A data stream identification method and apparatus

Abstract

The embodiment of the application provides a data stream identification method and device, which are used for improving the identification efficiency and identification accuracy of network data streams. Specifically, a data stream identification device acquires a first collection rule, and then collects first type data of a data stream in a current running environment according to the first collection rule; when the data stream identification device determines that there is a feature change point in the data stream according to the first type data, the data stream identification device determines a second collection rule; then the data stream identification device collects second type data of the data stream according to the second collection rule; finally, the data stream identification device inputs the second type data into an application identification model to obtain a first application identifier corresponding to the data stream.

Description

[0001] This application claims priority to Chinese Patent Application No. 202011121426.4, filed on October 19, 2020, entitled “Method, Apparatus and System for Implementing Application Identification”, the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to network data stream classification technology, and more particularly to a data stream identification method and apparatus. Background Technology

[0003] Network traffic is a crucial carrier for recording and reflecting network activity and operations. With the rapid development of the internet, various new network services are emerging to meet the diverse needs of internet users, leading to a continuous increase in both the quantity and types of network traffic. Network traffic classification refers to identifying and categorizing TCP or User Datagram Protocol (UDP) traffic generated by network communication based on the Transmission Control Protocol / Internet Protocol (TCP / IP) according to the application type (e.g., video, voice, games, downloads). Network traffic classification technology is a key technology for ensuring network security and a fundamental function in modern network management and security systems. Simultaneously, network traffic classification technology also plays a significant role in Quality of Service (QoS) control and network application trend analysis, possessing immense application value. After identifying the application type of network traffic, it is possible to: 1. Automated experience assurance for business traffic. For example, in the event of sudden network congestion, different dynamic safeguards need to be implemented for traffic from different applications to improve user experience; enterprises can reduce costs by using appropriate forwarding paths (private network / internet) for traffic based on business needs. 2. Conduct security audits of network traffic. Governments and enterprises have a need for auditing and control of their own networks, requiring countermeasures against traffic violations. 3. Implement differentiated billing. Various operator packages should offer different billing methods for applications within a specified scope (e.g., free data).

[0004] Currently, with more and more applications opting for encrypted transmission (such as HTTPS) and no longer reading packet payload data for privacy reasons, traditional application identification methods (analyzing packet content) have become ineffective. Current application identification algorithms often employ artificial intelligence (AI) methods, taking the first N packets of the network data stream as input, and using AI algorithms to automatically extract feature signatures from the header and output an application identifier.

[0005] However, AI application identification algorithms based on the first N packets struggle to capture all the flow characteristics of the network traffic corresponding to the application, leading to errors in network traffic identification. Summary of the Invention

[0006] This application provides a data stream identification method and apparatus to improve the identification efficiency and accuracy of network data streams.

[0007] In a first aspect, embodiments of this application provide a data stream identification method, specifically comprising: the data stream identification device acquiring a first acquisition rule, and then acquiring a first type of data of the data stream in the current operating environment according to the first acquisition rule; when the data stream identification device determines that the data stream has a feature change point according to the first type of data, the data stream identification device determines a second acquisition rule; then the data stream identification device acquires a second type of data of the data stream according to the second acquisition rule; finally, the data stream identification device inputs the second type of data into an application identification model to obtain a first application identifier corresponding to the data stream.

[0008] In this embodiment, the application identifier is used to indicate the classification type of the data stream. For example, the application identifier indicates that the data stream is a video stream, a game stream, or an audio stream.

[0009] It is understandable that the first type of data and the second type of data differ in transmission time and feature values, and the first type of data may include data collected in multiple acquisition cycles. For example, during the transmission time of the data stream, the data stream identification device collects data from the data stream according to the first acquisition rule in the first time period as the first type of data. If the first type of data in the first time period indicates that the data stream has no change point, then the data collected by the data stream identification device in the second time period according to the first acquisition rule will still be classified as the first type of data. If the first type of data in the second time period indicates that the data stream has a change point, then the data stream identification device will collect data from the data stream according to the second acquisition rule in the third time period as the second type of data. The first time period is earlier than the second time period, and the second time period is earlier than the third time period. From the perspective of feature values, the first type of data is the statistical data during the data stream's startup phase, while the second type of data is the data collected after determining that the data stream has a feature change point. Compared with the first type of data, the second type of data has more feature values ​​to represent the data stream. In one possible implementation, the first type of data can be the statistical requirements for the feature values ​​of the data stream, and the second type of data can be the number and feature values ​​of the messages to be collected in the data stream. For example, the first type of data can be the mean, median, or variance of the direction and length data of multiple messages, while the second type of data can be the direction and length data of multiple messages, as well as the number of messages.

[0010] In this embodiment, the data stream identification device collects data from the data stream multiple times and increases the detection of feature change points in the data stream, thereby capturing more feature values ​​of the data stream corresponding to the application, thus improving the identification efficiency and accuracy of the network data stream.

[0011] Optionally, during the process of detecting feature change points in a data stream, if the data stream identification device determines that there are no feature change points in the data stream based on the first type of data, the data stream identification device can continuously collect the first type of data of the data stream according to the first acquisition rule; and then determine whether there are feature change points in the data stream based on the first type of data.

[0012] Optionally, during the data stream identification process, the data stream identification device may also start a timer. If no feature change point is detected in the data stream during the timer's operation until the timer expires, the data stream identification device will input the first type of data into the application identification model to obtain the second application identifier corresponding to the data stream after the timer expires, and then end the data stream identification process.

[0013] Optionally, the data stream identification device may employ the following possible implementation methods when determining whether there are characteristic change points in the data stream based on the first type of data:

[0014] In one possible implementation, the data stream identification device inputs the first type of data into a feature change point detection model to obtain a first state label. This first state label indicates whether a feature change point exists in the data stream. Specifically, in this solution, the data stream identification device cyclically detects feature change points in the data stream. Then, when a feature change point is detected, it collects data after the feature change point in the data stream to obtain an application identifier. This allows for the acquisition of more feature values ​​from the data stream, thereby improving the accuracy of data stream identification.

[0015] In another possible implementation, the data stream identification device inputs the first type of data into an application identification model to obtain a third application identifier. If the third application identifier is different from the current application identifier of the data stream, it is determined that the data stream has a feature change point. That is, in this scheme, the data stream identification device can repeatedly identify the data stream, and when a feature change point is detected, it collects data after the feature change point in the data stream to obtain the application identifier again. This allows for the acquisition of more feature values ​​of the data stream, thereby improving the accuracy of data stream identification.

[0016] Based on the above scheme, the application identification model includes at least one of the following: an inter-stream data application identification model and a first N packet data application identification model. It is understood that in this embodiment, the first N packet data is used to indicate the data packets from the start time up to the Nth data packet when the data stream is started, and the inter-stream data refers to any data in the data stream other than the first N packet data.

[0017] Optionally, in this embodiment of the application, the data stream identification device may acquire the first acquisition rule in the following possible ways:

[0018] In one possible implementation, before detecting feature change points, the data stream identification device collects the first N packets of data from the data stream according to a preset collection rule, where N is a positive integer. Then, the first N packets are input into the application identification model to obtain a fourth application identifier for the data stream. The first collection rule is then derived based on this fourth application identifier. It is understood that the data stream identification device can also report this fourth application identifier. This allows the data stream identification device to perform an initial identification and report the obtained application identifier, thus reducing the waiting time for third parties (such as operators and network providers).

[0019] In another possible implementation, the first acquisition rule is a pre-set acquisition rule. In this scheme, the data stream identification device can directly skip acquiring the first N packets of data and instead acquire inter-stream data packets. Then, it directly performs feature change point detection on these inter-stream data packets. If feature change points exist, it acquires the data after the feature change points for identification to obtain the application identifier. If no feature change points exist, it can still identify the application identifier and report it. Then, the data stream identification device performs cyclic feature change point detection on the data stream again.

[0020] Optionally, in this embodiment, the data stream identification device can determine the steps of the data stream identification process and the acquisition rules for each step according to preset state rules. The preset state rules are pre-set rules that instruct the data stream identification device to determine the next step based on the state characteristics of the data stream and preset execution steps. The state characteristics include the application identifier identified by the application identification model or the state label identified by the feature change point detection model. The preset execution steps include performing application identification detection, performing feature change point detection, or ending the data stream identification process.

[0021] Optionally, the first or second acquisition rule includes the flow identifier and acquisition specifications of the data stream. The acquisition specifications include inter-flow periodic statistical requirements, or the number and characteristic values ​​of the packets to be acquired. It is understood that the inter-flow periodic statistical requirements can typically be understood as statistically processed data of the packet's characteristic values, such as the average and variance values ​​of the packet's direction and length data. The number of packets can indicate how many packets the data stream identification device should acquire, and the characteristic values ​​of the packets can typically indicate the packet's direction data, length data, etc.

[0022] Optionally, the data stream includes at least one of the following: video stream, game stream, webpage stream, download stream, and audio stream. It can be understood that the video stream is the data stream generated during video data transmission, typically understood as the data stream generated by video applications, such as video data during a user's video call or video data played by a video player. The game stream can be understood as the data stream generated by a game application, such as user operation data in a game and feedback data generated in response to user operations. The webpage stream can be the data stream generated by a web browser, such as data generated by a user's click or input operations in a web browser, and feedback data generated by the web browser in response to these operations. The download stream can be the data stream generated during the data download process. For example, the data transmission generated when a user uses a download tool to download data can be called a download stream. An audio stream is the data stream generated during the transmission of audio data, typically understood as the data stream generated by audio applications, such as audio data played by an audio player.

[0023] Secondly, this application provides a data stream identification device that has the function of implementing the data stream identification device behavior described in the first aspect above. This function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-described function.

[0024] In one possible implementation, the apparatus includes units or modules for performing the steps of the first aspect above. For example, the apparatus includes: an acquisition module for acquiring a first acquisition rule; an acquisition module for acquiring a first type of data from a data stream according to the first acquisition rule; a processing module for determining a second acquisition rule when the first type of data indicates that the data stream has a feature change point; the acquisition module is further configured to acquire a second type of data from the data stream after the feature change point according to the second acquisition rule; and the processing module is further configured to input the second type of data into an application identification model to obtain a first application identifier corresponding to the data stream.

[0025] Optionally, a storage module may also be included to store the necessary program instructions and data for the data stream identification device.

[0026] In one possible implementation, the apparatus includes a processor and a transceiver, the processor being configured to support the data stream identification device in performing the corresponding functions of the method provided in the first aspect above. The transceiver is used to instruct communication between the data stream identification device and other devices, such as sending the application identifier involved in the above method to a third-party server. Optionally, the apparatus may also include a memory coupled to the processor, which stores program instructions and data necessary for the data stream identification device.

[0027] In one possible implementation, when the device is a chip within a data stream identification device, the chip includes a processing module and a transceiver module. The processing module may be, for example, a processor, used to identify the data stream to obtain the first application identifier. The transceiver module may be, for example, an input / output interface, pin, or circuit on the chip, transmitting the obtained first application identifier to other chips or modules coupled to this chip. The processing module can execute computer execution instructions stored in a storage unit to support the data stream identification device in performing the method provided in the first aspect described above. Optionally, the storage unit may be a storage unit within the chip, such as a register or cache. Alternatively, the storage unit may be a storage unit located outside the chip, such as read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions, such as random access memory (RAM).

[0028] In one possible implementation, the device includes a communication interface and a logic circuit. The communication interface is used to acquire a first acquisition rule; acquire a first type of data from a data stream according to the first acquisition rule; the logic circuit is used to determine a second acquisition rule when the first type of data indicates that the data stream has a feature change point; the communication interface is also used to acquire a second type of data from the data stream after the feature change point according to the second acquisition rule; the logic circuit is also used to input the second type of data into an application identification model to obtain a first application identifier corresponding to the data stream.

[0029] The processor mentioned above can be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of programs for the data transmission methods described above.

[0030] Thirdly, embodiments of this application provide a computer-readable storage medium storing computer instructions for performing any possible implementation of the method described in any of the above aspects.

[0031] Fourthly, embodiments of this application provide a computer program product containing instructions that, when run on a computer, cause the computer to perform the method described in any of the above aspects.

[0032] Fifthly, this application provides a chip system including a processor for supporting a data stream identification device in implementing the functions involved in the foregoing aspects, such as generating or processing the data and / or information involved in the foregoing methods. In one possible design, the chip system further includes a memory for storing program instructions and data necessary for the data stream identification device to implement the functions of any of the foregoing aspects. The chip system may be composed of chips or may include chips and other discrete devices.

[0033] Sixthly, embodiments of this application provide a communication system, which includes the data stream identification device, terminal equipment, and server described above.

[0034] Optionally, the data stream identification device can be a forwarding device or a combination of an analyzer and a forwarding device to achieve the function of the data stream identification device. Specifically:

[0035] In one possible implementation, the communication system includes a forwarding device, a terminal device, and a server, wherein the terminal device interacts with the server via the forwarding device; the forwarding device is used to perform the method described in the first aspect above.

[0036] In another possible implementation, the communication system includes a forwarding device, an analyzer, a terminal device, and a server, wherein the terminal device interacts with the server through the forwarding device; the analyzer sends collection rules to the forwarding device; the forwarding device collects data and uploads it to the analyzer; and the analyzer is used to execute the method described in the first aspect above. Attached Figure Description

[0037] Figure 1 A schematic diagram illustrating network traffic characteristics in video conferencing or online education scenarios;

[0038] Figure 2 A diagram illustrating network traffic characteristics in a remote work scenario;

[0039] Figure 3 A schematic diagram illustrating the network traffic characteristics of an action game scene;

[0040] Figure 4 This is a functional model block diagram of the data stream identification device in the embodiments of this application;

[0041] Figure 5 This is a schematic diagram of a system architecture for applying the data stream identification method in an embodiment of this application;

[0042] Figure 6 This is a schematic diagram of another system architecture that applies the data stream identification method in the embodiments of this application;

[0043] Figure 7 This is a schematic diagram of another system architecture that applies the data stream identification method in the embodiments of this application;

[0044] Figure 8 This is a flowchart illustrating a preset state rule in an embodiment of this application;

[0045] Figure 9 This is a schematic diagram of one embodiment of the data stream identification method in this application;

[0046] Figure 10 This is a schematic diagram of another embodiment of the data stream identification method in this application;

[0047] Figure 11 This is a schematic diagram of another embodiment of the data stream identification method in this application;

[0048] Figure 12 This is a flowchart illustrating the identification process of an online education flow with feature jumps in this embodiment of the application.

[0049] Figure 13 This is a flowchart illustrating the identification process of an online education stream without feature transitions in this application embodiment;

[0050] Figure 14 This is a schematic diagram of one embodiment of the data stream identification device in this application;

[0051] Figure 15 This is a schematic diagram of another embodiment of the data stream identification device in this application. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application are described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Those skilled in the art will understand that with the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0053] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules is not necessarily limited to those explicitly listed, but may include other steps or modules not explicitly listed or inherent to such processes, methods, products, or devices. The naming or numbering of steps appearing in this application does not imply that the steps in the method flow must be performed in the chronological / logical order indicated by the naming or numbering. The execution order of named or numbered process steps can be changed according to the desired technical purpose, as long as the same or similar technical effect is achieved. The division of units in this application is a logical division. In practical applications, there may be other division methods. For example, multiple units may be combined into or integrated into another system, or some features may be ignored or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interface, and the indirect coupling or communication connection between units may be electrical or other similar forms, none of which are limited in this application. Furthermore, the units or sub-units described as separate components may or may not be physically separated, may or may not be physical units, or may be distributed among multiple circuit units. Some or all of the units may be selected to achieve the purpose of the solution in this application according to actual needs. The terminology used in this application is only for the purpose of describing specific embodiments and is not intended to be a limitation of this application. As used in the specification and appended claims of this application, the singular expressions "a," "an," "the," "the," "the," and "this" are intended to also include expressions such as "one or more," unless the context clearly indicates otherwise. It should also be understood that in the embodiments of this application, "one or more" refers to one, two, or more; "and / or" describes the relationship between the associated objects, indicating that three relationships can exist; for example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following associated objects have an "or" relationship.

[0054] Network traffic is a crucial carrier for recording and reflecting network activity and operations. With the rapid development of the internet, various new network services are emerging to meet the diverse needs of internet users, leading to a continuous increase in both the quantity and types of network traffic. Network traffic classification technology is a key technology for ensuring network security and a fundamental function in modern network management and security systems. After identifying the application type of network traffic, the following can be achieved: 1. Automated experience protection for business traffic. For example, in the event of sudden network congestion, different dynamic protection measures need to be taken for different applications to improve user experience; enterprises can adopt appropriate forwarding paths (private network / internet) based on their business needs to reduce costs. 2. Security auditing of network traffic. Governments and enterprises have auditing and control needs for their own network management, requiring traffic adversarial capabilities. 3. Differentiated billing. Various operator packages can implement different billing methods for applications within a specified range (e.g., free data). Current application identification algorithms often use artificial intelligence (AI) methods. The AI ​​algorithm automatically mines the feature signatures in the header of the first N packets of the network data stream and outputs the application identifier. However, AI application identification algorithms based on the first N packets struggle to capture all the flow characteristics of the network traffic corresponding to the application, leading to incorrect network traffic identification. The following are some application scenarios to illustrate this:

[0055] 1. Video conferencing or online education scenarios

[0056] In video conferencing or online education applications, the typical characteristic of the data stream is that it contains both small packets (carrying audio) and large packets (carrying video). Over time, the characteristics of this data stream can be as follows: Figure 1 As shown, in Figure 1 The horizontal axis represents the packet sequence number (equivalent to representing time), and the vertical axis represents the packet length (equivalent to representing the length of the data packet). The middle horizontal line indicates the case where the packet length is 0. A positive vertical axis indicates that the data packet direction is upstream (i.e., from the client to the server), with a packet length between 0 and 1500 bytes; a negative vertical axis indicates that the data packet direction is downstream (i.e., from the server to the client), with a packet length between 0 and 1500 bytes. The closer to the middle horizontal line, the smaller the packet length; the farther away from the middle horizontal line, the larger the packet length. However, in video conferencing or online education scenarios, the first N data packets of the data stream may sometimes only contain large packets without smaller packets (the camera is on but the microphone is off). Therefore, using the first N data packets of this data stream for application identification will misidentify the video conferencing or online education data stream as a video stream.

[0057] 2. Remote work scenarios

[0058] In remote work scenarios, the typical characteristics of data flow are small upstream packets (carrying mouse and keyboard actions) and large downstream packets (carrying desktop video). Over time, the characteristics of this data flow can be as follows: Figure 2 As shown, the Figure 2 The description of the horizontal and vertical axes and Figure 1 Similarly, this will not be elaborated upon here. However, in this remote work application scenario, the first N data packets of the data stream often only contain large packets and no smaller packets (after logging into the remote desktop, the person leaves their workstation and does not operate the computer). Therefore, using the first N data packets of this data stream for application identification will misidentify the remote work stream as a video stream.

[0059] 3. Action game scenes

[0060] In action game applications, the typical characteristic of its data flow is bidirectional small packets (carrying both player actions and game feedback). Over time, the characteristics of its data flow can be as follows: Figure 3 As shown, the Figure 3 The description of the horizontal and vertical axes and Figure 1 The same applies here, so I won't repeat it. However, in action game applications, sometimes only sparse heartbeat packets are available. This is because in some interfaces, the user doesn't perform any actions. For example, in PUBG, during the nearly one minute from the start of the game until the parachute jump, some users may not perform any actions. Therefore, using the first N data packets of this data stream for application identification can also lead to misidentification.

[0061] To address the aforementioned technical problems, this application provides a method for identifying network traffic, specifically comprising: the data flow identification device acquiring a first collection rule, and then collecting a first type of data of the data flow under the current operating environment according to the first collection rule; when the data flow identification device determines that the data flow has a characteristic change point based on the first type of data, the data flow identification device determines a second collection rule; then the data flow identification device collects a second type of data of the data flow according to the second collection rule; finally, the data flow identification device inputs the second type of data into an application identification model to obtain a first application identifier corresponding to the data flow.

[0062] In this embodiment, the application identifier is used to indicate the classification type of the data stream. For example, the application identifier indicates that the data stream is a video stream, a game stream, or an audio stream.

[0063] It is understandable that the first type of data and the second type of data differ in transmission time and feature values, and the first type of data may include data collected in multiple acquisition cycles. For example, during the transmission time of the data stream, the data stream identification device collects data from the data stream according to the first acquisition rule in the first time period as the first type of data. If the first type of data in the first time period indicates that the data stream has no change point, then the data collected by the data stream identification device in the second time period according to the first acquisition rule will still be classified as the first type of data. If the first type of data in the second time period indicates that the data stream has a change point, then the data stream identification device will collect data from the data stream according to the second acquisition rule in the third time period as the second type of data. The first time period is earlier than the second time period, and the second time period is earlier than the third time period. From the perspective of feature values, the first type of data is the statistical data during the data stream's startup phase, while the second type of data is the data collected after determining that the data stream has a feature change point. Compared with the first type of data, the second type of data has more feature values ​​to represent the data stream. In one possible implementation, the first type of data can be the statistical requirements for the feature values ​​of the data stream, and the second type of data can be the number and feature values ​​of the messages to be collected in the data stream. For example, the first type of data can be the mean, median, or variance of the direction and length data of multiple messages, while the second type of data can be the direction and length data of multiple messages, as well as the number of messages.

[0064] Specifically, such as Figure 4 As shown in the embodiment of this application, an exemplary functional module structure of the data stream identification device includes: an application identification model, a feature change point detection model, a preset state rule module, a data distribution module, and a data acquisition module. The data acquisition module is used to acquire data according to the acquisition rules issued by the preset state rule module or preset acquisition rules, and report it to the data distribution module. Then, the data distribution module determines whether to send the data to the feature change point detection module or the application identification model. The application identification model is used to identify the application identifier of the data stream based on the data. The feature change point detection model is used to detect whether there are feature change points in the data stream based on the data.

[0065] In communication systems, depending on the deployment location of each functional module, the data flow identification method in this application embodiment can be applied to different system architectures, as detailed below:

[0066] One possible implementation is, such as Figure 5As shown, the system architecture includes an analyzer (deployed locally), a network, forwarding devices, and terminal devices. The data acquisition module is deployed on the forwarding device, while the application identification model and feature change point detection model are deployed on the analyzer. The preset state rule module and the data distribution module can be deployed on either the analyzer or the forwarding device. In this system architecture, the terminal device interacts with the network through the forwarding device; the analyzer determines the acquisition rules and distributes them to the forwarding device; the forwarding device collects data packets of the data stream between the terminal device and the network according to the acquisition rules and reports them to the analyzer; the analyzer performs the application identification algorithm calculation, distributes acquisition rules, and reports application identifiers, among other operations.

[0067] Another possible implementation, such as Figure 6 As shown, the system architecture includes a cloud analyzer (deploying the analyzer in the cloud), a network, forwarding devices, and terminal devices. The data acquisition module is deployed on the forwarding device, while the application identification model and feature change point detection model are deployed on the cloud analyzer. The preset state rule module and the data distribution module can be deployed on either the cloud analyzer or the forwarding device. In this system architecture, the terminal device interacts with the network through the forwarding device; the analyzer determines the acquisition rules and distributes them to the forwarding device; the forwarding device collects data packets of the data stream between the terminal device and the network according to the acquisition rules and reports them to the analyzer; the analyzer performs the application identification algorithm calculation, distributes acquisition rules, and reports application identifiers, among other operations.

[0068] Another possible implementation, such as Figure 7 As shown, the system architecture includes terminal devices, forwarding devices, and a network. The data acquisition module, application identification model, feature change point detection model, preset state rule module, and data distribution module are all deployed on the forwarding device. In this system architecture, the terminal device transmits data to the network through the forwarding device; the forwarding device performs operations such as determining acquisition rules, acquiring data packets of the data stream between the terminal device and the server according to the acquisition rules, calculating the application identification algorithm, and reporting the application identifier.

[0069] In the aforementioned system architecture or functional module, the preset state rule module sets preset state rules. These preset state rules are pre-set execution rules used to instruct the data flow identification device to determine the next step based on the state characteristics of the data flow and preset execution steps. The state characteristics include the application identifier identified by the application identification model or the state label identified by the feature change point detection model. The preset execution steps include performing application identification detection, performing feature change point detection, or ending the data flow identification process. In one exemplary solution, the preset state rule can be as follows: Figure 8 As shown, initialization is performed first, collecting the first N packets of data and inputting this data into the application recognition model to obtain an application identifier. If the application identifier indicates that the data stream is a video stream, the next step is to collect periodic statistical data and then determine whether a feature change point has appeared in the data stream based on this periodic statistical data. If a feature change point appears, N packets of inter-stream data are collected and input into the application recognition model to obtain the application identifier of the data stream. If the application identifier indicates that it is an online education stream or an online office stream, the data stream recognition process ends. If no feature change point appears, periodic statistical data is collected and feature change point detection continues. If no feature change point is found before the timer expires, the data stream recognition process ends. If the initial collection of the first N packets of data and the application identifier obtained by inputting this data into the application recognition model indicate that the data stream is an online education stream or an online office stream, the data stream recognition process ends directly.

[0070] Understandable, Figure 8 This is merely an exemplary scheme for pre-setting state rules. Specific scenarios can include various situations. For example, after initializing and collecting N packets of data and applying them to obtain application identifiers, it can be set that feature change point detection is required regardless of the application identifier indicating the type of application for the data stream. Specific schemes are not limited here.

[0071] The technical solutions of this invention can be applied to various communication systems, such as: Global System of Mobile Communication (GSM) system, Code Division Multiple Access (CDMA) system, Wideband Code Division Multiple Access (WCDMA) system, Long Term Evolution (LTE) system, LTE Frequency Division Duplex (FDD) system, LTE Time Division Duplex (TDD) system, Universal Mobile Telecommunication System (UMTS), 5G communication system, and future wireless communication systems, etc.

[0072] In this application, terminal equipment may refer to access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication equipment, user agent, or user device. Access terminal may be a cellular phone, cordless phone, Session Initiation Protocol (SIP) phone, Wireless Local Loop (WLL) station, Personal Digital Assistant (PDA), handheld device with wireless communication capabilities, computing device or other processing device connected to a wireless modem, vehicle-mounted device, wearable device, terminal equipment in a 5G network, or terminal equipment in a future PLMN network, etc.

[0073] In this application, the forwarding device can be a device used to communicate with terminal devices. For example, it can be a base station (BTS) in a GSM or CDMA system, a base station (NodeB, NB) in a WCDMA system, an evolved Node B (eNB or eNodeB) in an LTE system, or the network device can be a relay station, access point, vehicle-mounted equipment, wearable device, network-side equipment in a 5G network, or network equipment in a future evolved Public Land Mobile Network (PLMN) network, etc.

[0074] Please refer to the following: Figure 9As shown, one embodiment of the data stream identification method in this application includes:

[0075] 901. The data stream identification device acquires the first acquisition rule.

[0076] In this embodiment, the data stream identification device can acquire the first acquisition rule in the following possible ways:

[0077] In one possible implementation, the data stream identification device directly reads the first acquisition rule embedded in the data stream identification device. That is, the first acquisition rule is the acquisition rule embedded in the data stream identification device.

[0078] In another possible implementation, before detecting feature change points, the data stream identification device collects the first N packets of data of the data stream according to a preset acquisition rule, where N is a positive integer; then the first N packets of data are input into the application identification model to obtain the fourth application identifier of the data stream; and the first acquisition rule is obtained according to the fourth application identifier.

[0079] Specifically, the collection rules include the stream identifier and collection specifications of the data stream.

[0080] 902. The data stream identification device collects the first type of data from the data stream according to the first acquisition rule.

[0081] Specifically, the acquisition rule includes the flow identifier and acquisition specifications of the data stream. The acquisition specifications include inter-stream periodic statistical requirements, or the number and characteristic values ​​of the packets to be acquired. It can be understood that the inter-stream periodic statistical requirements are typically statistically processed data of the packet's characteristic values, such as the average and variance values ​​of the packet's direction and length data. The number of packets can indicate how many packets the data stream identification device should acquire, and the characteristic values ​​of the packets can typically indicate the packet's direction data, length data, etc. For example, in an online education application scenario, this first acquisition rule could instruct the data stream identification device to acquire the direction and length data of the first 100 data packets of the data stream corresponding to the online education application.

[0082] The first type of data can be the statistical requirement for the characteristic values ​​of the data stream. For example, the first type of data can be the mean, median, or variance of the direction and length data of multiple messages.

[0083] Optionally, in this embodiment, during the process of detecting feature change points in a data stream, if the data stream identification device determines that there are no feature change points in the data stream based on the first type of data, the data stream identification device can continuously collect the first type of data of the data stream according to the first collection rule; and then determine whether there are feature change points in the data stream based on the first type of data.

[0084] Optionally, during the data stream identification process, the data stream identification device may also start a timer. If no feature change point is detected in the data stream during the timer's operation until the timer expires, the data stream identification device will input the first type of data into the application identification model to obtain the second application identifier corresponding to the data stream after the timer expires, and then end the data stream identification process.

[0085] Optionally, the data stream can include, but is not limited to, at least one of the following: video stream, game stream, webpage stream, download stream, and audio stream. It is understood that the video stream is the data stream generated during video data transmission, which can generally be understood as the data stream generated by video applications, such as video data during a user's video call or video data played by a video player. The game stream can be understood as the data stream generated by a game application, such as user operation data in a game and the feedback data generated in response to user operations. The webpage stream can be the data stream generated by a web browser, such as the data generated by a user's click or input operations in a web browser, and the feedback data generated by the web browser in response to these operations. The download stream can be the data stream generated during the data download process. For example, the data transmission generated by a user using a download tool can be called a download stream. An audio stream is the data stream generated during the transmission of audio data, which can generally be understood as the data stream generated by audio applications, such as audio data played by an audio player.

[0086] 903. When the first type of data indicates that there is a characteristic change point in the data stream, the data stream identification device determines the second acquisition rule.

[0087] Specifically, when determining whether a data stream has characteristic change points based on the first type of data, the data stream identification device can adopt the following possible implementation methods:

[0088] In one possible implementation, the data stream identification device inputs the first type of data into a feature change point detection model to obtain a first state label. This first state label indicates whether a feature change point exists in the data stream. Specifically, in this solution, the data stream identification device cyclically detects feature change points in the data stream. Then, when a feature change point is detected, it collects data after the feature change point in the data stream to obtain an application identifier. This allows for the acquisition of more feature values ​​from the data stream, thereby improving the accuracy of data stream identification.

[0089] In another possible implementation, the data stream identification device inputs the first type of data into an application identification model to obtain a third application identifier. If the third application identifier is different from the current application identifier of the data stream, it is determined that the data stream has a feature change point. That is, in this scheme, the data stream identification device can repeatedly identify the data stream, and when a feature change point is detected, it collects data after the feature change point in the data stream to obtain the application identifier again. This allows for the acquisition of more feature values ​​of the data stream, thereby improving the accuracy of data stream identification.

[0090] 904. The data stream identification device collects the second type of data of the data stream after the aforementioned feature change point according to the second acquisition rule.

[0091] Specifically, the second type of data consists of the number and characteristic values ​​of the messages to be collected in the data stream. For example, this second type of data could be the direction and length data of multiple messages, as well as the number of messages.

[0092] 905. The data stream identification device inputs the second type of data into the application identification model to obtain the first application identifier corresponding to the data stream.

[0093] Specifically, the application identification model can be a classification model. Furthermore, the application identification model includes, but is not limited to, at least one of the following: a first N packet data application identification model, and an inter-flow N packet data application identification model. The first N packet data application identification model and the inter-flow N packet data application identification model can be classification models using different algorithms, or they can be classification models using the same algorithm but with different weight parameters; no specific limitations are imposed here.

[0094] Please refer to the following: Figure 10 As shown, another embodiment of the data stream identification method in this application is described using a forwarding device to implement all the functions of the data stream identification device as an example:

[0095] 1001. The forwarding device collects the first N packets of data from the data stream according to the preset collection rules, where N is a positive integer.

[0096] Specifically, the preset collection rule includes the data stream identifier and collection specifications. The collection specifications can instruct the forwarding device to collect the first N packets of data from the data stream. For example, in an online education application scenario, the initial collection rule could instruct the forwarding device to collect the direction and length data of the first 100 data packets corresponding to the online education data stream. Furthermore, the preset collection rule can be a collection rule embedded in the forwarding device.

[0097] 1002. The forwarding device inputs the first N packet data into the application identification model to obtain the fourth application identifier.

[0098] Specifically, the application identification model can be a classification model. Furthermore, the application identification model includes, but is not limited to, at least one of the following: a first N packet data application identification model, and an inter-flow N packet data application identification model. The first N packet data application identification model and the inter-flow N packet data application identification model can be classification models using different algorithms, or they can be classification models using the same algorithm but with different weight parameters; no specific limitations are imposed here.

[0099] In this embodiment, if the application identification model includes the first N packet data application identification model and the inter-flow N packet data application identification model, then the forwarding device inputs the first N packet data into the first N packet data application identification model to obtain the fourth application identifier corresponding to the data flow. If the application identification model includes the inter-flow N packet data application identification model, then the forwarding device inputs the first N packet data into the inter-flow N packet data application identification model to obtain the fourth application identifier corresponding to the data flow.

[0100] Optionally, the forwarding device may also report the fourth application identifier.

[0101] 1003. The forwarding device determines the first collection rule based on the fourth application identifier and the preset status rule.

[0102] Specifically, the forwarding device matches the fourth application identifier with the state features in the preset state rules to determine the first collection rule.

[0103] It is understandable that if the status feature matched by the first application identifier indicates that the data stream identification process has ended, then the forwarding device may no longer execute subsequent steps 1004 to 1010.

[0104] 1004. The forwarding device collects the first type of data from the data stream according to the first collection rule.

[0105] Specifically, the first acquisition rule is used to collect data for feature change point detection, which includes the flow identifier and acquisition specifications of the data stream. In one exemplary scheme, the acquisition specifications include inter-flow periodic statistical requirements. It can be understood that these inter-flow periodic statistical requirements are typically statistically processed data of message feature values, such as the average and variance values ​​of message direction and length data. For example, in an online education application scenario, the first acquisition rule can instruct the data stream identification device to collect the average value of the direction data and the average value of the length data of the first 100 data packets of the data stream corresponding to the online education.

[0106] The first type of data can be the statistical requirement for the characteristic values ​​of the data stream. For example, the first type of data can be the mean, median, or variance of the direction and length data of multiple messages.

[0107] 1005. The forwarding device inputs the first type of data into the feature change point detection model to obtain the status label.

[0108] Specifically, depending on the type of data stream, the feature change point detection model can include different models. For example, if the data stream is a video stream, the feature change point detection model should include a video stream feature change point detection model; if the data stream is a game stream, the feature change point detection model should include a game stream feature change point detection model. The status label is a result used to indicate whether a feature change point exists in the data stream. Specific details are not limited here; for example, an output of 1 indicates the presence of a feature change point, and an output of 0 indicates the absence of a feature change point. Alternatively, an output of "yes" indicates the presence of a feature change point, and an output of "no" indicates the absence of a feature change point.

[0109] 1006. The forwarding device determines whether there is a feature change point in the data stream based on the status label. If there is a feature change point, steps 1007 to 1010 are executed; if there is no feature change point, steps 1004 to 1006 are executed.

[0110] Understandably, the forwarding device can determine the time to end the data stream identification process based on the preset status rules. For example, if the status label indicates that there are no feature change points in the data stream, the forwarding device can loop the feature change point detection process until a feature change point is detected during the timer's timing phase, and the application identification is performed to end the identification process, or until the timer expires and no feature change point is detected, thus ending the identification process.

[0111] 1007. The forwarding device determines the second collection rule based on the status label and the preset status rule.

[0112] Specifically, the forwarding device matches the status label with the status features in the preset status rules to determine the second collection rule.

[0113] It is understood that the second acquisition rule can be the same as or different from the first acquisition rule; no specific limitation is made here. For example, the first acquisition rule indicates the length and direction of 100 consecutive data packets between acquisition streams, while the second acquisition rule can be set to the length and direction of 200 consecutive data packets between acquisition streams.

[0114] 1008. The forwarding device collects the second type of data according to the second collection rule.

[0115] Specifically, the second collection rule is used to collect data for application identification, including the flow identifier and collection specifications of the data stream. In one exemplary scheme, the collection specifications include the number of packets to be collected and their characteristic values. The number of packets can indicate how many packets the data stream identification device should collect, and the characteristic values ​​of the packets can typically indicate the direction data, length data, etc. For example, in an online education application scenario, the first collection rule can instruct the data stream identification device to collect the direction and length data of the first 100 data packets of the data stream corresponding to the online education.

[0116] 1009. The forwarding device inputs the second type of data into the application identification model to obtain the first application identifier corresponding to the data stream.

[0117] Specifically, the application identification model can be a classification model. Furthermore, the application identification model includes, but is not limited to, at least one of the following: a first N packet data application identification model, and an inter-flow N packet data application identification model. The first N packet data application identification model and the inter-flow N packet data application identification model can be classification models using different algorithms, or they can be classification models using the same algorithm but with different weight parameters; no specific limitations are imposed here.

[0118] In this embodiment, the second type of data is usually the length and direction data of the inter-flow N-packet data of the data stream. The forwarding device inputs the second type of data into the inter-flow N-packet data application identification model to obtain the first application identifier corresponding to the data stream.

[0119] 1010. The forwarding device reports the identifier of the first application and terminates the data stream identification process.

[0120] Specifically, if the forwarding device reports the fourth application identifier, it will report the first application identifier and instruct the peer device to update the fourth application identifier to the first application identifier. At the same time, the data stream identification process will end.

[0121] Optionally, the forwarding device can also perform cyclic application identification to detect whether there are feature change points in the data stream. Specifically, after step 1004, the forwarding device can input the first type of data into the application identification model to obtain a third application identifier. The forwarding device determines whether there are feature change points in the data stream based on the third application identifier and the fourth application identifier. That is, if the third application identifier and the fourth application identifier are the same, it indicates that there are no feature change points in the data stream; if the third application identifier and the fourth application identifier are different, it indicates that there are change points in the data stream. If there are feature change points in the data stream, steps 1006 to 1010 are executed; if there are no feature change points in the data stream, the forwarding device continues to cyclically execute the application identification process until the data stream identification process ends.

[0122] Please refer to the following: Figure 11 As shown, an embodiment of the data stream identification method in this application is described using an analyzer and a forwarding device to implement all the functions of the data stream identification device:

[0123] 1101. The forwarding device collects the first N packets of data from the data stream according to the preset collection rules and reports them to the analyzer, where N is a positive integer.

[0124] Specifically, the preset collection rule includes the data stream identifier and collection specifications. The collection specifications can instruct the forwarding device to collect the first N packets of data from the data stream. For example, in an online education application scenario, the initial collection rule could instruct the forwarding device to collect the direction and length data of the first 100 data packets corresponding to the online education data stream. Furthermore, the preset collection rule can be a collection rule embedded in the forwarding device.

[0125] 1102. The analyzer inputs the first N packets of data into the application identification model to obtain the fourth application identifier.

[0126] Specifically, the application identification model can be a classification model. Furthermore, the application identification model includes, but is not limited to, at least one of the following: a first N packet data application identification model, and an inter-flow N packet data application identification model. The first N packet data application identification model and the inter-flow N packet data application identification model can be classification models using different algorithms, or they can be classification models using the same algorithm but with different weight parameters; no specific limitations are imposed here.

[0127] In this embodiment, if the application identification model includes the first N packet data application identification model and the inter-flow N packet data application identification model, then the analyzer inputs the first N packet data into the first N packet data application identification model to obtain the fourth application identifier corresponding to the data flow. If the application identification model includes the inter-flow N packet data application identification model, then the analyzer inputs the first N packet data into the inter-flow N packet data application identification model to obtain the fourth application identifier corresponding to the data flow.

[0128] Optionally, the analyzer can also report the fourth application identifier.

[0129] 1103. The analyzer determines the first collection rule based on the fourth application identifier and the preset status rule, and sends it to the forwarding device.

[0130] Specifically, the analyzer matches the fourth application identifier with the state features in the preset state rules to determine the first acquisition rule.

[0131] It is understandable that if the status feature matched by the first application identifier indicates that the data stream identification process has ended, then the analyzer may no longer execute subsequent steps 1104 to 1110.

[0132] 1104. The forwarding device collects the first type of data from the data stream according to the first collection rule and reports it to the analyzer.

[0133] Specifically, the first acquisition rule is used to collect data for feature change point detection, which includes the flow identifier and acquisition specifications of the data stream. In one exemplary scheme, the acquisition specifications include inter-flow periodic statistical requirements. It can be understood that these inter-flow periodic statistical requirements are typically statistically processed data of message feature values, such as the average and variance values ​​of message direction and length data. For example, in an online education application scenario, the first acquisition rule can instruct the data stream identification device to collect the average value of the direction data and the average value of the length data of the first 100 data packets of the data stream corresponding to the online education.

[0134] The first type of data can be the statistical requirement for the characteristic values ​​of the data stream. For example, the first type of data can be the mean, median, or variance of the direction and length data of multiple messages.

[0135] 1105. The analyzer inputs the first type of data into the feature change point detection model to obtain the state label.

[0136] Specifically, depending on the type of data stream, the feature change point detection model can include different models. For example, if the data stream is a video stream, the feature change point detection model should include a video stream feature change point detection model; if the data stream is a game stream, the feature change point detection model should include a game stream feature change point detection model. The status label is a result used to indicate whether a feature change point exists in the data stream. Specific details are not limited here; for example, an output of 1 indicates the presence of a feature change point, and an output of 0 indicates the absence of a feature change point. Alternatively, an output of "yes" indicates the presence of a feature change point, and an output of "no" indicates the absence of a feature change point.

[0137] 1106. The analyzer determines whether there is a feature change point in the data stream based on the status label. If there is a feature change point, steps 1107 to 1110 are executed; if there is no feature change point, steps 1104 to 1106 are executed.

[0138] Understandably, the forwarding device can determine the time to end the data stream identification process based on the preset status rules. For example, if the status label indicates that there are no feature change points in the data stream, the forwarding device can loop the feature change point detection process until a feature change point is detected during the timer's timing phase, and the application identification is performed to end the identification process, or until the timer expires and no feature change point is detected, thus ending the identification process.

[0139] 1107. The analyzer determines the second collection rule based on the status label and the preset status rule, and sends it to the forwarding device.

[0140] Specifically, the analyzer matches the state label with the state features in the preset state rules to determine the second acquisition rule.

[0141] It is understood that the second acquisition rule can be the same as or different from the first acquisition rule; no specific limitation is made here. For example, the first acquisition rule indicates the length and direction of 100 consecutive data packets between acquisition streams, while the second acquisition rule can be set to the length and direction of 200 consecutive data packets between acquisition streams.

[0142] 1108. The forwarding device collects the second type of data according to the second collection rule and reports it to the analyzer.

[0143] Specifically, the second collection rule is used to collect data for application identification, including the flow identifier and collection specifications of the data stream. In one exemplary scheme, the collection specifications include the number of packets to be collected and their characteristic values. The number of packets can indicate how many packets the data stream identification device should collect, and the characteristic values ​​of the packets can typically indicate the direction data, length data, etc. For example, in an online education application scenario, the first collection rule can instruct the data stream identification device to collect the direction and length data of the first 100 data packets of the data stream corresponding to the online education.

[0144] 1109. The analyzer inputs the second type of data into the application identification model to obtain the first application identifier corresponding to the data stream.

[0145] Specifically, the application identification model can be a classification model. Furthermore, the application identification model includes, but is not limited to, at least one of the following: a first N packet data application identification model, and an inter-flow N packet data application identification model. The first N packet data application identification model and the inter-flow N packet data application identification model can be classification models using different algorithms, or they can be classification models using the same algorithm but with different weight parameters; no specific limitations are imposed here.

[0146] In this embodiment, the second type of data is usually the length and direction data of the inter-flow N-packet data of the data stream. The analyzer then inputs the second type of data into the inter-flow N-packet data application identification model to obtain the first application identifier corresponding to the data stream.

[0147] 1110. The analyzer reports the first application identifier and terminates the data stream identification process.

[0148] Specifically, if the analyzer reports the fourth application identifier, it then reports the first application identifier and instructs the peer device to update the fourth application identifier to the first application identifier. Simultaneously, the data stream identification process terminates.

[0149] Optionally, the analyzer can also perform cyclic application identification to detect whether there are feature change points in the data stream. Specifically, after step 1104, the analyzer can input the first type of data into the application identification model to obtain a third application identifier. The analyzer determines whether there are feature change points in the data stream based on the third application identifier and the fourth application identifier. That is, if the third application identifier is the same as the fourth application identifier, it indicates that there are no feature change points in the data stream; if the third application identifier is different from the fourth application identifier, it indicates that there are change points in the data stream. If there are feature change points in the data stream, steps 1106 to 1110 are executed; if there are no feature change points in the data stream, the analyzer continues to cyclically execute the application identification process until the data stream identification process ends.

[0150] The following is based on Figure 4 Taking the data stream recognition device shown as an example, the data stream recognition process in the online education scenario is illustrated.

[0151] In one exemplary scheme, when there is a feature change point (i.e., feature jump) in the data stream of this online education scenario, the specific process can be as follows: Figure 12 As shown:

[0152] 1. The data acquisition module reports the direction and length data of the first 100 data packets of stream ID001. In this embodiment, stream ID001 is an exemplary stream identifier for the data stream in this online education scenario. The direction data indicates whether each data packet in the first 100 data packets is being uploaded or downloaded. The length data indicates the size of each data packet in the first 100 data packets, such as 1500 bytes or 200 bytes, etc.

[0153] 2. The data distribution module distributes the data of stream ID001 (i.e., the first 100 data packets) to the first N packet application identification model. In this embodiment, the application identification model includes a first N packet application identification model and an inter-stream N packet application identification model. The application identification model can be a classification model using a CNN network.

[0154] 3. The first N packets application identification model identifies the application type as video, reports the stream ID 001 and the application type video class to the peer device (which can be understood as a third party, such as an operator or network service provider, etc.), and sends it to the stream identification state machine (which is equivalent to the aforementioned preset state rule module).

[0155] 4. The flow identification state machine determines the next data collection rule based on the application type and its operating rules. This collection rule can be used to instruct the data acquisition module to collect periodic statistical data of flow ID001 and send it to the data acquisition module.

[0156] 5. The data acquisition module collects direction and length statistics for stream ID001 every 10 seconds according to the acquisition rules. This statistical data can be understood as the average, variance, or median of the direction or length data, etc. For example, the direction data for the first 10 seconds is recorded as "upload," and the length data is recorded as 600 bytes; the direction data for the second 10 seconds is recorded as "upload," and the length data is recorded as 1500 bytes.

[0157] 6. The data distribution module distributes the periodic statistical data of stream ID001 to the video stream feature change point detection model. In this embodiment, the feature change point detection model includes a video stream feature change point detection model and a game stream feature change point detection model. The feature change point detection model can be a classification model using a CNN network. The game stream feature change point detection model can be used for detecting data streams in scenarios such as action games.

[0158] 7. The video stream feature change point detection model identifies the feature change points in the video stream and sends the stream ID001 and the feature change point label (equivalent to the aforementioned state label) to the stream recognition state machine.

[0159] 8. The stream identification state machine determines the next acquisition rule based on the feature change point labels and the operating rules. This acquisition rule can be used to instruct the data acquisition module to collect N consecutive packets of data from stream id001 and send them to the data acquisition module.

[0160] 9. The data acquisition module collects the direction and length data of 100 consecutive data packets of stream id001 according to the acquisition rules determined in step 8.

[0161] 10. The data distribution module distributes the direction and length data of 100 consecutive data packets of stream ID001 to the inter-stream N-packet application identification model.

[0162] 11. The inter-flow N-packet application identification model identifies the application type as online education, reports the flow ID 001 and the application type (online education) to the peer device, and simultaneously sends them to the flow identification state machine.

[0163] 12. The flow identification state machine determines the end of the processing flow for flow ID001 based on the operating rules.

[0164] In one exemplary scheme, when there are no feature change points (i.e., feature jumps) in the data stream of the online education scenario, the specific process can be as follows: Figure 13 As shown:

[0165] 1. The data acquisition module reports the direction and length data of the first 100 data packets of stream ID001. In this embodiment, stream ID001 is an exemplary stream identifier for the data stream in this online education scenario. The direction data indicates whether each data packet in the first 100 data packets is being uploaded or downloaded. The length data indicates the size of each data packet in the first 100 data packets, such as 1500 bytes or 200 bytes, etc.

[0166] 2. The data distribution module distributes the data of stream ID001 (i.e., the first 100 data packets) to the first N packet application identification model. In this embodiment, the application identification model includes a first N packet application identification model and an inter-stream N packet application identification model. The application identification model can be a classification model using a CNN network.

[0167] 3. The first N packets application identification model identifies the application type as video, reports the stream ID 001 and the application type video class to the peer device (which can be understood as a third party, such as an operator or network service provider, etc.), and sends it to the stream identification state machine (which is equivalent to the aforementioned preset state rule module).

[0168] 4. The flow identification state machine determines the next data collection rule based on the application type and its operating rules. This collection rule can be used to instruct the data acquisition module to collect periodic statistical data of flow ID001 and send it to the data acquisition module.

[0169] 5. The data acquisition module collects direction and length statistics for stream ID001 every 10 seconds according to the acquisition rules. This statistical data can be understood as the average, variance, or median of the direction or length data, etc. For example, the direction data for the first 10 seconds is recorded as "upload," and the length data is recorded as 600 bytes; the direction data for the second 10 seconds is recorded as "upload," and the length data is recorded as 1500 bytes.

[0170] 6. The data distribution module distributes the periodic statistical data of stream ID001 to the video stream feature change point detection model. In this embodiment, the feature change point detection model includes a video stream feature change point detection model and a game stream feature change point detection model. The feature change point detection model can be a classification model using a CNN network. The game stream feature change point detection model can be used for detecting data streams in scenarios such as action games.

[0171] 7. The video stream feature change point detection model identifies the feature change points in the video stream and sends the stream ID001 and the feature change point label (equivalent to the aforementioned state label) to the stream recognition state machine.

[0172] 8. The flow recognition state machine determines the next step for detecting feature change points based on the feature change point labels and operating rules. That is, it repeats the operations from steps 4 to 7.

[0173] 9. Since no feature change point has been detected, the flow identification state machine decides to end the processing flow of flow ID001 after the timer expires, according to the operating rules.

[0174] The data stream identification method in the embodiments of this application has been described above. The data stream identification device in the embodiments of this application will be described below. Please refer to [link / reference] for details. Figure 14 As shown, the data stream identification device 1400 in this embodiment includes: an acquisition module 1401, a collection module 1402, and a processing module 1403, wherein the acquisition module 1401, the collection module 1402, and the processing module 1403 are connected via a bus. The data stream identification device 1400 can be a forwarding device as described in the above method embodiments, or it can be configured as one or more chips of a forwarding device. The data stream identification device 1400 can be used to perform some or all of the functions of the forwarding device or the forwarding device and analyzer as described in the above method embodiments.

[0175] The acquisition module 1402 can be equivalent to Figure 4 The preset state rule module in the middle, the acquisition module 1402 can be equivalent to Figure 4 The data acquisition module and the processing module 1403 are equivalent to the data acquisition module in the middle. Figure 4 The application of this model includes identification models and feature change point detection models.

[0176] For example, the acquisition module 1401 is used to acquire a first acquisition rule; the acquisition module 1402 is used to acquire a first type of data from the data stream according to the first acquisition rule; the processing module 1403 is used to determine a second acquisition rule when the first type of data indicates that there is a feature change point in the data stream; the acquisition module 1402 is also used to acquire a second type of data according to the second acquisition rule; the processing module 1403 is also used to acquire a second type of data from the data stream after the feature change point according to the second acquisition rule.

[0177] Optionally, the data flow identification device 1400 further includes a storage module coupled to the processing module, enabling the processing module to execute computer execution instructions stored in the storage module to achieve the terminal functions described in the above method embodiments. In one example, the storage module optionally included in the data flow identification device 1400 can be an in-chip storage unit, such as a register or cache. Alternatively, the storage module can be an external storage unit, such as ROM or other types of static storage devices capable of storing static information and instructions, such as RAM.

[0178] It should be understood that the above Figure 14 The processes executed between the modules of the data stream identification device 1400 in the corresponding embodiment are the same as those described above. Figures 4 to 13 The processes executed by the data stream identification device, forwarding device, or analyzer in the corresponding method embodiments are similar, and will not be described in detail here.

[0179] Figure 15A schematic diagram of a possible structure of a data stream identification device 1500 in the above embodiments is shown. This data stream identification device 1500 can be configured as the aforementioned forwarding device. The data stream identification device 1500 may include: a processor 1502, a computer-readable storage medium / memory 1503, a transceiver 1504, an input device 1505, and an output device 1506, as well as a bus 1501. The processor, transceiver, computer-readable storage medium, etc., are connected via the bus. This application does not limit the specific connection medium between the above components.

[0180] For example, the transceiver 1504 is used to acquire a first acquisition rule; acquire a first type of data of the data stream according to the first acquisition rule; when the first type of data indicates that there is a feature change point in the data stream, the processor 1502 determines a second acquisition rule; the transceiver 1504 acquires a second type of data of the data stream after the feature change point according to the second acquisition rule; the processor 1502 inputs the second type of data into the application identification model to obtain a first application identifier corresponding to the data stream.

[0181] The transceiver 1504 and the processor 1502 can achieve the above-mentioned functions. Figures 4 to 13 The corresponding steps in any of the embodiments are not detailed here.

[0182] Understandable, Figure 15 This application only shows a simplified design of the data stream identification device. In practical applications, the data stream identification device can include any number of transceivers, processors, memory, etc., and all data stream identification devices that can implement this application are within the protection scope of this application.

[0183] The processor 1502 involved in the aforementioned data flow identification device 1500 can be a general-purpose processor, such as a CPU, network processor (NP), microprocessor, etc., or an ASIC, or one or more integrated circuits used to control the execution of the program of the present application. It can also be a digital signal processor (DSP), field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The processor can also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc. The processor typically performs logical and arithmetic operations based on program instructions stored in memory.

[0184] The bus 1501 mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 15 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0185] The aforementioned computer-readable storage medium / memory 1503 may also store an operating system and other applications. Specifically, the program may include program code, which includes computer operation instructions. More specifically, the aforementioned memory may be ROM, other types of static storage devices capable of storing static information and instructions, RAM, other types of dynamic storage devices capable of storing information and instructions, disk storage, etc. Memory 1503 may be a combination of the aforementioned storage types. Furthermore, the aforementioned computer-readable storage medium / memory may be located within a processor, external to the processor, or distributed across multiple entities including a processor or processing circuitry. The aforementioned computer-readable storage medium / memory may be embodied in a computer program product. For example, a computer program product may include a computer-readable medium within packaging material.

[0186] Alternatively, embodiments of this application also provide a general-purpose processing system, such as commonly referred to as a chip, comprising: one or more microprocessors providing processor functions; and an external memory providing at least a portion of a storage medium, all of which are connected to other supporting circuitry via an external bus architecture. When instructions stored in the memory are executed by the processor, the processor causes the data flow identification device to... Figures 4 to 13 This embodiment includes some or all of the steps in the data transmission method, and / or other processes used in the technology described in this application.

[0187] The steps of the methods or algorithms described in this application can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in read-only memory (ROM), flash memory, random access memory (RAM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, portable hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and storage medium can reside in an ASIC. Alternatively, the ASIC can reside in a terminal. Of course, the processor and storage medium can also exist as discrete components in a data flow identification device.

[0188] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0189] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0190] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0191] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0192] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

Claims

1. A data stream identification method, characterized in that, include: Obtain the first collection rule; The first type of data from the data stream is collected according to the first collection rule, and the data stream includes the flow characteristics of network traffic; When the first type of data indicates that there is a feature change point in the data stream, a second acquisition rule is determined, wherein the feature change point is used to indicate the feature jump of the data stream; According to the second acquisition rule, the data stream is acquired after the feature change point, which is the second type of data. The second type of data is input into the application identification model to obtain the first application identifier corresponding to the data stream.

2. The method according to claim 1, characterized in that, The first type of data collected according to the first collection rule includes: When no characteristic change points are detected in the data stream, the first type of data in the data stream is collected according to the first collection rule.

3. The method according to claim 2, characterized in that, The method further includes: Start the timer; If the data stream does not have any feature change points and the timer times out, the first type of data is input into the application identification model to obtain the second application identifier corresponding to the data stream, and the identification process of the data stream ends.

4. The method according to any one of claims 1 to 3, characterized in that, After collecting the first type of data from the data stream according to the first collection rule, the method further includes: The first type of data is input into the feature change point detection model to obtain a status label, which is used to indicate whether there are feature change points in the data stream.

5. The method according to any one of claims 1 to 3, characterized in that, After collecting the first type of data from the data stream according to the first collection rule, the method further includes: The first type of data is input into the application identification model to obtain the third application identifier corresponding to the data stream; If the third application identifier is different from the current application identifier of the data stream, then it is determined that there is a feature change point in the data stream.

6. The method according to any one of claims 1 to 3, characterized in that, The application identification model includes at least one of the following: Inter-stream data application identification model, first N packet data application identification model, where N is a positive integer.

7. The method according to any one of claims 1 to 3, characterized in that, The first acquisition rule includes: The first N packets of data in the data stream are collected according to a preset collection rule, where N is a positive integer; The first N packets of data are input into the application identification model to obtain the fourth application identifier corresponding to the data stream; The first collection rule is determined based on the fourth application identifier.

8. The method according to any one of claims 1 to 3, characterized in that, The first collection rule is a pre-set collection rule.

9. The method according to any one of claims 1 to 3, characterized in that, The first or second collection rule includes the flow identifier and collection specifications of the data stream. The collection specifications include inter-stream periodic statistical requirements, or the number and characteristic values ​​of the packets to be collected.

10. The method according to any one of claims 1 to 3, characterized in that, The data stream includes at least one of the following: Video stream, game stream, webpage stream, download stream, audio stream.

11. A data stream identification device, characterized in that, include: The acquisition module is used to acquire the first collection rule; The acquisition module is used to acquire a first type of data from the data stream according to the first acquisition rule, wherein the data stream includes the flow characteristics of network traffic; The processing module is used to determine a second acquisition rule when the first type of data indicates that there is a feature change point in the data stream, wherein the feature change point is used to indicate a feature jump in the data stream; The acquisition module is also used to acquire a second type of data in the data stream after the feature change point according to the second acquisition rule; The processing module is further configured to input the second type of data into the application identification model to obtain the first application identifier corresponding to the data stream.

12. The apparatus according to claim 11, characterized in that, The acquisition module is specifically used to acquire the first type of data of the data stream according to the first acquisition rule when no feature change point is detected in the data stream.

13. The apparatus according to claim 12, characterized in that, The processing module is also used to start a timer; if the data stream does not have a feature change point and the timer times out, the first type of data is input into the application identification model to obtain the second application identifier corresponding to the data stream, and the identification process of the data stream ends.

14. The apparatus according to any one of claims 12 to 13, characterized in that, The processing module is further configured to input the first type of data into the feature change point detection model to obtain a first state label, the first state label being used to indicate whether there are feature change points in the data stream.

15. The apparatus according to any one of claims 11 to 13, characterized in that, The processing module is further configured to input the first type of data into the application identification model to obtain a third application identifier corresponding to the data stream; if the third application identifier is different from the current application identifier of the data stream, then it is determined that there is a feature change point in the data stream.

16. The apparatus according to any one of claims 11 to 13, characterized in that, The application identification model includes at least one of the following: Inter-stream data application identification model, first N packet data application identification model, where N is a positive integer.

17. The apparatus according to any one of claims 11 to 13, characterized in that, The acquisition module is also used to acquire the first N packets of data in the data stream according to a preset acquisition rule, where N is a positive integer; The processing module is further configured to input the first N packets of data into the application identification model to obtain the fourth application identifier corresponding to the data stream; and determine the first collection rule based on the fourth application identifier.

18. The apparatus according to any one of claims 11 to 13, characterized in that, The first collection rule is a pre-set collection rule.

19. The apparatus according to any one of claims 11 to 13, characterized in that, The first or second collection rule includes the flow identifier and collection specifications of the data stream. The collection specifications include inter-stream periodic statistical requirements, or the number and characteristic values ​​of the packets to be collected.

20. The apparatus according to any one of claims 11 to 13, characterized in that, The data stream includes at least one of the following: video stream, game stream, webpage stream, download stream, and audio stream.

21. A data stream identification device, characterized in that, It includes at least one processor and a memory, the processor being coupled to the memory, the processor invoking instructions stored in the memory to control the data stream identification device to perform the method of any one of claims 1 to 10.

22. A communication system, characterized in that, include: Terminal equipment, forwarding equipment, and servers; The terminal device interacts with the server through the forwarding device; The forwarding device is used to perform the method according to any one of claims 1 to 10.

23. A communication system, characterized in that, include: Terminal equipment, forwarding equipment, servers, and analyzers; The terminal device interacts with the server through the forwarding device; The analyzer sends the collection rules to the forwarding device; The forwarding device collects data and uploads it to the analyzer; The analyzer is used to perform the method according to any one of claims 1 to 10.

24. The system according to claim 23, characterized in that, The analyzer is deployed on a cloud server or on the forwarding device.

Images