Deep learning based sd-wan application identification method and system

Abstract

The application provides a deep learning-based SD-WAN application identification method and system. The method comprises capturing and analyzing a plurality of traffic data in an SD-WAN network to obtain analyzed data. SD-WAN refers to a software-defined wide area network. After the analyzed data is converted into a data picture through a picture processing technology, picture features in the data picture are extracted. The picture features are input into a preset deep learning model for training. The SD-WAN network traffic data to be identified is input into the deep learning model to obtain a preliminary matching result matched with the picture features. The preliminary matching result is subjected to confidence evaluation, which comprises calculating a similarity score of the preliminary matching result and the picture features. If the similarity score exceeds a preset threshold, a final application category is determined according to the preliminary matching result, and the application category comprises an encrypted application. Through the method, accurate identification of various applications including encrypted applications can be achieved.

Description

Technical Field

[0001] This application relates to the Internet field, and in particular to a method and system for identifying SD-WAN applications based on deep learning. Background Technology

[0002] With the rapid development of technologies such as cloud computing and big data, enterprises' demands for networks are also increasing, especially for wide area networks (WANs). Traditional WANs, due to architectural limitations, cannot meet the flexibility, efficiency, and security requirements of modern enterprises. Therefore, Software-Defined Wide Area Networks (SD-WAN) have emerged. SD-WAN, through centralized control and open interfaces, can achieve intelligent identification and optimization of applications, thereby improving network performance.

[0003] In SD-WAN networks, application identification is a key technology that helps network administrators understand the types of applications running on the network, optimize network performance, and formulate corresponding management policies. Currently, application identification primarily employs Deep Packet Inspection (DPI) technology. DPI performs in-depth parsing and analysis of data packets to extract application layer protocol features, which are then matched with known application features in a feature database to identify specific applications.

[0004] However, DPI technology also has some limitations: the accuracy of DPI technology depends heavily on the completeness and update frequency of the feature library. If a new application or protocol appears and there is no corresponding feature in the feature library, DPI cannot identify it correctly, and it is difficult to identify encrypted applications or other application categories by extracting application features. Summary of the Invention

[0005] This application provides a deep learning-based SD-WAN application identification method and system for accurately identifying various applications, including encrypted applications.

[0006] Firstly, this application provides a deep learning-based SD-WAN application identification method, which includes: capturing and parsing multiple traffic data in an SD-WAN network to obtain parsed data, wherein SD-WAN refers to Software-Defined Wide Area Network; after converting the parsed data into a data image using image processing technology, extracting image features from the data image; inputting the image features into a preset deep learning model for training; inputting the SD-WAN network traffic data to be identified into the deep learning model to obtain a preliminary matching result that matches the image features; performing a confidence assessment on the preliminary matching result, wherein the confidence assessment includes calculating a similarity score between the preliminary matching result and the image features; if the similarity score exceeds a preset threshold, determining the final application category based on the preliminary matching result, wherein the application category includes encrypted applications.

[0007] In the above technical solution, by extracting features from SD-WAN network traffic through image conversion, matching and identifying application categories based on a deep learning model, and introducing a confidence evaluation mechanism to judge the reliability of the identification results, accurate identification of various applications, including encrypted applications, is achieved.

[0008] In conjunction with some technical solutions of the first aspect, some technical solutions, after assessing the confidence of the preliminary matching result, which includes calculating the similarity score between the preliminary matching result and the image feature, further include: identifying traffic data whose similarity score does not exceed the preset threshold as unknown traffic data; after aggregating multiple unknown traffic data, determining new traffic features corresponding to the unknown application traffic through big data analysis and mining techniques; after labeling the new application traffic features, generating a new application feature library; and updating the deep learning model through the new application feature library.

[0009] The above technical solution allows for the continuous expansion and improvement of the feature library of the deep learning model, enhancing its adaptability and recognition capabilities for unknown applications. This enables the method to continuously address emerging application types, exhibiting good scalability and robustness. Simultaneously, mining the features of unknown traffic data maximizes the utilization of captured traffic information, continuously iteratively optimizing the recognition model and results.

[0010] In conjunction with some technical solutions of the first aspect, some technical solutions, after the step of inputting the image features into a preset deep learning model for training, further include: updating the deep learning model using the volume characteristics of multiple traffic data to obtain an updated deep learning model; inputting the SD-WAN network traffic data to be identified into the updated deep learning model to obtain volume traffic data that matches the volume characteristics; and determining the application category of the volume traffic data according to the volume characteristics.

[0011] In the above technical solution, by learning the volume characteristics of traffic, the deep learning model can characterize and identify applications from the dimension of data volume, improving the accuracy and comprehensiveness of application identification. Combining volume features with image features to represent application traffic from multiple dimensions can achieve better identification results than using a single feature.

[0012] In conjunction with some technical solutions from the first aspect, some solutions include the following steps in which the SD-WAN network traffic data to be identified is input into the deep learning model to obtain preliminary matching results that match the image features: the SD-WAN network traffic data to be identified is time-segmented to obtain a time window of a set length; the traffic data within each time window is parsed and features are extracted to obtain the corresponding traffic data image; the traffic data image is input into the deep learning model to obtain the application category probability distribution of the traffic data within the time window; after preprocessing the application category probability distribution, the final application category label is obtained; and the application category label is determined as the preliminary matching result of the traffic data within the time window.

[0013] In the above technical solution, by introducing a time window, continuous traffic is divided into multiple discrete segments. The traffic within each segment will exhibit local features of application behavior within that time span, which is beneficial for deep learning models to perform fine-grained traffic modeling and application identification. At the same time, by setting an appropriate window length, a trade-off can be struck between identification accuracy and real-time performance, capturing key behavioral features of the application without introducing excessive waiting latency, thus meeting the requirements of real-time application identification.

[0014] In conjunction with some technical solutions in the first aspect, the step of obtaining the final application category label after preprocessing the application category probability distribution specifically includes: classifying the traffic data within each time window to obtain the original classification result for each time window; determining the application category probability distribution after smoothing the original classification results within adjacent time windows; assigning the corresponding application category label to applications whose application category probability is higher than the application category probability threshold after determining the application category probability threshold; and merging the same application category labels within adjacent time windows to obtain the final application category label for the time window.

[0015] In the above technical solution, the application behavior of traffic exhibits a certain continuity and correlation in adjacent time periods, and the application category at the current moment depends to some extent on the situation at previous and subsequent time periods. By aggregating the identification results over a period of time and utilizing this temporal dependence, it is possible to correct identification errors that may exist in a single time window, thereby improving the overall accuracy and robustness of identification.

[0016] In conjunction with some technical solutions of the first aspect, some technical solutions, after the step of determining the final application category based on the preliminary matching result if the similarity score exceeds a preset threshold, further include: performing cluster analysis on traffic data with the same application category to divide the traffic data into different traffic groups; performing statistical analysis on the traffic within each traffic group to calculate various indicators of the traffic data and the average indicator of the traffic group data; comparing the various indicators with the average indicator to determine abnormal traffic; and after generating alarm information based on the detection results of abnormal traffic, sending the detection results and the alarm information to the display terminal.

[0017] In the above technical solution, clustering can reveal the application's inherent traffic organization structure and patterns. By calculating traffic statistics within and around the group, a baseline for normal behavior is established as a reference to detect abnormal deviations in groups and members. This allows for the timely detection of potential abnormal traffic and security threats within the group. Feeding the detection results and alarm information back to the administrator can assist in subsequent traffic control and security protection decisions.

[0018] In conjunction with some technical solutions of the first aspect, some technical solutions, after determining the abnormal traffic, also include: extracting the spatiotemporal characteristics of the abnormal traffic, determining the distribution pattern and evolution trend of the abnormal traffic; after determining the abnormal traffic information based on the distribution pattern and evolution trend, sending it to the display terminal for display, the abnormal traffic information including the abnormal cause, propagation path and scope of impact of the abnormal traffic.

[0019] In the aforementioned technical solutions, on the one hand, abnormal traffic usually exhibits a certain temporal and spatial correlation, and timely detection of this correlation helps to uncover some hidden abnormal behaviors; on the other hand, anomalies often possess the characteristics of diffusion and dynamic evolution, and analyzing their propagation trajectory and scope of impact is crucial for judging the severity and potential risks of the anomaly. By analyzing the spatiotemporal characteristics of abnormal traffic and combining it with business semantic information, a comprehensive understanding of the abnormal event can be formed, laying the foundation for rapid anomaly localization, impact assessment, and the formulation of countermeasures, thus shifting from passive anomaly detection to proactive anomaly perception and early warning.

[0020] In a second aspect, embodiments of this application provide an application identification system, which includes: one or more processors and a memory; the memory is coupled to the one or more processors, and the memory is used to store computer program code, the computer program code including computer instructions, and the one or more processors call the computer instructions to cause the application identification system to perform the method described in the first aspect and any possible implementation thereof.

[0021] Thirdly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on an application identification system, cause the application identification system to perform the method described in the first aspect and any possible implementation thereof.

[0022] Fourthly, embodiments of this application provide a computer program product that, when run on an application identification system, causes the application identification system to perform the method described in the first aspect and any possible implementation thereof.

[0023] It is understood that the application identification system provided in the second aspect, the computer-readable storage medium provided in the third aspect, and the computer program product provided in the fourth aspect are all used to execute the methods provided in the embodiments of this application. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0024] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0025] 1. By employing deep learning technology to identify traffic data and constructing an application identification model based on image features, it can fully utilize the behavioral pattern information contained in traffic data, effectively solving the problem of insufficient identification capability of traditional methods for unknown applications and encrypted traffic, thereby achieving accurate identification of various applications, including encrypted applications, in SD-WAN networks.

[0026] 2. By using time windows to segment traffic and smoothing the recognition results across windows to improve the continuity and robustness of recognition, it can capture key behavioral features applied at different time granularities while ensuring real-time performance. This effectively solves the problems of discreteness and one-sidedness in recognition results, and thus achieves a comprehensive application characterization that combines macro and micro perspectives.

[0027] 3. By employing cluster analysis and anomaly detection techniques, the application's inherent traffic organization structure and abnormal patterns are uncovered, and the spatiotemporal evolution characteristics of abnormal traffic are analyzed. Therefore, the application's internal structure can be characterized more finely and abnormal behavior can be detected. This effectively solves the problem that traditional application identification methods cannot perceive the application's inherent security risks, thus achieving the organic integration of application identification and anomaly detection. Attached Figure Description

[0028] Figure 1 This is a flowchart illustrating a deep learning-based SD-WAN application identification method in an embodiment of this application.

[0029] Figure 2This is another flowchart illustrating a deep learning-based SD-WAN application identification method in an embodiment of this application;

[0030] Figure 3 This is another flowchart illustrating a deep learning-based SD-WAN application identification method in an embodiment of this application;

[0031] Figure 4 This is a schematic diagram of the functional module structure of the application identification system in the embodiments of this application;

[0032] Figure 5 This is a schematic diagram of the physical device structure of the identification system applied in the embodiments of this application. Detailed Implementation

[0033] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to any or all possible combinations including one or more of the listed items.

[0034] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0035] To make it easier to understand, a relevant application scenario is introduced below.

[0036] Suppose a company has deployed an SD-WAN network, whose main business systems include an ERP system, an OA office system, and a video conferencing system. Because the video conferencing system consumes a large amount of bandwidth, the response speed of the critical ERP system slows down, impacting business operations. To ensure the performance of the ERP system, the network administrator wants to identify and control the traffic from the video conferencing system.

[0037] However, the company recently launched a self-developed video conferencing software with a unique application layer protocol and communication mechanism. Since this software is newly launched, its application characteristics are not yet included in the DPI system's feature library. Furthermore, because the software's communication data is encrypted, application characteristics cannot be directly extracted from the data content. This results in the DPI system being unable to accurately identify the software's traffic, and network administrators being unable to effectively manage it. In this situation, the limitations of traditional DPI technology become apparent: the feature library cannot be updated in real time and struggles to adapt to newly emerging applications. It is powerless against encrypted traffic and cannot extract usable application layer characteristics. This prevents network administrators from fully understanding the application status within the network, impacting the effectiveness of network optimization. Administrators are looking for an intelligent identification method that can continuously learn and automatically discover unknown applications, thereby enabling more intelligent and flexible application awareness and traffic scheduling.

[0038] It is evident that traditional DPI technology is insufficient to meet the demands of rapidly identifying new applications and handling encrypted traffic in this application scenario. Therefore, there is an urgent need to explore a new application identification method based on machine learning.

[0039] The deep learning-based SD-WAN application identification method in this application captures and parses SD-WAN network traffic data, converts the parsed data into image data, extracts image features, trains and matches a deep learning model to obtain preliminary matching results, and then determines the final application category through confidence evaluation. This achieves accurate identification of applications in the SD-WAN network, capable of identifying both plaintext and encrypted applications. This method fully leverages the advantages of deep learning in image feature extraction and classification. Through an end-to-end identification process, it overcomes the limitations of traditional DPI technology, which relies on the completeness of the feature library and struggles to identify encrypted applications, significantly improving the flexibility, accuracy, and real-time performance of application identification in the SD-WAN environment.

[0040] To facilitate understanding, the method provided in this implementation will be described in detail below, using the above scenario as an example. Please refer to [link / reference]. Figure 1 , Figure 1 This is a flowchart illustrating a deep learning-based SD-WAN application identification method in an embodiment of this application.

[0041] S101. Capture and parse multiple traffic data in the SD-WAN network to obtain the parsed data. Here, SD-WAN refers to Software-Defined Wide Area Network.

[0042] SD-WAN (Software-Defined Wide Area Network) is a specific application scenario of SDN (Software-Defined Networking) technology in WAN (Wide Area Network). SD-WAN is a network abstracted from its hardware, creating a virtualized network coverage that operators can remotely manage and quickly expand across long geographical distances.

[0043] The application identification system first needs to capture traffic data in the SD-WAN. This step is fundamental to the entire application identification process, as only by acquiring network traffic data can the system further analyze and identify the application types within it. The application identification system captures passing data packets using sensors or traffic monitoring tools deployed in the SD-WAN network. The captured data includes, but is not limited to, IP addresses, port numbers, protocol types, packet sizes, and transport layer information. After capturing the data, the system parses it to extract useful information. The parsing process may involve deep packet inspection (DPI) of the data packets to identify application layer protocol characteristics.

[0044] S102. After converting the parsed data into a data image using image processing technology, extract the image features from the data image;

[0045] Specifically, the application recognition system first preprocesses the parsed traffic data, standardizing it into a unified data format. Then, using image processing and computer vision techniques, the system transforms this standardized data into an image representation. For example, the system can map the attribute values ​​of each flow (such as source and destination IPs, port numbers, protocol types, and data lengths) to different pixel positions and color channels of the image, thus obtaining a data image that reflects the characteristics of the flow. Next, the system extracts features from the generated data image. It can use various image feature description algorithms to extract a series of feature vectors from the data image that characterize its texture, shape, color distribution, and other visual properties. These image features represent the inherent patterns of the original traffic data from another dimension and can be used for subsequent deep learning modeling.

[0046] For example, suppose an application recognition system parses an HTTP stream, obtaining structured data such as its request line, header fields, and message body. The system can first convert these data items into a fixed-size two-dimensional matrix, with each element corresponding to a byte or character. Then, the system can treat this matrix as a grayscale image and use image feature extraction algorithms to calculate its local and global texture features, such as GLCM (Gray-Level Co-occurrence Matrix) and wavelet transform coefficients, thereby obtaining a compact feature vector to represent the image features of this HTTP stream.

[0047] S103. Input the image features into a preset deep learning model for training;

[0048] Application recognition systems need to build a deep neural network model that can efficiently learn image features and classify applications. Some convolutional neural network architectures can be used as the basic model, and appropriate improvements and optimizations can be made according to the specific application recognition task.

[0049] The application recognition system selects a portion of massive historical traffic data as a training set, converts it into images, extracts features, and feeds them into a deep learning model for training. During training, the application recognition system continuously adjusts the model's parameters, enabling it to learn the inherent mapping relationship between image features and application categories. This process can be carried out through supervised learning; that is, the application recognition system can pre-label each traffic data point in the training set with an application category, and then minimize the error between the model's prediction and the true label, thereby continuously improving the model's classification ability.

[0050] In some embodiments, after training the deep learning model, the model can be updated using the volume characteristics of multiple traffic data points to obtain an updated deep learning model. The SD-WAN network traffic data to be identified is then input into the updated deep learning model to obtain traffic volume data matching the volume characteristics. The application category of the traffic volume data is determined according to these volume characteristics. Here, the volume characteristics of traffic data refer to indicators such as traffic size and data transmission rate. After initially training the deep learning model using image features, the application identification system can collect volume characteristics of a large amount of traffic data. These volume characteristics are labeled with corresponding application categories to generate a volume characteristic dataset. The deep learning model is then further trained using this dataset, enabling it to learn the correspondence between traffic volume and application category. At this point, the deep learning model integrates image features and volume characteristics, forming a more powerful recognizer. For new traffic, the application identification system inputs its volume characteristics into the updated model to obtain a matching application category. If the volume characteristics of a traffic flow match the typical volume range of a certain application category, the traffic flow can be determined to belong to that application category. For example, if a traffic packet has an average length of 1400 bytes and a throughput of 30Mbps, matching the size characteristics of a video application, then the traffic can be identified as video application traffic.

[0051] S104. Input the SD-WAN network traffic data to be identified into the deep learning model to obtain a preliminary matching result that matches the features of the image;

[0052] When the application identification system captures new SD-WAN network traffic data, it first performs the same data preprocessing as during the training phase to extract relevant image features. Then, the system inputs these extracted image features into a pre-trained deep learning model. After forward propagation, it calculates the matching probability of the traffic data for each application category. This probability reflects the similarity in image feature patterns between the traffic to be identified and each application category, and can serve as a preliminary matching result.

[0053] For example, suppose an application identification system extracts image features from unknown encrypted traffic data and inputs them into a trained deep learning model for prediction. The model's output layer will provide a 10-dimensional probability vector, with each dimension corresponding to an application category, and the value representing the probability that the traffic belongs to that category. For example, an output vector of [0.1, 0.05, 0.7, 0.02, ...] indicates that the model believes the traffic belongs to the third application category with 70% confidence. The application identification system can select the category with the highest probability as the initial matching result. If the third application category is video application, then the traffic is considered to be a video application.

[0054] S105. Calculate the confidence level of the preliminary matching result, which includes calculating the similarity score between the preliminary matching result and the image features.

[0055] The application identification system first normalizes the probability distribution of application categories in the preliminary matching results, mapping the probability of each application category to between 0 and 1 for easier subsequent calculation and comparison. Then, the system extracts key information from the preliminary matching results and image features to construct feature vectors. The feature vectors for the preliminary matching results may include application categories and their corresponding probabilities, port numbers used for traffic, etc., while the feature vectors for image features may include color histograms, texture features, shape features, etc.

[0056] Next, the recognition system calculates the similarity between the two feature vectors, obtaining a similarity score between 0 and 1. The closer the similarity score is to 1, the closer the initial matching result is to the image features, and the higher the confidence level; the closer the similarity score is to 0, the greater the difference between the two, and the lower the confidence level.

[0057] For example, an application identification system identifies an unknown application, with preliminary matching results showing a 70% probability that it belongs to the instant messaging category. Extracting the application's traffic data image reveals that its color histogram distribution is very similar to that of known instant messaging applications (such as WeChat), and its texture and shape features are also quite similar. The calculated similarity score is 0.8, higher than the preset confidence threshold of 0.75, therefore, the preliminary matching result can be considered highly reliable.

[0058] By comparing similarity scores, the application recognition system can quantitatively assess the confidence level of preliminary matching results, automatically determining which recognition results are reliable and which require further verification. This confidence assessment mechanism provides a method for evaluating the quality of preliminary matching results, avoiding blind trust and helping to improve the accuracy and reliability of application recognition. Furthermore, quantifying confidence as a specific numerical value also provides a reference for subsequent adjustments to the recognition strategy.

[0059] S106. If the similarity score exceeds a preset threshold, the final application category is determined based on the preliminary matching result. The application category includes encrypted applications.

[0060] The application identification system pre-sets a confidence threshold as a standard for judging the credibility of the preliminary matching results. When the similarity score is higher than this threshold, it means that the preliminary matching results highly match the image features, and the preliminary matching results can be considered accurate and reliable. At this time, the application identification system can directly accept the preliminary matching results and determine them as the final application category of the traffic to be identified.

[0061] It is important to note that "application category" is a broad concept, encompassing various plaintext and encrypted applications. Traditional DPI techniques often struggle to identify encrypted applications, but the method in this application, through deep learning and multi-dimensional feature fusion, achieves equal treatment for both plaintext and encrypted applications. Although the data content of encrypted applications is encrypted, their traffic behavior patterns share certain similarities with those of similar plaintext applications. These similarities can be captured and modeled through image visualization and machine learning.

[0062] For example, an app, after initial matching, has an 85% probability of belonging to the instant messaging category, with a similarity score of 0.9 for its traffic image features, exceeding the preset confidence threshold of 0.8. Based on this, the app identification system concludes that although the app's communication content is encrypted and cannot be directly detected, its traffic behavior pattern is very similar to known mainstream instant messaging apps such as WeChat and QQ. Therefore, the app identification system ultimately classifies this app as an encrypted instant messaging app. As another example, an app's initial matching results show a 90% probability of belonging to the online video category, but its similarity score is only 0.7, below the confidence threshold. This means that although it is relatively close to known video apps in terms of pure traffic features, the similarity of its image features is not high, indicating a certain difference between the two. Therefore, the app identification system will not simply accept the initial matching results but will reserve its opinion on the app's identity, refraining from making a final judgment and awaiting further verification.

[0063] In some embodiments, if the similarity score of a traffic flow with all known applications is below a preset threshold, the traffic flow can be identified as unknown traffic. These unknown traffic flows are collected and aggregated into an unknown traffic dataset. Then, big data analytics techniques are used to perform statistical and correlation analyses on the unknown traffic dataset to discover commonalities among these unknown flows. Through this mining, new traffic characteristic parameters can be extracted from these unknown flows, such as combinations of specific ports, protocols, and packet size distributions mapping to a new unknown application. These newly discovered unknown traffic features can then be manually verified and labeled with corresponding application tags. These newly extracted unknown application traffic features are integrated into the existing application feature library. The expanded feature library is used to retrain the deep learning model, enabling it to learn these newly added unknown application features. In this way, the recognition capability of the deep learning model is expanded and enhanced, allowing it to identify more unknown applications. Simultaneously, this process also enables continuous iteration and training of the deep learning model, continuously improving its ability to handle new applications.

[0064] The above embodiments employ the deep learning-based application identification technology described in this application. By representing network traffic in an image format and using a deep learning model for feature learning and matching, and then supplementing it with a confidence evaluation mechanism to determine the credibility of the identification results, accurate identification of various applications in the SD-WAN network is achieved. It can identify not only known application categories, but also unknown and encrypted applications.

[0065] The following provides a more detailed description of the process of the method provided in this implementation. Please refer to [link / reference]. Figure 2 , Figure 2 This is another flowchart illustrating a deep learning-based SD-WAN application identification method in an embodiment of this application.

[0066] S201. Perform time segmentation on the SD-WAN network traffic data to be identified to obtain a time window of a set length;

[0067] Application identification systems need to discretize continuous network traffic to capture application characteristics at different time granularities. Specifically, the application identification system can preset a time window length, such as 1 second. Then, the application identification system segments the captured network traffic according to this time window, processing each second of traffic as a sample.

[0068] The setting of the time window needs to take into account both real-time performance and feature extraction requirements. A window that is too short will result in too small a sample size, making it impossible to effectively extract application features; a window that is too long will introduce excessive latency, failing to meet the real-time processing requirements of traffic. The specific window size needs to be determined based on the statistical characteristics of network traffic, application type, and recognition requirements.

[0069] S202. Analyze and extract features from the traffic data within each time window to obtain the corresponding traffic data image;

[0070] For each segmented time window sample, the application recognition system needs to parse the traffic information it contains, extract features, and finally generate the corresponding traffic data image.

[0071] Specifically, the application recognition system can parse the content of each traffic data packet, including fields such as source and destination IP addresses, source and destination ports, protocol type, length, and timestamp. This information reflects the network layer and transport layer characteristics of the traffic. After obtaining this structured feature data, the application recognition system preprocesses it into a unified format and then maps it to a two-dimensional image matrix. For example, each byte can be mapped to a pixel, source / destination addresses and ports can be mapped to image coordinates, and request commands and content types can be mapped to different color channels. In this way, the application recognition system can transform abstract traffic features into intuitive image representations. The application recognition system can obtain a large number of traffic data samples with image representations as training data for deep learning models.

[0072] S203. Input the traffic data image into the deep learning model to obtain the application category probability distribution of the traffic data within the time window;

[0073] For each time window, the application recognition system inputs the traffic data images into the constructed deep learning model. After forward propagation calculation, the predicted probability of traffic corresponding to each candidate application category can be obtained, i.e., the application category probability distribution.

[0074] Specifically, deep learning models extract hierarchical visual features from images and then obtain the predicted probability for each category. Assume there are n application categories, such as instant messaging, video calling, and web browsing. The output layer of the deep learning model generates an n-dimensional vector [P1, P2, ..., Pn], where Pi (i = 1, 2, ..., n) represents the probability that the traffic data is predicted to belong to the i-th application category.

[0075] This application of the identification system allows for comparison of probability distribution differences across different time windows (i.e., different traffic samples), enabling discrimination based on time dimension information.

[0076] S204. After preprocessing the probability distribution of the application category, the final application category label is obtained;

[0077] The application identification system first detects anomalous data in the probability distribution. There are two main types of anomalies: First, the predicted probability of a certain application category is too high or too low, significantly deviating from the normal probability range for that category. This may be due to insufficient sample size or model misjudgment. Second, the probability values ​​of different application categories are similar, making it impossible to clearly distinguish between them. This may be due to overly similar application behavior patterns or the simultaneous presence of traffic from different applications. For the first type of anomaly, the application identification system can set a threshold to adjust predicted values ​​exceeding the normal probability range to a default probability value. For example, if the original distribution is [0.8, 0.1, 0.05, 0.05], and the first category has a high proportion, it can be modified to [0.4, 0.2, 0.2, 0.2]. For the second type of anomaly, the application identification system can merge multiple categories with similar probability values, uniformly classifying them into types such as "unknown application" or "mixed application traffic." After processing the anomalies, the application identification system obtains the corrected application category probability distribution. Then, based on the processed distribution, the application identification system selects the application category with the highest probability as the final identification label result for that time window.

[0078] S205. Classify the traffic data within each time window to obtain the original classification result for each time window;

[0079] For each time window of traffic, the deep learning model outputs a probability distribution vector, representing the probability that the traffic in that window belongs to each application category. The application identification system needs to determine a unique classification result from this vector as the original category label for that window. Specifically, the application identification system selects the category with the highest probability as the original classification result for that window. For example, for window 1, the model outputs a probability distribution of [0.3, 0.1, 0.6], so the third category with the highest probability is selected as the original classification result for that window. For window 2, [0.1, 0.8, 0.1], the second category is selected as the original result.

[0080] S206. After smoothing the original classification results within adjacent time windows, determine the probability distribution of the application category.

[0081] After obtaining the original classification results for each time window using the recognition system, the correlation between the results of neighboring windows is further considered, and the original results are smoothed to improve the robustness of the classification decision.

[0082] Specifically, the application recognition system examines the original classification results of adjacent time windows. If the result of a window is inconsistent with the results of the preceding and following windows, the system considers modifying the classification result of that window to be consistent with the results of the preceding and following windows.

[0083] For example, suppose the original classification results for three consecutive time windows are A, B, and A, respectively. The application recognition system will change the result B in the middle window to A, making the classification results consistent across the three windows. This utilizes the assumption that traffic has a certain continuity and correlation in adjacent time windows, which can correct misclassifications caused by insufficient sample size in a single window.

[0084] S207. After determining the application category probability threshold, apply the corresponding application category label to applications whose application category probability is higher than the application category probability threshold.

[0085] After obtaining the probability distribution of application categories over multiple long time windows, the application identification system also needs to set a probability threshold to filter out categories with too low a probability and select only categories with higher probabilities for labeling.

[0086] Specifically, the application identification system pre-sets a probability threshold, such as 0.05. It then scans the probability distribution, and for all categories with probabilities exceeding 0.05, the system assigns them the corresponding category label. Using the probability distribution [0.3, 0.5, 0.2] in the example above, assuming the three categories are A, B, and C, only A and B have probabilities exceeding the 0.05 threshold. Therefore, the application identification system will label these two application categories over a longer time window.

[0087] Introducing probability thresholds serves two purposes: first, to filter out categories with excessively low probabilities, thereby improving the reliability of category determination; and second, to provide a basis for subsequent management decisions such as application traffic control and optimization based on the identified main category labels.

[0088] S208. Merge identical application category labels within adjacent time windows to obtain the final application category labels for the time windows.

[0089] After obtaining application category labels for multiple longer time windows, the application recognition system also needs to consider the correlation between the results of these longer time windows to further optimize the recognition results. If several consecutive time windows are found to have the same category label, these time windows will be merged and uniformly determined as a classification result for a longer time span window.

[0090] By merging multiple longer time windows, some local noise and misclassifications can be filtered out, and corrections can be made using the continuity of labels over time. Merging classification results with longer time spans also provides a more global perspective, representing the overall application characteristics within that time period. The application identification system can also adjust the confidence level of application category labels based on the length of the merged time window. The longer the time span, the more stable the classification label is over time, and the higher the confidence level. The application identification system can set an appropriate time span threshold to output only the classification results of longer time windows with sufficiently high confidence, filtering out short time window results that may contain misclassifications. Finally, the application identification system outputs the merged and optimized time window classification labels as the final application category result for the traffic sequence within that time period.

[0091] In this embodiment, the application identification technology based on time window and confidence assessment is adopted. By dividing network traffic into time segments to obtain fine-grained behavioral features, and combining the confidence assessment mechanism to correct identification errors, real-time and accurate application identification is achieved. It can not only identify known applications, but also discover unknown and encrypted applications.

[0092] In some embodiments, network traffic of the same application category shares similar characteristics. After identifying the application category of the network traffic, the application identification system can collect traffic belonging to the same category. These characteristics reflect the normal traffic characteristics of that application category. The application identification system can construct a baseline of traffic behavior for that application category through statistical analysis. By comparing real-time traffic characteristics with the baseline of that application category, it can determine whether there are significant deviations or anomalies. For example, if certain traffic characteristics deviate significantly from normal, such as a sudden increase in size or port anomalies, then the traffic can be identified as potentially abnormal. Further correlation analysis is performed on this abnormal traffic to determine its cause. For example, it may originate from certain malicious IP addresses, potentially spreading worm viruses. Finally, the application identification system can report the relevant information of the detected abnormal traffic or directly block the abnormal traffic.

[0093] Following the above embodiments, the method provided in this embodiment will now be described in more detail. Please refer to [link / reference]. Figure 3 , Figure 3 This is another flowchart illustrating a deep learning-based SD-WAN application identification method in an embodiment of this application.

[0094] S301. Perform cluster analysis on the traffic data of the same application category to divide the traffic data into different traffic groups;

[0095] After identifying the application category to which the network traffic belongs, the application identification system can divide the traffic into different groups based on the application category, that is, group traffic of the same application category together.

[0096] For example, there are video applications, web browsing applications, and file download applications. The application identification system will group video traffic into one group, web browsing traffic into another, and file download traffic into a third. For each type of application, the application identification system can use different clustering algorithms to further subdivide its traffic. For example, for video traffic, it can be clustered based on features such as source address, transmission protocol, and bitrate, dividing it into video stream groups targeting different user groups, as well as groups with different qualities such as high definition and standard definition.

[0097] Through cluster analysis, application identification systems can discover the inherent organizational structure of application traffic and understand different traffic groups of similar applications. This lays the foundation for subsequent statistical analysis and anomaly detection.

[0098] S302. Perform statistics and analysis on the traffic within each traffic group, and calculate the various indicators of the traffic data and the average indicators of the traffic group data.

[0099] For each defined traffic group, the application identification system collects data on all traffic within that group, performs statistical analysis, and primarily includes: calculating characteristic metrics for individual traffic flows, such as traffic size, time distribution, and source / destination addresses; and calculating average metrics for the entire group, such as average traffic for the application category and peak-hour distribution. Through statistical analysis, the application identification system can clearly understand the specific characteristics of different traffic groups within that application category, establishing a baseline for the overall traffic behavior of that application.

[0100] For example, the single-stream bandwidth distribution, peak user access times, and traffic packet length distribution of a video group all exhibit significant statistical patterns. The application identification system aggregates these indicators to form an overall statistical characteristic baseline for the video stream group. Obtaining various statistical characteristics of application traffic and overall baseline information provides important references for subsequent anomaly detection and network optimization.

[0101] S303. Compare each indicator with the average indicator to determine abnormal traffic flow;

[0102] The application identification system will obtain statistical indicators for each traffic flow and compare them with the overall average indicators of the corresponding traffic group to determine whether the traffic flow is abnormal.

[0103] The main comparative analyses include: comparing single-stream metrics with average metrics; if the difference significantly exceeds a preset threshold, it is marked as abnormal traffic. Detecting sudden changes in traffic metrics, such as traffic peaks deviating significantly from the average level, may also indicate anomalies. Analyzing whether the temporal and spatial distribution of traffic differs significantly from the average, such as sudden changes in the access source. For example, for a video stream group, if the single-stream bandwidth suddenly increases to five times the average level, the traffic is highly likely to be abnormal. A sudden peak in file access traffic in the early morning also violates the normal temporal distribution pattern.

[0104] S304. Extract the spatiotemporal characteristics of the abnormal flow to determine its distribution pattern and evolution trend;

[0105] For detected abnormal traffic, the application identification system will further extract its spatiotemporal distribution characteristics and analyze the propagation pattern of the anomaly.

[0106] The main spatiotemporal features analyzed include:

[0107] Temporal distribution characteristics of abnormal traffic - record the proportion of abnormal traffic in different time periods to determine whether the abnormality is concentrated in certain time points.

[0108] Network space distribution characteristics of abnormal traffic - Record the source IP and destination IP distribution of abnormal traffic to determine whether the abnormality comes from or is concentrated in certain addresses.

[0109] Temporal correlation of abnormal traffic - Calculate the correlation coefficient of abnormal traffic in different time periods to determine whether the abnormality has a propagation relationship in time.

[0110] Spatial correlation of abnormal traffic - Calculate the correlation coefficient of abnormal traffic from different source addresses to determine whether there is an infection relationship in space.

[0111] By using spatiotemporal correlation analysis, the application identification system can determine whether abnormal traffic has obvious propagation patterns, such as originating from the same source of infection and spreading in a worm-like manner, or targeting certain computer rooms / areas. This can help determine the cause of the anomaly and trace the propagation chain.

[0112] The application identification system can also analyze the dynamic evolution of the spatiotemporal characteristics of abnormal traffic, monitor whether the anomaly shows a spiraling upward deterioration trend, and provide a basis for early warning of abnormal traffic.

[0113] S305. After determining the abnormal traffic information based on the distribution pattern and the evolution trend, the abnormal traffic information is sent to the display terminal for display. The abnormal traffic information includes the abnormal cause, propagation path and scope of impact of the abnormal traffic.

[0114] By analyzing spatiotemporal features, the application identification system can determine key information about abnormal traffic, including:

[0115] Cause of anomaly - Determine the possible root cause of the anomaly based on the spatiotemporal distribution pattern, such as an attack on a network node causing the anomaly.

[0116] Propagation Path - Analyze the propagation path of anomalies based on the abnormal correlations between network nodes.

[0117] Scope of impact - Determine the scope of the impact of the anomaly based on the network spatial distribution of the abnormal traffic, such as whether it is limited to a certain area or spreads to the entire network.

[0118] After the application identification system aggregates the above abnormal traffic information and generates an analysis report, it can display the data to the administrator through visual charts. The displayed content may include: a heatmap of the spatiotemporal distribution of abnormal traffic, a propagation path diagram, and a network topology diagram of the affected area. Data curves can also be used to show the evolution trend of the abnormal traffic time series. This intuitive visualization allows administrators to better understand the overall characteristics of the anomaly, determine its severity and impact, and quickly formulate handling strategies, such as isolating certain network areas to curb its spread.

[0119] The above embodiments employ the abnormal traffic detection technology based on clustering and statistical analysis from the embodiments of this application. By clustering traffic of the same application category and calculating the statistical characteristics of each traffic group, and comparing them with the overall average index, the accurate identification of abnormal traffic is achieved. It can not only detect anomalies that deviate significantly from the baseline, but also discover hidden abnormal propagation patterns.

[0120] The following describes an application identification system from a module perspective in an embodiment of this application. Please refer to [link / reference]. Figure 4 , Figure 4 This is a schematic diagram of the functional module structure of the application identification system in the embodiments of this application.

[0121] The parsed data acquisition module 401 is used to capture and parse multiple traffic data in the SD-WAN network to obtain parsed data. Here, SD-WAN refers to Software-Defined Wide Area Network.

[0122] The image feature extraction module 402 is used to extract image features from the data image after the parsed data is converted into a data image through image processing technology.

[0123] The model training module 403 is used to input the features of the image into a preset deep learning model for training.

[0124] The preliminary matching result acquisition module 404 is used to input the SD-WAN network traffic data to be identified into the deep learning model to obtain preliminary matching results that match the features of the image;

[0125] The confidence assessment module 405 is used to assess the confidence of the preliminary matching result, which includes calculating the similarity score between the preliminary matching result and the image features;

[0126] The application category determination module 406 is used to determine the final application category based on the preliminary matching result if the similarity score exceeds a preset threshold. The application category includes encrypted applications.

[0127] In some embodiments, the confidence assessment module 405 specifically includes:

[0128] The unknown traffic data determination unit is used to determine the traffic data whose similarity score does not exceed the preset threshold as unknown traffic data.

[0129] The new traffic feature determination unit is used to determine the new traffic features corresponding to the unknown application traffic by aggregating multiple unknown traffic data and using big data analysis and mining techniques.

[0130] The new application feature library generation unit is used to generate a new application feature library after the traffic features of the new application are labeled.

[0131] The deep learning model update unit is used to update the deep learning model using the new application feature library.

[0132] In some embodiments, the model training module 403 specifically includes:

[0133] The updated deep learning model acquisition unit is used to update the deep learning model by utilizing the volume characteristics of multiple traffic data to obtain the updated deep learning model.

[0134] The volume traffic data acquisition unit is used to input the SD-WAN network traffic data to be identified into the updated deep learning model to obtain volume traffic data that matches the volume characteristics.

[0135] The application category determination unit is used to determine the application category of the volume flow data according to the volume characteristics.

[0136] In some embodiments, the preliminary matching result obtaining module 404 specifically includes:

[0137] The time window acquisition unit is used to perform time segmentation on the SD-WAN network traffic data to be identified, and obtain a time window of a set length;

[0138] The traffic data image acquisition unit is used to parse and extract features from the traffic data within each time window to obtain the corresponding traffic data image.

[0139] The application category probability distribution acquisition unit is used to input the traffic data image into the deep learning model to obtain the application category probability distribution of the traffic data within the time window;

[0140] The application category label acquisition unit is used to obtain the final application category label after preprocessing the probability distribution of the application category;

[0141] The preliminary matching result determination unit is used to determine the application category label as the preliminary matching result of the traffic data within the time window.

[0142] In some embodiments, the application category determination module 406 specifically includes:

[0143] The raw classification result acquisition unit is used to classify the traffic data within each time window and obtain the raw classification result for each time window;

[0144] The application category probability distribution determination unit is used to determine the application category probability distribution after smoothing the original classification results within adjacent time windows.

[0145] The application category labeling unit is used to assign the corresponding application category label to applications whose application category probability is higher than the application category probability threshold after determining the application category probability threshold.

[0146] The final application category label acquisition unit is used to merge identical application category labels within adjacent time windows to obtain the final application category label for the time window.

[0147] In some embodiments, the application category determination module 406 further includes:

[0148] The traffic group determination unit is used to perform cluster analysis on traffic data of the same application category and divide the traffic data into different traffic groups.

[0149] The average index acquisition unit is used to statistically analyze the traffic within each traffic group, calculate various indicators of the obtained traffic data and the average index of the traffic group data;

[0150] The abnormal traffic determination unit is used to compare each indicator with the average indicator to determine abnormal traffic.

[0151] The alarm information generation unit is used to generate alarm information based on the abnormal traffic detection results, and then send the detection results and the alarm information to the display terminal.

[0152] In some embodiments, the application category determination module 406 further includes:

[0153] The abnormal flow spatiotemporal feature extraction unit is used to extract the spatiotemporal features of the abnormal flow and determine the distribution pattern and evolution trend of the abnormal flow.

[0154] An abnormal traffic sending unit is used to send abnormal traffic information to the display terminal for display after determining the abnormal traffic information based on the distribution pattern and the evolution trend. The abnormal traffic information includes the abnormal cause, propagation path and scope of impact of the abnormal traffic.

[0155] The above describes an application identification system from the perspective of modular functional entities. The following describes an application identification system from the perspective of hardware processing. Please refer to [link to relevant documentation]. Figure 5 , Figure 5 This is a schematic diagram of the physical device structure of the identification system applied in the embodiments of this application.

[0156] The application identification system 500 includes: one or more processors 501 ( Figure 5 Taking a processor 501 as an example), a memory 502, an input device 503, and an output device 504. In some embodiments of the present invention, the processor 501, memory 502, input device 503, and output device 504 may be connected via a bus or other means, wherein... Figure 5 Taking the example of a connection between China and Israel via a bus.

[0157] Specifically, the processor 501 implements a deep learning-based SD-WAN application identification method in this application embodiment by calling the computer instructions to cause the computer program to be executed by the processor.

[0158] The memory 502 is used to store computer program code, which includes computer instructions.

[0159] Input device 503 is used to receive unknown network traffic data.

[0160] Output device 504 is used to output the application category corresponding to network traffic.

[0161] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0162] As used in the above embodiments, depending on the context, the term "when..." can be interpreted as meaning "if...", "after...", "in response to determining...", or "in response to detecting...". Similarly, depending on the context, the phrase "when determining..." or "if (the stated condition or event) is interpreted as meaning "if determining...", "in response to determining...", "when (the stated condition or event) is detected", or "in response to detecting (the stated condition or event)".

[0163] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. This computer program product includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from a website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.

[0164] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A deep learning-based SD-WAN application identification method, characterized in that, The method comprises: capturing and analyzing a plurality of traffic data in an SD-WAN network to obtain parsed data, wherein the SD-WAN refers to a software-defined wide area network; extracting picture features in a data picture obtained by converting the parsed data into the data picture through a picture processing technology; inputting the picture features into a preset deep learning model for training; inputting the SD-WAN network traffic data to be identified into the deep learning model to obtain a preliminary matching result matched with the picture features; performing confidence evaluation on the preliminary matching result, wherein the confidence evaluation comprises calculating a similarity score of the preliminary matching result and the picture features; if the similarity score exceeds a preset threshold, determining a final application category according to the preliminary matching result, wherein the application category comprises an encrypted application; after the step of performing confidence evaluation on the preliminary matching result, the confidence evaluation comprises calculating a similarity score of the preliminary matching result and the picture features, the method further comprises: determining traffic data corresponding to the similarity score not exceeding the preset threshold as unknown traffic data; after collecting a plurality of the unknown traffic data, determining new traffic features corresponding to unknown application traffic through big data analysis and mining technology; generating a new application feature library after labeling the new application traffic features; updating the deep learning model through the new application feature library; the step of inputting the SD-WAN network traffic data to be identified into the deep learning model to obtain a preliminary matching result matched with the picture features specifically comprises: time division of the SD-WAN network traffic data to be identified to obtain time windows of a set length; parsing and feature extraction of traffic data in each time window to obtain corresponding traffic data pictures; inputting the traffic data pictures into the deep learning model to obtain an application category probability distribution of the traffic data in the time window; obtaining a final application category label after preprocessing the application category probability distribution; determining the application category label as the preliminary matching result of the traffic data in the time window; the step of obtaining a final application category label after preprocessing the application category probability distribution specifically comprises: classifying the traffic data in each time window to obtain an original classification result of each time window; determining the application category probability distribution after smoothing the original classification result in adjacent time windows; after determining an application category probability threshold, applying corresponding application category labels to applications whose probabilities of the application category are higher than the application category probability threshold; merging the same application category labels in adjacent time windows to obtain a final application category label of the time window.

2. The method of claim 1, wherein, after the step of inputting the picture features into a preset deep learning model for training, the method further comprises: updating the deep learning model by using the volume characteristics of a plurality of traffic data to obtain an updated deep learning model; Inputting the SD-WAN network traffic data to be identified into the updated deep learning model to obtain volume traffic data matching the volume characteristics; Determining an application category of the volume traffic data according to the volume characteristics.

3. The method of claim 1, wherein, After the step of determining a final application category according to the preliminary matching result if the similarity score exceeds a preset threshold, the method further comprises: Performing clustering analysis on the traffic data of the same application category to divide the traffic data into different traffic groups; Statistically analyzing the traffic in each traffic group to calculate various indexes of the traffic data and average indexes of the traffic group data; Comparing the various indexes with the average indexes to determine abnormal traffic; After generating an alarm information according to the detection result of the abnormal traffic, sending the detection result and the alarm information to a display end.

4. The method of claim 3, wherein, After the step of comparing the various indexes with the average indexes to determine abnormal traffic, the method further comprises: Extracting spatio-temporal characteristics of the abnormal traffic to determine distribution rules and evolution trends of the abnormal traffic; After determining abnormal traffic information according to the distribution rules and the evolution trends, sending the abnormal traffic information to a display end for display, the abnormal traffic information including abnormal reasons, propagation paths and influence ranges of the abnormal traffic.

5. An application recognition system characterized by, The application recognition system comprises one or more processors and a memory; the memory is coupled with the one or more processors; the memory is configured to store computer program codes, the computer program codes comprising computer instructions; the one or more processors invoke the computer instructions to enable the application recognition system to perform the method according to any one of claims 1-4.

6. A computer-readable storage medium comprising instructions, characterized in that, The instructions enable the application recognition system to perform the method according to any one of claims 1-4 when the instructions run on the application recognition system.

7. A computer program product, characterised in that, The computer program product enables the application recognition system to perform the method according to any one of claims 1-4 when the computer program product runs on the application recognition system.

Images