Traffic identification method and traffic identification device

Abstract

The embodiment of the present application discloses a traffic identification method and a traffic identification device, which are used to accurately identify game traffic and improve the accuracy of game traffic identification. The method of the embodiment of the present application includes: the traffic identification device obtains the traffic to be analyzed of the target data flow; the traffic identification device obtains the arrival time interval of the message of the traffic to be analyzed; the traffic identification device determines the type of the traffic to be analyzed based on the distribution characteristics of the probability of some or all of the arrival time intervals in the arrival time interval.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a flow identification method and a flow identification device. Background Art

[0002] Online gaming services are developing rapidly around the world, and the number of users is increasing. Traffic identification equipment extracts features from game traffic and uses machine learning and statistical learning methods to infer the application type of the service, thereby providing service assurance. Therefore, how to accurately identify online gaming service traffic, achieve network management, network planning, and improve network service quality has become a research focus in the field of network management.

[0003] At present, traffic identification equipment captures conversation packets with keywords, extracts tuple information of both communicating parties and builds a five-tuple rule base. Then, the traffic identification equipment uses the flow classification algorithm to match the five-tuple prefix of the messages included in the traffic, and completes the identification and classification of game traffic through the matching algorithm.

[0004] From the above solution, it can be seen that the traffic identification device realizes the identification and classification of traffic by matching the five-tuple prefix of the messages included in the traffic. However, when the addresses of the two communicating parties change, the accuracy of identifying the game traffic through the tuple information of the two communicating parties will be low, and the game traffic cannot be accurately identified. Summary of the invention

[0005] The embodiments of the present application provide a traffic identification method and a traffic identification device for accurately identifying game traffic and improving the accuracy of game traffic identification.

[0006] A first aspect of an embodiment of the present application provides a flow identification method, the method comprising:

[0007] The traffic identification device obtains the traffic to be analyzed of the target data flow; then, the traffic identification device obtains the arrival time interval of the messages of the traffic to be analyzed, and then determines the type of the traffic to be analyzed based on the probability distribution characteristics of part or all of the time intervals in the arrival time interval.

[0008] In this embodiment, since the probability distribution of the arrival time interval of the packets of each type of traffic has a certain distribution law. Therefore, the traffic identification device can accurately identify the type of the traffic to be analyzed through the distribution characteristics of the probability of the arrival time interval of the packets of the traffic to be analyzed. For example, when the distribution characteristics of the probability of all or part of the arrival time intervals of the packets of the traffic to be analyzed are consistent with the distribution characteristics of the probability of the packets of the game traffic, the traffic identification device can determine that the traffic to be analyzed is the game traffic, thereby accurately identifying the game traffic and improving the recognition accuracy of the game traffic.

[0009] In one possible implementation, the traffic identification device determines the type of traffic to be analyzed based on the distribution characteristics of the probabilities of part or all of the time intervals in the arrival time interval, including: the traffic identification device determines the type of traffic to be analyzed based on the similarity between the distribution characteristics of the probabilities of part or all of the arrival time intervals in the arrival time interval and the distribution characteristics of the probability of arrival time intervals of packets of the first type of historical traffic.

[0010] In this possible implementation, a specific method is provided for a specific traffic identification device to identify the type of traffic to be analyzed, and whether the traffic to be analyzed is the first type of traffic is determined by the similarity between the distribution characteristics of the probability of the arrival time interval of the packets of the traffic to be analyzed and the distribution characteristics of the probability of the arrival time interval of the packets of the known type of traffic.

[0011] In another possible implementation, the traffic identification device determines the type of the traffic to be analyzed based on the similarity between the distribution characteristics of the probabilities of part or all of the arrival time intervals in the arrival time interval and the distribution characteristics of the probabilities of the arrival time intervals of packets of the first type of historical traffic, including: when the similarity is higher than the first similarity, the traffic identification device determines that the traffic to be analyzed is the first type of traffic.

[0012] In this possible implementation, a specific implementation method is provided for determining the type of traffic to be analyzed by judging the magnitude of similarity, thereby improving the feasibility of the solution.

[0013] In another possible implementation, the similarity is characterized by the degree of fit between the distribution characteristics of the probability of the partial or all arrival time intervals and the reference time interval probability distribution model, and the reference time interval probability distribution model is used to characterize the distribution characteristics of the probability of the arrival time intervals of the packets of the first type of historical traffic; when the similarity is higher than the first similarity, the traffic identification device determines that the traffic to be analyzed is the first type of traffic, including: when the degree of fit is higher than the first degree of fit, the traffic identification device determines that the traffic to be analyzed is the first type of traffic.

[0014] In this possible implementation, the similarity is characterized by the degree of fit between the distribution characteristics of the probability of part or all of the arrival time intervals and the reference time interval probability distribution model, so that the traffic to be analyzed can be identified by judging the size of the degree of fit.

[0015] In another possible implementation, the degree of fit is characterized by the reciprocal of the relative entropy and the Kolmogorov-Smirnov (KS) test value. When the reciprocal of the relative entropy is equal to a first preset threshold and the KS test value is equal to a second preset threshold, the degree of fit is the first degree of fit; when the reciprocal of the relative entropy is greater than the first preset threshold and the KS test value is less than the second preset threshold, the degree of fit is higher than the first degree of fit.

[0016] In this possible implementation, two specific parameters characterizing the degree of fit are provided, and the degree of fit between the distribution characteristics of the probability of part or all of the arrival time intervals and the distribution characteristics of the probability of the arrival time intervals of packets of the first type of historical traffic is determined through the range of these two specific parameters. When the similarity is higher than the first similarity, the traffic identification device determines that the traffic to be analyzed is the first type of traffic.

[0017] In another possible implementation, the traffic identification device determines the type of traffic to be analyzed based on the similarity between the distribution characteristics of the probabilities of part or all of the arrival time intervals in the arrival time interval and the distribution characteristics of the probability of the arrival time intervals of the packets of the first type of historical traffic, including: the traffic identification device calculates fitting parameters based on the part or all of the arrival time intervals, the probabilities of the part or all of the arrival time intervals and a reference time interval probability distribution model, the reference time interval probability distribution model is used to characterize the distribution characteristics of the probability of the arrival time intervals of the packets of the first type of historical traffic, and the fitting parameters are used to indicate the degree of fit between the distribution characteristics of the probability of the part or all of the arrival time intervals and the reference time interval probability distribution model; the traffic identification device determines the type of traffic to be analyzed based on the fitting parameters.

[0018] In this possible implementation method, an implementation method of characterizing similarity by means of fitting parameters and a specific implementation method of calculating the fitting parameters are shown. The fitting parameters are used to characterize the degree of fit between the distribution characteristics of the probability of part or all of the arrival time intervals and the probability distribution model of the reference time interval, thereby achieving accurate judgment of the type of traffic to be analyzed through fitting parameters and improving the accuracy of traffic identification.

[0019] In another possible implementation, the fitting parameters include the inverse of the relative entropy and the KS test value; the traffic identification device determines the type of the traffic to be analyzed based on the fitting parameters, including: when the traffic identification device determines that the inverse of the relative entropy is greater than a first preset threshold and the KS test value is less than a second preset threshold, determining that the traffic to be analyzed is the first type of traffic.

[0020] In this possible implementation, two specific forms of fitting parameters are provided, namely the inverse of the relative entropy and the KS test value, and the process of identifying the type of the flow to be analyzed by the inverse of the relative entropy and the KS test value is shown, which improves the feasibility of the solution.

[0021] In another possible implementation, the first type of traffic is game traffic or video traffic.

[0022] In this possible implementation, the traffic identification method in the embodiment of the present application is applicable to the identification of game traffic and / or video traffic, and may also be applicable to the identification of other types of traffic.

[0023] In another possible implementation, the method also includes: the traffic identification device obtains historical traffic of the first type; the traffic identification device obtains the arrival time interval of the packets of the historical traffic and the probability of the arrival time interval of the packets of the historical traffic; the traffic identification device establishes the reference time interval probability distribution model based on the arrival time interval of the packets of the historical traffic and the probability of the arrival time interval of the packets of the historical traffic.

[0024] In this possible implementation, the traffic identification device can also establish a reference time interval probability distribution model through the arrival time interval of the packets of the historical traffic and the probability of the arrival time interval of the packets of the historical traffic. In this way, it can determine whether the traffic to be analyzed is the first type of traffic through the similarity between the reference time interval probability distribution model and the distribution characteristics of the probability of part or all of the arrival time intervals of the packets of the traffic to be analyzed, thereby accurately identifying the type of the traffic to be analyzed.

[0025] In another possible implementation manner, the reference time interval probability distribution model includes any one of the following: a power law distribution model, a Gaussian distribution model, a normal distribution model, and a Poisson distribution model.

[0026] In this possible implementation, multiple possible forms of the reference time interval probability distribution model are provided. When selecting the reference time interval probability distribution model, a model that is more consistent with the distribution characteristics of the probability of the arrival time interval of the message corresponding to the traffic type should be selected in combination with the traffic type and experimental results. For example, for game traffic, the distribution characteristics of the probability of the arrival time interval of the message of the game traffic are more consistent with the distribution characteristics of the power-law distribution model. Therefore, the traffic identification device can select the power-law distribution model as the reference time interval probability distribution model.

[0027] In another possible implementation, when the traffic identification device determines the type of traffic to be analyzed based on the probability distribution characteristics of some arrival time intervals in the arrival time interval, the some arrival time intervals in the arrival time intervals are the arrival time intervals in the arrival time intervals of the packets of the traffic to be analyzed that are less than a third preset threshold.

[0028] In this possible implementation, since the arrival time intervals of the packets of the game traffic or video traffic are relatively small, the probability distribution characteristics of the arrival time intervals with smaller arrival time intervals among the arrival time intervals of the packets of the traffic to be analyzed can to a certain extent reflect the type of the traffic to be analyzed.

[0029] In another possible implementation, the method also includes: the traffic identification device determines a first message of the traffic to be analyzed, and the arrival time interval of the first message is less than a third preset threshold; the traffic identification device determines the ratio of the number of the first message to the total number of messages included in the traffic to be analyzed; when the traffic identification device determines that the ratio is greater than a fourth preset threshold, the traffic identification device triggers the execution of a step of determining the type of the traffic to be analyzed based on the distribution characteristics of the probabilities of part or all of the arrival time intervals in the arrival time interval.

[0030] In this possible implementation, through the preliminary screening process of traffic by the traffic identification device in the above solution, traffic identification can avoid further identification of all network traffic flowing through the traffic identification device, thereby improving traffic identification efficiency.

[0031] A second aspect of an embodiment of the present application provides a flow identification device, the flow identification device comprising:

[0032] A first acquisition unit, used to acquire the flow to be analyzed of the target data flow;

[0033] A second acquisition unit, used to acquire the arrival time interval of the packets of the traffic to be analyzed;

[0034] The first determining unit is configured to determine the type of the traffic to be analyzed according to a distribution characteristic of probabilities of a part or all of the arrival time intervals in the arrival time interval.

[0035] In a possible implementation manner, the first determining unit is specifically configured to:

[0036] The type of the traffic to be analyzed is determined according to the similarity between the distribution characteristics of the probabilities of part or all of the arrival time intervals in the arrival time interval and the distribution characteristics of the probabilities of the arrival time intervals of the packets of the first type of historical traffic.

[0037] In another possible implementation manner, the first determining unit is specifically configured to:

[0038] When the similarity is higher than the first similarity, it is determined that the traffic to be analyzed is the first type of traffic.

[0039] In another possible implementation, the similarity is characterized by the degree of fit between the distribution characteristics of the probability of the partial or all of the arrival time intervals and the reference time interval probability distribution model, and the reference time interval probability distribution model is used to characterize the distribution characteristics of the probability of the arrival time interval of the packets of the first type of historical traffic; the first determination unit is specifically used to:

[0040] When the degree of fit is higher than the first degree of fit, it is determined that the traffic to be analyzed is the first type of traffic.

[0041] In another possible implementation, the degree of fit is characterized by the inverse of the relative entropy and the KS test value. When the inverse of the relative entropy is equal to the first preset threshold and the KS test value is equal to the second preset threshold, the degree of fit is the first degree of fit; when the inverse of the relative entropy is greater than the first preset threshold and the KS test value is less than the second preset threshold, the degree of fit is higher than the first degree of fit.

[0042] In another possible implementation manner, the first determining unit is specifically configured to:

[0043] Calculating a fitting parameter according to the partial or full arrival time interval, the probability of the partial or full arrival time interval, and a reference time interval probability distribution model, the reference time interval probability distribution model is used to characterize the distribution characteristics of the probability of the arrival time interval of the packets of the first type of historical traffic, and the fitting parameter is used to indicate the degree of fit between the distribution characteristics of the probability of the partial or full arrival time interval and the reference time interval probability distribution model;

[0044] The type of the flow to be analyzed is determined according to the fitting parameters.

[0045] In another possible implementation, the fitting parameters include the inverse of the relative entropy and the Kolmogorov-Smirnov KS test value; the first determination unit is specifically used for:

[0046] When the traffic identification device determines that the inverse of the relative entropy is greater than a first preset threshold and the KS test value is less than a second preset threshold, it is determined that the traffic to be analyzed is a first type of traffic.

[0047] In another possible implementation, the first type of traffic is game traffic or video traffic.

[0048] In another possible implementation, the first acquiring unit is further configured to:

[0049] Get the historical traffic of the first type;

[0050] The second acquisition unit is further used for:

[0051] Obtaining the arrival time interval of the packets of the historical traffic and the probability of the arrival time interval of the packets of the historical traffic;

[0052] The flow identification device also includes an establishment unit;

[0053] The establishing unit is used to establish the reference time interval probability distribution model according to the arrival time interval of the packets of the historical traffic and the probability of the arrival time interval of the packets of the historical traffic.

[0054] In another possible implementation manner, the reference time interval probability distribution model includes any one of the following: a power law distribution model, a Gaussian distribution model, a normal distribution model, and a Poisson distribution model.

[0055] In another possible implementation, when the first determination unit determines the type of the traffic to be analyzed based on the probability distribution characteristics of some arrival time intervals in the arrival time interval, the some arrival time intervals in the arrival time interval are the arrival time intervals in the arrival time intervals of the packets of the traffic to be analyzed that are less than a third preset threshold.

[0056] In another possible implementation, the traffic identification device further includes a second determination unit and a triggering unit;

[0057] The second determination unit is used to determine a first message of the flow to be analyzed, the arrival time interval of the first message being less than a third preset threshold; determine a ratio of the number of the first message to the total number of messages included in the flow to be analyzed;

[0058] The trigger unit is used to trigger the first determination unit to execute the step of determining the type of the traffic to be analyzed based on the distribution characteristics of the probability of part or all of the arrival time intervals in the arrival time interval when the traffic identification device determines that the ratio is greater than a fourth preset threshold.

[0059] A third aspect of an embodiment of the present application provides a flow identification device, which includes: a processor, a memory, an input / output device, and a bus; the memory stores computer instructions; when the processor executes the computer instructions in the memory, the memory stores computer instructions; when the processor executes the computer instructions in the memory, it is used to implement any one of the implementation methods of the first aspect.

[0060] In a possible implementation manner of the third aspect, the processor, the memory, and the input and output devices are respectively connected to the bus.

[0061] A fourth aspect of an embodiment of the present application provides a chip system, which includes a processor for supporting a network device to implement the functions involved in the first aspect, for example, sending or processing the data and / or information involved in the above method. In one possible design, the chip system also includes a memory, which is used to store program instructions and data necessary for the network device. The chip system can be composed of a chip, or it can include a chip and other discrete devices.

[0062] A fifth aspect of the embodiments of the present application provides a computer program product comprising instructions, characterized in that when the computer program product is run on a computer, the computer is caused to execute any one of the implementation methods of the first aspect.

[0063] A sixth aspect of an embodiment of the present application provides a computer-readable storage medium, characterized in that it includes instructions, which, when executed on a computer, enable the computer to execute any one of the implementation methods in the first aspect.

[0064] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0065] It can be known from the above technical solution that the traffic identification device obtains the traffic to be analyzed of the target data flow; then, the traffic identification device obtains the arrival time interval of the message of the traffic to be analyzed, and then determines the type of the traffic to be analyzed based on the probability distribution characteristics of part or all of the time intervals in the arrival time interval. Since the probability distribution of the arrival time interval of the message of each type of traffic has a certain distribution law. Therefore, the traffic identification device can accurately identify the type of the traffic to be analyzed through the probability distribution characteristics of the arrival time interval of the message of the traffic to be analyzed. For example, when the probability distribution characteristics of all or part of the arrival time intervals in the arrival time interval of the message of the traffic to be analyzed are relatively consistent with the probability distribution characteristics of the message of the game traffic, the traffic identification device can determine that the traffic to be analyzed is the game traffic, thereby accurately identifying the game traffic and improving the recognition accuracy of the game traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 A schematic diagram of a framework of an embodiment of the present application;

[0067] Figure 2A A schematic diagram of an embodiment of the flow identification method of the present application;

[0068] Figure 2B A schematic diagram of a scenario of the traffic identification method according to an embodiment of the present application;

[0069] Figure 3A This is another schematic diagram of an embodiment of the flow identification method of the present application;

[0070] Figure 3B A schematic diagram of the probability distribution of the time intervals of arrival of messages of the game traffic of the game application "King of Glory" in an embodiment of the present application;

[0071] Figure 3C It is a schematic diagram of the distribution of the inverse of the relative entropy and the KS test quantity corresponding to the flow to be analyzed in the embodiment of the present application;

[0072] Figure 3D A schematic diagram of the probability distribution of the time intervals of arrival of packets of the video traffic of the video application "iQIYI" in an embodiment of the present application;

[0073] Figure 4 This is another schematic diagram of an embodiment of the flow identification method of the present application;

[0074] Figure 5 A schematic diagram of the structure of the flow identification device according to an embodiment of the present application;

[0075] Figure 6 This is another structural schematic diagram of the traffic identification device according to an embodiment of the present application. DETAILED DESCRIPTION

[0076] The embodiments of the present application provide a traffic identification method and a traffic identification device for accurately identifying game traffic and improving the accuracy of game traffic identification.

[0077] See also Figure 1 , Figure 1 FIG. 1 is a schematic diagram of a framework of an embodiment of the present application. Figure 1 As shown in Figure 1, the game traffic of the game service flow will flow through the network devices at each layer in the network during the network transmission process. For example, if the game server sends the game service flow, the game traffic of the game service flow will flow through the network devices at each layer in the network. Figure 1Broadband remote access server (BRAS), optical line terminal (OLT) and optical network terminal (ONT) of the network. It can be seen that in the network, the game traffic of the transmitted game business flow will flow through the network devices deployed at each layer, so the game traffic can be obtained in the network devices deployed at each layer. Therefore, the technical solution of the embodiment of the present application proposes to deploy or hang a traffic identification device at a single point or multiple points in any one of the network devices deployed at each layer in the network, and the traffic identification device collects the network traffic of various types of terminal devices (for example, mobile phones, personal computers, televisions, etc.), and identifies the network traffic to determine the type of network traffic, so as to facilitate the use of machine learning and statistical learning methods to infer the service type corresponding to the network traffic, and provide service guarantee according to the priority of the service type.

[0078] It should be noted that the traffic identification device can be integrated into the network devices deployed at each layer at a single point or multiple points, or it can be hung in the network devices deployed at each layer, which is not limited in this application.

[0079] Above Figure 1 Only the application scenario of identifying game traffic is shown, and it is also applicable to scenarios that are not shown in this application and have similar or identical requirements, and this application does not limit it. For example, the technical solution of the embodiment of the present application is also applicable to the application scenario where the traffic identification device is used to identify video traffic. The technical solution of the embodiment of the present application is also applicable to the application scenario where the traffic identification device is used to identify both game traffic and video traffic.

[0080] The technical solution of the embodiments of the present application is introduced below through specific examples.

[0081] See also Figure 2A , Figure 2A This is a schematic diagram of an embodiment of the flow identification method of the present application. Figure 2A The method comprises:

[0082] 201. The traffic identification device obtains the traffic to be analyzed of the target data flow.

[0083] For example, Figure 1As shown, the flow identification device is integrated and deployed in the optical network terminal as an example for explanation. When the network flow passes through the optical network terminal through the transmission flow, the flow identification device can obtain the network flow. Then, the flow identification device determines that the network flow belongs to the flow of the target data flow based on the quintuple of the network flow. Then, the flow identification device uses the network flow as the flow to be analyzed; or, the flow identification device uses part of the flow in the network flow as the flow to be analyzed. For example, the part of the flow includes the first m packets in the network flow, where m is an integer greater than 0.

[0084] It should be noted that when the network traffic includes traffic of multiple data flows, the traffic identification device identifies the traffic of the target data flow from the network traffic through quintuple identification, and then uses part or all of the traffic of the target data flow as the traffic to be analyzed.

[0085] For example, network traffic includes traffic of data stream A and traffic of data stream B. Data stream A is the target data stream, and the flow traffic identification device identifies the traffic of data stream A in the network traffic through the five-tuple, and then uses part or all of the traffic of the identified data stream A as the traffic to be analyzed.

[0086] 202. The traffic identification device obtains the arrival time interval of the packets of the traffic to be analyzed.

[0087] The message arrival time interval is the time interval between two messages of the same data stream received continuously by the traffic identification device. Specifically, the message arrival time interval can be the interval between the time when the traffic identification device receives the message and the time when the next message of the message is received, or the interval between the time when the traffic identification device receives the message and the time when the previous message of the message is received.

[0088] For example, Figure 2B As shown, message 1, message 2 and message 3 are three messages of the target data stream continuously received by the traffic identification device. The time point when the traffic identification device receives message 1 is the moment of the 1ms (millisecond). The time point when the traffic identification device receives message 2 is the moment of the 1.8ms. The time point when the traffic identification device receives message 3 is 3. In one possible implementation, the arrival time interval of message 2 can be understood as the time difference between the time point when the traffic identification device receives message 3 and the time point when the traffic identification device receives message 2, that is, the arrival time interval of message 2 is 1.2ms. In another possible implementation, the arrival time interval of message 2 can be understood as the time difference between the time point when the traffic identification device receives message 2 and the time point when the traffic identification device receives message 1, that is, the arrival time interval of message 2 is 0.8ms.

[0089] 203. The traffic identification device determines the type of the traffic to be analyzed according to the probability distribution characteristics of part or all of the time intervals in the arrival time intervals of the packets of the traffic to be analyzed.

[0090] The probability of an arrival time interval refers to the probability that the arrival time interval appears in the arrival time interval of the packets of the traffic to be analyzed. There are many ways to calculate the probability of the arrival time interval, which are explained below by examples:

[0091] 1. The probability of an arrival time interval is the ratio of the number of packets whose arrival time interval is the arrival time interval in the arrival time interval of the packets of the traffic to be analyzed to the total number of packets of the traffic to be analyzed.

[0092] For example, for the probability of arrival time interval A, the total number of packets of the traffic to be analyzed is M, and the M packets include N packets with arrival time interval A, then it can be known that the probability of arrival time interval A is N / M. Among them, A is greater than 0, M is an integer greater than 0, and N is an integer greater than 0 and less than M.

[0093] 2. The probability of an arrival time interval is the ratio of the number of arrival time intervals in the arrival time intervals of the packets of the traffic to be analyzed to the total number of arrival time intervals in the arrival time intervals of the packets of the traffic to be analyzed. That is, the probability of an arrival time interval is the ratio of the number of times the arrival time interval occurs to the total number of times all arrival time intervals occur in the arrival time intervals of the packets of the traffic to be analyzed.

[0094] For example, with respect to the probability of arrival time interval A, the arrival time intervals of the packets of the traffic to be analyzed are 1ms, 2ms, 2ms, 3ms, and 5ms respectively. The traffic identification device determines that the total number of arrival time intervals of the packets of the traffic to be analyzed is 5. The arrival time interval A is 2ms, so the traffic identification device determines that the number of arrival time intervals of the packets of the traffic to be analyzed with an arrival time interval of 2ms is 2. It can be seen that the probability of an arrival time interval of 2ms is 40%.

[0095] In this embodiment, the type of the traffic to be analyzed is the first type of traffic or the second type of traffic. The first type of traffic includes game traffic, and the second type of traffic is non-game traffic; or the first type of traffic is video traffic, and the second type of traffic is non-video traffic. For example, the non-video traffic is download data traffic.

[0096] Some of the arrival time intervals in the arrival time intervals of the packets of the traffic to be analyzed include arrival time intervals in the arrival time intervals of the packets of the traffic to be analyzed whose arrival time intervals are smaller than a third preset threshold.

[0097] For example, the arrival time intervals of the packets of the traffic to be analyzed are 1ms, 2ms, 2ms, 3ms, 5ms, 9ms, 20ms and 30ms respectively. The third preset threshold is 10ms, then the arrival time intervals of this part are 1ms, 2ms, 2ms, 3ms and 5ms, of which 1ms, 3ms and 5ms appear once, and 2ms appears twice. Since the arrival time intervals of the packets of the game traffic or video traffic are relatively small, the traffic identification device can determine the type of the traffic to be analyzed by the distribution characteristics of the probability of the arrival time intervals with smaller arrival time intervals among the arrival time intervals of the packets of the traffic to be analyzed.

[0098] For example, since the probability distribution characteristics of the arrival time intervals of game traffic packets are consistent with the distribution characteristics of the probability distribution model, when the traffic identification device determines that the probability distribution characteristics of part or all of the arrival time intervals are highly similar to the distribution characteristics of the probability distribution model, the traffic identification device can determine that the traffic to be analyzed is game traffic, thereby accurately identifying the game traffic and improving the identification accuracy of the game traffic.

[0099] In this embodiment, optionally, step 203 specifically includes step 203a.

[0100] Step 203a, the traffic identification device determines the type of the traffic to be analyzed based on the similarity between the probability distribution characteristics of part or all of the arrival time intervals of the packets of the traffic to be analyzed and the probability distribution characteristics of the arrival time intervals of the packets of the first type of historical traffic.

[0101] Specifically, the traffic identification device can determine whether the traffic to be analyzed is the first type of traffic by the similarity between the probability distribution characteristics of part or all of the arrival time intervals of the packets of the traffic to be analyzed and the probability distribution characteristics of the arrival time intervals of the packets of the first type of historical traffic.

[0102] Optionally, when the similarity is higher than the first similarity, the traffic identification device determines that the traffic to be analyzed is the first type of traffic.

[0103] In a possible implementation, the similarity is characterized by the degree of fit between the distribution characteristics of the probability of the partial or all arrival time intervals and the reference time interval probability distribution model, and the reference time interval probability distribution model is used to characterize the distribution characteristics of the probability of the arrival time intervals of the packets of the first type of historical traffic; the first similarity corresponds to the first degree of fit. Then, when the degree of fit is higher than the first degree of fit, the traffic identification device determines that the traffic to be analyzed is the first type of traffic.

[0104] The degree of fit is characterized by the inverse of the relative entropy and the KS test value. When the inverse of the relative entropy is equal to the first preset threshold and the KS test value is equal to the second preset threshold, the degree of fit is the first degree of fit; correspondingly, when the inverse of the relative entropy is greater than the first preset threshold and the KS test value is less than the second preset threshold, the degree of fit is higher than the first degree of fit.

[0105] The calculation process of the inverse of the relative entropy and the KS test value can be found in the related introduction of the subsequent step 3001, which will not be repeated here.

[0106] In an embodiment of the present application, a traffic identification device obtains the traffic to be analyzed of the target data stream; then, the traffic identification device obtains the arrival time interval of the message of the traffic to be analyzed, and then determines the type of the traffic to be analyzed based on the distribution characteristics of the probability of part or all of the arrival time intervals in the arrival time interval. Since the probability distribution of the arrival time interval of the message of each type of traffic has a certain distribution law. Therefore, the traffic identification device can accurately identify the type of the traffic to be analyzed through the distribution characteristics of the probability of the arrival time interval of the message of the traffic to be analyzed. For example, when the distribution characteristics of the probability of all or part of the arrival time intervals in the arrival time interval of the message of the traffic to be analyzed are relatively consistent with the distribution characteristics of the probability of the message of the game traffic, the traffic identification device can determine that the traffic to be analyzed is the game traffic, thereby accurately identifying the game traffic and improving the recognition accuracy of the game traffic.

[0107] In the embodiment of the present application, optionally, the above Figure 2A Step 202a in the embodiment shown has a specific execution process, and step 202a specifically includes step 3001 and step 3002. Figure 3A The embodiment shown is described in detail. Figure 3A , Figure 3A This is a schematic diagram of another embodiment of the traffic identification method of the embodiment of the present application.

[0108] 3001. The traffic identification device calculates fitting parameters based on the partial or complete arrival time interval, the probability of the partial or complete arrival time interval and a reference time interval probability distribution model.

[0109] In this embodiment, the fitting parameter is used to indicate the degree of fit between the distribution characteristics of the probability of the partial or all time intervals and the reference time interval probability distribution model. The reference time interval probability distribution model is used to characterize the distribution characteristics of the probability of the time intervals of the packets of the first type of traffic.

[0110] The reference time interval probability distribution model is a model trained based on the first type of historical traffic, and is used by the traffic identification device to calculate fitting parameters based on the partial or full arrival time interval and the probability of the partial or full time interval.

[0111] Optionally, the fitting parameters include the inverse of the relative entropy r and / or the KS test quantity p.

[0112] First, the calculation process of the inverse of relative entropy r is introduced. Here, the distribution characteristics of the probability of partial or complete arrival time intervals are expressed as function P(i), where P(i) refers to the probability of the arrival time interval of the i-th message of the traffic to be analyzed received by the traffic identification device obtained by actual measurement. The reference time interval probability distribution model is function Q(i), where Q(i) refers to the probability of the arrival time interval of the i-th message of the traffic to be analyzed received by the traffic identification device calculated by the reference time interval probability distribution model. Relative entropy is in, It refers to the sum of x corresponding to 1 to n, and ln(a) refers to the logarithm of a with e as the base. Then, the reciprocal of relative entropy is r = 1 / D KL (P||Q).

[0113] For example, the probability of the arrival time interval and the total arrival time interval of the packets of the traffic to be analyzed is as follows: Figure 3B In the distribution diagram shown, the horizontal axis is the arrival time interval of the packets of the traffic to be analyzed, and the vertical axis is the probability of all arrival time intervals. According to the time sequence of the packets arriving at the traffic identification device, the traffic identification device uses the arrival time intervals corresponding to n packets as input parameters, inputs them into the reference time interval probability distribution model, and calculates the reference probability of the arrival time intervals corresponding to the n packets. Then, the traffic identification device substitutes the arrival time intervals corresponding to the n packets, the probability of the arrival time intervals of the n packets actually measured, and the reference probability of the arrival time intervals corresponding to the n packets into Then calculate the D KL The reciprocal r of (P||Q), n is an integer greater than 1.

[0114] The calculation process of the KS test quantity p is introduced below. The distribution characteristics of the probability of partial or complete arrival time interval are expressed as function F N (x), F N (x) refers to the probability of the arrival time interval x in the arrival time interval of the message of the traffic to be analyzed obtained by actual measurement. The reference time interval probability distribution model is expressed as a function F(x), and F(x) is the probability of the arrival time interval x in the arrival time interval of the message of the traffic to be analyzed calculated by the reference time interval probability distribution model. The traffic identification device determines p=Dn =sup|F N (x)-F(x)|, sup(b) is a function, which means taking the maximum value of b. |c| means taking the absolute value of c.

[0115] The traffic to be analyzed includes n messages. The traffic identification device takes the arrival time intervals of the n messages as x and substitutes them into F(x), and obtains the reference probability of the arrival time interval of each message in the n messages. The actual probability of the arrival time interval of each message (here the actual probability of the arrival time interval of each message is the actual measured value obtained by actual measurement) is known. The traffic identification device calculates the absolute value of the difference between the reference probability and the actual probability of the arrival time interval of each message in the n messages. Then the traffic identification device obtains the n absolute values ​​corresponding to the n messages, and then determines the maximum value of the n absolute values. It can be seen that the maximum value is Dn, that is, p is obtained.

[0116] In this embodiment, the reference time interval probability distribution model can be a model trained by the traffic identification device based on the first type of historical traffic, or it can be a model trained by other devices based on the first type of historical traffic and configured on the traffic identification device. The specific details are not limited here.

[0117] In this implementation, the reference time interval probability distribution model includes a power law distribution model, a Gaussian distribution model, a normal distribution model or a Poisson distribution model, which is not specifically limited in this application.

[0118] In the embodiment of the present application, when selecting the reference time interval probability distribution model, a model that is more consistent with the distribution characteristics of the probability of the arrival time interval of the message corresponding to the traffic type should be selected in combination with the traffic type and the experimental results. For example, for game traffic, the distribution characteristics of the probability of the arrival time interval of the message of the game traffic are more consistent with the distribution characteristics of the power law distribution model. Therefore, when the traffic identification device identifies the game traffic, the power law distribution model can be selected as the reference time interval probability distribution model.

[0119] It should be noted that when the traffic identification device is used to identify both game traffic and video traffic, multiple reference time interval probability distribution models are configured in the traffic identification device. For example, the multiple reference time interval probability distribution models include a first time interval probability distribution model and a second time interval probability distribution model, the first time interval probability distribution model is used to characterize the distribution characteristics of the probability of the arrival time interval of the game traffic packets, and the second time interval probability distribution model is used to characterize the distribution characteristics of the probability of the arrival time interval of the video traffic packets.

[0120] When the traffic identification device identifies the traffic to be analyzed, the traffic identification device can first determine whether the traffic to be analyzed is game traffic by the similarity between the first time interval probability distribution model and the distribution characteristics of the probability of the partial or complete arrival time interval. If the similarity is high, the traffic identification device determines that the traffic to be analyzed is game traffic; if the similarity is low, the traffic identification device can determine whether the traffic to be analyzed is video traffic by the similarity between the second time interval probability distribution model and the distribution characteristics of the probability of the partial or complete arrival time interval. If the similarity is high, the traffic identification device determines that the traffic to be analyzed is video traffic; if the similarity is low, the traffic identification device determines that the traffic to be analyzed is neither game traffic nor video traffic.

[0121] 3002. The traffic identification device determines the type of the traffic to be analyzed according to the fitting parameters.

[0122] The type of traffic to be analyzed can be found in the above Figure 2A The relevant description of step 203 in the illustrated embodiment will not be repeated here.

[0123] Optionally, it can be known from the above step 3001 that the fitting parameters include the reciprocal of the relative entropy r and / or the KS test quantity p. Then, the step 3002 includes steps 3002a to 3002c.

[0124] Step 3002a: The traffic identification device determines whether r is greater than a first preset threshold and whether p is less than a second preset threshold; if so, proceed to step 3002b; if not, proceed to step 3002c.

[0125] For example, the first preset threshold is 1000, and the second preset threshold is 0.00001. The traffic identification device determines whether the calculated r is greater than 1000 and whether p is less than 0.00001. If so, the traffic identification device determines that the traffic to be analyzed is the first type of traffic; if not, the traffic identification device determines that the traffic to be analyzed is the second type of traffic. For specific identification results, please refer to Figure 3C In the schematic diagram shown in FIG. 1 , the horizontal axis is p and the vertical axis is r. The r and p corresponding to the to-be-analyzed traffic corresponding to the multiple data flows obtained by the traffic identification device are respectively shown by the coordinate point (p, r). Figure 3C It can be clearly determined that the gaming traffic and non-gaming traffic in the traffic to be analyzed corresponds to the multiple data streams.

[0126] It should be noted that the setting values ​​of the first preset threshold and the second preset threshold can be specifically determined by experimental data.

[0127] Step 3002b: The traffic identification device determines that the traffic to be analyzed is the first type of traffic.

[0128] Step 3002c: The traffic identification device determines that the traffic to be analyzed is the second type of traffic.

[0129] In the embodiment of the present application, optionally, in the above Figure 2A In the embodiment shown, before step 202, the above Figure 2A The illustrated embodiment further includes steps 202a to 202e.

[0130] Step 202a: The traffic identification device analyzes the first packet of the traffic.

[0131] The first message is a message whose arrival time interval is less than the third preset threshold value in the message of the traffic to be analyzed. For example, the third preset threshold value is 10ms (milliseconds), and the traffic identification device takes the message whose arrival time interval is 10ms in the traffic to be analyzed as the first message.

[0132] It should be noted that the size of the third preset threshold can be specifically determined according to the current network transmission state. For example, when the network transmission state is good, the third preset threshold is small; when the network transmission state is poor, the third preset threshold is large. The network transmission state can be specifically determined by the bandwidth and delay of the network transmission.

[0133] Step 202b: The traffic identification device determines the ratio of the number of first messages to the total number of messages extracted from the traffic to be analyzed.

[0134] For example, the total number of packets in the traffic to be analyzed is M, and the number of packets with an arrival time interval of 10 ms is L. It can be seen that the ratio of the number of packets with an arrival time interval of 10 ms to the total number of packets in the traffic to be analyzed is L / M, where L is an integer greater than 0 and less than M.

[0135] Step 202c: The traffic identification device determines whether the ratio is greater than a fourth preset threshold value, and if so, executes step 202d; if not, executes step 202e.

[0136] For example, the fourth preset threshold is 80%, and the traffic identification device determines whether the ratio is greater than 80%. If so, the traffic identification device preliminarily determines that the traffic to be analyzed is the first type of traffic, and the traffic identification device can further identify the traffic to be analyzed to accurately identify the type of the traffic to be analyzed; if not, the traffic identification device determines the second type of traffic.

[0137] It should be noted that the fourth preset threshold value may be determined through multiple experimental data.

[0138] Step 202d: The traffic identification device triggers the execution of the above step 203.

[0139] When the traffic identification device determines that the ratio is greater than the fourth preset threshold, the traffic identification device executes step 203 to further identify the traffic to be analyzed. Through the screening process of step 202c above, the traffic identification device can avoid further identifying all network traffic flowing through the traffic identification device, thereby improving the traffic identification efficiency.

[0140] Step 202e: The traffic identification device determines that the traffic to be analyzed is the second type of traffic.

[0141] In the embodiment of the present application, optionally, in the above Figure 2A In the embodiment shown, before step 202, the above Figure 2A The illustrated embodiment further includes steps 202f to 202h.

[0142] Step 202f: The traffic identification device obtains the historical traffic of the first type;

[0143] The historical traffic is game traffic or video traffic.

[0144] Specifically, the server tags the historical traffic, and the tag indicates that the historical traffic is the first type of traffic. In this way, when the traffic identification device receives the historical traffic, it determines that the historical traffic is the first type of traffic through the tag. The size of the historical traffic is generally selected to be 1 to 2 GB.

[0145] Step 202g: The traffic identification device determines the arrival time interval of the packets of the historical traffic and the probability of the arrival time interval of the packets of the historical traffic.

[0146] Step 202g is the same as the above Figure 2A In the embodiment shown, step 202 is similar, and please refer to the aforementioned Figure 2A The relevant introduction of step 202 in the illustrated embodiment will not be repeated here.

[0147] Step 202h: The traffic identification device establishes a reference time interval probability distribution model according to the arrival time interval of the packets of the historical traffic and the probability of the arrival time interval of the packets of the historical traffic.

[0148] Specifically, the traffic identification device uses the arrival time interval of the packets of the historical traffic as the horizontal axis and the probability of the arrival time interval of the packets of the historical traffic as the vertical axis to obtain the probability distribution diagram of the arrival time interval of the packets of the historical traffic. Then, the traffic identification device determines the time interval probability distribution model to be proposed based on the probability distribution diagram of the arrival time interval of the packets of the historical traffic, and calculates the parameter values ​​of the time interval probability distribution model to be proposed. The traffic identification device substitutes the parameter values ​​into the time interval probability distribution model to be proposed to obtain the reference time interval distribution probability model. Optionally, the traffic identification device calculates the parameter values ​​of the time interval probability distribution model to be proposed by the maximum likelihood estimation method.

[0149] For example, the historical traffic is the game traffic of the game application "Honor of Kings". The traffic identification device uses the arrival time interval of the packets of the historical traffic as the horizontal axis and the probability of the arrival time interval of the packets of the historical traffic as the vertical axis to obtain the probability distribution diagram of the arrival time interval of the packets of the historical traffic. Figure 3B , Figure 3B This is a schematic diagram of the probability distribution of the time interval between arrivals of packets of the historical traffic of the game application "King of Glory". Figure 3B It can be seen from the time interval probability distribution diagram that the distribution characteristics of the probability of the arrival time interval of the historical traffic message are consistent with the distribution characteristics of the power-law distribution model. The traffic identification device determines that the time interval probability distribution model to be proposed is a power-law distribution model; then, the traffic identification device calculates the parameter value of the power-law distribution model through the maximum likelihood estimation method, and then substitutes the parameter value into the power-law distribution model to obtain the reference time interval distribution model.

[0150] For example, the historical traffic is the video traffic of the video application "iQiyi". The traffic identification device uses the arrival time interval of the packets of the historical traffic of "iQiyi" as the horizontal axis and the probability of the arrival time interval of the packets of the traffic to be analyzed as the vertical axis to obtain the probability distribution diagram of the arrival time interval of the packets of the traffic to be analyzed. Figure 3D As shown, Figure 3D This is a schematic diagram of the probability distribution of the time interval between arrivals of packets of the historical traffic of the video application "iQiyi". Figure 3D It can be seen that the probability distribution characteristics of the time intervals of the packets of the historical traffic are consistent with the distribution characteristics of the Gaussian distribution model. Therefore, the traffic identification device calculates the parameter value of the Gaussian distribution model through the maximum likelihood estimation method, and then substitutes the parameter value into the Gaussian distribution model to obtain the reference time interval distribution model.

[0151] From the above examples, it can be seen that the distribution characteristics of the probability of the time interval of arrival of packets of game traffic are consistent with the distribution characteristics of the power-law distribution model. Therefore, when the traffic identification device identifies game traffic, it can accurately determine that the traffic to be analyzed is game traffic by comparing the distribution characteristics of the probability of the time interval of arrival of packets of the traffic to be analyzed with the distribution characteristics of the power-law distribution model. The distribution characteristics of the probability of the time interval of arrival of packets of video traffic are consistent with the distribution characteristics of the Gaussian distribution model. The traffic identification device can accurately determine whether the traffic to be analyzed is video traffic by comparing the distribution characteristics of the probability of the time interval of arrival of packets of the traffic to be analyzed with the distribution characteristics of the Gaussian distribution model.

[0152] In the embodiment of the present application, optionally, the above Figure 2A In the embodiment shown, step 202 specifically includes steps 4001 to 4004. Figure 4 , Figure 4 This is another embodiment schematic diagram of the flow identification method in the embodiment of the present application, the method comprising:

[0153] 4001. The traffic identification device determines the first quintuple of the second message and the second quintuple of the third message.

[0154] The first five-tuple includes the source IP address, destination IP address, source port number, destination port number and transport protocol type of the second message. The second five-tuple includes the source IP address, destination IP address, source port number, destination port number and transport protocol type of the second message.

[0155] Specifically, the traffic identification device obtains the first quintuple through the message header of the second message and obtains the second quintuple through the message header of the third message.

[0156] 4002. The traffic identification device determines, based on the first quintuple and the second quintuple, that the second message and the third message are two messages of the target data flow.

[0157] 4003. The traffic identification device determines, based on the first moment and the second moment, that the second message and the third message are two messages of the target data flow that are continuously received by the traffic identification device.

[0158] The first moment is the moment when the traffic identification device receives the second message, and the second moment is the moment when the traffic identification device receives the third message.

[0159] Specifically, the traffic identification device determines the timestamps of the arrival of the messages according to the time sequence in which the messages arrive at the traffic identification device, and the timestamps can be used to determine that the traffic identification device receives the second message at the first moment and receives the third message at the second moment. Then, the traffic identification device determines, based on the timestamps, that the second message and the third message are two messages of the target data flow that are continuously received by the traffic identification device.

[0160] Optionally, the third message is the next message of the second message, or is the previous message of the second message, which is not specifically limited here.

[0161] 4004. The traffic identification device uses the time difference between the first moment and the second moment as the arrival time interval of the second message.

[0162] Specifically, when understanding step 4003 and step 4004, the above Figure 2A The example of step 202 in the illustrated embodiment will not be described in detail here.

[0163] The following is an introduction to the flow identification device provided in the embodiment of the present application. Figure 5 , Figure 5 This is a schematic diagram of the structure of the flow identification method of the present application embodiment. The flow identification device can be used to perform the above Figure 2A , Figure 3A and Figure 4 For details of the steps performed by the traffic identification device in the illustrated embodiment, please refer to the relevant description in the above method embodiment.

[0164] The traffic identification device includes a first acquisition unit 501, a second acquisition unit 502 and a first determination unit 503. Optionally, the traffic identification device also includes an establishment unit 504, a second determination unit 505 and a triggering unit 506.

[0165] The first acquisition unit 501 is used to acquire the traffic to be analyzed of the target data flow;

[0166] The second acquisition unit 502 is used to acquire the arrival time interval of the packets of the traffic to be analyzed;

[0167] The first determining unit 503 is configured to determine the type of the traffic to be analyzed according to a distribution characteristic of probabilities of a part or all of the arrival time intervals in the arrival time interval.

[0168] In a possible implementation, the first determining unit 503 is specifically configured to:

[0169] The type of the traffic to be analyzed is determined according to the similarity between the distribution characteristics of the probabilities of part or all of the arrival time intervals in the arrival time interval and the distribution characteristics of the probabilities of the arrival time intervals of the packets of the first type of historical traffic.

[0170] In another possible implementation, the first determining unit 503 is specifically configured to:

[0171] When the similarity is higher than the first similarity, it is determined that the traffic to be analyzed is the first type of traffic.

[0172] In another possible implementation, the similarity is characterized by the degree of fit between the distribution characteristics of the probability of the partial or all of the arrival time intervals and the reference time interval probability distribution model, and the reference time interval probability distribution model is used to characterize the distribution characteristics of the probability of the arrival time interval of the message of the first type of historical traffic; the first determination unit 503 is specifically used to:

[0173] When the degree of fit is higher than the first degree of fit, it is determined that the traffic to be analyzed is the first type of traffic.

[0174] In another possible implementation, the degree of fit is characterized by the inverse of the relative entropy and the KS test value. When the inverse of the relative entropy is equal to the first preset threshold and the KS test value is equal to the second preset threshold, the degree of fit is the first degree of fit; when the inverse of the relative entropy is greater than the first preset threshold and the KS test value is less than the second preset threshold, the degree of fit is higher than the first degree of fit.

[0175] In another possible implementation, the first determining unit 503 is specifically configured to:

[0176] Calculating a fitting parameter according to the partial or full arrival time interval, the probability of the partial or full arrival time interval, and a reference time interval probability distribution model, the reference time interval probability distribution model is used to characterize the distribution characteristics of the probability of the arrival time interval of the packets of the first type of historical traffic, and the fitting parameter is used to indicate the degree of fit between the distribution characteristics of the probability of the partial or full arrival time interval and the reference time interval probability distribution model;

[0177] The type of the flow to be analyzed is determined according to the fitting parameters.

[0178] In another possible implementation, the fitting parameters include the inverse of the relative entropy and the Kolmogorov-Smirnov KS test value; the first determination unit 503 is specifically used for:

[0179] When the traffic identification device determines that the inverse of the relative entropy is greater than a first preset threshold and the KS test value is less than a second preset threshold, it is determined that the traffic to be analyzed is a first type of traffic.

[0180] In another possible implementation, the first type of traffic is game traffic or video traffic.

[0181] In another possible implementation, the first acquiring unit 501 is further configured to:

[0182] Get the historical traffic of the first type;

[0183] The second acquisition unit 502 is further used for:

[0184] Obtaining the arrival time interval of the packets of the historical traffic and the probability of the arrival time interval of the packets of the historical traffic;

[0185] The establishing unit 504 is used to establish the reference time interval probability distribution model according to the arrival time interval of the packets of the historical traffic and the probability of the arrival time interval of the packets of the historical traffic.

[0186] In another possible implementation manner, the reference time interval probability distribution model includes any one of the following: a power law distribution model, a Gaussian distribution model, a normal distribution model, and a Poisson distribution model.

[0187] In another possible implementation, when the first determination unit 503 determines the type of the traffic to be analyzed based on the probability distribution characteristics of some arrival time intervals in the arrival time interval, the some arrival time intervals in the arrival time interval are the arrival time intervals in the arrival time intervals of the packets of the traffic to be analyzed that are less than a third preset threshold.

[0188] In another possible implementation, the second determining unit 505 is used to:

[0189] Determine a first message of the traffic to be analyzed, wherein the arrival time interval of the first message is less than a third preset threshold; determine a ratio of the number of the first message to the total number of messages included in the traffic to be analyzed;

[0190] The trigger unit 506 is used to trigger the first determination unit 503 to execute the step of determining the type of the traffic to be analyzed based on the distribution characteristics of the probabilities of part or all of the arrival time intervals in the arrival time interval when the traffic identification device determines that the ratio is greater than a fourth preset threshold.

[0191] In the embodiment of the present application, the first acquisition unit 501 acquires the traffic to be analyzed of the target data flow; then, the second acquisition unit 502 acquires the arrival time interval of the message of the traffic to be analyzed; the first determination unit 503 determines the type of the traffic to be analyzed according to the distribution characteristics of the probability of part or all of the arrival time intervals in the arrival time interval. Since the probability distribution of the arrival time interval of the message of each type of traffic has a certain distribution law. Therefore, the first determination unit 503 can accurately identify the type of the traffic to be analyzed through the distribution characteristics of the probability of the arrival time interval of the message of the traffic to be analyzed. For example, when the distribution characteristics of the probability of all or part of the arrival time intervals in the arrival time interval of the message of the traffic to be analyzed are relatively consistent with the distribution characteristics of the probability of the message of the game traffic, the first determination unit 503 can determine that the traffic to be analyzed is the game traffic, thereby accurately identifying the game traffic and improving the recognition accuracy of the game traffic.

[0192] The present application embodiment also provides a flow identification device 600. Figure 6 , Figure 6 This is another structural diagram of the flow identification device of the embodiment of the present application. The flow identification device is used to perform Figure 2A , Figure 3A and Figure 4 For details of the steps performed by the traffic identification device in the illustrated embodiment, please refer to the relevant description in the aforementioned method embodiment.

[0193] The traffic identification device 600 includes: a processor 601 , a memory 602 , an input / output device 603 , and a bus 604 .

[0194] In a possible implementation, the processor 601, the memory 602, and the input and output device 603 are respectively connected to the bus 604, and the memory stores computer instructions.

[0195] The input-output device 603 is used to obtain the traffic to be analyzed of the target data flow;

[0196] The processor 601 is configured to obtain an arrival time interval of packets of the traffic to be analyzed; and determine a type of the traffic to be analyzed according to a distribution characteristic of probabilities of part or all of the arrival time intervals in the arrival time interval.

[0197] In a possible implementation, the processor 601 is specifically configured to:

[0198] The type of the traffic to be analyzed is determined according to the similarity between the distribution characteristics of the probabilities of part or all of the arrival time intervals in the arrival time interval and the distribution characteristics of the probabilities of the arrival time intervals of the packets of the first type of historical traffic.

[0199] In another possible implementation manner, the processor 601 is specifically configured to:

[0200] When the similarity is higher than the first similarity, it is determined that the traffic to be analyzed is the first type of traffic.

[0201] In another possible implementation, the similarity is characterized by the degree of fit between the distribution characteristics of the probability of the partial or all of the arrival time intervals and the reference time interval probability distribution model, and the reference time interval probability distribution model is used to characterize the distribution characteristics of the probability of the arrival time interval of the message of the first type of historical traffic; the processor 601 is specifically used to:

[0202] When the degree of fit is higher than the first degree of fit, it is determined that the traffic to be analyzed is the first type of traffic.

[0203] In another possible implementation, the degree of fit is characterized by the inverse of the relative entropy and the KS test value. When the inverse of the relative entropy is equal to the first preset threshold and the KS test value is equal to the second preset threshold, the degree of fit is the first degree of fit; when the inverse of the relative entropy is greater than the first preset threshold and the KS test value is less than the second preset threshold, the degree of fit is higher than the first degree of fit.

[0204] In another possible implementation manner, the processor 601 is specifically configured to:

[0205] Calculating a fitting parameter according to the partial or full arrival time interval, the probability of the partial or full arrival time interval, and a reference time interval probability distribution model, the reference time interval probability distribution model is used to characterize the distribution characteristics of the probability of the arrival time interval of the packets of the first type of historical traffic, and the fitting parameter is used to indicate the degree of fit between the distribution characteristics of the probability of the partial or full arrival time interval and the reference time interval probability distribution model;

[0206] The type of the flow to be analyzed is determined according to the fitting parameters.

[0207] In another possible implementation, the fitting parameters include the inverse of the relative entropy and the Kolmogorov-Smirnov KS test; the processor 601 is specifically used for:

[0208] When the traffic identification device determines that the inverse of the relative entropy is greater than a first preset threshold and the KS test value is less than a second preset threshold, it is determined that the traffic to be analyzed is a first type of traffic.

[0209] In another possible implementation, the first type of traffic is game traffic or video traffic.

[0210] In another possible implementation, the input / output device 603 is further used for:

[0211] Get the historical traffic of the first type;

[0212] The processor 601 is further configured to:

[0213] Obtaining the arrival time interval of the packets of the historical traffic and the probability of the arrival time interval of the packets of the historical traffic;

[0214] The reference time interval probability distribution model is established according to the arrival time interval of the packets of the historical traffic and the probability of the arrival time interval of the packets of the historical traffic.

[0215] In another possible implementation manner, the reference time interval probability distribution model includes any one of the following: a power law distribution model, a Gaussian distribution model, a normal distribution model, and a Poisson distribution model.

[0216] In another possible implementation, when the processor 601 determines the type of the traffic to be analyzed based on the probability distribution characteristics of some arrival time intervals in the arrival time interval, the some arrival time intervals in the arrival time interval are the arrival time intervals in the arrival time intervals of the packets of the traffic to be analyzed that are less than a third preset threshold.

[0217] In another possible implementation, the input / output device 603 is further used for:

[0218] Determine a first message of the traffic to be analyzed, wherein the arrival time interval of the first message is less than a third preset threshold; determine a ratio of the number of the first message to the total number of messages included in the traffic to be analyzed;

[0219] The processor 601 is further configured to:

[0220] When the traffic identification device determines that the ratio is greater than a fourth preset threshold, it triggers the step of determining the type of the traffic to be analyzed based on the distribution characteristics of the probabilities of part or all of the arrival time intervals in the arrival time interval.

[0221] In an embodiment of the present application, the input-output device 603 obtains the traffic to be analyzed of the target data stream; then, the processor 601 obtains the arrival time interval of the message of the traffic to be analyzed; and then determines the type of the traffic to be analyzed based on the distribution characteristics of the probability of part or all of the arrival time intervals in the arrival time interval. Since the probability distribution of the arrival time interval of the message of each type of traffic has a certain distribution law, the processor 601 can accurately identify the type of the traffic to be analyzed through the distribution characteristics of the probability of the arrival time interval of the message of the traffic to be analyzed. For example, when the distribution characteristics of the probability of all or part of the arrival time interval of the message of the traffic to be analyzed are relatively consistent with the distribution characteristics of the probability of the message of the game traffic, the processor 601 can determine that the traffic to be analyzed is the game traffic, thereby accurately identifying the game traffic and improving the recognition accuracy of the game traffic.

[0222] The present application also provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the above Figure 2A , Figure 3A and Figure 4 The traffic identification method of the embodiment shown.

[0223] The embodiment of the present application also provides a computer-readable storage medium, including instructions, which, when executed on a computer, enable the computer to execute the above Figure 2A , Figure 3A and Figure 4 The traffic identification method of the embodiment shown.

[0224] In another possible design, when the traffic identification device is a chip in a terminal, the chip includes: a processing unit and a communication unit. The processing unit may be, for example, a processor, and the communication unit may be, for example, an input / output interface, a pin or a circuit. The processing unit may execute computer-executable instructions stored in the storage unit to enable the chip in the terminal to execute the above Figure 2A , Figure 3A and Figure 4 Traffic identification method in the embodiment shown. Optionally, the storage unit is a storage unit in the chip, such as a register, a cache, etc., and the storage unit can also be a storage unit in the terminal located outside the chip, such as a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM), etc.

[0225] The processor mentioned in any of the above places can be a general-purpose central processing unit, a microprocessor, an application-specific integrated circuit (ASIC), or one or more processors for controlling the above Figure 2A , Figure 3A and Figure 4 The flow identification method in the illustrated embodiment is a program executed by an integrated circuit.

[0226] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0227] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0228] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0229] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0230] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.

[0231] In the present application, the terms "first", "second", etc. are used to distinguish between identical or similar items having substantially the same effects and functions. It should be understood that there is no logical or temporal dependency between "first", "second", and "nth", nor is there a limitation on quantity and execution order. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another. For example, without departing from the scope of the various described examples, a first image may be referred to as a second image, and similarly, a second image may be referred to as a first image. Both the first image and the second image may be images, and in some cases, may be separate and different images.

[0232] The term "at least one" in this application means one or more, and the term "multiple" in this application means two or more, for example, multiple second messages means two or more second messages. The terms "system" and "network" are often used interchangeably herein.

[0233] It should be understood that the terms used in the description of the various examples herein are only for describing specific examples and are not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0234] It should also be understood that the term "and / or" used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items. The term "and / or" is a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this application generally indicates that the associated objects before and after are in an "or" relationship.

[0235] It should also be understood that in the various embodiments of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0236] It should be understood that determining B based on A does not mean determining B only based on A. B can also be determined based on A and / or other information.

[0237] It should also be understood that the term “comprise” (also known as “includes,” “including,” “comprises” and / or “comprising”) when used in this specification specifies the presence of stated features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0238] It should also be understood that the term "if" may be interpreted to mean "when" or "upon" or "in response to determining" or "in response to detecting." Similarly, the phrase "if it is determined that ..." or "if [a stated condition or event] is detected" may be interpreted to mean "upon determining that ..." or "in response to determining that ..." or "upon detecting [a stated condition or event]" or "in response to detecting [a stated condition or event]," depending on the context.

[0239] It should be understood that the references to "one embodiment", "an embodiment", or "a possible implementation" throughout the specification mean that specific features, structures, or characteristics related to the embodiment or implementation are included in at least one embodiment of the present application. Therefore, the references to "in one embodiment" or "in an embodiment", or "a possible implementation" appearing throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0240] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A flow identification method, characterized in that: The method comprises: The traffic identification device obtains the traffic to be analyzed of the target data flow, where the traffic to be analyzed of the target data flow is part or all of the network traffic sent by the server to the terminal device; The traffic identification device obtains the arrival time interval of the packets of the traffic to be analyzed; The traffic identification device determines the service type of the traffic to be analyzed based on the distribution characteristics of the probability of part or all of the arrival time intervals in the arrival time interval, and the probability of part or all of the arrival time intervals refers to the probability of the part or all of the arrival time intervals appearing in the arrival time intervals of the packets of the traffic to be analyzed.

2. The method according to claim 1, characterized in that The traffic identification device determines the service type of the traffic to be analyzed according to the distribution characteristics of the probability of part or all of the arrival time intervals in the arrival time interval, including: The traffic identification device determines the service type of the traffic to be analyzed based on the similarity between the probability distribution characteristics of part or all of the arrival time intervals in the arrival time interval and the probability distribution characteristics of the arrival time intervals of packets of the first type of historical traffic.

3. The method according to claim 2, characterized in that The traffic identification device determines the service type of the traffic to be analyzed according to the similarity between the distribution characteristics of the probability of part or all of the arrival time intervals in the arrival time interval and the distribution characteristics of the probability of the arrival time intervals of the packets of the first type of historical traffic, including: The traffic identification device calculates a fitting parameter according to the partial or full arrival time interval, the probability of the partial or full arrival time interval and a reference time interval probability distribution model, the reference time interval probability distribution model is used to characterize the distribution characteristics of the probability of the arrival time interval of the packets of the first type of historical traffic, and the fitting parameter is used to indicate the degree of fit between the distribution characteristics of the probability of the partial or full arrival time interval and the reference time interval probability distribution model; The traffic identification device determines the service type of the traffic to be analyzed according to the fitting parameters.

4. The method according to claim 3, characterized in that The fitting parameters include the inverse of the relative entropy and the Kolmogorov-Smirnov KS test value; The traffic identification device determines the service type of the traffic to be analyzed according to the fitting parameters, including: When the traffic identification device determines that the inverse of the relative entropy is greater than a first preset threshold and the KS test value is less than a second preset threshold, the traffic identification device determines that the traffic to be analyzed is the first type of traffic.

5. The method according to claim 4, characterized in that The first type of traffic is game traffic or video traffic.

6. The method according to any one of claims 3 to 5, characterized in that The method further comprises: The traffic identification device obtains the historical traffic of the first type; The traffic identification device obtains the arrival time interval of the packets of the historical traffic and the probability of the arrival time interval of the packets of the historical traffic; The traffic identification device establishes the reference time interval probability distribution model according to the arrival time interval of the packets of the historical traffic and the probability of the arrival time interval of the packets of the historical traffic.

7. The method according to any one of claims 3 to 5, characterized in that The reference time interval probability distribution model includes any one of the following: a power law distribution model, a Gaussian distribution model, a normal distribution model and a Poisson distribution model.

8. The method according to any one of claims 1 to 5, characterized in that When the traffic identification device determines the service type of the traffic to be analyzed based on the distribution characteristics of the probability of some arrival time intervals in the arrival time interval, the some arrival time intervals in the arrival time intervals are the arrival time intervals in the arrival time intervals of the packets of the traffic to be analyzed that are less than a third preset threshold.

9. The method according to any one of claims 1 to 5, characterized in that The method further comprises: The traffic identification device determines a first message of the traffic to be analyzed, and an arrival time interval of the first message is less than a third preset threshold; The traffic identification device determines a ratio of the number of the first messages to the total number of messages included in the traffic to be analyzed; When the traffic identification device determines that the ratio is greater than a fourth preset threshold, it triggers the step of executing the traffic identification device determining the service type of the traffic to be analyzed according to the distribution characteristics of the probabilities of part or all of the arrival time intervals in the arrival time interval.

10. A flow identification device, characterized in that: The flow identification device comprises: A first acquisition unit is used to acquire the traffic to be analyzed of the target data flow, where the traffic to be analyzed of the target data flow is part or all of the network traffic sent by the server to the terminal device; A second acquisition unit, used to acquire the arrival time interval of the packets of the traffic to be analyzed; The first determination unit is used to determine the service type of the traffic to be analyzed based on the distribution characteristics of the probability of part or all of the arrival time intervals in the arrival time interval, wherein the probability of part or all of the arrival time intervals refers to the probability of the part or all of the arrival time intervals appearing in the arrival time intervals of the packets of the traffic to be analyzed.

11. The flow identification device according to claim 10, characterized in that: The first determining unit is specifically configured to: The service type of the traffic to be analyzed is determined according to the similarity between the distribution characteristics of the probabilities of part or all of the arrival time intervals and the distribution characteristics of the probabilities of the arrival time intervals of the packets of the first type of historical traffic.

12. The flow identification device according to claim 11, characterized in that: The first determining unit is specifically configured to: Calculating fitting parameters according to the partial or full arrival time interval, the probability of the partial or full arrival time interval and a reference time interval probability distribution model, wherein the reference time interval probability distribution model is used to characterize the distribution characteristics of the probability of the arrival time interval of the packets of the first type of historical traffic, and the fitting parameters are used to indicate the degree of fit between the distribution characteristics of the probability of the partial or full arrival time interval and the reference time interval probability distribution model; The service type of the traffic to be analyzed is determined according to the fitting parameters.

13. The flow identification device according to claim 12, characterized in that: The fitting parameters include the inverse of the relative entropy and the Kolmogorov-Smirnov KS test value; the first determination unit is specifically used for: When the traffic identification device determines that the inverse of the relative entropy is greater than a first preset threshold and the KS test value is less than a second preset threshold, it is determined that the traffic to be analyzed is the first type of traffic.

14. The flow identification device according to claim 13, characterized in that: The first type of traffic is game traffic or video traffic.

15. The flow identification device according to any one of claims 12 to 14, characterized in that: The first acquisition unit is further used for: Obtaining historical traffic of the first type; The second acquisition unit is further used for: Acquire the arrival time interval of the packets of the historical traffic and the probability of the arrival time interval of the packets of the historical traffic; The flow identification device also includes an establishment unit; The establishing unit is used to establish the reference time interval probability distribution model according to the arrival time interval of the packets of the historical traffic and the probability of the arrival time interval of the packets of the historical traffic.

16. The flow identification device according to any one of claims 12 to 14, characterized in that: The reference time interval probability distribution model includes any one of the following: a power law distribution model, a Gaussian distribution model, a normal distribution model and a Poisson distribution model.

17. The flow identification device according to any one of claims 10 to 14, characterized in that: When the first determination unit determines the service type of the traffic to be analyzed based on the distribution characteristics of the probability of some arrival time intervals in the arrival time interval, the some arrival time intervals in the arrival time intervals are the arrival time intervals in the arrival time intervals of the packets of the traffic to be analyzed that are less than a third preset threshold.

18. The flow identification device according to any one of claims 10 to 14, characterized in that: The flow identification device also includes a second determination unit and a triggering unit; The second determining unit is used to determine a first message of the traffic to be analyzed, where the arrival time interval of the first message is less than a third preset threshold; Determining a ratio of the number of the first messages to the total number of messages included in the traffic to be analyzed; The trigger unit is used to trigger the first determination unit to execute the step of determining the business type of the traffic to be analyzed based on the distribution characteristics of the probabilities of part or all of the arrival time intervals in the arrival time interval when the traffic identification device determines that the ratio is greater than a fourth preset threshold.

Images