Service classification method and apparatus, internet system

Abstract

The application discloses a service classification method and device and an Internet system, and belongs to the technical field of Internet. The service classification method comprises the following steps: determining n data stream groups in a plurality of data streams; determining a service pair corresponding to each data stream group in the n data stream groups, so as to obtain a plurality of service pairs; determining an interval corresponding to each service pair in the plurality of service pairs, wherein the interval corresponding to each service pair comprises an interval between start times of data streams corresponding to two services in each service pair in the same data stream group; determining whether the services in each service pair are associated based on the interval corresponding to each service pair, so as to obtain an association relationship of the services in each service pair; and classifying a plurality of services in the plurality of service pairs based on the association relationship of the services in each service pair in the plurality of service pairs. The application can classify a plurality of services, so that the management of the Internet system can be realized based on the classification result.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet, in particular to a service classification method and device, and an Internet system. BACKGROUND

[0002] The Internet system comprises a forwarding device, and a client and a server connected with the forwarding device, wherein the server provides services to the client through the forwarding device.

[0003] When the server provides services to the client, the server and the client transmit data streams corresponding to the services through the forwarding device.

[0004] At present, there are many types of services provided by the server to the client, therefore, in order to manage the Internet system, a method for classifying services is urgently needed. SUMMARY

[0005] The present application provides a service classification method and device, and an Internet system, which can classify services, and the technical solution is as follows:

[0006] In a first aspect, a service classification method is provided, which comprises: determining n data stream groups in a plurality of data streams, n≥1, each data stream group in the n data stream groups corresponding to one client and at least two services, and different data stream groups corresponding to different clients; determining service pairs corresponding to each data stream group in the n data stream groups to obtain a plurality of service pairs, each service pair corresponding to each data stream group comprising: any two services corresponding to each data stream group; determining intervals corresponding to each service pair in the plurality of service pairs, the interval corresponding to each service pair comprising: an interval of start times of data streams corresponding to two services in each service pair in the same data stream group, the start time of a data stream being a time when the forwarding device receives the data stream; determining whether the services in each service pair are associated based on the interval corresponding to each service pair to obtain an association relationship of the services in each service pair; and classifying the services in the plurality of service pairs based on the association relationship of the services in each service pair in the plurality of service pairs.

[0007] In the service classification method provided by the present application, the service classification device can determine whether the services in each service pair are associated based on the interval corresponding to each service pair to obtain an association relationship of the services in each service pair, and then classify the services in the plurality of service pairs based on the association relationship of the services in each service pair in the plurality of service pairs. Thus, the classification of services is realized, and the management of the Internet system is realized based on the classification result of the services.

[0008] Optionally, the determining whether the services in each service pair are associated based on the intervals corresponding to the service pair comprises: determining a set of intervals in the intervals corresponding to the service pair that are less than a first time threshold; determining a frequency of each interval in the set of intervals; determining q intervals in the set of intervals whose frequencies exceed a frequency threshold, q≥1; determining a maximum interval and a minimum interval in the q intervals; and determining that the two services in the service pair are associated when a difference between the maximum interval and the minimum interval is less than a second time threshold.

[0009] It can be seen that the two services are associated only when the start times of the two services are similar. In the embodiment of the present application, the first time threshold, the second time threshold and the frequency threshold are used to determine whether the two services are associated. Alternatively, other methods can be used to determine whether the two services are associated, for example, when the number of intervals in the intervals corresponding to the service pair that are less than the first time threshold is greater than a number threshold, it is determined that the two services in the service pair are associated.

[0010] Optionally, the frequency threshold Y=E+k*A, where E represents the median of the frequencies of the set of intervals, A represents the absolute median difference of the frequencies of the set of intervals, and k represents a constant. Of course, the frequency threshold can also be other numerical values, such as numerical values input by staff into the service classification device.

[0011] Optionally, the classifying the plurality of services based on the association relationship of the services in each service pair in the plurality of service pairs comprises: determining p service groups in the plurality of services based on the association relationship of the services in each service pair in the plurality of service pairs, the service group comprising at least two services in the plurality of services that are associated with each other, p≥1; determining an associated service set of each service in the plurality of services based on the p service groups, the associated service set comprising services in the service group in which the service is located that are associated with the service; and classifying the plurality of services based on the similarity of the associated service sets of the plurality of services.

[0012] Optionally, the determining the p service groups from the plurality of services based on the association relationship between services in each service pair in the plurality of service pairs comprises: determining at least one associated service pair from the plurality of service pairs based on the association relationship between services in each service pair in the plurality of service pairs, the two services in the associated service pair being associated; generating an undirected graph based on the plurality of services and the at least one associated service pair, wherein the undirected graph comprises a plurality of nodes corresponding to the plurality of services and at least one edge corresponding to the at least one associated service pair, and the nodes are used to represent the corresponding services and the edges are used to connect the two nodes corresponding to the corresponding associated service pair; determining p maximal cliques in the undirected graph, the maximal clique comprising a plurality of nodes connected by edges; and determining the p service groups corresponding to the p maximal cliques, the nodes in the maximal clique corresponding to the services in the corresponding service group.

[0013] Optionally, before the classifying the plurality of services based on the similarity of the associated service sets of the plurality of services, the method further comprises: determining the similarity of the two associated service sets of any two services in the plurality of services based on the intersection-over-union of the two associated service sets. In the embodiment of the application, the similarity is determined based on the intersection-over-union, but other ways of determining the similarity are also possible, which are not limited in the embodiment of the application.

[0014] Optionally, the classifying the plurality of services based on the similarity of the associated service sets of the plurality of services comprises: generating a similarity matrix of the plurality of services based on the similarity of the associated service sets of the plurality of services, wherein the similarity matrix comprises m rows and m columns of elements, and the element in the ith row and the jth column is used to represent the similarity of the associated service set of the ith service in the plurality of services and the associated service set of the jth service, 1≤i≤m, 1≤j≤m; and clustering the similarity matrix to obtain the classification result of the plurality of services. Optionally, the service classification device can use a spectral clustering algorithm (or other algorithms for clustering based on a similarity matrix, such as K-Means or DBSCAN, etc.) to cluster the similarity matrix.

[0015] Optionally, after the clustering the similarity matrix to obtain the classification result of the plurality of services, the method further comprises: detecting whether the accuracy of the classification result of the plurality of services is less than or equal to an accuracy threshold; and when the accuracy of the classification result is less than or equal to the accuracy threshold, repeating the process of clustering the similarity matrix to obtain the classification result of the plurality of services. In this way, the accuracy of the classification of the plurality of services can be improved through multiple verifications.

[0016] Optionally, the determining the interval corresponding to each service pair in the plurality of service pairs comprises: ranking the plurality of services; and determining the interval corresponding to each service pair in the plurality of service pairs based on the ranking of the plurality of services. As can be seen, after ranking the plurality of services, when determining the interval corresponding to each service pair, it is only necessary to subtract the start time of the data stream corresponding to the service in the front from the start time of the data stream corresponding to the service in the back. In this way, it is possible to avoid the situation that the interval is determined repeatedly by subtracting the start time of the data stream corresponding to the service in the front from the start time of the data stream corresponding to the service in the back, and by subtracting the start time of the data stream corresponding to the service in the back from the start time of the data stream corresponding to the service in the front.

[0017] Optionally, the determining the interval corresponding to each service pair in the plurality of service pairs based on the ranking of the plurality of services comprises: determining the interval T pq p q corresponding to each service pair, wherein the each service pair comprises a pth service and a qth service in the plurality of services, p>q≥1, and the T p represents the start time of any data stream corresponding to the pth service in one data stream group corresponding to the each service pair, and the T q represents the start time of any data stream corresponding to the qth service in the one data stream group.

[0018] Optionally, the method further comprises: determining a client set corresponding to each service in the plurality of services, wherein the client set corresponding to the each service comprises a client corresponding to the data stream corresponding to the each service; classifying the plurality of services based on the similarity of the client sets corresponding to the plurality of services; and adjusting the result of classifying the plurality of services based on the association relationship between the services in each service pair in the plurality of service pairs, according to the result of classifying the plurality of services based on the similarity of the client sets.

[0019] For example, assuming that in the result of classifying the plurality of services based on the similarity of the client sets, two services are classified into the same class, while in the result of classifying the plurality of services based on the association relationship between the services in each service pair in the plurality of service pairs, the two services are not classified into the same class. Then the service classification device can adjust the result of classifying the plurality of services based on the association relationship between the services in each service pair in the plurality of service pairs, so as to make the two services be classified into the same class.

[0020] ​​Optionally, the method further comprises: obtaining domain names corresponding to each service in the plurality of services; classifying the plurality of services based on similarity of the domain names corresponding to the plurality of services; and after classifying the plurality of services based on the association between services in each service pair in the plurality of service pairs, adjusting the result of classifying the plurality of services based on the similarity of the domain names corresponding to the plurality of services.

[0021] For example, assuming that in the result of classifying services based on similarity of domain names, two services are classified into the same class, while in the result of classifying services based on the association between services in each service pair in the plurality of service pairs, the two services are not classified into the same class. The service classification device can adjust the result of classifying services based on the association between services in each service pair in the plurality of service pairs, so that the two services are classified into the same class.

[0022] In this way, the service classification device can classify services based on multiple classification methods, and reference the classification results of these methods to each other, so that the classification results of the plurality of services are more accurate.

[0023] In a second aspect, a service classification apparatus is provided, which has the function of implementing the service classification method in the first aspect. The service classification apparatus comprises at least one module for implementing the service classification method provided in the first aspect.

[0024] In a third aspect, a service classification apparatus is provided, which comprises at least one processor, at least one interface, a memory, and at least one communication bus. The processor is configured to execute a program stored in the memory to implement the service classification method in the first aspect.

[0025] In a fourth aspect, a computer-readable storage medium is provided, which stores a computer program. When the computer program is executed by a processor, the service classification method in the first aspect is implemented.

[0026] In a fifth aspect, a computer program product containing instructions is provided, which, when executed on a computer, causes the computer to perform the service classification method in the first aspect.

[0027] In a sixth aspect, an Internet system is provided, which comprises a service classification apparatus, a plurality of service ends, and a plurality of clients. The service classification apparatus is the service classification apparatus in the second aspect or the third aspect. BRIEF DESCRIPTION OF DRAWINGS

[0028] Figure 1 A structural schematic diagram of an Internet system provided for an embodiment of the present application;

[0029] Figure 2 A flowchart of a service classification method provided for an embodiment of the present application;

[0030] Figure 3 A flowchart of a method of classifying multiple services in multiple service pairs provided for an embodiment of the present application;

[0031] Figure 4 A schematic diagram of an undirected graph provided for an embodiment of the present application;

[0032] Figure 5 A block diagram of a service classification apparatus provided for an embodiment of the present application;

[0033] Figure 6 A block diagram of a first classification module provided for an embodiment of the present application;

[0034] Figure 7 A block diagram of another service classification apparatus provided for an embodiment of the present application;

[0035] Figure 8 A block diagram of a third determination module provided for an embodiment of the present application;

[0036] Figure 9 A structural schematic diagram of a service classification apparatus provided for an embodiment of the present application. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solutions and advantages of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the drawings.

[0038] Figure 1 A structural schematic diagram of an Internet system provided for an embodiment of the present application, see Figure 1 The Internet system 10 includes a forwarding device 101, and multiple clients 102 (for example, 3 are shown in Figure 1 ) and multiple servers 103 (for example, 3 are shown in Figure 1 ) connected with the forwarding device 101. The clients 102 and the servers 103 are communicatively connected through the forwarding device 101.

[0039] The service end 103 can provide at least one service to the client 102 through the forwarding device, and the service end 103 can distinguish the service provided by the service end 103 through an internet protocol (IP) address and a service port of the service end 103. The application running in the client 102 needs to realize its function based on multiple services, and the multiple services can be provided by one service end 103 or multiple service ends 103, which is not limited in the embodiments of the present application. Optionally, the forwarding device 101 can be a switch or a router or other device capable of forwarding data flow. For example, the forwarding device 101 can include a network processor, and the forwarding device 101 realizes the communication connection between the client 102 and the service end 103 through the network processor.

[0040] When the service end provides a service to the application running in the client, the service port and the client can transmit the service-related data flow through the forwarding device. The data flow is used to indicate the IP address of the corresponding client, the client port, the IP address of the service end and the service port, wherein the IP address of the service end and the service port correspond to one service. When the forwarding device 101 receives the data flow sent by the client 102, the forwarding device 101 forwards the data flow to the service port indicated by the data flow; when the forwarding device 101 receives the data flow sent by the service end 103, the forwarding device 101 forwards the data flow to the client indicated by the data flow. One or more services can correspond to one application. In order to manage the Internet system, a deep packet inspection (DPI) technology for identifying the type of the application corresponding to the data flow is proposed. The forwarding device maintains an application feature database, and the application feature database stores the correspondence between the application feature information and the application type. When the type of the application is identified through the DPI technology, the forwarding device looks up the application feature database according to the application feature information carried in the received data flow to identify the application corresponding to the data flow. However, since the DPI technology needs to use the application feature database, when a new type of application appears, the developer needs to find the application feature information of the new type of application and update the application feature database. The process of determining the type of the application corresponding to the data flow through the DPI technology is relatively complex and has poor real-time performance. Moreover, the DPI technology cannot classify the services provided by the service end.

[0041] The embodiments of the present application provide a method for classifying services. For example, Figure 2 A flowchart of a service classification method provided by the embodiments of the present application is shown in the figure, and the method can be applied to a service classification device. In the embodiments of the present application, the service classification device is taken as an example. Figure 1 The forwarding device 101 shown in the figure is taken as an example. Referring to Figure 2The method can comprise:

[0042] Step 201, receiving a plurality of data streams.

[0043] Each data stream can correspond to a client and a service, and the data stream is used for transmission to the corresponding client or is issued for the corresponding client, and the data stream is the data stream of the corresponding service. The plurality of data streams can correspond to a plurality of clients and a plurality of services.

[0044] Step 202, determining the start time of each data stream in the plurality of data streams, and the start time of each data stream is the time when the forwarding device receives the data stream.

[0045] The forwarding device needs to determine the start time of each data stream respectively. For example, the forwarding device generates the start time of each data stream when receiving the data stream. In addition, the forwarding device stores a flow table, and the forwarding device can record the five-tuple carried by the data stream and the start time of the data stream in the flow table. When determining the start time of each data stream in the plurality of data streams, the forwarding device can directly query the start time corresponding to the five-tuple of the data stream in the flow table.

[0046] For example, the start time of the plurality of data streams determined by the forwarding device can be as shown in Table 1. The forwarding device can indicate a data stream through the IP address of the corresponding client and the identifier of the service. The identifier of the service can include the IP address of the service end where the service is located and the identifier of the service port of the service end providing the service. For example, the start time of the data stream corresponding to the IP address of the client Src_IP1 and the service Dst_IP1_port_1 is T1. Wherein, Dst_IP1 is used to represent the IP address of the service end where the service is located, and port_1 represents the service port of the service.

[0047] Table 1

[0048] IP address of the client Service Start time Src_IP1 Dst_IP1_port_1 T1 Src_IP1 Dst_IP1_port_2 T2 Src_IP1 Dst_IP1_port_3 T3 … … … Src_IP1 Dst_IP1_port_n Tn

[0049] It should be noted that the services corresponding to the plurality of data streams can be located on the same service end, or can be located on different service ends, and the clients corresponding to the plurality of data streams can be the same client or different clients. In Table 1, only the services corresponding to the plurality of data streams are located on the same service end, and the clients corresponding to the plurality of data streams are the same client. In addition, there can be data streams corresponding to the same client and service in the plurality of data streams, and only the services corresponding to the plurality of data streams are different in Table 1.

[0050] Step 203, determining the service corresponding to each data stream in the plurality of data streams.

[0051] Step 204, determining a client corresponding to each data flow in the plurality of data flows.

[0052] For example, the forwarding device can query the above flow table to determine the service and the client corresponding to each data flow.

[0053] Step 205, determining n data flow groups in the plurality of data flows, n≥1, each data flow group in the n data flow groups corresponding to one client and at least two services, and different data flow groups corresponding to different clients.

[0054] After determining the service and the client corresponding to each data flow, the forwarding device can group the plurality of data flows based on the client corresponding to each data flow to obtain a group of data flows corresponding to each client, each data flow in the group of data flows corresponding to the client. And the clients corresponding to different data flow groups are different. For example, a group of data flows in the plurality of data flows can include the plurality of data flows embodied in Table 1, and the clients corresponding to the group of data flows are all the client with the network address Src_IP1 in Table 1.

[0055] Step 206, determining a service pair corresponding to each data flow group in the n data flow groups to obtain a plurality of service pairs.

[0056] Each service pair corresponding to each data flow group includes any two services corresponding to the each data flow group. After determining the n data flow groups, the forwarding device can determine that any two services in the services corresponding to each data flow group in the n data flow groups form a service pair.

[0057] For example, in a group of data flows embodied in Table 1, service Dst_IP1_port_1 and service Dst_IP1_port 2 form a service pair, service Dst_IP1_port_1 and service Dst_IP1_port 3 form a service pair, and service Dst_IP1_port_2 and service Dst_IP1_port 3 form a service pair.

[0058] After determining the service pairs corresponding to all data flow groups, the forwarding device can obtain a plurality of service pairs. The plurality of service pairs includes the union of the service pairs corresponding to the n data flow groups.

[0059] Step 207, determining an interval corresponding to each service pair in the plurality of service pairs.

[0060] After obtaining the plurality of service pairs, the forwarding device can determine the interval corresponding to each service pair in the plurality of service pairs. The interval corresponding to each service pair includes the interval of the start times of the data flows corresponding to the two services in the service pair in the same data flow group.

[0061] For example, as shown in Table 2, assuming that service Dst_IP1_port_1 and service Dst_IP1_port_2 are a service pair, the start time of the data stream corresponding to service Dst_IP1_port_1 in a data stream group is T2, and the start time of the data stream corresponding to service Dst_IP1_port_2 in the data stream group is T1, the interval corresponding to the service pair composed of service Dst_IP1_port_1 and service Dst_IP1_port_2 includes T2-T1. In addition, in order to facilitate calculation, all obtained intervals can be rounded to the minimum time unit (e.g., 1 second), and at this time, the interval corresponding to the service pair of service Dst_IP1_port_1 and service Dst_IP1_port_2 can be represented as (T2-T1) / / 1, that is, (T2-T1) is rounded to 1 second.

[0062] Table 2

[0063] Service Service Interval Dst_IP1_port_1 Dst_IP1_port_2 (T2-T1) / / 1 Dst_IP1_port_1 Dst_IP1_port_3 (T3-T1) / / 1 Dst_IP1_port_2 Dst_IP1_port_3 (T3-T2) / / 1 … … …

[0064] Optionally, the forwarding device can first sort the plurality of services in any order, for example, according to the identifiers of the services. Then, the forwarding device can determine the interval corresponding to each service pair based on the sorting of the plurality of services. For example, the interval T pq p q corresponding to a service pair including a pth service and a qth service in the plurality of services, p>q≥1, T p represents the start time of any data stream corresponding to the pth service in a data stream group corresponding to the service pair, and T q represents the start time of any data stream corresponding to the qth service in the data stream group.

[0065] It can be seen that after the plurality of services are sorted, when the interval corresponding to each service pair is determined, only the start time of the data stream corresponding to the service after sorting is subtracted from the start time of the data stream corresponding to the service before sorting. In this way, it is possible to avoid the case that the interval is obtained by subtracting the start time of the data stream corresponding to the service after sorting from the start time of the data stream corresponding to the service before sorting, and the interval is obtained by subtracting the start time of the data stream corresponding to the service before sorting from the start time of the data stream corresponding to the service after sorting, thereby causing the interval to be determined repeatedly.

[0066] In step 208, whether the services in each service pair are associated is determined based on the interval corresponding to each service pair, and the association relationship of the services in each service pair is obtained.

[0067] ​​The forwarding device can first determine a set of intervals less than the first time threshold in the intervals corresponding to the service pair when determining whether the two services in each service pair are associated. Then, the forwarding device also needs to determine the frequency of each interval in the set of intervals.

[0068] It should be noted that the data stream corresponding to each service can not be unique, so the interval of the start time of the data stream corresponding to each service pair can also not be unique, and some intervals can be the same. As shown in Table 3, for the service pair composed of service Dst_IP1_port_1 and service Dst_IP1_port_2, the intervals of the start time of the data stream corresponding to the two services include: -4 seconds, -2 seconds, 0 seconds, 1 second and 2 seconds, a total of five intervals. Among them, the interval of -4 seconds occurs 1 time (frequency 1), the interval of -2 seconds occurs 10 times (frequency 10), the interval of 0 seconds occurs 100 times (frequency 100), the interval of 1 second occurs 100 times (frequency 100), and the interval of 2 seconds occurs 1 time (frequency 1).

[0069] Table 3

[0070] Service pair Interval Frequency <Dst_IP1_port_1, Dst_IP1_port_2> -4 1 <Dst_IP1_port_1, Dst_IP1_port_2> -2 10 <Dst_IP1_port_1, Dst_IP1_port_2> 0 100 <Dst_IP1_port_1, Dst_IP1_port_2> 1 100 <Dst_IP1_port_1, Dst_IP1_port_2> 2 1

[0071] After the forwarding device determines the frequency of each interval in the set of intervals, the forwarding device can find q intervals with a frequency greater than a frequency threshold in the set of intervals, q≥1. Then, the forwarding device also needs to determine the maximum interval and the minimum interval in the q intervals, and when the difference between the maximum interval and the minimum interval is less than a second time threshold, it indicates that the similarity of the start times of the two services in the service pair is high, and at this time, the forwarding device determines that the two services in the service pair are associated.

[0072] For example, the first time threshold can be 30 seconds, 20 seconds, etc., and the second time threshold can be 5 seconds, 4 seconds, etc. Alternatively, the frequency threshold can be set by the staff on the forwarding device, or can be calculated by the forwarding device. Alternatively, when the frequency threshold is calculated by the forwarding device, the frequency threshold Y=E+k*A, E represents the median of the frequency of the set of intervals, A represents the absolute median difference (or variance, in this embodiment, A is taken as an example) of the frequency of the set of intervals, and k represents a constant. For example, k can be a constant of 3, 4 or 5. The absolute median difference is equal to the median of the results obtained by the difference between each interval in the set of intervals and the median E.

[0073] Assuming the first time threshold is 30 seconds, the second time threshold is 5 seconds, and k=3, for the service pair composed of the service Dst_IP1_port_1 and the service Dst_IP1_port_2 shown in Table 3, the intervals of the start times of the data flows corresponding to the two services include: -4 seconds, -2 seconds, 0 seconds, 1 second, and 2 seconds, a total of five intervals. All the five intervals are less than the first time threshold 30 seconds. And based on the frequencies of the five intervals, it can be calculated that E is 10 and A is 13.34, so the frequency threshold is 50.03. The first interval in the frequencies of the five intervals is 1 second, and the second interval is 0 second. The difference between the first interval and the second interval is 1 second, which is less than the second time threshold 5 seconds. Therefore, the forwarding device can determine that the service Dst_IP1_port_1 and the service Dst_IP1_port_2 are associated.

[0074] It can be seen that only when the start times of the two services are similar, the two services are associated. In the embodiment of the present application, whether the two services are associated is determined by the first time threshold, the second time threshold, and the frequency threshold. Alternatively, whether the two services are associated can also be determined by other manners, such as when the number of intervals less than the first time threshold in the intervals corresponding to the service pair is greater than the number threshold, it is determined that the two services in the service pair are associated.

[0075] The forwarding device can determine whether the services in each service pair in the plurality of service pairs are associated by using the method in step 208 to obtain the association relationship of the services in each service pair.

[0076] Step 209, classifying the plurality of services in the plurality of service pairs based on the association relationship of the services in each service pair in the plurality of service pairs.

[0077] After determining the association relationship of the services in each service pair, the forwarding device can classify the services in the plurality of service pairs according to the association relationship. For example, as shown in Figure 3 Step 209 can include:

[0078] Step 2091, determining p service groups in the plurality of services based on the association relationship of the services in each service pair in the plurality of service pairs, a service group including at least two services in the plurality of services that are associated with each other, and p≥1.

[0079] For example, the forwarding device can first determine at least one associated service pair in the plurality of service pairs based on the association relationship of the services in each service pair in the plurality of service pairs, the two services in the associated service pair being associated. Of course, the plurality of service pairs can also have other service pairs in addition to the associated service pair, the two services in the other service pair not being associated.

[0080] Afterwards, the forwarding device can generate an undirected graph based on the plurality of services and the at least one associated service pair, where the undirected graph comprises a plurality of nodes corresponding to the plurality of services and at least one edge corresponding to the at least one associated service pair, and the nodes are used to represent the corresponding services and the edges are used to connect two nodes corresponding to the corresponding associated service pair. For example, assume that the plurality of services comprises services 1-5, and service 1 and 3 form a first associated service pair, service 2 and 3 form a second associated service pair, service 1 and 2 form a third associated service pair, and service 4 and 5 form a fourth associated service pair. At this time, the undirected graph generated based on the five services and the four associated service pairs can be as shown in FIG. 3. Figure 4 Referring to FIG. 3, Figure 4 the undirected graph comprises nodes 1.1-1.5 and edges 2.1-2.4. Node 1.x corresponds to service x, and edge 2.y corresponds to the yth associated service pair, 1≤x≤5, 1≤y≤4. Therefore, node 1.1 and node 1.3 are connected by edge 2.1, node 1.2 and node 1.3 are connected by edge 2.2, node 1.1 and node 1.2 are connected by edge 2.3, and node 1.4 and node 1.5 are connected by edge 2.4.

[0081] After obtaining the undirected graph, the forwarding device can determine p maximal cliques in the undirected graph, where a maximal clique comprises a plurality of nodes connected by edges two by two. The intersection of the p maximal cliques is zero. The forwarding device can determine the maximal cliques in the undirected graph based on any method, such as Bron-Kerbosch (a method for determining maximal cliques), etc. For example, the forwarding device determines that the maximal cliques in the undirected graph shown in FIG. 3 can comprise maximal cliques 3.1-3.2. Maximal clique 3.1 comprises nodes 1.1-1.3, and maximal clique 3.2 comprises nodes 1.4-1.5. Figure 4

[0082] After determining the at least one maximal clique, the forwarding device can determine p service groups corresponding to the p maximal cliques based on the p maximal cliques, where the nodes in the maximal cliques correspond to the services in the corresponding service groups one by one.

[0083] Step 2092, determining an associated service set of each service in the plurality of services based on the p service groups, where the associated service set comprises the services associated with the each service in the service group in which the each service is located.

[0084] After determining the p service groups, the forwarding device can determine the associated service set of each service in the service groups based on the at least one associated service pair determined before.

[0085] For example, in the example shown in FIG. 3, Figure 4 ​In the service group corresponding to the medium-large group 3.1 (including: service 1-3), the associated service set of service 1 is {service 2 and service 3}, the associated service set of service 2 is {service 2 and service 3}, and the associated service set of service 3 is {service 1 and service 2}.

[0086] In step 2093, the similarity of any two associated service sets is determined based on the intersection union ratio of the two associated service sets.

[0087] After determining the associated service set of each service, the forwarding device needs to determine the similarity of any two associated service sets. In the embodiment of the present application, the similarity is determined based on the intersection union ratio, and of course other ways of determining the similarity can also be used, which are not limited in the embodiment of the present application.

[0088] The intersection union ratio of each two associated service sets refers to the ratio of the number of intersection elements to the number of union elements of the two associated service sets. For example, the intersection of the associated service set m1 {c1, c2, c3, c4, c5, c6} and the associated service set m2 {c2, c3, c4, c5, c6, c7} is {c2, c3, c4, c5, c6}, and the union is {c1, c2, c3, c4, c5, c6, c7}. The number of intersection elements is 5, and the number of union elements is 7, so the intersection union ratio of the associated service set m1 and the associated service set m2 is 5 / 7≈71%.

[0089] Optionally, the forwarding device can directly use the intersection union ratio of the two associated service sets as the similarity of the two associated service sets, or can perform calculation processing on the intersection union ratio of the two associated service sets, and use the result of the calculation processing as the similarity of the two associated service sets. For example, the calculation processing can include multiplying the intersection union ratio by a preset intersection union ratio coefficient, and the like, which are not limited in the embodiment of the present application.

[0090] In step 2094, the multiple services are classified based on the similarity of the associated service sets of the multiple services.

[0091] Optionally, a similarity threshold can be set in advance, and when the similarity of the associated service sets of two services is greater than the similarity threshold, the forwarding device can divide the two services into the same class.

[0092] Optionally, the forwarding device can cluster the similarity of the associated service set of each two services in the service group by a clustering algorithm. In step 2094, the forwarding device can first generate a similarity matrix of the plurality of services based on the similarity of the associated service set of the plurality of services, and then cluster the similarity matrix to obtain the classification result of the plurality of services. The similarity matrix includes m rows and m columns of elements, and the element in the ith row and jth column is used to represent the similarity of the associated service set of the ith service and the associated service set of the jth service in the plurality of services, 1≤i≤m, 1≤j≤m.

[0093] For example, it is assumed that the intersection-over-union of the associated service set of any two services in the determined service group is as shown in Table 4. The service group includes services Dst_IP1_port_1, Dst_IP1_port_2, and Dst_IP1_port_3. The associated service set of service Dst_IP1_port_1 is denoted as Set1, the associated service set of service Dst_IP1_port_2 is denoted as Set2, and the associated service set of service Dst_IP1_port_3 is denoted as Set3. The similarity (such as the intersection-over-union) of the associated service set of service Dst_IP1_port_1 and the associated service set of service Dst_IP1_port_2 is denoted as IoU(Set1, Set2), the similarity (such as the intersection-over-union) of the associated service set of service Dst_IP1_port_1 and the associated service set of service Dst_IP1_port_3 is denoted as IoU(Set1, Set3), and the similarity (such as the intersection-over-union) of the associated service set of service Dst_IP1_port_2 and the associated service set of service Dst_IP1_port_3 is denoted as IoU(Set2, Set3). Based on the similarity shown in Table 4, the similarity matrix can be:

[0094]

[0095] Table 4

[0096] Dst_IP1_port_1 Dst_IP1_port_2 Dst_IP1_port_3 Dst_IP1_port_1 1 IoU(Set1, Set2) IoU(Set1, Set3) Dst_IP1_port_2 IoU(Set1, Set2) 1 IoU(Set2, Set3) Dst_IP1_port_3 IoU(Set1, Set3) IoU(Set2, Set3) 1

[0097] Optionally, the forwarding device can cluster the similarity matrix by using a spectral clustering algorithm (or other algorithms for clustering based on a similarity matrix, such as K-Means or DBSCAN, etc.).

[0098] In summary, in the service classification method provided in the embodiments of the present application, the service classification device can determine n data stream groups in the plurality of data streams, and determine the service pairs corresponding to each data stream group in the n data stream groups to obtain a plurality of service pairs. Then, based on the interval corresponding to each service pair, the service classification device determines whether the services in each service pair are associated to obtain the association relationship of the services in each service pair, and classifies the services in the plurality of service pairs based on the association relationship of the services in each service pair in the plurality of service pairs. In this way, the classification of the services is realized, and further, the management of the Internet system is realized based on the classification result of the services.

[0099] Optionally, after classifying the services, the forwarding device can classify the data streams corresponding to the services based on the classification result of the services. The data streams corresponding to the services of the same type are of the same type, and the data streams corresponding to the services of different types are of different types. For example, it is assumed that the services IP1+port 1 and IP1+port 3 belong to the same class, and the service IP1+port 2 belongs to the same class alone. Further, the forwarding device can divide the data stream corresponding to the service IP1+port 1 and the data stream corresponding to the service IP1+port 3 into the same class, and divide the data stream corresponding to the service IP1+port 2 into a class, thereby realizing the classification of the data streams corresponding to the services in the service group. After classifying the services corresponding to the services in all service groups, the classification of all data streams can be realized.

[0100] It should be noted that the similarity of the services divided into a class is usually high, and these services usually correspond to the same application. In addition, the start times of the data streams of the services based on the same application are usually close, and the similarity is high. It can be seen that the classification process is based on the similarity of the start times of the data streams corresponding to the services. Optionally, the classification method based on the similarity of the start times of the data streams corresponding to the services can also be different from the method provided in the embodiments of the present application, for example, the similarity of the start times of the data streams of the services can be directly calculated, and whether two services are similar can be determined through a similarity threshold, and then similar services are divided into a class.

[0101] Optionally, assuming that in step 2094, the forwarding device clusters the similarity matrix to obtain the classification result of the plurality of services, after classifying the plurality of services, the forwarding device can further verify the classification result of the plurality of services to determine the accuracy of the classification result of the plurality of services. For example, after step 2094, the forwarding device can further detect whether the classification result of the plurality of services meets the classification constraint condition, and when the classification result of the plurality of services does not meet the classification constraint condition, the process of clustering the similarity matrix in step 2094 is repeated; when the classification result of the plurality of services meets the classification constraint condition, the process of classifying the plurality of services is ended. In this way, through multiple verifications, the accuracy of the classification of the plurality of services can be improved.

[0102] For example, the classification constraint condition can include that the accuracy of the classification result of the plurality of services is greater than an accuracy threshold. Optionally, when detecting whether the classification result meets the classification constraint condition, the forwarding device can evaluate the classification result by using the silhouette coefficient index to obtain an evaluation index of the classification result, which can represent the accuracy of the classification result. For example, when evaluating the classification result by using the silhouette coefficient index, the forwarding device can first generate a degree matrix according to the similarity matrix. Then, the classification result and the degree matrix are input into the silhouette coefficient index to output an evaluation index for representing the quality of the classification result, which is usually a value in the interval [-1, 1]. The greater the value of the evaluation index, the higher the accuracy of the classification result. When the value of the evaluation index is greater than the accuracy threshold, it indicates that the accuracy of the classification result is high, and at this time the forwarding device determines that the classification result meets the classification constraint condition; when the value of the evaluation index is not greater than the accuracy threshold, it indicates that the accuracy of the classification result is low, and at this time the forwarding device determines that the classification result does not meet the classification constraint condition.

[0103] For example, assuming that the accuracy threshold is 0.8, the forwarding device can generate a degree matrix according to the similarity matrix in the aforementioned step 2094, and then input the aforementioned classification result {0, 0, 0, 1, 0, 1, 2} and the degree matrix into the silhouette coefficient index. When the output evaluation index is 0.5, the forwarding device determines that the classification result meets the classification constraint condition; when the output evaluation index is 0.98, the forwarding device determines that the classification result does not meet the classification constraint condition.

[0104] For example, when the forwarding device needs to re-execute the process of clustering the similarity matrix in step 2094 to obtain the classification result of the plurality of services, the preset type number can be changed to output the classification result corresponding to different preset type numbers. For example, assuming that the classification result {0, 0, 0, 1, 0, 1, 2} obtained by step 2094 does not meet the classification constraint condition, the preset type number can be changed from 3 to 2, and then the spectral clustering algorithm is used for clustering.

[0105] The service classification method provided by the embodiments of the present application can realize classification of data streams without maintaining a database, simplifies the service classification process, and improves the real-time performance of service classification. Moreover, more and more applications are private applications of enterprises, and the client running the private applications usually receives encrypted data streams when communicating with the server through the forwarding device. The forwarding device can only obtain the IP address of the client, the IP address of the server, and the port from the data stream. When identifying the type of the application through the DPI technology, the forwarding device needs to obtain the application feature information from the data stream. For encrypted data streams, the forwarding device cannot obtain the application feature information, and thus cannot identify the type of the application, and cannot realize management of the Internet system. The embodiments of the present application can realize classification of data streams only by using the IP address of the client, the IP address of the server, and the port, and thus the service classification method provided by the embodiments of the present application can accurately classify encrypted data streams, has a wide application range, and can realize management of the Internet system when the data streams are encrypted.

[0106] In the embodiments of the present application, the forwarding device classifies a plurality of services through steps 201 to 209. Optionally, after classifying the plurality of services, the forwarding device can also update the plurality of data streams in step 201. Then, based on the updated plurality of data streams, steps 201 to 209 are repeatedly executed to obtain the classification results of the plurality of services corresponding to the updated plurality of data streams. It should be noted that the updated plurality of data streams can include at least part of the data streams before the update, or can not include the data streams before the update, which is not limited in the embodiments of the present application. In one embodiment, updating the plurality of data streams means updating the information of the recorded plurality of data streams. For example, deleting the information of the recorded data streams and recording the information of the newly received data streams. The information of the data streams includes the identification of the corresponding client and the identification of the service.

[0107] After classifying the plurality of services, the forwarding device can also identify the type of the service corresponding to the subsequently received data stream to be forwarded based on the classification of the plurality of services. Then, the forwarding device can manage the Internet system based on the type of the service corresponding to the plurality of data streams, such as limiting the speed of the data stream corresponding to a certain type of service, or increasing the transmission bandwidth of the data stream corresponding to a certain type of service.

[0108] Optionally, the service classification device performing the service classification method in the above embodiments is taken as an example of the forwarding device. As an example, the service classification device can also not be the forwarding device. At this time, the service classification device does not receive multiple data flows in step 201, but obtains data flows to be forwarded by the forwarding device. As another example, the service classification device can also include multiple devices, for example, the service classification device can include the above-mentioned forwarding device and an auxiliary device, at this time, part of the steps in step 201 and step 209 can be executed by the forwarding device, and the other part of the steps can be executed by the auxiliary device.

[0109] Optionally, the forwarding device can also classify multiple services based on other manners. For example, the forwarding device can classify services based on the similarity of client sets. For example, the forwarding device can determine the client set corresponding to each service in the multiple services, wherein the client set corresponding to each service includes the client corresponding to the data flow corresponding to the each service; then, the forwarding device can classify the multiple services based on the similarity of the client sets corresponding to the multiple services. As another example, the forwarding device can classify multiple services based on the similarity of domain names. For example, the forwarding device can obtain the domain name corresponding to each service in the multiple services, and then classify the multiple services based on the similarity of the domain names corresponding to the multiple services.

[0110] After the forwarding device executes step 209, the forwarding device can also adjust the classification result of the multiple services in step 209 in combination with other classification results.

[0111] On the one hand, the forwarding device can adjust the classification result obtained in step 209 based on the result of classifying the multiple services based on the similarity of client sets. For example, assuming that in the result of classifying the multiple services based on the similarity of client sets, two services are classified into the same class, while in the classification result of step 209, the two services are not classified into the same class. The forwarding device can adjust the classification result of step 209 so that the two services are classified into the same class.

[0112] On the other hand, the forwarding device can adjust the classification result of step 209 according to the result of classifying the multiple services based on the similarity of domain names. For example, assuming that in the result of classifying the multiple services based on the similarity of domain names, two services are classified into the same class, while in the classification result of step 209, the two services are not classified into the same class. The forwarding device can adjust the classification result of step 209 so that the two services are classified into the same class.

[0113] In another aspect, the forwarding device adjusts the classification result of step 209 according to the result of classifying the plurality of services based on the similarity of the client set and the result of classifying the plurality of services based on the similarity of the domain name. For example, assume that in the result of classifying the plurality of services based on the similarity of the client set, two services are classified into the same class; in the result of classifying the plurality of services based on the similarity of the domain name, the two services are classified into a class, and in the classification result of step 209, the two services are not classified into the same class. Then the forwarding device can adjust the classification result of step 209 so that the two services are classified into the same class. For another example, assume that in the result of classifying the plurality of services based on the similarity of the client set, two services are classified into the same class, in the result of classifying the plurality of services based on the similarity of the domain name, the two services are not classified into a class, and in the classification result of step 209, the two services are not classified into the same class. Then the forwarding device can not need to adjust the classification result of step 209.

[0114] The sequence of the method provided by the embodiments of the present application can be adjusted appropriately, and the steps can be increased or decreased based on the situation. Any person skilled in the art can easily think of the changed method within the technical range disclosed by the present application, which should be covered in the protection scope of the present application, and thus will not be described in detail.

[0115] The service classification method provided by the embodiments of the present application is introduced above, and the service classification device provided by the embodiments of the present application is introduced below.

[0116] Figure 5 A block diagram of a service classification device provided by the embodiments of the present application is shown in FIG. 5. Figure 5 The service classification device 500 includes:

[0117] A first determining module 501 is configured to determine n data stream groups in a plurality of data streams, n≥1, each data stream group of the n data stream groups corresponding to one client and at least two services, and different data stream groups corresponding to different clients.

[0118] A second determining module 502 is configured to determine a service pair corresponding to each data stream group in the n data stream groups, to obtain a plurality of service pairs, each service pair corresponding to each data stream group including any two services corresponding to each data stream group.

[0119] A third determining module 503 is configured to determine an interval corresponding to each service pair in the plurality of service pairs, the interval corresponding to each service pair including an interval of start times of data streams corresponding to two services in each service pair in the same data stream group, the start time of a data stream being a time when the forwarding device receives the data stream.

[0120] The fourth determining module 504 is configured to determine, based on the interval corresponding to each service pair, whether the services in the service pair are associated, to obtain the association relationship between the services in the service pair.

[0121] The first classifying module 505 is configured to classify the services in the plurality of service pairs based on the association relationship between the services in each service pair in the plurality of service pairs.

[0122] In summary, in the service classifying apparatus provided by the embodiments of the present application, the first determining module can determine n data stream groups in the plurality of data streams, the second determining module can determine the service pair corresponding to each data stream group in the n data stream groups, to obtain the plurality of service pairs; then, the fourth determining module can determine, based on the interval corresponding to each service pair, whether the services in the service pair are associated, to obtain the association relationship between the services in the service pair, and the first classifying module can classify the services in the plurality of service pairs based on the association relationship between the services in each service pair in the plurality of service pairs. In this way, the classification of the services is realized, and then the management of the Internet system can be realized based on the classification result of the services.

[0123] Optionally, the fourth determining module 504 is configured to: determine a group of intervals in the interval corresponding to each service pair, which are less than a first time threshold; determine the frequency of each interval in the group of intervals; determine q intervals in the group of intervals, the frequency of which exceeds a frequency threshold, q≥1; determine the maximum interval and the minimum interval in the q intervals; and determine that the two services in the service pair are associated when the difference between the maximum interval and the minimum interval is less than a second time threshold.

[0124] Optionally, the frequency threshold Y=E+k*A, where E represents the median of the frequencies of the group of intervals, A represents the absolute median difference of the frequencies of the group of intervals, and k represents a constant.

[0125] Optionally, Figure 6 A block diagram of a first classifying module provided by an embodiment of the present application is shown in FIG. 5, which includes: Figure 6

[0126] The first determining sub-module 5051 is configured to determine, based on the association relationship between the services in each service pair in the plurality of service pairs, p service groups in the plurality of services, the service group including at least two services in the plurality of services that are associated with each other, p≥1.

[0127] The second determining sub-module 5052 is configured to determine, based on the p service groups, the associated service set of each service in the plurality of services, the associated service set including the services in the service group in which the service is located and that are associated with the service.

[0128] ​The classification submodule 5053 is configured to classify the plurality of services based on the similarity of the association service sets of the plurality of service pairs.

[0129] Optionally, the first determination submodule 5051 is configured to:

[0130] determine at least one associated service pair in the plurality of service pairs based on the association relationship of the services in each service pair in the plurality of service pairs, the two services in the associated service pair being associated;

[0131] generate an undirected graph based on the plurality of services and the at least one associated service pair, wherein the undirected graph includes a plurality of nodes corresponding to the plurality of services and at least one edge corresponding to the at least one associated service pair, and the nodes are used to represent the corresponding services, and the edges are used to connect the two nodes corresponding to the corresponding associated service pair;

[0132] determine p maximal cliques in the undirected graph, the maximal cliques including a plurality of nodes connected by edges two by two;

[0133] determine p service groups corresponding to the p maximal cliques, the nodes in the maximal cliques corresponding to the services in the corresponding service groups one by one.

[0134] Optionally, please refer to Figure 7 , Figure 7 Another service classification device provided by the embodiment of the present application is shown in the block diagram, which is based on Figure 5 , and the service classification device 500 further includes:

[0135] The fifth determination module 506 is configured to determine the similarity of the two association service sets of any two services in the plurality of services based on the intersection-union ratio of the two association service sets.

[0136] Optionally, the classification submodule 5053 is configured to:

[0137] generate a similarity matrix of the plurality of services based on the similarity of the association service sets of the plurality of services, wherein the similarity matrix includes m rows and m columns of elements, and the element in the ith row and the jth column is used to represent the similarity of the association service set of the ith service in the plurality of services and the association service set of the jth service, 1≤i≤m, 1≤j≤m;

[0138] cluster the similarity matrix to obtain a classification result of the plurality of services.

[0139] Optionally, as Figure 7 shown, the service classification device 500 further includes:

[0140] The detection module 507 is configured to detect whether the accuracy of the classification result of the plurality of services is less than or equal to an accuracy threshold.

[0141] The repetition module 508 is configured to, when the accuracy of the classification result is less than or equal to the accuracy threshold, repeatedly perform the process of clustering the similarity matrix to obtain the classification result of the plurality of services.

[0142] Optionally, Figure 8 A block diagram of a third determination module provided in an embodiment of the present application is shown in FIG. 5B. The third determination module 503 includes: Figure 7

[0143] The sorting sub-module 5031 is configured to sort the plurality of services.

[0144] The third determination sub-module 5032 is configured to determine, based on the sorting of the plurality of services, an interval corresponding to each service pair in the plurality of service pairs.

[0145] Optionally, the third determination sub-module 5032 is configured to determine the interval T pq p q corresponding to each service pair, wherein the each service pair includes a p th service and a q th service in the plurality of services, p > q ≥ 1, and T p represents a start time of any data stream corresponding to the p th service in one data stream group corresponding to the each service pair, and T q represents a start time of any data stream corresponding to the q th service in the one data stream group.

[0146] Optionally, as shown in FIG. 5C, the service classification apparatus 500 further includes: Figure 7

[0147] The sixth determination module 509 is configured to determine a client set corresponding to each service in the plurality of services, wherein the client set corresponding to the each service includes a client corresponding to a data stream corresponding to the each service.

[0148] The second classification module 510 is configured to classify the plurality of services based on the similarity of the client sets corresponding to the plurality of services.

[0149] The first adjustment module 511 is configured to, after classifying the plurality of services based on the association relationship between services in each service pair in the plurality of service pairs, adjust the result of classifying the plurality of services based on the similarity of the client sets corresponding to the plurality of services. ​​​​

[0150] Alternatively, as Figure 7 As shown, the service classification device 500 further includes:

[0151] An acquisition module 512 is configured to acquire a domain name corresponding to each of the plurality of services;

[0152] A third classification module 513 is configured to classify the multiple services based on similarities of the domain names corresponding to the multiple services;

[0153] The second adjustment module 514 is used to adjust the results of classifying the multiple services based on the association relationship between the services in each of the multiple service pairs after classifying the multiple services in the multiple service pairs based on the association relationship between the services in each of the multiple service pairs, according to the results of classifying the multiple services based on the similarity of the domain names corresponding to the multiple services.

[0154] In summary, in the service classification device provided in the embodiments of the present application, the first determination module can determine n data stream groups from multiple data streams, the second determination module can determine the service pairs corresponding to each data stream group in the n data stream groups, and obtain multiple service pairs; thereafter, the fourth determination module can determine whether the services in each service pair are associated based on the interval corresponding to each service pair, and obtain the association relationship of the services in each service pair. The first classification module classifies the multiple services in the multiple service pairs based on the association relationship of the services in each of the multiple service pairs. This achieves service classification, and further enables management of the Internet system based on the service classification results.

[0155] The above describes the service classification device provided by the embodiment of the present application. The following describes the possible product forms of the service classification device. It should be understood that any device with the above Figure 5 or Figure 7 Any product with the characteristics of the service classification device falls within the scope of protection of this application. It should also be understood that the following description is only an example and does not limit the product form of the service classification device of the embodiment of this application.

[0156] The embodiment of the present application provides a service classification device, such as Figure 9 As shown, the service classification device 600 includes: at least one processor 601 ( Figure 9 One is shown), at least one interface 602 ( Figure 9 ), memory 603 and at least one communication bus 604 ( Figure 9 The processor 601 is configured to execute a program stored in the memory 603 to implement the service classification method described in the embodiment of the present application.

[0157] The processor 601 includes one or more processing cores, and performs various functional applications and data processing by running computer programs and units.

[0158] The memory 603 can be used to store computer programs and units. Specifically, the memory 603 can store an operating system and at least one application program unit required by a function. The operating system can be an operating system such as real time executive (RTX), LINUX, UNIX, WINDOWS or OS X.

[0159] The interface 602 can be multiple, and the interface 602 is used to communicate with other storage devices or network devices. For example, in the embodiment of the present application, the interface 602 can be used to transmit and receive data streams.

[0160] The memory 603 and the interface 602 are connected to the processor 601 through the communication bus 604, respectively.

[0161] In the above embodiment, all or part can be realized by software, hardware, firmware or any combination thereof. When realized by software, all or part can be realized in the form of a computer program product including one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a computer network or other programmable device. The computer instructions can be stored in a computer readable storage medium of the computer, or transferred from one computer readable storage medium to another, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) mode. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (such as floppy disk, hard disk, magnetic tape), optical media, or semiconductor media (such as solid state disk) and the like.

[0162] The embodiments of the present application provide an Internet system, which comprises a forwarding device, and a plurality of clients and a plurality of servers connected with the forwarding device. The server can provide at least one service to the client through the forwarding device, and when the server provides the service to the application running in the client, the server and the client can transmit the service related data stream through the forwarding device. Wherein, the forwarding device can be the above-mentioned 5、 Figure 7 Or Figure 9The service classification device. The Internet system can refer to Figure 1 The Internet system shown in the figure, the embodiments of the present application will not be described here.

[0163] In the present application, the terms "first", "second" and the like are only for descriptive purposes, and cannot be understood as indicating or implying relative importance. The term "a plurality of" refers to two or more, unless otherwise explicitly limited.

[0164] It should be noted that the method embodiments and device embodiments provided by the embodiments of the present application can be mutually referred to, and the embodiments of the present application do not limit this.

[0165] It should be understood that the present application is not limited to the precise structure described above and shown in the drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

[0166] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present application, and these modifications or replacements should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method of service classification, characterized by, The method comprises: determining n data stream groups in a plurality of data streams, n≥1, each data stream group in the n data stream groups corresponding to one client and at least two services, and different data stream groups corresponding to different clients; determining a service pair corresponding to each data stream group in the n data stream groups to obtain a plurality of service pairs, each service pair corresponding to each data stream group comprising any two services corresponding to each data stream group; determining an interval corresponding to each service pair in the plurality of service pairs, the interval corresponding to each service pair comprising an interval of start times of data streams corresponding to two services in each service pair in the same data stream group, the start time of a data stream being a time at which a forwarding device receives the data stream; determining whether the services in each service pair are associated based on the interval corresponding to each service pair to obtain an association relationship of the services in each service pair; classifying a plurality of services in the plurality of service pairs based on the association relationship of the services in each service pair in the plurality of service pairs.

2. The method of claim 1, wherein, The method comprises: determining a group of intervals less than a first time threshold in the interval corresponding to each service pair; determining a frequency of each interval in the group of intervals; determining at least one interval in the group of intervals whose frequency exceeds a frequency threshold; determining a maximum interval and a minimum interval in the at least one interval; when a difference between the maximum interval and the minimum interval is less than a second time threshold, determining that the two services in each service pair are associated.

3. The method of claim 2, wherein, The frequency threshold Y=E+k*A, wherein E represents a median of the frequencies of the group of intervals, A represents an absolute median difference of the frequencies of the group of intervals, and k represents a constant.

4. The method according to any one of claims 1 to 3, characterized in that, The method comprises: based on the association relationship of the services in each service pair in the plurality of service pairs, determining p service groups in the plurality of services, the service group comprising at least two services associated with each other in the plurality of services, p≥1; based on the p service groups, determining an associated service set of each service in the plurality of services, the associated service set comprising services associated with each service in a service group in which each service is located; based on a similarity of the associated service sets of the plurality of services, classifying the plurality of services.

5. The method of claim 4, wherein, The method comprises: based on the association relationship of the services in each service pair in the plurality of service pairs, determining at least one associated service pair in the plurality of service pairs, the two services in the associated service pair being associated; generating an undirected graph based on the plurality of services and the at least one pair of associated services, wherein the undirected graph comprises a plurality of nodes corresponding to the plurality of services and at least one edge corresponding to the at least one pair of associated services, and the nodes are used to represent the corresponding services and the edges are used to connect two nodes corresponding to the corresponding pair of associated services; determining p maximal cliques in the undirected graph, wherein the maximal cliques comprise a plurality of nodes connected by edges two by two; determining p service groups corresponding to the p maximal cliques, wherein the nodes in the maximal cliques correspond to the services in the corresponding service groups one by one.

6. The method of claim 4, wherein, Before the classifying the plurality of services based on the similarity of the associated service sets of the plurality of services, the method further comprises: determining the similarity of the two associated service sets based on the intersection-union ratio of the two associated service sets of any two services in the plurality of services.

7. The method of claim 4, wherein, The classifying the plurality of services based on the similarity of the associated service sets of the plurality of services comprises: generating a similarity matrix of the plurality of services based on the similarity of the associated service sets of the plurality of services, wherein the similarity matrix comprises m rows and m columns of elements, and the element in the i th row and the j th column is used to represent the similarity of the associated service set of the i th service in the plurality of services and the associated service set of the j th service in the plurality of services, 1≤i≤m, 1≤j≤m; clustering the similarity matrix to obtain the classification result of the plurality of services.

8. The method of claim 7, wherein, After the clustering the similarity matrix to obtain the classification result of the plurality of services, the method further comprises: detecting whether the accuracy of the classification result of the plurality of services is less than or equal to an accuracy threshold value; when the accuracy of the classification result is less than or equal to the accuracy threshold value, repeating the process of clustering the similarity matrix to obtain the classification result of the plurality of services.

9. The method according to any one of claims 1 to 3, characterized in that, The determining the interval corresponding to each service pair in the plurality of service pairs comprises: sorting the plurality of services; determining the interval corresponding to each service pair in the plurality of service pairs based on the sorting of the plurality of services.

10. The method of claim 9, wherein, The determining the interval corresponding to each service pair in the plurality of service pairs based on the sorting of the plurality of services comprises: determining the corresponding interval T for each service pair pq = T p - T q ; wherein each service pair includes a pth service and a qth service in the plurality of services, p>q≥1, and the T p denotes a start time of any data stream corresponding to the pth service in a data stream group corresponding to the each service pair, and the T q denotes a start time of any data stream corresponding to the qth service in the data stream group.

11. The method according to any one of claims 1 to 3, characterized in that, The method further comprises: determining a client set corresponding to each service in the plurality of services, wherein the client set corresponding to each service comprises a client corresponding to a data stream corresponding to the each service; classifying the plurality of services based on the similarity of the client sets corresponding to the plurality of services; after the classifying the plurality of services based on the association relationship between the services in each service pair in the plurality of service pairs, adjusting the result of classifying the plurality of services based on the similarity of the client sets corresponding to the plurality of services.

12. The method according to any one of claims 1 to 3, characterized in that, The method further comprises: obtaining a domain name corresponding to each service in the plurality of services; classifying the plurality of services based on the similarity of the domain names corresponding to the plurality of services; The first classification module is configured to classify the plurality of services based on the association relationship between the services in each service pair in the plurality of service pairs.

13. A service classification apparatus characterized by comprising: The service classification apparatus comprises: A first determination module configured to determine n data stream groups in a plurality of data streams, n≥1, each data stream group in the n data stream groups corresponding to one client and at least two services, and different data stream groups corresponding to different clients; A second determination module configured to determine service pairs corresponding to each data stream group in the n data stream groups, to obtain a plurality of service pairs, each service pair corresponding to each data stream group comprising any two services corresponding to each data stream group; A third determination module configured to determine intervals corresponding to each service pair in the plurality of service pairs, the interval corresponding to each service pair comprising an interval of start times of data streams corresponding to two services in each service pair in the same data stream group, the start time of a data stream being a time at which a forwarding device receives the data stream; A fourth determination module configured to determine whether the services in each service pair are associated based on the interval corresponding to each service pair, to obtain an association relationship between the services in each service pair; A first classification module configured to classify a plurality of services in the plurality of service pairs based on the association relationship between the services in each service pair in the plurality of service pairs.

14. The service classification device of claim 13, wherein, The fourth determination module is configured to: determine a group of intervals in the interval corresponding to each service pair that are less than a first time threshold; determine a frequency of each interval in the group of intervals; determine at least one interval in the group of intervals whose frequency exceeds a frequency threshold; determine a maximum interval and a minimum interval in the at least one interval; when a difference between the maximum interval and the minimum interval is less than a second time threshold, determine that the two services in each service pair are associated.

15. The service classification device of claim 14, wherein, The frequency threshold Y=E+k*A, where E represents a median of the frequencies of the group of intervals, A represents an absolute median difference of the frequencies of the group of intervals, and k represents a constant.

16. The service classification device according to any one of claims 13 to 15, wherein The first classification module comprises: A first determination submodule configured to determine p service groups in the plurality of services based on the association relationship between the services in each service pair in the plurality of service pairs, the service group comprising at least two services that are associated with each other in the plurality of services, p≥1; A second determination submodule configured to determine an associated service set of each service in the plurality of services based on the p service groups, the associated service set comprising services associated with the each service in a service group in which the each service is located; A classification submodule configured to classify the plurality of services based on a similarity of the associated service sets of the plurality of services.

17. The service classification device of claim 16, wherein, The first determination submodule is configured to: determine at least one associated service pair in the plurality of service pairs based on the association relationship between the services in each service pair in the plurality of service pairs, the two services in the associated service pair being associated; generate a directed graph based on the plurality of services and the at least one pair of associated services, wherein the directed graph comprises a plurality of nodes corresponding to the plurality of services and at least one edge corresponding to the at least one pair of associated services, and the nodes are used to represent the corresponding services and the edges are used to connect two nodes corresponding to the corresponding pair of associated services; determine p maximal cliques in the directed graph, wherein the maximal cliques comprise a plurality of nodes connected by edges two by two; determine p service groups corresponding to the p maximal cliques, wherein the nodes in the maximal cliques correspond to the services in the corresponding service groups one by one.

18. The service classification device of claim 16, wherein, The service classification device further comprises: a fifth determination module configured to determine the similarity of the two sets of associated services of any two services in the plurality of services based on the intersection-union ratio of the two sets of associated services.

19. The service classification device of claim 16, wherein, The classification submodule is configured to: generate a similarity matrix of the plurality of services based on the similarity of the sets of associated services of the plurality of services, wherein the similarity matrix comprises m rows and m columns of elements, and the element in the ith row and the jth column is used to represent the similarity of the set of associated services of the ith service and the set of associated services of the jth service in the plurality of services, 1≤i≤m, 1≤j≤m; and cluster the similarity matrix to obtain a classification result of the plurality of services.

20. The service classification device of claim 19, wherein, The service classification device further comprises: a detection module configured to detect whether the accuracy of the classification result of the plurality of services is less than or equal to an accuracy threshold; a repetition module configured to repeat the process of clustering the similarity matrix to obtain the classification result of the plurality of services when the accuracy of the classification result is less than or equal to the accuracy threshold.

21. The service classification device according to any one of claims 13 to 15, wherein The third determination module comprises: a sorting submodule configured to sort the plurality of services; and a third determination submodule configured to determine an interval corresponding to each service pair in the plurality of service pairs based on the sorting of the plurality of services.

22. The service classification device of claim 21, wherein, The third determination submodule is configured to: determining the corresponding interval T for each service pair pq = T p - T q ; wherein each service pair includes a pth service and a qth service in the plurality of services, p>q≥1, and the T p denotes a start time of any data stream corresponding to the pth service in a data stream group corresponding to the each service pair, and the T q denotes a start time of any data stream corresponding to the qth service in the data stream group.

23. The service classification device according to any one of claims 13 to 15, wherein The service classification device further comprises: a sixth determination module configured to determine a set of clients corresponding to each service in the plurality of services, wherein the set of clients corresponding to each service comprises a client corresponding to a data stream corresponding to the each service; a second classification module configured to classify the plurality of services based on the similarity of the sets of clients corresponding to the plurality of services; and a first adjustment module configured to adjust the result of classifying the plurality of services based on the association relationship between the services in each service pair in the plurality of service pairs according to the result of classifying the plurality of services based on the similarity of the sets of clients.

24. The service classification device according to any one of claims 13 to 15, wherein The service classification device further comprises: an acquisition module configured to acquire a domain name corresponding to each service in the plurality of services; a third classification module configured to classify the plurality of services based on the similarity of the domain names corresponding to the plurality of services. The second adjustment module is configured to adjust the classification result of the plurality of services based on the association relationship between the services in each service pair in the plurality of service pairs, according to the similarity between the domain names corresponding to the plurality of service pairs.

25. A service classification apparatus characterized by comprising: The service classification apparatus comprises at least one processor, at least one interface, a memory, and at least one communication bus, the processor is configured to execute a program stored in the memory to implement the service classification method according to any one of claims 1 to 12.

26. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, and the computer program is executed by the processor to implement the service classification method according to any one of claims 1 to 12.

27. An Internet system, characterized in that The Internet system comprises a service classification apparatus, a plurality of service ends, and a plurality of clients. The service classification apparatus is the service classification apparatus according to any one of claims 13 to 24, or the service classification apparatus is the service classification apparatus according to claim 25.

Images