uses "games" as the query criterion, accesses the priority mapping table, and obtains the priority value "1" corresponding to "games." The network edge device appends the priority value "1" as the target priority to the description structure of the data packet and submits the data packet to the traffic scheduling unit. The traffic scheduling unit reads the target priority value "1" and places the data packet into the highest priority transmission queue corresponding to the priority value "1," thereby ensuring that the game data packet receives priority transmission and more bandwidth resource guarantees.

[0047] For example, if the matched service category is identified as "file transfer", the network edge device obtains the corresponding priority value as "6". The traffic scheduling unit places the data packet into the lower priority sending queue corresponding to the priority value "6". This queue has a low scheduling weight and only gets a chance to be sent when there are no data packets to be sent in the high priority queue, thereby avoiding the impact of file transfer traffic on high priority services.

[0048] As can be seen, this embodiment achieves refined and differentiated scheduling of different service traffic by pre-setting a priority mapping table and clearly defining the correspondence between service categories and priority values.

[0049] In one embodiment, specifically step S104, which involves uploading the object to be processed to a remote artificial intelligence server, the following steps are included: S141: Start a scheduled task, which is configured with a time interval parameter.

[0050] One possible approach is for network edge devices to simultaneously launch a scheduled task when initiating packet collection and identification functions. This scheduled task is configured with a time interval parameter, the value of which determines the reporting frequency of the objects to be processed. The time interval parameter can be preset by the network administrator based on the actual network environment and business needs, or it can be dynamically adjusted by the AI ​​server via remote configuration commands to achieve a flexible reporting strategy.

[0051] S142: During a time interval of the scheduled task, all pending objects generated because the plaintext feature information does not match any record in the first feature database will be temporarily stored in the local cache area of ​​the network edge device.

[0052] One possible approach is for a network edge device to continuously extract and match features from captured data packets within a given time interval. When the plaintext features of a data packet do not match any record in the first feature database, the network edge device identifies the data packet itself, or a feature digest generated based on the key features extracted from the data packet, as a pending object and temporarily stores it in a local cache area. The local cache area can be a specially allocated buffer in memory or a temporary file in a storage device. Using feature digests effectively reduces the amount of data to be processed, thus lowering network bandwidth consumption during subsequent uploads.

[0053] S143: When the timed task reaches the end of the time interval period, all pending objects currently stored in the local cache area are packaged and encapsulated to obtain the encapsulated data packet.

[0054] One possible approach is that when the scheduled task reaches the end of its time interval, the network edge device retrieves all currently stored objects to be processed from its local cache, packages and encapsulates them according to a preset data exchange format, resulting in a packaged data packet. The packaging and encapsulation format can be JSON, Protocol Buffers, or a custom binary format. The packaged data packet contains plaintext characteristic information for each object to be processed, as well as necessary metadata information, such as the network edge device's device identifier and timestamp.

[0055] S144: Upload the encapsulated data packet to the artificial intelligence server via Hypertext Transfer Protocol or Secure Hypertext Transfer Protocol.

[0056] One possible approach is for a network edge device to upload encapsulated data packets via an HTTP POST request to a pre-configured AI server's designated network address (e.g., "https: / / www.my_ai_xxxx.com / api / upload") using a single network interface. The HTTPS protocol encrypts the transmitted content, ensuring the confidentiality and integrity of the data during public network transmission. After the upload operation is complete, the network edge device immediately clears its local cache and resets the scheduled task to begin accumulating data for the next time interval.

[0057] For example, a network edge device starts a scheduled task during system initialization, configured with a time interval of 600 seconds. During the first 600-second cycle, the network edge device detects multiple unidentified data packets and temporarily stores the feature summaries corresponding to these packets as objects to be processed in a memory buffer. When the scheduled task reaches its 600-second mark, the network edge device packages all objects to be processed in the buffer into a single JSON data packet and uploads it to the designated interface of the AI ​​server via a secure hypertext transfer protocol. After the upload is complete, the network edge device clears the buffer and begins accumulating data for the next 600-second cycle.

[0058] As can be seen, through the above-mentioned timed accumulation and batch upload mechanism, the network edge device effectively avoids initiating a network request for each unidentified data packet, reducing the communication frequency and network bandwidth overhead with the artificial intelligence server, and improving the overall operating efficiency.

[0059] Secondly, such as Figure 3 As shown, this embodiment of the invention provides a feature library update method, which is applied to... Figure 1Taking an artificial intelligence server as an example, the artificial intelligence server is used to connect to network edge devices. The network edge devices include those that implement the above-mentioned packet scheduling method, and include the following steps: S201: Receive the object to be processed uploaded by the network edge device.

[0060] One possible approach is for the AI ​​server to receive objects to be processed uploaded by network edge devices via a network interface. These objects are either the data packets uploaded by the network edge devices because no matching record was found in their local first feature database, or feature summaries extracted from these data packets. After receiving the objects, the AI ​​server can parse and preprocess them to extract the plaintext feature information contained within; this is not limited to specific methods.

[0061] It should be understood that the object to be processed may include one or more. When a network edge device accumulates multiple unidentified data packets within a time interval, the data packet it packages and uploads will contain multiple objects to be processed. After receiving the data packet, the artificial intelligence server can parse out the multiple objects to be processed and process them separately.

[0062] Furthermore, the AI ​​server can communicate with one network edge device or connect to multiple network edge devices simultaneously. When the AI ​​server is connected to multiple network edge devices, it can receive objects to be processed uploaded from each device and perform subsequent analysis and feature library update processing on each object.

[0063] S202: Input the object to be processed into the pre-deployed large language model to obtain the business category identifier corresponding to the object to be processed.

[0064] One possible approach is to pre-deploy a large language model on the artificial intelligence server. The large language model is a deep learning model with natural language understanding and generation capabilities, and can provide services externally through an application programming interface (API). The artificial intelligence server inputs the object to be processed received in step S201 into the large language model, and uses the semantic understanding capabilities of the large language model to analyze the plaintext feature information carried by the object to obtain the business category identifier corresponding to the object. The business category identifier is used to characterize the application business type to which the object belongs.

[0065] It should be understood that when the artificial intelligence server receives multiple objects to be processed, it can sequentially input each object into the large language model to obtain the business category identifier corresponding to each object.

[0066] It should be noted that when the AI ​​server communicates with at least two network edge devices simultaneously, the time it takes for different network edge devices to upload objects to be processed may vary. In this case, the AI ​​server can input the objects uploaded by each network edge device into the large language model for analysis and processing in batches or sequentially according to a preset interval (e.g., 10 minutes, 30 minutes, 60 minutes, 2 hours, or 1 day, etc., which is not limited here and can be set as needed) to obtain the business category identifier corresponding to each object. Through the above batch or sequential processing method, the AI ​​server can process objects from multiple network edge devices in an orderly manner, effectively avoiding instantaneous pressure on the large language model interface due to processing a large number of requests simultaneously, and ensuring the stability and response efficiency of the analysis and processing process.

[0067] For example, the AI ​​server communicates with a first network edge device, a second network edge device, and a third network edge device. The first network edge device uploads a data packet containing object A to be processed at time T1; the second network edge device uploads data packets containing objects B and C to be processed at time T2; and the third network edge device uploads a data packet containing object D to be processed at time T3, where T1, T2, and T3 are all different. After receiving the above objects to be processed, the AI ​​server, according to the order of receipt or a preset processing interval (e.g., processing a batch every 30 minutes), sequentially inputs objects A, B, C, and D into a large language model. The large language model analyzes the plaintext feature information carried by each object to obtain the corresponding business category identifier for each object.

[0068] It should be understood that when a single network edge device uploads a data packet containing multiple objects to be processed, the AI ​​server first processes all objects in that data packet sequentially before processing objects uploaded by other network edge devices, or processes objects in each data packet sequentially according to the order in which they are received. For example, if a data packet uploaded by a second network edge device at time T2 contains objects B and C to be processed, the AI ​​server first inputs object B into the large language model for analysis, then inputs object C into the large language model for analysis. After all objects in that data packet have been processed, it then continues processing object D uploaded by a third network edge device at time T3. This approach ensures that each object to be processed receives complete and orderly analysis and processing.

[0069] S203: Generate a new record. The new record defines the correspondence between the plaintext feature information of the object to be processed and the obtained business category identifier.

[0070] In one implementation, after the AI ​​server obtains the business category identifier corresponding to the object to be processed in step S202, it generates a new record. This new record defines the correspondence between the plaintext feature information carried by the object to be processed and the business category identifier obtained in step S202. The structure of the new record is consistent with the structure of existing records in the first feature library, so that it can be correctly parsed and used by network edge devices after being incorporated into the first feature library.

[0071] It should be understood that when the artificial intelligence server receives multiple objects to be processed, it can perform the analysis operation of step S202 on each object to be processed to obtain the business category identifier corresponding to each object to be processed, and generate corresponding new records for each object to be processed.

[0072] S204: The newly added record is merged into the first feature library to obtain the second feature library.

[0073] One possible implementation involves an AI server maintaining a full feature library, which serves as the currently valid first feature library. This first feature library stores the mapping relationship between plaintext feature information of all known applications and business category identifiers. The AI ​​server merges the newly added records generated in step S203 into this first feature library. The merging operation can be either appending the new records to the end of the feature library file or inserting them into the corresponding table in the feature library database. After merging the new records, the content of the first feature library is updated, including both existing mapping records and the newly added records; that is, the updated first feature library becomes the second feature library.

[0074] It should be understood that when the artificial intelligence server generates multiple new records, all new records can be merged into the first feature library to obtain the second feature library.

[0075] S205: Distribute the second feature library to network edge devices.

[0076] One possible approach is for the AI ​​server, after generating a second feature library, to distribute it to the network edge devices with which it has a communication connection. The distribution can be implemented using an active push mode, where the AI ​​server proactively establishes connections with each network edge device and pushes the second feature library file; or a passive pull mode, where the network edge devices periodically send query requests to the AI ​​server, and download the second feature library file when they confirm that the version of the second feature library is higher than the currently used version of the first feature library. Upon receiving the second feature library, the network edge devices use it to update their currently loaded first feature library, completing the synchronization update of their local feature libraries.

[0077] It should be understood that when an AI server communicates with multiple network edge devices, it can simultaneously distribute the second feature library to all associated network edge devices, achieving the effect of updating once and synchronizing multiple devices.

[0078] In summary, the beneficial effects of the technical solution provided by this embodiment of the invention are as follows: An artificial intelligence server receives objects to be processed uploaded by network edge devices due to a failure to match the local first feature library. The server inputs these objects into a pre-deployed large language model for semantic-level analysis, automatically obtaining the business category identifier corresponding to the object. It then generates a new record defining the correspondence between the plaintext feature information of the object and the business category identifier. This new record is then merged into the first feature library to form an updated second feature library, which is finally distributed to the network edge devices. The synergistic effect of these technical features enables the artificial intelligence server to automatically receive and analyze unknown application data streams reported by network edge devices, and to convert the analysis results into structured feature mapping records, feeding them back to the network edge devices. This forms a closed-loop update mechanism of "receiving—analyzing—generating—merging—distributing." Therefore, without manual intervention in rule configuration, automated updates to the feature library relied upon by network edge devices are achieved, collaboratively solving the technical problems of low automation and reliance on manual operation in feature library updates in existing technologies.

[0079] Furthermore, leveraging the powerful semantic understanding capabilities of the large language model to analyze the objects to be processed effectively improves the accuracy of business category classification and reduces the false positive rate. By periodically receiving and analyzing the objects to be processed reported by network edge devices, the AI ​​server can continuously generate new records and dynamically update the feature library, enabling the feature library to continuously evolve with changes in network applications, demonstrating strong adaptability. Network edge devices can directly call their own native quality of service tools to execute scheduling strategies without requiring large-scale modifications to the underlying architecture, resulting in strong compatibility and ease of implementation. The large language model is deployed on a remote server, and network edge devices only need to run lightweight feature extraction and matching functions, avoiding the occupation of embedded hardware resources and the need for upgrades, resulting in low hardware costs and easy deployment. In addition, the AI ​​server can connect to multiple network edge devices, enabling the simultaneous distribution of the updated second feature library to all associated devices, achieving a highly efficient collaborative effect of one-time identification and simultaneous updates across multiple devices.

[0080] In one embodiment, specifically in step S202, which involves inputting the object to be processed into a pre-deployed large language model to obtain the business category identifier corresponding to the object to be processed, the following steps are included: S221: Extract target identification information from the object to be processed. The target identification information is contained in the plaintext feature information. S222: Construct analysis prompt instructions based on target identification information, and input the analysis prompt instructions into the large language model to request the large language model to classify the target identification information into business attributes; S223: Receive the dialogue response returned by the large language model, and extract the business category description corresponding to the target identifier information from the dialogue response; S224: Based on the preset category label mapping rules, convert the extracted business category descriptions into business category identifiers.

[0081] One possible approach is for the AI ​​server to first extract target identification information from the object to be processed. This target identification information is contained within the plaintext feature information of the object and is used to characterize the business attributes carried by the object. The target identification information can be a domain name string in the server name indicator field, a query domain name string in the Domain Name System query message, or a combination of a specific destination Internet Protocol address and a destination port number, etc.

[0082] Then, the AI ​​server constructs analysis prompts based on the extracted target identification information. Specifically, it can obtain a preset prompt template, fill the target identification information into the corresponding position of the prompt template, generate a complete analysis prompt, and input the analysis prompt into the large language model to request the large language model to classify the target identification information into business attributes.

[0083] After receiving the analysis prompt, the large language model classifies and judges the target identification information based on its semantic understanding capabilities, and generates a corresponding dialogue response to return to the artificial intelligence server. The artificial intelligence server receives the dialogue response returned by the large language model and extracts the business category description text corresponding to the target identification information from the dialogue response.

[0084] Finally, the AI ​​server converts the extracted business category description text into business category identifiers that can be directly scheduled by network edge devices, based on preset category label mapping rules. The category label mapping rules define the mapping relationship between business category description text and business category identifiers; for example, mapping "games" to the "games" category identifier, and mapping "video" to the "audio-video" category identifier, etc.

[0085] As can be seen, this embodiment realizes intelligent business classification of the objects to be processed.

[0086] In one embodiment, specifically step S222, which involves constructing an analysis prompt instruction based on the target identification information, the following steps are included: S2221: Obtain a preset prompt template, which includes a first prompt text, a second prompt text, and a placeholder for embedding the content to be analyzed; S2222: Fill the placeholder with the target identification information to obtain the analysis prompt instruction containing the target identification information, the first prompt text, and the second prompt text.

[0087] As an example, the first prompt text defines the analytical role of the large language model, setting its identity and context for this analysis task and guiding it to make judgments from a specific professional perspective. The second prompt text defines the output format of the large language model, constraining its responses to contain only category names and excluding any explanatory text or punctuation, ensuring the conciseness and parsability of the output. Placeholders are variable parts of the template, used to be replaced with actual target identification information each time a specific instruction is constructed.

[0088] For example, a preset prompt template could be designed as: "System Role: You are a network traffic analysis expert. Please determine the business category based on the following target information. Output Requirements: Return only the category name, without explanation. Target Information: {{target}}". Here, "{{target}}" is a placeholder. If the extracted target identifier information is the domain name "game.example.com", it is filled into the placeholder, and the generated analysis prompt instruction is: "System Role: You are a network traffic analysis expert. Please determine the business category based on the following target information. Output Requirements: Return only the category name, without explanation. Target Information: game.example.com". After this analysis prompt instruction is sent to the large language model, the large language model will assume the role of a traffic analysis expert based on the first prompt text and output only the category name based on the constraints of the second prompt text, thereby obtaining a business category description corresponding to the target identifier information.

[0089] As can be seen, this implementation achieves standardized construction of analysis prompts by using preset prompt templates and placeholder filling, thus ensuring the controllability and consistency of the output of the large language model.

[0090] In summary, the following example will further illustrate the above process: The AI ​​server receives a data entry for a process from a network edge device. This data entry is a feature digest containing a Domain Name System (DNS) query. The AI ​​server extracts the target identifier from the plaintext feature information of the data entry to obtain the query domain name string "game.qq.com".

[0091] The AI server obtains a preset prompt template. The first prompt text of this prompt template is: "You are an expert in DNS packet analysis. Please determine which of the following categories the domain name queried in the DNS query packet belongs to: game, chat, filetrans, system. Only return the category name without explanation." The AI server fills the target identification information "game.qq.com" into the prompt template to generate the user's question content: "Analyze this DNS query packet: Which category does the domain name game.qq.com belong to among game, chat, filetrans, and system?" The AI server encapsulates the above prompt text and the user's question content into an analysis prompt instruction according to the large language model interface specification, and sends it to the large language model interface through an HTTP POST request.

[0092] After receiving the analysis prompt instruction, the large language model classifies the business attributes of the target identification information "game.qq.com" and determines that this domain name belongs to the game business category. The large language model returns a conversation response in the following format: { "id": "chatcmpl-xxx", "object": "chat.completion", "choices": { "index": 0, "message": { "role": "assistant", "content": "game" }, "finish_reason": "stop" } } The AI server receives this conversation response and extracts the business category description text "game" from the "choices[0].message.content" field. According to the preset category label mapping rules, "game" is converted into a standardized business category identifier "Game".

[0093] It should be noted that the above is only an example and does not constitute a limitation to the present invention. <0ooooo244>

[0094] In one embodiment, that is, before step S204, that is, when the AI server is used to connect to multiple network edge devices and before incorporating the new record into the first feature library, the following steps are further included: ​S204A: Retrieve each new record generated from the objects to be processed uploaded by multiple network edge devices; S204B: Perform deduplication on each new record, removing redundant records that have the same plaintext feature information and business category identifier, to obtain a deduplicated set of new records.

[0095] Among them: Incorporating newly added records into the first feature library includes: incorporating each newly added record in the deduplicated set of newly added records into the first feature library.

[0096] In one feasible approach, in practical deployment scenarios, the AI ​​server typically communicates with multiple network edge devices. Smart terminals on different network edge devices may simultaneously access the same newly emerging application service. In this case, each network edge device will determine that the data packet corresponding to the application service has failed to match and will upload the corresponding pending object to the AI ​​server.

[0097] After receiving objects to be processed from multiple network edge devices, the AI ​​server performs analysis operations on each object, generating multiple new records. Since these objects correspond to the same application service, their plaintext feature information (such as the server name indicator field value) is identical, and the business category identifiers obtained from the analysis are also the same. Therefore, the generated multiple new records have completely identical plaintext feature information and business category identifiers, forming redundant records.

[0098] To avoid writing duplicate records to the feature database, the AI ​​server first retrieves all new records generated from the objects to be processed uploaded by these multiple network edge devices before incorporating them into the first feature database. Then, it performs deduplication on each new record. The deduplication criterion is: if two new records have identical plaintext feature information and business category identifiers, they are considered redundant. The AI ​​server removes the redundant records, retaining only one, resulting in the deduplicated set of new records.

[0099] Finally, the AI ​​server merges each new record in the deduplicated set of new records into the first feature library to form the second feature library, and then distributes the second feature library to each network edge device.

[0100] For example, the AI ​​server is connected to both a first network edge device and a second network edge device. The smart terminals of both network edge devices access the same newly launched video streaming service, with the server name indicator field showing "new-video.example.com". The first and second network edge devices upload the objects to be processed corresponding to this service to the AI ​​server. After analyzing each object using a large language model, the AI ​​server generates two new records with identical content: one with the feature type "server name indicator", the feature value "new-video.example.com", and the business category identifier "audio / video". Before merging these two new records into the first feature library, the AI ​​server performs deduplication on these two new records, removing one redundant record and retaining only one. Then, the AI ​​server merges this retained new record into the first feature library, forming a second feature library, and simultaneously distributes the second feature library to both the first and second network edge devices.

[0101] As can be seen, the above deduplication process effectively avoids duplicate records in the feature library caused by multiple network edge devices reporting the same unknown application traffic, thereby improving the storage efficiency of the feature library and subsequent matching performance.

[0102] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0103] Thirdly, such as Figure 1 As shown, this embodiment of the invention provides a message scheduling system, which includes a network edge device and an artificial intelligence server; The network edge device is configured to capture data packets flowing through it, extract plaintext feature information from the data packets, match the plaintext feature information with records in a first feature library currently loaded by the network edge device, wherein each record in the first feature library defines a correspondence between specific plaintext feature information and a specific service category identifier; when the plaintext feature information matches a record in the first feature library, the service category identifier in that record is obtained, a target priority is determined based on the service category identifier, and the traffic scheduling unit forwards the data packets according to the target priority; when the plaintext feature information does not match any record in the first feature library, the traffic scheduling unit forwards the data packets according to a default priority; and identify the data packets or feature digests generated based on the data packets as objects to be processed, and upload the objects to be processed to the artificial intelligence server. The artificial intelligence server is used to update the first feature library based on the object to be processed using a pre-deployed large language model to obtain a second feature library; The network edge device is also used to receive a second feature library from the artificial intelligence server and to update the first feature library using the second feature library.

[0104] In one embodiment, extracting the plaintext feature information of the data packet includes: Extract the first type of feature information of the data packet, which includes one or more of the following: source Internet Protocol address, destination Internet Protocol address, source port number, destination port number, and protocol type of the data packet; When the data packet contains a Transport Layer Security Protocol (TLS) handshake message, a second type of feature information is extracted from the plaintext payload of the TLS handshake message. The second type of feature information includes a server name indication field, JA3 fingerprint feature, JA3S fingerprint feature, TLS version identifier, and one or more items from the cipher suite list. The second type of feature information and / or the first type of feature information are used as plaintext feature information.

[0105] In one embodiment, determining the target priority based on the business category identifier includes: The priority mapping table is queried using the business category identifier to obtain the priority value corresponding to the business category identifier, and the priority value is used as the target priority; wherein, the priority mapping table defines the correspondence between different business categories and priority values; The business categories include games, social networking, information query, audio and video, shopping, file transfer, and system categories, and the priority of the business categories from high to low is as follows: games, social networking, audio and video, information query, shopping, file transfer, and system categories. Among them, the higher the priority of a business category, the smaller the priority value.

[0106] In one embodiment, uploading the object to be processed to a remote artificial intelligence server includes: Start a scheduled task, which is configured with a time interval parameter; During a time interval of the scheduled task, all objects to be processed generated because the plaintext feature information does not match any record in the first feature library are temporarily stored in the local cache area of ​​the network edge device. When the timed task reaches the end of the time interval period, all the objects to be processed currently stored in the local cache area are packaged and encapsulated to obtain the encapsulated data packet; The encapsulated data packet is uploaded to the artificial intelligence server via Hypertext Transfer Protocol or Secure Hypertext Transfer Protocol.

[0107] In one embodiment, updating the first feature library based on the object to be processed using a pre-deployed large language model to obtain a second feature library includes: Receive objects to be processed uploaded by network edge devices; The object to be processed is input into a pre-deployed large language model to obtain the business category identifier corresponding to the object to be processed. A new record is generated, which defines the correspondence between the plaintext feature information of the object to be processed and the obtained business category identifier; The newly added records are incorporated into the first feature library to obtain the second feature library; The second feature library is distributed to the network edge device.

[0108] In one embodiment, the step of inputting the object to be processed into a pre-deployed large language model to obtain the business category identifier corresponding to the object to be processed includes: Extract target identification information from the object to be processed, wherein the target identification information is contained in plaintext feature information; An analysis prompt instruction is constructed based on the target identification information, and the analysis prompt instruction is input into the large language model to request the large language model to classify the target identification information into business attributes; Receive the dialogue response returned by the large language model, and extract the business category description corresponding to the target identifier information from the dialogue response; Based on the preset category label mapping rules, the extracted business category descriptions are converted into business category identifiers.

[0109] In one embodiment, constructing the analysis prompt instruction based on the target identification information includes: Obtain a preset prompt template, which includes a first prompt text, a second prompt text, and a placeholder for embedding the content to be analyzed; wherein, the first prompt text is used to limit the analysis role of the large language model, and the second prompt text is used to limit the output of the large language model to include only the category name and not the explanation content; The target identification information is filled into the placeholder to obtain an analysis prompt instruction containing the target identification information, the first prompt text, and the second prompt text.

[0110] In one embodiment, when the artificial intelligence server is used to connect to multiple network edge devices, the artificial intelligence server is further used to: Retrieve each of the newly added records generated from the objects to be processed uploaded by the multiple network edge devices; Perform deduplication on each of the newly added records, and remove redundant records in which the plaintext feature information and the business category identifier are the same, to obtain a set of deduplicated new records; The step of incorporating the newly added record into the first feature library includes: incorporating each newly added record in the deduplicated set of newly added records into the first feature library.

[0111] It should be noted that the specific limitations of the message scheduling system can be found in the limitations of the message scheduling method and / or feature database update method mentioned above, and will not be repeated here.

[0112] Thirdly, embodiments of the present invention provide a network edge device, which may be a server, and its internal structure diagram may be as follows. Figure 4 As shown, the network edge device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database contains data required for executing a message scheduling method. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps of a message scheduling method.

[0113] In one embodiment, the present invention provides a network edge device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the packet scheduling method described in the above embodiment, such as steps S101-S104 and their sub-steps. To avoid repetition, these will not be described again here.

[0114] In one embodiment, the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the message scheduling method described in the above embodiments, such as steps S101-S104 and their sub-steps. Alternatively, when the computer program is executed by a processor, it implements the feature database update method described in the above embodiments, such as steps S201-S205 and their sub-steps, and S204A-S204B. To avoid repetition, these will not be repeated here.

[0115] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0116] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0117] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A message scheduling method, characterized in that, Applied to network edge devices, the method includes: Capture data packets flowing through network edge devices and extract plaintext feature information from the data packets; The plaintext feature information is matched with records in the first feature library currently loaded by the network edge device; wherein each record in the first feature library defines the correspondence between specific plaintext feature information and specific service category identifier; When the plaintext feature information successfully matches a record in the first feature library, the service category identifier in that record is obtained, the target priority is determined based on the service category identifier, and the traffic scheduling unit forwards and schedules the data packet according to the target priority. When the plaintext feature information does not match any record in the first feature library, the traffic scheduling unit forwards the data packet according to the default priority; and identifies the data packet or the feature digest generated based on the data packet as the object to be processed, and uploads the object to be processed to the remote artificial intelligence server; receives the second feature library issued by the artificial intelligence server, and updates the first feature library using the second feature library; wherein, the second feature library is obtained by the artificial intelligence server using the deployed large language model to analyze the object to be processed, and updates the first feature library according to the analysis results.

2. The method according to claim 1, characterized in that, The extraction of plaintext feature information from the data packet includes: Extract the first type of feature information of the data packet, which includes one or more of the following: source Internet Protocol address, destination Internet Protocol address, source port number, destination port number, and protocol type of the data packet; When the data packet contains a Transport Layer Security Protocol (TLS) handshake message, a second type of feature information is extracted from the plaintext payload of the TLS handshake message. The second type of feature information includes a server name indication field, JA3 fingerprint feature, JA3S fingerprint feature, TLS version identifier, and one or more items from the cipher suite list. The second type of feature information and / or the first type of feature information are used as plaintext feature information.

3. The method according to claim 1, characterized in that, The step of determining the target priority based on the business category identifier includes: The priority mapping table is queried using the business category identifier to obtain the priority value corresponding to the business category identifier, and the priority value is used as the target priority; wherein, the priority mapping table defines the correspondence between different business categories and priority values; The business categories include games, social networking, information query, audio and video, shopping, file transfer, and system categories, and the priority of the business categories from high to low is as follows: games, social networking, audio and video, information query, shopping, file transfer, and system categories. Among them, the higher the priority of a business category, the smaller the priority value.

4. The method according to claim 1, characterized in that, Uploading the object to be processed to a remote artificial intelligence server includes: Start a scheduled task, which is configured with a time interval parameter; During a time interval of the scheduled task, all objects to be processed generated because the plaintext feature information does not match any record in the first feature library are temporarily stored in the local cache area of ​​the network edge device. When the timed task reaches the end of the time interval period, all the objects to be processed currently stored in the local cache area are packaged and encapsulated to obtain the encapsulated data packet; The encapsulated data packet is uploaded to the artificial intelligence server via Hypertext Transfer Protocol or Secure Hypertext Transfer Protocol.

5. A feature library update method, characterized in that, Applied to an artificial intelligence server, the artificial intelligence server is used to connect to a network edge device, the network edge device including a network edge device implementing the packet scheduling method according to any one of claims 1 to 4, the method comprising: Receive objects to be processed uploaded by network edge devices; The object to be processed is input into a pre-deployed large language model to obtain the business category identifier corresponding to the object to be processed. A new record is generated, which defines the correspondence between the plaintext feature information of the object to be processed and the obtained business category identifier; The newly added records are incorporated into the first feature library to obtain the second feature library; The second feature library is distributed to the network edge device.

6. The method according to claim 5, characterized in that, The step of inputting the object to be processed into a pre-deployed large language model to obtain the business category identifier corresponding to the object to be processed includes: Extract target identification information from the object to be processed, wherein the target identification information is contained in plaintext feature information; An analysis prompt instruction is constructed based on the target identification information, and the analysis prompt instruction is input into the large language model to request the large language model to classify the target identification information into business attributes; Receive the dialogue response returned by the large language model, and extract the business category description corresponding to the target identifier information from the dialogue response; Based on the preset category label mapping rules, the extracted business category descriptions are converted into business category identifiers.

7. The method according to claim 6, characterized in that, The step of constructing analysis prompts based on the target identification information includes: Obtain a preset prompt template, which includes a first prompt text, a second prompt text, and a placeholder for embedding the content to be analyzed; wherein, the first prompt text is used to limit the analysis role of the large language model, and the second prompt text is used to limit the output of the large language model to include only the category name and not the explanation content; The target identification information is filled into the placeholder to obtain an analysis prompt instruction containing the target identification information, the first prompt text, and the second prompt text.

8. The method according to claim 5, characterized in that, When the artificial intelligence server is used to connect to multiple network edge devices, before incorporating the new record into the first feature library, the method further includes: Retrieve each of the newly added records generated from the objects to be processed uploaded by the multiple network edge devices; Perform deduplication on each of the newly added records, and remove redundant records in which the plaintext feature information and the business category identifier are the same, to obtain a set of deduplicated new records; The step of incorporating the newly added record into the first feature library includes: incorporating each newly added record in the deduplicated set of newly added records into the first feature library.

9. A message scheduling system, characterized in that, This includes network edge devices and artificial intelligence servers; The network edge device is configured to capture data packets flowing through it, extract plaintext feature information from the data packets, match the plaintext feature information with records in a first feature library currently loaded by the network edge device, wherein each record in the first feature library defines a correspondence between specific plaintext feature information and a specific service category identifier; when the plaintext feature information matches a record in the first feature library, the service category identifier in that record is obtained, a target priority is determined based on the service category identifier, and the traffic scheduling unit forwards the data packets according to the target priority; when the plaintext feature information does not match any record in the first feature library, the traffic scheduling unit forwards the data packets according to a default priority; and identify the data packets or feature digests generated based on the data packets as objects to be processed, and upload the objects to be processed to the artificial intelligence server. The artificial intelligence server is used to analyze the object to be processed using a deployed large language model, and update the first feature library based on the analysis results to obtain a second feature library. The network edge device is also used to receive a second feature library from the artificial intelligence server and to update the first feature library using the second feature library.

10. A network edge device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the message scheduling method as described in any one of claims 1 to 4.

Images