A data traffic classification method, apparatus, device and medium

Abstract

The application discloses a data flow classification method and device, equipment and medium, and relates to the field of data classification, comprising: respectively performing semantic feature extraction on each flow feature in the to-be-classified data flow, and determining a data flow semantic feature vector based on each feature vector obtained after the semantic feature extraction; mining the correlation between the data flow semantic feature vector and a label semantic feature vector based on a self-attention mechanism to obtain a correlation feature vector; adaptively fusing the data flow semantic feature vector and the correlation feature vector to obtain a data flow representation vector, determining the correlation between the data flow representation vector and a hidden layer state based on the self-attention mechanism, processing the data flow representation vector to obtain a target data flow vector, further combining the hidden layer state to determine an output vector, and predicting the label to obtain the classification result of the to-be-classified data flow containing several predicted labels, so that the accuracy of data flow classification is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data classification, and in particular to a data flow classification method, device, equipment and medium. BACKGROUND

[0002] With the rapid increase in network size, a large number of network devices are connected to the Internet, resulting in a large number of complex data and great difficulties in network management. Classifying data flow to manage data flow is a main way to realize network management.

[0003] The existing flow classification methods mainly include a deep packet inspection (DPI) based flow classification method and a machine learning based flow classification method. However, the DPI based flow classification method may lead to user privacy leakage and increase the consumption of computing power due to the need for searching the load information of the entire data packet and matching the features of the entire data packet. The machine learning based flow classification method generally only depends on the content of the data flow, and may obtain data flow semantic information that is biased to the classification task, thereby causing deviation in the classification result.

[0004] Therefore, how to improve the accuracy of classifying data flow is a problem to be solved by those skilled in the art. SUMMARY

[0005] The embodiments of the present application provide a data flow classification method, device, equipment and medium, which can effectively fuse data flow semantic feature vectors and label semantic feature vectors, thereby obtaining data flow representation vectors with higher label discriminability. Subsequently, the label prediction and classification of the data flow to be classified can be realized by combining the hidden layer state, which can improve the accuracy and reliability of data flow classification. The specific scheme is as follows:

[0006] In a first aspect, the present application provides a data flow classification method, comprising:

[0007] obtaining data flow to be classified, and performing semantic feature extraction on each flow feature in the data flow to be classified to determine a global data flow semantic feature vector based on each semantic feature vector obtained after the semantic feature extraction;

[0008] mining the correlation between the global data flow semantic feature vector and a label semantic feature vector based on a first self-attention mechanism to obtain a correlation feature vector; wherein the label semantic feature vector includes a plurality of label vectors, and the plurality of label vectors are vectors obtained by performing semantic feature extraction on a plurality of text form labels in a preset label set;

[0009] The global data flow semantic feature vector and the association feature vector are adaptively fused to obtain a data flow representation vector, a correlation between the data flow representation vector and a hidden layer state is determined based on a second self-attention mechanism, and the data flow representation vector is processed based on the correlation to obtain a target data flow vector;

[0010] An output vector is determined based on the target data flow vector and the hidden layer state, and a label prediction is performed on the output vector to obtain a classification result of the data flow to be classified, which includes a plurality of predicted labels.

[0011] Optionally, the semantic feature extraction is performed on each flow feature in the data flow to be classified based on semantic feature vectors obtained after the semantic feature extraction, to determine a global data flow semantic feature vector, including:

[0012] Each flow feature in the data flow to be classified is input into a bidirectional long short-term memory network, and semantic feature extraction is performed on each flow feature based on a forward algorithm and a backward algorithm, to obtain a semantic feature vector corresponding to each flow feature;

[0013] A corresponding global data flow semantic feature vector is determined based on the semantic feature vector corresponding to each flow feature.

[0014] Optionally, the semantic feature extraction is performed on each flow feature based on a forward algorithm and a backward algorithm, to obtain a semantic feature vector corresponding to each flow feature, including:

[0015] A forward calculation is performed on any flow feature based on a forward semantic feature of a previous time step corresponding to the flow feature at a current time step, to obtain a forward semantic feature of the current time step corresponding to the flow feature;

[0016] A backward calculation is performed on the any flow feature based on a backward semantic feature of a next time step corresponding to the flow feature at the current time step, to obtain a backward semantic feature of the current time step corresponding to the flow feature;

[0017] A semantic feature vector corresponding to the any flow feature is determined based on the forward semantic feature and the backward semantic feature of the current time step corresponding to the flow feature.

[0018] Optionally, the association relationship between the global data flow semantic feature vector and the label semantic feature vector is mined based on a first self-attention mechanism to obtain an association feature vector, including:

[0019] transform the global data traffic semantic feature vector based on a first parameter matrix corresponding to each attention head of the multi-head attention mechanism to obtain a query vector corresponding to each attention head;

[0020] transform the label semantic feature vector based on a second parameter matrix corresponding to each attention head of the multi-head attention mechanism to obtain a value vector corresponding to each attention head, and transform the label semantic feature vector based on a third parameter matrix corresponding to each attention head of the multi-head attention mechanism to obtain a key vector corresponding to each attention head; wherein different attention heads correspond to different first parameter matrices, second parameter matrices and third parameter matrices; correspondingly, different attention heads correspond to different query vectors, value vectors and key vectors;

[0021] map the global data traffic semantic feature vector and the label semantic feature vector based on the query vector, the value vector and the key vector corresponding to each attention head to obtain a mapping feature vector corresponding to each attention head;

[0022] concatenate the mapping feature vectors corresponding to each attention head to obtain a concatenated feature vector, and determine a correlation feature vector based on the concatenated feature vector and an attention parameter matrix corresponding to the multi-head attention mechanism.

[0023] Optionally, the determining the correlation between the data flow representation vector and the hidden layer state based on the second self-attention mechanism and processing the data flow representation vector based on the correlation to obtain a target data flow vector comprises:

[0024] determining the correlation between the hidden layer state of the current time step and each representation vector in the data flow representation vector based on the second self-attention mechanism, and determining a weight parameter of the current time step corresponding to each representation vector based on each correlation;

[0025] determining a target data flow vector of the current time step based on each representation vector and the weight parameter of the current time step corresponding to each representation vector;

[0026] wherein the hidden layer state of the current time step is a hidden layer state determined based on a hidden layer state of a previous time step, a target data flow vector of the previous time step and a target label vector of the previous time step; the target label vector of the previous time step is a label vector corresponding to a target predicted label of the previous time step; and the target predicted label of the previous time step is a predicted label with the largest prediction probability selected from a plurality of predicted labels of the previous time step.

[0027] Optionally, the output vector is determined based on the target data flow vector and the hidden layer state, and label prediction is performed on the output vector to obtain a classification result of the data flow to be classified, which includes a plurality of predicted labels.

[0028] An output vector of the current time step is determined based on the target data flow vector of the current time step and the hidden layer state of the current time step.

[0029] The output vector of the current time step is subjected to label prediction based on the mask vector of the current time step, so as to obtain a classification result of the data flow to be classified in the current time step, which includes a plurality of predicted labels.

[0030] The mask vector of the current time step is obtained by setting the mask corresponding to the label predicted by the historical time step in the initial mask vector constructed based on the preset label set to a preset mask value.

[0031] Optionally, after the output vector of the current time step is subjected to label prediction based on the mask vector of the current time step, so as to obtain a classification result of the data flow to be classified in the current time step, which includes a plurality of predicted labels, the method further comprises:

[0032] After label prediction of each time step is completed and a plurality of predicted labels of each time step are obtained, beam search is performed on the plurality of predicted labels of each time step based on a preset beam width, so as to obtain an optimal label sequence corresponding to the data flow to be classified.

[0033] In a second aspect, the present application provides a data flow classification device, comprising:

[0034] A semantic feature extraction module is configured to acquire data flow to be classified, and perform semantic feature extraction on each flow feature in the data flow to be classified, so as to determine a global data flow semantic feature vector based on each semantic feature vector obtained after semantic feature extraction.

[0035] An association relationship mining module is configured to mine an association relationship between the global data flow semantic feature vector and a label semantic feature vector based on a first self-attention mechanism, so as to obtain an association feature vector; wherein the label semantic feature vector includes a plurality of label vectors, and the plurality of label vectors are vectors obtained by performing semantic feature extraction on a plurality of labels in a preset label set in a text form.

[0036] a representation vector processing module configured to adaptively fuse the global data flow semantic feature vector and the association feature vector to obtain a data flow representation vector, determine a correlation between the data flow representation vector and a hidden layer state based on a second self-attention mechanism, and process the data flow representation vector based on the correlation to obtain a target data flow vector;

[0037] a label prediction module configured to determine an output vector based on the target data flow vector and the hidden layer state, and predict a label for the output vector to obtain a classification result of the data flow to be classified, which includes a plurality of predicted labels.

[0038] In a third aspect, the present application provides an electronic device, comprising:

[0039] a memory configured to store a computer program;

[0040] a processor configured to execute the computer program to implement the steps of the data flow classification method.

[0041] In a fourth aspect, the present application provides a computer readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the data flow classification method are implemented.

[0042] In the present application, a data flow to be classified is obtained, and semantic feature extraction is performed on each flow feature in the data flow to be classified. A global data flow semantic feature vector is determined based on each semantic feature vector obtained after semantic feature extraction. An association feature vector is obtained based on a first self-attention mechanism to mine an association relationship between the global data flow semantic feature vector and a label semantic feature vector. The label semantic feature vector includes a plurality of label vectors, which are obtained by performing semantic feature extraction on a plurality of text-form labels in a preset label set. A data flow representation vector is obtained by adaptively fusing the global data flow semantic feature vector and the association feature vector. A correlation between the data flow representation vector and a hidden layer state is determined based on a second self-attention mechanism, and the data flow representation vector is processed based on the correlation to obtain a target data flow vector. An output vector is determined based on the target data flow vector and the hidden layer state, and a label is predicted for the output vector to obtain a classification result of the data flow to be classified, which includes a plurality of predicted labels.

[0043] Beneficial effects: the application extracts semantic features of several text-form labels in a preset label set respectively in advance, constructs a label semantic feature vector based on several label vectors obtained after semantic feature extraction, so that when classifying the data flow to be classified, a global data flow semantic feature vector can be constructed based on each semantic feature vector obtained after semantic feature extraction of each flow feature in the data flow to be classified, and the correlation between the global data flow semantic feature vector and the label semantic feature vector is mined, so as to effectively fuse the global data flow semantic feature vector and the label semantic feature vector, so as to obtain a data flow representation vector with better label discriminability, and reduce the attention to noise content in the data flow. Further, by subsequent label prediction based on the hidden layer state and the data flow representation vector, the label prediction classification of the data flow to be classified can be realized, which can reduce the classification deviation of the data flow, and improve the accuracy and reliability of the data flow classification. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present application, the drawings needed in the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0045] Figure 1 A data flow classification method flowchart provided for the embodiments of the present application;

[0046] Figure 2 A data flow classification flowchart provided for the embodiments of the present application;

[0047] Figure 3 A data flow classification device structure schematic diagram provided for the embodiments of the present application;

[0048] Figure 4 An electronic equipment structure diagram provided for the embodiments of the present application. DETAILED DESCRIPTION

[0049] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present application.

[0050] With the sharp increase in network size, a large number of network devices are accessed to the Internet, resulting in a large number of complex data of various services in the network, and bringing great difficulties to the management of the network; and classifying the data flow to manage the data flow is a main way to realize the network management. Therefore, the application provides a data flow classification method, which effectively fuses the data flow semantic feature vector and the label semantic feature vector to obtain a data flow representation vector with higher label discriminability, and then combines the hidden layer state to realize label prediction classification of the data flow to be classified, so that the accuracy and reliability of the data flow classification can be improved.

[0051] Referring to Figure 1 As shown in the figure, the embodiment of the application provides a data flow classification method, which comprises the following steps:

[0052] In step S11, the data flow to be classified is obtained, and the semantic features of each flow feature in the data flow to be classified are extracted respectively to determine the global data flow semantic feature vector based on the semantic feature vectors obtained after the semantic feature extraction.

[0053] In this embodiment, the data flow to be classified is obtained and input into the pre-trained data flow classification model, so that the semantic features of each flow feature in the data flow to be classified are extracted respectively by the content encoding layer in the data flow classification model to obtain the semantic feature vectors corresponding to each flow feature respectively, and then the corresponding global data flow semantic feature vector is obtained based on the semantic feature vectors corresponding to each flow feature respectively.

[0054] According to one of the embodiments, for each flow feature in the data flow to be classified, the text form data flow to be classified can be segmented and feature extracted by the pre-trained word embedding model, so as to obtain each flow feature. The word embedding model can use Word2Vec (Word to Vector, a related model for generating word vectors), BERT (Bidirectional Encoder Representations from Transformers, a deep bidirectional language representation model based on the Transformer architecture) and the like. In this way, the word embedding model is used to segment and extract features of the data flow to be classified, so as to capture the semantic information of each segmented word in the data flow.

[0055] It should be noted that the semantic feature of each traffic feature in the to-be-classified data traffic is extracted through the content encoding layer in the data traffic classification model, specifically, each traffic feature in the to-be-classified data traffic is input into the content encoding layer in the data traffic classification model, so that the content encoding layer uses the bidirectional long short-term memory network (Bi-LSTM, Bidirectional Long Short-Term Memory) to extract the semantic feature of each traffic feature based on the forward algorithm and the backward algorithm, to obtain the semantic feature vector corresponding to each traffic feature. In this way, the embodiment of the application uses the bidirectional long short-term memory network to establish the semantic feature vector corresponding to each traffic feature in the data traffic from the front to the back and from the back to the front, so that the global semantic feature vector of the data traffic can be obtained based on the semantic feature vector corresponding to each traffic feature.

[0056] Specifically, for any traffic feature in each traffic feature, the content encoding layer uses the bidirectional long short-term memory network to perform forward calculation on the traffic feature based on the forward semantic feature of the previous time step corresponding to the traffic feature at the current time step, to obtain the forward semantic feature of the current time step corresponding to the traffic feature; and perform backward calculation on the traffic feature based on the backward semantic feature of the next time step corresponding to the traffic feature at the current time step, to obtain the backward semantic feature of the current time step corresponding to the traffic feature; and then splice the forward semantic feature and the backward semantic feature of the current time step corresponding to the traffic feature to obtain the semantic feature vector corresponding to the traffic feature. The specific formula involved is as follows:

[0057] ;

[0058] ;

[0059] ;

[0060] wherein, represents any traffic feature in each traffic feature; m represents the total number of features of each traffic feature in the to-be-classified data traffic; t represents the current time step; represents the forward semantic feature of the previous time step corresponding to any traffic feature; represents the backward semantic feature of the next time step corresponding to any traffic feature; LSTM represents the calculation function of the long short-term memory network; represents the forward semantic feature of the current time step corresponding to any traffic feature; represents the backward semantic feature of the current time step corresponding to any traffic feature; represents the semantic feature vector corresponding to any traffic feature.

[0061] After obtaining the semantic feature vectors respectively corresponding to each traffic feature x = (w1, w2,..., w m ) in the data traffic to be classified, a global data traffic semantic feature vector H = {h1, h2,..., h m} is obtained based on the semantic feature vectors respectively corresponding to each traffic feature.

[0062] In step S12, an association feature vector is obtained by mining the association between the global data traffic semantic feature vector and a label semantic feature vector based on a first self-attention mechanism. The label semantic feature vector includes a plurality of label vectors, which are obtained by performing semantic feature extraction on a plurality of text-form labels in a preset label set.

[0063] In this embodiment, the global data traffic semantic feature vector is input to an interaction attention layer in the data traffic classification model through the content encoding layer in the data traffic classification model, so that the interaction attention layer mines the association between the global data traffic semantic feature vector and a label semantic feature vector based on a first self-attention mechanism, thereby obtaining an association feature vector. The first self-attention mechanism can be a multi-head attention mechanism.

[0064] For the label semantic feature vector, semantic feature extraction is performed on a plurality of text-form labels Y = {y1, y2,..., y n} in a preset label set through a pre-trained word embedding model, to obtain a plurality of label vectors respectively corresponding to the plurality of text-form labels, and then a label semantic feature vector C = {c1, c2,..., c n} is determined based on the label vectors respectively corresponding to the plurality of text-form labels. It should be noted that the vector dimensions of the label vectors in the label semantic feature vector are consistent with the vector dimensions of the traffic features in the data traffic to be classified. Furthermore, in the training process of the data traffic classification model, the frequency of each label vector is obtained by counting the number of occurrences of each label vector, and each label vector is sorted in descending order of frequency, so as to construct the label semantic feature vector based on the sorted label vectors; that is, the frequency of any label vector in the label semantic feature vector is higher than the frequency of the next label vector.

[0065] According to one of the embodiments, for the association feature vector, each attention head in the multi-head attention mechanism maps the global data traffic semantic feature vector and the label semantic feature vector respectively, to obtain a mapping feature vector respectively corresponding to each attention head, and then the association feature vector is determined based on the attention parameter matrix corresponding to the multi-head attention mechanism and the mapping feature vectors respectively corresponding to each attention head.

[0066] Specifically, the global data traffic semantic feature vector is transformed based on the first parameter matrix corresponding to each attention head to obtain a query vector corresponding to each attention head; the label semantic feature vector is transformed based on the second parameter matrix corresponding to each attention head to obtain a value vector corresponding to each attention head, and the label semantic feature vector is transformed based on the third parameter matrix corresponding to each attention head to obtain a key vector corresponding to each attention head. It should be noted that different attention heads correspond to different first parameter matrices, second parameter matrices and third parameter matrices; correspondingly, different attention heads correspond to different query vectors, value vectors and key vectors; and the parameter matrices involved in the embodiments of the present application are all learned in the training process of the data traffic classification model. Further, after obtaining the query vector, the value vector and the key vector corresponding to each attention head, the global data traffic semantic feature vector and the label semantic feature vector are mapped based on the query vector, the value vector and the key vector corresponding to each attention head to obtain a mapping feature vector corresponding to each attention head; then the mapping feature vectors corresponding to each attention head are spliced to obtain a spliced feature vector, and an associated feature vector is determined based on the spliced feature vector and the attention parameter matrix corresponding to the multi-head attention mechanism. The specific formula involved is as follows:

[0067] ;

[0068] ;

[0069] wherein, denotes the rth attention head; r denotes the number of attention heads; H denotes the global data traffic semantic feature vector; C denotes the label semantic feature vector; denotes the query vector corresponding to the rth attention head; denotes the key vector corresponding to the rth attention head; denotes the value vector corresponding to the rth attention head; d denotes the vector dimension; denotes the attention parameter matrix; softmax denotes the activation function; Concat denotes the splicing function; G denotes the associated feature vector. It should be noted that, ; ; that is, the vector dimensions of the query vector, the value vector and the key vector are ; and the vector dimension of the attention parameter matrix is . In this way, the embodiments of the present application reduce the classification bias caused by relying only on data traffic for label prediction classification by mining the association between the global data traffic semantic feature vector and the label semantic feature vector.

[0070] Step S13: Adaptively fuse the global data traffic semantic feature vector and the associated feature vector to obtain a data traffic representation vector. Determine the correlation between the data traffic representation vector and the hidden layer state based on the second self-attention mechanism, and use the correlation to process the data traffic representation vector to obtain the target data traffic vector.

[0071] In this embodiment, an adaptive gate in the data traffic classification model is used to adaptively weight and fuse the global data traffic semantic feature vector and the associated feature vector to obtain a more label-discriminative data traffic representation vector. The specific formulas involved are as follows:

[0072] ;

[0073] in, Let H represent the adaptive weighting coefficients; G represent the global data flow semantic feature vector; U represent the association feature vector; and U = {u1, u2, ..., u}. m}; This represents the dot product. Thus, this embodiment of the invention, through adaptive weighted fusion of the global data traffic semantic feature vector and the associated feature vector, better leverages the respective advantages of both.

[0074] Furthermore, the correlation between the data flow representation vector and the hidden layer state is determined by using the second self-attention mechanism in the attention layer of the data flow classification model, and the correlation is used to process the data flow representation vector to obtain the target data flow vector.

[0075] According to one embodiment, the correlation between the hidden layer state at the current time step and each representation vector in the data flow representation vector is determined using a second self-attention mechanism through an attention layer, and the weight parameters for the current time step corresponding to each representation vector are determined based on the correlations; then, the target data flow vector for the current time step is determined based on each representation vector and the weight parameters for the current time step corresponding to each representation vector. The specific formulas involved are as follows:

[0076] ;

[0077] ;

[0078] ;

[0079] Where T represents the transpose of the matrix; The data flow representation vector represents the first... represents a vector; tanh represents the hyperbolic tangent function; the hidden layer state of the current time step t; the correlation between the hidden layer state of the current time step and the i-th representation vector in the data flow representation vector; exp represents an exponential function; m represents the total number of vectors of each representation vector in the data flow representation vector; the weight parameter of the current time step corresponding to the i-th representation vector; the target data flow vector of the current time step; are parameter matrices obtained during training of the data flow classification model.

[0080] It should be noted that the hidden layer state of the current time step is determined by the hidden layer in the data flow classification model using a long short-term memory network based on the hidden layer state of the previous time step, the target data flow vector of the previous time step, and the target label vector of the previous time step; wherein the target label vector of the previous time step is a label vector corresponding to the target predicted label of the previous time step; and the target predicted label of the previous time step is a predicted label with the largest prediction probability selected from a plurality of predicted labels of the previous time step. The specific formula involved is as follows:

[0081] ;

[0082] wherein, the hidden layer state of the current time step t; the hidden layer state of the previous time step; LSTM represents a calculation function of a long short-term memory network; the target data flow vector of the previous time step; the target predicted label of the previous time step, that is, a predicted label with the largest prediction probability in a plurality of predicted labels of the previous time step; the target label vector of the previous time step, that is, a label vector corresponding to the target predicted label of the previous time step.

[0083] In step S14, an output vector is determined based on the target data flow vector and the hidden layer state, and a label prediction is performed on the output vector to obtain a classification result of the data flow to be classified, which includes a plurality of predicted labels.

[0084] In this embodiment, an output vector is determined based on a target data flow vector and a hidden layer state by a classification layer in a data flow classification model, and a label prediction is performed on the output vector to obtain a classification result of the data flow to be classified; wherein the classification result includes a plurality of predicted labels.

[0085] Specifically, the target data flow vector of the current time step and the hidden layer state of the current time step are fully connected and linearly added by the classification layer to obtain an output vector of the current time step; and the output vector of the current time step is label predicted based on the mask vector of the current time step to obtain a classification result of the data flow to be classified at the current time step, which contains several predicted labels. The specific formula involved is as follows:

[0086] ;

[0087] ;

[0088] wherein, , , are parameter matrices obtained during training of the data flow classification model; represents the hidden layer state of the current time step t; represents the target data flow vector of the current time step; f represents a nonlinear activation function; represents the output vector of the current time step; softmax represents an activation function; represents the mask vector of the current time step; represents the classification result of the data flow to be classified at the current time step, that is, several predicted labels of the current time step.

[0089] For the mask vector of the current time step, the mask corresponding to the label predicted by the historical time step in the initial mask vector is set to a preset mask value to obtain the mask vector of the current time step; wherein the initial mask vector is a vector constructed based on a preset label set; and the preset mask value can be set to a large negative number, so that when the softmax function is applied, the prediction probability of the corresponding label is close to zero, thereby avoiding repeated prediction of the same label at different time steps.

[0090] It should be noted that after completing the label prediction of each time step and obtaining several predicted labels of each time step, beam search is performed on the several predicted labels of each time step based on a preset beam width to obtain an optimal label sequence corresponding to the data flow to be classified. Wherein, the beam width can be flexibly set according to actual needs, and the beam search can alleviate the exposure error problem when generating several predicted labels by predicting the classification of several flow characteristics in the data flow to be classified.

[0091] In this embodiment, for training of the data traffic classification model, a training set can be first constructed based on a plurality of sets of training data, and the data traffic classification model is trained based on the training set and a preset loss function to obtain a pre-trained data traffic classification model. Each set of training data is data composed of a data traffic sample and a corresponding real label set; the data traffic sample includes a plurality of traffic features, and the real label set includes a plurality of real labels.

[0092] According to one of the embodiments, the preset loss function can adopt a cross-entropy loss function, specifically, the loss between the predicted label and the real label corresponding to each data traffic sample is calculated based on the preset label set and the cross-entropy loss function, and the training loss is determined based on the sum of the losses to optimize the training of the data traffic classification model, so as to obtain the trained data traffic classification model. The calculation formula of the cross-entropy loss function is as follows:

[0093] ;

[0094] wherein, N represents the number of sets of training data in the training set; n represents the total number of labels in the preset label set; represents the real label; represents the predicted label.

[0095] According to another embodiment, the preset loss function is a loss function constructed based on a plurality of different loss functions, such as cross-entropy loss function, Hinge loss function, log-likelihood loss function, etc. The training loss of the data traffic classification model is calculated by a plurality of different loss functions, and each training loss is weighted calculated based on the weight parameters corresponding to each loss function to obtain the final training loss, so as to optimize the training of the data traffic classification model based on the final training loss to obtain the trained data traffic classification model. The weight parameters corresponding to each loss function can be dynamically adjusted based on the accuracy of the training of the data traffic classification model. In this way, by means of multi-loss function fusion, the accuracy of the training of the data traffic classification model can be improved, so as to improve the accuracy and reliability of the data traffic classification.

[0096] Beneficial effects: the application extracts semantic features of several text-form labels in the preset label set respectively in advance, constructs a label semantic feature vector based on several label vectors obtained after semantic feature extraction, so that when predicting and classifying the to-be-classified data flow, a global data flow semantic feature vector can be constructed based on the semantic feature vectors obtained after semantic feature extraction of each flow feature in the to-be-classified data flow, and the correlation between the global data flow semantic feature vector and the label semantic feature vector is mined, so as to effectively fuse the global data flow semantic feature vector and the label semantic feature vector, so as to obtain a data flow representation vector with better label discriminability, and reduce the attention to noise content in the data flow. Further, by subsequently predicting the label based on the hidden layer state and the data flow representation vector, the label prediction and classification of the to-be-classified data flow can be realized, which can reduce the classification deviation of the data flow and improve the accuracy and reliability of the data flow classification.

[0097] Referring to Figure 2 The embodiment of the application provides a data flow classification method, which comprises the following steps:

[0098] The to-be-classified data flow is input into the data flow classification model, so that each flow feature x=(w1, w2,..., w m ) in the to-be-classified data flow is subjected to semantic feature extraction by the content encoding layer in the data flow classification model, and a corresponding global data flow semantic feature vector is obtained by concatenating each semantic feature vector obtained after semantic feature extraction, and then the global data flow semantic feature vector is input into the interaction attention layer in the data flow classification model.

[0099] The interaction attention layer in the data flow classification model uses each attention head in the multi-head attention mechanism to respectively map the global data flow semantic feature vector and the label semantic feature vector C=(c1, c2,..., c n ) to obtain a mapping feature vector corresponding to each attention head, then the mapping feature vectors corresponding to each attention head are spliced to obtain a spliced feature vector, and the correlation feature vector is determined based on the spliced feature vector and the attention parameter matrix corresponding to the multi-head attention mechanism, and the correlation feature vector is input into the adaptive gate in the data flow classification model.

[0100] The adaptive gate in the data flow classification model adaptively weights and fuses the global data flow semantic feature vector and the correlation feature vector to obtain a data flow representation vector with better label discriminability, and the data flow representation vector is input into the attention layer in the data flow classification model.

[0101] The self-attention mechanism is used by the attention layer in the data flow classification model to determine the correlation between the hidden layer state and each representation vector in the data flow representation vector, and determine a weight parameter corresponding to each representation vector based on the correlation, and then determine a target data flow vector based on each representation vector and the weight parameter corresponding to each representation vector, and input the target data flow vector into the classification layer in the data flow classification model. The hidden layer state is a state obtained by the hidden layer in the data flow classification model.

[0102] The classification layer in the data flow classification model determines an output vector based on the target data flow vector and the hidden layer state, and uses the mask vector to perform label prediction on the output vector to obtain a classification result of the data flow to be classified containing a plurality of predicted labels, thereby realizing label prediction classification of the data flow to be classified.

[0103] Beneficial effects: The application extracts semantic features of a plurality of text-form labels in a preset label set respectively in advance to construct a label semantic feature vector based on a plurality of label vectors obtained after semantic feature extraction, so that when performing label prediction classification on the data flow to be classified, a global data flow semantic feature vector can be constructed based on a plurality of semantic feature vectors obtained after semantic feature extraction of each flow feature in the data flow to be classified, and the correlation between the global data flow semantic feature vector and the label semantic feature vector is mined to effectively fuse the global data flow semantic feature vector and the label semantic feature vector, so as to obtain a data flow representation vector with better label discrimination and reduce the attention to noise content in the data flow. Further, label prediction based on the hidden layer state and the data flow representation vector is performed to realize label prediction classification of the data flow to be classified, which can reduce the classification bias of the data flow and improve the accuracy and reliability of data flow classification.

[0104] Referring to Figure 3 The embodiment of the application provides a data flow classification device, which comprises:

[0105] The semantic feature extraction module 11 is configured to obtain the data flow to be classified, and extract semantic features of each flow feature in the data flow to be classified respectively to determine a global data flow semantic feature vector based on a plurality of semantic feature vectors obtained after semantic feature extraction.

[0106] The correlation mining module 12 is configured to mine the correlation between the global data flow semantic feature vector and a label semantic feature vector based on a first self-attention mechanism to obtain a correlation feature vector. The label semantic feature vector comprises a plurality of label vectors, and the plurality of label vectors are vectors obtained after semantic feature extraction of a plurality of text-form labels in a preset label set respectively.

[0107] a vector representation module 13 configured to perform adaptive fusion on the global data traffic semantic feature vector and the correlation feature vector to obtain a data traffic representation vector, determine a correlation between the data traffic representation vector and a hidden layer state based on a second self-attention mechanism, and process the data traffic representation vector based on the correlation to obtain a target data traffic vector;

[0108] a label prediction module 14 configured to determine an output vector based on the target data traffic vector and the hidden layer state, and perform label prediction on the output vector to obtain a classification result of the data traffic to be classified, which includes a plurality of predicted labels.

[0109] Since the embodiments of the device part correspond to the above-mentioned embodiments, the embodiments of the device part are described with reference to the embodiments of the method part described above, and will not be described here.

[0110] Beneficial effects: The present application extracts semantic features from a plurality of text-form labels in a preset label set respectively in advance, constructs a label semantic feature vector based on a plurality of label vectors obtained after semantic feature extraction, and thus can construct a global data traffic semantic feature vector based on a plurality of semantic feature vectors obtained after semantic feature extraction of each traffic feature in the data traffic to be classified when performing label prediction and classification on the data traffic to be classified, and mine the correlation between the global data traffic semantic feature vector and the label semantic feature vector, so as to effectively fuse the global data traffic semantic feature vector and the label semantic feature vector, thereby obtaining a data traffic representation vector with better label discrimination, and reducing the attention to noise content in the data traffic. Further, by subsequently performing label prediction based on the hidden layer state and the data traffic representation vector, the label prediction and classification of the data traffic to be classified can be realized, which can reduce the classification bias of the data traffic, and improve the accuracy and reliability of the data traffic classification.

[0111] Further, the present application embodiment also discloses an electronic device, Figure 4 is an electronic device structure diagram according to an exemplary embodiment, the contents in the figure cannot be considered as any limitation on the use range of the present application. The electronic device, specifically can include: at least one processor 21, at least one memory 22, power supply 23, communication interface 24, input output interface 25 and communication bus 26. Wherein, the memory 22 is used for storing computer program, the computer program is loaded and executed by the processor 21, to realize the related steps in the data traffic classification method disclosed in any preceding embodiment. In addition, the electronic device in the present embodiment can be an electronic computer.

[0112] In this embodiment, the power supply 23 is configured to provide operating voltage for each hardware device on the electronic device; the communication interface 24 is configured to create a data transmission channel between the electronic device and external devices, and the communication protocol followed by the communication interface 24 can be any communication protocol applicable to the technical solution of the present application, which will not be specifically limited herein; the input / output interface 25 is configured to obtain external input data or output data to the outside, and the specific interface type can be selected according to the specific application needs, which will not be specifically limited herein.

[0113] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., and the resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage mode can be temporary storage or permanent storage.

[0114] The operating system 221 is configured to manage and control each hardware device on the electronic device and the computer program 222, and can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program capable of completing the data flow classification method executed by the electronic device disclosed in any of the foregoing embodiments, the computer program 222 can further include a computer program capable of completing other specific work.

[0115] Further, the present application also discloses a computer readable storage medium for storing a computer program; wherein the computer program is executed by a processor to implement the data flow classification method disclosed above. For the specific steps of the method, please refer to the corresponding content disclosed in the foregoing embodiments, which will not be described here.

[0116] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. For the same or similar parts between each embodiment, please refer to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and please refer to the method part for the relevant part.

[0117] The skilled person can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of both. In order to clearly show the interchangeability of hardware and software, the components and steps of each example have been described in the above description. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0118] The steps of a method or algorithm described in connection with the embodiments disclosed herein can be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module can reside in RAM, flash memory, ROM, electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. The

[0119] Finally, it should be noted that the terms "first" and "second", and the like, are used herein only to distinguish one entity or action from another, and do not necessarily require or imply any actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element preceded by "comprises a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0120] The above provides a detailed description of the technical solutions of the present application. The principles and implementation modes of the present application are described by applying specific examples. The above description of the embodiments is only used to help understand the method of the present application and its core idea; at the same time, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range will be changed; in summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A method of classifying data traffic, characterized by, The method comprises the following steps: acquiring data traffic to be classified, and performing semantic feature extraction on each traffic feature in the data traffic to be classified to determine a global data traffic semantic feature vector based on each semantic feature vector obtained after semantic feature extraction; mining an association relationship between the global data traffic semantic feature vector and a label semantic feature vector based on a first self-attention mechanism to obtain an association feature vector; wherein the label semantic feature vector comprises a plurality of label vectors obtained by performing semantic feature extraction on a plurality of text-form labels in a preset label set; performing adaptive fusion on the global data traffic semantic feature vector and the association feature vector to obtain a data traffic representation vector, determining a correlation between the data traffic representation vector and a hidden layer state based on a second self-attention mechanism, and processing the data traffic representation vector based on the correlation to obtain a target data traffic vector; determining an output vector based on the target data traffic vector and the hidden layer state, and performing label prediction on the output vector to obtain a classification result of the data traffic to be classified, which comprises a plurality of predicted labels.

2. The data traffic classification method of claim 1, wherein, The method comprises the following steps: inputting each traffic feature in the data traffic to be classified into a bidirectional long short-term memory network to perform semantic feature extraction on each traffic feature based on a forward algorithm and a backward algorithm to obtain a semantic feature vector corresponding to each traffic feature; determining a corresponding global data traffic semantic feature vector based on the semantic feature vector corresponding to each traffic feature.

3. The data traffic classification method of claim 2, wherein, The method comprises the following steps: performing forward calculation on any traffic feature based on a forward semantic feature of a previous time step corresponding to the traffic feature at a current time step to obtain a forward semantic feature of the current time step corresponding to the traffic feature; performing backward calculation on the any traffic feature based on a backward semantic feature of a next time step corresponding to the traffic feature at the current time step to obtain a backward semantic feature of the current time step corresponding to the traffic feature; determining a semantic feature vector corresponding to the any traffic feature based on the forward semantic feature and the backward semantic feature of the current time step corresponding to the traffic feature.

4. The data traffic classification method of claim 1, wherein, The method comprises the following steps: transforming the global data traffic semantic feature vector based on a first parameter matrix corresponding to each attention head in a multi-head attention mechanism to obtain a query vector corresponding to each attention head; transform the label semantic feature vector based on the second parameter matrix corresponding to each attention head to obtain a value vector corresponding to each attention head, and transform the label semantic feature vector based on a third parameter matrix corresponding to each attention head to obtain a key vector corresponding to each attention head; different attention heads correspond to different first parameter matrices, second parameter matrices and third parameter matrices; correspondingly, different attention heads correspond to different query vectors, value vectors and key vectors; map the global data traffic semantic feature vector and the label semantic feature vector based on the query vector, the value vector and the key vector corresponding to each attention head to obtain a mapping feature vector corresponding to each attention head; concatenate the mapping feature vectors corresponding to each attention head to obtain a concatenated feature vector, and determine an associated feature vector based on the concatenated feature vector and an attention parameter matrix corresponding to the multi-head attention mechanism.

5. The data traffic classification method according to any of claims 1 to 4, characterized by, The second self-attention mechanism is used to determine the correlation between the data flow representation vector and the hidden layer state, and the data flow representation vector is processed based on the correlation to obtain a target data flow vector, including: determining the correlation between the hidden layer state of the current time step and each representation vector in the data flow representation vector based on the second self-attention mechanism, and determining a weight parameter of the current time step corresponding to each representation vector based on each correlation; determining a target data flow vector of the current time step based on each representation vector and the weight parameter of the current time step corresponding to each representation vector; wherein the hidden layer state of the current time step is a hidden layer state determined based on the hidden layer state of the previous time step, the target data flow vector of the previous time step and the target label vector of the previous time step; the target label vector of the previous time step is a label vector corresponding to the target predicted label of the previous time step; the target predicted label of the previous time step is a predicted label with the largest prediction probability selected from a plurality of predicted labels of the previous time step.

6. The data traffic classification method of claim 5, wherein, The target data flow vector and the hidden layer state are used to determine an output vector, and the output vector is used for label prediction to obtain a classification result of the data flow to be classified containing a plurality of predicted labels, including: determining an output vector of the current time step based on the target data flow vector of the current time step and the hidden layer state of the current time step; performing label prediction on the output vector of the current time step based on a mask vector of the current time step to obtain a classification result of the data flow to be classified containing a plurality of predicted labels at the current time step; wherein the mask vector of the current time step is obtained by setting the mask corresponding to the label predicted by the historical time step in the initial mask vector constructed based on the preset label set to a preset mask value.

7. The data traffic classification method of claim 6, wherein, The label prediction on the output vector of the current time step based on the mask vector of the current time step to obtain the classification result of the data traffic to be classified in the current time step includes: After completing the label prediction of each time step and obtaining a plurality of predicted labels of each time step, a beam search is performed on the plurality of predicted labels of each time step based on a preset beam width to obtain an optimal label sequence corresponding to the data traffic to be classified.

8. A data traffic classification apparatus, characterized by Comprise: The semantic feature extraction module is configured to obtain the data traffic to be classified, and perform semantic feature extraction on each traffic feature in the data traffic to be classified respectively, so as to determine a global data traffic semantic feature vector based on each semantic feature vector obtained after semantic feature extraction; The association relationship mining module is configured to mine an association relationship between the global data traffic semantic feature vector and a label semantic feature vector based on a first self-attention mechanism to obtain an association feature vector; wherein the label semantic feature vector includes a plurality of label vectors, and the plurality of label vectors are vectors obtained by performing semantic feature extraction on a plurality of text-form labels in a preset label set respectively; The representation vector processing module is configured to perform adaptive fusion on the global data traffic semantic feature vector and the association feature vector to obtain a data traffic representation vector, determine a correlation between the data traffic representation vector and a hidden layer state based on a second self-attention mechanism, and process the data traffic representation vector based on the correlation to obtain a target data traffic vector; The label prediction module is configured to determine an output vector based on the target data traffic vector and the hidden layer state, and perform label prediction on the output vector to obtain a classification result of the data traffic to be classified including a plurality of predicted labels.

9. An electronic device, comprising: Comprise: The memory is configured to store a computer program; The processor is configured to execute the computer program to implement the steps of the data traffic classification method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the data traffic classification method according to any one of claims 1 to 7.

Images