Traffic classification method, device, electronic device and computer readable medium

Abstract

The present disclosure relates to a traffic classification method, device, electronic device and computer-readable medium, and belongs to the field of Internet technology. The method includes: obtaining a traffic sequence collected from a client, and segmenting the traffic sequence according to a pre-trained traffic segmentation model to obtain a traffic time series segment corresponding to the traffic sequence; determining the sequence similarity distance between the traffic time series segment and the historical traffic time series segment in the historical traffic template library; and determining the traffic type of the traffic time series segment according to the sequence similarity distance between the traffic time series segment and the historical traffic time series segment. The present disclosure reasonably segments the traffic sequence through a traffic segmentation model to obtain traffic time series segments, and determines the traffic type of the traffic time series segment by similarity matching, which can improve the accuracy and efficiency of traffic tracing.

Description

Technical Field

[0001] The present disclosure relates to the field of Internet technology, and in particular to a traffic classification method, a traffic classification device, an electronic device, and a computer-readable medium. Background Art

[0002] With the rapid development of the Internet industry, users' online behaviors have become supervised, recordable, and traceable. In business scenarios such as customer service, advertising, and logistics, the analysis of user traffic has become the key for enterprises to reduce costs and increase efficiency.

[0003] Generally, traffic analysis includes three main parts: traffic prediction, traffic classification, and traffic decomposition. Traffic classification refers to the classification and identification of traffic time series. However, current traffic classification methods generally have problems such as inaccurate traffic segment segmentation, difficulty in tracing, and low tracing accuracy.

[0004] In view of this, there is an urgent need in the art for a traffic classification method that can improve the accuracy and efficiency of traffic tracing.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0006] The purpose of the present disclosure is to provide a traffic classification method, a traffic classification device, an electronic device and a computer-readable medium, thereby improving the accuracy and efficiency of traffic tracing at least to a certain extent.

[0007] According to a first aspect of the present disclosure, a traffic classification method is provided, comprising:

[0008] Acquire a traffic sequence collected from a client, and segment the traffic sequence according to a pre-trained traffic segmentation model to obtain a traffic time series segment corresponding to the traffic sequence;

[0009] Determine the sequence similarity distance between the traffic time series segment and the historical traffic time series segment in the historical traffic template library;

[0010] The traffic type of the traffic time series segment is determined according to the sequence similarity distance between the traffic time series segment and the historical traffic time series segment.

[0011] In an exemplary embodiment of the present disclosure, the traffic segmentation model is a binary classification model, and the traffic sequence is segmented according to the pre-trained traffic segmentation model to obtain the traffic time series segments corresponding to the traffic sequence, including:

[0012] Inputting each sequence point in the traffic sequence into a pre-trained traffic segmentation model in reverse chronological order, and determining an output type corresponding to each sequence point;

[0013] If the output type of the sequence point in the traffic segmentation model is an unsegmented sequence point, proceed to classify the next sequence point;

[0014] If the output type of the sequence point in the traffic segmentation model is a segmentation sequence point, the traffic sequence is segmented at the segmentation sequence point to obtain traffic time series segments corresponding to the traffic sequence.

[0015] In an exemplary embodiment of the present disclosure, the training method of the traffic segmentation model includes:

[0016] Using the historical traffic time series segments in the historical traffic template library as training samples of the traffic segmentation model, and obtaining the time series features of the historical traffic time series segments;

[0017] The traffic segmentation model is trained according to the time series characteristics of the historical traffic time series segments and the segmentation type of each sequence point in the historical traffic time series segments.

[0018] In an exemplary embodiment of the present disclosure, determining the sequence similarity distance between the traffic timing segment and the historical traffic timing segment in the historical traffic template library includes:

[0019] According to the values ​​of each sequence point in the traffic time series segment and the values ​​of each sequence point in the historical traffic time series segment in the historical traffic template library, a dynamic time warping distance between the traffic time series segment and the historical traffic time series segment is obtained;

[0020] The dynamic time warping distance between the traffic time series segment and the historical traffic time series segment is used as the sequence similarity distance.

[0021] In an exemplary embodiment of the present disclosure, determining the traffic type of the traffic time series segment according to the sequence similarity distance between the traffic time series segment and the historical traffic time series segment includes:

[0022] Determine whether the sequence similarity distance between the traffic time series segment and the historical traffic time series segment is less than or equal to a similarity distance threshold;

[0023] If the sequence similarity distance is less than or equal to the similarity distance threshold, clustering the traffic time series segment and the historical traffic time series segment, and determining the traffic type of the traffic time series segment according to the historical traffic type corresponding to the clustered historical traffic time series segment;

[0024] If the sequence similarity distance is greater than the similarity distance threshold, the traffic type of the traffic time series segment is determined as a newly added traffic type.

[0025] In an exemplary embodiment of the present disclosure, the determining whether the sequence similarity distance between the traffic time series segment and the historical traffic time series segment is less than or equal to a similarity distance threshold includes:

[0026] Obtaining the number of inflection points of the dynamic time warping distance between the traffic time series segment and the historical traffic time series segment;

[0027] If the number of inflection points is less than or equal to the inflection point threshold, it is determined that the sequence similarity distance between the traffic time series segment and the historical traffic time series segment is less than or equal to the similarity distance threshold.

[0028] In an exemplary embodiment of the present disclosure, the method further includes:

[0029] If the traffic type of the traffic time series segment is the historical traffic type, updating the central curve of the historical traffic time series segment corresponding to the historical traffic type according to the traffic time series segment;

[0030] If the traffic type of the traffic timing segment is the newly added traffic type, a central curve corresponding to the newly added traffic type is generated in the historical traffic template library according to the traffic timing segment.

[0031] In an exemplary embodiment of the present disclosure, the method further includes:

[0032] If the traffic type of the traffic time series segment is an abnormal traffic type among the historical traffic types, corresponding abnormal warning information is triggered according to the abnormal traffic type.

[0033] According to a second aspect of the present disclosure, there is provided a flow classification device, comprising:

[0034] A traffic sequence segmentation module is used to obtain a traffic sequence collected from a client, and segment the traffic sequence according to a pre-trained traffic segmentation model to obtain a traffic time series segment corresponding to the traffic sequence;

[0035] A similarity distance determination module, used to determine the sequence similarity distance between the traffic time series segment and the historical traffic time series segment in the historical traffic template library;

[0036] The traffic type determination module is used to determine the traffic type of the traffic time series segment according to the sequence similarity distance between the traffic time series segment and the historical traffic time series segment.

[0037] According to a third aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned traffic classification methods by executing the executable instructions.

[0038] According to a fourth aspect of the present disclosure, a computer-readable medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the method for classifying traffic described in any one of the above is implemented.

[0039] The exemplary embodiments of the present disclosure may have the following beneficial effects:

[0040] In the traffic classification method of the example implementation method of the present disclosure, the continuous traffic sequence is reasonably segmented by the traffic segmentation model to obtain the corresponding traffic time series segments, and by matching the similarity with the historical traffic time series segments in the historical traffic template library, it is found out whether the current traffic time series segment is a traffic trend shape that has already appeared, thereby determining the traffic type of the traffic time series segment. The traffic classification method in the example implementation method of the present disclosure, on the one hand, can solve the problem of adaptive segmentation of traffic sequences through the traffic segmentation model, improve the accuracy of traffic segment segmentation, and further improve the accuracy of traffic tracing; on the other hand, it can realize the rapid tracing of traffic time series segments and the discovery of unknown abnormal trends, improve the efficiency of traffic tracing, and can realize the automatic update of the historical traffic template library, which can be effectively applied to system operation and maintenance, business monitoring and other scenarios.

[0041] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0043] Figure 1 A schematic diagram showing a flow chart of a method for classifying traffic according to an exemplary embodiment of the present disclosure;

[0044] Figure 2 A schematic diagram of a process of segmenting a traffic sequence according to a traffic segmentation model according to an exemplary embodiment of the present disclosure is shown;

[0045] Figure 3 A schematic diagram of traffic sequence segmentation according to a specific embodiment of the present disclosure is schematically shown;

[0046] Figure 4 A flow chart showing a method for training a traffic segmentation model according to an exemplary embodiment of the present disclosure is shown;

[0047] Figure 5 A schematic diagram of a dynamic time warping distance according to a specific embodiment of the present disclosure is schematically shown;

[0048] Figure 6 A schematic diagram showing a flow chart of determining the traffic type of a traffic time series segment according to a sequence similarity distance in an exemplary embodiment of the present disclosure;

[0049] Figure 7 A schematic diagram schematically shows a center line segment value of a flow time series segment according to a specific embodiment of the present disclosure;

[0050] Figure 8 A schematic diagram of a flow trend sequence automatic tracing system according to a specific embodiment of the present disclosure is schematically shown;

[0051] Fig. 9 A schematic diagram of a flow trend sequence automatic tracing model according to a specific implementation of the present disclosure is schematically shown;

[0052] Fig.10 A block diagram showing a flow classification device according to an exemplary embodiment of the present disclosure;

[0053] Fig.11 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0054] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0055] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0056] At present, with the rapid development of the Internet industry, the behavior of users on the Internet has become supervised, recordable, and traceable. Through repeated clicks and browsing behaviors, user flow has become information flow. For enterprises, how to deal with information flow at the lowest cost has become the key to reducing costs and increasing efficiency. This has given rise to the development of time series traffic analysis in the industry, including in customer service, advertising, logistics and other business scenarios, where traffic analysis has been applied.

[0057] Generally, traffic analysis includes three main parts: traffic prediction, traffic classification, and traffic decomposition. Traffic prediction refers to the prediction of traffic in the future based on historical data and external features through models such as time series algorithms, machine learning algorithms, and neural network algorithms. Typical algorithms include Holt-Winters, GBM (Generalized Boosted Regression Models), XGBoost (eXtreme Gradient Boosting), and LSTM (Long short-term memory). Traffic classification refers to the classification and recognition of traffic time series patterns, which can usually be performed using supervised classification and unsupervised clustering. Traffic decomposition refers to splitting a time series data into multiple time series data of the same length as the original sequence. At the same time, the new time series can be combined into the original sequence signal through weighted sum or weighted multiplication.

[0058] At present, traffic classification has been used in various business scenarios such as system operation and maintenance, traffic monitoring, and attribution analysis. However, traffic classification methods generally face problems such as difficulty in tracing the source, difficulty in detecting anomalies, and inaccurate traffic segmentation.

[0059] In some related embodiments, the flow rate trend can be monitored by the following methods:

[0060] The first is anomaly detection, which mainly targets abnormal situations in which traffic has undergone large mutations in the time series, usually manifested as a jump in amplitude or an abnormal slope. This detection method usually relies more on empirical threshold settings and cannot be used for slowly changing anomalies.

[0061] The second is the same-period and month-on-month detection, which is performed by comparing the data of the same period. This data monitoring method can monitor slowly changing traffic anomalies, but it also relies on manually defined thresholds. In addition, the selection of the period is fixed and is not suitable for sequences with non-periodic noise.

[0062] The third method is to use machine learning or deep learning methods to predict the trend of existing traffic segments, so as to determine whether the traffic will remain in the correct range in the future. This method is more flexible and can determine slow anomalies before they occur. However, this method can only be used to determine whether anomalies will occur, and the cause and nature of the anomalies cannot be found, which is not conducive to rapid evaluation and handling of anomalies.

[0063] The fourth type is to compare the similarity between the existing traffic segments and the historical traffic segments. There are several problems here. The first is how to compare the similarity of the two traffics. The average error in the numerical values ​​from point to point is difficult to explain the similarity. Second, a long traffic segment and a short traffic segment may be of the same form and nature, but because of the different impacts, the shape is elongated, so the traffic segments are not necessarily of equal length. Third, how to divide the existing traffic segments appropriately. Since a traffic sequence is a continuous signal, it needs to be cut at the appropriate point to ensure that when matching with the historical traffic segments, the similarity will not be affected by being too long or too short. Fourth, when a new type of traffic is discovered, it is usually not automatically determined to be a new traffic form, and the template library needs to be manually updated.

[0064] Therefore, in order to solve the above problems, a method is needed to flexibly segment traffic time series, compare historical traffic characteristics, automatically discover current traffic shape characteristics, trace the causes of current changes and future development trends, and facilitate automatic tracing of traffic trends for rapid business positioning and response.

[0065] This example implementation first provides a method for classifying traffic. Figure 1 As shown, the above traffic classification method may include the following steps:

[0066] Step S110: Obtain a traffic sequence collected from the client, and segment the traffic sequence according to a pre-trained traffic segmentation model to obtain traffic time series segments corresponding to the traffic sequence.

[0067] Step S120: Determine the sequence similarity distance between the traffic timing segment and the historical traffic timing segment in the historical traffic template library.

[0068] Step S130: Determine the traffic type of the traffic time series segment according to the sequence similarity distance between the traffic time series segment and the historical traffic time series segment.

[0069] In the traffic classification method of the example implementation method of the present disclosure, the continuous traffic sequence is reasonably segmented by the traffic segmentation model to obtain the corresponding traffic time series segments, and by matching the similarity with the historical traffic time series segments in the historical traffic template library, it is found out whether the current traffic time series segment is a traffic trend shape that has already appeared, thereby determining the traffic type of the traffic time series segment. The traffic classification method in the example implementation method of the present disclosure, on the one hand, can solve the problem of adaptive segmentation of traffic sequences through the traffic segmentation model, improve the accuracy of traffic segment segmentation, and further improve the accuracy of traffic tracing; on the other hand, it can realize the rapid tracing of traffic time series segments and the discovery of unknown abnormal trends, improve the efficiency of traffic tracing, and can realize the automatic update of the historical traffic template library, which can be effectively applied to system operation and maintenance, business monitoring and other scenarios.

[0070] Next, combine Figures 2 to 6 The above steps of this exemplary embodiment are described in more detail.

[0071] In step S110, a traffic sequence collected from a client is obtained, and the traffic sequence is segmented according to a pre-trained traffic segmentation model to obtain traffic time series segments corresponding to the traffic sequence.

[0072] In this example implementation, the traffic sequence is continuous traffic time series data obtained by periodically accumulating and summing the traffic collected from each client and labeling it with a time period, and may include traffic data of types such as login volume, click volume, and exposure volume. When obtaining the traffic sequence from the client, it is necessary to ensure that the types of the obtained traffic sequences are the same, such as obtaining only the traffic sequence corresponding to the login volume, or only the traffic sequence corresponding to the click volume.

[0073] Since the acquired traffic sequence is a continuous sequence of indefinite length, it is necessary to first divide the continuous traffic sequence reasonably. Figure 2 As shown in the figure, the traffic sequence can be segmented using a pre-trained traffic segmentation model to obtain the traffic time series segments corresponding to the traffic sequence. Specifically, the following steps can be included:

[0074] Step S210: Input each sequence point in the traffic sequence into the pre-trained traffic segmentation model in reverse chronological order to determine the output type corresponding to each sequence point.

[0075] In this example implementation, when a traffic sequence is input into a pre-trained traffic segmentation model, each sequence point in the traffic sequence can be first added to a temporary queue in reverse order of time points, starting from the current sequence point, and then input into the traffic segmentation model in turn, and the output type corresponding to each sequence point is determined by the traffic segmentation model. The output type of the sequence point includes a segmented sequence point and a non-segmented sequence point.

[0076] Step S220: If the output type of the sequence point in the traffic segmentation model is an unsegmented sequence point, proceed to classify the next sequence point.

[0077] If the output type of the current sequence point in the traffic segmentation model is a non-segmented sequence point, indicating that no segmentation is performed at the sequence point, the traffic segmentation model is continued to be used to determine the output type of the next sequence point.

[0078] Step S230: If the output type of the sequence point in the traffic segmentation model is a segmentation sequence point, the traffic sequence is segmented at the segmentation sequence point to obtain traffic time series segments corresponding to the traffic sequence.

[0079] If the output type of the current sequence point in the traffic segmentation model is a segmentation sequence point, it means that segmentation needs to be performed at this sequence point. At this time, the segmented traffic time series segment can be obtained by combining the previous segmentation sequence point.

[0080] Figure 3 The schematic diagram of flow sequence segmentation according to a specific embodiment of the present disclosure is schematically shown, wherein the starting point and the ending point of the flow time series segment are the segmentation sequence points determined by the flow segmentation model. After the flow sequence is segmented at these two points, the following is obtained: Figure 3 Traffic timing snippet shown.

[0081] In this example implementation, Figure 4 As shown, the training method of the above traffic segmentation model may specifically include the following steps:

[0082] Step S410: Use the historical traffic time series segments in the historical traffic template library as training samples for the traffic segmentation model, and obtain the time series features of the historical traffic time series segments.

[0083] In this example implementation, historical traffic time series segments in the historical traffic template library can be used as training samples for the traffic segmentation model. The sample features come from the time series features of the historical traffic time series segments, including sequence length, the value and sequence number of the global extreme point, the number of local extreme points, the sequence mean, the sequence variance, the difference between the starting point and the end point, the sequence slope mean, etc.

[0084] Step S420: Train a traffic segmentation model according to the time series characteristics of the historical traffic time series segments and the segmentation type of each sequence point in the historical traffic time series segments.

[0085] The traffic segmentation model in this example implementation may select a binary supervised neural network, and the output results of the traffic segmentation model are of two types: segmentation or non-segmentation.

[0086] In step S120, the sequence similarity distance between the traffic time series segment and the historical traffic time series segment in the historical traffic template library is determined.

[0087] After obtaining the cut traffic time series segments, since the length of the traffic time series segments is different from each historical traffic time series segment in the historical traffic template library, the Euclidean distance cannot be directly used as the similarity judgment criterion.

[0088] In this example implementation, the DTW (Dynamic time warping) distance can be used as the sequence similarity distance between the traffic timing segment and the historical traffic timing segment. Specifically, the dynamic time warping distance between the traffic timing segment and the historical traffic timing segment can be obtained based on the values ​​of each sequence point in the traffic timing segment and the values ​​of each sequence point in the historical traffic timing segment in the historical traffic template library, and then the dynamic time warping distance between the traffic timing segment and the historical traffic timing segment is used as the sequence similarity distance. The specific calculation method of the DTW distance is as follows:

[0089] Assuming that the two sequences being compared are sequence a and sequence b, the calculation formula for the DTW distance between the two sequences is:

[0090]

[0091] Wherein, sequence a and sequence b each include multiple sequence points, i represents the sequence number of each sequence point in sequence a, j represents the sequence number of each sequence point in sequence b, a[i] represents the value of the i-th sequence point in sequence a, and b[j] represents the value of the j-th sequence point in sequence b. The graphical expression of DTW distance is as follows: Figure 5 As shown, each value dp[i][j] in the distance matrix represents the DTW distance between the i-th sequence point in sequence a and the j-th sequence point in sequence b. The darker the value, the smaller the DTW distance.

[0092] In step S130, the traffic type of the traffic time series segment is determined according to the sequence similarity distance between the traffic time series segment and the historical traffic time series segment.

[0093] In this example implementation, the difference between the current traffic time series segment and the historical traffic time series segment can be found based on the sequence similarity distance between the traffic time series segment and the historical traffic time series segment, such as the DTW distance.

[0094] In this example implementation, Figure 6 As shown, according to the sequence similarity distance between the traffic time series segment and the historical traffic time series segment, the traffic type of the traffic time series segment is determined, which may specifically include the following steps:

[0095] Step S610: Determine whether the sequence similarity distance between the traffic time series segment and the historical traffic time series segment is less than or equal to the similarity distance threshold.

[0096] In this example implementation, the number of inflection points of the dynamic time warping distance can be used to determine whether the sequence similarity distance is less than or equal to the similarity distance threshold. Specifically, the number of inflection points of the dynamic time warping distance between the traffic timing segment and the historical traffic timing segment can be obtained. If the number of inflection points is less than or equal to the inflection point threshold, it is determined that the sequence similarity distance between the traffic timing segment and the historical traffic timing segment is less than or equal to the similarity distance threshold.

[0097] like Figure 5 As shown in the figure, since the solution space of the DTW distance is a distance matrix with the length of two sequences as its length and width, the DTW distance calculation path is to continuously move forward in the solution space along the shortest path until it reaches the lower right corner from the upper left corner. In this process, the number of inflection points of the path can represent the number of local similarity changes. If the number of inflection points exceeds the inflection point threshold, it is equivalent to that the local similarity change exceeds the threshold, and it can be identified as a new traffic sequence.

[0098] Step S620: If the sequence similarity distance is less than or equal to the similarity distance threshold, cluster the traffic time series segments and the historical traffic time series segments, and determine the traffic type of the traffic time series segments according to the historical traffic types corresponding to the clustered historical traffic time series segments.

[0099] Based on the DTW distance, its main purpose is to find out whether the difference between the current traffic time series segment and the historical traffic time series segment in the template library meets the threshold. If it meets the threshold, it means that the current traffic time series segment belongs to one of the historical traffic time series segments. At this time, automatic clustering will be triggered to cluster the current traffic time series segment and the historical traffic time series segments in the historical template library. The clustering method can be, for example, KMedoids clustering, which classifies the traffic according to the historical traffic type corresponding to the most recent historical traffic time series segment. The method of clustering traffic time series segments does not need to label the traffic type in advance, but directly divides the traffic into multiple clusters based on the characteristics of the traffic itself to obtain the corresponding traffic type.

[0100] In this example implementation, if the traffic type of the traffic time series segment is a historical traffic type, the central curve of the historical traffic time series segment corresponding to the historical traffic type is updated according to the traffic time series segment. Figure 7 As shown, the center segment value refers to the most representative segment among all the segments in a classification. The method for determining the center segment value can use the method provided in the KMedoids clustering method. By updating the corresponding center segment value, it can be made more robust.

[0101] Step S630: If the sequence similarity distance is greater than the similarity distance threshold, the traffic type of the traffic time series segment is determined as a newly added traffic type.

[0102] If the sequence similarity distance is greater than the similarity distance threshold, it means that the current traffic time series segment does not belong to any of the historical traffic time series segments, and therefore, it is determined as a new traffic type.

[0103] In this example implementation, if the traffic type of the traffic time series segment is a newly added traffic type, a central curve corresponding to the newly added traffic type is generated in the historical traffic template library according to the traffic time series segment. When the same trend occurs next time, pattern matching and early warning can be achieved.

[0104] In this example implementation, if the traffic type of the traffic time series segment is an abnormal traffic type in the historical traffic type, corresponding abnormal warning information is triggered according to the abnormal traffic type.

[0105] The historical traffic types include some abnormal traffic types. When the traffic sequence segment matches the abnormal traffic type, an abnormal error will be triggered. The operation and maintenance personnel can locate the error location according to the label corresponding to the abnormal traffic type and quickly repair the abnormality. If the current traffic sequence segment is a new abnormal traffic type that has not occurred before, the relevant operation and maintenance personnel can add a new abnormal traffic type label to it for quick tracing next time.

[0106] like Figure 8 The figure is a schematic diagram of a flow trend sequence automatic tracing system according to a specific implementation of the present disclosure, which is a specific application scenario of the above steps in this example implementation. The specific architecture and functions of the flow trend sequence automatic tracing system are as follows:

[0107] The traffic is transmitted from each client to the traffic collection system 801. The traffic here can be various statistical quantities such as login volume, click volume, exposure volume, etc., but the statistical caliber of each end needs to be kept consistent, that is, the traffic type obtained by each port is consistent. For example, if port A obtains login volume, other ports also obtain login volume.

[0108] The traffic collection system 801 obtains continuous traffic time series data by periodically accumulating and summing the traffic and marking time period labels. At this time, the traffic sequence is a continuous indefinite length sequence.

[0109] The traffic trend automatic tracing model 802 can realize traffic segmentation, pattern recognition, and clustering. The recognition and clustering here are achieved by comparing the traffic time series segments with the historical traffic time series segments in the historical traffic template library.

[0110] After the traffic trend automatic tracing model 802, two kinds of results are obtained. One is that the trend of the current traffic time series segment conforms to one of the historical traffic template library. At this time, automatic clustering will be triggered to update the central curve of the historical traffic time series segment to make it more robust; the other is that the trend of the traffic time series segment is a new traffic characteristic. At this time, a new template central curve will be generated in the historical template library. When the same trend occurs next time, the pattern warning can be realized.

[0111] When the traffic time series segment matches an abnormal type, an abnormal error will be triggered through the abnormal reminder and annotation system 803, and the operation and maintenance personnel can locate the error location according to the label of the abnormal template and quickly repair the abnormality. If the current traffic segment is a new traffic pattern that has never occurred before, the relevant operation and maintenance personnel can label the abnormal cause for the new trend template to facilitate rapid tracing next time.

[0112] like Fig. 9 The figure is a schematic diagram of a flow trend sequence automatic tracing model according to a specific embodiment of the present disclosure, which is a schematic diagram of a flow trend sequence automatic tracing model according to a specific embodiment of the present invention. Figure 8 Detailed description of the automatic tracing model 802 of the traffic trend in the flow chart. The purpose of the automatic tracing model of the traffic trend sequence is to classify the current traffic trend shape and monitor whether it is an abnormal situation. From the internal structure of the model, there are three layers, namely sequence segmentation, pattern matching, and automatic clustering. The specific principles of the model are as follows:

[0113] For the acquired traffic time series 901, firstly segment it using the pre-trained traffic segmentation model 902. When the traffic time series 901 enters the traffic segmentation model 902, the past points are added to the temporary queue in reverse order from the current point, and input into the traffic segmentation model 902 until the output result of the traffic segmentation model 902 is segmentation, and then the current characteristic traffic segment 903 is obtained.

[0114] After obtaining the cut characteristic flow segment 903, based on the DTW distance, its main purpose is to find the difference between the current segment and the flow template 904 in the historical template library, and determine whether it meets the threshold. If it meets the threshold, the current characteristic flow segment 903 and the segments in the historical template library are clustered by KMedoids, classified by the most recent historical segment, and the center segment value of the segment is updated. If it does not meet the threshold, the current characteristic flow segment 903 is determined as a newly added flow type, and a new center segment value is generated and saved in the historical template library.

[0115] It should be noted that although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0116] Furthermore, the present disclosure also provides a flow classification device. Fig.10 As shown, the traffic classification device may include a traffic sequence segmentation module 1010, a similarity distance determination module 1020, and a traffic type determination module 1030. Among them:

[0117] The traffic sequence segmentation module 1010 can be used to obtain the traffic sequence collected from the client, and segment the traffic sequence according to the pre-trained traffic segmentation model to obtain the traffic time series segments corresponding to the traffic sequence;

[0118] The similarity distance determination module 1020 may be used to determine a sequence similarity distance between a traffic time series segment and a historical traffic time series segment in a historical traffic template library;

[0119] The traffic type determination module 1030 may be configured to determine the traffic type of the traffic time series segment according to a sequence similarity distance between the traffic time series segment and a historical traffic time series segment.

[0120] In some exemplary embodiments of the present disclosure, the traffic sequence segmentation module 1010 may include a segmentation model input unit, a next sequence point classification unit, and a current sequence point segmentation unit.

[0121] The segmentation model input unit can be used to input each sequence point in the traffic sequence into the pre-trained traffic segmentation model in reverse chronological order to determine the output type corresponding to each sequence point;

[0122] The next sequence point classification unit can be used to continue the classification of the next sequence point if the output type of the sequence point in the traffic segmentation model is an unsegmented sequence point;

[0123] The current sequence point segmentation unit can be used to segment the traffic sequence at the segmentation sequence point if the output type of the sequence point in the traffic segmentation model is a segmentation sequence point, so as to obtain the traffic time series segment corresponding to the traffic sequence.

[0124] In some exemplary embodiments of the present disclosure, a traffic classification device provided by the present disclosure may further include a segmentation model training module, and the segmentation model training module may include a time series feature acquisition unit and a segmentation model training unit.

[0125] The time series feature acquisition unit can be used to use the historical traffic time series segments in the historical traffic template library as training samples of the traffic segmentation model and obtain the time series features of the historical traffic time series segments;

[0126] The segmentation model training unit can be used to train the traffic segmentation model according to the time series characteristics of the historical traffic time series segments and the segmentation type of each sequence point in the historical traffic time series segments.

[0127] In some exemplary embodiments of the present disclosure, the similarity distance determination module 1020 may include a dynamic time warping distance determination unit and a sequence similarity distance determination unit.

[0128] The dynamic time warping distance determination unit can be used to obtain the dynamic time warping distance between the traffic time series segment and the historical traffic time series segment according to the value of each sequence point in the traffic time series segment and the value of each sequence point in the historical traffic time series segment in the historical traffic template library;

[0129] The sequence similarity distance determination unit may be configured to use the dynamic time warping distance between the traffic time series segment and the historical traffic time series segment as the sequence similarity distance.

[0130] In some exemplary embodiments of the present disclosure, the traffic type determination module 1030 may include a sequence similarity distance determination unit, a historical traffic type determination unit, and a new traffic type determination unit.

[0131] The sequence similarity distance judgment unit may be used to judge whether the sequence similarity distance between the traffic time series segment and the historical traffic time series segment is less than or equal to the similarity distance threshold;

[0132] The historical traffic type determination unit may be used to cluster the traffic time series segments and the historical traffic time series segments if the sequence similarity distance is less than or equal to the similarity distance threshold, and determine the traffic type of the traffic time series segments according to the historical traffic types corresponding to the clustered historical traffic time series segments;

[0133] The newly added traffic type determination unit may be configured to determine the traffic type of the traffic time series segment as a newly added traffic type if the sequence similarity distance is greater than a similarity distance threshold.

[0134] In some exemplary embodiments of the present disclosure, the sequence similarity distance judgment unit may include an inflection point number acquisition unit and an inflection point threshold judgment unit.

[0135] The inflection point number acquisition unit may be used to acquire the number of inflection points of the dynamic time bending distance between the traffic time series segment and the historical traffic time series segment;

[0136] The inflection point threshold judgment unit can be used to determine that the sequence similarity distance between the traffic time series segment and the historical traffic time series segment is less than or equal to the similarity distance threshold if the number of inflection points is less than or equal to the inflection point threshold.

[0137] In some exemplary embodiments of the present disclosure, the traffic type determination module 1030 may further include a center curve updating unit and a center curve adding unit.

[0138] The central curve updating unit may be used to update the central curve of the historical traffic time series segment corresponding to the historical traffic type according to the traffic time series segment if the traffic type of the traffic time series segment is a historical traffic type;

[0139] The center curve adding unit can be used to generate a center curve corresponding to the newly added traffic type in the historical traffic template library according to the traffic timing segment if the traffic type of the traffic timing segment is a newly added traffic type.

[0140] In some exemplary embodiments of the present disclosure, the traffic type determination module 1030 may further include an abnormal type warning unit, which may be used to trigger corresponding abnormal warning information according to the abnormal traffic type if the traffic type of the traffic time series segment is an abnormal traffic type in the historical traffic type.

[0141] The specific details of each module / unit in the above-mentioned traffic classification device have been described in detail in the corresponding method embodiment part and will not be repeated here.

[0142] Fig.11 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present invention is shown.

[0143] It should be noted that Fig.11 The computer system 1100 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0144] like Fig.11As shown, the computer system 1100 includes a central processing unit (CPU) 1101, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1102 or a program loaded from a storage part 1108 into a random access memory (RAM) 1103. Various programs and data required for system operation are also stored in the RAM 1103. The CPU 1101, the ROM 1102, and the RAM 1103 are connected to each other via a bus 1104. An input / output (I / O) interface 1105 is also connected to the bus 1104.

[0145] The following components are connected to the I / O interface 1105: an input section 1106 including a keyboard, a mouse, etc.; an output section 1107 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1108 including a hard disk, etc.; and a communication section 1109 including a network interface card such as a LAN card, a modem, etc. The communication section 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to the I / O interface 1105 as needed. A removable medium 1111, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1110 as needed, so that a computer program read therefrom is installed into the storage section 1108 as needed.

[0146] In particular, according to an embodiment of the present invention, the process described below with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 1109, and / or installed from a removable medium 1111. When the computer program is executed by a central processing unit (CPU) 1101, various functions defined in the system of the present application are executed.

[0147] It should be noted that the computer-readable medium shown in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0148] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0149] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the following embodiment.

[0150] It should be noted that, although several modules of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules described above can be concretized in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules to be concretized.

[0151] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modifications, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure.

[0152] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A traffic classification method, characterized in that: include: Obtain a traffic sequence collected from a client, and segment the traffic sequence according to a pre-trained traffic segmentation model to obtain a traffic time series segment corresponding to the traffic sequence; wherein the traffic segmentation model is a binary classification model, and the traffic segmentation model is used to determine the output type corresponding to each sequence point in the traffic sequence, and the output type of the sequence point includes a segmented sequence point and a non-segmented sequence point; Determine a sequence similarity distance between the traffic time series segment and a historical traffic time series segment in a historical traffic template library; wherein the sequence similarity distance includes a dynamic time warping distance; The traffic type of the traffic time series segment is determined according to the sequence similarity distance between the traffic time series segment and the historical traffic time series segment.

2. The flow classification method according to claim 1, characterized in that: The step of segmenting the traffic sequence according to the pre-trained traffic segmentation model to obtain traffic time series segments corresponding to the traffic sequence includes: Inputting each sequence point in the traffic sequence into a pre-trained traffic segmentation model in reverse chronological order, and determining an output type corresponding to each sequence point; If the output type of the sequence point in the traffic segmentation model is an unsegmented sequence point, proceed to classify the next sequence point; If the output type of the sequence point in the traffic segmentation model is a segmentation sequence point, the traffic sequence is segmented at the segmentation sequence point to obtain traffic time series segments corresponding to the traffic sequence.

3. The flow classification method according to claim 2, characterized in that: The training method of the traffic segmentation model includes: Using the historical traffic time series segments in the historical traffic template library as training samples of the traffic segmentation model, and obtaining the time series features of the historical traffic time series segments; The traffic segmentation model is trained according to the time series characteristics of the historical traffic time series segments and the segmentation type of each sequence point in the historical traffic time series segments.

4. The flow classification method according to claim 1, characterized in that: The determining of the sequence similarity distance between the traffic time series segment and the historical traffic time series segment in the historical traffic template library includes: According to the values ​​of each sequence point in the traffic time series segment and the values ​​of each sequence point in the historical traffic time series segment in the historical traffic template library, a dynamic time warping distance between the traffic time series segment and the historical traffic time series segment is obtained; The dynamic time warping distance between the traffic time series segment and the historical traffic time series segment is used as the sequence similarity distance.

5. The flow classification method according to claim 1, characterized in that: The determining the traffic type of the traffic time series segment according to the sequence similarity distance between the traffic time series segment and the historical traffic time series segment includes: Determine whether the sequence similarity distance between the traffic time series segment and the historical traffic time series segment is less than or equal to a similarity distance threshold; If the sequence similarity distance is less than or equal to the similarity distance threshold, clustering the traffic time series segment and the historical traffic time series segment, and determining the traffic type of the traffic time series segment according to the historical traffic type corresponding to the clustered historical traffic time series segment; If the sequence similarity distance is greater than the similarity distance threshold, the traffic type of the traffic time series segment is determined as a newly added traffic type.

6. The flow classification method according to claim 5, characterized in that: The determining whether the sequence similarity distance between the traffic time series segment and the historical traffic time series segment is less than or equal to a similarity distance threshold comprises: Obtaining the number of inflection points of the dynamic time warping distance between the traffic time series segment and the historical traffic time series segment; If the number of inflection points is less than or equal to the inflection point threshold, it is determined that the sequence similarity distance between the traffic time series segment and the historical traffic time series segment is less than or equal to the similarity distance threshold.

7. The flow classification method according to claim 5, characterized in that: The method further comprises: If the traffic type of the traffic time series segment is the historical traffic type, updating the central curve of the historical traffic time series segment corresponding to the historical traffic type according to the traffic time series segment; If the traffic type of the traffic timing segment is the newly added traffic type, a central curve corresponding to the newly added traffic type is generated in the historical traffic template library according to the traffic timing segment.

8. The flow classification method according to claim 5, characterized in that: The method further comprises: If the traffic type of the traffic time series segment is an abnormal traffic type among the historical traffic types, corresponding abnormal warning information is triggered according to the abnormal traffic type.

9. A flow classification device, characterized in that: include: A traffic sequence segmentation module is used to obtain a traffic sequence collected from a client, and segment the traffic sequence according to a pre-trained traffic segmentation model to obtain a traffic time series segment corresponding to the traffic sequence; wherein the traffic segmentation model is a binary classification model, and the traffic segmentation model is used to determine the output type corresponding to each sequence point in the traffic sequence, and the output type of the sequence point includes a segmented sequence point and an unsegmented sequence point; A similarity distance determination module, used to determine the sequence similarity distance between the traffic time series segment and the historical traffic time series segment in the historical traffic template library; wherein the sequence similarity distance includes a dynamic time warping distance; The traffic type determination module is used to determine the traffic type of the traffic time series segment according to the sequence similarity distance between the traffic time series segment and the historical traffic time series segment.

10. An electronic device, characterized in that: include: processor; as well as A memory, used to store one or more programs, when the one or more programs are executed by the processor, enables the processor to implement the traffic classification method according to any one of claims 1 to 8.

11. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the traffic classification method according to any one of claims 1 to 8 is implemented.

Images