Method, apparatus, device, and storage medium for determining data type

Abstract

Embodiments of the present application disclose a method, apparatus, device, and storage medium for determining data types, belonging to the technical field of data processing. In the embodiments of the present application, the data type query library includes the correspondence between the identification information of multiple sample data and the data types. By searching the data type query library according to the obtained identification information of the sample data, the data type can be quickly determined, thereby improving the processing efficiency of the sample data. And in the case where the data types of some sample data are not found in the data type query library, data mining is performed. That is, the present solution does not require data mining every time.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of data processing, and particularly to a method, device, and storage medium for determining a data type. Background Art

[0002] With the development of network technology, various applications have emerged, such as video applications, instant messaging applications, game applications, and so on. After installing these applications on a terminal, a user can interact with an application server through the terminal to meet their own needs. At the same time, in order to perform refined management of the user's services, such as network traffic management and network quality management, it is necessary to classify the data generated during the communication between the terminal and the application server to determine the data type of the data generated by the terminal. Subsequently, the type of service that the terminal has recently performed can be known through the data type, and then more appropriate network bandwidth and network quality can be provided for each application on the terminal. The network quality includes, for example, packet loss rate, latency, jitter, etc., so as to improve the overall performance of each application running on the terminal. For example, if it is determined that the data type of the data generated by the terminal is a game service, and the game service requires a lower latency and less jitter, then subsequent high-quality network services can be provided for the terminal when the terminal performs game services. Summary of the Invention

[0003] The embodiments of the present application provide a method, device, equipment, and storage medium for determining a data type, which can improve the processing efficiency of data. The technical solution is as follows:

[0004] In a first aspect, a method for determining a data type is provided. The method includes:

[0005] Obtain M sample data, where M is a natural number; perform a search for the data type in a data type query library according to the identification information of the M sample data. The data type query library includes the corresponding relationship between the identification information of multiple sample data and the data type; based on the search, determine the sample data of unknown type from the M sample data; based on data mining performed on the sample data of unknown type, determine the data type of the sample data of unknown type.

[0006] In the embodiments of the present application, the data type query library includes the corresponding relationship between the identification information of multiple sample data and the data type. By performing a search in the data type query library according to the obtained identification information of the sample data, the data type can be quickly determined, thereby improving the processing efficiency of the sample data. And in the case where the data type of some of the sample data is not found in the data type query library, data mining is performed. That is, this solution does not require data mining every time.

[0007] In the embodiments of the present application, the network management server can collect data generated during the interaction between multiple terminals in the network and any one or more application servers through the corresponding forwarding devices. For example, various packets generated during the communication between each terminal and the application server need to be reported to the network management server through the forwarding device for management after passing through the forwarding device. That is, the network management server can collect the packets reported by each forwarding device in the network, process the packets, and obtain sample data.

[0008] The embodiments of the present application will take the network management server obtaining M pieces of sample data as an example to introduce this. The M pieces of sample data are data generated during the interaction between one or more terminals and one or more application servers through the corresponding forwarding devices.

[0009] Optionally, each piece of sample data in the M pieces of sample data includes source data and destination data. The source data includes data related to the terminal that generates the corresponding sample data, and the destination data includes data related to the application server that interacts with the terminal that generates the corresponding sample data. The identification information refers to the destination data included in the corresponding sample data.

[0010] Optionally, the source data includes the source Internet protocol (IP) address, source port, and sample generation time, and the destination data includes the destination IP address, destination port, and communication protocol. Alternatively, the destination data includes the destination IP address, destination port, communication protocol, and domain name system (DNS) information.

[0011] In the embodiments of the present application, a data type query library is stored in the network management server. The data type query library includes the correspondence between the identification information of multiple pieces of sample data and the data type. For example, the data type query library is used to store the mining results of sample data obtained by historical data mining. Each mining result includes the correspondence between the identification information of a piece of sample data and the data type. In this way, after the network management server obtains the M pieces of sample data, it searches the data type query library for the data type according to the identification information of the M pieces of sample data. That is, it searches the data type query library for the data type corresponding to each piece of sample data in the M pieces of sample data. If the corresponding data type can be found, the data type of the sample data can be quickly determined, that is, the processing efficiency of the sample data is very high.

[0012] As described above, a sample data includes source data and destination data, where the destination data includes data related to an application server that interacts with a terminal that generates the corresponding sample data. In the embodiments of the present application, the identification information stored in the data type query library refers to the destination data included in the corresponding sample data. In this case, the network management server can find the data type of the corresponding sample data from the data type query library according to the destination data included in each of the M sample data.

[0013] It should be noted that since the destination data included in the sample data is data related to the application server, and the application server can reflect the business type, that is, reflect the data type, while the source data is data related to the terminal. When finding the data type from the data type query library, it does not care which terminal generated the sample data whose data type is stored in the data type query library. That is, as long as the destination data included in two sample data is the same, regardless of whether the included source data is the same, it can be considered that the data types of these two sample data should be the same. Therefore, in the embodiments of the present application, the destination data is used as the identification information of the sample data, and the network management server finds the data type from the data type query library according to the destination data. The data type query library includes multiple corresponding relationships between different destination data and data types, that is, stores multiple different destination data and the data types corresponding to each of the multiple destination data.

[0014] In the embodiments of the present application, after the network management server performs a search for the data type on the data type query library according to the identification information of the M sample data, based on this search, it determines the sample data of unknown type from the M sample data, and determines the data type of the sample data of unknown type based on the data mining performed on the sample data of unknown type.

[0015] That is, in the embodiments of the present application, if the network management server fails to find the data type of some of the M sample data from the data type query library, it performs data mining.

[0016] Optionally, the network management server determines the data type of the sample data of unknown type based on the data mining performed on the sample data of unknown type, including: determining the data type of the sample data of unknown type based on the data mining performed on the sample data of unknown type and the sample data in the sample database.

[0017] Optionally, the network management server determines the data type of the sample data of unknown type based on the data mining performed on the sample data of unknown type, including: determining the data type of the sample data of unknown type based on the data mining performed on the M sample data.

[0018] Optionally, the network management server determines the data type of the sample data of unknown type based on data mining performed on the M sample data, including: determining the data type of the sample data of unknown type based on data mining performed on the M sample data and the sample data in the sample database.

[0019] Since the larger the amount of data for data mining, the higher the mining accuracy generally is, that is, the accuracy of performing data mining on all of the M sample data is higher. Additionally, among the M sample data, there are multiple sample data with strong time correlation regarding the same terminal. Since multiple sample data with strong time correlation regarding the same terminal are very likely to correspond to the same data type, by performing data mining on the M sample data together, the accuracy of data mining is higher, that is, the determined data type of the sample data of unknown type is more accurate.

[0020] It should be noted that there are multiple implementation manners for the network management server to perform data mining, such as frequent itemset mining.

[0021] Additionally, in the embodiments of the present application, the M sample data obtained by the network management device are data generated during the interaction between one or more terminals and one or more application servers through corresponding forwarding devices. In the case where the network management device obtains data generated by multiple terminals, by sharing the data of each terminal for data mining, the accuracy rate of data mining is very high.

[0022] Optionally, in the embodiments of the present application, after the network management device determines the data type of the sample data of unknown type, the method further includes: sending the data type of the sample data of unknown type to the forwarding device corresponding to the sample data of unknown type. It should be noted that the forwarding device can perform traffic modeling, model training, etc. according to the received data type of the sample data to determine the network tuning strategy for the corresponding terminal and improve the overall performance of the terminal.

[0023] In the embodiments of the present application, after the network management server searches the data type query library for the data type based on the identification information of the M sample data, the method further includes: determining the data type of the sample data of known type from the M sample data based on the search; sending the data type of the sample data of known type to the forwarding device corresponding to the sample data of known type.

[0024] That is, in the embodiments of the present application, if the network management server finds the data type of some or all of the multiple sample data from the data type query library, it takes the found data type as the data type corresponding to the corresponding sample data and sends it to the corresponding forwarding device. This can quickly determine the data type of the sample data and has a very high processing efficiency for the sample data.

[0025] Optionally, after the network management server determines the data type of the sample data of an unknown type, the method further includes: updating the data type query library based on the data type of the sample data of the unknown type.

[0026] For example, the network management server stores the identification information and data type of each sample data of an unknown type in the data type query library correspondingly. That is, the network management server also stores the mining result of the sample data obtained from this data mining in the data type query library to reuse the result of the data mining. Moreover, when the obtained sample data is data generated by multiple terminals, the mining result of the data can be shared with the forwarding devices corresponding to each terminal, that is, each forwarding device can share the data mining result.

[0027] Optionally, after the network management server determines the data type of the sample data of an unknown type, the method further includes: storing the M sample data in the sample database. That is, the network management server adds the latest sample data generated in the network to the sample database so that the sample database contains the latest information of the applications in the network. When performing data mining based on the sample database subsequently, the result of the data mining is more accurate.

[0028] Since information such as the IP addresses and port numbers publicly disclosed by each application server in the network may be changed frequently, to ensure the timeliness of the data in the data type query library and / or the sample database, that is, to ensure that the data in the data type query library and / or the sample database is consistent with the latest information of the applications in the network, it is necessary to update the data type query library and / or the sample database and delete the expired data.

[0029] Optionally, each sample data in the sample database corresponds to a sample generation time;

[0030] The method further includes: updating the sample database according to the first update period, the first valid duration, and the sample generation time corresponding to each sample data in the sample database.

[0031] Optionally, each pair of identification information and data type in the data type query library corresponds to a result generation time;

[0032] The method further includes: updating the data type query library according to the second update period, the second valid duration, and the result generation time corresponding to each pair of identification information and data type in the data type query library.

[0033] Second aspect, a data type determination device is provided, and the data type determination device has a function of implementing the behavior of the data type determination method in the above first aspect. The data type determination device includes one or more modules, and the one or more modules are used to implement the data type determination method provided in the above first aspect.

[0034] That is to say, an embodiment of the present application provides a data type determination device, and the device includes:

[0035] An acquisition module, configured to acquire M pieces of sample data, where M is a natural number;

[0036] A search module, configured to search for a data type in a data type query library according to the identification information of the M pieces of sample data, and the data type query library includes the corresponding relationship between the identification information of multiple pieces of sample data and the data type;

[0037] A first determination module, configured to determine, based on the search, the sample data of unknown type from the M pieces of sample data;

[0038] A data mining module, configured to determine the data type of the sample data of unknown type based on data mining performed on the sample data of unknown type.

[0039] Optionally, the device further includes:

[0040] A first update module, configured to update the data type query library based on the data type of the sample data of unknown type.

[0041] Optionally, the M pieces of sample data are data generated during the interaction between one or more terminals and one or more application servers through corresponding forwarding devices.

[0042] Optionally, the device further includes:

[0043] A first sending module, configured to send the data type of the sample data of unknown type to the forwarding device corresponding to the sample data of unknown type.

[0044] Optionally, the device further includes:

[0045] A second determination module, configured to determine, based on the search, the data type of the sample data of known type from the M pieces of sample data;

[0046] A second sending module, configured to send the data type of the sample data of known type to the forwarding device corresponding to the sample data of known type.

[0047] Optionally, each of the M sample data includes source data and destination data. The source data includes data related to the terminal that generates the corresponding sample data, and the destination data includes data related to the application server that interacts with the terminal that generates the corresponding sample data. The identification information refers to the destination data included in the corresponding sample data.

[0048] Optionally, the source data includes: source Internet Protocol (IP) address, source port, and sample generation time.

[0049] The destination data includes:

[0050] destination IP address, destination port, and communication protocol, or

[0051] destination IP address, destination port, communication protocol, and Domain Name System (DNS) information.

[0052] Optionally, the data mining module includes:

[0053] a data mining sub-module for determining the data type of the sample data of unknown type based on data mining performed on the sample data of unknown type and the sample data in the sample database.

[0054] Optionally, the device further includes:

[0055] a storage module for storing the M sample data in the sample database.

[0056] Optionally, each sample data in the sample database corresponds to a sample generation time;

[0057] The device further includes:

[0058] a second update module for updating the sample database according to the first update period, the first effective duration, and the sample generation time corresponding to each sample data in the sample database.

[0059] Optionally, each pair of identification information and data type in the data type query library corresponds to a result generation time;

[0060] The device further includes:

[0061] a third update module for updating the data type query library according to the second update period, the second effective duration, and the result generation time corresponding to each pair of identification information and data type in the data type query library.

[0062] In a third aspect, a computer device is provided. The computer device includes a processor and a memory. The memory is used to store a program for executing the method for determining the data type provided in the first aspect above, and to store data involved in implementing the method for determining the data type provided in the first aspect above. The processor is configured to execute the program stored in the memory. The operating device of the storage device may further include a communication bus, which is used to establish a connection between the processor and the memory.

[0063] In a fourth aspect, a computer-readable storage medium is provided. Instructions are stored in the computer-readable storage medium, and when it runs on a computer, it causes the computer to execute the method for determining the data type described in the first aspect above.

[0064] In a fifth aspect, a computer program product containing instructions is provided. When it runs on a computer, it causes the computer to execute the method for determining the data type described in the first aspect above.

[0065] The technical effects obtained in the second, third, fourth, and fifth aspects above are similar to those obtained by the corresponding technical means in the first aspect, and will not be elaborated here.

[0066] The technical solutions provided in the embodiments of the present application can at least bring the following beneficial effects:

[0067] In the embodiments of the present application, the data type query library includes the correspondence between the identification information of multiple sample data and the data type. The data type query library is searched according to the obtained identification information of the sample data to quickly determine the data type, thereby improving the processing efficiency of the sample data. And in the case where the data type of some sample data is not found in the data type query library, data mining is performed. That is, this solution does not require data mining every time. Description of the Drawings

[0068] Figure 1 is a system architecture diagram related to a method for determining a data type provided in an embodiment of the present application;

[0069] Figure 2 is a schematic structural diagram of a computer device provided in an embodiment of the present application;

[0070] Figure 3 is a flowchart of a method for determining a data type provided in an embodiment of the present application;

[0071] Figure 4 is a flowchart of another method for determining a data type provided in an embodiment of the present application;

[0072] Figure 5It is a flowchart of another method for determining a data type provided by an embodiment of the present application;

[0073] Figure 6 It is a schematic structural diagram of a device for determining a data type provided by an embodiment of the present application. Detailed implementation manners

[0074] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the following will further describe the embodiments of the present application in detail with reference to the accompanying drawings.

[0075] Figure 1 It is a system architecture diagram related to a method for determining a data type provided by an embodiment of the present application. Refer to Figure 1 , the system architecture includes a plurality of terminals 101, a plurality of forwarding devices 102, a network management server 103, and one or more application servers 104. Among them, each of the plurality of terminals 101 is communicatively connected to at least one of the one or more application servers 104 through one of the plurality of forwarding devices 102, and each of the plurality of forwarding devices 102 is also communicatively connected to the network management server 103.

[0076] In an embodiment of the present application, each of the plurality of terminals 101 is used to interact with at least one application server 104 through a forwarding device 102 for communication, and during the interaction process, each terminal 102 generates data. For example, the data in the packets sent by the terminal 101 during the interaction process, and the data generated by each terminal 101 will be reported to the network management server 103 through the corresponding forwarding device 102.

[0077] The network management server 103 is used to collect the data reported by each forwarding device 102 to obtain sample data, and the network management server 103 is also used to determine the data type of each sample data according to the method for determining a data type provided by an embodiment of the present application.

[0078] Optionally, the network management server 103 is further used to send the determined data type of each sample data to the forwarding device 102 corresponding to the corresponding sample data.

[0079] In some other embodiments, the network management server 103 is configured to collect the data reported by each forwarding device 102 to obtain sample data, and send the obtained sample data to the data processing server. The data processing server is configured to determine the data type of each sample data according to the data type determination method provided in the embodiments of the present application. That is to say, the system architecture further includes a data processing server, which is communicatively connected to the network management server 103, and the data processing server has the function of implementing the data type determination method provided in the embodiments of the present application. Optionally, in this case, the data processing server is further configured to send the determined data type of each sample data to the corresponding forwarding device 102 corresponding to the sample data, or the data processing server is further configured to send the determined data type of each sample data to the network management server 103, and the network management server 103 sends it to the corresponding forwarding device 102 corresponding to the sample data.

[0080] It should be noted that it is assumed that the data reported by each forwarding device 102 is a packet. Optionally, the packet is not only reported to the network management server 103 for management, but also forwarded by network devices (such as routers, switches, etc.) in the network to the corresponding application server 104, or the packet is transmitted to the application server 104 by other means. The embodiments of the present application do not make any limitations in this regard. That is to say, the process of the network management server 103 implementing the function of the data type determination method in the embodiments of the present application has no impact on the data interaction in the network. And Figure 1 The connection relationships of the devices shown are only for illustrative purposes. Figure 1 It does not constitute a limitation to the embodiments of the present application itself.

[0081] That is to say, the data type determination method provided in the embodiments of the present application can be implemented on any device supported by the performance. The data processing server and Figure 1 the network management server 103 therein do not constitute a limitation to the embodiments of the present application.

[0082] In the application embodiments, each of the multiple terminals 101 can be a mobile phone, a laptop, a desktop computer, a tablet computer, a smart bracelet, a smart home appliance, a smart speaker, and so on. Each of the multiple forwarding devices 102 is an optical network terminal (ONT), which can also be referred to as an optical modem, an optical modulator-demodulator, etc. The network management server 103 can be a single server, or a server cluster composed of multiple servers, or a cloud computing service center. The application server 104 is a server in any form that provides application services. In the case where the system architecture further includes a data processing server, the data processing server is a single server, or a server cluster composed of multiple servers, or a cloud computing service center.

[0083] The network architecture and service scenarios described in the embodiments of the present application are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those of ordinary skill in the art can know that with the evolution of the network architecture and the emergence of new service scenarios, the technical solutions provided by the embodiments of the present application are equally applicable to similar technical problems.

[0084] Please refer to Figure 2 , Figure 2 which is a schematic structural diagram of a computer device shown according to an embodiment of the present application. Optionally, the computer device is Figure 1 the network management server 103 or the data processing server shown in

[0085] The processor 201 is a general-purpose central processing unit (CPU), a network processor (NP), a microprocessor, or one or more integrated circuits for implementing the solution of the present application. For example, an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. Optionally, the above PLD is a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0086] The communication bus 202 is used to transfer information between the above components. Optionally, the communication bus 202 is divided into an address bus, a data bus, a control bus, etc. For the sake of representation, only a thick line is shown in the figure, but it does not mean that there is only one bus or one type of bus.

[0087] Optionally, the memory 203 is a read-only memory (ROM), a random access memory (RAM), an electrically erasable programmable read-only memory (EEPROM), an optical disc (including a compact disc read-only memory (CD-ROM), a compressed optical disc, a laser disc, a digital versatile disc, a Blu-ray disc, etc.), a magnetic disk storage medium, or other magnetic storage devices, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 203 exists independently and is connected to the processor 201 through the communication bus 202, or the memory 203 is integrated with the processor 201.

[0088] The communication interface 204 uses any device such as a transceiver for communicating with other devices or communication networks. The communication interface 204 includes a wired communication interface, and optionally, also includes a wireless communication interface. Among them, the wired communication interface is, for example, an Ethernet interface, etc. Optionally, the Ethernet interface is an optical interface, an electrical interface, or a combination thereof. The wireless communication interface is a wireless local area networks (WLAN) interface, a cellular network communication interface, or a combination thereof, etc. For example, the computer device is Figure 1 the network management server 103 shown in the figure, and the network management server 103 communicates with each forwarding device 102 through the communication interface 204 to obtain the sample data reported by the forwarding device 102.

[0089] Optionally, in some embodiments, the computer device includes multiple processors, such as Figure 2 the processor 201 and the processor 205 shown in the figure. Each of these processors is a single-core processor or a multi-core processor. Optionally, the processor here refers to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0090] In a specific implementation, as an embodiment, the computer device further includes an output device 206 and an input device 207. The output device 206 communicates with the processor 201 and can display information in various ways. For example, the output device 206 is a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc. The input device 207 communicates with the processor 201 and can receive user input in various ways. For example, the input device 207 is a mouse, a keyboard, a touch screen device, or a sensing device, etc.

[0091] In some embodiments, the memory 203 is used to store the program code 210 for executing the solution of this application, and the processor 201 can execute the program code 210 stored in the memory 203. The program code includes one or more software modules, and the computer device can implement the data type determination method provided in the embodiments below through the processor 201 and the program code 210 in the memory 203. For example, when the acquisition module 601, the search module 602, the first determination module 603, and the data mining module 604 included in the data type determination device shown below are all implemented by software, the program code 210 may include an acquisition module, a search module, a first determination module, and a data mining module. Among them, the acquisition module is used to acquire the sample data reported by each forwarding device, the search module is used to search for the data type of the sample data from the data type query library, the first determination module is used to determine the sample data for which the data type has not been found, and the data mining module is used to perform data mining when the data type of some sample data has not been found. Figure 3 For example, when Figure 6 the data type determination device shown below includes an acquisition module 601, a search module 602, a first determination module 603, and a data mining module 604, which are all implemented by software, the program code 210 may include an acquisition module, a search module, a first determination module, and a data mining module. Among them, the acquisition module is used to acquire the sample data reported by each forwarding device, the search module is used to search for the data type of the sample data from the data type query library, the first determination module is used to determine the sample data for which the data type has not been found, and the data mining module is used to perform data mining when the data type of some sample data has not been found.

[0092] Figure 3 is a flowchart of a data type determination method provided by an embodiment of this application. As can be seen from the foregoing, the process of determining the data type can be directly implemented by the network management server, or the network management server sends the acquired sample data to the data processing server, and the data processing server determines the data type. Next, taking the application of this method to the network management server as an example, the process of determining the data type will be introduced. Please refer to Figure 3 This method includes the following operations.

[0093] Operation 301: Acquire M sample data, where M is a natural number.

[0094] In the embodiments of the present application, the network management server can collect data generated during the interaction between multiple terminals in the network and any one or more application servers through corresponding forwarding devices. For example, various packets generated during the communication between each terminal and the application server need to be reported to the network management server for management after passing through the forwarding device. That is, the network management server can collect the packets reported by each forwarding device in the network, process the packets, and obtain sample data.

[0095] The embodiments of the present application will introduce this by taking the network management server obtaining M pieces of sample data as an example. The M pieces of sample data are data generated during the interaction between one or more terminals and one or more application servers through corresponding forwarding devices.

[0096] In the embodiments of the present application, each piece of the M pieces of sample data includes source data and destination data. Among them, the source data includes data related to the terminal that generates the corresponding sample data, and the destination data includes data related to the application server that interacts with the terminal that generates the corresponding sample data.

[0097] Exemplarily, a packet sent by terminal A is reported to the network management server through a forwarding device (such as ONT). The network management server can obtain the packet header included in the packet. The packet header carries the source IP address, destination IP address, source port, destination port, communication protocol, and timestamp. Among them, the source IP address, destination IP address, source port, destination port, and communication protocol can be called the five-tuple. The network management server takes the obtained five-tuple and timestamp as a piece of sample data. The source data included in the sample data is the source IP address, source port, and timestamp, and the destination data included in the sample data is the destination IP address, destination port, and communication protocol. Or, the network management server takes the time obtained by converting the timestamp as the sample generation time, and then takes the obtained five-tuple and sample generation time as a piece of sample data. The source data in the sample data includes the source IP address, source port, and sample generation time, and the destination data in the sample data includes the destination IP address, destination port, and communication protocol. The embodiments of the present application will introduce this by taking the sample data including the sample generation time as an example.

[0098] In addition, in the case where the packet also carries DNS information, the network management server can also obtain the DNS information in the packet and take the DNS information as one item in the destination data included in the sample data. That is, in this case, the destination data includes the destination IP address, destination port, communication protocol, and DNS information.

[0099] That is, in the embodiments of the present application, the source data includes the source IP address, the source port, and the sample generation time, and the destination data includes the destination IP address, the destination port, and the communication protocol. Alternatively, the destination data includes the destination IP address, the destination port, the communication protocol, and the Domain Name System (DNS) information.

[0100] Optionally, in some other embodiments, a sample data only includes the destination data. In still other embodiments, the source data in a sample data includes the source IP address and the sample generation time (or timestamp), and does not include the source port.

[0101] It should be noted that when the network management server initially executes the operation of the method for determining the data type provided in the embodiments of the present application, after collecting the data generated by the one or more terminals to a certain number, M sample data are obtained to ensure that the data volume of the initial data mining is sufficient to ensure the accuracy of the result. After processing the M sample data obtained for the first time according to this method to obtain the corresponding data type, the network management server can obtain one sample data at a time, or obtain more than one sample data at a time as the M sample data. The embodiments of the present application do not limit this. That is, except for the first time when the network management server needs to obtain a certain number of sample data, the number of sample data obtained each time is not limited at other times.

[0102] Operation 302: Search the data type query library for the data type according to the identification information of the M sample data. The data type query library includes the corresponding relationship between the identification information of multiple sample data and the data type.

[0103] In the embodiments of the present application, a data type query library is stored in the network management server. The data type query library includes the corresponding relationship between the identification information of multiple sample data and the data type. For example, the data type query library stores the mining results of the sample data obtained by historical data mining. Each mining result includes the corresponding relationship between the identification information of a sample data and the data type. Another example is that the network management server determines the corresponding relationship between one or more identification information of some application servers and the data type according to the public information of these application servers, and stores the corresponding relationship between these identification information and the data type in the data type query library. For example, the public information of a certain video server includes the IP address. The network management server determines that the data type corresponding to the identification information including this IP address is a video application, and stores the data type corresponding to the identification information including this IP address as a video application in the data type query library.

[0104] Since the data type query library in the embodiments of the present application includes the correspondence between the identification information of multiple sample data and the data types, in this way, after the network management server obtains the M sample data, it searches the data type query library for the data types according to the identification information of the M sample data. That is, it searches in the data type query library for the data type corresponding to each piece of sample data among the M sample data. If the corresponding data type can be found, the data type of the sample data can be quickly determined, that is, the processing efficiency of the sample data is very high.

[0105] As can be seen from the foregoing, a piece of sample data includes source data and destination data, where the destination data includes data related to the application server that interacts with the terminal that generates the corresponding sample data. In the embodiments of the present application, the identification information stored in the data type query library refers to the destination data included in the corresponding sample data. In this case, the network management server can search the data type query library for the data type of the corresponding sample data according to the destination data included in each piece of the M sample data.

[0106] It should be noted that since the destination data included in the sample data is data related to the application server, and the application server can reflect the business type, that is, reflect the data type, while the source data is data related to the terminal. When searching for the data type in the data type query library, it does not care which terminal generates the sample data for the data type stored in the data type query library. That is, as long as the destination data included in two pieces of sample data is the same, regardless of whether the included source data is the same, it can be considered that the data types of these two pieces of sample data should be the same. Therefore, in the embodiments of the present application, the destination data is used as the identification information of the sample data, and the network management server searches for the data type from the data type query library according to the destination data. The data type query library includes the correspondence between multiple different destination data and the data types, that is, it stores multiple different destination data and the data type corresponding to each of the multiple destination data.

[0107] In addition, in the embodiments of the present application, the data type of a piece of sample data can be a video application, an instant communication application, a game application, etc., or the data type of a piece of sample data can be a specific application name, such as Video APP1, Video APP2, Game APP1, Game APP2, etc. That is, the data type in the embodiments of the present application can be a coarse-grained classification or a fine-grained classification, that is, the classification granularity can be flexibly determined according to the business classification requirements, and the embodiments of the present application do not limit this.

[0108] Optionally, in the embodiments of the present application, the data type is reflected in the form of a data label. One sample data corresponds to one data label, and this data label is the data type of this sample data. One identification information in the data type query library corresponds to one data label, and this data label is the data type of this identification information.

[0109] Operation 303: Based on this search, determine the sample data of unknown type from the M sample data.

[0110] In the embodiments of the present application, after the network management server performs a search for the data type in the data type query library, based on this search, determine the data types of the sample data of known type from the M sample data, and determine the sample data of unknown type.

[0111] That is to say, if the data type of each sample data in the M sample data is found in the data type query library, the network management server determines that the M sample data are all sample data of known type, which can quickly determine the data type of the sample data and has a high processing efficiency for the sample data. If there is one or more sample data in the M sample data for which the data type is not found, the network management server determines that there is sample data of unknown type in the M sample data.

[0112] Operation 304: Based on the data mining performed on the sample data of unknown type, determine the data type of the sample data of unknown type.

[0113] In the embodiments of the present application, if the network management server determines that there is sample data of known type in the M sample data, then use the found data type as the data type of the corresponding sample data, that is, determine the data types of the sample data of known type in the M sample data.

[0114] Exemplarily, assume that the data type query library stores the mining results of the sample data obtained by historical data mining. Each mining result includes the correspondence between the identification information of a sample data and the data type. Among them, the data type corresponding to sample data 1 has been obtained by historical data mining. Sample data 1 includes destination data 1, and destination data 1 includes destination IP address 1, destination port 1, and hyper text transfer protocol (HTTP). The destination data 1 and the corresponding data type are stored in the data type query library. The sample data for which the data type needs to be found is sample data 2. The destination data in sample data 2 also includes destination IP address 1, destination port 1, and HTTP. Then the network management server can directly find the data type corresponding to sample data 2 from the data type query library according to this destination data.

[0115] In an embodiment of the present application, if the network management server determines that there is sample data of an unknown type among the M pieces of sample data, it determines the data type of the sample data of the unknown type based on data mining performed on the sample data of the unknown type.

[0116] In an embodiment of the present application, a sample database is further stored in the network management server. The sample database is used to store sample data. The network management server determines the data type of the sample data of the unknown type based on data mining performed on the sample data of the unknown type and the sample data in the sample database.

[0117] Optionally, the network management server determines the data type of the sample data of the unknown type based on data mining performed on the M pieces of sample data. Optionally, the network management server determines the data type of the sample data of the unknown type based on data mining performed on the M pieces of sample data and the sample data in the sample database. Among the M pieces of sample data, there are multiple pieces of sample data with strong time correlation regarding the same terminal. Since multiple pieces of sample data with strong time correlation regarding the same terminal are very likely to correspond to the same data type, by jointly performing data mining on the M pieces of sample data, the accuracy of data mining is higher, that is, the determined data type of the sample data of the unknown type is more accurate.

[0118] In other words, in an embodiment of the present application, if the network management server fails to find the data type of some of the M pieces of sample data from the data type query library, that is, if there is one or more first sample data among the M pieces of sample data, the network management server performs data mining based on the M pieces of sample data and the sample data in the sample database to determine the data type corresponding to each of the one or more first sample data. Among them, the one or more first sample data refer to the sample data for which the data type cannot be found from the data type query library.

[0119] It should be noted that there are multiple implementation manners for the network management server to perform data mining. In an embodiment of the present application, frequent item set mining is taken as an example to introduce this.

[0120] In an embodiment of the present application, the network management server jointly performs frequent item set mining on the M pieces of sample data or the sample data of the unknown type and the sample data in the sample database to obtain one or more frequent item sets. Each frequent item set includes multiple pieces of data with a high degree of association. If one piece of data included in a frequent item set is data related to a known application server, that is, the data type corresponding to this piece of data is known, then the other pieces of data in the frequent item set where this piece of data is located also correspond to this data type. Then the network management server determines that the sample data including this piece of data among the multiple sample data also corresponds to this data type.

[0121] It should be noted that in the embodiments of the present application, some public information of application servers is stored in the network management server. The public information includes the destination IP address or DNS information, that is, the data types corresponding to these destination IP addresses or DNS information are known. Then, based on this known information and through data mining, the network management server performs correlation analysis on each item of data in the sample data to determine the data type of the sample data.

[0122] For example, assuming that the data type is in the form of a data label, it is known that an application server is the application server corresponding to the video APP1, and the data related to this application server is the destination IP address 1. That is, the data label corresponding to the sample data including the destination IP address 1 in the destination data is video APP1. A frequent item set obtained by the network management server through data mining includes the destination IP address 1 and the destination port 1, and another frequent item set includes the destination IP address 1 and the destination port 2. Then, it is considered that the destination port 1 and the destination port 2 are probably the two ports of this application server. Among the M sample data obtained by the network management server, the data label corresponding to the sample data whose destination data includes the destination port 1 or the destination port 2 is also video APP1.

[0123] In the embodiments of the present application, after the network management server determines the data type of the sample data of unknown type based on the data mining performed on the sample data of unknown type, it updates the data type query library based on the data type of the sample data of unknown type.

[0124] After this data mining, the network management server stores the corresponding relationship between the newly determined identification information and the data type in the data type query library. That is, it stores the mining result obtained from this data mining in the data type query library to make secondary use of the result of the data mining.

[0125] Exemplarily, the network management server stores the data type of each sample data in the sample data of unknown type and the included destination data in the data type query library correspondingly. In other words, the network management server takes the data type of each sample data in the sample data of unknown type and the included destination data as the mining result of the corresponding sample data, and stores the mining result in the data type query library.

[0126] In the embodiments of the present application, after the network management server determines the data type of the sample data of unknown type, it stores the M sample data in the sample database. That is, it adds the latest sample data generated in the network to the sample database so that the sample database contains the latest information of the applications in the network. In the case of subsequent data mining based on the sample database, the result of the data mining is more accurate.

[0127] Optionally, in the embodiments of the present application, after obtaining the M sample data, the network management server may also store the M sample data in the sample database before performing a data type search on the data type query library according to the identification information of the M sample data. Subsequently, if there is sample data in the M sample data for which the data type cannot be found in the data type query library, that is, there is sample data of an unknown type in the M sample data, the network management server performs data mining based on the sample data of the unknown type and the sample data in the sample database, or performs data mining based on the M sample data and the sample data in the sample database.

[0128] Since information such as the IP addresses and port numbers publicly disclosed by each application server in the network may often change, in order to ensure the timeliness of the data in the data type query library and / or the sample database, that is, to ensure that the data in the data type query library and / or the sample database is consistent with the latest information of the applications in the network, it is necessary to update the data type query library and / or the sample database.

[0129] In the embodiments of the present application, each sample data in the sample database corresponds to a sample generation time. Based on this, the network management server can update the sample database according to the first update period, the first effective duration, and the sample generation time corresponding to each sample data in the sample database.

[0130] Exemplarily, assuming that the first update period is one week and the first effective duration is one month, then the network management server can delete the data in the sample database whose sample generation time was one month ago at zero o'clock every Sunday, that is, delete the expired data.

[0131] In the embodiments of the present application, each pair of identification information and data type in the data type query library corresponds to a result generation time. Based on this, the network management server can update the data type query library according to the second update period, the second effective duration, and the result generation time corresponding to each pair of identification information and data type in the data type query library.

[0132] Exemplarily, assuming that the second update period is two days and the second effective duration is one month, then the network management server can delete the data in the data type query library whose result generation time was one month ago every two days, that is, delete the expired data.

[0133] Optionally, the first update period and the second update period may be the same or different, and the first effective duration and the second effective duration may be the same or different.

[0134] Optionally, use the sample generation time corresponding to the sample data as the identification information of the sample data and the result generation time corresponding to the data type, or use the time for determining the data type of the sample data as the identification information and the result generation time corresponding to the data type.

[0135] Optionally, in the embodiments of the present application, after the network management server determines the data type corresponding to each of the M sample data, it sends the data type of the sample data to the forwarding device corresponding to the corresponding sample data. Subsequently, the forwarding device can perform model training, traffic modeling, etc. according to the received data type of the sample data to determine the network optimization strategy, and select appropriate network bandwidth and network quality (such as packet loss, latency, jitter, etc.) for each application installed on the terminal through the network optimization strategy to improve the overall performance of the terminal. Or, the network management server can learn about the types of services recently performed by each terminal through the data type, and then provide more appropriate network bandwidth and network quality for each application on the terminal to improve the overall performance of the terminal.

[0136] In the embodiments of the present application, as can be seen from the foregoing, the M sample data may include sample data of unknown types and sample data of known types. After the network management server determines the data type of the sample data of unknown types, it sends the data type of the sample data of unknown types to the forwarding device corresponding to the sample data of unknown types. After determining the data type of the sample data of known types, it sends the data type of the sample data of known types to the forwarding device corresponding to the sample data of known types.

[0137] Next, refer to Figure 4 to introduce again the method for determining the data type provided in the embodiments of the present application. Refer to Figure 4 , the network management server (also referred to as the server side) includes a sample management module, a matching query module, a data mining module, and a distribution management module. The network management server determines the data type of the sample data through the following operations based on these modules.

[0138] 1. The sample management module collects the data reported by each forwarding device to obtain M sample data, stores the M sample data in a sample database (also referred to as a sample library), and sends the M sample data to the matching query module.

[0139] 2. The M sample data is processed by the matching query module to obtain target data, and the corresponding data type is searched from a data type query library (also referred to as a result set) according to the target data.

[0140] 3. The matching query module finds the data types corresponding to some or all of the M sample data. For the sample data in the M sample data for which the data types cannot be found in the data type query library, that is, for the sample data of unknown types, the matching query module requests the data mining module to perform data mining.

[0141] 4. The data mining module performs data mining on the sample data in the sample database to determine the data types of the sample data of unknown types, and stores the mining results in the result set.

[0142] 5. For the data types of the found sample data, the matching query module requests the distribution management module to distribute the results. The distribution management module distributes the data types of the found sample data to the corresponding forwarding devices, that is, sends the data types of the sample data of known types to the corresponding forwarding devices. For the data types of the sample data determined by data mining, the data mining module requests the distribution management module to distribute the results. The distribution management module distributes the data types of the sample data determined by data mining to the corresponding forwarding devices, that is, sends the data types of the sample data of unknown types to the corresponding forwarding devices.

[0143] Optionally, Figure 4 the sample management module in

[0144] is also used to update the sample database to delete expired sample data. For example, the sample management module updates the sample database according to the first update period, the first effective duration, and the sample generation time corresponding to each sample data in the sample database. Figure 4 Optionally,

[0145] the network management server in Figure 4 also includes a result management module (not shown). The result management module is used to update the data type query library to delete expired data. For example, the result management module updates the data type query library according to the second update period, the second effective duration, and the result generation time corresponding to each pair of identification information and data type in the data type query library. Figure 5 Exemplarily, on the basis of

[0146] 1. When the network management server executes the method for determining the data type provided in the embodiment of the present application for the first time, the sample management module receives the sample data reported by forwarding devices such as forwarding device A and forwarding device N.

[0147] 2. The sample management module aggregates the sample data reported by all forwarding devices to a certain quantity and requests the matching query module to search for the data type in the data type query library.

[0148] 3. When searching for the first time, the data type query library (result set) is empty. The matching query module determines that all sample data needs data mining and requests the data mining module to perform data mining.

[0149] 4. Based on the data mining performed on all sample data, the data mining module identifies the data types of all sample data, saves the mining results obtained from the data mining to the result set, and requests the distribution management module to distribute the data types of the sample data to the corresponding forwarding devices, that is, requests to send the identification results to the forwarding devices.

[0150] 5. The distribution management module distributes the identification results to the corresponding forwarding devices.

[0151] 6. Forwarding device A reports sample data to the sample management module again.

[0152] 7. The sample management module requests the matching query module to perform a search.

[0153] 8. Since forwarding device N reported sample data including the same destination data before, the matching query module can directly find the corresponding data type from the result set.

[0154] 9. The matching query module requests the distribution management module to send the search results to the corresponding forwarding devices.

[0155] 10. The distribution management module distributes the results to forwarding device A.

[0156] As can be seen from the above introduction, the network management server collects sample data generated by multiple terminals through corresponding forwarding devices, and conducts data mining on these sample data together, that is, shares the data reported by each forwarding device. The accuracy of data mining is very high, and through the data type query library, each forwarding device shares the results of data mining to quickly determine the data type of the sample data. After the network management server runs for a period of time, the correspondence between the identification information and data type of most of the sample data in the whole network accumulates in the data type query library. Then, for the sample data reported by any forwarding device in the network, the probability of directly finding the corresponding data type through the data type query library will be greatly improved, and even data mining may not be required at all, unless there are new applications or services in the network, in which case data mining may be needed again. In addition, the network management server can also update the data type query library and the sample database to delete expired data and ensure the timeliness of the data.

[0157] That is to say, when the mining results of the sample data obtained from historical data mining are stored in the data type query library, each forwarding device can share the historical data mining results to quickly determine the data type, thereby improving the processing efficiency of the sample data. Moreover, when the data type corresponding to some of the sample data cannot be found in the data type query library, data mining is performed based on the sample data reported by all forwarding devices. That is, the sample data reported by each forwarding device is shared during the data mining process, and data sharing can significantly improve the accuracy of data mining.

[0158] It should be noted that the embodiment of the present application provides a solution for sharing the sample data and data mining results of each node (such as a forwarding device). The design idea of this solution can be applied to various data mining scenarios based on samples, and the processing efficiency of samples and the accuracy of data mining are improved through the sharing of sample data and data mining results among nodes.

[0159] In summary, in the embodiment of the present application, the data type query library includes the correspondence between the identification information and data type of multiple sample data. The data type query library is searched according to the obtained identification information of the sample data to quickly determine the data type, thereby improving the processing efficiency of the sample data. And when the data type of some of the sample data cannot be found in the data type query library, data mining is performed, that is, this solution does not require data mining every time.

[0160] Figure 6FIG. 600 is a schematic structural diagram of a data type determination device provided by an embodiment of the present application. The data type determination device 600 can be implemented as part or all of a computer device by software, hardware, or a combination of both. The computer device can be Figure 1 the network management server or data processing server shown in Figure 6 . Referring to

[0161] , the device 600 includes: an acquisition module 601, a search module 602, a first determination module 603, and a data mining module 604. Figure 3 The acquisition module 601 is configured to acquire M sample data, where M is a natural number; the specific implementation manner refers to the detailed description in operation 301 in the foregoing

[0162] embodiment and will not be elaborated here. Figure 3 The search module 602 is configured to search for the data type in the data type query library according to the identification information of the M sample data. The data type query library includes the correspondence between the identification information of multiple sample data and the data type; the specific implementation manner refers to the detailed description in operation 302 in the foregoing

[0163] embodiment and will not be elaborated here.

[0164] The first determination module 603 is configured to determine the sample data of unknown type from the M sample data based on the search; Figure 3

[0164] The data mining module 604 is configured to determine the data type of the sample data of unknown type based on the data mining performed on the sample data of unknown type. The specific implementation manner refers to the detailed description in operation 304 in the foregoing embodiment and will not be elaborated here.

[0165] Optionally, the device 600 further includes:

[0166] A first update module, configured to update the data type query library based on the data type of the sample data of unknown type. The specific implementation manner refers to the detailed description in operation 304 in the foregoing Figure 3 embodiment and will not be elaborated here.

[0167] Optionally, the M sample data is data generated during the interaction between one or more terminals and one or more application servers through corresponding forwarding devices.

[0168] Optionally, the device 600 further includes:

[0169] A first sending module, configured to send the data type of the sample data of unknown type to the forwarding device corresponding to the sample data of unknown type.

[0170] Optionally, the device 600 further includes:

[0171] A second determination module, configured to determine the data type of the sample data of the known type from the M pieces of sample data based on the search.

[0172] A second sending module, configured to send the data type of the sample data of the known type to the forwarding device corresponding to the sample data of the known type.

[0173] Optionally, each piece of sample data in the M pieces of sample data includes source data and destination data. The source data includes data related to the terminal that generates the corresponding sample data, and the destination data includes data related to the application server that interacts with the terminal that generates the corresponding sample data. The identification information refers to the destination data included in the corresponding sample data.

[0174] Optionally, the source data includes: a source Internet Protocol (IP) address, a source port, and a sample generation time.

[0175] The destination data includes:

[0176] a destination IP address, a destination port, and a communication protocol, or

[0177] a destination IP address, a destination port, a communication protocol, and Domain Name System (DNS) information.

[0178] Optionally, the data mining module 604 includes:

[0179] A data mining sub-module, configured to determine the data type of the sample data of the unknown type based on data mining performed on the sample data of the unknown type and the sample data in the sample database. The specific implementation method refers to the detailed description in operation 304 in the foregoing Figure 3 embodiment, and will not be elaborated here.

[0180] Optionally, the device 600 further includes:

[0181] A storage module, configured to store the M pieces of sample data in the sample database.

[0182] Optionally, each piece of sample data in the sample database corresponds to a sample generation time;

[0183] The device 600 further includes:

[0184] A second update module, configured to update the sample database according to the first update period, the first effective duration, and the sample generation time corresponding to each piece of sample data in the sample database.

[0185] Optionally, each pair of identification information and data type in the data type query library corresponds to a result generation time;

[0186] The device 600 further includes:

[0187] A third update module, configured to update a data type query library according to a second update period, a second valid duration, and a result generation time corresponding to each pair of identification information and data type in the library.

[0188] In summary, in the embodiment of the present application, the data type query library includes the correspondence between the identification information and the data type of multiple sample data. By searching the data type query library according to the obtained identification information of the sample data, the data type can be quickly determined, thereby improving the processing efficiency of the sample data. And in the case where the data types of some of the sample data are not found in the data type query library, data mining is performed. That is, the present solution does not need to perform data mining every time.

[0189] It should be noted that when determining the data type, the data type determination device provided in the above embodiment is only illustrated by taking the division of the above functional modules as an example. In actual applications, the above functions can be assigned to different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the data type determination device provided in the above embodiment and the data type determination method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0190] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center in a wired manner (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or a wireless manner (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center that includes one or more integrated available media. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a digital versatile disc (DVD)), or a semiconductor medium (such as a solid state disk (SSD)), etc. It should be noted that the computer-readable storage medium mentioned in the embodiments of the present application can be a non-volatile storage medium, in other words, a non-transitory storage medium.

[0191] It should be understood that the "at least one" mentioned herein refers to one or more, and the "multiple" refers to two or more. In the description of the embodiments of the present application, unless otherwise specified, " / " means "or". For example, A / B can mean A or B; the "and / or" herein is merely a description of the association relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, terms such as "first" and "second" are used to distinguish the same items or similar items with basically the same functions and roles. Those skilled in the art can understand that the terms "first", "second", etc. do not limit the quantity and execution order, and the terms "first", "second", etc. do not necessarily limit to be different.

[0192] The above are the embodiments provided by the present application, which are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for determining a data type, characterized in that The method includes: Obtaining M sample data, where M is a natural number, and the M sample data is data generated during the interaction between one or more terminals and one or more application servers through corresponding forwarding devices. Each sample data in the M sample data includes source data and destination data. The source data includes data related to the terminal that generates the corresponding sample data, and the destination data includes data related to the application server that interacts with the terminal that generates the corresponding sample data; the source data includes a source Internet Protocol (IP) address, a source port, and a sample generation time; the destination data includes: a destination IP address, a destination port, and a communication protocol, or a destination IP address, a destination port, a communication protocol, and Domain Name System (DNS) information; Performing a data type search on a data type query library according to the identification information of the M sample data. The data type query library includes the corresponding relationship between the identification information of multiple sample data and data types, and the identification information refers to the destination data included in the corresponding sample data; Based on the search, determining unknown type sample data from the M sample data; Performing frequent item set mining on the M sample data and the sample data in the sample database to obtain one or more frequent item sets, and each frequent item set includes multiple items of data; For any frequent item set in the one or more frequent item sets, if there is an item of data of a known type in the frequent item set, then determining the data type of the item of data of the known type as the data type of other item data in the frequent item set, and determining the data type of the sample data that includes any item data in the frequent item set in the unknown type sample data; 2. The method according to claim 1, wherein After determining the data type of the unknown type sample data, the method further includes: Updating the data type query library based on the data type of the unknown type sample data; 3. The method according to claim 1 or 2, characterized in that, After determining the data type of the unknown type sample data, the method further includes: Sending the data type of the unknown type sample data to the forwarding device corresponding to the unknown type sample data; 4. The method according to any one of claims 1-3, characterized in that, After performing a data type search on the data type query library according to the identification information of the M sample data, the method further includes: Based on the search, determining the data type of the known type sample data from the M sample data; Sending the data type of the known type sample data to the forwarding device corresponding to the known type sample data; 5. The method according to any one of claims 1-4, characterized in that, After determining the data type of the unknown type sample data, the method further includes: Storing the M sample data in the sample database; 6. The method according to any one of claims 1-5, characterized in that Each sample data in the sample database corresponds to a sample generation time; The method further includes: Updating the sample database according to a first update period, a first effective duration, and the sample generation time corresponding to each sample data in the sample database; 7. The method according to any one of claims 1-6, characterized in that Each pair of identification information and data type in the data type query library corresponds to a result generation time; The method further includes: Update the data type query library according to the second update period, the second effective duration, and the result generation time corresponding to each pair of identification information and data type in the data type query library.

8. An apparatus for determining a data type, characterized in that, The device includes: An acquisition module, configured to acquire M sample data, where M is a natural number, and the M sample data is data generated during the interaction between one or more terminals and one or more application servers through corresponding forwarding devices. Each sample data in the M sample data includes source data and destination data. The source data includes data related to the terminal that generates the corresponding sample data, and the destination data includes data related to the application server that interacts with the terminal that generates the corresponding sample data; the source data includes a source Internet Protocol (IP) address, a source port, and a sample generation time; the destination data includes: a destination IP address, a destination port, and a communication protocol, or a destination IP address, a destination port, a communication protocol, and Domain Name System (DNS) information; A search module, configured to perform a search for data types on the data type query library according to the identification information of the M sample data. The data type query library includes the correspondence between the identification information and data types of multiple sample data, and the identification information refers to the destination data included in the corresponding sample data. A first determination module, configured to determine, based on the search, the sample data of unknown types from the M sample data. A data mining module, configured to perform frequent item set mining on the M sample data and the sample data in the sample database to obtain one or more frequent item sets. Each frequent item set includes multiple items of data. For any frequent item set in the one or more frequent item sets, if there is an item of data of a known type in the frequent item set, determine the data type of the item of data of the known type as the data type of other items of data in the frequent item set, and determine the data type of the sample data including any item of data in the frequent item set in the sample data of unknown types.

9. The device according to claim 8, characterized in that, The device further includes: A first update module, configured to update the data type query library based on the data types of the sample data of unknown types.

10. The device according to claim 8 or 9, characterized in that, The device further includes: A first sending module, configured to send the data types of the sample data of unknown types to the forwarding device corresponding to the sample data of unknown types.

11. The device according to any one of claims 8-10, characterized in that, The device further includes: A second determination module, configured to determine, based on the search, the data types of the sample data of known types from the M sample data. A second sending module, configured to send the data types of the sample data of known types to the forwarding device corresponding to the sample data of known types.

12. The device according to any one of claims 8-11, characterized in that, The device further includes: A storage module, configured to store the M sample data in the sample database.

13. The device according to any one of claims 8-12, characterized in that, Each sample data in the sample database corresponds to a sample generation time; The device further includes: A second update module, configured to update the sample database according to the first update period, the first effective duration, and the sample generation time corresponding to each sample data in the sample database.

14. The device according to any one of claims 8-13, characterized in that, Each pair of identification information and data type in the data type query library corresponds to a result generation time; The device further includes: A third update module, configured to update the data type query library according to a second update period, a second valid duration, and the result generation time corresponding to each pair of identification information and data type in the data type query library.

15. A computer device, characterized in that, The device includes a memory and a processor: The memory is configured to store the program involved in any one of claims 1-7; The processor is configured to execute the program to implement the method according to any one of claims 1-7.

16. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, and when the computer program is executed by the processor, it implements the operations of the method according to any one of claims 1-7.

Images