Cache processing method, device and electronic device applied to router

Abstract

The embodiments of the present disclosure disclose a cache processing method, device and electronic device applied to a router. A specific implementation of the method includes: determining a router associated with a target router path; grouping router information in a router information set; for a router information group, performing the following processing steps: extracting features of router forwarding data information included in each router information in the router information group; generating a data intent for the router information group; in response to the data intent being a first data intent, clearing invalid caches for the router corresponding to the router information in the router information group; in response to the data intent being a second data intent, controlling the real-time data flow corresponding to the router forwarding data information included in the router information in the router information group. This implementation effectively reduces the risk of network paralysis.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular to a cache processing method, device, and electronic device applied to a router. Background Art

[0002] A router is a hardware device that acts as a gateway and is used to connect at least two networks to achieve the purpose of cross-network data transmission. As the complexity of networks increases and the amount of data transmitted across networks increases, the data transmission pressure on routers in the network increases. At present, when data is transmitted through a router, the method usually adopted is to directly transmit the corresponding data using the destination address corresponding to the data as the address.

[0003] However, when the above method is adopted, the following technical problems often occur:

[0004] First, because the router directly transmits data, when the data transmission volume is large, it increases the data forwarding pressure of the router, which may cause network paralysis;

[0005] Second, for common attack methods such as flood attacks, due to the lack of effective feature extraction of the content of the transmitted data, it is impossible to identify abnormal data at the router level, increasing the risk of the server being attacked;

[0006] Third, there is a lack of effective data intent recognition for the content of transmitted data, making it impossible to identify abnormal data at the data intent level, increasing the risk of the server being attacked.

[0007] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the invention

[0008] The content of this disclosure is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this disclosure is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0009] Some embodiments of the present disclosure propose a cache processing method, device, and electronic device applied to a router to solve one or more of the technical problems mentioned in the above background technology section.

[0010] In a first aspect, some embodiments of the present disclosure provide a cache processing method for a router, the method comprising: determining a router associated with a target router path according to a real-time network topology corresponding to a target virtual local area network, and obtaining a router information set, wherein the router information in the above router information set comprises: real-time load information of the router, router forwarding data information, a first routing table, and a second routing table; grouping the router information in the above router information set according to the data flow direction corresponding to the first routing table included in the router information and the router forwarding data information included in the router information to generate a router information group set; for each router information group in the above router information group set, performing the following processing steps: grouping the router information in the above router information set according to the data flow direction corresponding to the router forwarding data information included in the router information Data flow direction, feature extraction is performed on the router forwarding data information included in each router information in the above router information group to generate router forwarding data features and obtain a router forwarding data feature sequence; based on the above router forwarding data feature sequence, a data intent is generated for the above router information group; in response to the above data intent being a first data intent, according to the router real-time load information of the router included in the router information in the above router information group, invalid cache clearing is performed on the router corresponding to the router information in the above router information group; in response to the above data intent being a second data intent, the real-time data flow direction corresponding to the router forwarding data information included in the router information in the above router information group is controlled through the first routing table and the second routing table included in the router information in the above router information group.

[0011] In a second aspect, some embodiments of the present disclosure provide a cache processing device for a router, the device comprising: a determination unit, configured to determine a router associated with a target router path according to a real-time network topology corresponding to a target virtual local area network, and obtain a router information set, wherein the router information in the above router information set comprises: router real-time load information, router forwarding data information, a first routing table and a second routing table; a grouping unit, configured to group the router information in the above router information set according to the data flow direction corresponding to the first routing table included in the router information and the router forwarding data information included in the router information, so as to generate a router information group set; an execution unit, configured to perform the following processing steps for each router information group in the above router information group set: according to the router information including The data flow direction corresponding to the router forwarding data information of the router is extracted feature by extracting the router forwarding data information included in each router information in the router information group to generate a router forwarding data feature and obtain a router forwarding data feature sequence; according to the router forwarding data feature sequence, a data intent for the router information group is generated; in response to the data intent being a first data intent, according to the router real-time load information of the router included in the router information in the router information group, an invalid cache is cleared for the router corresponding to the router information in the router information group; in response to the data intent being a second data intent, the real-time data flow direction corresponding to the router forwarding data information included in the router information in the router information group is controlled through the first routing table and the second routing table included in the router information in the router information group.

[0012] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner of the above-mentioned first aspect.

[0013] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation manner of the above-mentioned first aspect is implemented.

[0014] The above-mentioned embodiments of the present disclosure have the following beneficial effects: through the cache processing method applied to the router of some embodiments of the present disclosure, the cache pressure and data forwarding pressure of the router are reduced, and the risk of network paralysis is further reduced. Specifically, the reason for network paralysis is that since the router directly transmits data, when the data transmission volume is large, the data forwarding pressure of the router is increased, which may cause network paralysis. In practice, since the router is an intermediary for cross-network transmission, when the router is down due to data transmission pressure, it may cause network paralysis. Based on this, the cache processing method applied to the router of some embodiments of the present disclosure, first, according to the real-time network topology corresponding to the target virtual local area network, the router associated with the target router path is determined to obtain a router information set, wherein the router information in the above router information set includes: router real-time load information, router forwarding data information, a first routing table and a second routing table. In this way, the operation status of at least one router associated with the target router path is obtained. Secondly, according to the first routing table included in the router information and the data flow direction corresponding to the router forwarding data information included in the router information, the router information in the above router information set is grouped to generate a router information group set. In practice, the target router and at least one router corresponding to the router information set often present a star-shaped local network topology structure centered on the target router. When different data are transmitted through the target router and at least one router corresponding to the router information set, only some of the routers may be involved. By grouping the router information set based on the data flow direction as the segmentation unit, the topological relationship between the routers corresponding to the router information set can be further described from the perspective of the data flow direction. Then, for each router information group in the above router information group set, the following processing steps are performed: the first step is to extract features of the router forwarding data information included in each router information in the above router information group according to the data flow direction corresponding to the router forwarding data information included in the router information, so as to generate router forwarding data features and obtain a router forwarding data feature sequence. In this way, the data features of the router forwarding data information are obtained for subsequent data intent identification. The second step is to generate the data intent for the above router information group according to the above router forwarding data feature sequence. In this way, the data intent corresponding to the router forwarding data information is obtained. In the third step, in response to the data intent being the first data intent, according to the router real-time load information of the router included in the router information in the router information group, the router corresponding to the router information in the router information group is cleared of invalid cache. By clearing the invalid cache, the pressure resistance and data forwarding capability of the router are improved, and the risk of network paralysis is further reduced.In the fourth step, in response to the data intention being the second data intention, the real-time data flow direction corresponding to the router forwarding data information included in the router information in the router information group is controlled through the first routing table and the second routing table included in the router information in the router information group, so as to ensure that the data can flow correctly to the corresponding destination address. In this way, the risk of network paralysis is effectively reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0016] Figure 1 is a flow chart of some embodiments of a cache processing method applied to a router according to the present disclosure;

[0017] Figure 2 is a schematic diagram of the structure of some embodiments of a cache processing device applied to a router according to the present disclosure;

[0018] Figure 3 It is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0019] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0020] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0021] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0022] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0023] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0024] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0025] refer to Figure 1 , shows a process 100 of some embodiments of a cache processing method applied to a router according to the present disclosure. The cache processing method applied to a router comprises the following steps:

[0026] Step 101, according to the real-time network topology corresponding to the target virtual local area network, determine the router associated with the target router path, and obtain a router information set.

[0027] In some embodiments, the execution subject (e.g., computing device) of the cache processing method applied to the router can determine the router associated with the target router path according to the real-time network topology corresponding to the target virtual local area network, and obtain a router information set. Among them, the target virtual local area network can be a local area network covering a limited area. In practice, according to the actual network division, the target virtual local area network can include at least one sub-local area network. The sub-local area network in at least one sub-local area network can be connected to the network through a router, and at the same time, at least one router can be set in the sub-local area network. The real-time network topology map is used to describe the topological relationship between the routers in the target virtual local area network. The target router can be a router in the target virtual local area network used to connect the sub-local area network in at least one sub-local area network. The router information in the router information set can include: real-time load information of the router, router forwarding data information, a first routing table, and a second routing table. The real-time load information of the router represents the load pressure of the router corresponding to the router information when transmitting data. The router forwarding data information represents the data forwarded by the router corresponding to the router information. The first routing table represents the routing table used to forward normal messages in the router corresponding to the router information. The second routing table represents the routing table in the router corresponding to the router information for forwarding abnormal messages to the honeypot node. The honeypot node can be a trap node for detecting or resisting unauthorized operations or hacker attacks. In practice, the above-mentioned execution subject can traverse the above-mentioned real-time network topology map with the position of the target router in the real-time network topology map as the center to obtain the above-mentioned router information set.

[0028] It should be noted that the above computing device can be hardware or software. When the computing device is hardware, it can be implemented as at least one server. When the computing device is embodied as software, it can be installed in the hardware devices listed above, without limitation. It should be understood that the number of computing devices can be any number according to implementation needs. In practice, when the computing device is software, it can share server resources with the firewall.

[0029] In some optional implementations of some embodiments, the execution subject determines the router associated with the target router path according to the real-time network topology corresponding to the target virtual local area network, and obtains the router information set, which may include the following steps:

[0030] In the first step, the position of the target router in the real-time network topology map is used as the traversal center, and the routers whose hop distance to the target router is less than the preset hop distance and whose communication path is reachable to the target router are selected as candidate routers to obtain a set of candidate routers.

[0031] The hop distance refers to the number of hops that need to be crossed for communication between routers. The reachability of the communication path indicates that there is a communication link between the router and the target router that can be used for information transmission.

[0032] In the second step, for each candidate router in the above candidate router set, perform the following router information determination steps:

[0033] The first sub-step is to determine the real-time load information of the candidate router as the real-time load information of the router included in the router information corresponding to the candidate router information.

[0034] The real-time load information of the router may represent the real-time cache load of the candidate router. Specifically, the real-time load information of the router may be the cache volume occupied by each executing process in the candidate router.

[0035] As an example, for candidate router A, the corresponding router real-time load information may be {process A, cache occupancy: 2M; process B, cache occupancy: 1.2M;}.

[0036] The second sub-step is to determine the forwarding data forwarded by the candidate router within a preset time period as the router forwarding data information included in the router information corresponding to the candidate router.

[0037] In practice, the execution subject may determine the forwarding data forwarded by the candidate router within a preset time period by monitoring, as the router forwarding data information included in the router information corresponding to the candidate router.

[0038] The third sub-step is to determine the routing table used for data forwarding addressing stored in the candidate router as the first routing table and the second routing table included in the router information corresponding to the candidate router.

[0039] In practice, the above-mentioned execution subject may determine the routing table stored in the candidate router for forwarding normal messages as the first routing table, and determine the routing table stored in the candidate router for forwarding abnormal messages to the honeypot node as the second routing table.

[0040] Step 102: group the router information in the router information set according to the first routing table included in the router information and the data flow direction corresponding to the router forwarding data information included in the router information to generate a router information group set.

[0041] In some embodiments, the above-mentioned execution subject can group the router information in the router information set according to the data flow direction corresponding to the first routing table included in the router information and the router forwarding data information included in the router information to generate a router information group set. In practice, since data needs to pass through multiple routers in the target virtual local area network before it can be forwarded to the destination address. Therefore, in the process of data forwarding, multiple routers often have the same router forwarding data. At the same time, when forwarding data, the router needs to rely on its own stored routing table (for example, the first routing table and the second routing table) for data forwarding. Therefore, the above-mentioned execution subject can group the router information in the router information set according to the data flow direction corresponding to the first routing table included in the router information and the router forwarding data information included in the router information to generate a router information group set.

[0042] As an example, a router information set may include: router information A, router information B, and router information C. Among them, the router forwarding data information included in router information A includes: forwarding data A. The router forwarding data information included in router information B includes: forwarding data A. The router forwarding data information included in router information C includes: forwarding data B. Therefore, router information A and router information B constitute a router information group. Router information C constitutes a router information group.

[0043] Step 103: for each router information group in the router information group set, perform the following processing steps:

[0044] Step 1031, based on the data flow direction corresponding to the router forwarding data information included in the router information, feature extraction is performed on the router forwarding data information included in each router information in the router information group to generate a router forwarding data feature and obtain a router forwarding data feature sequence.

[0045] In some embodiments, the execution subject may extract features of the router forwarding data information included in each router information in the router information group according to the data flow direction corresponding to the router forwarding data information included in the router information, so as to generate a router forwarding data feature and obtain a router forwarding data feature sequence. In practice, the execution subject may use a graph neural network model to extract features of the router forwarding data information included in the router information, so as to generate a router forwarding data feature.

[0046] In some optional implementations of some embodiments, the execution subject extracts features of the router forwarding data information included in each router information in the router information group according to the data flow direction corresponding to the router forwarding data information included in the router information to generate a router forwarding data feature, and obtains a router forwarding data feature sequence, which may include the following steps:

[0047] In the first step, the data flow feature corresponding to the router forwarding data information included in the above router information is extracted through a data flow feature extraction model included in a pre-trained data feature extraction model.

[0048] The input of the data flow feature extraction model is the local topology structure of at least one router corresponding to the router information group in the real-time network topology map. In practice, when there are many routers in the target virtual local area network, the corresponding real-time network topology structure is relatively complex. However, one forwarding data only involves part of the routers in the target virtual local area network for data forwarding. Therefore, the execution subject can only use the local topology structure corresponding to the router information group as the input of the data flow feature extraction model. The data flow feature extraction model includes: a regularization layer, a first feature processing block, a second feature processing block, a third feature processing block and a pooling layer. The network structures of the first feature processing block, the second feature processing block and the third feature processing block are consistent. The first feature processing block includes: an attention mechanism layer, a graph convolution network and a time domain graph convolution layer. The attention mechanism layer, the graph convolution network and the time domain graph convolution layer are connected in series. The output of the regularization layer jumps to the first feature processing block through a residual connection, and is superimposed with the output of the first feature processing block as the input of the second feature processing block.

[0049] In the second step, the data packet features corresponding to the router forwarding data information included in the router information are extracted through the data packet feature extraction model included in the data feature extraction model.

[0050] Among them, for the router forwarding data information included in each router information in the router information group, there are often differences in the RIP (Routing Information Protocol) header part. Therefore, the data packet feature extraction model includes: a header feature extraction model, a non-header feature extraction model and a feature buffer pool. The header feature extraction model is used to extract the header features corresponding to the router forwarding data information included in the router information. The non-header feature extraction model is used to extract the non-header features corresponding to the router forwarding data information included in the router information. For a router information group, the non-header feature extraction model only extracts features from the non-header data in the router forwarding data information included in the first router information in the router information group. And the extracted non-header features are stored in the feature buffer pool, so that after the header feature extraction model extracts features from the header data in the router forwarding data information except the first router information, the non-header features can be directly taken out from the feature buffer pool, and spliced ​​with the header features to obtain the data packet features corresponding to the router forwarding data information included in the router information. Among them, since the amount of data in the header data is smaller than that in the non-header data, the model structure of the header feature extraction model is shorter than that of the non-header feature extraction model. Therefore, the header feature extraction model can adopt a weak feature extraction model architecture. For example, the header feature extraction model can include 2 layers of serially connected convolutional layers and pooling layers. The non-header feature extraction model can include 9 layers of serially connected convolutional layers and pooling layers.

[0051] As an example, the router information group may include: router information A, router information B, and router information C. The above-mentioned execution subject may extract the header feature A corresponding to the router information A through the header feature extraction model, extract the non-header feature A corresponding to the router information A through the non-header feature extraction model, and use the header feature A and the non-header feature A as the data message feature A corresponding to the router information A. At the same time, the non-header feature A will be stored in the feature buffer pool, so as to be used for splicing the non-header feature A with the header feature B corresponding to the router information B to obtain the data message feature B corresponding to the router information B, and for splicing the non-header feature A with the header feature C corresponding to the router information C to obtain the data message feature C corresponding to the router information C.

[0052] The third step is to generate a router forwarding data feature in the router forwarding data feature sequence corresponding to the router information according to the data flow direction feature and the data message feature.

[0053] In practice, the execution subject may perform feature splicing on the data flow direction feature and the data message feature to obtain the router forwarding data feature corresponding to the router information.

[0054] The above-mentioned contents in some optional implementation methods of some embodiments, as an inventive point of the present disclosure, solve the second technical problem mentioned in the background technology, namely, "for common attack methods such as flood attacks, due to the lack of effective feature extraction of the content of the transmitted data, it is impossible to identify abnormal data at the router level, which increases the risk of the server being attacked". Based on this, the present disclosure firstly takes the local topological structure of at least one router corresponding to the router information group in the real-time network topology map as input, and extracts graph features through the data flow feature extraction model. In practice, for common attack methods such as flood attacks, a targeted attack is often used to attack a certain server resource, and the corresponding routing path often does not change much. Therefore, by extracting graph features from the network topology map, the data flow characteristics of the data in the local area network can be extracted. Secondly, considering that routers often mainly involve the use of the message header for the RIP protocol to control the data flow. Therefore, the present disclosure refines the data message feature extraction model, namely the message header feature extraction model, the non-message header feature extraction model and the feature buffer pool. The header data is feature extracted through the header feature extraction model, and the non-header data is feature extracted through the non-header feature extraction model. At the same time, considering that the non-header data often does not change during the router forwarding process, a feature buffer pool is set to cache the non-header features corresponding to the first router information in the router information group to avoid repeated feature extraction of the non-header feature extraction model. In this way, the feature extraction of the transmitted data (router forwarding data information) is effectively realized, so that abnormal data can be identified at the router level based on accurate data features (router forwarding data features) in the future. The probability of the risk of the server being attacked is reduced.

[0055] Step 1032: Generate data intent for the router information group based on the router forwarding data feature sequence.

[0056] In some embodiments, the execution subject may generate a data intent for a router information group based on a router forwarding data feature sequence. The data intent represents a data access intent for forwarding data corresponding to the router information group. In practice, the execution subject may adopt a BERT model, that is, use a router forwarding data feature sequence as the input of BERT to output a data intent for a router information group.

[0057] In some optional trial writing methods of some embodiments, the execution subject generates the data intent for the router information group according to the router forwarding data feature sequence, which may include the following steps:

[0058] The above data intent is generated by the pre-trained intent recognition model and the above router forwarding data feature sequence. Among them, the intent recognition model includes: a first Transformer layer, a second Transformer layer, a first convolutional layer, a second convolutional layer, a third convolutional layer and a first classifier. In practice, the intent recognition model includes a first Transformer layer, a second Transformer layer, a first convolutional layer, a second convolutional layer and a third convolutional layer connected in series. The second convolutional layer and the third convolutional layer use capsule feature processing to extract features. The feature processing granularity of the second convolutional layer is finer than that of the third convolutional layer. Specifically, the second convolutional layer and the third convolutional layer are both composed of multiple neurons. Capsule feature processing refers to treating the features output by a group of neurons as a feature group. For example, the second convolutional layer encapsulates a feature matrix group corresponding to a group of neurons with an n-gram length of 1. The third convolutional layer encapsulates a feature matrix group corresponding to a group of neurons with an n-gram length of 3. For example, the third convolutional layer can use D filters of size A×B×D to perform convolution operations on the low-dimensional feature matrix group output by the second convolutional layer with a step size of 1. Where A is the n-gram length corresponding to the third convolutional layer. B is the number of feature matrix groups output by the second convolutional layer.

[0059] The above-mentioned contents in some optional implementations of some embodiments, as an inventive point of the present disclosure, solve the technical problem three mentioned in the background technology, "lack of effective data intent recognition of the content of the transmitted data, so that abnormal data cannot be identified from the data intent level, increasing the risk of the server being attacked". Based on this, the present disclosure designs an intent recognition model for generating data intent. Among them, in order to reduce the complexity of the model, the present disclosure first uses the first Transformer layer and the second Transformer layer to extract features at the semantic level for the feature sequence of the router forwarding data. In addition, the second convolution layer and the third convolution layer are designed. Specifically, the second convolution layer and the third convolution layer use capsule feature extraction to extract features. Compared with the feature extraction method of the traditional convolutional neural network, it can save semantic features with a smaller probability of occurrence and ensure the integrity of the feature information. At the same time, it also has good robustness and the ability to fit features. In addition, the feature processing granularity of the second convolution layer and the third convolution layer is different to realize the extraction of semantic features at different levels at different feature depths. To ensure the accuracy of the final intent recognition. In this way, abnormal data can be effectively identified at the data intent level, reducing the risk of server attacks.

[0060] Step 1033, in response to the data intent being the first data intent, based on the real-time load information of the router included in the router information in the router information group, clear the invalid cache of the router corresponding to the router information in the router information group.

[0061] In some embodiments, in response to the data intent being the first data intent, the execution subject may perform invalid cache clearing on the router corresponding to the router information in the router information group according to the real-time load information of the router included in the router information in the router information group. The first data intent represents the cache clearing intent. In practice, the execution subject may perform overall cache pressure monitoring on the target virtual local area, and when it is identified that the cache pressure is large, the forwarding data corresponding to the first data intent may be broadcast to the router information in the router information set, so that the router that receives the forwarding data corresponding to the first data intent can perform cache self-clearing.

[0062] In some optional implementations of some embodiments, the execution subject may clear invalid caches of routers corresponding to the router information in the router information group according to the real-time load information of the routers included in the router information in the router information group, which may include the following steps:

[0063] For each router information in the above router information group, perform the following invalidation cache clearing steps:

[0064] The first step is to determine the router importance of the router corresponding to the above router information in the above real-time network topology diagram.

[0065] The router importance is the ratio of the data forwarding volume of the router corresponding to the router information to the target data forwarding volume in a preset time period. The target data forwarding volume is the average data forwarding volume of the router corresponding to each router information in the router information set in the preset time period.

[0066] The second step is to determine the cache clearing mode according to the real-time load information of the router included in the above router information.

[0067] The cache clearing mode represents the cache clearing strength. In practice, the execution subject may determine the corresponding load interval according to the real-time load information of the router, and determine the cache clearing mode corresponding to the load interval as the cache clearing mode corresponding to the router information.

[0068] The third step is to determine cache clearing policy information that matches the router importance and the cache clearing mode.

[0069] The cache clearing policy information represents a pre-set rule for performing cache clearing. In practice, the cache clearing mode may include: a first cache clearing mode, a second cache clearing mode, and a third cache clearing mode. The first cache clearing mode represents that cache clearing is performed in a queue manner according to the generation time of the process in the real-time load information of the router. The second cache clearing mode represents that cache clearing is performed in a queue manner according to the process importance of the process in the real-time load information of the router. The third cache clearing mode represents that cache clearing is performed in a queue manner according to the process current state of the process in the real-time load information of the router. The cache clearing policy information may include: a cache threshold and a cache release logic code. The cache threshold is determined by the importance of the router. For example, when the importance of the router is low, the cache threshold can be set low, that is, most of the cache in the router is released. When the importance of the router is high, the cache threshold can be set high, that is, a small part of the cache in the router is released. The cache release logic code is determined by the cache clearing mode. For example, when the cache clearing mode is the first cache clearing mode, the corresponding cache release logic code may be a logic code for performing cache clearing in a queue manner according to the generation time of the process in the real-time load information of the router.

[0070] The fourth step is to activate the cache clearing policy corresponding to the cache clearing policy information to achieve invalid cache clearing for the router corresponding to the router information.

[0071] Step 1034, in response to the data intent being the second data intent, controlling the real-time data flow corresponding to the router forwarding data information included in the router information in the router information group through the first routing table and the second routing table included in the router information in the router information group.

[0072] In some embodiments, in response to the data intent being the second data intent, the above-mentioned execution entity can control the real-time data flow corresponding to the router forwarding data information included in the router information in the router information group through the first routing table and the second routing table included in the router information in the router information group.

[0073] The second data intention represents the intention to forward data normally through the router. For example, the second data intention may represent the intention to forward the router forwarding data information to a certain service server. In practice, the above-mentioned execution subject may control the real-time data flow corresponding to the router forwarding data information included in the router information in the router information group through the first routing table, the second routing table and the destination address corresponding to the router forwarding data information included in the router information in turn.

[0074] In some optional implementations of some embodiments, in response to the data intent being the second data intent, the execution subject controls the real-time data flow corresponding to the router forwarding data information included in the router information in the router information group through the first routing table and the second routing table included in the router information in the router information group, which may include the following steps:

[0075] The first step is to determine the intention tendency of the second data intention to generate intention tendency information.

[0076] In practice, the intent recognition model may also include a second classifier. Among them, the second classifier may be a classifier for further distinguishing the intent tendency of the second data intent when the data intent is the second data intent. The second classifier may be a binary classifier. The classification categories of the second classifier may include: positive intent tendency category and negative intent tendency category. The above-mentioned execution subject may select a category with a large predicted probability from the positive intent tendency category and the negative intent tendency category as the intent tendency information. Specifically, the positive intent tendency category indicates that there is no attack intention when the router performs normal data forwarding. The positive intent tendency category indicates that there is an attack intention when the router performs normal data forwarding. For example, having an attack intention refers to the intention to harm the target virtual LAN and the connected hardware by means such as a torrent attack.

[0077] In the second step, in response to determining that the intention tendency information represents a positive intention tendency, for each router information in the router information group, the real-time data flow corresponding to the router forwarding data information included in the routing information is controlled through the first routing table.

[0078] In practice, the above-mentioned execution subject can forward the router forwarding data information to the corresponding destination address through the first routing table.

[0079] In the third step, in response to determining that the intention tendency information indicates a negative intention tendency, for each router information in the router information group, the router forwarding data information included in the routing information is controlled to flow to the honeypot node through the second routing table.

[0080] The node position of the honeypot node is dynamically adjusted according to the data flow corresponding to the above-mentioned real-time network topology diagram, and the above-mentioned second routing table is updated in real time according to the node position of the honeypot node. In practice, in order to avoid the problem that the honeypot position of the fixed honeypot node may be discovered, the node position of the honeypot node is updated in real time to increase the interception capability against attacks such as flood attacks.

[0081] Optionally, after controlling the router forwarding data information included in the routing information to flow to the honeypot node through the second routing table, the method further includes:

[0082] The first step is, in response to the honeypot node receiving the router forwarding data information included in the routing information, decapsulating the router forwarding data information to obtain decapsulated data.

[0083] In practice, the above-mentioned execution subject can decapsulate the data information forwarded by the router according to the data protocol corresponding to the data information forwarded by the router to obtain the decapsulated data.

[0084] The second step is to generate decapsulated data description information based on the decapsulated data.

[0085] The decapsulated data description information includes: service type description information and data response identifier. The service type description information is used to describe the service type matching the decapsulated data, and the data response identifier indicates whether to respond to the decapsulated data.

[0086] The third step is to generate a honeypot subnode set in the honeypot node according to the business type description information.

[0087] In practice, the execution subject can clone and copy the server resources that match the business type described by the business type description information, and use container technology to generate honeypot subnodes. The server resources corresponding to the honeypot subnodes are isolated from normal server resources. In practice, the number of honeypot substages in the honeypot subnode set can be determined according to the amount of server resources that match the business type described by the business type description information. The honeypot subnodes in the honeypot subnode set are used to load the business simulation environment.

[0088] In the fourth step, in response to the data response identification indicating that response data corresponding to the decapsulated data needs to be generated, response data for the router forwarding data information included in the routing information is generated through the honeypot subnodes in the honeypot subnode set.

[0089] The fifth step is to respond the response data to the data sending source corresponding to the router forwarding data information through the target virtual local area network.

[0090] In practice, the execution subject may use the data transmission source as the destination address, and respond to the response data to the data transmission source corresponding to the data forwarding information of the router through the target virtual local area network.

[0091] In the sixth step, in response to the data response identifier indicating that there is no need to generate response data corresponding to the decapsulated data, the honeypot sub-nodes in the honeypot sub-node set are used to perform data analysis and data anomaly warning on the decapsulated data.

[0092] The above-mentioned embodiments of the present disclosure have the following beneficial effects: through the cache processing method applied to the router of some embodiments of the present disclosure, the cache pressure and data forwarding pressure of the router are reduced, and the risk of network paralysis is further reduced. Specifically, the reason for network paralysis is that since the router directly transmits data, when the data transmission volume is large, the data forwarding pressure of the router is increased, which may cause network paralysis. In practice, since the router is an intermediary for cross-network transmission, when the router is down due to data transmission pressure, it may cause network paralysis. Based on this, the cache processing method applied to the router of some embodiments of the present disclosure, first, according to the real-time network topology corresponding to the target virtual local area network, the router associated with the target router path is determined to obtain a router information set, wherein the router information in the above router information set includes: router real-time load information, router forwarding data information, a first routing table and a second routing table. In this way, the operation status of at least one router associated with the target router path is obtained. Secondly, according to the first routing table included in the router information and the data flow direction corresponding to the router forwarding data information included in the router information, the router information in the above router information set is grouped to generate a router information group set. In practice, the target router and at least one router corresponding to the router information set often present a star-shaped local network topology structure centered on the target router. When different data are transmitted through the target router and at least one router corresponding to the router information set, only some of the routers may be involved. By grouping the router information set based on the data flow direction as the segmentation unit, the topological relationship between the routers corresponding to the router information set can be further described from the perspective of the data flow direction. Then, for each router information group in the above router information group set, the following processing steps are performed: the first step is to extract features of the router forwarding data information included in each router information in the above router information group according to the data flow direction corresponding to the router forwarding data information included in the router information, so as to generate router forwarding data features and obtain a router forwarding data feature sequence. In this way, the data features of the router forwarding data information are obtained for subsequent data intent identification. The second step is to generate the data intent for the above router information group according to the above router forwarding data feature sequence. In this way, the data intent corresponding to the router forwarding data information is obtained. In the third step, in response to the data intent being the first data intent, according to the router real-time load information of the router included in the router information in the router information group, the router corresponding to the router information in the router information group is cleared of invalid cache. By clearing the invalid cache, the pressure resistance and data forwarding capability of the router are improved, and the risk of network paralysis is further reduced.In the fourth step, in response to the data intention being the second data intention, the real-time data flow direction corresponding to the router forwarding data information included in the router information in the router information group is controlled through the first routing table and the second routing table included in the router information in the router information group, so as to ensure that the data can flow correctly to the corresponding destination address. In this way, the risk of network paralysis is effectively reduced.

[0093] Further references Figure 2 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a cache processing device applied to a router. These device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the cache processing device applied to a router can be specifically applied to various electronic devices.

[0094] like Figure 2 As shown, some embodiments of the cache processing device 200 applied to the router include: a determination unit 201, a minute unit 202 and an execution unit 203. The determination unit 201 is configured to determine the router associated with the target router path according to the real-time network topology corresponding to the target virtual local area network, and obtain a router information set, wherein the router information in the above router information set includes: router real-time load information, router forwarding data information, a first routing table and a second routing table; the grouping unit 202 is configured to group the router information in the above router information set according to the first routing table included in the router information and the data flow corresponding to the router forwarding data information included in the router information, so as to generate a router information group set; the execution unit 203 is configured to perform the following processing steps for each router information group in the above router information group set: according to the data flow corresponding to the router forwarding data information included in the router information, Data flow direction, feature extraction is performed on the router forwarding data information included in each router information in the above router information group to generate router forwarding data features and obtain a router forwarding data feature sequence; based on the above router forwarding data feature sequence, a data intent is generated for the above router information group; in response to the above data intent being a first data intent, according to the router real-time load information of the router included in the router information in the above router information group, invalid cache clearing is performed on the router corresponding to the router information in the above router information group; in response to the above data intent being a second data intent, the real-time data flow direction corresponding to the router forwarding data information included in the router information in the above router information group is controlled through the first routing table and the second routing table included in the router information in the above router information group.

[0095] It can be understood that the units described in the cache processing device 200 for the router are similar to those described in the reference Figure 1Therefore, the operations, features and beneficial effects described above for the method are also applicable to the cache processing device 200 applied to the router and the units included therein, and will not be described in detail here.

[0096] Reference below Figure 3 , which shows a structural schematic diagram of an electronic device (eg, a computing device) 300 suitable for implementing some embodiments of the present disclosure. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0097] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory 302 or a program loaded from a storage device 308 into a random access memory 303. Various programs and data required for the operation of the electronic device 300 are also stored in the random access memory 303. The processing device 301, the read-only memory 302, and the random access memory 303 are connected to each other via a bus 304. An input / output interface 305 is also connected to the bus 304.

[0098] Typically, the following devices may be connected to the I / O interface 305: input devices 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 309. The communication devices 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0099] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the read-only memory 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.

[0100] It should be noted that the computer-readable medium recorded in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In some embodiments of the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0101] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (Hyper Text Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0102] The computer-readable medium may be included in the electronic device; or it may exist independently without being installed in the electronic device. The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: determines the router associated with the target router path according to the real-time network topology corresponding to the target virtual local area network, and obtains a router information set, wherein the router information in the router information set includes: router real-time load information, router forwarding data information, a first routing table and a second routing table; groups the router information in the router information set according to the data flow direction corresponding to the first routing table included in the router information and the router forwarding data information included in the router information, so as to generate a router information group set; for each router information group in the router information group set, performs the following processing steps: according to the router forwarding data included in the router information, group the router information in the router information set according to the data flow direction corresponding to the first routing table included in the router information and the router forwarding data information included in the router information, so as to generate a router information group set. According to the data flow direction corresponding to the information, feature extraction is performed on the router forwarding data information included in each router information in the above router information group to generate router forwarding data features and obtain a router forwarding data feature sequence; based on the above router forwarding data feature sequence, a data intent for the above router information group is generated; in response to the above data intent being a first data intent, according to the router real-time load information of the router included in the router information in the above router information group, invalid cache clearing is performed on the router corresponding to the router information in the above router information group; in response to the above data intent being a second data intent, the real-time data flow direction corresponding to the router forwarding data information included in the router information in the above router information group is controlled through the first routing table and the second routing table included in the router information in the above router information group.

[0103] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0104] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0105] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The described units may also be set in a processor, for example, may be described as: a processor includes a determination unit, a minute unit, and an execution unit. The names of these units do not constitute limitations on the units themselves in certain cases, for example, the grouping unit may also be described as "a unit for grouping the router information in the above router information set according to the data flow direction corresponding to the first routing table included in the router information and the router forwarding data information included in the router information to generate a router information group set."

[0106] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0107] The above descriptions are only some preferred embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) and the technical solutions formed.

Claims

1. A cache processing method applied to a target router, comprising: According to the real-time network topology corresponding to the target virtual local area network, the router associated with the target router path is determined to obtain a router information set, wherein the router information in the router information set includes: real-time router load information, router forwarding data information, a first routing table and a second routing table, wherein the target virtual local area network is a local area network covering a limited area, according to the actual network division, the target virtual local area network includes at least one sub-local area network, and the sub-local area network in at least one sub-local area network is connected to the network through a router, and the target router is a router in the target virtual local area network for connecting the sub-local area networks in at least one sub-local area network, the real-time router load information represents the load pressure of the router corresponding to the router information when transmitting data, the router forwarding data information represents the data forwarded by the router corresponding to the router information, the first routing table represents the routing table in the router corresponding to the router information for forwarding normal messages, and the second routing table represents the routing table in the router corresponding to the router information for forwarding abnormal messages to the honeypot node; According to the first routing table included in the router information and the data flow direction corresponding to the router forwarding data information included in the router information, grouping the router information including the same routing forwarding data information to generate a router information group set; For each router information group in the router information group set, the following processing steps are performed: According to the data flow direction corresponding to the router forwarding data information included in the router information, feature extraction is performed on the router forwarding data information included in each router information in the router information group to generate a router forwarding data feature and obtain a router forwarding data feature sequence; Generate a data intent for the router information group according to the router forwarding data feature sequence, wherein the data intent represents a data access intent for the forwarding data corresponding to the router information group; In response to the data intent being a first data intent, performing invalid cache clearing on a router corresponding to the router information in the router information group according to the router real-time load information included in the router information in the router information group, wherein the first data intent represents a cache clearing intent; In response to the data intention being the second data intention, controlling the real-time data flow direction corresponding to the router forwarding data information included in the router information in the router information group through the first routing table and the second routing table included in the router information in the router information group, wherein the second data intention represents the intention of performing normal data forwarding through the router, wherein the feature extraction of the router forwarding data information included in each router information in the router information group to generate a router forwarding data feature includes: The data flow feature extraction model included in the pre-trained data feature extraction model is used to extract the data flow feature corresponding to the router forwarding data information included in the router information, wherein the input of the data flow feature extraction model is the local topological structure of at least one router corresponding to the router information group in the real-time network topology map, and the data flow feature extraction model includes: a regularization layer, a first feature processing block, a second feature processing block, a third feature processing block and a pooling layer, wherein the network structures of the first feature processing block, the second feature processing block and the third feature processing block are consistent, and the first feature processing block includes: an attention mechanism layer, a graph convolution network and a time domain graph convolution layer, and the attention mechanism layer, the graph convolution network and the time domain graph convolution layer are connected in series, and the output of the regularization layer jumps to the first feature processing block through a residual connection, and is superimposed with the output of the first feature processing block as the input of the second feature processing block; Extracting data packet features corresponding to the router forwarding data information included in the router information through the data packet feature extraction model included in the data feature extraction model, wherein the data packet feature extraction model includes: a packet header feature extraction model, a non-packet header feature extraction model and a feature buffer pool, the packet header feature extraction model is used to extract the packet header features corresponding to the router forwarding data information included in the router information, and the non-packet header feature extraction model is used to extract the non-packet header features corresponding to the router forwarding data information included in the router information; Generating a router forwarding data feature in the router forwarding data feature sequence corresponding to the router information according to the data flow direction feature and the data message feature, wherein generating a data intent for the router information group according to the router forwarding data feature sequence includes: The data intent is generated by a pre-trained intent recognition model and the router forwarding data feature sequence, wherein the intent recognition model includes: a first Transformer layer, a second Transformer layer, a first convolutional layer, a second convolutional layer, a third convolutional layer and a first classifier, and the first Transformer layer, the second Transformer layer, the first convolutional layer, the second convolutional layer and the third convolutional layer are connected in series, The step of clearing invalid cache of a router corresponding to the router information in the router information group according to the router real-time load information included in the router information in the router information group includes: For each router information in the router information group, perform the following invalid cache clearing steps: Determine the router importance of the router corresponding to the router information in the real-time network topology map, wherein the router importance is a ratio of the data forwarding volume of the router corresponding to the router information to a target data forwarding volume within a preset time period, and the target data forwarding volume is an average data forwarding volume of the routers corresponding to the router information in the router information set within the preset time period; Determine a cache clearing mode according to the real-time load information of the router included in the router information, wherein the cache clearing mode represents the cache clearing intensity; Determining cache clearing policy information that matches the router importance and matches the cache clearing mode; activating a cache clearing policy corresponding to the cache clearing policy information to clear invalid caches of the router corresponding to the router information, wherein the cache clearing policy information represents a pre-set rule for performing cache clearing, Wherein, in response to the data intent being the second data intent, controlling the real-time data flow direction corresponding to the router forwarding data information included in the router information in the router information group through the first routing table and the second routing table included in the router information in the router information group, comprises: Determine the intention tendency of the second data intention to generate intention tendency information, wherein the intention tendency information is a category with a large predicted probability in a positive intention tendency category and a negative intention tendency category, the positive intention tendency category indicates that the router has no attack intention when forwarding data normally, and the negative intention tendency category indicates that the router has an attack intention when forwarding data normally, and the attack intention refers to the intention to harm the target virtual local area network and the connected hardware; In response to determining that the intention tendency information represents a positive intention tendency, for each router information in the router information group, forwarding the router forwarding data information to the corresponding destination address through the first routing table to control the real-time data flow corresponding to the router forwarding data information included in the routing information; In response to determining that the intention tendency information represents a negative intention tendency, for each router information in the router information group, the router forwarding data information included in the routing information is controlled to flow to the honeypot node through the second routing table, wherein the node position of the honeypot node is dynamically adjusted according to the data traffic corresponding to the real-time network topology diagram, and the second routing table is updated in real time according to the node position of the honeypot node.

2. The method according to claim 1, wherein: The step of determining a router associated with a target router path according to a real-time network topology diagram corresponding to the target virtual local area network and obtaining a router information set includes: Taking the position of the target router in the real-time network topology map as the traversal center, taking the routers whose hop distance to the target router is less than the preset hop distance and whose communication path to the target router is reachable as candidate routers, and obtaining a set of candidate routers, wherein the hop distance refers to the number of hops that need to be crossed for communication between routers, and the reachable communication path indicates that there is a communication link that can be used for information transmission between the router and the target router; For each candidate router in the candidate router set, the following router information determination steps are performed: Determine the real-time load information of the candidate router as the real-time load information of the router included in the router information corresponding to the candidate router; Determine the forwarding data forwarded by the candidate router within a preset time period as the router forwarding data information included in the router information corresponding to the candidate router; A routing table stored in the candidate router and used for data forwarding addressing is determined as the first routing table and the second routing table included in the router information corresponding to the candidate router.

3. The method according to claim 2, wherein: After controlling the router forwarding data information included in the routing information to flow to the honeypot node through the second routing table, the method further includes: In response to the honeypot node receiving the router forwarding data information included in the routing information, decapsulating the router forwarding data information to obtain decapsulated data; Generate decapsulated data description information according to the decapsulated data, wherein the decapsulated data description information includes: service type description information and a data response identifier, wherein the service type description information is used to describe the service type matching the decapsulated data, and the data response identifier indicates whether to perform a data response to the decapsulated data; Generating a honeypot sub-node set in the honeypot node according to the business type description information, wherein the honeypot sub-nodes in the honeypot sub-node set are used to load a business simulation environment; When the data response identifier indicates that response data corresponding to the decapsulated data needs to be generated, generating response data for the router forwarding data information included in the routing information through the honeypot subnodes in the honeypot subnode set; Responding the response data to a data transmission source corresponding to the router forwarding data information through the target virtual local area network; When the data response identifier indicates that there is no need to generate response data corresponding to the decapsulated data, the honeypot sub-nodes in the honeypot sub-node set perform data analysis and data anomaly warning on the decapsulated data.

4. A cache processing device applied to a target router, comprising: The determination unit is configured to determine the router associated with the target router path according to the real-time network topology corresponding to the target virtual local area network, and obtain a router information set, wherein the router information in the router information set includes: router real-time load information, router forwarding data information, a first routing table and a second routing table, wherein the target virtual local area network is a local area network covering a limited area, and according to the actual network division, the target virtual local area network includes at least one sub-local area network, and the sub-local area network in at least one sub-local area network is connected to the network through a router, and the target router is a router in the target virtual local area network for connecting the sub-local area networks in at least one sub-local area network, the router real-time load information represents the load pressure of the router corresponding to the router information when transmitting data, the router forwarding data information represents the data forwarded by the router corresponding to the router information, the first routing table represents the routing table in the router corresponding to the router information for forwarding normal messages, and the second routing table represents the routing table in the router corresponding to the router information for forwarding abnormal messages to the honeypot node; a grouping unit configured to group router information including the same routing forwarding data information according to the first routing table included in the router information and the data flow direction corresponding to the router forwarding data information included in the router information, so as to generate a router information group set; The execution unit is configured to perform the following processing steps for each router information group in the router information group set: according to the data flow direction corresponding to the router forwarding data information included in the router information, feature extraction is performed on the router forwarding data information included in each router information in the router information group to generate a router forwarding data feature and obtain a router forwarding data feature sequence; according to the router forwarding data feature sequence, a data intent for the router information group is generated, wherein the data intent represents the data access intent of the forwarding data corresponding to the router information group; in response to the data intent being a first data intent, according to the router real-time load information of the router included in the router information in the router information group, an invalid cache is cleared for the router corresponding to the router information in the router information group, wherein the first data intent represents the cache clearing intent; in response to the data intent being a second data intent, the real-time data flow direction corresponding to the router forwarding data information included in the router information in the router information group is controlled through the first routing table and the second routing table included in the router information in the router information group, wherein the second data intent represents the intent of performing normal data forwarding through the router, wherein the feature extraction is performed on the router forwarding data information included in each router information in the router information group to generate the router forwarding data feature, including: The data flow feature extraction model included in the pre-trained data feature extraction model is used to extract the data flow feature corresponding to the router forwarding data information included in the router information, wherein the input of the data flow feature extraction model is the local topological structure of at least one router corresponding to the router information group in the real-time network topology map, and the data flow feature extraction model includes: a regularization layer, a first feature processing block, a second feature processing block, a third feature processing block and a pooling layer, wherein the network structures of the first feature processing block, the second feature processing block and the third feature processing block are consistent, and the first feature processing block includes: an attention mechanism layer, a graph convolution network and a time domain graph convolution layer, and the attention mechanism layer, the graph convolution network and the time domain graph convolution layer are connected in series, and the output of the regularization layer jumps to the first feature processing block through a residual connection, and is superimposed with the output of the first feature processing block as the input of the second feature processing block; Extracting data packet features corresponding to the router forwarding data information included in the router information through the data packet feature extraction model included in the data feature extraction model, wherein the data packet feature extraction model includes: a packet header feature extraction model, a non-packet header feature extraction model and a feature buffer pool, the packet header feature extraction model is used to extract the packet header features corresponding to the router forwarding data information included in the router information, and the non-packet header feature extraction model is used to extract the non-packet header features corresponding to the router forwarding data information included in the router information; generating a router forwarding data feature in the router forwarding data feature sequence corresponding to the router information according to the data flow direction feature and the data message feature, The step of generating a data intent for the router information group according to the router forwarding data feature sequence includes: The data intent is generated by a pre-trained intent recognition model and the router forwarding data feature sequence, wherein the intent recognition model includes: a first Transformer layer, a second Transformer layer, a first convolutional layer, a second convolutional layer, a third convolutional layer and a first classifier, and the first Transformer layer, the second Transformer layer, the first convolutional layer, the second convolutional layer and the third convolutional layer are connected in series, The step of clearing invalid cache of a router corresponding to the router information in the router information group according to the router real-time load information included in the router information in the router information group includes: For each router information in the router information group, perform the following invalid cache clearing steps: Determine the router importance of the router corresponding to the router information in the real-time network topology map, wherein the router importance is a ratio of the data forwarding volume of the router corresponding to the router information to a target data forwarding volume within a preset time period, and the target data forwarding volume is an average data forwarding volume of the routers corresponding to the router information in the router information set within the preset time period; Determine a cache clearing mode according to the real-time load information of the router included in the router information, wherein the cache clearing mode represents the cache clearing intensity; Determining cache clearing policy information that matches the router importance and matches the cache clearing mode; activating a cache clearing policy corresponding to the cache clearing policy information to clear invalid caches of the router corresponding to the router information, wherein the cache clearing policy information represents a pre-set rule for performing cache clearing, Wherein, in response to the data intent being the second data intent, controlling the real-time data flow direction corresponding to the router forwarding data information included in the router information in the router information group through the first routing table and the second routing table included in the router information in the router information group, comprises: Determine the intention tendency of the second data intention to generate intention tendency information, wherein the intention tendency information is a category with a large predicted probability in a positive intention tendency category and a negative intention tendency category, the positive intention tendency category indicates that the router has no attack intention when forwarding data normally, and the negative intention tendency category indicates that the router has an attack intention when forwarding data normally, and the attack intention refers to the intention to harm the target virtual local area network and the connected hardware; In response to determining that the intention tendency information represents a positive intention tendency, for each router information in the router information group, forwarding the router forwarding data information to the corresponding destination address through the first routing table to control the real-time data flow corresponding to the router forwarding data information included in the routing information; In response to determining that the intention tendency information represents a negative intention tendency, for each router information in the router information group, the router forwarding data information included in the routing information is controlled to flow to the honeypot node through the second routing table, wherein the node position of the honeypot node is dynamically adjusted according to the data traffic corresponding to the real-time network topology diagram, and the second routing table is updated in real time according to the node position of the honeypot node.

5. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 3.

6. A computer readable medium having a computer program stored thereon, wherein: When the computer program is executed by a processor, the method according to any one of claims 1 to 3 is implemented.

Images