A causal inference method and system for video multi-modal traffic

Abstract

The application relates to the field of network security and management, and provides a causal reasoning method and system for video multi-modal traffic. The method comprises the following steps: preprocessing original network traffic data to obtain traffic data sequences; setting threshold conditions of video streams based on the traffic data sequences, and identifying the video streams; determining the correlation between the video streams and other related streams by adopting time similarity measurement weights, to obtain a preliminary core traffic set meeting the conditions; based on the preliminary core traffic set, the independence of the video streams and other related streams is tested by adopting conditional independence, to obtain a core traffic set; based on the core traffic set, video traffic features are extracted, the causal relationship between a live broadcast scene and the video traffic features in structure and parameters is analyzed, the live broadcast scene is reasoned, and the label of the live broadcast scene is obtained.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security and management, and particularly relates to a causal reasoning method and system for video multi-modal traffic. BACKGROUND

[0002] The statements in this section merely provide background information related to the present application and do not necessarily constitute the prior art.

[0003] At present, the quality of video content is uneven, and some of them deliver harmful video information. For example, some game videos may carry violent, pornographic and other content, thereby affecting the healthy growth of minors. Therefore, video traffic identification has become an important research hotspot in the field of network security and management.

[0004] Traditional traffic identification is mostly based on port and deep packet inspection (DPI) technology. However, due to the wide application of dynamic port technology and encryption technology, these two methods are not suitable for video traffic identification.

[0005] Most existing video traffic identification researches are to build video fingerprints for identification. The basic process is to extract effective fingerprints of specific videos through Variable Bit Rate (VBR) encoding, and then apply machine learning algorithms to identify video traffic. However, video traffic identification based on fingerprint matching has obvious limitations. First, a fingerprint database must be established to contain all fingerprints of target videos, which brings scalability problems in practical applications. Second, most existing works target at identifying video titles, and cannot further infer the category of the video based on the fingerprints.

[0006] In addition, most existing video traffic identification methods only focus on video streams and do not care about other related data streams, such as text related to videos, without identifying video streams from the perspective of multi-modal traffic. Although the existing traffic identification methods can process and analyze video traffic to some extent, they often lack or have errors in causal relationships, resulting in inaccuracy of analysis results.

[0007] In summary, the current research on video traffic analysis and identification still has the following shortcomings: with the wide application of encryption technology, traditional DPI methods are no longer suitable for video traffic identification. Emerging methods also have the defects of low scalability, less identified information, ignoring other related data streams, ignoring and missing the causal relationship between data streams, and not analyzing video streams from the perspective of multi-modal traffic. SUMMARY

[0008] To solve the technical problems in the background art, the application provides a causal inference method and system for video multi-modal traffic, which identifies video streams from real-time flow sessions and proposes the concept of a core traffic set for analyzing the causal relationship between video streams and other related streams.

[0009] To achieve the above-mentioned purpose, the application adopts the following technical solutions:

[0010] The first aspect of the application provides a causal inference method for video multi-modal traffic.

[0011] A causal inference method for video multi-modal traffic comprises:

[0012] The obtained raw network traffic data is preprocessed to obtain a traffic data sequence;

[0013] Based on the traffic data sequence, a threshold condition of the video stream is set to identify the video stream;

[0014] A time similarity measurement weight is used to determine the correlation between the video stream and other related streams to obtain a preliminary core traffic set that meets the condition; based on the preliminary core traffic set, conditional independence is used to test the independence of the video stream and other related streams to obtain a core traffic set;

[0015] Based on the core traffic set, video traffic features are extracted, and the causal relationship between the live streaming scene and the video traffic features in structure and parameters is analyzed to infer the live streaming scene and obtain the label of the live streaming scene.

[0016] Further, the process of obtaining the traffic data sequence comprises:

[0017] The raw network traffic data is filtered, and the number of bits per second is calculated to obtain a BPS sequence;

[0018] The BPS sequence is converted into an ADU sequence, i.e., a traffic data sequence.

[0019] Further, the threshold condition comprises:

[0020] Condition 1: obtaining a retrieval manifest file request of a video, an audio segment request, and a video segment request;

[0021] Condition 2: the average packet load of the video stream is greater than a set video packet threshold;

[0022] Condition 3: the flow rate of the video stream is greater than a set video flow rate threshold.

[0023] Further, the process of using a time similarity measurement weight to determine the correlation between the video stream and other related streams uses the following formula:

[0024]

[0025] wherein respectively represent the start time of two flows, the smaller the difference of the start time, the closer the trigger time of two flows, respectively represent the average packet arrival time interval of the packets in two flows, the smaller the difference of the average packet arrival time interval, the closer the packet sending frequency of two flows;

[0026] Select the video stream with the weight less than the first set threshold value, and construct a preliminary core flow set.

[0027] Further, based on the preliminary core flow set, the conditional independence is used to test the independence of the video stream and other related streams, and the video stream with the p-value greater than the set second threshold value is selected to construct the core flow set.

[0028] Further, the extracted video flow features include uplink flow features, downlink flow features and all flow features.

[0029] Further, the process of analyzing the causal relationship between the live scene and the video flow features in structure and parameters comprises:

[0030] By learning a directed acyclic graph from the variable set, the structural relationship between the video flow features and the live scene label variables is learned, and the causal relationship between them is qualitatively represented, and the initial features are set to create a connection in the absence to ensure that the connection between the features and the live scene label variables always exists during training;

[0031] Based on the given network structure, a suitable parameter is determined to fit the conditional distribution about the live scene label variable, and the quantitative causal structure and parameters of the video flow features and the live scene label are integrated to complete the video scene inference and causal analysis.

[0032] The second aspect of the application provides a causal inference system for video multi-modal flow.

[0033] A causal inference system for video multi-modal flow comprises:

[0034] A preprocessing module configured to preprocess the obtained original network flow data to obtain a flow data sequence;

[0035] A video stream identification module configured to set threshold conditions of the video stream based on the flow data sequence, and identify the video stream;

[0036] a core flow set identification module configured to: determine the correlation of the video stream with other related streams by using a time similarity measure weight, to obtain a preliminary core flow set meeting a condition; and based on the preliminary core flow set, test the independence of the video stream and other related streams by using conditional independence, to obtain a core flow set;

[0037] a causal reasoning module configured to: extract video flow features based on the core flow set, analyze the causal relationship between the live scene and the video flow features in structure and parameters, and reason the live scene to obtain a label of the live scene.

[0038] A third aspect of the present application provides a computer readable storage medium.

[0039] A computer readable storage medium having a computer program stored thereon, the program being executed by a processor to implement the steps in the causal reasoning method for video multi-modal flow according to the first aspect.

[0040] A fourth aspect of the present application provides a computer device.

[0041] A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the steps in the causal reasoning method for video multi-modal flow according to the first aspect when executing the program.

[0042] Compared with the prior art, the present application has the following beneficial effects:

[0043] The present application can realize reliable online analysis and identification of multi-modal video flow under the premise of low overhead occupation and high processing speed, and solves the problems of high computing power occupation, large memory occupation, slow processing speed and difficulty in online identification in the prior art.

[0044] The present application analyzes the video stream from the perspective of multi-modal flow, considers other related data streams of the video stream, and analyzes from the causal relationship between the data streams, thereby improving the accuracy and real-time performance of live scene identification. BRIEF DESCRIPTION OF DRAWINGS

[0045] The drawings accompanying the specification of the present application form part of the present application and serve to provide further understanding of the present application. The exemplary embodiments of the present application and their descriptions serve to explain the present application and do not constitute an improper limitation of the present application.

[0046] Figure 1 A flowchart of the causal reasoning method for video multi-modal flow provided by the embodiments of the present application;

[0047] Figure 2 A flowchart of the video stream identification provided by the embodiments of the present application;

[0048] Figure 3 A flowchart of ADU identification provided for the embodiments of the present application is shown in FIG. 1.

[0049] Figure 4 A flowchart of core traffic set extraction provided for the embodiments of the present application is shown in FIG. 2.

[0050] Figure 5 A flowchart of LSRN training provided for the embodiments of the present application is shown in FIG. 3.

[0051] Figure 6 A flowchart of LSRN inference network training provided for the embodiments of the present application is shown in FIG. 4.

[0052] Figure 7 A system framework diagram of a causal inference system for video multi-modal traffic provided for the embodiments of the present application is shown in FIG. 5. DETAILED DESCRIPTION

[0053] The present application is further described below in conjunction with the accompanying drawings and embodiments.

[0054] It should be noted that the following detailed description is illustrative only, and is intended to provide further description in order to provide a fuller enabling teaching of the present application. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application pertains.

[0055] It is also important to note that the use of the term "or" in the context of this specification is to be interpreted as inclusive or, meaning there was an occurrence of either one or more of a number of listed components. Only terms clearly indicated to the contrary are interpreted as exclusive or.

[0056] It should be noted that the flowcharts and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of methods and systems according to various embodiments of the present disclosure. It is noted that each block in the flowcharts or block diagrams can represent a module, a segment, or a portion of code, which can include one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks noted in succession can in fact be executed substantially concurrently or can sometimes be executed in reverse order, depending on the functionality involved. It will also be noted that each block of the flowchart and / or block diagrams and combinations of blocks in the flowchart and / or block diagrams can be implemented by special purpose hardware-based systems that perform the specified functions or operations, or combinations of special purpose hardware and computer instructions.

[0057] Embodiment one

[0058] Terminology explanation:

[0059] Kernel-based conditional independence (KCI) is a kernel-based conditional independence test.

[0060] The time similarity measure weight is to measure the similarity of two flows in the time domain.

[0061] The core flow set refers to the set of flows that are most relevant to the content of a video session among all the sets of flows generated in a video session.

[0062] The peak point feature is the numerical feature of the highest point of the packet size sequence curve.

[0063] LSRN is a causal reasoning network and a lightweight and effective reasoning model, which solves the problem of live video scene recognition at a lower implementation cost.

[0064] In the prior art, with the popularization of encryption technology, traditional methods gradually fail; emerging video traffic identification technology has formed a relatively mature research framework, especially the identification technology based on machine learning has a high level of intelligence and generalization, which provides a basic research idea for Internet video traffic identification research; by designing a causal reasoning network LSRN, low-cost, efficient and reliable multi-modal video traffic analysis and identification are realized.

[0065] Therefore, the present application provides a causal reasoning method for video multi-modal traffic, such as Figure 1As shown, the embodiment takes the method applied to the server as an example, and it can be understood that the method can also be applied to the terminal, and can also be applied to the terminal and the server and the system, and is realized through the interaction of the terminal and the server. The server can be a stand-alone physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network servers, cloud communication, middleware services, domain name services, security services CDN, and basic cloud computing services such as big data and artificial intelligence platforms. The terminal can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, and the like, but is not limited thereto. The terminal and the server can be directly or indirectly connected through wired or wireless communication, which is not limited in the present application. In the embodiment, the method comprises the following steps:

[0066] The obtained raw network traffic data is preprocessed to obtain a traffic data sequence;

[0067] Based on the traffic data sequence, a threshold condition of the video stream is set, and the video stream is identified;

[0068] The time similarity measurement weight is used to determine the correlation of the video stream and other related streams, and a preliminary core traffic set meeting the condition is obtained; based on the preliminary core traffic set, the conditional independence is used to test the independence of the video stream and other related streams, and a core traffic set is obtained;

[0069] Based on the core traffic set, the video traffic features are extracted, the causal relationship between the live streaming scene and the video traffic features in structure and parameters is analyzed, the live streaming scene is inferred, and the label of the live streaming scene is obtained.

[0070] The embodiment will be described in detail below with reference to the accompanying drawings:

[0071] S1, collecting raw network traffic data; the specific steps include:

[0072] The specific steps of collecting raw network traffic data are as follows: first, in the selection of video scenes, the embodiment focuses on three live streaming scenes of online games, video chats, and outdoor activities, because these video scenes are the most popular types in live streaming sessions. Then, the live streaming traffic is captured by using a data traffic capture tool by logging in to a platform to watch live streaming. In order to ensure the usability of the data set, the duration of each live streaming session is kept at a suitable fixed value.

[0073] It should be noted that the acquisition of live streaming traffic in the embodiment is agreed by the live streaming platform and complies with relevant legal regulations.

[0074] S2. Filter the raw traffic for noise, calculate the bits per second (BPS) sequence, and then convert it into an ADU sequence based on platform differences. Based on the above data processing, identify the video stream from the real-time streaming session by setting threshold conditions. Next, combine kernel-based conditional independence (KCI) testing and temporal similarity metric weights to calculate the relationship between the video stream and other relevant streams, constructing a core traffic set; where the BPS sequence is a = (a1, a2, ..., a...). i ...,a n ), a i The ADU sequence P = (p1, p2, ..., p) represents the sum of the data packet sizes in the i-th second. l-1 ,p l ), where l represents the number of ADUs. The threshold condition for the video stream is used to calculate ADUs based on the packet size threshold in the uplink and the set transmission time interval; the specific steps include:

[0075] S201, Convert the raw traffic into an ADU sequence; such as Figure 3 As shown, an elephant stream set is extracted from the raw traffic data and then proceeds to the data processing stage. Given a stream of m seconds, it can be represented as a BPS sequence a = (a1, a2, ..., a...). i ...,a n ), a i This represents the sum of data packet sizes in the i-th second. In the DASH protocol, live video is divided into fixed-length ADUs for transmission. Therefore, based on the BPS, depending on the platform, a time interval or a fixed uplink load is set and divided into several segments. For each segment, the low-load components are filtered to avoid noise. ADUs smaller than the default video unit are filtered out. Finally, the BPS are aggregated into an ADU sequence P = (p1, p2, ..., p...). l-1 ,p l ), where l represents the number of ADUs. The filtering rules are defined as follows.

[0076]

[0077] Where T represents the total time of the video session, t i num represents the actual duration of each stream. i This represents the number of packets in each stream. α and β are parameters used to distinguish between elephant streams and mouse streams. During data processing, if the number of packets in a stream is less than α, it will be considered a mouse stream and directly eliminated. In addition, if the transmission time of a stream accounts for less than β of the total video session time, it will also be eliminated. This allows us to obtain the set of elephant streams.

[0078] S202, set threshold condition of video stream, identify video stream from real-time streaming session; as shown in Figure 2 As shown, first extract features such as average packet load and load rate from traffic, and combine the number of video ADUs to match the traffic pattern. The identification threshold of video stream is shown in Table 1. Only when the flow pattern meets the following three conditions, it will be marked as a video stream. For video streams, there are generally at least three ADUs, and the minimum condition is that there are at least three uplink requests in TCP: one to obtain the retrieval list file of the video, one to obtain the audio segment, and one to obtain the video segment; secondly, from the perspective of packet load, in order to transmit video content as much as possible, the downlink packets in the flow are almost transmitted with high load, so the video packet threshold L v and the audio packet threshold L a are set in the table. When the average packet load of the flow is greater than L v , it meets the video stream condition; finally, from the perspective of flow transmission rate, video streams often have high rate, so R v and R a are set to represent the video stream rate and the non-video stream rate. When the rate of the flow is greater than R v , it is considered to meet the video stream condition.

[0079] Table 1: Video stream identification feature threshold description

[0080]

[0081] S203, combine the kernel function-based conditional independence (KCI) test and the time similarity measurement weight to calculate the relationship between the video stream and other related streams, and build a core traffic set, as shown in Figure 4 ;

[0082] Build a time similarity weight to measure the similarity of two flows in the time domain, and the calculation formula is as follows:

[0083]

[0084] Wherein, respectively represent the start time of two flows, and the smaller the difference between the start times, the closer the triggering times of two flows, respectively represent the average packet arrival time interval of the packets in two flows, and the smaller the difference between the average packet arrival time intervals, the closer the packet sending frequency of two flows.

[0085] Let the identified video stream be denoted as variable Y, and the other elephant streams in the session be denoted as variable X, the correlation between variable Y and X in time domain is calculated by using time similarity weight, for the stream whose weight is less than threshold β, it is added to the preliminary core flow set, and then based on the extracted stream sequence, the independence of variable Y and X is calculated by using KCI independence test. According to the core matrix generated by variable X and Y, a simple test statistic is defined to directly calculate the independence of variable X and Y. Assuming that the samples of variable X and Y are and Based on this, the eigenvalue decomposition (EVD) decomposition of the core matrix and is calculated:

[0086] Wherein, Λ X and Λ Y are composed of non-negative eigenvalues λ x,i and λ y,i . Under the zero hypothesis condition of variable Z, X and Y are independent of each other, then the statistic can be expressed as:

[0087] The p-value is calculated by locating T UI in the zero distribution, if the p-value of the stream is greater than the threshold α, it is considered that there is a nonlinear correlation, and it is added to the final core flow set, the KCI calculation rule is as follows.

[0088] IF p-value < α THEN X⊥Y

[0089] S3, according to the features extracted in the core flow set, using a live reasoning network (LSRN) model, analyzing the causal relationship between the live scene and the video flow features in structure and parameters, and reasoning the live scene according to the causal relationship; wherein the live scene includes game live, chat live, outdoor live, the video flow features include the flow features extracted from the flow data from the three angles of uplink flow, downlink flow and all flow, the causal relationship is depicted by constructing a causal structure model (SCM), and the directed edge between two variables represents the existence of causal relationship.

[0090] Specifically, the LSRN reasoning network consists of three parts: feature variable extraction, network structure learning and network parameter learning; wherein the feature variable extraction module is to extract the input variables of the reasoning network according to the features of the core flow set and the corresponding live labels; the network structure learning module uses the NOTEARS algorithm to learn the structural relationship between the features and the label variables, and qualitatively represents the causal relationship between them; the network parameter learning module is to determine a suitable parameter θ to fit the conditional distribution about the label variable label according to the given network structure.

[0091] The specific steps include:

[0092] S301: The feature variable extraction module extracts peak point features and ordinary features, including average arrival interval time, TCP window, average packet length, etc. Tables 2 and 3 show the peak point features and ordinary features extracted in this embodiment. To remove redundant features and reduce training time, XGBOOST is used to select the top 10 most important features. The initial features are set to create connections if they do not exist, to ensure that the connections between features and labels always exist during training. The initial features include d_PP_C, ADU_mea, dpl_s, dpnum_s, dpl_mean, and dpl_std, which are generally related to changes in video content. Step S302 is then executed.

[0093] Table 2: List of extracted peak point features

[0094] Feature name Feature meaning ADU_max Maximum value of ADU sequence in the whole stream ADU_min Minimum value of ADU sequence in the whole stream ADU_mean Mean value of ADU sequence in the whole stream ADU_std Variance of ADU sequence in the whole stream f_PP_C Peak point size in the uplink stream b_PP_C Peak point size in the downlink stream d_PP_C Peak point size in the whole stream

[0095] Table 3: List of extracted common features

[0096]

[0097]

[0098] S302. Once the feature variables are extracted, they are input into the network structure learning module. The network structure learning module consists of NOTEARS structure training, filtering weak weighted edges, retrieving the maximum subgraph, and correcting the maximum subgraph. Figure Four It consists of several parts, and the execution of step S303 is as follows: Figure 5 , Figure 6 As shown.

[0099] The specific steps for training the S303 and NOTEARS structures are as follows: Given a sample X = (X1, ..., X... d ) is a random variable containing d nodes.

[0100] First, using the weight matrix A graph with d nodes is defined. Using... An adjacency matrix can be defined for a directed graph G.

[0101] Secondly, from a vector perspective, W = [w1|…|w d It can also be defined as a linear structure equation (SEM) with respect to X: Where z = (z1, ..., z) d X is a random noise variable, and its conditional expectation under the parent node can be calculated using SEM. Therefore, the simulated variable X j The conditional distribution.

[0102] Then as a scoring function model NOTEARS focuses on the conversion from SEM to graph, linear SEM can calculate a least squares (LS) loss When LS loss takes the minimum value, it can prove that the NOTEARS algorithm recovers the true DAG with high probability on the limited and high-dimensional sample, and the result is consistent for Gaussian SEM and non-Gaussian SEM.

[0103] Finally, in order to be able to learn a sparse DAG graph, the algorithm adds L1-regularization ||W||1=||vec(W)||1, and the final scoring function of the DAG graph is as follows. Through the scoring function, we can train a DAG graph that meets the causal relationship between feature variables, and execute step S304.

[0104]

[0105] S304, get a full connected graph, which contains some weak weight edges. Therefore, in order to obtain an effective DAG graph, the weak weight edges and the node variables between the edges are filtered by using the weight threshold ω (default ω=0.8), and finally a series of DAGs representing the relationship between variables are obtained, and step S305 is executed.

[0106] S305, after obtaining the DAG, only the largest subgraph with labeled variables is interested. However, when searching for the largest subgraph, it is found that there are still some wrong edges and directions, so the largest subgraph needs to be fine-tuned. In addition, for the largest subgraph without label connection, the initial features are used to create connections to ensure that there is always a relationship between features and labels, and step S306 is executed.

[0107] S306, in the parameter learning stage, on the one hand, in order to quantify the value state of each continuous variable, on the other hand, in order to unify the scale of features of different quantities, the Max-Min linear normalization method is used to transform the feature variables of different scales in the data set to the interval [0, 1], where 0 represents the minimum value and 1 represents the maximum value. If the interval [0, 1] is divided into n parts, then each feature value can be mapped to the integer set {1, 2, …, n-1, n}. Assuming that there is a feature variable Xi at this time, if n=3, it can be mapped to three value states of high, medium and low. According to the distribution of Xi in the sample, two three-quantile points α1 and α2 are calculated, which are 1 / 3 and 2 / 3 respectively. The discrete mapping is as follows:

[0108]

[0109] Therefore, with the help of Markov Blanket (MB) and feature discretization, the probability P(θ|D) of the label variable under different feature conditions can be easily represented as shown in formula X:

[0110] P(θ|D)=P(label)=s|X1=x1,X2=x2…,X m =x m )=p max

[0111] Embodiment Two

[0112] The embodiment provides a causal inference system for video multi-modal traffic.

[0113] As shown in Figure 7 , a causal inference system for video multi-modal traffic includes:

[0114] A preprocessing module configured to preprocess the obtained raw network traffic data to obtain a traffic data sequence;

[0115] A video stream identification module configured to set a threshold condition of a video stream based on the traffic data sequence and identify the video stream;

[0116] A core traffic set identification module configured to determine the relevance of the video stream and other related streams using a time similarity measurement weight to obtain a preliminary core traffic set that meets the condition, and based on the preliminary core traffic set, use conditional independence to test the independence of the video stream and other related streams to obtain a core traffic set;

[0117] A causal inference module configured to extract video traffic features based on the core traffic set, analyze the causal relationship between the live streaming scene and the video traffic features in structure and parameters, and infer the live streaming scene to obtain the label of the live streaming scene.

[0118] It should be noted that the above preprocessing module, video stream identification module, core traffic set identification module and causal inference module have the same examples and application scenarios as the steps in Embodiment One, but are not limited to the content disclosed in Embodiment One. It should be noted that the above modules as part of the system can be executed in a computer system such as a set of computer executable instructions.

[0119] Embodiment Three

[0120] The embodiment provides a computer readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the causal inference method for video multi-modal traffic as described in Embodiment One.

[0121] Embodiment Four

[0122] The embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps in the video multi-modal traffic oriented causal inference method according to the above embodiment one when executing the program.

[0123] Those skilled in the art will understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage, etc.) containing computer-usable program code.

[0124] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system), and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus generate a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure One one or more flows and / or blocks Figure One means for carrying out the functions specified in the flowcharts and / or block diagrams.

[0125] These computer program instructions can also be stored in a computer-readable memory capable of guiding a computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including instruction means, which implements the functions specified in the flowcharts and / or block diagrams. Figure One one or more flows and / or blocks Figure One means for carrying out the functions specified in the flowcharts and / or block diagrams.

[0126] These computer program instructions can also be loaded into a computer or other programmable data processing apparatus, so that a series of operation steps are performed on the computer or other programmable data processing apparatus to produce a computer-implemented process, so that the instructions executed on the computer or other programmable data processing apparatus provide a process for implementing the functions specified in the flowcharts and / or block diagrams. Figure One one or more flows and / or blocks Figure One means for carrying out the functions specified in the flowcharts and / or block diagrams.

[0127] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing relevant hardware, and the program can be stored in a computer readable storage medium. When the program is executed, the program can include the processes of the above-mentioned embodiment methods. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM), a random access memory (RAM) or the like.

[0128] The above only describes the preferred embodiments of the present application and is not used to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement and the like within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A causal reasoning method for video multimodal traffic, characterized in that, include: The acquired raw network traffic data is preprocessed to obtain a traffic data sequence; Based on the traffic data sequence, threshold conditions are set for the video stream to identify the video stream; Using time similarity as a metric, the correlation between the video stream and other related streams is determined, resulting in a preliminary core traffic set that meets the criteria. Based on the aforementioned initial core traffic set, the independence of the video stream from other related streams is tested using conditional independence to obtain the core traffic set. Based on the core traffic set, video traffic features are extracted, and the causal relationship between live streaming scenarios and video traffic features in terms of structure and parameters is analyzed. In this way, the live streaming scenarios are inferred and the labels of the live streaming scenarios are obtained. The process of analyzing the causal relationship between live streaming scenarios and video traffic characteristics in terms of structure and parameters includes: By learning a directed acyclic graph from the variable set, the structural relationship between video traffic features and live scene label variables is learned, and the causal relationship between them is qualitatively represented. The initial features are set to create connections when they do not exist, so as to ensure that the connection between features and live scene label variables always exists during training. Based on the given network structure, a suitable parameter is determined to fit the conditional distribution of the live scene label variable. By combining the causal structure and parameters of video traffic characteristics and the quantitative analysis of live scene labels, video scene inference and causal analysis are completed.

2. The causal reasoning method for video multimodal traffic according to claim 1, characterized in that, The process of obtaining the traffic data sequence includes: The raw network traffic data is filtered, and the bits per second (BPS) sequence is calculated. Convert the BPS sequence into an ADU sequence, i.e., a traffic data sequence.

3. The causal reasoning method for video multimodal traffic according to claim 1, characterized in that, The threshold conditions include: Condition 1: Request a search list file for the video, a request to retrieve audio segments, and a request to retrieve video segments; Condition 2: The average packet load of the video stream is greater than the set video packet threshold; Condition 3: The video stream rate is greater than the set video stream rate threshold.

4. The causal reasoning method for video multimodal traffic according to claim 1, characterized in that, The process of determining the correlation between a video stream and other related streams using time similarity as a weighting metric employs the following formula: in , These represent the start times of the two streams. The smaller the difference in start times, the closer the trigger times of the two streams are. , These represent the average packet arrival time intervals in the two flows, respectively. The smaller the difference in the average packet arrival time intervals, the more similar the packet sending frequencies of the two flows are. Select video streams with weights less than a first set threshold to construct an initial core traffic set.

5. The causal reasoning method for video multimodal traffic according to claim 4, characterized in that, Based on the initial core traffic set, conditional independence is used to test the independence of the video stream from other related streams, and the video stream is selected. Video streams exceeding the set second threshold are used to construct a core traffic set.

6. The causal reasoning method for video multimodal traffic according to claim 1, characterized in that, The extracted video traffic features include uplink flow features, downlink flow features, and all flow features.

7. A causal inference system for video multimodal traffic, characterized in that, include: The preprocessing module is configured to preprocess the acquired raw network traffic data to obtain a traffic data sequence. The video stream recognition module is configured to: recognize video streams based on traffic data sequences and by setting threshold conditions for the video streams; The core traffic set identification module is configured to: use time similarity metric weights to determine the correlation between the video stream and other related streams, and obtain a preliminary core traffic set that meets the conditions; Based on the aforementioned initial core traffic set, the independence of the video stream from other related streams is tested using conditional independence to obtain the core traffic set. The causal reasoning module is configured to: extract video traffic features based on the core traffic set, analyze the causal relationship between the live streaming scene and the video traffic features in terms of structure and parameters, and infer the live streaming scene to obtain the label of the live streaming scene. The process of analyzing the causal relationship between live streaming scenarios and video traffic characteristics in terms of structure and parameters includes: By learning a directed acyclic graph from the variable set, the structural relationship between video traffic features and live scene label variables is learned, and the causal relationship between them is qualitatively represented. The initial features are set to create connections when they do not exist, so as to ensure that the connection between features and live scene label variables always exists during training. Based on the given network structure, a suitable parameter is determined to fit the conditional distribution of the live scene label variable. By combining the causal structure and parameters of video traffic characteristics and the quantitative analysis of live scene labels, video scene inference and causal analysis are completed.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the causal reasoning method for video multimodal traffic as described in any one of claims 1-6.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the causal reasoning method for video multimodal traffic as described in any one of claims 1-6.

Images