Network flow state monitoring method, system, equipment, medium and product

Abstract

The invention relates to a network flow state monitoring method, system and device, a medium and a product, and the method comprises the steps: S1, constructing two memory spaces on a static random access memory of a core gateway as a large flow screening module and a small flow storage module in each measurement period; s2, mapping a flow needing to be monitored to the large flow screening module for flow screening, and if the flow is judged to be a large flow, performing a corresponding flow state operation in the large flow screening module to realize flow state monitoring; if it is judged that the flow is the small flow, the flow is mapped to the small flow storage module, and corresponding flow state operation is carried out to achieve flow state monitoring; wherein the flow state operation comprises an insertion operation, a deletion operation, an update operation and a query operation. According to the invention, the monitoring of the network flow state is realized based on flow screening, and the storage space is effectively saved.

Description

Technical Field

[0001] The present invention relates to the technical field of network flow monitoring, and in particular to a network flow state monitoring method, system, equipment, medium and product. Background Art

[0002] In network traffic measurement, continuous monitoring of the state of each flow is essential for fine-grained network management and detecting malicious traffic or abnormal behavior. This is an important means to ensure network security. According to specific monitoring requirements, a group of packets with the same flow label is usually abstracted as a flow, and the network flow label and flow state can be flexibly defined according to the application scenario. For example, all packets sent to the same destination address can be regarded as a flow, and the destination address is the label of the flow. At the same time, the state of the flow can be defined as the TCP session state or the priority of the flow. In a TCP session, control flags such as ACK, RST, SYN, and FIN can be used to indicate the connection state of the flow. When the RST or FIN flag is set, it usually means that the TCP connection is reset or terminated. Changes in such flags may be related to RST or FIN attacks, and an alarm should be generated at this time. Tracking the state of each flow is essential to locating suspicious TCP flows. For example, if a large amount of traffic is in the SYN-RECEIVED state for a long time, it may indicate a TCP SYN flood attack, affecting the normal service response of legitimate traffic. Therefore, monitoring the flow state and its distribution is a basic operation for detecting network anomalies.

[0003] However, performing such monitoring tasks in high-speed networks is extremely challenging, mainly in terms of computational and memory overhead. Bloom filter is an efficient probabilistic data structure that is often used for set membership queries. Bloom filter-based methods are known for their low false positive rate and The insertion and query complexity of Bloom filters is widely used in many network applications, thereby effectively reducing the memory and bandwidth costs of information processing. Existing studies have attempted to replace the bit units in Bloom filters with state units to store flow state information. This method can support approximate flow state queries. However, these technologies have two major challenges: First, the skewness of flow size distribution: In a real network environment, about 95% of flows are small flows containing only a small number of data packets, while a small number of large flows account for the vast majority of the total traffic. The rapid influx of large flows will lead to a large number of state operations, significantly reducing processing efficiency. Second, the skewness of flow state distribution: In a TCP connection, about 95% of the data packets set the ACK flag to maintain a reliable connection. Allocating the same size of storage units to different states will result in low utilization of storage resources. The counters required for frequent states (such as ACK) are large, while infrequent states waste storage space, resulting in excessive memory overhead. Summary of the invention

[0004] To this end, the technical problem to be solved by the present invention is to overcome the problem in the prior art that the monitoring of network flow status does not filter the traffic type, and also overcome the problem of allocating storage units of the same size to flows of different states, resulting in a waste of storage space.

[0005] To solve the above technical problems, the present invention provides a network flow status monitoring method, comprising:

[0006] Step S1: In each measurement cycle, two memory spaces are constructed on the static random access memory of the core gateway as a large flow screening module and a small flow storage module;

[0007] Step S2: Map the flow to be monitored to the large flow screening module for flow screening. If the flow is judged to be a large flow, a corresponding flow state operation is performed in the large flow screening module to realize flow state monitoring; if the flow is judged to be a small flow, the flow is mapped to the small flow storage module and a corresponding flow state operation is performed to realize flow state monitoring;

[0008] The flow state operation includes an insert operation, a delete operation, an update operation and a query operation. The large flow is a flow whose number of data packets exceeds a preset number, and the small flow is a flow whose number of data packets does not exceed a preset number.

[0009] In one embodiment of the present invention, the method of the insertion operation is:

[0010] Each packet in a flow is passed through a flow-state pair When it arrives in the form of To insert the data, first use the hash function to convert the stream-state pair Mapping to the high-volume filtering module No. Bucket, the mapping formula is:

[0011] ;

[0012] in, Indicates bucket, the bucket is a register, is a hash function, For modulo calculation, is the number of buckets, where each bucket includes four fields, namely , , , , Used to store flow labels. Used to store stream status, Used to count the number of packets with the same flow label as the bucket. Used to count the number of data packets with different flow labels from the bucket;

[0013] According to Different insertion operations are performed based on the filling content of each bucket.

[0014] In one embodiment of the present invention, the The following methods are used to insert different contents of a bucket:

[0015] Jordi bucket is empty, that is , then directly convert the flow-state pair Insert into the bucket: and Modified to and ,Will Set to 1 to count the packet, where Represents an empty type;

[0016] Jordi Streams and stream-state pairs recorded in buckets The same stream, that is , then The value of is increased by 1 to count the packet;

[0017] Jordi Streams and stream-state pairs recorded in buckets The streams are different, that is ,and , then The value of is increased by 1 to count the number of packets mapped to the bucket and with different flow labels; at the same time, the flow-state pair Send to small stream storage module Recording, small stream storage module include flow state storage unit, by using A hash function converts the flow-state pair Map to A stream state storage unit is created, and its storage state is modified to , the formula is:

[0018] ;

[0019] in, Storage module for small streams No. flow state storage unit, for The hash function A hash function, It is an assignment operation;

[0020] Jordi Streams and stream-state pairs recorded in buckets The streams are different, that is ,and , first Stream-state pairs stored in buckets Send to small stream storage module To record, use A hash function converts the flow-state pair Map to A stream state storage unit is created, and its storage state is modified to , the formula is:

[0021] ;

[0022] Reset bucket and convert the stream-state pair Insert into the bucket: and Modified to and ,Will Set to 1 to count the packet and Reset to 0.

[0023] In one embodiment of the present invention, the method of the deletion operation is:

[0024] Deleting the stored streams: First, use the hash function to map the stored streams to the large stream filtering module. No. The stored flow label is , if the label is The stream of is the same as the stream stored in the bucket, that is, , then clear or reset all domains of the bucket to delete the stream status record; if the tag is The stream of is different from the stream stored in the bucket, that is, , then label it as The stream is sent to the small stream storage module To delete, map the stored stream to Stream state storage unit , and clear its storage state.

[0025] In one embodiment of the present invention, the query operation method is:

[0026] To query a given stream: First, use the hash function to map the stored stream to the large stream filtering module. No. The stored flow label is , if the label is The stream of is the same as the stream stored in the bucket, that is, , then the stream state stored in the bucket Return as query result; if the tag is The stream of is different from the stream stored in the bucket, that is, , then label it as The stream is sent to the small stream storage module To query, by mapping it to flow state storage unit, and The state values ​​of the flow state storage units are intersected and returned as the query result. The formula is:

[0027] ;

[0028] in, To take the intersection symbol.

[0029] In one embodiment of the present invention, the method of the update operation is:

[0030] Perform an update operation on a given stream: first perform a delete operation, then perform an insert operation.

[0031] In order to solve the above technical problems, the present invention provides a network flow status monitoring system, comprising:

[0032] Building module: used to build two memory spaces on the static random access memory of the core gateway as a large flow screening module and a small flow storage module in each measurement cycle;

[0033] Traffic status monitoring module: used to map the flow to be monitored to the large flow screening module for flow screening. If the flow is judged to be a large flow, the corresponding flow status operation is performed in the large flow screening module to realize traffic status monitoring; if the flow is judged to be a small flow, the flow is mapped to the small flow storage module and the corresponding flow status operation is performed to realize traffic status monitoring;

[0034] The flow state operation includes an insert operation, a delete operation, an update operation and a query operation. The large flow is a flow whose number of data packets exceeds a preset number, and the small flow is a flow whose number of data packets does not exceed a preset number.

[0035] To solve the above technical problems, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above network flow status monitoring method when executing the computer program.

[0036] In order to solve the above technical problems, the present invention provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above network flow status monitoring method are implemented.

[0037] In order to solve the above technical problem, the present invention provides a computer program product, including a computer program, which implements the steps of the above network flow status monitoring method when executed by a processor.

[0038] The above technical solution of the present invention has the following advantages compared with the prior art:

[0039] The network flow status monitoring method described in the present invention screens traffic types by real-time identification, and performs differentiated status monitoring for different traffic types (specifically, the status monitoring of traffic can be achieved through insertion operations, deletion operations, update operations and query operations) to improve monitoring efficiency and reduce the consumption of memory and computing resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to make the contents of the present invention more clearly understood, the present invention is further described in detail below based on specific embodiments of the present invention in conjunction with the accompanying drawings.

[0041] Figure 1 is a flow chart of the method of the present invention;

[0042] Figure 2 It is a block diagram of the method of the present invention. DETAILED DESCRIPTION

[0043] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it, but the embodiments are not intended to limit the present invention. Embodiment 1

[0044] Reference Figure 1 and Figure 2 As shown, the present invention relates to a network flow state monitoring method, comprising:

[0045] Step S1: In each measurement cycle, two memory spaces are constructed on the static random access memory of the core gateway as a large flow screening module and a small flow storage module;

[0046] Step S2: Map the flow to be monitored to the large flow screening module for flow screening. If the flow is judged to be a large flow, a corresponding flow state operation is performed in the large flow screening module to realize flow state monitoring; if the flow is judged to be a small flow, the flow is mapped to the small flow storage module and a corresponding flow state operation is performed to realize flow state monitoring;

[0047] The flow state operation includes an insert operation, a delete operation, an update operation and a query operation. The large flow is a flow whose number of data packets exceeds a preset number, and the small flow is a flow whose number of data packets does not exceed a preset number.

[0048] The following is a detailed introduction to this embodiment:

[0049] The network flow state monitoring method proposed in this embodiment mainly includes four flow state operations: insertion, deletion, update and query. All operations are performed on the static random access memory (SRAM) of the core gateway of the network link. In each measurement cycle, two memory spaces will be opened on the SRAM for the large flow screening module and the small flow storage module respectively. When it is necessary to monitor the flow, first, the flow is mapped to a register (i.e., bucket) of the large flow screening module using a hash function according to the flow label, and traffic screening is performed. If the flow is judged to be a large flow, the corresponding flow state operation is performed in the register. Otherwise, if the flow is judged to be a small flow, the flow is mapped to multiple flow state storage units of the small flow storage module using a hash function according to the flow label, and the corresponding flow state operation is performed. After a measurement cycle ends, the SRAM will reset the opened memory space. The specific implementation method is as follows:

[0050] At the beginning of each measurement cycle, the core gateway will open up a memory space in SRAM for the large flow screening module , the large flow screening module Contains a hash function and registers ( ), each register contains four fields: Used to store flow labels. Used to store stream status, Used to count the number of packets with the same flow label as this register. It is used to count the number of packets with different flow labels from this register. In addition, the core gateway will also open up a memory space on the SRAM for the small flow storage module , which contains flow state storage unit, using Hash functions ( ) maps the stream to corresponding flow state storage unit. For each incoming flow-state pair , and perform corresponding processing according to the different operations required.

[0051] (I) Insertion operation. When a new flow arrives (each packet in the flow passes through the flow-state pair ), for the flow-state pair To perform the insertion operation, first use the hash function to map it to the large flow filtering module No. The specific mapping formula is:

[0052] (1);

[0053] in, Indicates bucket, is any random hash function, For modulo calculation, The bucket number.

[0054] Then, different insertion operations are performed according to the content of the bucket. The specific methods are as follows:

[0055] (1) If the bucket is empty, , then directly convert the flow-state pair Insert into the bucket: and Modified to and ,Will Set to 1 to count the packet, where Represents an empty type;

[0056] (2) If the stream and stream-state pair recorded in the bucket The same stream, that is , then The value of is increased by 1 to count the packet;

[0057] (3) If the stream and stream-state pair recorded in the bucket The streams are different, that is ,and , then The value of is increased by 1 to count the number of packets mapped to this bucket and with different flow labels. At the same time, the flow-state pair Send to small stream storage module Specifically, this embodiment uses Hash function selection A stream state storage unit is created, and its storage state is modified to , the specific method is as follows:

[0058] (2);

[0059] in, Storage module for small streams No. flow state storage unit, is a series of independent and highly random hash functions, corresponding to The hash function A hash function; It is an assignment operation.

[0060] (4) If the stream and stream-state pair recorded in the bucket Different streams ( ),and First, the stream-state pairs stored in the bucket Send to small stream storage module Specifically, this embodiment uses A hash function converts the flow-state pair Map to A stream state storage unit is created, and its storage state is modified to , the specific method is as follows:

[0061] (3);

[0062] Next, reset the bucket and add the stream-state pair Insert into the bucket: and Modified to and ,Will Set to 1 to count the packet and Reset to 0.

[0063] (ii) Delete operation (for stored streams). The flow state deletion operation of the flow is first mapped to the large flow filtering module with the help of a hash function No. bucket. If the label is The stream of is the same as the stream stored in the bucket, that is, , then clear or reset all fields of the bucket to delete the stream status record. Otherwise, if the tag is The stream of is different from the stream stored in the bucket, that is, , then label it as The stream is sent to the small stream storage module Specifically, this embodiment maps it to Stream state storage unit , and clear its storage state.

[0064] (III) Query operation (for a given stream). For a label The flow state query operation is performed on the flow. First, the hash function is used to map it to the large flow screening module. No. bucket. If the label is The stream of is the same as the stream stored in the bucket, that is, , then the stream state stored in the bucket Return as the query result. Otherwise, if the tag is The stream of is different from the stream stored in the bucket, that is, , then label it as The stream is sent to the small stream storage module Specifically, this embodiment maps it to flow state storage unit, and The state values ​​of the stream state storage units are intersected and returned as the query result. The specific operations are as follows:

[0065] (4);

[0066] (iv) Update operation (for a given stream). Labeled The stream state update operation of the stream mainly consists of the deletion operation of the old stream-state pair and the insertion operation of the new stream-state pair. The specific operation is the same as the above content and will not be repeated here.

[0067] This embodiment monitors the flow status through the following four operations:

[0068] Insert operation, used to store new traffic status information;

[0069] The delete operation is used to delete the stored traffic status information;

[0070] Query operation, used to query the flow status information of a given flow;

[0071] Update operation, used to update the traffic state information of a given flow.

[0072] (I) The specific implementation of the insert operation includes the following steps:

[0073] S2.1: Calculate the sequence number mapped to the bucket in the large flow screening module according to formula (1) ;

[0074] S2.2: Check the bucket (i.e. ) storage conditions;

[0075] S2.3: If If it is empty, the flow-state pair is directly Insert into the bucket: and Modified to and ,Will Set to 1 to count the packet;

[0076] S2.4: If the stream and stream-state of the bucket record are The same stream, that is , then The value of is increased by 1 to count the packet;

[0077] S2.5: If the stream and stream-state of the bucket record are Different streams ( ),and , then The value of is increased by 1;

[0078] S2.6: Calculate the mapping to the small flow storage module according to formula (2) The sequence number of a flow state storage unit;

[0079] S2.7: According to formula (2), the flow state Insert Mapping to A flow state storage unit;

[0080] S2.8: If the stream and stream-state of the bucket record are Different streams ( ),and , then according to formula (3), the label in the original bucket is calculated as The flow is mapped to the small flow storage module The sequence number of a flow state storage unit;

[0081] S2.9: According to formula (3), the flow state stored in the original bucket Insert the mapping to A flow state storage unit;

[0082] S2.10: Reset the bucket and set the stream-state pair Insert into the bucket: and Modified to and ,Will Set to 1 to count the packet and Reset to 0.

[0083] (II) The specific implementation of the delete operation includes the following steps:

[0084] S3.1: Calculate the sequence number mapped to the bucket in the large flow screening module according to formula (1) ;

[0085] S3.2: Check bucket (i.e. ) storage conditions;

[0086] S3.3: If the label is The flow and The stored stream is the same, i.e. , then All domains are cleared or reset;

[0087] S3.4: If the label is The stream of is different from the stream stored in the bucket, that is, , then the label is calculated according to formula (2): The flow is mapped to the small flow storage module The sequence number of a flow state storage unit;

[0088] S3.5: Reset middle The stream state storage unit mapped to.

[0089] (III) The specific implementation of the query operation includes the following steps:

[0090] S4.1: Calculate the sequence number mapped to the bucket in the large flow screening module according to formula (1) ;

[0091] S4.2: Check bucket Storage conditions;

[0092] S4.3: If the label is The flow and The stored stream is the same, i.e. , then Returned as query result;

[0093] S4.4: If the label is The stream of is different from the stream stored in the bucket, that is, , then the label is calculated according to formula (2): The flow is mapped to the small flow storage module The sequence number of a flow state storage unit;

[0094] S4.5: According to formula (4), The storage information of the stream state storage unit mapped to is calculated and the calculated value is returned as the query result.

[0095] (IV) The specific implementation of the update operation includes the following steps:

[0096] Tagged with The stream state update operation of the stream is: first perform the delete operation, then perform the insert operation. Embodiment 2

[0097] This embodiment provides a network flow status monitoring system, including:

[0098] Building module: used to build two memory spaces on the static random access memory of the core gateway as a large flow screening module and a small flow storage module in each measurement cycle;

[0099] Traffic status monitoring module: used to map the flow to be monitored to the large flow screening module for flow screening. If the flow is judged to be a large flow, the corresponding flow status operation is performed in the large flow screening module to realize traffic status monitoring; if the flow is judged to be a small flow, the flow is mapped to the small flow storage module and the corresponding flow status operation is performed to realize traffic status monitoring;

[0100] The flow state operation includes an insert operation, a delete operation, an update operation and a query operation. The large flow is a flow whose number of data packets exceeds a preset number, and the small flow is a flow whose number of data packets does not exceed a preset number. Embodiment 3

[0101] This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the network flow status monitoring method described in Embodiment 1 are implemented. Embodiment 4

[0102] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the network flow status monitoring method described in the first embodiment are implemented. Embodiment 5

[0103] This embodiment provides a computer program product, including a computer program. When the computer program is executed by a processor, the steps of the network flow status monitoring method described in the first embodiment are implemented.

[0104] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The schemes in the embodiments of the present application may be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0105] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0106] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0107] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0108] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0109] Obviously, the above embodiments are merely examples for clear explanation and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived from these are still within the protection scope of the invention.

Claims

1. A network flow status monitoring method, Features: include: Step S1: In each measurement cycle, two memory spaces are constructed on the static random access memory of the core gateway as a large flow screening module and a small flow storage module; Step S2: Map the flow to be monitored to the large flow screening module for flow screening. If the flow is judged to be a large flow, a corresponding flow state operation is performed in the large flow screening module to realize flow state monitoring; if the flow is judged to be a small flow, the flow is mapped to the small flow storage module and a corresponding flow state operation is performed to realize flow state monitoring; The flow state operation includes an insert operation, a delete operation, an update operation and a query operation. The large flow is a flow whose number of data packets exceeds a preset number, and the small flow is a flow whose number of data packets does not exceed a preset number.

2. The network flow status monitoring method according to claim 1, Features: The method of the insertion operation is: Each packet in a flow is passed through a flow-state pair When it arrives in the form of To insert the data, first use the hash function to convert the stream-state pair Mapping to the high-volume filtering module No. Bucket, the mapping formula is: ； in, Indicates bucket, the bucket is a register, is a hash function, For modulo calculation, is the number of buckets, where each bucket includes four fields, namely , , , , Used to store flow labels. Used to store stream status, Used to count the number of packets with the same flow label as the bucket. Used to count the number of data packets with different flow labels from the bucket; According to Different insertion operations are performed based on the filling content of each bucket.

3. The network flow status monitoring method according to claim 2, Features: According to the The following methods are used to insert different contents of a bucket: Jordi bucket is empty, that is , then directly convert the flow-state pair Insert into the bucket: and Modified to and ,Will Set to 1 to count the packet, where Represents an empty type; Jordi Streams and stream-state pairs recorded in buckets The same stream, that is , then The value of is increased by 1 to count the packet; Jordi Streams and stream-state pairs recorded in buckets The streams are different, that is ,and , then The value of is increased by 1 to count the number of packets mapped to the bucket and with different flow labels; at the same time, the flow-state pair Send to small stream storage module Recording, small stream storage module include flow state storage unit, by using A hash function converts the flow-state pair Map to A stream state storage unit is created, and its storage state is modified to , the formula is: ； in, Storage module for small streams No. flow state storage unit, for The hash function A hash function, It is an assignment operation; Jordi Streams and stream-state pairs recorded in buckets The streams are different, that is ,and , first Stream-state pairs stored in buckets Send to small stream storage module To record, use A hash function converts the flow-state pair Map to A stream state storage unit is created, and its storage state is modified to , the formula is: ； Reset bucket and convert the stream-state pair Insert into the bucket: and Modified to and ,Will Set to 1 to count the packet and Reset to 0.

4. The network flow status monitoring method according to claim 3, Features: The method of the deletion operation is: Deleting the stored streams: First, use the hash function to map the stored streams to the large stream filtering module. No. The stored flow label is , if the label is The stream is the same as the stream stored in the bucket, that is, , then clear or reset all domains of the bucket to delete the stream status record; if the tag is The stream of is different from the stream stored in the bucket, that is, , then label it as The stream is sent to the small stream storage module To delete, map the stored stream to Stream state storage unit , and clear its storage state.

5. The network flow status monitoring method according to claim 3, Features: The method of the query operation is: To query a given stream: First, use the hash function to map the stored stream to the large stream filtering module. No. The stored flow label is , if the label is The stream is the same as the stream stored in the bucket, that is, , then the stream state stored in the bucket Return as query result; if the tag is The stream of is different from the stream stored in the bucket, that is, , then label it as The stream is sent to the small stream storage module To query, by mapping it to flow state storage unit, and The state values ​​of the flow state storage units are intersected and returned as the query result. The formula is: ； in, To take the intersection symbol.

6. The network flow status monitoring method according to claim 1, Features: The update operation method is: Perform an update operation on a given stream: first perform a delete operation, then perform an insert operation.

7. A network flow status monitoring system, Features: include: Building module: used to build two memory spaces on the static random access memory of the core gateway as a large flow screening module and a small flow storage module in each measurement cycle; Traffic status monitoring module: used to map the flow to be monitored to the large flow screening module for flow screening. If the flow is judged to be a large flow, the corresponding flow status operation is performed in the large flow screening module to realize traffic status monitoring; if the flow is judged to be a small flow, the flow is mapped to the small flow storage module and the corresponding flow status operation is performed to realize traffic status monitoring; The flow state operation includes an insert operation, a delete operation, an update operation and a query operation. The large flow is a flow whose number of data packets exceeds a preset number, and the small flow is a flow whose number of data packets does not exceed a preset number.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, Features: When the processor executes the computer program, the steps of the network flow status monitoring method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, Features: When the computer program is executed by a processor, the steps of the network flow status monitoring method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program, It is characterized in that When the computer program is executed by a processor, the steps of the network flow status monitoring method described in any one of claims 1 to 6 are implemented.

Images