Data packet identification method and apparatus

Abstract

This application discloses a method and apparatus for identifying data packets, relating to the field of artificial intelligence. It enables model training based on data packets generated from labeled new applications, requiring minimal computation and time. The method includes: acquiring a first target model, which is used to extract first feature information from a first data packet to determine a first application in a first application set corresponding to the first data packet; acquiring a second target model, which is used to extract second feature information from a second data packet to determine a second application in a second application set corresponding to the second data packet, under certain triggering conditions; and acquiring a third data packet, and determining the first or second application corresponding to the third data packet based on the first and second target models.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and in particular to a method and apparatus for identifying data packets. Background Technology

[0002] With the rapid development of the internet, internet applications (APPs) are also increasing, for example, and And so on. These applications generate data packets during runtime, and different applications may generate data packets with different network requirements. In order to achieve differentiated management of data packets generated by different applications, it is first necessary to identify which application generated each data packet.

[0003] Currently, data packets can be identified using deep learning methods. For example, a data packet identification device can identify data packets generated by existing applications by: acquiring a large number of labeled data packets generated by existing applications; identifying the feature information of each data packet, such as the keywords of the application corresponding to the data packet; and repeatedly training a model based on the feature information of each identified data packet, and then using the trained model to identify newly received data packets generated by existing applications.

[0004] In the course of internet development, new applications emerge in addition to existing ones. In such cases, the packet recognition device cannot identify packets generated by these new applications. Therefore, the packet recognition device must retrain its model based on a large number of labeled packets, enabling the trained model to distinguish between packets generated by existing and new applications. This process is not only computationally intensive but also time-consuming. Furthermore, if new applications appear frequently, the packet recognition device needs to execute this process repeatedly, resulting in significant data and computational overhead. Summary of the Invention

[0005] This application provides a method and apparatus for identifying data packets, which can train a model based on data packets generated by newly labeled applications when new applications are added. This method requires little computation and has a short training time.

[0006] To achieve the above objectives, the embodiments of this application adopt the following technical solutions:

[0007] In a first aspect, embodiments of this application provide a data packet identification method, the method comprising: a first device acquiring a first target model, the first target model being used to extract first feature information of a first data packet and determine a first application in a first application set corresponding to the first data packet; under the condition of satisfying a triggering condition, the first device acquiring a second target model, the second target model being used to extract second feature information of a second data packet and determine a second application in a second application set corresponding to the second data packet, wherein the first application in the first application set is different from the second application in the second application set; and the first device acquiring a third data packet and determining, based on the first target model and the second target model, either the first application or the second application corresponding to the third data packet.

[0008] The method provided in the first aspect above, when a new application (i.e., an application in the second application set) appears after using the first target model, does not require the first device to train a model based on the labeled data packets of the first and second applications to obtain a model capable of recognizing data packets from both the first and second application sets. Instead, the first device can train a model based on the labeled data packets of the second application to obtain a second target model. Subsequently, the first and second target models are used to recognize data packets from either the first or second application set. Because the number of labeled data packets from the second application is much smaller than the number of labeled data packets from the first and second applications, the method provided in the first aspect has a lower computational load and shorter training time for the first device. Furthermore, in the case of a new application, the method provided in the first aspect uses the labeled data packets from the second application for model training, thus freeing up the labeled data packets from the first application and reducing data storage costs.

[0009] One possible implementation involves a first device acquiring a second target model, comprising: the first device receiving information about a first initial model from a server and a list of second applications contained in a second application set, wherein the first initial model is determined based on the number of applications in the second application set, and the list of second applications indicates the correspondence between the second applications in the second application set and the output of the first initial model; the first device training the first initial model based on data packets of labeled second applications obtained by the first device to obtain a first intermediate model; the first device sending information about the first intermediate model to the server; the first device receiving information about a second target model from the server, wherein the information about the second target model is obtained by aggregating information from intermediate models from multiple first devices; and the first device obtaining a second target model based on the information about the second target model and the first initial model. Based on the above method, a device participating in model training, such as the first device, can receive information about the first initial model from the server and a list of second applications contained in the second application set, train the first initial model based on data packets of labeled second applications to obtain a first intermediate model, and send the information about the first intermediate model to the server so that the server can aggregate the information from intermediate models from multiple first devices to obtain the information about the second target model. Subsequently, the first device can receive information from the second target model from the server and, based on the information of the second target model and the first initial model, obtain the second target model. On the one hand, all devices participating in model training can obtain a model that can ultimately identify data packets of applications in the second application set. On the other hand, in the above method, the server does not need to perform model training; instead, the model training process is delegated to the devices participating in model training. The number of labeled data packets used by each device during model training is also less than the number of labeled data packets used by the server during model training. For these devices, the computational load is not large, and model training time can be saved.

[0010] One possible implementation involves the first device acquiring the second target model, further including: the first device acquiring a data packet of the second application; the first device sending the data packet of the second application to a server; and the first device receiving annotated data packets of the second application from the server. Based on the above method, the first device can send the data packet of the second application to the server, facilitating the server to annotate the data packet.

[0011] One possible implementation is that the trigger condition is that the number of applications in the second application set is greater than or equal to a first threshold; or, the trigger condition is that the number of data packets from the applications in the second application set is greater than or equal to a second threshold; or, the trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets from the applications in the second application set is greater than or equal to the second threshold. Based on the above methods, when the number of newly added applications reaches the first threshold, or when the number of unidentified data packets exceeds the second threshold, or when the number of newly added applications reaches the first threshold and the number of unidentified data packets exceeds the second threshold, the first device can be triggered to acquire the second target model. This avoids the first device frequently acquiring the second target model, thus preventing excessive computational overhead. It also avoids the first device not acquiring the second target model for extended periods, which could lead to a large number of unidentified data packets and affect service usage.

[0012] One possible implementation involves the first device determining the first or second application corresponding to the third data packet based on a first target model and a second target model. This includes: the first device obtaining a first output entropy of the third data packet based on the first target model, where the first output entropy indicates the probability that the application corresponding to the third data packet is the application predicted by the first target model; the first device obtaining a second output entropy of the third data packet based on the second target model, where the second output entropy indicates the probability that the application corresponding to the third data packet is the application predicted by the second target model; and the first device determining the application predicted by the target model corresponding to the third data packet as the application corresponding to the third data packet, based on the lower value of the first and second output entropies. Based on this method, the first device can determine the application corresponding to the third data packet based on the first and second output entropies, thereby achieving application identification by combining the first and second target models. Thus, when a new application appears, the first device does not need to train a model based on the labeled data packets of the first and second applications to obtain a model that can identify data packets of applications in both the first and second application sets.

[0013] One possible implementation further includes: a first device acquiring a second initial model, determined based on the number of applications in a first application set and the number of applications in a second application set; the first device training the second initial model to obtain a third target model based on the annotation results of the data packets obtained by the first device using the first target model and the second target model; the third target model is used to extract third feature information and determine the application corresponding to the data packet corresponding to the third feature information; the third feature information includes feature information of the data packet corresponding to the third feature information, and the data packet corresponding to the third feature information is a data packet of an application in the first application set or a data packet of an application in the second application set. Based on the above method, the first device can acquire the second initial model and train it to obtain the third target model based on the annotation results of the data packets obtained by the first device using the first target model and the second target model. Subsequently, the first device can identify data packets based on the third target model, saving time for the first device to identify data packets. In addition, by continuously compressing the model, the first device can stabilize the model size, which is beneficial for the model's deployment on an on-chip system.

[0014] One possible implementation further includes: a first device training a third target model based on labeled data packets used when acquiring the first target model, and / or labeled data packets used when acquiring the second target model, to obtain a trained third target model. Based on this method, the first device can train the third target model based on the labeled data packets used when acquiring the first target model, and / or labeled data packets used when acquiring the second target model, resulting in a more accurate and more precise data packet recognition of the trained third target model.

[0015] One possible implementation further includes: a first device receiving instruction information from a server, the instruction information instructing the first device to retrain a fourth target model for identifying data packets of the first application and data packets of the second application. Based on the above method, the server can instruct the first device to retrain the model so that the trained model can identify data packets of applications in the first application set and data packets of applications in the second application set.

[0016] Secondly, embodiments of this application provide a data packet identification method, the method comprising: a server acquiring information of a first target model, the first target model being used to extract first feature information of a first data packet and determine a first application in a first application set corresponding to the first data packet; the server sending the information of the first target model to a first device; and, under a triggering condition, the server acquiring information of a second target model, the second target model being used to extract second feature information of a second data packet and determine a second application in a second application set corresponding to the second data packet, wherein the first application in the first application set is different from the second application in the second application set; and the server sending the information of the second target model to the first device.

[0017] The method provided in the second aspect above has two advantages. First, the server does not need to perform model training; instead, the model training process is delegated to the devices involved in the training (the first device and the second device). The server only needs to aggregate the information from the intermediate models of multiple devices, reducing the server's computational overhead. Second, when a new application is added after using the first target model, the first device does not need to train a model based on the labeled data packets of the first and second applications to obtain a model that can identify data packets of applications in both the first and second application sets. The first device trains the model based on the labeled data packets of the second application to obtain the second target model. Subsequently, it identifies data packets of applications in either the first or second application set based on the first and second target models. The number of labeled data packets of the second application is much smaller than the number of labeled data packets of the first and second applications, so the computational load on the first device is small, and the training time is short. Furthermore, in the method provided in the second aspect above, when a new application is added, the first device uses the labeled data packets of the second application for model training, thus releasing the labeled data packets of the first application and reducing data storage costs.

[0018] One possible implementation involves the server acquiring information about the second target model, including: the server sending information about a first initial model and a list of second applications contained in a second application set to a first device. The first initial model is determined based on the number of applications in the second application set, and the list of second applications indicates the correspondence between the second applications in the second application set and the output of the first initial model. The server receives information about a first intermediate model from the first device, which is obtained by the first device training the first initial model using data packets of labeled second applications obtained by the first device. The server then sends the information about the first initial model and the list of second applications to the second device. The server also receives information about a second intermediate model from the second device, which is obtained by the second device training the first initial model using data packets of labeled second applications obtained by the second device. The server aggregates the information about the first intermediate model and the information about the second intermediate model to obtain information about the second target model. Based on this method, the server can send information about the first initial model and the list of second applications to devices participating in model training, such as the first device, so that the first device can train the first initial model using data packets of labeled second applications, obtain the first intermediate model, and then send the information about the first intermediate model to the server. After receiving information from intermediate models from multiple devices, the server aggregates this information to obtain information about the second target model. This second target model information is then sent to the first device, allowing the first device to derive the second target model based on this information and the first initial model. On one hand, all devices participating in model training can obtain a model capable of recognizing data packets from applications in the second application set. On the other hand, in this method, the server does not need to perform model training; instead, the training process is delegated to the participating devices. Each device using a trained model uses fewer labeled data packets than the server uses, resulting in less computational load and saving training time.

[0019] One possible implementation involves the server acquiring information about the second target model, further including: the server receiving data packets from a second application on a first device; the server obtaining labeled data packets of the second application based on the data packets of the second application; and the server sending the labeled data packets of the second application to the first device. Based on this method, the server can receive data packets from the second application on the first device and label them, so that the first device can train the model based on the labeled data packets.

[0020] One possible implementation is that the trigger condition is that the number of applications in the second application set is greater than or equal to a first threshold; or, the trigger condition is that the number of data packets from the applications in the second application set is greater than or equal to a second threshold; or, the trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets from the applications in the second application set is greater than or equal to the second threshold. Based on the above methods, when the number of newly added applications reaches the first threshold, or when the number of unidentified data packets exceeds the second threshold, or when the number of newly added applications reaches the first threshold and the number of unidentified data packets exceeds the second threshold, the server can be triggered to obtain information about the second target model. This avoids the server frequently obtaining information about the second target model, thus preventing excessive computational overhead. It also avoids the server not obtaining information about the second target model for extended periods, which could lead to a large number of unidentified data packets and affect business operations.

[0021] One possible implementation further includes the following: if the accuracy rate of the first target model and the second target model in recognizing data packets is less than or equal to a third threshold, the server sends an instruction message to the first device, instructing the first device to retrain a fourth target model for recognizing data packets of the first application and data packets of the second application. Based on the above method, when the accuracy rate of the first target model and the second target model in recognizing data packets is less than or equal to the third threshold, the server can instruct the first device to retrain the model, so that the trained model can recognize data packets of the first application and data packets of the second application.

[0022] Thirdly, embodiments of this application provide a data packet identification device that can implement the method in the first aspect or any possible implementation of the first aspect. The device includes corresponding units or components for performing the above-described method. The units included in the device can be implemented in software and / or hardware. The device can be, for example, a first device, or a chip, chip system, or processor that supports the implementation of the above-described method in the first device.

[0023] Fourthly, embodiments of this application provide a data packet identification device that can implement the methods in the second aspect or any possible implementation of the second aspect described above. The device includes corresponding units or components for performing the above methods. The units included in the device can be implemented in software and / or hardware. The device can be, for example, a server, or a chip, chip system, or processor that supports the implementation of the above methods on a server.

[0024] Fifthly, embodiments of this application provide a data packet identification device, comprising: a processor coupled to a memory, the memory being used to store programs or instructions, wherein when the program or instructions are executed by the processor, the device enables the method described in the first aspect or any possible implementation thereof.

[0025] In a sixth aspect, embodiments of this application provide a data packet identification device, comprising: a processor coupled to a memory, the memory being used to store programs or instructions, wherein when the program or instructions are executed by the processor, the device enables the method described in the second aspect above, or any possible implementation thereof.

[0026] In a seventh aspect, embodiments of this application provide a data packet identification device, which is used to implement the method described in the first aspect or any possible implementation of the first aspect.

[0027] Eighthly, embodiments of this application provide a data packet identification device, which is used to implement the method described in the second aspect above, or any possible implementation of the second aspect.

[0028] Ninthly, embodiments of this application provide a computer-readable medium having a computer program or instructions stored thereon, which, when executed, cause a computer to perform the method described in the first aspect or any possible implementation thereof.

[0029] In a tenth aspect, embodiments of this application provide a computer-readable medium having a computer program or instructions stored thereon, which, when executed, cause a computer to perform the method described in the second aspect above, or any possible implementation thereof.

[0030] Eleventhly, embodiments of this application provide a computer program product, which includes computer program code. When the computer program code is run on a computer, it causes the computer to perform the method described in the first aspect or any possible implementation of the first aspect.

[0031] In a twelfth aspect, embodiments of this application provide a computer program product comprising computer program code, which, when executed on a computer, causes the computer to perform the methods described in the second aspect above, or any possible implementation thereof.

[0032] In a thirteenth aspect, embodiments of this application provide a chip, including: a processor coupled to a memory, the memory being used to store programs or instructions, wherein when the program or instructions are executed by the processor, the chip causes the chip to implement the method described in the first aspect above, or any possible implementation of the first aspect.

[0033] In a fourteenth aspect, embodiments of this application provide a chip, including: a processor coupled to a memory, the memory being used to store programs or instructions, wherein when the program or instructions are executed by the processor, the chip causes the chip to implement the method described in the second aspect above, or any possible implementation of the second aspect.

[0034] In a fifteenth aspect, embodiments of this application provide a data packet identification system. This system includes the apparatus described in the third aspect and / or the apparatus described in the fourth aspect, or the system includes the apparatus described in the fifth aspect and / or the apparatus described in the sixth aspect, or the system includes the apparatus described in the seventh aspect and / or the apparatus described in the eighth aspect.

[0035] It is understood that any of the data packet identification devices, chips, computer-readable media, computer program products, or data packet identification systems provided above are used to execute the corresponding methods provided above. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0036] In a sixteenth aspect, embodiments of this application provide a method for identifying data packets. The method includes: acquiring a first target model, the first target model being used to extract first feature information of a first data packet and determine a first application in a first application set corresponding to the first data packet; acquiring a second target model, the second target model being used to extract second feature information of a second data packet and determine a second application in a second application set corresponding to the second data packet, wherein the first application in the first application set is different from the second application in the second application set; and acquiring a third data packet and determining the first application or the second application corresponding to the third data packet based on the first target model and the second target model.

[0037] The method provided in the sixteenth aspect above, when a new application (i.e., an application in the second application set) appears after using the first target model, does not require the first device to train a model based on the labeled data packets of the first and second applications to obtain a model capable of recognizing data packets of applications in both the first and second application sets. Instead, the first device can train a model based on the labeled data packets of the second application to obtain a second target model. Subsequently, the first and second target models are used to recognize data packets of applications in either the first or second application set. Because the number of labeled data packets of the second application is much smaller than the number of labeled data packets of the first and second applications, the method provided in the sixteenth aspect has a lower computational load and shorter training time for the first device. Furthermore, in the case of a new application, the method provided in the sixteenth aspect uses the labeled data packets of the second application for model training, thus freeing up the labeled data packets of the first application and reducing data storage costs.

[0038] One possible implementation involves obtaining the second target model, including: obtaining a data packet of an annotated second application; obtaining a first initial model and a list of second applications contained in the second application set, wherein the first initial model is determined based on the number of applications in the second application set, and the list of second applications indicates the correspondence between the second applications in the second application set and the output of the first initial model; and training the first initial model based on the annotated data packet of the second application to obtain the second target model. Based on the above method, the first device can train the first initial model based on the annotated data packet of the second application to obtain the second target model, so that the first device can subsequently determine the application corresponding to the third data packet based on the first target model and the second target model.

[0039] One possible implementation is that the trigger condition is that the number of applications in the second application set is greater than or equal to a first threshold; or, the trigger condition is that the number of data packets from the applications in the second application set is greater than or equal to a second threshold; or, the trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets from the applications in the second application set is greater than or equal to the second threshold. Based on the above methods, when the number of newly added applications reaches the first threshold, or when the number of unidentified data packets exceeds the second threshold, or when the number of newly added applications reaches the first threshold and the number of unidentified data packets exceeds the second threshold, the first device can be triggered to acquire the second target model. This avoids the first device frequently acquiring the second target model, thus preventing excessive computational overhead. It also avoids the first device not acquiring the second target model for extended periods, which could lead to a large number of unidentified data packets and affect service usage.

[0040] One possible implementation involves determining the first or second application corresponding to the third data packet based on a first target model and a second target model. This includes: obtaining a first output entropy of the third data packet based on the first target model, where the first output entropy indicates the probability that the application corresponding to the third data packet is the application predicted by the first target model; obtaining a second output entropy of the third data packet based on the second target model, where the second output entropy indicates the probability that the application corresponding to the third data packet is the application predicted by the second target model; and determining the application predicted by the target model corresponding to the third data packet as the application corresponding to the third data packet, based on the lower value of the first and second output entropies. Based on this method, the first device can determine the application corresponding to the third data packet based on the first and second output entropies, thereby achieving application identification by combining the first and second target models. Thus, when a new application appears, the first device does not need to train a model based on the labeled data packets of the first and second applications to obtain a model that can identify data packets of applications in both the first and second application sets.

[0041] One possible implementation further includes: obtaining a second initial model, determined based on the number of applications in the first and second application sets; training the second initial model to obtain a third target model based on the annotation results of the data packets obtained by the first device using the first and second target models; the third target model is used to extract third feature information and determine the application corresponding to the data packet corresponding to the third feature information based on the third feature information; the third feature information includes feature information of the data packet corresponding to the third feature information, and the data packet corresponding to the third feature information is a data packet of an application in the first or second application set. Based on the above method, the first device can obtain the second initial model and train it to obtain the third target model based on the annotation results of the data packets obtained by the first device using the first and second target models. Subsequently, the first device can identify data packets based on the third target model, saving time for the first device to identify data packets. In addition, by continuously compressing the model, the first device can stabilize the model size, which is beneficial for the model's deployment on-chip systems.

[0042] One possible implementation further includes: training a third target model based on the labeled data packets used when acquiring the first target model, and / or the labeled data packets used when acquiring the second target model, to obtain a trained third target model. Based on the above method, the first device can train the third target model based on the labeled data packets used when acquiring the first target model, and / or the labeled data packets used when acquiring the second target model, resulting in a more accurate and precise third target model for data packet recognition.

[0043] One possible implementation further includes: if the accuracy of the first target model and the second target model in identifying data packets is less than or equal to a third threshold, retraining a fourth target model for identifying data packets of the first application and the second application. Based on the above method, when the accuracy of the first target model and the second target model in identifying data packets is less than or equal to the third threshold, the first device can retrain the model so that the trained model can identify data packets of applications in the first application set and applications in the second application set.

[0044] In a seventeenth aspect, embodiments of this application provide a data packet identification device, the device comprising: an acquisition module and a determination module; the acquisition module is configured to acquire a first target model, the first target model being used to extract first feature information of a first data packet and determine a first application in a first application set corresponding to the first data packet; the acquisition module is further configured to acquire a second target model when a triggering condition is met, the second target model being used to extract second feature information of a second data packet and determine a second application in a second application set corresponding to the second data packet, wherein the first application in the first application set is different from the second application in the second application set; the determination module is configured to acquire a third data packet and, based on the first target model and the second target model, determine the first application or the second application corresponding to the third data packet.

[0045] One possible implementation includes an acquisition module, specifically used to acquire data packets of the labeled second application; the acquisition module is also specifically used to acquire a list of second applications contained in the first initial model and the second application set, wherein the first initial model is determined based on the number of applications in the second application set, and the list of second applications is used to indicate the correspondence between the second applications in the second application set and the output of the first initial model; the acquisition module is also specifically used to train the first initial model based on the data packets of the labeled second application to obtain the second target model.

[0046] One possible implementation is that the triggering condition is that the number of applications in the second application set is greater than or equal to a first threshold; or, the triggering condition is that the number of data packets of the applications in the second application set is greater than or equal to a second threshold; or, the triggering condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets of the applications in the second application set is greater than or equal to the second threshold.

[0047] One possible implementation includes a determining module, specifically configured to obtain a first output entropy of the third data packet based on a first target model, the first output entropy indicating the probability that the application corresponding to the third data packet is the application predicted by the first target model; the determining module is also specifically configured to obtain a second output entropy of the third data packet based on a second target model, the second output entropy indicating the probability that the application corresponding to the third data packet is the application predicted by the second target model; the determining module is also specifically configured to determine the application predicted by the target model corresponding to the lower value of the first output entropy and the second output entropy as the application corresponding to the third data packet.

[0048] In one possible implementation, the device further includes: a training module; an acquisition module, further configured to acquire a second initial model, the second initial model being determined based on the number of applications in the first application set and the number of applications in the second application set; and a training module, configured to train the second initial model to obtain a third target model based on the annotation results of the data packets obtained by the first device using the first target model and the second target model, the third target model being used to extract third feature information and determine the application corresponding to the data packet corresponding to the third feature information based on the third feature information, the third feature information including feature information of the data packet corresponding to the third feature information, the data packet corresponding to the third feature information being a data packet of an application in the first application set or a data packet of an application in the second application set.

[0049] One possible implementation is that the training module is also used to train a third target model based on the labeled data packets used when acquiring the first target model, and / or the labeled data packets used when acquiring the second target model, to obtain the trained third target model.

[0050] One possible implementation is that the acquisition module is also used to retrain a fourth target model for recognizing data packets of the first application and data packets of the second application if the accuracy of the first target model and the second target model in recognizing data packets is less than or equal to a third threshold.

[0051] In an eighteenth aspect, embodiments of this application provide a data packet identification device, comprising: a processor coupled to a memory for storing programs or instructions, wherein when the programs or instructions are executed by the processor, the device implements the method described in the sixteenth aspect or any possible implementation thereof.

[0052] In a nineteenth aspect, embodiments of this application provide a data packet identification device for implementing the method described in the sixteenth aspect or any possible implementation of the sixteenth aspect.

[0053] In a twentieth aspect, embodiments of this application provide a computer-readable medium having a computer program or instructions stored thereon, which, when executed, cause a computer to perform the method described in the sixteenth aspect or any possible implementation thereof.

[0054] In a twentieth aspect, embodiments of this application provide a computer program product comprising computer program code, which, when executed on a computer, causes the computer to perform the methods described in the sixteenth aspect or any possible implementation thereof.

[0055] In a twentieth aspect, embodiments of this application provide a chip, comprising: a processor coupled to a memory, the memory being used to store programs or instructions, wherein when the program or instructions are executed by the processor, the chip causes the chip to implement the method described in the sixteenth aspect above, or any possible implementation thereof.

[0056] It is understood that any of the data packet identification devices, chips, computer-readable media, or computer program products provided above are used to execute the corresponding methods provided above. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here. Attached Figure Description

[0057] Figure 1 A schematic diagram of the data packet identification system architecture provided in the embodiments of this application;

[0058] Figure 2 This is a schematic diagram of the hardware structure of the identification device provided in the embodiments of this application;

[0059] Figure 3 A flowchart illustrating a data packet identification method provided in an embodiment of this application;

[0060] Figure 4A A schematic diagram of the first target model provided in an embodiment of this application;

[0061] Figure 4B A schematic diagram of the second target model provided in the embodiments of this application;

[0062] Figure 5 A flowchart illustrating another data packet identification method provided in this application embodiment;

[0063] Figure 6A A schematic diagram of the third initial model provided in the embodiments of this application;

[0064] Figure 6B A schematic diagram of the first initial model provided for an embodiment of this application;

[0065] Figure 7 A flowchart illustrating another data packet identification method provided in this application embodiment;

[0066] Figure 8 A flowchart illustrating another data packet identification method provided in this application embodiment;

[0067] Figure 9 A flowchart illustrating another data packet identification method provided in this application embodiment;

[0068] Figure 10A flowchart illustrating another data packet identification method provided in this application embodiment;

[0069] Figure 11 A flowchart illustrating another data packet identification method provided in this application embodiment;

[0070] Figure 12 A flowchart illustrating another data packet identification method provided in this application embodiment;

[0071] Figure 13 A flowchart illustrating another data packet identification method provided in this application embodiment;

[0072] Figure 14 A schematic diagram of the structure of a data packet identification device provided in an embodiment of this application;

[0073] Figure 15 A schematic diagram of the structure of another data packet identification device provided in an embodiment of this application;

[0074] Figure 16 A schematic diagram of the structure of another data packet identification device provided in an embodiment of this application;

[0075] Figure 17 This is a schematic diagram of the structure of a chip provided in an embodiment of this application;

[0076] Figure 18 This is a schematic diagram illustrating the composition of a data packet identification system provided in an embodiment of this application. Detailed Implementation

[0077] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0078] The method provided in this application can be applied to both federated and non-federated learning scenarios. Federated learning refers to a method of machine learning by collaborating different participants (also known as data owners or clients). In federated learning, participants do not need to expose their data to other participants, administrators, or coordinators (e.g., servers), thus effectively protecting user privacy and ensuring data security. Non-federated learning, on the other hand, does not require participants; devices in non-federated learning scenarios can perform machine learning based on the data they acquire. The following section uses a federated learning scenario as an example to introduce the data packet recognition system provided in this application.

[0079] like Figure 1 The diagram shown is a schematic representation of the architecture of the data packet identification system 10 provided in this embodiment of the application. Figure 1In this system, the data packet identification system 10 may include one or more servers 101 (only one is shown) and devices 102-104 that can communicate with the servers 101. Figure 1 This is merely an illustrative diagram and does not constitute a limitation on the applicable scenarios of the technical solutions provided in this application.

[0080] exist Figure 1 In this system, server 101 can function as a manager or coordinator. That is, server 101 can manage or coordinate one or more participants (e.g., device 102, device 103, or device 104). For example, server 101 can determine the device that needs model training (hereinafter referred to as the training device). Subsequently, server 101 can also send initial model information to each training device, which indicates the initial model that the training device needs to train. Server 101 can also receive intermediate model information from each training device, which indicates the intermediate model obtained by the training device based on the initial model. Subsequently, server 101 can also aggregate the received intermediate models to obtain target model information and send the target model information to each training device, so that each training device obtains the target model based on the target model information and identifies data packets based on the target model.

[0081] exist Figure 1 In this system, devices 102, 103, or 104 can function as participants. That is, devices 102, 103, or 104 can perform machine learning or model training. For example, devices 102, 103, or 104 can receive initial model information from server 101 and train an intermediate model based on the initial model. Subsequently, devices 102, 103, or 104 can send the intermediate model information to server 101, so that server 101 can aggregate the intermediate models obtained by devices 102, 103, and 104 to obtain the target model information. Devices 102, 103, or 104 can also receive target model information from server 101. Thus, devices 102, 103, or 104 can obtain the target model based on the target model information and identify data packets based on the target model.

[0082] Figure 1 Server 101 can be a device capable of providing services such as computing or applications to participants. For example, Figure 1 The server 101 in the text can be a network device, a network cloud engine (NCE), or a federated learning server (FLS), etc.

[0083] Figure 1 Device 102, device 103, or device 104 can be a device capable of receiving, sending, or generating data packets and performing machine learning. For example, device 102, device 103, or device 104 can be a network device, a terminal, an optical network terminal (ONT), or a federated learning client (FLC), etc.

[0084] The aforementioned network equipment can be any device with wireless transceiver capabilities. This includes, but is not limited to: evolved base stations (NodeB, eNB, or e-NodeB) in long term evolution (LTE) systems, base stations (gNodeB or gNB) or transmission receiving points / transmission reception points (TRPs) in new radio (NR) systems, base stations in subsequent 3GPP evolutions, access nodes, wireless relay nodes, and wireless backhaul nodes in WiFi systems.

[0085] The aforementioned terminal can be a device with wireless transceiver capabilities. For example, it can be a mobile phone, tablet computer, computer with wireless transceiver capabilities, virtual reality (VR) terminal, augmented reality (AR) terminal, terminal in industrial control, vehicle-mounted terminal, terminal in self-driving cars, terminal in assisted driving, etc. Terminals are sometimes also referred to as terminal equipment, user equipment (UE), access terminal, vehicle-mounted terminal, industrial control terminal, UE unit, UE station, mobile station, mobile station, remote station, remote terminal, mobile device, UE terminal equipment, wireless communication equipment, machine terminal, UE agent, or UE device, etc. Terminals can be fixed or mobile.

[0086] Figure 1 The data packet identification system 10 shown is for illustrative purposes only and is not intended to limit the technical solutions of this application. Those skilled in the art should understand that in specific implementations, the data packet identification system 10 may also include other devices, and the number of network devices and terminals may be determined according to specific needs without limitation.

[0087] Optionally, embodiments of this application Figure 1 Each device in the device, such as server 101, device 102, device 103, or device 104, can be a functional module within a device. It is understood that the functional module can be a component in a hardware device, such as a communication chip or communication component in a terminal or network device, or a software functional module running on hardware, or a virtualization function instantiated on a platform (e.g., a cloud platform).

[0088] For example, Figure 1 Each device in the system can be accessed via Figure 2 The identification device 200 in the middle is used to achieve this. Figure 2 The diagram shows a hardware structure of an identification device applicable to embodiments of this application. The identification device 200 includes at least one processor 201, a communication line 202, a memory 203, and at least one communication interface 204.

[0089] The processor 201 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the program of the present application.

[0090] Communication line 202 may include a path for transmitting information between the aforementioned components, such as a bus.

[0091] Communication interface 204 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet interface, radio access network (RAN) interface, wireless local area network (WLAN) interface, etc.

[0092] The memory 203 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor via communication line 202. The memory may also be integrated with the processor. The memory provided in this application embodiment is generally non-volatile. The memory 203 is used to store computer execution instructions involved in the scheme of this application and is controlled by the processor 201 for execution. The processor 201 is used to execute computer execution instructions stored in the memory 203, thereby implementing the method provided in the embodiments of this application.

[0093] Optionally, the computer execution instructions in the embodiments of this application may also be referred to as application code, and the embodiments of this application do not specifically limit this.

[0094] In a specific implementation, as one embodiment, the processor 201 may include one or more CPUs, for example... Figure 2 CPU0 and CPU1 in the CPU.

[0095] In a specific implementation, as one example, the identification device 200 may include multiple processors, such as... Figure 2 Processors 201 and 207 are described herein. Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. A processor here may refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0096] In a specific implementation, as one embodiment, the identification device 200 may further include an output device 205 and an input device 206. The output device 205 communicates with the processor 201 and can display information in various ways. For example, the output device 205 may be a liquid crystal display (LCD), a light-emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc. The input device 206 communicates with the processor 201 and can receive user input in various ways. For example, the input device 206 may be a mouse, keyboard, touchscreen device, or sensing device, etc.

[0097] The aforementioned identification device 200 can be a general-purpose device or a dedicated device. In specific implementations, the identification device 200 can be a desktop computer, laptop computer, network server, PDA (personal digital assistant), mobile phone, tablet computer, wireless terminal device, embedded device, or other similar device. Figure 2 Devices with similar structures. This application does not limit the type of identification device 200 to any particular embodiment.

[0098] The following combination Figure 1 and Figure 2 The data packet identification method provided in this application embodiment will be specifically described using both federated learning and non-federated learning scenarios as examples.

[0099] It should be noted that the message names between devices or the names of parameters in the messages in the embodiments of this application are just examples. In specific implementations, other names may also be used. This application does not specifically limit this.

[0100] It should be noted that in the embodiments of this application, " / " can indicate that the objects before and after are in an "or" relationship. For example, A / B can mean A or B. "And / or" can be used to describe three relationships between the associated objects. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. A and B can be singular or plural.

[0101] To facilitate the description of the technical solutions in the embodiments of this application, the terms "first" and "second" may be used to distinguish technical features with the same or similar functions. The terms "first" and "second" do not limit the number or execution order, nor are they necessarily different. In the embodiments of this application, the words "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design scheme described as "exemplary" or "for example" should not be construed as being more preferred or advantageous than other embodiments or design schemes. The use of "exemplary" or "for example" is intended to present related concepts in a concrete manner for ease of understanding.

[0102] It should be noted that, in the embodiments of this application, for a technical feature, the technical features in the technical feature are distinguished by "first", "second", "third", "fourth", "A", "B", "C" and "D", and there is no order of precedence or size among the technical features described by "first", "second", "third", "fourth", "A", "B", "C" and "D".

[0103] It is understood that the same step or a step or message with the same function in the embodiments of this application can be referenced and learned from each other in different embodiments.

[0104] It is understood that in the embodiments of this application, the server or the first device may execute some or all of the steps in the embodiments of this application. These steps are merely examples, and the embodiments of this application may also execute other steps or variations thereof. Furthermore, the steps may be executed in different orders as presented in the embodiments of this application, and it is not necessary to execute all the steps in the embodiments of this application.

[0105] In this application embodiment, the specific structure of the execution subject for data packet identification is not particularly limited, as long as communication can be performed according to the data packet identification method of this application embodiment by running a program that records the code of the data packet identification method of this application embodiment. For example, the execution subject of the data packet identification method provided in this application embodiment can be a server, or a component applied in the server, such as a chip, and this application does not limit this. Alternatively, the execution subject of the data packet identification method provided in this application embodiment can be a first device, or a component applied in the first device, such as a chip, and this application does not limit this. The following embodiments describe the data packet identification method using a server and a first device as examples.

[0106] First, taking a federated learning scenario as an example, we will introduce the data packet identification method provided in this application's embodiments. Specifically, please refer to the following... Figure 3 , Figure 5 , Figure 7-11 The method shown.

[0107] like Figure 3 The image shows a data packet identification method provided in an embodiment of this application, which is applied to a first device. The data packet identification method includes steps 301-303.

[0108] Step 301: The first device acquires the first target model.

[0109] The first device can be Figure 1 Devices 102, 103, or 104 in the dataset. The first device can be the device determined by the server that needs to perform model training. The server can be... Figure 1 Server 101 in the middle.

[0110] The first target model is used to extract first feature information from the first data packet and determine the first application in the first application set corresponding to the first data packet. The first application set includes at least one first application. The at least one first application includes applications that are installed on a server, a first device, or other devices.

[0111] The first feature information includes the feature information of the first data packet. For example, the first feature information includes keywords of the application to which the first data packet belongs. It should be understood that the first data packet is generated by the first application in the first application set.

[0112] For example, the first application set includes and Data packet 1 is The generated data packet, data packet 2 is Taking the generated data packets as an example, the first feature information corresponding to data packet 1 includes "Wechat", and the first feature information corresponding to data packet 2 includes "Alipay".

[0113] Understandably, each data packet generated by the first application corresponds to a first characteristic information. The first characteristic information corresponding to data packets from the same application can be the same or different. Here, the application's data packet can be understood as the data packet generated by the application.

[0114] One possible implementation is that the first target model includes a first target feature extractor and a first target classifier. The first target feature extractor is used to extract first feature information from the first data packet, for example, first feature information. The first target classifier is used to determine the first application in the first application set corresponding to the first data packet.

[0115] For example, the first target model can be as follows: Figure 4A As shown. Figure 4AIn this model, the first target model 401 includes a first target feature extractor 402 and a first target classifier 403. The input of the first target feature extractor 402 is the input of the first target model 401, and the output of the first target feature extractor 402 is the input of the first target classifier 403. The output of the first target classifier 403 is the output of the first target model 401. The first target classifier 403 has n output ports, each corresponding to a first application in a first application set. n is the number of applications in the first application set. It can be understood that among the n output ports, the application corresponding to the port with the highest output value can be determined as the application corresponding to the data packet input to the first target model 401.

[0116] For example, the first application set includes and Data packet 1 is The generated data packet, data packet 2 is Taking the generated data packet as an example, if the first target model is as follows: Figure 4A As shown, the value of n is 2. Assume port 1 corresponds to... Port 2 corresponds to Data packet 1 passes through the first target feature extractor 402 to obtain "Wechat". Inputting "Wechat" into the first target classifier 403, we find that the output value of port 1 is greater than the output value of port 2, meaning the application corresponding to data packet 1 is... Similarly, data packet 2, after passing through the first target feature extractor 402 to obtain Alipay, and inputting Alipay into the first target classifier 403, shows that the output value of port 2 is greater than the output value of port 1, meaning that the application corresponding to data packet 2 is...

[0117] One possible implementation involves the first device acquiring a first target model, including: the first device receiving information about a third initial model from a server and a list of first applications contained in a first application set; the first device training the third initial model based on data packets of the labeled first applications obtained by the first device, to obtain a third intermediate model; the first device sending information about the third intermediate model to the server; the first device receiving information about a first target model from the server; and the first device obtaining the first target model based on the information about the first model and the third initial model. The specific process of the first device acquiring the first target model will be described below. Figure 5 The method shown will be explained in detail.

[0118] One possible implementation is that, during server initialization (e.g., the first time the server is powered on, or the server is restored to factory settings), the first device acquires the first target model.

[0119] Step 302: If the triggering conditions are met, the first device acquires the second target model.

[0120] One possible implementation is that the trigger condition is that the number of applications in the second application set is greater than or equal to a first threshold; or, the trigger condition is that the number of data packets of the applications in the second application set is greater than or equal to a second threshold; or, the trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets of the applications in the second application set is greater than or equal to the second threshold. Wherein, the first threshold and the second threshold are positive integers.

[0121] The second set of applications includes at least one second application. This at least one second application includes applications installed on a server, the first device, or other devices after the first device acquires the first target model.

[0122] For example, taking the trigger condition that the number of applications in the second application set is greater than or equal to a first threshold, where the first threshold is 5, if the number of applications in the second application set is 6, then the first device acquires the second target model. If the number of applications in the second application set is 3, then the first device does not acquire the second target model.

[0123] For example, taking the trigger condition that the number of data packets of applications in the second application set is greater than or equal to a second threshold, where the second threshold is 30, if the second application set includes two applications, and the number of data packets of the first application and the second application are both 20, then the first device acquires the second target model. If the number of data packets of the first application is 5 and the number of data packets of the second application is 10, then the first device does not acquire the second target model.

[0124] For example, taking the triggering conditions as the number of applications in the second application set being greater than or equal to a first threshold, and the number of data packets in the second application set being greater than or equal to a second threshold, where the first threshold is 3 and the second threshold is 50, if the second application set includes two applications, and the number of data packets for both the first and second applications is 30, then the first device does not acquire the second target model. If the second application set includes four applications, and the number of data packets for both the first and second applications is 10, and the number of data packets for both the third and fourth applications is 5, then the first device does not acquire the second target model. If the second application set includes three applications, and the number of data packets for the first, second, and third applications is 25, then the first device acquires the second target model.

[0125] Understandably, when the triggering conditions are met, the server sends information to the first device instructing it to acquire the second target model. The first device receives this information and acquires the second target model. Alternatively, when the triggering conditions are met, the server sends information about a first initial model and a list of second applications contained in a second application set to the first device. The first device receives this information and the list of second applications and acquires the second target model. The descriptions of the first initial model information and the list of second applications can be found below. Figure 7 As described in the method shown. That is, when the triggering condition is met, the server will send the aforementioned instruction information, or information about the first initial model and a list of the second application, to the first device. After receiving the aforementioned information, the first device will obtain the second target model.

[0126] Understandably, the triggering conditions mentioned above can be set by the administrator or by the server as needed. In one scenario, the server monitors that the triggering conditions are met and can instruct the first device to acquire the second target model. In another scenario, if the administrator determines that the first device must acquire the second target model, the server can instruct the first device to do so. It should be understood that during the operation of the first device, the administrator or the server can reset the triggering conditions as needed.

[0127] The second target model is used to extract the second feature information of the second data packet and determine the second application in the second application set corresponding to the second data packet. The second feature information includes the feature information of the second data packet. For example, the second feature information includes keywords of the application to which the second data packet belongs. It should be understood that the second data packet is generated by the second application in the second application set.

[0128] For example, the second application set includes and Data packet 1 is The generated data packet, data packet 2 is Taking the generated data packets as an example, the second feature information corresponding to data packet 1 includes iQIYI, and the second feature information corresponding to data packet 2 includes Tencent.

[0129] Understandably, each data packet generated by the second application corresponds to a second feature information. The second feature information corresponding to data packets from the same application can be the same or different.

[0130] One possible implementation involves a second target model comprising a second target feature extractor and a second target classifier. The second target feature extractor is identical to the first target feature extractor and can be used to extract feature information from data packets; for example, it can be used to extract second feature information from second data packets. The second target classifier is used to determine the second application within the second application set corresponding to the second data packet.

[0131] For example, the second target model can be as follows: Figure 4B As shown. Figure 4B In this model, the second target model 404 includes a second target feature extractor 405 and a second target classifier 406. The input of the second target feature extractor 405 is the input of the second target model 404, and the output of the second target feature extractor 405 is the input of the second target classifier 406. The output of the second target classifier 406 is the output of the second target model 404. The second target classifier 406 has m output ports, each corresponding to an application in the second application set. m is the number of applications in the second application set. It can be understood that among the m output ports, the application corresponding to the port with the highest output value can be determined as the application corresponding to the data packet input to the second target model 404.

[0132] For example, the second application set includes and Data packet 1 is The generated data packet, data packet 2 is Taking the generated data packet as an example, if the second target model is as follows: Figure 4B As shown, the value of m is 2. Assume port 1 corresponds to... Port 2 corresponds to Data packet 1 passes through the second target feature extractor 405 to obtain iQIYI. Inputting iQIYI into the second target classifier 406, we can see that the output value of port 1 is greater than the output value of port 2, meaning the application corresponding to data packet 1 is... Similarly, data packet 2, after passing through the second target feature extractor 405 to obtain Tencent, is input into the second target classifier 406. This shows that the output value of port 2 is greater than the output value of port 1, indicating that the application corresponding to data packet 2 is...

[0133] One possible implementation involves the first device acquiring the second target model, including: the first device receiving information about a first initial model from a server and a list of second applications contained in a second application set; the first device training the first initial model based on data packets of the labeled second applications obtained by the first device to obtain a first intermediate model; the first device sending information about the first intermediate model to the server; the first device receiving information about the second target model from the server; and the first device obtaining the second target model based on the information about the second target model and the first initial model. The specific process of the first device acquiring the second target model will be described below. Figure 7 The method shown will be explained in detail.

[0134] Understandably, the first device will acquire the second target model each time the trigger condition is met. That is, the first device can acquire the second target model multiple times, either before or after step 303. The difference lies in the applications in the second application set corresponding to each acquired second target model. The second application set includes applications installed on the server, the first device, or other devices after the first device last acquired the target model.

[0135] For example, taking the case where the first device acquires the second target model three times after step 301, the second application set corresponding to the first acquired second target model includes applications installed on the server, the first device, or other devices after the first device acquires the first target model. The second application set corresponding to the second acquired second target model includes applications installed on the server, the first device, or other devices after the first device acquires the second target model for the first time. The second application set corresponding to the second acquired second target model for the third time includes applications installed on the server, the first device, or other devices after the first device acquires the second target model for the second time.

[0136] Step 303: The first device acquires the third data packet and determines the first application or the second application corresponding to the third data packet based on the first target model and the second target model.

[0137] One possible implementation involves the first device determining the first or second application corresponding to the third data packet based on a first target model and a second target model. This includes: the first device obtaining a first output entropy of the third data packet based on the first target model; the first device obtaining a second output entropy of the third data packet based on the second target model; and the first device determining the application predicted by the target model corresponding to the third data packet as the application corresponding to the first data packet, based on the lower output entropy value between the first and second output entropies. In this way, the first device can identify data packets generated by the first application or data packets generated by the second application based on the first and second target models.

[0138] The first output entropy indicates the probability that the application corresponding to the third data packet is the application predicted by the first target model. A larger first output entropy value indicates a lower probability that the application corresponding to the third data packet is the application predicted by the first target model; conversely, a smaller first output entropy value indicates a higher probability that the application corresponding to the third data packet is the application predicted by the first target model. The second output entropy indicates the probability that the application corresponding to the third data packet is the application predicted by the second target model. A larger second output entropy value indicates a lower probability that the application corresponding to the third data packet is the application predicted by the second target model; conversely, a smaller second output entropy value indicates a higher probability that the application corresponding to the third data packet is the application predicted by the second target model.

[0139] Furthermore, the first output entropy satisfies the following formula: Where H1(p1) is the first output entropy. n is the number of output ports of the first target classifier. p1(i) is the probability that the application corresponding to the data packet input to the first target model is the application corresponding to the i-th port.

[0140] Similarly, the second output entropy satisfies the following formula: Where H2(p2) is the second output entropy. m is the number of output ports of the second target classifier. p2(i) is the probability that the application corresponding to the data packet input to the second target model is the application corresponding to the i-th port.

[0141] For example, taking the application corresponding to data packet 1 predicted by the first target model as an example. The application corresponding to the second target model prediction data packet 1 is... For example, if the value of the first output entropy is 20 and the value of the second output entropy is 85, then the first device determines that the application corresponding to the third data packet is... If the value of the first output entropy is 90 and the value of the second output entropy is 15, then the first device determines that the application corresponding to the third data packet is...

[0142] Understandably, if the first device acquires the second target model multiple times, the first device determines the first application or the second application corresponding to the third data packet based on the first target model and the multiple acquired second target models.

[0143] Furthermore, the first device determines the first application or the second application corresponding to the third data packet based on the first target model and the second target model obtained multiple times, including: the first device obtains the first output entropy of the third data packet based on the first target model; the first device obtains the second output entropy of the third data packet corresponding to each second target model obtained multiple times; the first device determines the application predicted by the target model corresponding to the third data packet as the application of the target model with the lower value among the first output entropy and the obtained second output entropy.

[0144] One possible implementation is that if the first device receives an instruction from the server, it retrains a fourth target model for identifying data packets of the first application and data packets of the second application. The instruction instructs the first device to retrain the fourth target model for identifying data packets of the first and second applications. The fourth target model is trained based on labeled data packets of the first and second applications. The process of the first device retraining the fourth target model for identifying data packets of the first and second applications can refer to the process of the first device obtaining the first target model in step 301 above. That is, after receiving the instruction, the first device can re-execute steps 301-303 above. The fourth target model is trained based on labeled data packets of the first and second applications, while the first device identifies data packets based on the first and second target models by inferring the result from the output entropy. Therefore, the accuracy of the fourth target model in identifying data packets is greater than the accuracy of the first device in identifying data packets based on the first and second target models.

[0145] Understandably, the aforementioned instruction information may be sent by the server triggered by the administrator, or it may be sent by the server to the first device when it detects that the accuracy of the application corresponding to the third data packet determined by the first device is less than or equal to the third threshold.

[0146] based on Figure 3 The method shown, when a new application (i.e., an application from the second application set) appears after using the first target model, does not require the first device to train a model based on the labeled data packets of applications from both the first and second application sets to obtain a model capable of recognizing data packets from both sets. Instead, the first device can train a model based on the labeled data packets of the second application to obtain a second target model. Subsequently, the first and second target models are used to recognize data packets from either the first or second application set. Because the number of labeled data packets from the second application is much smaller than the number of labeled data packets from the first and second applications, Figure 3 In the method shown, the first device has low computational cost and short training time. Furthermore, in Figure 3 In the method shown, when a new application is added, the first device uses the data packets of the labeled second application for model training, thus releasing the data packets of the labeled first application and reducing the cost of data storage.

[0147] exist Figure 3In one possible implementation of the method shown, such as Figure 5 As shown, step 301 may include steps 3011-3015.

[0148] Step 3011: The first device receives information about the third initial model and a list of the first applications from the server.

[0149] The information in the third initial model is used to indicate the third initial model. The third initial model is determined based on the number of applications in the first application set. In other words, the third initial model is an initialized model obtained based on the number of applications in the first application set. For example, the third initial model includes a third initial feature extractor and a third initial classifier. The third initial feature extractor, after training, can be updated to the first target feature extractor, and the third initial classifier, after model training, can be updated to the first target classifier.

[0150] For example, the third initial model can be as follows: Figure 6A As shown. Figure 6A In this model, the third initial model 601 includes a third initial feature extractor 602 and a third initial classifier 603. The input of the third initial feature extractor 602 is the input of the third initial model 601, and the output of the third initial feature extractor 602 is the input of the third initial classifier 603. The output of the third initial classifier 603 is the output of the third initial model 601. The third initial classifier 603 has n output ports, each corresponding to an application in the first application set. n is the number of applications in the first application set.

[0151] One possible implementation is that the information of the third initial model includes structural information and parameter information. The structural information indicates the structure of the third initial model; for example, it indicates that the third initial model includes a third initial feature extractor and a third initial classifier. The parameter information indicates the parameters of the third initial model; for example, it indicates the parameters of the third initial feature extractor and the third initial classifier. The parameters of the third initial feature extractor and the third initial classifier can be described in reference to the explanations of feature extractor and classifier parameters in conventional techniques, and will not be repeated here.

[0152] One possible implementation is that the list of first applications is used to indicate the correspondence between the first applications in the first application set and the output of the third initial model.

[0153] For example, with Figure 6ATaking the third initial model as an example, the correspondence between the first application in the first application set and the output of the third initial model can be shown in Table 1. In Table 1, the port corresponding to application 1 is port 1, the port corresponding to application 2 is port 2, ..., the port corresponding to application n-1 is port n-1, and the port corresponding to application n is port n.

[0154] Table 1

[0155] The first application in the first application set The output of the third initial model Application 1 Port 1 Application 2 Port 2 … … Application n-1 Port n-1 Application n port n

[0156] Step 3012: The first device trains the third initial model based on the labeled data packets of the first application obtained by the first device, and obtains the third intermediate model.

[0157] The data packets of the first application that have been labeled obtained by the first device can be labeled manually or by machine.

[0158] Taking manual annotation as an example, the data packet can be annotated by the administrator of the first device or by the administrator of the server. If the data packet is annotated by the server's administrator, the first device can obtain the data packet of the first application, send the data packet of the first application to the server, and receive the annotated data packet of the first application from the server. The data packet of the first application can be received by the first device or generated by the application on the first device.

[0159] Taking machine annotation as an example, the data packet can be annotated by the first device or by the server. If the data packet is annotated by the server, the first device can obtain the data packet of the first application, send the data packet of the first application to the server, and receive the annotated data packet of the first application from the server.

[0160] One possible implementation involves the first device updating the third initial model using backpropagation based on the labeled data packets of the first application obtained by the first device, thus obtaining a third intermediate model. Furthermore, the loss function used by the first device in updating the third initial model using backpropagation satisfies the following formula:

[0161] Where L represents the loss function, which can be used to calculate the gradient of the parameters of the third initial model. N is the number of labeled data packets of the first application obtained by the first device. M is the number of applications in the first application set. ic As an indicator variable, y represents the case where the true class of the i-th data packet is class c. ic =1, otherwise y ic =0. p ic Let be the predicted probability that the i-th data packet belongs to category c.

[0162] The specific process by which the first device updates the third initial model using backpropagation to obtain the third intermediate model can be found in the explanations in conventional techniques and will not be elaborated here.

[0163] Step 3013: The first device sends information about the third intermediate model to the server.

[0164] The information of the third intermediate model includes its parameters. For example, the parameters of the third intermediate model include the gradients of the parameters of the third initial model.

[0165] Step 3014: The first device receives information about the first target model from the server.

[0166] The information of the first target model is obtained by aggregating information from intermediate models from multiple first devices. This information indicates the parameters of the first target model. For example, the parameters of the first target model include the gradients of the updated parameters of the third initial model.

[0167] Step 3015: The first device obtains the first target model based on the information of the first target model and the third initial model.

[0168] One possible implementation involves the first device obtaining the first target model based on information from the first target model and the third initial model, including: the first device obtaining parameters of the first target model based on parameters of the third initial model and information from the first target model; and the first device replacing the parameters of the third initial model with the parameters of the first target model to obtain the first target model.

[0169] It should be noted that steps 3011-3015 above are described using the example of obtaining the first target model by performing a single model training operation on the first device. In practical applications, the first device may perform multiple model training operations to obtain the first target model. That is, in step 3015, the model obtained by the first device based on the information of the first target model and the third initial model may be an incomplete first target model, meaning the model obtained by the first device may not converge. Subsequently, the first device can train the aforementioned incomplete first target model based on the labeled first application data package obtained by the first device, send the gradient obtained from the training to the server, receive the aggregated gradient from the server, and obtain a model based on the aggregated gradient and the aforementioned incomplete first target model. If the model converges, then the model is the first target model; if the model does not converge, the above process is repeated until the model obtained by the first device converges.

[0170] based on Figure 5The method shown allows devices participating in model training, such as the first device, to receive information about a third initial model and a list of first applications from a server. The third initial model is trained based on the labeled data packets of the first applications to obtain a third intermediate model. This intermediate model is then sent to the server, allowing the server to aggregate information from the intermediate models of multiple first devices to obtain information about the first target model. Subsequently, the first device can receive information about the first target model from the server and, based on this information and the third initial model, obtain the first target model. In this way, all devices participating in model training can obtain a model that can ultimately recognize data packets from the first application. Furthermore, Figure 5 In the method shown, the server does not need to perform model training. Instead, the model training process is delegated to the devices participating in the model training. The number of labeled data packets used by each device when training the model is also less than the number of labeled data packets used by the server when training the model. For these devices, the computational load is not large, and model training time can be saved.

[0171] exist Figure 3 In one possible implementation of the method shown, such as Figure 7 As shown, step 302 may include steps 3021-3025.

[0172] Step 3021: The first device receives information about the first initial model and a list of the second applications from the server.

[0173] The information in the first initial model is used to indicate the first initial model. The first initial model is determined based on the number of applications in the second application set. In other words, the first initial model is an initialized model obtained based on the number of applications in the second application set. For example, the first initial model includes a second target feature extractor and a first initial classifier. The second target feature extractor is a feature extractor that reuses the first target feature extractor in the first initial model; subsequently, the first device does not need to train the feature extractor. The first initial classifier can be updated to the second target classifier after model training.

[0174] Understandably, the first initial model may not reuse the first target feature extractor. In this case, the first initial model includes a first initial feature extractor and a first initial classifier. The first initial feature extractor is the initialized feature extractor acquired by the first device.

[0175] For example, the first initial model can be as follows: Figure 6B As shown. Figure 6BIn this model, the first initial model 604 includes a second target feature extractor 605 and a first initial classifier 606. The input of the second target feature extractor 605 is the input of the first initial model 604, and the output of the second target feature extractor 605 is the input of the first initial classifier 606. The output of the first initial classifier 606 is the output of the first initial model 604. The first initial classifier 606 has m output ports, each corresponding to an application in the second application set. m is the number of applications in the second application set.

[0176] One possible implementation is that the information of the first initial model includes structural information and parameter information. The structural information indicates the structure of the first initial model; for example, it indicates that the first initial model includes a second target feature extractor and a first initial classifier. The parameter information indicates the parameters of the first initial model, such as the parameters of the second target feature extractor and the first initial classifier. The parameters of the second target feature extractor and the first initial classifier can be described in reference to the explanations of feature extractor and classifier parameters in conventional techniques, and will not be repeated here.

[0177] One possible implementation is that the list of second applications is used to indicate the correspondence between the second applications in the second application set and the output of the first initial model.

[0178] For example, with Figure 6B Taking the first initial model as an example, the correspondence between the second application in the second application set and the output of the first initial model can be shown in Table 2. In Table 2, the port corresponding to application 1 is port 1, the port corresponding to application 2 is port 2, ..., the port corresponding to application m-1 is port m-1, and the port corresponding to application m is port m.

[0179] Table 2

[0180] The second application in the second application set Output of the first initial model Application 1 Port 1 Application 2 Port 2 … … Application m-1 Port m-1 Application m port m

[0181] Step 3022: The first device trains the first initial model based on the labeled data packet of the second application obtained by the first device, and obtains the first intermediate model.

[0182] The data packets of the second application that have been labeled obtained by the first device can be labeled manually or by machine.

[0183] Taking manual annotation as an example, the data packet can be annotated by the administrator of the first device or by the administrator of the server. If the data packet is annotated by the server's administrator, the first device can obtain the data packet of the second application, send the data packet of the second application to the server, and receive the annotated data packet of the second application from the server. The data packet of the second application can be received by the first device or generated by an application on the first device.

[0184] Taking machine annotation as an example, the data packet can be annotated by the first device or by the server. If the data packet is annotated by the server, the first device can obtain the data packet of the second application, send the data packet of the second application to the server, and receive the annotated data packet of the second application from the server.

[0185] One possible implementation involves the first device updating the first initial model using backpropagation based on the labeled data packets of the second application obtained by the first device, thus obtaining a first intermediate model. Furthermore, the loss function used by the first device in updating the first initial model using backpropagation satisfies the following formula:

[0186] Where L represents the loss function, which can be used to calculate the parameters of the first initial classifier. N is the number of labeled data packets of the second application obtained by the first device. M is the number of applications in the second application set. ic As an indicator variable, y represents the case where the true class of the i-th data packet is class c. ic =1, otherwise y ic =0. p ic Let be the predicted probability that the i-th data packet belongs to category c.

[0187] The specific process by which the first device updates the first initial model using the backpropagation method to obtain the first intermediate model can be found in the explanations in conventional techniques and will not be elaborated here.

[0188] Step 3023: The first device sends the information of the first intermediate model to the server.

[0189] The information of the first intermediate model includes the parameters of the first intermediate model. For example, the parameters of the first intermediate model include the gradients of the parameters of the first initial classifier.

[0190] Step 3024: The first device receives information about the second target model from the server.

[0191] The information of the second target model is obtained by aggregating information from intermediate models from multiple first devices. This information indicates the parameters of the second target model. For example, the parameters of the second target model include the gradients of the updated parameters of the first initial classifier.

[0192] Step 3025: The first device obtains the second target model based on the information of the second target model and the first initial model.

[0193] One possible implementation involves the first device obtaining the second target model based on information from the second target model and the first initial model, including: the first device obtaining the parameters of the second target classifier based on the parameters of the first initial classifier and the information from the second target model; and the first device replacing the parameters of the first initial classifier in the first initial model with the parameters of the second target classifier to obtain the second target model.

[0194] It should be noted that steps 3021-3025 above are described using the example of obtaining the second target model after the first device performs model training once. In practical applications, the first device may perform model training multiple times to obtain the second target model. That is, in step 3025, the model obtained by the first device based on the information of the second target model and the first initial model may be an incomplete second target model, meaning the model obtained by the first device may not converge. Subsequently, the first device can train the aforementioned incomplete second target model based on the labeled data package of the second application obtained by the first device, send the gradient obtained from the training to the server, receive the aggregated gradient from the server, and obtain a model based on the aggregated gradient and the aforementioned incomplete second target model. If the model converges, then the model is the second target model; if the model does not converge, the above process is repeated until the model obtained by the first device converges.

[0195] based on Figure 7 The method shown allows devices participating in model training, such as a first device, to receive information about a first initial model and a list of second applications from a server. The first initial model is trained based on labeled data packets from the second applications to obtain a first intermediate model. The device then sends the information of the first intermediate model to the server, allowing the server to aggregate the information from the intermediate models of multiple first devices to obtain information about a second target model. Subsequently, the first device can receive information about a second target model from the server and, based on this information and the first initial model, obtain a second target model. On one hand, all devices participating in model training can obtain a model capable of recognizing data packets from the second application. On the other hand, the first initial model reuses the first target feature extractor, thus eliminating the need to train the feature extractor during model training and reducing computational overhead. Furthermore, Figure 7In the method shown, the server does not need to perform model training. Instead, the model training process is delegated to the devices participating in the model training. The number of labeled data packets used by each device when training the model is also less than the number of labeled data packets used by the server when training the model. For these devices, the computational load is not large, and model training time can be saved.

[0196] Understandably, when the first device acquires multiple second target models, identifying the third data packet requires obtaining the output entropy of each target model (both the first and multiple second target models). Then, based on these multiple output entropies, the device determines the application corresponding to the third data packet. Therefore, the time required for the first device to identify the third data packet may be lengthy, impacting user experience. In this case, the first device can compress the first target model and multiple target models into a single target model. Subsequently, identifying the third data packet using the compressed target model can save the first device time. For details, please refer to... Figure 8 The method shown.

[0197] like Figure 8 As shown, in Figure 3 In one possible implementation of the method shown, Figure 3 The method shown also includes steps 801 and 802.

[0198] Step 801: The first device acquires the second initial model.

[0199] The second initial model is determined based on the number of applications in the first application set and the number of applications in the second application set. In other words, the second initial model is an initialized model obtained based on the number of applications in the first and second application sets. For example, the second initial model includes a second initial feature extractor and a second initial classifier. The second initial feature extractor is a feature extractor that reuses the first target feature extractor in the second initial model; subsequently, the first device does not need to train the feature extractor. The second initial classifier is an initialized classifier obtained by the first device.

[0200] Understandably, the second initial model may not reuse the first target feature extractor. In this case, the feature extractor included in the second initial model is the initialized feature extractor acquired by the first device.

[0201] One possible implementation is that the input to the second initial model is the input to the second initial feature extractor, the output of the second initial feature extractor is the input to the second initial classifier, and the output of the second initial classifier is the output of the second initial model. The second initial classifier has q output ports, each corresponding to an application in either the first application set or the second application set. q is the sum of the number of applications in the first application set and the number of applications in the second application set.

[0202] One possible implementation is that the first device creates a second initial model based on the number of applications in the first application set and the number of applications in the second application set.

[0203] Another possible implementation is that the first device sends first information to the server and receives information about the second initial model from the server.

[0204] The first information indicates the number of applications in the first application set and the number of applications in the second application set. The second initial model information indicates the second initial model. For example, the second initial model information includes structural information and parameter information. Specifically, the structural information of the second initial model indicates that it includes a second initial feature extractor and a second initial classifier. The parameter information of the second initial model indicates the parameters of the second initial model, such as the parameters of the second initial feature extractor and the second initial classifier. The parameters of the second initial feature extractor and the second initial classifier can be explained in conventional techniques and will not be elaborated upon here.

[0205] One possible implementation is that after the first device acquires the second target model R times, it executes step 801. Here, R is an integer greater than 0.

[0206] Step 802: The first device trains a second initial model to obtain a third target model based on the annotation results of the data packets obtained by the first target model and the second target model.

[0207] The annotation results of the first target model and the second target model on the data packets obtained by the first device can be the recognition results of the first device on the data packets based on the first target model and the second target model after the first device has acquired them. In other words, in the process of obtaining the third target model, the first device can use the recognition results obtained by the first device in recognizing data packets using the first target model and the second target model to train the second initial model. In this way, the first device does not need to store the annotated data packets used when acquiring the first target model and the second target model, saving storage overhead.

[0208] The third target model is used to extract third feature information and determine the application corresponding to the data packet based on the third feature information. The third feature information includes the feature information of the data packet corresponding to the third feature information. For example, the third feature information includes keywords of the application to which the data packet corresponding to the third feature information belongs. It should be understood that the data packet corresponding to the third feature information is a data packet of an application in the first application set or a data packet of an application in the second application set.

[0209] One possible implementation involves a third target model comprising a second initial feature extractor and a third target classifier. The second initial feature extractor extracts feature information from the data packet, such as third feature information. The third target classifier determines the application corresponding to the data packet with the third feature information. The third target classifier is obtained by training the second initial classifier on the first device.

[0210] It should be noted that the specific process by which the first device trains the second initial model to obtain the third target model based on the annotation results of the data packets obtained by the first device according to the first target model and the second target model can be referred to in step 3022 above, in which the first device trains the first initial model based on the annotated data packets of the second application obtained by the first device to obtain the first intermediate model, which will not be repeated here.

[0211] One possible implementation is that, after step 802, the first device identifies the data packets of the first application or the data packets of the second application based on the third target model.

[0212] One possible implementation is that, after step 802, the first device trains a third target model based on the labeled data packets used when acquiring the first target model, and / or the labeled data packets used when acquiring the second target model, to obtain the trained third target model. The specific process of the first device training the third target model based on the labeled data packets used when acquiring the first target model, and / or the labeled data packets used when acquiring the second target model, to obtain the trained third target model, can be referred to in step 3022 above, where the first device trains a first initial model based on the labeled data packets of the second application obtained by the first device to obtain a first intermediate model, and will not be elaborated further.

[0213] It is understandable that the annotation results of the first target model and the second target model on the data packets obtained by the first device may be incorrect. Therefore, the first device can train the third target model based on the labeled data packets used when obtaining the first target model and / or the labeled data packets used when obtaining the second target model. This can improve the accuracy of the model, making the trained third target model more accurate and more accurate in recognizing data packets.

[0214] based on Figure 8The method shown allows the first device to acquire a second initial model after obtaining multiple second target models. Based on the annotation results of the data packets obtained by the first device using the first and second target models, the second initial model is trained to obtain a third target model. Subsequently, the first device can identify data packets based on the third target model, saving time in data packet identification. Furthermore, by continuously compressing the model, the first device can stabilize the model size, which is beneficial for on-chip system deployment.

[0215] The above Figure 3 , Figure 5 , Figure 7 and Figure 8 The data packet identification method shown is applied to the first device. Another data packet identification method provided in this application embodiment is described below, which is applied to a server.

[0216] like Figure 9 The image shows another data packet identification method provided in this application embodiment, which is applied to a server. The method includes steps 901-904.

[0217] Step 901: The server obtains information about the first target model.

[0218] Among them, the server can be Figure 1 Server 101 in the middle. The information about the first target model can be referred to in step 3014 above, and the information about the first target model can be referred to in step 301 above.

[0219] One possible implementation is that the server obtains information about the first target model during initialization (e.g., the first time the server is powered on, or the server is restored to factory settings).

[0220] One possible implementation involves the server acquiring information about the first target model, including steps A through E. These steps are described using the example where the server determines the devices required for model training to be the first and second devices. If the number of devices determined by the server to be required for model training is greater than or equal to three, the server's acquisition of the first target model can be referenced from the case where the server determines the devices required for model training to be the first and second devices, and will not be elaborated further.

[0221] The first device and the second device can be Figure 1 The devices in the system. For example, if the first device is... Figure 1 If device 102 is used, then the second device can be... Figure 1 Device 103 or device 104 in the middle. If the first device is... Figure 1 If device 103 is used, then the second device can be... Figure 1Device 102 or device 104 in the middle. If the first device is... Figure 1 If device 104 is in the middle, then the second device can be... Figure 1 Device 102 or device 103 in the middle.

[0222] Step A: The server sends information about the third initial model and a list of the first applications contained in the first application set to the first device.

[0223] The information on the third initial model and the list of the first applications can be found in step 3011 above.

[0224] Step B: The server receives information from the third intermediate model of the first device.

[0225] The information about the third intermediate model can be found in the description in step 3013 above.

[0226] Step C: The server sends information about the third initial model and a list of the first applications included in the first application set to the second device.

[0227] Step D: The service receives information from the fourth intermediate model from the second device.

[0228] The information about the fourth intermediate model can be found by referring to the description of the information about the third intermediate model mentioned above.

[0229] Step E: The server aggregates the information from the third intermediate model and the fourth intermediate model to obtain the information from the first target model.

[0230] One possible implementation is that the server performs a weighted sum of the information from the third intermediate model and the fourth intermediate model to obtain the information from the first target model.

[0231] It should be noted that steps A-E above are based on the example of the server obtaining the first target model information after one model training run by the first and second devices. In practical applications, the first and second devices may perform model training multiple times before the server obtains the first target model information. That is, the model obtained based on the first target model information in step E may be an incomplete first target model, meaning it may not converge. In this case, the server can receive intermediate model information from the first and second devices multiple times, aggregating the received intermediate model information each time to obtain aggregated information. If the model obtained based on the aggregated information converges, then this model is the first target model; if it does not converge, the above steps are repeated until the obtained model converges.

[0232] Understandably, before step A, the server can also label the data packets of the first application. Alternatively, the server can label the data packets of the first application through an administrator. For example, the server receives data packets of the first application from the first device; the server obtains the labeled data packets of the first application based on the data packets of the first application; the server sends the labeled data packets of the first application to the first device.

[0233] When the server annotates the data packets of the first application, the server obtains the annotated data packets of the first application based on the data packets of the first application, including: the server annotates the data packets of the first application to obtain the annotated data packets of the first application.

[0234] When the server labels the data packets of the first application by the administrator, the server obtains the labeled data packets of the first application based on the data packets of the first application, including: in response to the administrator's input, the server receives the labeled data packets of the first application.

[0235] Step 902: The server sends the information of the first target model to the first device.

[0236] Step 903: If the triggering conditions are met, the server obtains information about the second target model.

[0237] The description of the triggering conditions can be found in step 302 above. The description of the second target model can be found in step 3024 above. The description of the second target model can be found in step 302 above.

[0238] One possible implementation involves the server acquiring information about the second target model, including steps a-e. These steps are described using the example where the server determines the devices required for model training to be the first and second devices. When the number of devices determined by the server to be required for model training is greater than or equal to three, the server's acquisition of information about the second target model can be referenced from the case where the server determines the devices required for model training to be the first and second devices, and will not be elaborated further.

[0239] Step a: The server sends information about the first initial model and a list of second applications contained in the second application set to the first device.

[0240] The information on the first initial model and the list of second applications can be found in step 3021 above.

[0241] Step b: The server receives information from the first intermediate model of the first device.

[0242] The information about the first intermediate model can be found in the description in step 3023 above.

[0243] Step c: The server sends the information of the first initial model and the list of second applications included in the second application set to the second device.

[0244] Step d: The service receives information from the second intermediate model from the second device.

[0245] The information about the second intermediate model can be found in the description of the information about the first intermediate model.

[0246] Step e: The server aggregates the information from the first intermediate model and the second intermediate model to obtain the information from the second target model.

[0247] One possible implementation is that the server performs a weighted sum of the information from the first intermediate model and the information from the second intermediate model to obtain the information from the second target model.

[0248] It should be noted that steps a-e above are based on the example of the server obtaining the second target model information after the first and second devices perform a single model training. In practical applications, the first and second devices may perform model training multiple times before the server obtains the second target model information. That is, based on the second target model information in step e, the obtained model may be an incomplete second target model, meaning it may not converge. In this case, the server can receive intermediate model information from the first and second devices multiple times, aggregating the received intermediate model information each time to obtain aggregated information. If the model obtained based on the aggregated information converges, then this model is the second target model; if it does not converge, the above steps are repeated until the obtained model converges.

[0249] Understandably, before step a, the server can also label the data packets of the second application. Alternatively, the server can label the data packets of the second application through an administrator. For example, the server receives data packets of the second application from the first device; the server obtains the labeled data packets of the second application based on the data packets of the second application; the server sends the labeled data packets of the second application to the first device.

[0250] When the server annotates the data packets of the second application, the server obtains the annotated data packets of the second application based on the data packets of the second application, including: the server annotates the data packets of the second application to obtain the annotated data packets of the second application.

[0251] When the server labels the data packets of the second application by the administrator, the server obtains the labeled data packets of the second application based on the data packets of the second application, including: in response to the administrator's input, the server receives the labeled data packets of the second application.

[0252] Step 904: The server sends the information of the second target model to the first device.

[0253] Understandably, the server can monitor the accuracy of the model's packet recognition on the first device. If the accuracy is less than or equal to a third threshold, the server sends an instruction to the first device. This instruction instructs the first device to retrain a fourth target model for recognizing packets from the first and second applications. This fourth target model is trained using labeled packets from the first and second applications. The first device, when recognizing packets using the first and second target models, infers the results based on the output entropy. Therefore, the accuracy of the fourth target model is greater than the accuracy of the first device's packet recognition using the first and second target models. This improves the accuracy of the first device's packet recognition.

[0254] For example, if the accuracy rate of the first target model and the second target model in identifying data packets is less than or equal to a third threshold, the server sends an indication message to the first device. Alternatively, if the accuracy rate of the third target model in identifying data packets is less than or equal to the third threshold, the server sends an indication message to the first device. The description of the third target model can be found above. Figure 8 As described in the method shown.

[0255] based on Figure 9 The method shown eliminates the need for the server to train the model. Instead, the model training process is delegated to the participating devices (the first and second devices). The server simply aggregates the intermediate model information from multiple devices, reducing its computational overhead. Furthermore, the number of labeled data packets used by each participating device during model training is less than the number used by the server during training. This results in minimal computational load for these devices and saves training time.

[0256] The above Figure 3 , Figure 5 , Figure 7 and Figure 8 The data packet identification method shown is applied to the first device. Figure 9 The data packet identification method shown is applied to a server. The data packet identification method provided in this application embodiment will be described below from the perspective of the interaction between a first device, a second device, and a server.

[0257] like Figure 10 As shown, this is another data packet identification method provided in the embodiment of this application. The data packet identification method may include steps 1001-1019.

[0258] Step 1001: The server sends information about the third initial model and a list of first applications contained in the first application set to the first device.

[0259] The description of step 1001 can be found in step A above.

[0260] Correspondingly, the first device receives information from the server about the third initial model and a list of first applications contained in the first application set.

[0261] Step 1002: The first device trains the third initial model based on the labeled data packets of the first application obtained by the first device, and obtains the third intermediate model.

[0262] Step 1003: The first device sends information about the third intermediate model to the server.

[0263] The descriptions of steps 1002-1003 can be found in steps 3012-3013 above.

[0264] Correspondingly, the server receives information from the third intermediate model of the first device.

[0265] Step 1004: The server sends information about the third initial model and a list of the first applications included in the first application set to the second device.

[0266] The description of step 1004 can be found in step C above.

[0267] Correspondingly, the second device receives information from the server about the third initial model and a list of the first applications contained in the first application set.

[0268] Step 1005: The second device trains the third initial model based on the labeled data packets of the first application obtained by the second device, and obtains the fourth intermediate model.

[0269] Step 1006: The second device sends information about the fourth intermediate model to the server.

[0270] The descriptions of steps 1005-1006 can be found in the corresponding descriptions of steps 3012-3013 above.

[0271] Correspondingly, the server receives information from the fourth intermediate model from the second device.

[0272] It is understood that the embodiments of this application do not limit the execution order of steps 1001-1003 and steps 1004-1006. For example, in the embodiments of this application, steps 1001-1003 may be executed first, followed by steps 1004-1006. Alternatively, steps 1004-1006 may be executed first, followed by steps 1001-1003. Furthermore, steps 1004-1006 and steps 1001-1003 may be executed simultaneously in the embodiments of this application.

[0273] Step 1007: The server aggregates the information from the third intermediate model and the fourth intermediate model to obtain the information from the first target model.

[0274] The description of step 1007 can be found in the description of step E above.

[0275] Step 1008: The server sends the information of the first target model to the first device.

[0276] Correspondingly, the first device receives information about the first target model from the server.

[0277] Step 1009: The first device obtains the first target model based on the information of the first target model and the third initial model.

[0278] The description of step 1009 can be found in step 3015 above.

[0279] Step 1010: The server sends information about the first initial model and a list of second applications contained in the second application set to the first device.

[0280] The description of step 1010 can be found in step a above.

[0281] Correspondingly, the first device receives information from the server about the first initial model and a list of second applications contained in the second application set.

[0282] Step 1011: The first device trains the first initial model based on the labeled data packets of the second application obtained by the first device, and obtains the first intermediate model.

[0283] Step 1012: The first device sends the information of the first intermediate model to the server.

[0284] The descriptions of steps 1011-1012 can be found in steps 3022-3023 above.

[0285] Correspondingly, the server receives information from the first intermediate model of the first device.

[0286] Step 1013: The server sends the information of the first initial model and the list of second applications included in the second application set to the second device.

[0287] The description of step 1013 can be found in step c above.

[0288] Correspondingly, the second device receives information from the first initial model from the server and a list of second applications contained in the second application set.

[0289] Step 1014: The second device trains the first initial model based on the labeled data packets of the second application obtained by the second device, and obtains the second intermediate model.

[0290] Step 1015: The second device sends information about the second intermediate model to the server.

[0291] The descriptions of steps 1014-1015 can be found in the corresponding descriptions of steps 3022-3023 above.

[0292] Correspondingly, the server receives information from the second intermediate model from the second device.

[0293] It is understood that the embodiments of this application do not limit the execution order of steps 1010-1012 and steps 1013-1015. For example, in the embodiments of this application, steps 1010-1012 may be executed first, followed by steps 1013-1015. Alternatively, steps 1013-1015 may be executed first, followed by steps 1010-1012. Furthermore, steps 1013-1015 and steps 1010-1012 may be executed simultaneously.

[0294] Step 1016: The server aggregates the information from the first intermediate model and the second intermediate model to obtain the information from the second target model.

[0295] The description of step 1016 can be found in the description of step e above.

[0296] Step 1017: The server sends the information of the second target model to the first device.

[0297] Correspondingly, the first device receives information about the second target model from the server.

[0298] Step 1018: The first device obtains the second target model based on the information of the second target model and the first initial model.

[0299] The description of step 1018 can be found in step 3025 above.

[0300] Step 1019: The first device acquires the third data packet and determines the first application or the second application corresponding to the third data packet based on the first target model and the second target model.

[0301] The description of step 1019 can be found in step 303 above.

[0302] based on Figure 10 The method shown has two advantages. First, the server does not need to train the model; instead, the model training process is delegated to the devices involved (the first and second devices). The server simply aggregates the information from intermediate models across multiple devices, reducing its computational overhead. Second, when a new application (i.e., an application from the second application set) is added after using the first target model, the first device does not need to train a model based on the labeled data packets of applications from both the first and second application sets to obtain a model capable of recognizing data packets from both sets. Instead, the first device can train a model based on the labeled data packets of the second application to obtain the second target model. Subsequently, it uses both the first and second target models to recognize data packets from either the first or second application set. Since the number of labeled data packets from the second application is much smaller than the number of labeled data packets from the first and second applications, the computational load on the first device is low, and the training time is short. Furthermore, in Figure 10 In the method shown, when a new application is added, the first device uses the data packets of the labeled second application for model training, thus releasing the data packets of the labeled first application and reducing the cost of data storage.

[0303] Understandably, when the first device acquires multiple second target models, identifying the third data packet requires obtaining the output entropy of each target model (both the first and multiple second target models). Then, based on these multiple output entropies, the device determines the application corresponding to the third data packet. Therefore, the time required for the first device to identify the third data packet may be lengthy, impacting user experience. In this case, the first device can compress the first target model and multiple target models into a single target model. Subsequently, identifying the third data packet using the compressed target model can save the first device time. For details, please refer to... Figure 11 The method shown.

[0304] like Figure 11 As shown, in Figure 10 In one possible implementation of the method shown, Figure 10 The method shown also includes steps 1101 and 1102.

[0305] Step 1101: The first device acquires the second initial model.

[0306] Step 1102: The first device trains a second initial model to obtain a third target model based on the annotation results of the data packets obtained by the first target model and the second target model.

[0307] The descriptions of steps 1101 and 1102 can be found in steps 801 and 802 above.

[0308] based on Figure 11 The method shown allows the first device to acquire a second initial model after obtaining multiple second target models. Based on the annotation results of the data packets obtained by the first device using the first and second target models, the second initial model is trained to obtain a third target model. Subsequently, the first device can identify data packets based on the third target model, saving time in data packet identification. Furthermore, by continuously compressing the model, the first device can stabilize the model size, which is beneficial for on-chip system deployment.

[0309] The above Figure 3 , Figure 5 , Figure 7-11 The data packet identification method shown is illustrated using a federated learning scenario as an example. The following describes the data packet identification method provided in this application embodiment using a non-federated learning scenario as an example.

[0310] like Figure 12 The image shows another data packet identification method provided in this application embodiment. The method includes steps 1201-1203.

[0311] Step 1201: The first device acquires the first target model.

[0312] The first device can be Figure 1 Server 101, device 102, device 103, or device 104.

[0313] The introduction of the first target model can be found in the description in step 301 above.

[0314] One possible implementation is that the first device acquires the first target model during initialization (e.g., the first device is powered on for the first time, or the first device is restored to factory settings).

[0315] One possible implementation involves the first device acquiring the first target model, which includes the following steps 1-3.

[0316] Step 1: The first device acquires the data packet of the first application in the labeled first application set.

[0317] The data packets of the first application in the first set of labeled applications obtained by the first device can be labeled manually or by machine.

[0318] Step 2: The first device obtains the third initial model and the list of first applications contained in the first application set.

[0319] The description of the third initial model and the list of the first application can be found in section 3011 above.

[0320] Step 3: The first device trains a third initial model based on the labeled data packet of the first application to obtain the first target model.

[0321] For an explanation of step 3, please refer to the description in step 3012 above.

[0322] Step 1202: If the triggering conditions are met, the first device acquires the second target model.

[0323] The triggering conditions can be found in step 302 above.

[0324] One possible implementation involves the first device acquiring the second target model, which includes steps 4-6.

[0325] Step 4: The first device acquires the data packets of the second application from the labeled second application set.

[0326] The data packets of the second application in the set of labeled second applications obtained by the first device can be labeled manually or by machine.

[0327] Step 5: The first device obtains a list of second applications contained in the first initial model and the second application set.

[0328] The description of the first initial model and the list of second applications can be found in section 3021 above.

[0329] Step 6: The first device trains a first initial model based on the labeled data packet of the second application to obtain a second target model.

[0330] For details on step 6, please refer to the description in step 3022 above.

[0331] Understandably, the first device will acquire the second target model each time the triggering condition is met. That is, the first device can acquire the second target model multiple times, either before or after step 1203. The difference lies in the applications in the second application set corresponding to each acquired second target model. The second application set includes applications installed on the server, the first device, or other devices after the first device previously acquired the target model.

[0332] Step 1203: The first device acquires the third data packet and determines the first application or the second application corresponding to the third data packet based on the first target model and the second target model.

[0333] The description of step 1203 can be found in step 303 above.

[0334] based on Figure 12 The method shown, when a new application (i.e., an application from the second application set) appears after using the first target model, does not require the first device to train a model based on the labeled data packets of applications from both the first and second application sets to obtain a model capable of recognizing data packets from both sets. Instead, the first device can train a model based on the labeled data packets of the second application to obtain a second target model. Subsequently, the first and second target models are used to recognize data packets from either the first or second application set. Because the number of labeled data packets from the second application is much smaller than the number of labeled data packets from the first and second applications, Figure 12 In the method shown, the first device has low computational cost and short training time. Furthermore, in Figure 12 In the method shown, when a new application is added, the first device uses the data packets of the labeled second application for model training, thus releasing the data packets of the labeled first application and reducing the cost of data storage.

[0335] Understandably, when the first device acquires multiple second target models, identifying the third data packet requires obtaining the output entropy of each target model (both the first and multiple second target models). Then, based on these multiple output entropies, the device determines the application corresponding to the third data packet. Therefore, the time required for the first device to identify the third data packet may be lengthy, impacting user experience. In this case, the first device can compress the first target model and multiple target models into a single target model. Subsequently, identifying the third data packet using the compressed target model can save time. For details, please refer to... Figure 13 The method shown.

[0336] like Figure 13 As shown, in Figure 12 In one possible implementation of the method shown, Figure 12 The method shown also includes steps 1301 and 1302.

[0337] Step 1301: The first device acquires the second initial model.

[0338] Step 1302: The first device trains a second initial model to obtain a third target model based on the annotation results of the data packets obtained by the first target model and the second target model.

[0339] The descriptions of steps 1301 and 1302 can be found in steps 801 and 802 above.

[0340] based on Figure 13 The method shown allows the first device to acquire a second initial model after obtaining multiple second target models. Based on the annotation results of the data packets obtained by the first device using the first and second target models, the second initial model is trained to obtain a third target model. Subsequently, the first device can identify data packets based on the third target model, saving time in data packet identification. Furthermore, by continuously compressing the model, the first device can stabilize the model size, which is beneficial for on-chip system deployment.

[0341] It is understood that the aforementioned first device, server, or apparatus, etc., includes corresponding hardware structures and / or software modules for performing each function in order to achieve the above-described functions. Those skilled in the art should readily recognize that, based on the unit and algorithm operations of the various examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0342] This application embodiment can divide the first device, server, or first apparatus into functional modules according to the above method examples. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0343] For example, when dividing the functional modules using an integrated approach. Figure 14 A schematic diagram of a data packet identification device is shown. This device can be a first device, a chip within the first device, or a system-on-a-chip. This device can be used to perform the functions of the first device involved in the above embodiments.

[0344] As one possible implementation method, Figure 14 The apparatus shown includes: an acquisition module 1401 and a determination module 1402.

[0345] The acquisition module 1401 is used to acquire a first target model. The first target model is used to extract first feature information from the first data packet and determine the first application in the first application set corresponding to the first data packet. For example, combined with... Figure 3 The acquisition module 1401 is used to execute step 301.

[0346] The acquisition module 1401 is further configured to acquire a second target model when the triggering condition is met. The second target model is used to extract second feature information from the second data packet, determine the second application in the second application set corresponding to the second data packet, and identify a different first application from the first application set compared to the second application from the second application set. For example, in conjunction with... Figure 2 The acquisition module 1401 is also used to execute step 302.

[0347] The determining module 1402 is further configured to acquire a third data packet and, based on the first target model and the second target model, determine the first application or the second application corresponding to the third data packet. For example, in combination with... Figure 3 The module 1402 is used to execute step 303.

[0348] One possible implementation is that the acquisition module 1401 is specifically used to receive information about a first initial model from a server and a list of second applications contained in a second application set. The first initial model is determined based on the number of applications in the second application set, and the list of second applications is used to indicate the correspondence between the second applications in the second application set and the output of the first initial model. The acquisition module 1401 is also specifically used to train the first initial model based on the data packets of the labeled second applications obtained by the device to obtain a first intermediate model. The acquisition module 1401 is also specifically used to send information about the first intermediate model to the server. The acquisition module 1401 is also specifically used to receive information about a second target model from the server. The information about the second target model is obtained by aggregating information from intermediate models from multiple first devices. The acquisition module 1401 is also specifically used to obtain a second target model based on the information about the second target model and the first initial model.

[0349] One possible implementation is that the acquisition module 1401 is further specifically used to acquire data packets of the second application; the acquisition module 1401 is further specifically used to send data packets of the second application to the server; the acquisition module 1401 is further specifically used to receive data packets of the labeled second application from the server.

[0350] One possible implementation is that the triggering condition is that the number of applications in the second application set is greater than or equal to a first threshold; or, the triggering condition is that the number of data packets of the applications in the second application set is greater than or equal to a second threshold; or, the triggering condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets of the applications in the second application set is greater than or equal to the second threshold.

[0351] One possible implementation is that the determining module 1402 is specifically used to obtain a first output entropy of the third data packet according to a first target model, wherein the first output entropy is used to indicate the probability that the application corresponding to the third data packet is the application predicted by the first target model; the determining module 1402 is also specifically used to obtain a second output entropy of the third data packet according to a second target model, wherein the second output entropy is used to indicate the probability that the application corresponding to the third data packet is the application predicted by the second target model; the determining module 1402 is also specifically used to determine the application predicted by the target model corresponding to the lower value of the first output entropy and the second output entropy as the application corresponding to the third data packet.

[0352] In one possible implementation, the device further includes: a training module; an acquisition module 1401, further configured to acquire a second initial model, the second initial model being determined based on the number of applications in the first application set and the number of applications in the second application set; and a training module configured to train the second initial model to obtain a third target model based on the annotation results of the data packets obtained by the device using the first target model and the second target model, the third target model being used to extract third feature information and determine the application corresponding to the data packet corresponding to the third feature information based on the third feature information, the third feature information including feature information of the data packet corresponding to the third feature information, the data packet corresponding to the third feature information being a data packet of an application in the first application set or a data packet of an application in the second application set.

[0353] One possible implementation is that the training module is also used to train a third target model based on the labeled data packets used when acquiring the first target model, and / or the labeled data packets used when acquiring the second target model, to obtain the trained third target model.

[0354] In one possible implementation, the apparatus further includes: a receiving module; the receiving module is configured to receive indication information from a server, the indication information being used to instruct the apparatus to retrain a fourth target model for identifying data packets of the first application and data packets of the second application.

[0355] All relevant content of each operation involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0356] In this embodiment, the device is presented in an integrated manner, divided into various functional modules. Here, "module" can refer to a specific ASIC, circuitry, a processor and memory executing one or more software or firmware programs, integrated logic circuitry, and / or other devices that can provide the aforementioned functions. In a simplified embodiment, those skilled in the art will appreciate that the device can employ... Figure 2 As shown in the figure.

[0357] for example, Figure 2 The processor 201 can call computer execution instructions stored in the memory 203 to cause the device to execute the data packet identification method in the above method embodiment.

[0358] For example, Figure 14 The functions / implementation process of the acquisition module 1401 and the determination module 1402 can be achieved through... Figure 2 The processor 201 in the memory calls computer execution instructions stored in the memory 203 to implement the function.

[0359] Since the device provided in this embodiment can perform the above-described data packet identification method, the technical effects it can achieve can be referred to the above-described method embodiments, and will not be repeated here.

[0360] For example, when dividing the functional modules using an integrated approach. Figure 15 A schematic diagram of a data packet identification device is shown. This device can be a server, a chip within a server, or a system-on-a-chip, and can be used to perform the server functions described in the above embodiments.

[0361] As one possible implementation method, Figure 15 The apparatus shown includes: an acquisition module 1501 and a transmission module 1502;

[0362] The acquisition module 1501 is used to acquire information about the first target model. The first target model is used to extract first feature information from the first data packet and determine the first application in the first application set corresponding to the first data packet. For example, combined with... Figure 9 The acquisition module 1501 is used to execute step 901.

[0363] The sending module 1502 is used to send information about the first target model to the first device. For example, in conjunction with... Figure 9 The sending module 1502 is used to perform step 902.

[0364] The acquisition module 1501 is further configured to acquire information about a second target model when a triggering condition is met. The second target model is used to extract second feature information from the second data packet, determine the second application in the second application set corresponding to the second data packet, and identify a different first application from the first application set compared to the second application from the second application set. For example, in conjunction with... Figure 9 The acquisition module 1501 is also used to execute step 903.

[0365] The sending module 1502 is also configured to send information about the second target model to the first device. For example, in combination with... Figure 9 The sending module 1502 is also used to perform step 904.

[0366] One possible implementation involves an acquisition module 1501, specifically configured to send information about a first initial model and a list of second applications contained in a second application set to a first device. The first initial model is determined based on the number of second applications in the second application set, and the list of second applications indicates the correspondence between the second applications in the second application set and the output of the first initial model. The acquisition module 1501 is also specifically configured to receive information about a first intermediate model from the first device, which is obtained by the first device training the first initial model using data packets of labeled second applications obtained by the first device. Furthermore, the acquisition module 1501 is also specifically configured to send information about the first initial model and the list of second applications to the second device. Additionally, the acquisition module 1501 is also specifically configured to receive information about a second intermediate model from the second device, which is obtained by the second device training the first initial model using data packets of labeled second applications obtained by the second device. Finally, the acquisition module 1501 is also specifically configured to aggregate the information of the first intermediate model and the information of the second intermediate model to obtain information about the second target model.

[0367] In one possible implementation, the acquisition module 1501 is further configured to receive data packets from the second application of the first device; the acquisition module 1501 is further configured to acquire data packets of the labeled second application based on the data packets of the second application; and the acquisition module 1501 is further configured to send the data packets of the labeled second application to the first device.

[0368] One possible implementation is that the triggering condition is that the number of applications in the second application set is greater than or equal to a first threshold; or, the triggering condition is that the number of data packets of the applications in the second application set is greater than or equal to a second threshold; or, the triggering condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets of the applications in the second application set is greater than or equal to the second threshold.

[0369] In one possible implementation, the sending module 1502 is further configured to send indication information to the first device if the accuracy of the first target model and the second target model in recognizing data packets is less than or equal to a third threshold. The indication information is used to instruct the first device to retrain a fourth target model for recognizing data packets of the first application and data packets of the second application.

[0370] All relevant content of each operation involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0371] In this embodiment, the device is presented in an integrated manner, divided into various functional modules. Here, "module" can refer to a specific ASIC, circuitry, a processor and memory executing one or more software or firmware programs, integrated logic circuitry, and / or other devices that can provide the aforementioned functions. In a simplified embodiment, those skilled in the art will appreciate that the device can employ... Figure 2 As shown in the figure.

[0372] for example, Figure 2 The processor 201 can call computer execution instructions stored in the memory 203 to cause the device to execute the communication method in the above method embodiment.

[0373] For example, Figure 15 The functions / implementation process of the acquisition module 1501 and the transmission module 1502 can be obtained through Figure 2 The processor 201 in the memory calls computer execution instructions stored in the memory 203 to implement the function. Alternatively, Figure 15 The function / implementation process of the acquisition module 1501 can be obtained through Figure 2 The processor 201 in the memory calls computer execution instructions stored in the memory 203 to implement this. Figure 12 The function / implementation process of the sending module 1502 can be obtained through Figure 2 It is implemented using the communication interface 204.

[0374] Since the device provided in this embodiment can perform the above-described data packet identification method, the technical effects it can achieve can be referred to the above-described method embodiments, and will not be repeated here.

[0375] For example, when dividing the functional modules using an integrated approach. Figure 16 A schematic diagram of a data packet identification device is shown. This device can be a first device, a chip within the first device, or a system-on-a-chip. This device can be used to perform the functions of the first device involved in the above embodiments.

[0376] As one possible implementation method, Figure 16The apparatus shown includes: an acquisition module 1601 and a determination module 1602.

[0377] The acquisition module 1601 is used to acquire a first target model. The first target model is used to extract first feature information from the first data packet and determine the first application in the first application set corresponding to the first data packet. For example, combined with... Figure 12 The acquisition module 1601 is used to execute step 1201.

[0378] The acquisition module 1601 is further configured to acquire a second target model when the triggering condition is met. The second target model is used to extract second feature information from the second data packet, determine the second application in the second application set corresponding to the second data packet, and identify a different first application from the first application set compared to the second application from the second application set. For example, in conjunction with... Figure 12 The acquisition module 1601 is also used to execute step 1202.

[0379] The determining module 1602 is used to acquire the third data packet and, based on the first target model and the second target model, determine the first application or the second application corresponding to the third data packet. For example, in combination with... Figure 12 The module 1602 is used to execute step 1203.

[0380] One possible implementation is that the acquisition module 1601 is specifically used to acquire data packets of the second application in the labeled second application set; the acquisition module 1601 is also specifically used to acquire a list of the second applications contained in the first initial model and the second application set, wherein the first initial model is determined according to the number of applications in the second application set, and the list of the second applications is used to indicate the correspondence between the second applications in the second application set and the output of the first initial model; the acquisition module 1601 is also specifically used to train the first initial model based on the data packets of the labeled second application to obtain the second target model.

[0381] One possible implementation is that the triggering condition is that the number of applications in the second application set is greater than or equal to a first threshold; or, the triggering condition is that the number of data packets of the applications in the second application set is greater than or equal to a second threshold; or, the triggering condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets of the applications in the second application set is greater than or equal to the second threshold.

[0382] One possible implementation is that the determining module 1602 is specifically used to obtain a first output entropy of the third data packet according to a first target model, the first output entropy being used to indicate the probability that the application corresponding to the third data packet is the application predicted by the first target model; the determining module 1602 is also specifically used to obtain a second output entropy of the third data packet according to a second target model, the second output entropy being used to indicate the probability that the application corresponding to the third data packet is the application predicted by the second target model; the determining module 1602 is also specifically used to determine the application predicted by the target model corresponding to the lower value of the first output entropy and the second output entropy as the application corresponding to the third data packet.

[0383] In one possible implementation, the device further includes: a training module; an acquisition module 1601, further configured to acquire a second initial model, the second initial model being determined based on the number of applications in the first application set and the number of applications in the second application set; and a training module configured to train the second initial model to obtain a third target model based on the annotation results of the data packets obtained by the first device using the first target model and the second target model, the third target model being used to extract third feature information and determine the application corresponding to the data packet corresponding to the third feature information based on the third feature information, the third feature information including feature information of the data packet corresponding to the third feature information, the data packet corresponding to the third feature information being a data packet of an application in the first application set or a data packet of an application in the second application set.

[0384] One possible implementation is that the training module is also used to train a third target model based on the labeled data packets used when acquiring the first target model, and / or the labeled data packets used when acquiring the second target model, to obtain the trained third target model.

[0385] In one possible implementation, the acquisition module 1601 is further configured to retrain a fourth target model for recognizing data packets of the first application and the second application if the accuracy of the first target model and the second target model in recognizing data packets is less than or equal to a third threshold.

[0386] All relevant content of each operation involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0387] In this embodiment, the device is presented in an integrated manner, divided into various functional modules. Here, "module" can refer to a specific ASIC, circuitry, a processor and memory executing one or more software or firmware programs, integrated logic circuitry, and / or other devices that can provide the aforementioned functions. In a simplified embodiment, those skilled in the art will appreciate that the device can employ... Figure 2 As shown in the figure.

[0388] for example, Figure 2 The processor 201 can call computer execution instructions stored in the memory 203 to cause the device to execute the data packet identification method in the above method embodiment.

[0389] For example, Figure 16 The functions / implementation process of the acquisition module 1601 and the determination module 1602 can be achieved through... Figure 2 The processor 201 in the memory calls computer execution instructions stored in the memory 203 to implement the function.

[0390] Since the device provided in this embodiment can perform the above-described data packet identification method, the technical effects it can achieve can be referred to the above-described method embodiments, and will not be repeated here.

[0391] Figure 17 This is a schematic diagram of a chip structure provided in an embodiment of this application. Chip 170 includes one or more processors 1701 and interface circuitry 1702. Optionally, chip 170 may further include a bus 1703. Wherein:

[0392] Processor 1701 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed through integrated logic circuits in the hardware of processor 1701 or through software instructions. The processor 1701 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods and steps disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor.

[0393] Interface circuit 1702 is used for sending or receiving data, instructions, or information. Processor 1701 can process the data, instructions, or other information received by interface circuit 1702, and can send the processed information out through interface circuit 1702.

[0394] Optionally, chip 170 also includes memory, which may include read-only memory and random access memory, and provides operation instructions and data to the processor. A portion of the memory may also include non-volatile random access memory (NVRAM).

[0395] Optionally, the memory stores executable software modules or data structures, and the processor can execute corresponding operations by calling the operation instructions stored in the memory (which may be stored in the operating system).

[0396] Optionally, chip 170 can be used in the data packet identification device (including a first device, server, or first apparatus) involved in the embodiments of this application. Optionally, interface circuit 1702 can be used to output the execution result of processor 1701. For the data packet identification methods provided in one or more embodiments of this application, please refer to the foregoing embodiments, which will not be repeated here.

[0397] It should be noted that the functions of processor 1701 and interface circuit 1702 can be implemented through hardware design, software design, or a combination of hardware and software; no restrictions are imposed here.

[0398] Figure 18 A schematic diagram of the composition of a data packet identification system is shown, such as... Figure 18 As shown, the packet identification system 180 may include: a first device 1801 and a server 1802. It should be noted that... Figure 18 The accompanying drawings are merely illustrative and are not intended to limit the scope of the embodiments described in this application. Figure 18 The data packet identification system 180 shown includes the devices and the number of devices.

[0399] The first device 1801 has the above-mentioned features. Figure 14 The function of the data packet identification device shown is to acquire a first target model, acquire a second target model when the triggering condition is met, acquire a third data packet, and determine the first application or the second application corresponding to the third data packet based on the first target model and the second target model.

[0400] Server 1802 has the above-mentioned features Figure 15 The data packet identification device shown can be used to obtain information about the first target model, send the information about the first target model to the first device 1801, obtain information about the second target model, and send the information about the second target model to the first device 1802.

[0401] It should be noted that all relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding node of the data packet identification system 180, and will not be repeated here.

[0402] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0403] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0404] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0405] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0406] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0407] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for identifying data packets, characterized in that, The method includes: The first device acquires a first target model, which is used to extract first feature information of the first data packet and determine the first application in the first application set corresponding to the first data packet. When the triggering condition is met, the first device acquires the second target model, which is used to extract the second feature information of the second data packet and determine the second application in the second application set corresponding to the second data packet. The first application in the first application set is different from the second application in the second application set. The first device acquires a third data packet and determines the first application or the second application corresponding to the third data packet based on the first target model and the second target model. The first device acquires a second initial model, which is determined based on the number of applications in the first application set and the number of applications in the second application set; When the first device acquires the second target model multiple times, the first device trains the second initial model to obtain the third target model based on the annotation results of the data packets acquired by the first device and the second target model. The third target model is used to extract third feature information and determine the application corresponding to the data packet corresponding to the third feature information based on the third feature information. The third feature information includes the feature information of the data packet corresponding to the third feature information. The data packet corresponding to the third feature information is a data packet of an application in the first application set or a data packet of an application in the second application set.

2. The method according to claim 1, characterized in that, The first device acquires the second target model, including: The first device receives information about a first initial model from a server and a list of second applications contained in the second application set. The first initial model is determined based on the number of applications in the second application set, and the list of second applications is used to indicate the correspondence between the second applications in the second application set and the output of the first initial model. The first device trains the first initial model based on the data packets of the labeled second application obtained by the first device to obtain the first intermediate model; The first device sends the information of the first intermediate model to the server; The first device receives information about the second target model from the server, and the information about the second target model is obtained by aggregating information from intermediate models from multiple first devices; The first device obtains the second target model based on the information of the second target model and the first initial model.

3. The method according to claim 2, characterized in that, The first device acquires the second target model, and further includes: The first device acquires data packets from the second application; The first device sends a data packet of the second application to the server; The first device receives a data packet from the server for the labeled second application.

4. The method according to any one of claims 1-3, characterized in that, The triggering condition is that the number of applications in the second application set is greater than or equal to the first threshold; or, The triggering condition is that the number of data packets of the applications in the second application set is greater than or equal to the second threshold. or, The triggering condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets of the applications in the second application set is greater than or equal to the second threshold.

5. The method according to any one of claims 1-3, characterized in that, The first device determines the first application or the second application corresponding to the third data packet based on the first target model and the second target model, including: The first device obtains the first output entropy of the third data packet based on the first target model. The first output entropy is used to indicate the probability that the application corresponding to the third data packet is the application predicted by the first target model. The first device obtains the second output entropy of the third data packet based on the second target model. The second output entropy is used to indicate the probability that the application corresponding to the third data packet is the application predicted by the second target model. The first device determines the application corresponding to the target model prediction of the lower value output entropy between the first output entropy and the second output entropy as the application corresponding to the third data packet.

6. The method according to any one of claims 1-3, characterized in that, The method further includes: The first device trains the third target model based on the labeled data packets used when acquiring the first target model, and / or the labeled data packets used when acquiring the second target model, to obtain the trained third target model.

7. The method according to any one of claims 1-3, characterized in that, The method further includes: The first device receives instruction information from the server, the instruction information being used to instruct the first device to retrain a fourth target model for recognizing data packets of the first application and data packets of the second application.

8. A method for identifying data packets, characterized in that, The method includes: The server obtains information from the first target model, which is used to extract the first feature information of the first data packet and determine the first application in the first application set corresponding to the first data packet. The server sends the information of the first target model to the first device; When the triggering condition is met, the server obtains information about the second target model. The second target model is used to extract the second feature information of the second data packet and determine the second application in the second application set corresponding to the second data packet. The first application in the first application set is different from the second application in the second application set. The server sends the information of the second target model to the first device; The server obtains a second initial model, which is determined based on the number of applications in the first application set and the number of applications in the second application set. When the server obtains the second target model multiple times, the server trains the second initial model to obtain the third target model based on the annotation results of the data packets obtained by the server according to the first target model and the second target model. The third target model is used to extract the third feature information and determine the application corresponding to the data packet corresponding to the third feature information based on the third feature information. The third feature information includes the feature information of the data packet corresponding to the third feature information. The data packet corresponding to the third feature information is a data packet of an application in the first application set or a data packet of an application in the second application set.

9. The method according to claim 8, characterized in that, The server obtains information about the second target model, including: The server sends information about a first initial model and a list of second applications contained in the second application set to the first device. The first initial model is determined based on the number of applications in the second application set, and the list of second applications is used to indicate the correspondence between the second applications in the second application set and the output of the first initial model. The server receives information from the first intermediate model from the first device. The first intermediate model is obtained by the first device training the first initial model based on the data packets of the labeled second application obtained by the first device. The server sends the information of the first initial model and the list of the second applications to the second device; The server receives information about a second intermediate model from the second device. The second intermediate model is obtained by the second device training the first initial model based on the data packets of the labeled second application obtained by the second device. The server aggregates the information from the first intermediate model and the second intermediate model to obtain the information from the second target model.

10. The method according to claim 9, characterized in that, The server obtains information about the second target model, including: The server receives data packets from the second application of the first device; The server obtains the labeled data packet of the second application based on the data packet of the second application; The server sends the data packet of the labeled second application to the first device.

11. The method according to any one of claims 8-10, characterized in that, The triggering condition is that the number of applications in the second application set is greater than or equal to the first threshold; or, The triggering condition is that the number of data packets of the applications in the second application set is greater than or equal to the second threshold. or, The triggering condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets of the applications in the second application set is greater than or equal to the second threshold.

12. The method according to any one of claims 8-10, characterized in that, The method further includes: If the accuracy of the first target model and the second target model in recognizing data packets is less than or equal to a third threshold, the server sends an instruction message to the first device, which instructs the first device to retrain a fourth target model for recognizing data packets of the first application and data packets of the second application.

13. A data packet identification device, characterized in that, The device includes: an acquisition module, a determination module, and a training module; The acquisition module is used to acquire a first target model, the first target model is used to extract first feature information of the first data packet, and determine the first application in the first application set corresponding to the first data packet; The acquisition module is further configured to acquire a second target model when the triggering condition is met. The second target model is used to extract the second feature information of the second data packet and determine the second application in the second application set corresponding to the second data packet. The first application in the first application set is different from the second application in the second application set. The determining module is further configured to acquire a third data packet and determine the first application or the second application corresponding to the third data packet based on the first target model and the second target model; The acquisition module is further configured to acquire a second initial model, which is determined based on the number of applications in the first application set and the number of applications in the second application set. The training module is used to train a second initial model to obtain a third target model based on the annotation results of the data packets obtained by the device according to the first target model and the second target model when multiple second target models are obtained. The third target model is used to extract third feature information and determine the application corresponding to the data packet corresponding to the third feature information based on the third feature information. The third feature information includes feature information of the data packet corresponding to the third feature information. The data packet corresponding to the third feature information is a data packet of an application in the first application set or a data packet of an application in the second application set.

14. The apparatus according to claim 13, characterized in that, The acquisition module is specifically used to receive information about a first initial model from the server and a list of second applications contained in the second application set. The first initial model is determined based on the number of applications in the second application set, and the list of second applications is used to indicate the correspondence between the second applications in the second application set and the output of the first initial model. The acquisition module is further specifically used to train the first initial model based on the data packet of the labeled second application obtained by the device, so as to obtain the first intermediate model; The acquisition module is also specifically used to send information about the first intermediate model to the server; The acquisition module is further specifically used to receive information about the second target model from the server, wherein the information about the second target model is obtained by aggregating information from intermediate models from multiple first devices; The acquisition module is further specifically used to obtain the second target model based on the information of the second target model and the first initial model.

15. The apparatus according to claim 14, characterized in that, The acquisition module is also specifically used to acquire data packets of the second application; The acquisition module is also specifically used to send the data packet of the second application to the server; The acquisition module is also specifically used to receive data packets from the labeled second application from the server.

16. The apparatus according to any one of claims 13-15, characterized in that, The triggering condition is that the number of applications in the second application set is greater than or equal to the first threshold; or, The triggering condition is that the number of data packets of the applications in the second application set is greater than or equal to the second threshold. or, The triggering condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets of the applications in the second application set is greater than or equal to the second threshold.

17. The apparatus according to any one of claims 13-15, characterized in that, The determining module is specifically used to obtain the first output entropy of the third data packet based on the first target model. The first output entropy is used to indicate the probability that the application corresponding to the third data packet is the application predicted by the first target model. The determining module is further specifically used to obtain the second output entropy of the third data packet according to the second target model, wherein the second output entropy is used to indicate the probability that the application corresponding to the third data packet is the application predicted by the second target model; The determining module is further specifically used to determine the application of the target model prediction corresponding to the lower value of the first output entropy and the second output entropy as the application corresponding to the third data packet.

18. The apparatus according to any one of claims 13-15, characterized in that, The training module is further configured to train the third target model based on the labeled data packets used when acquiring the first target model, and / or the labeled data packets used when acquiring the second target model, to obtain the trained third target model.

19. The apparatus according to any one of claims 13-15, characterized in that, The device further includes: a receiving module; The receiving module is configured to receive indication information from the server, the indication information being used to instruct the device to retrain the fourth target model for recognizing data packets of the first application and data packets of the second application.

20. A data packet identification device, characterized in that, The device includes: an acquisition module, a transmission module, and a training module; The acquisition module is used to acquire information of the first target model, and the first target model is used to extract the first feature information of the first data packet and determine the first application in the first application set corresponding to the first data packet; The sending module is used to send the information of the first target model to the first device; The acquisition module is further configured to acquire information of the second target model when the triggering condition is met. The second target model is used to extract the second feature information of the second data packet and determine the second application in the second application set corresponding to the second data packet. The first application in the first application set is different from the second application in the second application set. The sending module is also used to send information about the second target model to the first device; The acquisition module is further configured to acquire a second initial model, which is determined based on the number of applications in the first application set and the number of applications in the second application set. The training module is used to train a second initial model to obtain a third target model based on the annotation results of the data packets obtained by the device according to the first target model and the second target model when multiple second target models are obtained. The third target model is used to extract third feature information and determine the application corresponding to the data packet corresponding to the third feature information based on the third feature information. The third feature information includes feature information of the data packet corresponding to the third feature information. The data packet corresponding to the third feature information is a data packet of an application in the first application set or a data packet of an application in the second application set.

21. The apparatus according to claim 20, characterized in that, The acquisition module is specifically used to send information about the first initial model and a list of second applications contained in the second application set to the first device. The first initial model is determined based on the number of applications in the second application set, and the list of second applications is used to indicate the correspondence between the second applications in the second application set and the output of the first initial model. The acquisition module is further specifically used to receive information from the first intermediate model from the first device. The first intermediate model is obtained by the first device training the first initial model based on the data packet of the labeled second application obtained by the first device. The acquisition module is also specifically used to send the information of the first initial model and the list of the second applications to the second device; The acquisition module is further specifically used to receive information from the second intermediate model from the second device. The second intermediate model is obtained by the second device training the first initial model based on the data packet of the labeled second application obtained by the second device. The acquisition module is further configured to aggregate the information of the first intermediate model and the information of the second intermediate model to obtain the information of the second target model.

22. The apparatus according to claim 21, characterized in that, The acquisition module is further specifically configured to receive data packets from the second application of the first device; The acquisition module is further specifically used to acquire the data packet of the labeled second application based on the data packet of the second application; The acquisition module is also specifically used to send the data packet of the labeled second application to the first device.

23. The apparatus according to any one of claims 20-22, characterized in that, The triggering condition is that the number of applications in the second application set is greater than or equal to the first threshold; or, The triggering condition is that the number of data packets of the applications in the second application set is greater than or equal to the second threshold. or, The triggering condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets of the applications in the second application set is greater than or equal to the second threshold.

24. The apparatus according to any one of claims 20-22, characterized in that, The sending module is further configured to send indication information to the first device if the accuracy of the first target model and the second target model in recognizing data packets is less than or equal to a third threshold. The indication information is used to instruct the first device to retrain a fourth target model for recognizing data packets of the first application and data packets of the second application.

25. A data packet identification device, characterized in that, include: A processor coupled to a memory for storing programs or instructions that, when executed by the processor, cause the apparatus to perform the method as claimed in any one of claims 1 to 7, or the method as claimed in any one of claims 8 to 12.

26. A chip, characterized in that, include: A processor coupled to a memory for storing programs or instructions that, when executed by the processor, cause the chip to perform the method as claimed in any one of claims 1 to 7 or the method as claimed in any one of claims 8 to 12.

27. A computer-readable medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed, they cause the computer to perform the method as described in any one of claims 1 to 7 or the method as described in any one of claims 8 to 12.

28. A data packet identification system, characterized in that, include: The apparatus as described in any one of claims 13-19, and / or the apparatus as described in any one of claims 20-24.

Images