A method and device for identifying a flow

Abstract

The present application provides a method and apparatus for identifying a flow, which relates to the field of communication technology and can improve the accuracy of large flow identification and improve network service forwarding performance. A communication device receives a first message, which belongs to a first flow. The communication device performs N hash calculations on the quintuple of the first message, and obtains N calculation results corresponding to the N hash calculations, respectively, and the N calculation results correspond to N bits in a bit sequence. The communication device determines the values ​​corresponding to the N bits according to the probability calculation method corresponding to the N bits, and when the values ​​corresponding to the N bits are all specified values, the first message is marked as a large flow message.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and in particular, to a method and device for identifying a flow. Background Art

[0002] The network traffic in the data center is characterized by a wide variety of traffic types, uneven traffic distribution, and rapid traffic growth. Once the cache accumulated on the link exceeds the upper limit of the actual cache that the link can carry, it will cause temporary packet loss to alleviate the current network congestion. Messages with the same priority in the same queue have the same probability of being discarded, that is, as long as they exceed the queue cache, they will be discarded indiscriminately. However, under normal circumstances, it is necessary to ensure the normal forwarding of small flows. This is because a small flow only needs a few data packets to be transmitted. Once packet loss and retransmission occur, the completion time of the transmission of the small flow may double the expected completion time, seriously affecting the forwarding performance of network services. Therefore, when congestion occurs at the network exit, you can limit the speed of the large flow while ensuring the normal forwarding of the small flow, so as to reduce the number of large flow messages arriving per unit time and alleviate the cache pressure at the link exit.

[0003] In order to limit the speed of large flows, the first task is to identify large flows. If the table entry specifications of the device on the link are large enough, the number of packets of each flow can be counted. When the number of packets counted exceeds the preset threshold, the flow can be marked as a large flow. However, in real business scenarios, the number of flows that need to be counted within a certain period of time may reach millions or even tens of millions. Accurate matching and identification takes too long, and the table entry specifications of the switching device are limited and cannot meet the requirements. In order to save table entry space and improve search efficiency, many large flow identification technologies based on hash algorithms have been derived. Specifically, a hash function is used to map each message to a certain position in the vector, and the count of the corresponding vector bit is checked as the basis for judging the large flow. However, the current large flow identification method is prone to hash conflicts, that is, there are two flows mapped to the same vector bit, which easily causes the problem of mistakenly marking small flows as large flows, making the data packets of small flows easy to be discarded, causing the data packets of small flows to be retransmitted, affecting the forwarding performance of network services. Summary of the invention

[0004] The embodiments of the present application provide a method and device for identifying a flow, which can improve the accuracy of large flow identification and improve network service forwarding performance.

[0005] In order to achieve the above-mentioned purpose, the embodiment of the present application adopts the following technical solution.

[0006] In a first aspect, a method for identifying a flow is provided, comprising: a communication device counts received messages starting from an initial message of a target flow through a first filtering method; when the communication device determines that the number of messages received from the target flow is greater than or equal to a first threshold, starting from messages exceeding the first threshold, marking messages whose count is a multiple of m; m is an integer greater than or equal to 2; when the communication device determines that the number of messages received from the target flow is greater than or equal to a second threshold, counting messages that continue to be received through a second filtering method; when the communication device determines that the number of messages received from the target flow is greater than or equal to a third threshold λ4, determining that the target flow is a large flow, and marking messages that continue to be received. The communication device may be a switch.

[0007] In this way, the present application can identify the messages of the large flow through a two-layer filtering method, and mark some of the messages in the large flow. In this way, the marked messages can be limited or discarded, and the unmarked messages can still be forwarded normally. When the message enters the second-level filtering and reaches the third threshold set by the second-level filtering, the message will be continuously marked. The larger the flow, the more the total number of marked messages in the total number of messages in the flow. In this way, by sampling and processing the large flow messages, it is possible to not only improve the storage space utilization of the switch table entries, but also reduce hash conflicts through hierarchical processing. Furthermore, the recognition accuracy of the large flow messages can be improved, which also improves the forwarding success rate of the small flow.

[0008] In one possible design, the method further includes: when the communication device determines that network congestion occurs, updating the forwarding rate of the marked message, and the updated forwarding rate is less than the forwarding rate before the update; or, when the communication device determines that network congestion occurs, discarding the marked message in the target flow. The discarding here can also be understood as priority discarding.

[0009] The flow identification method provided in the present application can bypass small flows based on the large flow identification method of the second-layer filtering, and only mark the messages in the large flow. In fact, only the marked messages will be limited or discarded. If the total number of bytes of a flow is less than the threshold set by the first-level filter, at most only 1 / 8 of the packets will be marked, and most of the messages will be forwarded normally at the original rate. When the message enters the second-level filter and reaches the threshold λ4 set by the second-level filter, the message will continue to be marked. The larger the flow, the more the total number of marked messages accounts for the total number of message bytes. In this way, the network congestion of the link can be alleviated.

[0010] In one possible design, the data structure used by the first filtering method is a Bloom filter; counting received messages through the first filtering method includes: mapping received messages of the target stream one by one to vector bits corresponding to the target stream through a hash function and a vector corresponding to the Bloom filter, and increasing the corresponding vector bit count by 1 each time the mapping occurs. The Bloom filter here can be understood as a bloom filter, that is, mapping received messages of the target stream one by one to vector bits corresponding to the target stream through a hash function and a vector corresponding to the bloom filter, and increasing the corresponding vector bit count by 1 each time the mapping occurs.

[0011] In a possible design, when the communication device determines that the number of received packets of the target flow is greater than or equal to the first threshold, starting from the packets exceeding the first threshold, marking the packets whose count is a multiple of m includes: when the communication device determines that the number of received packets of the target flow is greater than or equal to the first threshold, determining the target flow as a candidate large flow; starting from the packets exceeding the first threshold, marking the packets whose count is a multiple of 2p; wherein m=2p, and p is an integer greater than or equal to 1. For example, when p=3, the packets whose count is 104, 112, 120, 128, ... can be marked, which can also be understood as the switch marking the 104th packet, 112th packet, 120th packet, 128th packet, ... received.

[0012] In a possible design, the data structure used by the second filtering method is a summary data structure; counting the messages that continue to be received through the second filtering method includes: mapping the messages that continue to be received through the second filtering method to w×d counters through d hash functions, and determining the minimum value of the counting results of wd counters as the number of messages currently received; w and d are integers greater than 1. This is equivalent to: if the number of messages received by the switch is greater than or equal to the second threshold, it enters the second layer of filtering, and the second layer of filtering uses the second filtering method. In this way, when the message enters the second level of filtering and reaches the third threshold set by the second level of filtering, the message will be continuously marked, and the larger the flow, the more the total number of marked messages accounts for the total number of messages in the flow. In this way, by sampling and processing large flow messages, it is possible to not only improve the storage space utilization of the switch table, but also reduce hash conflicts through hierarchical processing.

[0013] In one possible design, the method further includes: the communication device updates the third threshold value according to the accuracy rate and false alarm rate of the message received by the communication device. If the parameter third threshold value is to be adjusted next time, the new parameter can be used to re-sample the message, identify and capture the packet, calculate the new accuracy rate, and determine the updated third threshold value.

[0014] In a second aspect, a communication device is provided, including: a counting unit, which is used to count received messages starting from the initial message of the target flow through a first filtering method; a marking unit, which is used to mark messages with a count that is a multiple of m, starting from messages exceeding the first threshold, when it is determined that the number of messages received from the target flow is greater than or equal to a first threshold; m is an integer greater than or equal to 2; the counting unit is also used to count the messages that continue to be received through a second filtering method when it is determined that the number of messages received from the target flow is greater than or equal to a second threshold; the marking unit is also used to determine that the target flow is a large flow and mark the messages that continue to be received when it is determined that the number of messages received from the target flow is greater than or equal to a third threshold.

[0015] In one possible design, a congestion processing unit is also included, which is used to: when it is determined that network congestion occurs, update the forwarding rate of marked messages, and the updated forwarding rate is less than the forwarding rate before the update; or, when it is determined that network congestion occurs, discard the marked messages in the target flow.

[0016] In one possible design, the data structure used by the first filtering method is a Bloom filter; the counting unit is specifically used to: map the received messages of the target stream one by one to the vector bits corresponding to the target stream through the hash function and vector corresponding to the Bloom filter, and the corresponding vector bit count is increased by 1 each time mapping occurs.

[0017] In one possible design, the marking unit is specifically used to: when it is determined that the number of received packets of the target flow is equal to a first threshold, determine the target flow as a candidate large flow; starting from the packets exceeding the first threshold, mark the packets whose counts are multiples of 2p; wherein m=2p, p is an integer greater than or equal to 1.

[0018] In a possible design, the data structure used by the second filtering method is a summary data structure; the counting unit is specifically used to: map the messages that continue to be received through the second filtering method to w×d counters through d hash functions, and determine the minimum value of the counting results of wd counters as the number of messages currently received; w and d are integers greater than 1.

[0019] In a possible design, an updating unit is also included, which is used to update the third threshold according to the accuracy and false alarm rate of the message received by the communication device.

[0020] In a third aspect, another method for identifying a flow is provided. A communication device receives a first message, and the first message belongs to a first flow. In the present application, any message received by the communication device may be referred to as a first message, and the data flow to which the any message belongs is the first flow. The communication device performs N hash calculations on the quintuple of the first message to obtain N calculation results corresponding to the N hash calculations, respectively, and the N calculation results correspond to N bits in the bit sequence. Usually, N is greater than 1. The communication device determines the values ​​corresponding to the N bits according to the probability calculation method corresponding to the N bits, and when the values ​​corresponding to the N bits are all specified values, the first message is marked as a large flow message. When the initial value of each bit is 0, the specified value may be 1. When the initial value of each bit is 1, the specified value may be 0.

[0021] The method for identifying flows provided in the third aspect of the present application only needs to perform N hash calculations on the five-tuple of the first message, and each hash calculation corresponds to only one bit. Therefore, in the process of calculating whether the first message is a large flow message, only N bits of storage space are needed. Compared with the hash table, the storage space utilization rate is higher.

[0022] In one possible design, the communication device also records the first flow and marks other messages belonging to the first flow as large flow messages. In the present application, the communication device records the identified large flow, and directly marks the message as a large flow message after receiving the message belonging to the large flow, without the need to perform flow identification on each message, thereby improving the marking efficiency.

[0023] In a possible design, the bit sequence is obtained by integrating the storage space. For example, in a 4K table entry space, each table entry occupies 64 bits, and the bit sequence can be 4K*64 bits long. In the present application, the entire table entry space is used as a bit sequence, and each stream only needs to occupy N bits of storage space, instead of each stream occupying one table entry, which improves the utilization efficiency of the storage space.

[0024] In one possible design, when performing N hash calculations on the quintuple of the first message, the communication device performs a hash calculation on the quintuple of the first message respectively according to N different hash functions.

[0025] In one possible design, when any one of the values ​​corresponding to the N bits is not the specified value, the communication device does not mark the first message.

[0026] In one possible design, when network congestion occurs, the communication device updates the forwarding rate of the first flow, and the updated forwarding rate is less than the forwarding rate before the update, or the communication device discards the first message. When the first flow is identified as a large flow, the communication device can perform congestion control on the large flow when network congestion occurs without affecting the sending rate of the small flow.

[0027] According to a fourth aspect, a device for identifying a flow is provided, the device comprising at least one module / unit for implementing the flow identification method of the third aspect and its various implementations, and the at least one module / unit can be implemented by hardware, software, or a combination of hardware and software.

[0028] In a fifth aspect, a communication device is provided, comprising at least one processor, wherein the at least one processor is connected to a memory, and the at least one processor is used to read and execute a program stored in the memory so that the device performs a method as described in the first aspect or any one of the first aspect, or the second aspect or any one of the second aspect.

[0029] In a sixth aspect, a chip is provided, which is coupled to a memory and is used to read and execute program instructions stored in the memory to implement a method as described in the first aspect or any one of the first aspect, or the second aspect or any one of the second aspect.

[0030] In a seventh aspect, the present application provides a switch, comprising one or more processors and one or more memories. The one or more memories are coupled to the one or more processors, and the one or more memories are used to store computer program codes, and the computer program codes include computer instructions. When the one or more processors execute the computer instructions, the electronic device executes the method for identifying a flow in any one of the above aspects and any one of the above aspects, or the above second aspect or any possible implementation of the second aspect.

[0031] In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium, comprising computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes a method for identifying a flow in any one of the above aspects and any one of the possible aspects, or the above second aspect or any one of the implementations of the second aspect.

[0032] In the ninth aspect, an embodiment of the present application provides a computer program product. When the computer program product runs on a computer or a processor, it enables the computer or the processor to execute the method for identifying the flow in any one of the above aspects and any one of the possibilities, or the above second aspect or any one of the implementations of the second aspect.

[0033] It can be understood that any of the communication devices, switches, chip systems, computer-readable storage media or computer program products provided above can be applied to the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods and will not be repeated here.

[0034] These and other aspects of the present application will become more apparent from the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A schematic diagram of a processing flow of a multi-stage bloom filter algorithm provided in an embodiment of the present application;

[0036] Figure 2 A schematic diagram of using the sketch method to identify a message provided in an embodiment of the present application;

[0037] Figure 3 A schematic diagram of a method for identifying a large flow through a bit map provided in an embodiment of the present application;

[0038] Figure 4 A schematic diagram of discarding messages when a network is congested provided in an embodiment of the present application;

[0039] Figure 5 A schematic diagram of limiting the speed of messages when the network is congested provided in an embodiment of the present application;

[0040] Figure 6 A schematic diagram of the structure of a switch provided in an embodiment of the present application;

[0041] Figure 7 A flow chart of a method for identifying a flow provided in an embodiment of the present application;

[0042] Figure 8 A schematic diagram of a calculation process of an identification flow provided in an embodiment of the present application;

[0043] Fig. 9 A flow chart of a method for identifying a flow provided in an embodiment of the present application;

[0044] Fig.10 A schematic diagram of a calculation process of an identification flow provided in an embodiment of the present application;

[0045] Fig.11 A schematic diagram of the structure of a communication device provided in an embodiment of the present application;

[0046] Fig.12 A schematic diagram of the structure of a switch provided in an embodiment of the present application;

[0047] Fig.13A schematic diagram of the structure of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] For ease of understanding, some examples of concepts related to the embodiments of the present application are provided for reference, as shown below:

[0049] Data Center: A central repository of information and data that can be used by surrounding networked businesses or organizations to store, manage, and distribute information.

[0050] Data Center Network: Connects resources in data centers.

[0051] Cache: A buffer for data exchange.

[0052] Priority: A category used to determine the relative importance of an incident, problem, or change.

[0053] Queue: A limited buffer space used to receive messages. Messages are placed in different queues according to their priorities and forwarded in sequence.

[0054] Congestion: Excessive traffic between internetworks or within a network that can cause network traffic to become inefficient.

[0055] Small flow: A process of transmitting a small amount of data in a short time through a network link.

[0056] High-volume streaming: The process of transmitting large amounts of data continuously over a network link.

[0057] Table item specifications: the size of the table item storage space.

[0058] Core switch: The backbone of the network is called the core layer. The purpose of the core layer is to provide high-speed forwarding and reliable backbone transmission interfaces. Therefore, core layer switches have higher reliability, performance, and throughput.

[0059] Hash function: maps a data set of arbitrary length to a fixed length.

[0060] Hash algorithm: Calculate any set of input data, get a fixed-length output, and fill it into the corresponding position of the hash table. The same input will definitely get the same output; different inputs are likely to get different outputs.

[0061] False alarm rate: the proportion of marked packets that should not be marked among the total number of packets.

[0062] False negative rate: the proportion of unmarked packets among the total packets that should be marked.

[0063] Hash collision: Different input data are mapped to the same hash value after being processed by the same hash algorithm.

[0064] Differentiated Services Code Point (DSCP): Based on the Diff-Serv (Differentiated Service) Quality of Service (QoS) classification standard, the Type of Service (TOS) byte in the Internet Protocol (IP) header of each data packet uses the used 6 bits and the unused 2 bits to distinguish priorities through coded values. DSCP is the used 6-bit identifier in the TOS byte and is a combination of the "IP Precedence" and "Type of Service" fields. In order to utilize older routers that only support "IP Precedence", DSCP values ​​are used. This is because DSCP values ​​are compatible with the "IP Precedence" field. Each DSCP coded value is mapped to a defined PHB (Per-Hop-Behavior) identification code. By typing in the DSCP value, the terminal device can identify the traffic.

[0065] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0066] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this embodiment, unless otherwise specified, "plurality" means two or more.

[0067] At present, in order to save table space in switches and other devices and improve search efficiency, there are a variety of large flow identification technologies based on hash algorithms. Specifically, these hash algorithms use hash functions to map received messages to a certain position in a vector, check the count of the corresponding vector bit, and use the count as the basis for judging large flows. Depending on the data structure used by the hash algorithm, large flow identification methods based on hash algorithms can be divided into bloom filter methods and sketch methods.

[0068] The idea of ​​using bloom filter to identify large flows is relatively simple. The algorithm can use a hash function and a vector, and the initial count of the vector bits is 0. The hash function maps the packets of a flow to a certain vector bit one by one, and the count increases by 1 each time it is mapped. Since the packets of the same flow will only be mapped to the same vector bit, when the cumulative count exceeds the selected threshold, the flow can be marked as a large flow. Therefore, the method of using bloom filter counting to identify large flows is relatively simple and easy to operate.

[0069] As an upgraded version of bloom filter, multiple hash functions can be used through multi-level bloom filter to map the flow packets to multiple vectors. Only when the values ​​of the counters of the corresponding vector bits at each level are greater than the threshold, the flow will be identified as a large flow.

[0070] like Figure 1 The figure shows the processing flow of the multi-stage bloom filter algorithm. Assuming that the keyword of a flow is F, the switch will receive the message of the flow and perform a hash operation every time it receives a message. Figure 1 The multi-stage bloom filter shown in FIG. 1 is a three-stage bloom filter: a first-stage bloom filter ( Figure 1 The first level of filtering), the second level bloomfilter ( Figure 1 The second-level filter in the ) and the third-level bloom filter ( Figure 1 The three-level filtering in the flow) corresponds to the hash functions: h1(F), h2(F) and h3(F). Each level of bloom filter includes multiple vector bits, and the packets of the flow are mapped to the same vector bit position in each level of bloom filter through the hash function. Assuming that the keyword of each packet of the flow is mapped to vector bit ① through h1(F) and the vector of the first-level bloom filter, is mapped to vector bit ② through h2(F) and the vector of the second-level bloom filter, and is mapped to vector bit ③ through h3(F) and the vector of the third-level bloom filter, then the minimum value of the count values ​​in vector bit ①, vector bit ② and vector bit ③ can be taken. If the minimum value is greater than the threshold T, the flow is determined to be a large flow. Once congestion occurs, the rate at which large flow packets are queued can be controlled. For example, large flow packets to be queued can be discarded first to alleviate network congestion.

[0071] However, in some scenarios, the method of using bloom filter counting to identify large flows is prone to hash conflicts, that is, two flows are mapped to the same vector bit. In this way, when a small flow is also mistakenly marked as a large flow, the message of the small flow will be mistakenly discarded, which can be understood as a false positive misjudgment. Even if the number of layers is increased, false positive misjudgments still exist, that is, flows less than the threshold are mistakenly judged as large flows.

[0072] As for another sketch method, the Count-min (CM) sketch, such as Figure 2 As shown, d hash functions (h1, h2, ..., h d ) is mapped to w*d counters. The CM sketch here is actually a matrix with d rows and w columns. Each row of the matrix corresponds to a hash function, and then the minimum value of all counting results is taken as the final judgment value. Among them, w and d are integers greater than 1. Figure 2 i t represents flow, c t Indicates the counting result of each row. With this counting model, the mapping results of a flow have a total of w to the power of d, which can reduce the occurrence of conflicts between flows. Therefore, the CM sketch counting method is suitable for large flow identification in scenarios with a large number of flows.

[0073] Similar to bloom filter, the large flow recognition technology based on CM sketch still has hash conflicts, that is, false positive misjudgments. In addition, the space complexity of the CM sketch counting method is high and the implementation is more complicated.

[0074] In this regard, the present application proposes two simple and easy-to-operate large flow identification methods, which are suitable for scenarios of large and small flow identification, and can especially effectively solve the problem of large flow identification in scenarios where table entry specification resources of network devices such as switches are limited, and can improve the utilization rate of storage space of network devices such as switches.

[0075] In the first method, the present application provides an adaptive large flow identification method based on secondary filtering. For example, when the initial message of the flow is received, the first-level filtering can use a bloom filter to mark the messages that exceed the threshold and are multiples of a certain value. At this time, the flow can be considered as a candidate large flow. When the message count exceeds a certain upper limit, the second-level filtering CM sketch is entered. When the second-level message count exceeds the threshold, the flow is considered to be a large flow, and the messages of the flow that continue to be received are marked.

[0076] In the second method, the present application provides a bitmap large flow identification method. This method can perform hash calculation on the five-tuple of the flow message, the hash value corresponds to the bit, and the probability value is set to 0 or 1 through probability calculation. If the bitmap value is all 1, the flow can be marked as a large flow. Figure 3 As shown in the figure, assuming that three hash functions are used, when performing hash calculation on each message, it is only necessary to find the bit corresponding to the calculated value counter. In this case, only 3 bits of storage space are needed for one flow. Compared with the hash table, the storage space utilization is more efficient.

[0077] These two methods can be applied to a variety of scenarios. For example, in scenario 1, when the cache of the link exit in the network is full, the existing technology will discard the newly arrived messages of the flow, whether it belongs to a large flow or a small flow. However, using the large flow identification method in the present application, the messages belonging to the large flow can be identified and the messages with a high probability of being discarded (color) can be marked, so that the marked messages in the large flow can be discarded, and the situation of discarding the messages of the small flow will not occur.

[0078] like Figure 4 As shown, when the packets of the large flow are enqueued, the marked packets in the large flow will be discarded before entering the cached queue.

[0079] In scenario 2, in order to reduce the packet loss rate of network devices, it is necessary to limit the speed of the flow of network devices. This application adopts large flow identification technology, which can apply the speed limit strategy only to large flows, ensuring that the messages of small flows will not be limited in speed and can be forwarded normally.

[0080] like Figure 5 As shown in the figure, before the large flow is identified, that is, before the rate is limited, the packets of the flow can be queued with 4 marked packets in the time period t0 to t1. After the large flow is identified, that is, after the rate is limited, the packets of the flow can be queued with 2 marked packets in the time period t0 to t1.

[0081] In addition to these two scenarios, the method for identifying large flows in the present application can also be applied to other scenarios.

[0082] The method for identifying a large flow in the present application can be applied to network devices such as switches. Taking a switch as an example, Figure 6As shown, the device for identifying a large flow in a switch may include a receiving module, a mapping module, a register (such as a hardware high-speed register), a register clearing module, a judgment module, and a sending module. Among them, the receiving module can be used to receive the message of the flow arriving at the switch; the mapping module can be used to perform hash calculation according to the data of the message, such as mapping to a certain vector position or a certain bit position; the register can be used to count the number of mappings; the judgment module can be used to determine whether the message needs to be marked according to the count value of the register; the sending module can be used to output the message to the link; the register clearing module can be used to clear the register count every certain period of time.

[0083] The first method of this application is introduced below.

[0084] Embodiment 1

[0085] The present application embodiment provides a method for identifying a flow, such as Figure 7 As shown, the method includes:

[0086] 701. The communication device starts from the initial message of the target flow and counts the received messages through the first filtering method.

[0087] This application is described using a communication device switch as an example.

[0088] Assuming that the target flow is recorded as flow f, when the switch receives the initial message of flow f, that is, the first message, it can count the messages starting from message 1 through the first filtering method. The counting here can be understood as the first layer of filtering.

[0089] In some embodiments, the data structure used by the first filtering method is a Bloom filter, ie, the bloom filter mentioned above.

[0090] The above-mentioned counting of received messages by the first filtering method may include:

[0091] Through the hash function and vector corresponding to the bloom filter, the received packets of the target flow are mapped one by one to the vector bits corresponding to the target flow, and the corresponding vector bit count is increased by 1 each time the mapping occurs.

[0092] Here we can use a single-stage bloom filter for counting, or use Figure 1 When the bloom filter is used for counting, the minimum value among the multi-level count values ​​is compared with the first threshold λ1 to determine whether the minimum value is greater than or equal to the first threshold λ1.

[0093] Assuming that a single-stage bloom filter is used for counting, if there is a counting vector A containing w1 counters, a hash function h can evenly map each packet of flow f to [0, w1-1] counters according to the flow ID, and the count is increased by 1 each time the mapping is performed. Then, the count obtained from each mapping is compared with the first threshold λ1.

[0094] like Figure 8 As shown, the message of each flow f can be calculated once by using the hash function h and the counting vector A to add 1, which is exemplified as A[h(f)]+=1.

[0095] 702. When the communication device determines that the number of received packets of the target flow is greater than or equal to a first threshold, starting from the packets exceeding the first threshold, the packets whose counts are multiples of m(λ2) are marked, where m is an integer greater than or equal to 2.

[0096] In some embodiments, when the communication device determines that the number of received packets of the target flow is greater than or equal to the first threshold λ1, the target flow is determined to be a candidate large flow.

[0097] Assume that m is a power of 2, that is, 2 p When the switch exceeds the first threshold, the switch can start with the message, marking the count as 2 p Multiples of the message. Where m = 2 p , p is an integer greater than or equal to 1.

[0098] For example, assuming that λ1 = 100, when the switch receives the 100th message of flow f, it determines that flow f is a candidate large flow. If the switch continues to receive messages from flow f, that is, A[h(f)] ≥ λ1, the current count in the received message can be set to 2. p For example, when p=3, the messages with counts of 104, 112, 120, 128, ... can be marked out, which can also be understood as the switch marking the received 104th message, 112th message, 120th message, 128th message, ... If the switch receives the messages in sequence, it can also be understood as the switch marking the messages with sequence numbers of 104, 112, 120, 128, ... out.

[0099] like Figure 8 As shown, assuming that m is λ2, the condition for marking the message in step 702 can be exemplified as: A[h(f)]≥λ1 and A[h(f)]modλ2=0. That is, starting from the 101st message received, messages that do not meet the condition are not marked.

[0100] 703. When the communication device determines that the number of received packets of the target flow is greater than or equal to the second threshold, the communication device counts the packets that continue to be received by using the second filtering method.

[0101] In some embodiments, if the number of messages received by the switch is greater than or equal to the second threshold λ3, the switch enters the second layer of filtering, and the second layer of filtering uses the second filtering method.

[0102] Exemplarily, the data structure used by the second filtering method is a summary data structure, which can be understood as the CM sketch mentioned above.

[0103] Therefore, counting the messages that continue to be received through the second filtering method may include:

[0104] The second filtering method maps the messages that continue to be received to w×d counters through d hash functions, and d The minimum value among the counting results of the counters is determined as the number of messages currently received; w and d are integers greater than 1.

[0105] For example, assuming that the second threshold λ3 is 500, the CM sketch here is denoted as CM sketch C, which includes d count vectors, each count vector C i (C1, C2, ..., C d ) contains w2 counters, grouped by hash function g i Starting from the 501th message, the flow ID of flow f is evenly mapped to [0, w2-1], D = 1, 2, ..., w2 ≤ w1. Figure 8 As shown, the hash function group g i and count vector C i The example of the counting process starting from the 501st message is C i [g t (f)]+=1, i=1, 2,...,d.

[0106] 704. When the communication device determines that the number of received packets of the target flow is greater than or equal to the third threshold, the target flow is determined to be a large flow, and the packets that continue to be received are marked. Then, step 705 or step 706 is executed.

[0107] If the number of packets received by the switch starting from the 501th packet is greater than or equal to the third threshold λ4, it can be determined that the flow f is a large flow.

[0108] For example, assuming that when the switch starts to perform the second layer filtering, the minimum value of the calculation results of each message relative to d vectors C starting from the 501st message can be compared with the third threshold λ4. If the minimum value calculated for a certain message is min(C1[g1(f)], C2[g2(f), …, C d [g d (f)]], when min(C1[g1(f)], C2[g2(f), …, C d [g d (f)])≥λ4, the subsequent messages received from this message can be marked, such as Figure 8 shown.

[0109] For example, assuming that we start from the 501th message and regard the 501th message as the first received message, we count the messages that continue to be received through the CM sketch. If the calculation result of a message is min(C1[g1(f)], C2[g2(f), …, C d [g d (f)]]≥λ4, when λ4=50, the received messages can be marked starting from the 50th message. In fact, it can also be understood that the received messages are marked starting from the 550th message.

[0110] 705. When the communication device determines that network congestion occurs, the communication device updates the forwarding rate of the marked message, and the updated forwarding rate is less than the forwarding rate before the update.

[0111] In some embodiments, when the switch determines that network congestion has occurred, for example, when the storage space of the cache in the switch has no remaining space, the switch can limit the rate of the marked packets in the determined large flow. The rate limit here can be understood as reducing the rate at which the marked packets in the large flow are queued. Figure 5 The principle is similar.

[0112] 706. When the communication device determines that network congestion occurs, the message marked in the target flow is discarded.

[0113] In some embodiments, when the switch determines that network congestion occurs, for example, when there is no remaining space in the cache storage space of the switch, the switch can discard the large flow message: the message marked in flow f, so as to relieve the cache pressure in the switch and improve the transmission success rate of the small flow.

[0114] In this way, the present application can identify the messages of the large flow through a two-layer filtering method, and mark some of the messages in the large flow. In this way, the marked messages can be limited or discarded, and the unmarked messages can still be forwarded normally. When the message enters the second-level filtering and reaches the third threshold set by the second-level filtering, the message will be continuously marked. The larger the flow, the more the total number of marked messages in the total number of messages in the flow. In this way, by sampling and processing the large flow messages, it is possible to not only improve the storage space utilization of the switch table entries, but also reduce hash conflicts through hierarchical processing. Furthermore, the recognition accuracy of the large flow messages can be improved, which also improves the forwarding success rate of the small flow.

[0115] In order to illustrate the effect of the two-layer filtering method provided in the present application, a marking ratio test model is provided: the total number of flows is fixed at 400, and the number of bytes sent for each flow is changed (for example, 80KB, 200KB, 10MB, etc.), and the percentage of the total number of bytes of marked messages to the total number of bytes of the total number of messages is calculated under flows with different numbers of bytes.

[0116] Assume that the above parameters are set as follows: λ1=100, λ2=8, λ3=256, λ4=50;

[0117] Counter aging rate: count down by 1 every 1 millisecond;

[0118] Unmarked message dscp: CS1; marked message dscp: AF13.

[0119] The test results are shown in Table 1.

[0120] Table 1

[0121] Number of bytes sent per stream CS1 message bytes AF13 message bytes AF13 message ratio 80KB 15866256 0 0.0％ 200KB 28249596 885868 3.0％ 10MB 41836422 40623166 97.1％

[0122] From Table 1, we can find that: 1) small flows will not be marked, for example, there is no marked message in a small flow with a byte size of 80KB; 2) for flows exceeding 100KB, the more bytes of the sent flow, the higher the proportion of marked messages, and the probability of marked messages in larger flows, such as 10MB flows, is close to 100%.

[0123] Therefore, the flow identification method provided by the present application can bypass the small flow based on the large flow identification method of the second-layer filtering, and only mark the messages in the large flow. In fact, only the marked messages will be limited or discarded. If the total number of bytes of a flow is less than the threshold set by the first-level filter, at most only 1 / 8 of the packets will be marked, and most of the messages will be forwarded normally at the original rate. When the message enters the second-level filter and reaches the threshold λ4 set by the second-level filter, the message will continue to be marked. The larger the flow, the more the total number of marked messages accounts for the total number of message bytes.

[0124] In addition, the present application also provides an adaptive parameter adjustment method, which can adaptively adjust parameters according to the accuracy and false alarm rate of the message. The parameters here can be, for example, the above-mentioned λ1, λ2, λ3 and λ4.

[0125] The present application provides two parameter adaptive adjustment schemes. In one possible approach, the parameters λ1, λ2 and λ3 can be fixed, and the parameter λ4 can be adjusted. In this case, the present application embodiment may also include: 707 ( Figure 7 (not shown), the communication device updates the third threshold λ4 according to the accuracy and false alarm rate of the message received by the communication device.

[0126] Among them, the accuracy rate can be calculated based on the false alarm rate f of the message wrong and the false negative rate f loss Sure.

[0127] For example, the switch can capture packets and count the total number of packets in the large flow as N. e , the total number of packets in the small flow is N m , where the number of marked packets in the large flow is N e ′, the number of marked packets in the small flow is N m ′, according to the definition of false alarm rate: the proportion of marked packets that should not be marked in the total data packets, and the definition of missed alarm rate: the proportion of unmarked packets that should be marked in the total data packets, the false alarm rate f can be obtained wrong and the false negative rate f loss :

[0128] f wrong =N m ′ / N m , f loss =(N e -N e ′) / N e .

[0129] Then, according to the accuracy f right The calculation method is: 1-(false alarm rate + missed alarm rate) / 2, we can get:

[0130] f right =1-(f wrong +f loss ) / 2

[0131] The underreporting can be understood as: not marking the marked large flow message. That is, the underreporting rate = the number of unmarked large flow messages / the total number of large flow messages.

[0132] False alarm can be understood as: a small flow message in a small flow is mistakenly marked as a large flow message. That is, false alarm rate = small flow messages mistakenly marked as large flow messages / total number of small flow messages.

[0133] Based on this, it can be understood that in the present application, λ1 is a threshold for marking a message, and when it is greater than λ1, the flow can be classified as a large flow candidate;

[0134] λ2 can be understood as the sampling rate of the message, which is set to the power of 2. The larger the λ2, the smaller the false alarm rate and the larger the missed alarm rate.

[0135] λ3 can be understood as the need to enter the second layer of filtering when the number of messages exceeds λ3. The larger the λ3 value, the smaller the false alarm rate and the larger the missed alarm rate.

[0136] λ4 can be understood as a threshold for marking messages. The larger the λ4 value is, the smaller the false alarm rate is and the larger the missed alarm rate is.

[0137] Accordingly, the present application provides two solutions for adjusting the third threshold λ4.

[0138] Solution 1: Initialization parameters: λ1=100, λ2=8, λ3=256, λ4=n.

[0139] 1) Assume that the packets of flow f from a certain service are known. After sampling and capturing the packets of flow f, calculate f right ;

[0140] 2) Given a threshold ε f ∈(1 / 2-1 / 2λ2, 1 / 2+1 / 2λ2),

[0141] If f right ≥ε f , or λ4=n / 2, λ4 remains unchanged, and the result returns to λ4;

[0142] If f right <ε f , the value of λ4 can be updated to: λ4=max(n / 2,(1-δ f )×λ4), where δ f ∈(0,0.5).

[0143] Then, we can return to 1) to continue execution. That is, if f right <ε f , you can use the new parameters to resample, identify and capture packets and calculate the new f right , to determine the updated λ4 again, until f right ≥ε f , or when λ4=n / 2, the adjustment is ended.

[0144] Solution 2: Initialization parameters: λ1=100, λ2=8, λ3=256, λ4=n.

[0145] 1) Assume that the packets of flow f from a certain service are known. After sampling and capturing the packets of flow f, calculate f right ;

[0146] 2) Given a threshold ε f ∈(0, 1 / 2λ2),

[0147] If f right ≤ε f , or λ4=n / 2, λ4 remains unchanged, and the result returns to λ4;

[0148] If f right >ε f , the value of λ4 can be updated to: λ4=max(n / 2,(1-δ f )×λ4), where δ f ∈(0,0.5).

[0149] Then, we can return to 1) to continue execution. That is, if f right <ε f , you can use the new parameters to resample, identify and capture packets and calculate the new f right , to determine the updated λ4 again, until f right ≥ε f , or when λ4=n / 2, the adjustment is ended.

[0150] In some embodiments, the present application may also refer to Solution 1 or Solution 2, input different training sample training parameters λ4 into the switch, and take the average of all training results as the final λ4 value.

[0151] The second method proposed in this application: the bitmap large flow identification method is further introduced below.

[0152] Embodiment 2

[0153] It should be understood that in the first embodiment of the present application, the large flow and small flow are identified by counting the messages of the target flow. The counter or register in the switch generally uses a 16-bit or 32-bit data structure for counting, which still occupies a certain amount of storage space of the register. It can be understood that in the present application, for a target flow, it is only necessary to query whether the target flow is a large flow or a small flow, and the specific size of the flow is not critical. Therefore, in theory, whether the target flow is a large flow or a small flow can be identified by 1 bit, for example, 0 represents a small flow and 1 represents a large flow. Since it is impossible to count the number of messages of the target flow, the way in which this 1 bit changes from 0 to 1 can be a probabilistic mark. In other words, when each message of a flow arrives at a communication device, it can be determined whether the message is to be marked as a large flow message according to a certain probability p. Statistically speaking, if a flow is large enough and the number of messages arriving at the communication device is large enough, then the flow will definitely be identified as a large flow.

[0154] Based on this theory, the present application embodiment provides a method for identifying a flow, such as Fig. 9 As shown, the method includes:

[0155] 901. Starting from the initial message of the target flow, the communication device performs N hash calculations based on the five-tuple in each received message to determine the N bits in the bit sequence of the result of the N hash calculations on each message, where the bit sequence is obtained by integrating according to the storage space of the communication device.

[0156] The bit sequence here is obtained by integrating the storage space of the communication device, which can be understood as the communication device integrating all the storage space of the communication device into a continuous bit sequence.

[0157] For generating a continuous bit sequence, the present application provides a generation method, but is not limited to this method.

[0158] In this method, it is assumed that the storage space consists of X data structures, each of which is Y bits, and the goal is to generate a bit sequence of size X*Y, which can be used for operation query. For example, there is a 4K table entry space in the communication device, and the table entries in the table entry space occupy 64 bits, then X=4000, Y=64, and a 4000*64 continuous bit sequence is obtained.

[0159] Based on this, the communication device performs N hash calculations based on the five-tuple in each received message, which can be understood as: N hash functions are preset in the communication device, for example, N is 3, 4 or 5, etc. The input (key) of each hash function is the five-tuple in the message, and the calculation result (value) after the hash calculation can be understood as the position in the bit sequence, thus obtaining N bit positions.

[0160] When the communication device receives each message in the target stream, it can perform N hash calculations on each message according to the N hash functions to obtain N hash calculation results. Then, the communication device can determine N different bits in the bit sequence according to the N hash calculation results.

[0161] In some embodiments, when determining the N bits in a bit sequence that are the result of performing N hash calculations on each message, if the value of the hash calculation result obtained for each message can be divided into two parts, one part of the value is mapped to 1~X to determine which data structure it is in, and the other part of the value is used to map to 1~Y to determine which bit in this data structure it is on.

[0162] The five-tuple includes the source IP, destination IP, source port number, destination port number and protocol number carried in the message.

[0163] Corresponding to step 901, refer to Fig.10 , assuming that the switch starts to receive packets of target flow f and performs calculations based on N hash functions. i represents the i-th hash function, with an initial value of 1 and a value range of 1 to N. g i The i in (f) represents the i-th hash function, g i (f) indicates that the packets in target stream f are calculated according to the i-th hash function. i [g i (f)] represents the hash function g i (f) Map the message in the target stream f to the bit value at the bit position, where the bit value is 0 or 1.

[0164] 902. The communication device determines bit values ​​corresponding to N bit positions respectively according to a probability calculation method corresponding to N bit positions respectively obtained by hash mapping of each message.

[0165] When it is determined that each message corresponds to N bits in the bit sequence, the bit value of the bit can be determined to be 0 or 1 according to the independent probability P of each bit. If the value of any bit in the N bits is already 1, the communication device may not perform any operation on the value of the bit. If the value of any bit in the N bits is 0, the communication device may update the value of the bit from 0 to 1.

[0166] For example, if it is determined by probability calculation that the value of the yth bit in the data structure needs to be updated from 0 to 1 (1≤y≤Y), then the data structure can be recorded with 2 to the power of y. For example, for the above 64-bit table entry, if the value of the 15th bit needs to be updated from 0 to 1, then this table entry needs to be increased by 2. 15= 32768 can meet the requirements.

[0167] According to Fig.10 the process in i [g i (f)] = 1? It means to judge whether the bit value calculated from the currently received packet according to the i-th hash function is 1. If C i [g i (f)] = 1, no processing is performed, and continue to calculate according to the next hash function, that is, execute i = i + 1. If C i [g i (f)] ≠ 1, it is necessary to calculate according to the probability P, and set the value of C i [g i (f)] to 0 or 1.

[0168] Then, continue to judge whether the value after probability calculation is 1, that is, continue to execute C i [g i (f)] = 1?, if the value after probability calculation is still 0, the packet is not marked. If the value after probability calculation is still 1, continue to calculate according to the next hash function, that is, execute i = i + 1.

[0169] At this time, judge i < m + 1?, which means whether it has been executed to the N-th hash function. m represents N. If it has been executed to the N-th hash function, if i < m + 1, continue to calculate the next hash function. If i ≥ m + 1, if the values of all N bit positions are 1, mark the packet as a large flow packet.

[0170] 903. When the communication device determines that the bit values of the N bit positions corresponding to the first packet of the target flow are all 1, mark the first packet as a large flow packet. When the communication device determines that the bit values of the N bit positions corresponding to the second packet of the target flow are not all 1, the second packet is not marked.

[0171] For example, when N is 3, if the values of the 3 bit positions obtained after 3 hash calculations based on the five-tuple of the first packet are all 1, the first packet is a large flow packet; if the values of the 3 bit positions obtained after 3 hash calculations based on the five-tuple of the second packet are not all 1, the second packet is not marked.

[0172] 904. When the communication device determines that network congestion occurs, update the forwarding rate of the first packet, and the updated forwarding rate is less than the forwarding rate before the update; or, when the communication device determines that network congestion occurs, discard the first packet.

[0173] The implementation method of this step is similar to step 706.

[0174] Therefore, when marking the message of the flow by the bit sequence, the present application constructs a continuous bit sequence, operates the bit sequence on the existing data structure, and uses the probability marking and multiple hashing methods to identify the large and small flows of the message. Compared with the use of hash tables, the utilization rate of the table space required for storage is more efficient, the upper limit of the number of flows that can be processed is also increased, and the recognition efficiency of large and small flows is better.

[0175] In order to further illustrate the beneficial effects brought by the second embodiment, the present application provides a marking ratio test model for illustration.

[0176] In this model, it is assumed that there are 400 large flows and 8000 small flows. The bit sequence in the communication device is 2K*16bit=32000bit.

[0177] Assuming that the probability of marking a message p=0.005 and the number of hashes N=5, the communication device can count all messages in the received flow and test the proportion of messages marked as large flow messages. The test results are shown in Table 2.

[0178] Table 2

[0179]

[0180] It can be seen from Table 2 that in large flows, the marking ratio of large flow packets is >80%, and in small flows, the marking ratio of large flow packets is <0.3%.

[0181] Therefore, the present application can use the bit sequence method to distinguish large and small flows under limited resources. For the identification of 8400 flows, only 32000 bits of space are used, and the average space used for each flow is less than 4 bits, and the identification effect is good.

[0182] It is understandable that, in order to implement the above functions, the communication device includes hardware and / or software modules corresponding to the execution of each function. In combination with the algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application in combination with the embodiments, but such implementation should not be considered to be beyond the scope of the present application.

[0183] In this embodiment, the communication device can be divided into functional modules according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0184] In the case of dividing each functional module into corresponding functional modules, Fig.11 A possible schematic diagram of the composition of the communication device 110 involved in the above embodiment is shown. Fig.11 As shown, the communication device 110 may include: a counting unit 1101 , a marking unit 1102 , a congestion processing unit 1103 and an updating unit 1104 .

[0185] The counting unit 1101 may be used to support the communication device 110 in executing the above-mentioned steps 701 and 703, etc., and / or other processes of the technology described herein.

[0186] The marking unit 1102 may be used to support the communication device 110 to execute the above-mentioned steps 702 , 704 , etc., and / or other processes for the technology described herein.

[0187] The congestion processing unit 1103 may be configured to support the communication device 110 in executing the above steps 705 , 706 , etc., and / or other processes for the technology described herein.

[0188] The updating unit 1104 may be configured to support the communication device 110 to perform the above-mentioned step 707 and the like, and / or other processes for the technology described herein.

[0189] It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0190] The communication device 110 provided in this embodiment is used to execute the above-mentioned method for identifying a flow, and thus can achieve the same effect as the above-mentioned implementation method.

[0191] In the case of using an integrated unit, the communication device 110 may include a processing module, a storage module and a communication module. The processing module may be used to control and manage the actions of the communication device 110, for example, it may be used to support the communication device 110 in executing the steps performed by the counting unit 1101, the marking unit 1102, the congestion processing unit 1103 and the updating unit 1104. The storage module may be used to support the communication device 110 in storing program codes and data, etc. The communication module may be used to support the communication device 110 in communicating with other devices, for example, communicating with a terminal device and receiving messages from the terminal device.

[0192] Among them, the processing module can be a processor or a controller. It can implement or execute various exemplary logic boxes, modules and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc. The storage module can be a memory. The communication module can specifically be a device that interacts with other electronic devices, such as a radio frequency circuit, a Bluetooth chip, a Wi-Fi chip, etc.

[0193] In one embodiment, when the processing module is a processor, the storage module is a memory, and the communication module is a transceiver, the electronic device involved in this embodiment may be a Fig.12 A switch with the structure shown.

[0194] In the case of dividing each functional module into corresponding functional modules, Fig.13 A possible schematic diagram of the composition of the communication device 130 involved in the above embodiment is shown. Fig.13 As shown, the communication device 130 may include: a bit position determining unit 1301 , a bit value determining unit 1302 , a marking unit 1303 and a congestion processing unit 1304 .

[0195] The bit determination unit 1301 may be used to support the communication device 130 in executing the above step 901 and / or other processes of the technology described herein.

[0196] The bit value determining unit 1302 may be configured to support the communication device 130 in executing the above step 902 and / or other processes for the technology described herein.

[0197] The marking unit 1303 may be used to support the communication device 130 to execute the above-mentioned step 903 and / or other processes of the technology described herein.

[0198] The congestion processing unit 1304 may be configured to support the communication device 130 in executing the above-mentioned step 904 and / or other processes for the technology described herein.

[0199] It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0200] The communication device 130 provided in this embodiment is used to execute the above-mentioned method for identifying a flow, and thus can achieve the same effect as the above-mentioned implementation method.

[0201] In the case of adopting an integrated unit, the communication device 130 may include a processing module, a storage module and a communication module. Among them, the processing module can be used to control and manage the actions of the communication device 130, for example, it can be used to support the communication device 130 to execute the above-mentioned bit determination unit 1301, bit value determination unit 1302, marking unit 1303 and congestion processing unit 1304. The steps of execution. The storage module can be used to support the communication device 130 to store program codes and data, etc. The communication module can be used to support the communication device 130 to communicate with other devices, such as communicating with terminal devices and receiving messages from terminal devices.

[0202] The processing module may be a processor or a controller. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like. The storage module may be a memory. The communication module may specifically be a device that interacts with other electronic devices, such as a radio frequency circuit, a Bluetooth chip, a Wi-Fi chip, etc.

[0203] In one embodiment, when the processing module is a processor, the storage module is a memory, and the communication module is a transceiver, the communication device 130 involved in this embodiment may also be a device having Fig.12 A switch with the structure shown.

[0204] The embodiment of the present application also provides an electronic device, including one or more processors and one or more memories. The one or more memories are coupled to the one or more processors, and the one or more memories are used to store computer program codes, and the computer program codes include computer instructions. When the one or more processors execute the computer instructions, the electronic device executes the above-mentioned related method steps to implement the method for identifying a flow in the above-mentioned embodiment.

[0205] An embodiment of the present application further provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed on an electronic device, the electronic device executes the above-mentioned related method steps to implement the method for identifying a flow in the above-mentioned embodiment.

[0206] The embodiments of the present application also provide a computer program product. When the computer program product is run on a computer, the computer is caused to execute the above-mentioned related steps to implement the method for identifying a flow executed by the electronic device in the above-mentioned embodiment.

[0207] In addition, an embodiment of the present application also provides a device, which can specifically be a chip, a component or a module, and the device may include a connected processor and a memory; wherein the memory is used to store computer-executable instructions, and when the device is running, the processor can execute the computer-executable instructions stored in the memory to enable the chip to execute the method of sky recognition flow executed by the electronic device in the above-mentioned method embodiments.

[0208] Among them, the communication equipment, computer-readable storage medium, computer program product or chip provided in this embodiment are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0209] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0210] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0211] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0212] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0213] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0214] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for identifying a flow, characterized in that: include: receiving a first message, where the first message belongs to a first flow; Performing N hash calculations on the quintuple of the first message to obtain N calculation results corresponding to the N hash calculations, respectively, the N calculation results corresponding to N bits in the bit sequence, where N is an integer greater than 1; Determine values ​​corresponding to the N bits according to probability calculation methods corresponding to the N bits respectively; Determine whether the value corresponding to the bit obtained by the i-th hash calculation of the first message is a specified value. If it is a specified value, determine whether the value corresponding to the bit obtained by the i+1-th hash calculation of the first message is a specified value, where i is an integer greater than zero; When i≥N+1 and the values ​​corresponding to the N bits are all specified values, the first message is marked as a large flow message.

2. The method according to claim 1, characterized in that The method further comprises: recording the first stream; Other messages belonging to the first flow are marked as large-flow messages.

3. The method according to claim 1 or 2, characterized in that: The bit sequence is obtained by integrating according to the storage space.

4. The method according to claim 1, characterized in that: The performing N hash calculations on the quintuple of the first message includes: A hash calculation is performed on each of the five-tuples of the first message according to N different hash functions.

5. The method according to claim 1, characterized in that Also includes: When any one of the values ​​corresponding to the N bits is not the specified value, the first message is not marked.

6. The method according to claim 1, characterized in that Also includes: When network congestion occurs, updating the forwarding rate of the first flow, wherein the updated forwarding rate is less than the forwarding rate before the update; or When network congestion occurs, the first message is discarded.

7. A device for identifying a flow, characterized in that: include: A communication module, configured to receive a first message, wherein the first message belongs to a first flow; Processing modules for: Performing N hash calculations on the quintuple of the first message to obtain N calculation results corresponding to the N hash calculations, respectively, the N calculation results corresponding to N bits in the bit sequence, where N is an integer greater than 1; Determine values ​​corresponding to the N bits according to probability calculation methods corresponding to the N bits respectively; Determine whether the value corresponding to the bit obtained by the i-th hash calculation of the first message is a specified value. If it is a specified value, determine whether the value corresponding to the bit obtained by the i+1-th hash calculation of the first message is a specified value, where i is an integer greater than zero; When i≥N+1 and the values ​​corresponding to the N bits are all specified values, the first message is marked as a large flow message.

8. The device according to claim 7, characterized in that The processing module is also used for: recording the first stream; Other messages belonging to the first flow are marked as large-flow messages.

9. The device according to claim 7 or 8, characterized in that The bit sequence is obtained by integrating according to the storage space.

10. The device according to claim 7, characterized in that When performing N hash calculations on the quintuple of the first message, the processing module is used to: A hash calculation is performed on each of the five-tuples of the first message according to N different hash functions.

11. The device according to claim 7, characterized in that The processing module is also used for: When any one of the values ​​corresponding to the N bits is not the specified value, the first message is not marked.

12. The device according to claim 7, characterized in that The processing module is also used for: When network congestion occurs, updating the forwarding rate of the first flow, wherein the updated forwarding rate is less than the forwarding rate before the update; or When network congestion occurs, the first message is discarded.

13. A computer-readable storage medium, characterized in that: The method comprises computer instructions, which, when executed on an electronic device, cause the electronic device to execute the method according to any one of claims 1 to 6.

Images