A method, system, and apparatus for network traffic data classification

Abstract

This application provides a method, system, and device for classifying network traffic data. The method includes: capturing network traffic data from a network device; processing the network traffic data based on a preset first rule before storage to obtain formatted first summary data, wherein the first summary data includes at least basic information about the network traffic data; and classifying the network traffic data based on the first summary data. This method uses summary data of network traffic data instead of the actual network traffic data for classification, significantly reducing the amount of data to be processed and improving processing efficiency.

Description

Technical Field

[0001] This application relates to the field of computer network traffic data processing technology, and in particular to a technology for classifying network traffic data. Background Technology

[0002] Network traffic data is the total number of data packets passing through a network link per unit of time. With the development of the Internet, the scale of network traffic data generated by various networked devices is increasing. In order to meet regulatory compliance and / or internal management needs, some enterprises need to monitor, analyze, and classify the network traffic data in their network systems to a certain extent.

[0003] A significant proportion of network traffic data generated by typical enterprise network systems is not valuable for analysis: this portion of network traffic data does not involve sensitive operations or contain information that could cause network anomalies, and therefore will not generate much value in subsequent network traffic data analysis.

[0004] Since network traffic data is often captured from network devices, network traffic data without analytical value is often transmitted in the network mixed with other network traffic data with analytical value. In the current technology, the analysis speed of network traffic data often cannot match the network traffic data collection speed. In order to avoid data backlog and data loss due to the inability to analyze network traffic data in a timely manner, all the collected network traffic data is often stored first, and then the stored network traffic data is analyzed and classified. This results in low efficiency in processing network traffic data. Summary of the Invention

[0005] The purpose of this application is to provide a method, system, and device for classifying network traffic data, so as to at least partially solve the technical problem of low efficiency in network traffic data analysis in the prior art.

[0006] According to one aspect of this application, a method for classifying network traffic data is provided, wherein the method includes:

[0007] Capture network traffic data from network devices;

[0008] Before the network traffic data is stored, the network traffic data is processed based on a preset first rule to obtain formatted first summary data, wherein the first summary data includes at least the basic information of the network traffic data;

[0009] Based on the first summary data, the network traffic data is classified.

[0010] Optionally, the capture of network traffic data flowing through network devices includes:

[0011] Capture bypass traffic data that is identical to the network traffic data of the network device.

[0012] Optionally, the basic information includes at least the IP address, port, protocol type, and storage location of one or more data packets in the network traffic data.

[0013] Optionally, the classification of the network traffic data based on the first summary data includes:

[0014] Perform data analysis on the first summary data to obtain the first analysis result;

[0015] Based on the first analysis results, the network traffic data is classified.

[0016] Optionally, the method for classifying network traffic data further includes:

[0017] Based on one or more different preset second rules, the first summary data is expanded to obtain one or more different formatted second summary data;

[0018] Based on each second summary data, the network traffic data is classified.

[0019] Optionally, the method for classifying network traffic data further includes:

[0020] The first summary data and one or more different second summary data are merged to obtain formatted third summary data;

[0021] Based on the third summary data, the network traffic data is classified.

[0022] Optionally, the method for classifying network traffic data further includes:

[0023] Based on the results of classifying the network traffic data, the stored network traffic data is classified and processed.

[0024] According to another aspect of this application, a system for classifying network traffic data is provided, wherein the system comprises:

[0025] The first module is used to capture network traffic data from network devices;

[0026] The second module is used to process the network traffic data based on a preset first rule before the network traffic data is stored, to obtain formatted first summary data, wherein the first summary data includes at least the basic information of the network traffic data;

[0027] The third module is used to classify the network traffic data based on the first summary data.

[0028] Optionally, the system for classifying network traffic data further includes:

[0029] The fourth module is used to expand the first summary data based on one or more different preset second rules to obtain one or more different formatted second summary data.

[0030] The third module is further configured to classify the network traffic data based on each second summary data.

[0031] Optionally, the system for classifying network traffic data further includes:

[0032] The fifth module is used to merge the first summary data and one or more different second summary data to obtain formatted third summary data;

[0033] The third module is further configured to classify the network traffic data based on the third summary data.

[0034] Optionally, the system for classifying network traffic data further includes:

[0035] The sixth module is used to classify the stored network traffic data according to the results of classifying the network traffic data.

[0036] Compared with existing technologies, this application provides a method, system, and device for classifying network traffic data. The method includes: capturing network traffic data from network devices; processing the network traffic data based on a preset first rule before storage to obtain formatted first summary data, wherein the first summary data includes at least basic information about the network traffic data; and classifying the network traffic data based on the first summary data. This method uses summary data of network traffic data instead of the actual network traffic data for classification, which significantly reduces the amount of data to be processed and improves processing efficiency. Attached Figure Description

[0037] Other features, objects, and advantages of the invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0038] Figure 1 A schematic flowchart of a method for classifying network traffic data according to one aspect of this application is shown.

[0039] Figure 2 The diagram shown is a formatted data structure diagram of first summary data according to an optional embodiment of one aspect of this application;

[0040] Figure 3 This diagram illustrates a system for classifying network traffic data according to another aspect of this application;

[0041] The same or similar reference numerals in the accompanying drawings represent the same or similar parts. Detailed Implementation

[0042] The present invention will now be described in further detail with reference to the accompanying drawings.

[0043] In a typical configuration of various embodiments of this application, each trusted party of the device, system and / or each module of the apparatus may include one or more processors (CPU), input / output interfaces, network interfaces and memory.

[0044] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0045] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include non-transitory computer-readable media, such as modulated data signals and carrier waves.

[0046] In existing technologies, various network devices accessing an enterprise network system typically need to go through network devices to communicate with various business servers. Therefore, all network traffic data can be collected and stored on network devices.

[0047] Enterprise network administrators typically use data analysis programs that meet different requirements to analyze stored network traffic data based on actual needs. Then, they classify and process the stored network traffic data according to the analysis results. Because it is a full data analysis, and a large proportion of network traffic data is data without analytical value, the processing efficiency of existing methods is low.

[0048] To further illustrate the technical means adopted and the effects achieved in this application, the technical solution of this application will be clearly and completely described below in conjunction with the accompanying drawings and preferred embodiments.

[0049] Figure 1 The diagram illustrates a method flow chart for classifying network traffic data according to one aspect of this application, wherein one embodiment of the method includes:

[0050] S101 captures network traffic data from network devices;

[0051] S102 Before the network traffic data is stored, the network traffic data is processed based on a preset first rule to obtain formatted first summary data, wherein the first summary data includes at least the basic information of the network traffic data;

[0052] S103 Based on the first summary data, classify the network traffic data.

[0053] The various method embodiments of this application can be implemented or executed by device 100, which can be a bastion host capable of capturing network traffic data from network devices, or other computer devices capable of capturing network traffic data from network devices. The computer devices include, but are not limited to, personal computers, laptops, industrial computers, servers, network hosts, single network servers, or network server clusters. Here, the computer devices are merely examples; other existing or future devices and / or resource platforms that are applicable to this application should also be included within the scope of protection of this application, and are hereby incorporated by reference.

[0054] In this embodiment, in step S101, device 100 can capture all network traffic data passing through the network device. Capturing network traffic data refers to collecting network IP data packets.

[0055] Optionally, in step S101, capturing network traffic data flowing through network devices includes:

[0056] Capture bypass traffic data that is identical to the network traffic data of the network device.

[0057] To avoid affecting the normal operation of network devices, device 100 can capture bypass traffic data that is identical to the network traffic data of the network devices, that is, capture network traffic data passing through the network devices in a bypass manner. One common method for capturing bypass traffic data of network devices includes: capturing network traffic data flowing through the network ports of the network devices and being mirrored to the mirror ports through the mirror ports of the network devices, i.e., network IP data packets.

[0058] Alternatively, other existing methods can be used to capture network traffic data passing through network devices, which will not be elaborated here.

[0059] Continuing in this embodiment, in step S102, before the captured network traffic data is stored, the device 100 processes the network traffic data according to a pre-set first rule to obtain formatted first summary data, wherein the first summary data includes at least the basic information of the network traffic data.

[0060] The first rule can be configured according to the requirements of the actual application scenario, and can be applied to a single data packet or all data packets within a certain time period. Based on the pre-set first rule, the captured network traffic data is processed to obtain a formatted first digest of a specific data packet or all data packets within a certain time period. This first digest is stored and used as a binary stream. The first digest includes basic information about the specific data packet or all data packets within a certain time period extracted from the network traffic data.

[0061] Optionally, the basic information includes at least the IP address, port, protocol type, and storage location of one or more data packets in the network traffic data.

[0062] The summary data in this application includes several formatted fields (similar to a database data structure), which include two types: pre-defined fields and extended fields. An example formatted data structure for the first summary data is as follows: Figure 2As shown, pre-defined fields are configured as read-only attributes. Each pre-defined field includes attributes such as identifier (ID), name, parameter value, and creation time. After the summary data is generated, the parameter values ​​of pre-defined fields cannot be modified. Extended fields, on the other hand, can be added to the summary data as needed for specific application scenarios. The read / write attributes of extended fields can be pre-configured according to specific application scenarios. Each extended field includes attributes such as identifier (ID), name, parameter value, read / write (e.g., 1 for read-only, 0 for writable), and owner. The parameter values ​​of extended fields can be modified or not, depending on the application scenario when adding them. For newly added extended fields, different adders are pre-assigned field IDs within different ranges, avoiding conflicts in extended field creation at the source. Furthermore, each extended field has an unmodifiable owner attribute.

[0063] The formatted fields of the first summary data include pre-defined fields. Based on a pre-set first rule, basic information extracted from the captured network traffic data serves as the parameter values ​​for the corresponding pre-defined fields in the first summary data. This includes at least the IP address, port, protocol type, and storage location of one or more data packets from the captured network data. If there are multiple data packets, the IP address, port, protocol type, and storage location may differ for each packet.

[0064] Network traffic data is typically stored by accumulating a certain amount of data, such as a data block, before storing it in blocks. The storage location of the network traffic data corresponding to that block is determined only after the captured network traffic data reaches a certain size. Therefore, obtaining the storage location of the relevant network traffic data requires interaction with the service providing network traffic data storage. In this application, the generation of formatted first digest data based on a preset first rule and the storage of relevant network traffic data can be considered as parallel processes. For example, assuming a data block size is set to 20MB, when the captured network traffic data accumulates to 20MB, its storage location is determined. This 20MB of network traffic data is simultaneously handed over to the storage service and the digest data generation service for separate processing to complete the storage of the network traffic data and the generation of the formatted first digest data. The storage location in the first digest data can be directly used to locate the network traffic data stored at that location.

[0065] The formatted fields of the first summary data may also include extended fields. Specifically, based on pre-set first rules related to specific application scenarios, relevant business information is extracted from the captured network traffic data and used as parameter values ​​for the corresponding extended fields in the first summary data. For example, packet information related to DoS (Denial of Service) attacks extracted from network traffic data can be used as parameter values ​​for the corresponding extended fields.

[0066] In addition, the basic information of the preset summary data is also a pre-defined field.

[0067] Continuing in this embodiment, in step S103, device 100 classifies the captured corresponding network traffic data based on the first summary data.

[0068] Optionally, the classification of the network traffic data based on the first summary data includes:

[0069] Perform data analysis on the first summary data to obtain the first analysis result;

[0070] Based on the first analysis results, the network traffic data is classified.

[0071] Specifically, depending on the actual application scenario, a corresponding data analysis program can be used to analyze the generated first summary data to obtain a first analysis result. Then, based on the first analysis result, the network traffic data corresponding to the first summary data can be classified.

[0072] For example, if we want to focus on the total amount of uplink and downlink network data generated in an enterprise network, we only need to extract the total number of bytes of all data packets within a certain period of time, as well as the IP address, port, protocol type, storage location, and other information of each data packet from the captured network traffic data according to the pre-configured first preset rule, to generate first summary data. Then, we use the corresponding data analysis program to directly perform relevant data analysis and calculation operations on the first summary data to obtain the first analysis result. Finally, based on the first analysis result, we classify the relevant network traffic data according to the classification rules for the total amount of data.

[0073] By using steps S101 to S103 of this embodiment, summary data of network traffic data is used to replace network traffic data for classifying network traffic data, which can greatly reduce the amount of data to be processed and improve processing efficiency.

[0074] Optionally, the method for classifying network traffic data further includes:

[0075] Based on one or more different preset second rules, the first summary data is expanded to obtain one or more different formatted second summary data;

[0076] Based on each second summary data, the network traffic data is classified.

[0077] In real-world applications, different business processes have different focuses. For example, network security businesses are more sensitive to data related to network anomalies and DoS attacks, while network data statistics businesses may be more concerned with various statistical information. Therefore, different dimensions of focus lead to different emphases on the content of summary data. Depending on the specific application scenario, the summary data used for data analysis also varies. For instance, in security, security analysts use relevant data analysis programs to analyze security-related summary data. Based on the analysis results, they can identify which traffic generated security events, classify this traffic as abnormal traffic, and then further categorize this abnormal traffic according to pre-set security event classification rules.

[0078] In this way, according to the needs of different actual application scenarios, the second rule corresponding to each actual application scenario can be pre-configured to expand the generated first summary data, add extended fields, and obtain the formatted second summary data with the same data structure as the first summary data.

[0079] Continuing with the above example, based on the first summary data, a corresponding extended field can be added according to the pre-configured second rule related to the total amount of network data, and the relevant data in the first analysis result can be used as the parameter value of the newly added extended field to obtain a second summary data related to the total amount of network data.

[0080] Another example is to assume that security analysis of network traffic data is required. Then, a corresponding data analysis program is used to perform data analysis and calculation on the first summary data, count the different ports accessed by a certain source IP address and their number, and then add corresponding extended fields to the first summary data according to the pre-configured second rules related to network data security. The above statistical results are used as the parameter values ​​of the newly added extended fields to obtain a second summary data related to network data security.

[0081] Then, the corresponding data analysis program is used to analyze the second summary data to obtain the second data analysis results. Based on the second analysis results, the corresponding network traffic data is classified.

[0082] Optionally, the method for classifying network traffic data further includes:

[0083] The first summary data and one or more different second summary data are merged to obtain formatted third summary data;

[0084] Based on the third summary data, the network traffic data is classified.

[0085] The first and second summary data can be merged to obtain a new, formatted third summary data. Then, a corresponding data analysis program is used to analyze the third summary data, yielding a third data analysis result. Based on this result, the corresponding network traffic data is then classified. When merging extended fields, a pre-assigned field ID is used for reference. If the field ID of a merged extended field does not match the pre-assigned field ID range, that extended field will be ignored (i.e., the owner of an extended field in the merged summary data must have an added extended field in another summary data for the merge to be successful).

[0086] The above embodiments and / or optional embodiments of this application provide a method for classifying network traffic data. It can be freely combined with the needs of specific application scenarios to expand the summary data generated based on the captured network traffic data, and then use a data analysis program adapted to the needs of the specific application scenario to perform data analysis. Then, the network traffic data is classified and managed according to the analysis results, which greatly reduces the amount of data processing and improves processing efficiency.

[0087] Optionally, the method for classifying network traffic data further includes:

[0088] Based on the results of classifying the network traffic data, the stored network traffic data is classified and processed.

[0089] This process involves classifying network traffic data based on the classification results, locating the storage location of different categories of network traffic data through pre-defined fields in the summary data, and then classifying the stored network traffic data accordingly. For example, based on the level of analytical value, network traffic data with little or no analytical value (e.g., network traffic data that did not generate anomalies, alarms, or other critical events, and is unlikely to be used for further analysis) can be stored separately from network traffic data with high analytical value (e.g., network traffic data with little or no analytical value is stored on cheaper storage media, while network traffic data with high analytical value can be stored on faster access media). Different storage time limits can also be adjusted (e.g., network traffic data with little or no analytical value does not need to be stored for a long time, while network traffic data with high analytical value needs to be stored for a longer time). This improves the access efficiency of network traffic data with high analytical value, increases storage space turnover, and reduces storage costs.

[0090] Figure 3 The diagram illustrates a system for classifying network traffic data according to another aspect of this application, wherein, in one embodiment, the system includes:

[0091] The first module 310 is used to capture network traffic data of network devices;

[0092] The second module 320 is used to process the network traffic data based on a preset first rule before the network traffic data is stored, to obtain formatted first summary data, wherein the first summary data includes at least the basic information of the network traffic data.

[0093] The third module 330 is used to classify the network traffic data based on the first summary data.

[0094] In this embodiment, the system is deployed or integrated in the device 100 that performs the foregoing method embodiments and / or optional embodiments.

[0095] In this embodiment, the first module 310 of the system can capture network traffic data flowing through network devices. To avoid affecting the normal operation of the network devices, it can capture bypass traffic data identical to the network traffic data of the network devices; that is, it uses a bypass method to capture network traffic data passing through the network devices. A common method for capturing bypass traffic data from network devices includes capturing network traffic data flowing through and mirrored to the network port of the network device via its mirror port, i.e., network IP data packets. The first module 310 can also capture network traffic data passing through network devices using other existing methods, which will not be elaborated upon here.

[0096] Continuing in this embodiment, before the captured network traffic data is stored, the second module 320 of the system processes the network traffic data according to a pre-set first rule to obtain formatted first summary data, wherein the first summary data includes at least the basic information of the network traffic data.

[0097] The first rule can be configured according to the requirements of the actual application scenario, and can be applied to a single data packet or all data packets within a certain time period. Based on the pre-set first rule, the captured network traffic data is processed to obtain a formatted first digest of a specific data packet or all data packets within a certain time period. This first digest is stored and used as a binary stream. The first digest includes basic information about the specific data packet or all data packets within a certain time period extracted from the network traffic data.

[0098] Continuing in this embodiment, the third module 330 of the system classifies the captured network traffic data based on the first summary data. Specifically, depending on the actual application scenario, a corresponding data analysis program can be used to analyze the generated first summary data, obtain a first analysis result, and then classify the network traffic data corresponding to the first summary data based on the first analysis result.

[0099] Optionally, the system for classifying network traffic data further includes:

[0100] The fourth module 340 (not shown) is used to expand the first summary data based on one or more different preset second rules to obtain one or more different formatted second summary data.

[0101] The third module 330 is further configured to classify the network traffic data based on each second summary data.

[0102] Specifically, according to the needs of different practical application scenarios, the fourth module 340 of the system can pre-configure the second rule corresponding to each practical application scenario, expand the generated first summary data, add extended fields, and obtain the formatted second summary data with the same data structure as the first summary data.

[0103] The third module 330 of the system then uses a corresponding data analysis program to perform data analysis on the second summary data, obtain the second data analysis results, and then classify the corresponding network traffic data based on the second analysis results.

[0104] Optionally, the system for classifying network traffic data further includes:

[0105] The fifth module 350 (not shown) is used to merge the first digest data and one or more different second digest data to obtain formatted third digest data;

[0106] The third module 330 is further configured to classify the network traffic data based on the third summary data.

[0107] The fifth module 350 of the system can merge the first summary data and the second summary data to obtain a new formatted third summary data. If it is to merge extended fields, it will first refer to the pre-assigned field ID for judgment. If the field ID of a certain extended field to be merged does not match the pre-assigned field ID range, the extended field will be ignored (that is, the owner of the extended field in the merged summary data must have an added extended field in another summary data for it to be successfully merged).

[0108] The third module 330 of the system then uses a corresponding data analysis program to perform data analysis on the third summary data, obtain the third data analysis results, and then classify the corresponding network traffic data based on the third analysis results.

[0109] Optionally, the system for classifying network traffic data further includes:

[0110] The sixth module 360 ​​(not shown) is used to classify the stored network traffic data according to the results of classifying the network traffic data.

[0111] The sixth module 360 ​​of the system can locate the storage location of different categories of network traffic data based on the classification results obtained by classifying network traffic data and the storage location of network traffic data recorded in the pre-defined fields of the summary data, and then classify the stored network traffic data.

[0112] In the various embodiments and / or optional embodiments of the above system, the parts of the method steps executed by each module of the system that are not mentioned are the same as those in the aforementioned related method embodiments and / or optional embodiments, and will not be repeated here.

[0113] According to another aspect of this application, a computer-readable medium is also provided, the computer-readable medium storing computer-readable instructions that can be executed by a processor to implement the foregoing method embodiments.

[0114] It should be noted that the method embodiments and / or optional embodiments in this application do not strictly limit the order of execution of each step, as long as the method embodiments and / or optional embodiments can solve the defects existing in the prior art, achieve the inventive purpose of this application, and obtain beneficial effects. The method embodiments and / or optional embodiments in this application can be implemented in software and / or combinations of software and hardware. The software program involved in this application can be executed by a processor to implement the steps or functions of the above embodiments. Similarly, the software program of this application (including related data structures) can be stored in a computer-readable recording medium.

[0115] Furthermore, part or all of this application can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to this application through the operation of the computer. The program instructions invoking the methods of this application may be stored in a fixed or removable recording medium, and / or transmitted via data streams in broadcast or other signal carrying media, and / or stored in the working memory of a computer device operating according to the program instructions.

[0116] According to another aspect of this application, an apparatus for classifying network traffic data is also provided. The apparatus includes: a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, the apparatus is triggered to run the methods and / or technical solutions of the foregoing embodiments.

[0117] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered illustrative and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be embraced within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims. Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices recited in the apparatus claims may also be implemented by a single unit or device through software and / or hardware. The terms "first," "second," etc., are used to indicate names and do not indicate any particular order.

Claims

1. A method for network traffic data classification, characterized by, The method includes: Capture network traffic data from network devices; Before the network traffic data is stored, the network traffic data is processed based on a preset first rule to obtain formatted first summary data. The first summary data includes at least the basic information of the network traffic data, which includes at least the IP address, port, protocol type and storage location of one or more data packets in the network traffic data. Based on the first summary data, the network traffic data is classified; Based on the results of classifying the network traffic data, the stored network traffic data is further classified, wherein the classification process includes: separating the network traffic data according to their analytical value and adjusting different storage time limits.

2. The method according to claim 1, characterized in that, The captured network traffic data flowing through network devices includes: Capture bypass traffic data that is identical to the network traffic data of the network device.

3. The method according to claim 1, characterized in that, The classification of the network traffic data based on the first summary data includes: Perform data analysis on the first summary data to obtain the first analysis result; Based on the first analysis results, the network traffic data is classified.

4. The method according to claim 1, characterized in that, The method further includes: Based on one or more different preset second rules, the first summary data is expanded to obtain one or more different formatted second summary data; Based on each second summary data, the network traffic data is classified.

5. The method according to claim 4, characterized in that, The method further includes: The first summary data and one or more different second summary data are merged to obtain formatted third summary data; Based on the third summary data, the network traffic data is classified.

6. A system for classifying network traffic data, characterized in that, The system includes: The first module is used to capture network traffic data from network devices; The second module is used to process the network traffic data based on a preset first rule before the network traffic data is stored, and obtain formatted first summary data. The first summary data includes at least the basic information of the network traffic data, and the basic information includes at least the IP address, port, protocol type and storage location of one or more data packets in the network traffic data. The third module is used to classify the network traffic data based on the first summary data; The sixth module is used to classify the stored network traffic data according to the results of classifying the network traffic data. The classification process includes: storing the network traffic data separately according to the level of analytical value and adjusting different storage time limits.

7. The system according to claim 6, characterized in that, The system also includes: The fourth module is used to expand the first summary data based on one or more different preset second rules to obtain one or more different formatted second summary data. The third module is further configured to classify the network traffic data based on each second summary data.

8. The system according to claim 7, characterized in that, The system also includes: The fifth module is used to merge the first summary data and one or more different second summary data to obtain formatted third summary data; The third module is further configured to classify the network traffic data based on the third summary data.

9. A computer-readable medium, characterized in that, It stores computer-readable instructions that are executed by a processor to implement the method as described in any one of claims 1 to 5.

10. A device for classifying network traffic data, characterized in that, The device includes: One or more processors; and A memory storing computer-readable instructions, which, when executed, cause the processor to perform the operations of the method as described in any one of claims 1 to 5.

Images