Adaptive bypass network traffic quality detection method and system

Abstract

The present invention provides a method and system for adaptive bypass network flow quality detection, comprising: step S1: at the front end of a host system, real-time capture and storage of bypass business system data packets; step S2: filtering data packets corresponding to the current business system according to the server IP configured by the business system; step S3: judging the associated conditions of business decoding based on the filtered data packets corresponding to the current business system, and identifying whether the current business system is a TCP synchronous session; step S4: sequentially reorganizing the sequence number queues in the identified TCP synchronous session; step S5: performing quality detection on the bypass network flow based on the TCP characteristics of the data packets.

Description

Technical Field

[0001] The present invention relates to the technical field of bypass network flow quality detection, and in particular to a method and system for adaptive bypass network flow quality detection. Background Art

[0002] At present, many analysis tools have packet loss analysis when performing data packet analysis, but they do not distinguish whether the packet loss is caused by the business network or the bypass network. When monitoring services based on bypass network traffic, the packet loss caused by the bypass network is not a real business problem and is very likely to cause false alarms. When false alarms occur, there are three main traditional analysis methods:

[0003] 1. Manual analysis and judgment by bypassing the packet loss count of network traffic equipment;

[0004] 2. Download the data packets and use professional analysis tools, such as Wireshark, to manually compare and analyze them;

[0005] 3. By comparing with the system's business log, determine whether a business problem actually occurs.

[0006] These methods all require manual intervention and are prone to errors. Therefore, in existing business monitoring, there is no system or method for automatically implementing bypass network traffic quality detection. Summary of the invention

[0007] In view of the defects in the prior art, the object of the present invention is to provide a method and system for adaptive bypass network traffic quality detection.

[0008] A method for adaptive bypass network traffic quality detection provided by the present invention includes:

[0009] Step S1: At the front end of the host system, the bypassed business system data packets are captured and stored in real time;

[0010] Step S2: Filter the data packets corresponding to the current business system according to the server IP configured by the business system;

[0011] Step S3: judging the associated conditions of the service decoding based on the data packets corresponding to the current service system screened, and identifying whether the current service system is a TCP synchronous session;

[0012] Step S4: reorganizing the sequence number queues in the identified TCP synchronization session in order;

[0013] Step S5: Perform quality detection on bypass network traffic based on the TCP characteristics of the data packets.

[0014] Preferably, the step S3 comprises: identifying the associated conditions of the service decoding based on the data packets corresponding to the screened current service system, and when the service decoding is associated based on the TCP five-tuple in the order of the data packets, the current service system is considered to be a TCP synchronous session.

[0015] Preferably, the step S3 comprises:

[0016] Step S3.1: Obtain the TCP five-tuple information of the current business system; the TCP five-tuple information includes: client IP, client port number, protocol, server IP, server port number;

[0017] Step S3.2: Hash the obtained TCP quintuple information of the current service system into FlowId;

[0018] Step S3.3: Determine that the service with the association condition FlowId is a TCP synchronous session.

[0019] Preferably, the step S5 adopts:

[0020] Step S5.1: Analyze the TCP characteristics of the data packet;

[0021] Step S5.2: Based on the TCP feature analysis of the data packet, different data source quality detection models are selected to detect the quality of the bypass network traffic.

[0022] Preferably, the step S5.1 comprises:

[0023] A TCP session has only one synchronous service or a TCP session has multiple synchronous services;

[0024] When a TCP session has only one synchronous service, including one synchronous service with only one response data packet or one synchronous service with multiple response data packets;

[0025] When a synchronous service has only one response data packet, it includes the first packet loss scenario; the first packet loss scenario includes: the first response data packet is lost, there is no ACK data packet, the TCP session is closed after the single service is completed, and there is a FIN packet;

[0026] When a synchronous service has multiple response data packets, it includes the second packet loss scenario, the third packet loss scenario, the fourth packet loss scenario and the fifth packet loss scenario; wherein the second packet loss scenario is the same service, the first response data packet is lost, there is a corresponding ACK data packet, and the rest are not lost; the third packet loss scenario is the same service, the first response data packet and the corresponding ACK data packet are lost, and the rest are not lost; the fourth packet loss scenario is the same service, the first response data packet and the corresponding ACK are received, and the subsequent response data packet is lost but there is a corresponding ACK data packet; the fifth packet loss scenario is the same service, the first response data packet and the corresponding ACK are received, and the subsequent response data packet and the corresponding ACK data packet are lost at the same time;

[0027] When a TCP session has multiple synchronous services, including one service with only one response data packet or one service with multiple response data packets;

[0028] When a business has only one response data packet, it includes: the sixth packet loss scenario; the sixth packet loss scenario includes: the response data packet is lost, but there is a corresponding ACK data packet;

[0029] When a business has multiple response data packets, it includes the seventh packet loss scenario and the eighth packet loss scenario; the seventh packet loss scenario includes: the response data packet of a business is lost, but there is a corresponding ACK; the eighth packet loss scenario includes: one of the response data packets and the corresponding ACK of a business are both lost.

[0030] Preferably, the step S5.2 comprises: the different data source quality detection models comprise: a first data source quality detection model and a second data source quality detection model;

[0031] The first data source quality detection model includes:

[0032] Compare the Ack Number of the ACK data packet with the Seq Number + Lenth of the previous peer data packet. If Ack Number>Seq Number + Lenth, it is considered a packet loss.

[0033] FIN packet judgment: FIN ACK is regarded as a data packet with a payload of 1. When comparing, the AckNumber of ACK is reduced by 1. When Ack Number - 1> Seq Number + Lenth, it is judged as packet loss;

[0034] The second data source quality detection model includes:

[0035] Subtract the Seq Numbers of two consecutive data packets on the same side. If the difference is greater than the Lenth of the subtracted packet, it is considered a packet loss.

[0036] FIN packet judgment: FIN ACK is regarded as a data packet with a payload of 1. When the SeqNumber of two consecutive data packets on the same side is subtracted, a subtraction operation is performed. If the difference is greater than the Lenth of the subtracted data packet, it is judged as a packet loss;

[0037] In the first packet loss scenario, the second packet loss scenario, the fourth packet loss scenario, the sixth packet loss scenario, and the seventh packet loss scenario, the quality of bypass network traffic is detected using the first data source quality detection model;

[0038] The third packet loss scenario, the fifth packet loss scenario, and the eighth packet loss scenario use the second data source quality detection model to detect the quality of bypass network traffic.

[0039] Preferably, the method further comprises: obtaining packet loss data of a single business based on detection of the quality of bypass network traffic;

[0040] The detection based on the quality of bypass network traffic to obtain packet loss data of a single service includes:

[0041] When the service is responding normally, the service is marked as having normal data source quality. When the service has no response and the response of the service is judged to have packet loss, the service is marked as having abnormal data source quality. When the service volume indicators are counted, services with abnormal data source quality are still included. When the response rate, success rate, and response time indicators are counted, services with abnormal data source quality are not included in the statistics. At the same time, the volume of services with packet loss will be recorded at different time granularities for data source quality analysis.

[0042] A system for adaptive bypass network traffic quality detection provided by the present invention includes:

[0043] Module M1: At the front end of the host system, it captures and stores bypassed business system data packets in real time;

[0044] Module M2: Filter the data packets corresponding to the current business system according to the server IP configured by the business system;

[0045] Module M3: judging the associated conditions of the service decoding based on the data packets corresponding to the current service system screened, and identifying whether the current service system is a TCP synchronous session;

[0046] Module M4: reorganize the sequence number queue in the identified TCP synchronization session in order;

[0047] Module M5: Perform quality detection on bypass network traffic based on TCP characteristics of data packets.

[0048] Preferably, the module M3 comprises: identifying the association condition of the service decoding based on the data packets corresponding to the current service system screened, when the service decoding is associated based on the TCP five-tuple in the order of the data packets, the current service system is considered to be a TCP synchronous session;

[0049] The module M3 comprises:

[0050] Module M3.1: Obtain the TCP five-tuple information of the current business system; the TCP five-tuple information includes: client IP, client port number, protocol, server IP, server port number;

[0051] Module M3.2: Hash the obtained TCP quintuple information of the current business system into FlowId;

[0052] Module M3.3: Determine that the service with the association condition FlowId is a TCP synchronous session;

[0053] Preferably, the module M5 adopts:

[0054] Module M5.1: Analyze TCP characteristics of data packets;

[0055] Module M5.2: Based on the TCP feature analysis of data packets, different data source quality detection models are selected to detect the quality of bypass network traffic;

[0056] The module M5.1 comprises:

[0057] A TCP session has only one synchronous service or a TCP session has multiple synchronous services;

[0058] When a TCP session has only one synchronous service, including one synchronous service with only one response data packet or one synchronous service with multiple response data packets;

[0059] When a synchronous service has only one response data packet, it includes the first packet loss scenario; the first packet loss scenario includes: the first response data packet is lost, there is no ACK data packet, the TCP session is closed after the single service is completed, and there is a FIN packet;

[0060] When a synchronous service has multiple response data packets, it includes the second packet loss scenario, the third packet loss scenario, the fourth packet loss scenario and the fifth packet loss scenario; wherein the second packet loss scenario is the same service, the first response data packet is lost, there is a corresponding ACK data packet, and the rest are not lost; the third packet loss scenario is the same service, the first response data packet and the corresponding ACK data packet are lost, and the rest are not lost; the fourth packet loss scenario is the same service, the first response data packet and the corresponding ACK are received, and the subsequent response data packet is lost but there is a corresponding ACK data packet; the fifth packet loss scenario is the same service, the first response data packet and the corresponding ACK are received, and the subsequent response data packet and the corresponding ACK data packet are lost at the same time;

[0061] When a TCP session has multiple synchronous services, including one service with only one response data packet or one service with multiple response data packets;

[0062] When a business has only one response data packet, it includes: the sixth packet loss scenario; the sixth packet loss scenario includes: the response data packet is lost, but there is a corresponding ACK data packet;

[0063] When a business has multiple response data packets, it includes the seventh packet loss scenario and the eighth packet loss scenario; the seventh packet loss scenario includes: the response data packet of a business is lost, but there is a corresponding ACK; the eighth packet loss scenario includes: one of the response data packets and the corresponding ACK of a business are lost;

[0064] The module M5.2 includes: the different data source quality detection models include: a first data source quality detection model and a second data source quality detection model;

[0065] The first data source quality detection model includes:

[0066] Compare the Ack Number of the ACK data packet with the Seq Number + Lenth of the previous peer data packet. If Ack Number>Seq Number + Lenth, it is considered a packet loss.

[0067] FIN packet judgment: FIN ACK is regarded as a data packet with a payload of 1. When comparing, the AckNumber of ACK is reduced by 1. When Ack Number - 1> Seq Number + Lenth, it is judged as packet loss;

[0068] The second data source quality detection model includes:

[0069] Subtract the Seq Numbers of two consecutive data packets on the same side. If the difference is greater than the Lenth of the subtracted packet, it is considered a packet loss.

[0070] FIN packet judgment: FIN ACK is regarded as a data packet with a payload of 1. When the SeqNumber of two consecutive data packets on the same side is subtracted, a subtraction operation is performed. If the difference is greater than the Lenth of the subtracted data packet, it is judged as a packet loss;

[0071] In the first packet loss scenario, the second packet loss scenario, the fourth packet loss scenario, the sixth packet loss scenario, and the seventh packet loss scenario, the quality of bypass network traffic is detected using the first data source quality detection model;

[0072] The third packet loss scenario, the fifth packet loss scenario, and the eighth packet loss scenario use the second data source quality detection model to detect the quality of bypass network traffic.

[0073] Compared with the prior art, the present invention has the following beneficial effects:

[0074] 1. The present invention solves the impact of bypass network traffic packet loss on business monitoring by adopting the TCP sequence number analysis method, thereby achieving a significant improvement in the quality of business monitoring;

[0075] 2. The present invention adopts a data source quality detection method to automatically mark the business with abnormal data source quality, thereby solving the problem of slow manual analysis and realizing program automatic marking. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0077] Figure 1 The present invention is a flow chart of a method for adaptive bypass network traffic quality detection.

[0078] Figure 2 This is a schematic diagram of the first data source quality detection model.

[0079] Figure 3 This is a schematic diagram of the second data source quality detection model. DETAILED DESCRIPTION

[0080] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0081] Example 1

[0082] According to the present invention, an adaptive bypass network traffic quality detection method and system are provided, including: automatically identifying and marking unresponsive services caused by bypass network packet loss by analyzing the sequence number of the TCP synchronization session, eliminating the impact of such packet loss on service monitoring, and improving the quality of service monitoring without manual backtracking and analysis of data packets.

[0083] The method for adaptive bypass network flow quality detection is as follows: Figure 1 As shown, including:

[0084] Step S1: At the front end of the host system, the bypassed business system network data packets are captured and stored in real time;

[0085] Step S2: Filter data packets of different business systems according to the server IP and client IP (if any) configured by the business system, and distinguish the client and the server according to the server IP of the business system;

[0086] Specifically, the step S2 includes:

[0087] Step S21: If the data packet is sent from the client to the server, the data packet is defined as a request;

[0088] Step S22: If the data packet is sent from the server to the client, the data packet is defined as a response.

[0089] Step S3: Identify the association conditions of service decoding. If the service decoding is associated based on the TCP five-tuple in the order of data packets, the service is considered to be a TCP synchronous session. The client's acknowledgment number (Ack Number) queue and the server's sequence number (Seq Number) queue are analyzed and maintained, including:

[0090] Step S31: Determine the TCP five-tuple information of the service: <client IP, client port number, protocol, server IP, server port number>, and hash it into FlowId;

[0091] Step S32: Determine the business whose association condition is FlowId;

[0092] Step S33: Maintain an acknowledgment number (Ack Number) and sequence number (Seq Number) queue for the client;

[0093] Step S34: Maintain an acknowledgment number (Ack Number) and sequence number (Seq Number) queue for the server.

[0094] Step S35: When maintaining the queue, it is necessary to reorganize the queue order according to the sequence number order, so as to achieve the reorganization of the disordered scene. At the same time, the queue needs to set a reasonable threshold as needed to control resource consumption.

[0095] Step S4: Based on different packet loss characteristics, different data source quality detection algorithms are matched. There are two specific algorithms:

[0096] like Figure 2 As shown, the first data source quality detection model includes:

[0097] Compare the Ack Number of the ACK data packet with the Seq Number + Lenth of the previous peer data packet. If Ack Number > Seq Number + Lenth, it is determined to be packet loss.

[0098] FIN packet judgment: FIN ACK is regarded as a data packet with a payload of 1. When comparing, the AckNumber of ACK will be reduced by 1, that is, Ack Number - 1>Seq Number + Lenth, and it is judged as packet loss.

[0099] like Figure 3 As shown, the second data source quality detection model includes:

[0100] Subtract the Seq Numbers of two consecutive data packets on the same side. If the difference is greater than the Lenth of the subtracted packet, it is considered a packet loss.

[0101] FIN packet judgment: FIN ACK is regarded as a data packet with a payload of 1. When the SeqNumber of two consecutive data packets on the same side is subtracted, a subtraction operation is performed. If the difference is greater than the Lenth of the subtracted data packet, it is judged as packet loss.

[0102] Step S5: Based on the TCP characteristics of the actual data packet, combined with the algorithm, the quality detection of the bypass network traffic is implemented, characterized in that the algorithm scenario is as follows:

[0103]

[0104] Step S6: Based on the above scenario calculation, the packet loss data of a single service is obtained, which is as follows:

[0105] Step S61: When the service is responding normally, the service is identified as having normal data source quality; when the service is unresponsive and the response of the service is judged to have packet loss, the service is identified as having abnormal data source quality.

[0106] Step S62: when counting the business volume indicators, the business with abnormal data source quality is still counted;

[0107] Step S63: When the response rate, success rate, and response time indicators are counted, the business with abnormal data source quality is not included in the statistics;

[0108] Step S64: At the same time, the system will record the traffic volume of packet loss at different time granularities for data source quality analysis.

[0109] The present invention also provides a system for adaptive bypass network flow quality detection, which can be implemented by executing the process steps of the adaptive bypass network flow quality detection method, that is, those skilled in the art can understand the adaptive bypass network flow quality detection method as a preferred implementation of the adaptive bypass network flow quality detection system.

[0110] Those skilled in the art know that, in addition to realizing the system and its various devices, modules, and units provided by the present invention in a purely computer-readable program code, it is entirely possible to realize the same functions in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered as a hardware component, and the devices, modules, and units included therein for realizing various functions can also be regarded as structures within the hardware component; the devices, modules, and units for realizing various functions can also be regarded as both software modules for realizing the method and structures within the hardware component.

[0111] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A method for adaptive bypass network traffic quality detection, characterized in that: include: Step S1: At the front end of the host system, the bypassed business system data packets are captured and stored in real time; Step S2: Filter the data packets corresponding to the current business system according to the server IP configured by the business system; Step S3: judging the associated conditions of the service decoding based on the data packets corresponding to the current service system screened, and identifying whether the current service system is a TCP synchronous session; Step S4: reorganizing the sequence number queues in the identified TCP synchronization session in order; Step S5: Performing quality detection on bypass network traffic based on TCP characteristics of the data packet; The step S5 adopts: Step S5.1: Analyze the TCP characteristics of the data packet; Step S5.2: Based on the TCP feature analysis of the data packet, different data source quality detection models are selected to detect the quality of the bypass network traffic; The step S5.1 comprises: A TCP session has only one synchronous service or a TCP session has multiple synchronous services; When the TCP session has only one synchronous service, including one synchronous service with only one response data packet or one synchronous service with multiple response data packets; When a synchronous service has only one response data packet, it includes the first packet loss scenario; the first packet loss scenario includes: the first response data packet is lost, there is no ACK data packet, the TCP session is closed after the single service is completed, and there is a FIN packet; When a synchronous service has multiple response data packets, it includes the second packet loss scenario, the third packet loss scenario, the fourth packet loss scenario and the fifth packet loss scenario; wherein the second packet loss scenario is the same service, the first response data packet is lost, there is a corresponding ACK data packet, and the rest are not lost; the third packet loss scenario is the same service, the first response data packet and the corresponding ACK data packet are lost, and the rest are not lost; the fourth packet loss scenario is the same service, the first response data packet and the corresponding ACK are received, and the subsequent response data packet is lost but there is a corresponding ACK data packet; the fifth packet loss scenario is the same service, the first response data packet and the corresponding ACK are received, and the subsequent response data packet and the corresponding ACK data packet are lost at the same time; When a TCP session has multiple synchronous services, including one service with only one response data packet or one service with multiple response data packets; When a business has only one response data packet, it includes: the sixth packet loss scenario; the sixth packet loss scenario includes: the response data packet is lost, but there is a corresponding ACK data packet; When a business has multiple response data packets, it includes the seventh packet loss scenario and the eighth packet loss scenario; the seventh packet loss scenario includes: the response data packet of a business is lost, but there is a corresponding ACK; the eighth packet loss scenario includes: one of the response data packets and the corresponding ACK of a business are lost; The step S5.2 includes: the different data source quality detection models include: a first data source quality detection model and a second data source quality detection model; The first data source quality detection model includes: Compare the Ack Number of the ACK data packet with the Seq Number + Lenth of the previous peer data packet. If AckNumber>Seq Number + Lenth, it is determined to be a packet loss. FIN packet judgment: FIN ACK is regarded as a data packet with a payload of 1. When comparing, the Ack Number of ACK is reduced by 1. When Ack Number - 1> Seq Number + Lenth, it is judged as packet loss; The second data source quality detection model includes: Subtract the Seq Numbers of two consecutive data packets on the same side. If the difference is greater than the Lenth of the subtracted packet, it is considered a packet loss. FIN packet judgment: FIN ACK is regarded as a data packet with a payload of 1. When the SeqNumber of two consecutive data packets on the same side is subtracted, a subtraction operation is performed. If the difference is greater than the Lenth of the subtracted data packet, it is judged as a packet loss; In the first packet loss scenario, the second packet loss scenario, the fourth packet loss scenario, the sixth packet loss scenario, and the seventh packet loss scenario, the quality of bypass network traffic is detected using the first data source quality detection model; The third packet loss scenario, the fifth packet loss scenario, and the eighth packet loss scenario use the second data source quality detection model to detect the quality of bypass network traffic.

2. The method for adaptive bypass network traffic quality detection according to claim 1, characterized in that: The step S3 includes: identifying the association conditions of the service decoding based on the data packets corresponding to the screened current service system, and when the service decoding is associated based on the TCP five-tuple in the order of the data packets, the current service system is considered to be a TCP synchronous session.

3. The method for adaptive bypass network traffic quality detection according to claim 1, characterized in that: The step S3 comprises: Step S3.1: Obtain the TCP five-tuple information of the current business system; the TCP five-tuple information includes: client IP, client port number, protocol, server IP, server port number; Step S3.2: Hash the obtained TCP quintuple information of the current service system into FlowId; Step S3.3: Determine that the service with the association condition FlowId is a TCP synchronous session.

4. The method for adaptive bypass network traffic quality detection according to claim 1, characterized in that: The method further comprises: obtaining packet loss data of a single transaction by detecting the quality of bypass network traffic; The detection based on the quality of bypass network traffic to obtain packet loss data of a single service includes: When the service is responding normally, the service is marked as having normal data source quality. When the service has no response and the response of the service is judged to have packet loss, the service is marked as having abnormal data source quality. When the service volume indicators are counted, services with abnormal data source quality are still included. When the response rate, success rate, and response time indicators are counted, services with abnormal data source quality are not included in the statistics. At the same time, the volume of services with packet loss will be recorded at different time granularities for data source quality analysis.

5. A system for adaptive bypass network traffic quality detection, characterized in that: include: Module M1: At the front end of the host system, it captures and stores bypassed business system data packets in real time; Module M2: Filter the data packets corresponding to the current business system according to the server IP configured by the business system; Module M3: judging the associated conditions of the service decoding based on the data packets corresponding to the current service system screened, and identifying whether the current service system is a TCP synchronous session; Module M4: reorganize the sequence number queue in the identified TCP synchronization session in order; Module M5: Perform quality detection on bypass network traffic based on TCP characteristics of data packets; The module M5 adopts: Module M5.1: Analyze TCP characteristics of data packets; Module M5.2: Based on the TCP feature analysis of data packets, different data source quality detection models are selected to detect the quality of bypass network traffic; The module M5.1 comprises: A TCP session has only one synchronous service or a TCP session has multiple synchronous services; When the TCP session has only one synchronous service, including one synchronous service with only one response data packet or one synchronous service with multiple response data packets; When a synchronous service has only one response data packet, it includes the first packet loss scenario; the first packet loss scenario includes: the first response data packet is lost, there is no ACK data packet, the TCP session is closed after the single service is completed, and there is a FIN packet; When a synchronous service has multiple response data packets, it includes the second packet loss scenario, the third packet loss scenario, the fourth packet loss scenario and the fifth packet loss scenario; wherein the second packet loss scenario is the same service, the first response data packet is lost, there is a corresponding ACK data packet, and the rest are not lost; the third packet loss scenario is the same service, the first response data packet and the corresponding ACK data packet are lost, and the rest are not lost; the fourth packet loss scenario is the same service, the first response data packet and the corresponding ACK are received, and the subsequent response data packet is lost but there is a corresponding ACK data packet; the fifth packet loss scenario is the same service, the first response data packet and the corresponding ACK are received, and the subsequent response data packet and the corresponding ACK data packet are lost at the same time; When a TCP session has multiple synchronous services, including one service with only one response data packet or one service with multiple response data packets; When a business has only one response data packet, it includes: the sixth packet loss scenario; the sixth packet loss scenario includes: the response data packet is lost, but there is a corresponding ACK data packet; When a business has multiple response data packets, it includes the seventh packet loss scenario and the eighth packet loss scenario; the seventh packet loss scenario includes: the response data packet of a business is lost, but there is a corresponding ACK; the eighth packet loss scenario includes: one of the response data packets and the corresponding ACK of a business are lost; The module M5.2 includes: the different data source quality detection models include: a first data source quality detection model and a second data source quality detection model; The first data source quality detection model includes: Compare the Ack Number of the ACK data packet with the Seq Number + Lenth of the previous peer data packet. If AckNumber>Seq Number + Lenth, it is determined to be a packet loss. FIN packet judgment: FIN ACK is regarded as a data packet with a payload of 1. When comparing, the Ack Number of ACK is reduced by 1. When Ack Number - 1> Seq Number + Lenth, it is judged as packet loss; The second data source quality detection model includes: Subtract the Seq Numbers of two consecutive data packets on the same side. If the difference is greater than the Lenth of the subtracted packet, it is considered a packet loss. FIN packet judgment: FIN ACK is regarded as a data packet with a payload of 1. When the SeqNumber of two consecutive data packets on the same side is subtracted, a subtraction operation is performed. If the difference is greater than the Lenth of the subtracted data packet, it is judged as a packet loss; In the first packet loss scenario, the second packet loss scenario, the fourth packet loss scenario, the sixth packet loss scenario, and the seventh packet loss scenario, the quality of bypass network traffic is detected using the first data source quality detection model; The third packet loss scenario, the fifth packet loss scenario, and the eighth packet loss scenario use the second data source quality detection model to detect the quality of bypass network traffic.

6. The system for adaptive bypass network traffic quality detection according to claim 5, characterized in that: The module M3 includes: identifying the association conditions of service decoding based on the data packets corresponding to the current service system screened, when the service decoding is associated based on the TCP five-tuple according to the order of the data packets, the current service system is considered to be a TCP synchronous session; The module M3 comprises: Module M3.1: Obtain TCP five-tuple information of the current business system; the TCP five-tuple information includes: client IP, client port number, protocol, server IP, server port number; Module M3.2: Hash the obtained TCP quintuple information of the current business system into FlowId; Module M3.3: Determine that the service with the association condition FlowId is a TCP synchronous session.

Images