Traffic classification method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a traffic classification method and device, computer equipment, a readable storage medium and a program product. The method comprises the following steps: extracting a first time sequence feature of a to-be-detected transport stream; searching a target area in a preset index layer according to a preset classification algorithm and the time sequence characteristics of the first to-be-detected transport stream; and determining the category of the to-be-detected transport stream based on the category of the sample transport stream in the target area. By adopting the method, the accuracy of traffic classification can be improved.

Description

Technical Field

[0001] The present application relates to the field of machine learning technology, and in particular to a traffic classification method, apparatus, computer equipment, readable storage medium, and program product. Background Art

[0002] The encrypted traffic classification system provides necessary security information for network management and service optimization. It can identify critical business applications (such as video conferencing, online office, etc.) and non-critical business applications (such as file downloads, social media, etc.), thereby providing priority network resource allocation and security for critical business applications.

[0003] In related technologies, traffic classification usually uses methods such as metadata, statistical features, Domain Name System (DNS) queries, Secure Sockets Layer / Transport Layer Security (SSL / TLS) fingerprints, and mainstream encrypted traffic classification methods. Moreover, most of these traffic classification methods use machine learning methods for identification and classification. However, traditional machine learning algorithms have complex feature engineering and limited model generalization capabilities, which are prone to overfitting training data. The uneven distribution of training samples will lead to reduced classification accuracy. Summary of the invention

[0004] Based on this, it is necessary to provide a traffic classification method, apparatus, computer equipment, readable storage medium and program product that can improve the accuracy of traffic classification in response to the above technical problems.

[0005] In a first aspect, the present application provides a traffic classification method, comprising:

[0006] Extracting the timing characteristics of the transmission stream to be detected;

[0007] According to a preset classification algorithm and the timing characteristics of the transport stream to be detected, a target area is searched in a preset index layer; based on the categories of the sample transport streams in the target area, the category of the transport stream to be detected is determined.

[0008] In one embodiment, the preset index layer includes n index layers, and the method further includes:

[0009] Classify the sample traffic data packets according to preset labels to obtain multiple sample transmission flows;

[0010] Extract the time series features of each sample data stream;

[0011] Based on a preset density clustering algorithm and the timing characteristics, clustering the multiple sample transmission streams to obtain at least one first region, and determining a first index layer based on the at least one first region;

[0012] For the i-th layer, based on the preset density clustering algorithm, cluster the sample transmission streams contained in each area in the i-1-th index layer respectively to obtain at least one sub-area corresponding to each area, and determine the i-th index layer based on the at least one sub-area, 1<i≤n, i is a positive integer;

[0013] The first index layer and multiple i-th index layers are determined as the preset index layers.

[0014] In one embodiment, each index layer includes at least one index key value, and each index key value is the center point of the region.

[0015] In one embodiment, the method further comprises:

[0016] When the number of the sample transmission streams in each sub-area is less than or equal to the number of index key values ​​of the index layer, the index layer is determined as the nth index layer.

[0017] In one of the embodiments, searching for a target area in a preset index layer according to a preset classification algorithm and the timing characteristics of the transport stream to be detected includes:

[0018] Performing nearest neighbor search processing based on the timing characteristics of the transmission stream to be detected and the index key values ​​contained in the first index layer to obtain multiple first index values; determining the area corresponding to the first index value that meets the preset index condition as the first area to be indexed;

[0019] Among the multiple sub-areas included in the first area to be indexed, for the i-th index layer, in the area to be indexed of the index layer of the i-1 layer, a nearest neighbor search process is performed in the sub-areas of the area to be indexed based on the timing characteristics of the transport stream to be detected, to obtain multiple index values, and the area corresponding to the index value that meets the preset index condition is determined as the second area to be indexed;

[0020] When i=n, ​​the second area to be indexed is determined as the target area.

[0021] In one of the embodiments, determining the category of the to-be-detected transport stream based on the category of the sample transport stream in the target area includes:

[0022] Determining the number of categories of sample transport flows in the target area;

[0023] The categories of the largest number of the sample transmission streams are selected, and the categories of the largest number of the sample transmission streams are determined as the categories of the transmission streams to be detected.

[0024] In one of the embodiments, the preset tag includes a quintuple, and the quintuple includes a source address, a source port, a destination address, a destination port, and a protocol type.

[0025] In a second aspect, the present application also provides a traffic classification device, including:

[0026] A feature extraction module, used to extract the timing features of the transmission stream to be detected;

[0027] The classification module is used to search for a target area in a preset index layer according to a preset classification algorithm and the timing characteristics of the transmission stream to be detected; and determine the category of the transmission stream to be detected based on the category of the sample transmission stream in the target area.

[0028] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0029] Extracting the timing characteristics of the transmission stream to be detected;

[0030] According to a preset classification algorithm and the timing characteristics of the transport stream to be detected, a target area is searched in a preset index layer; based on the categories of the sample transport streams in the target area, the category of the transport stream to be detected is determined.

[0031] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0032] Extracting the timing characteristics of the transmission stream to be detected;

[0033] According to a preset classification algorithm and the timing characteristics of the transport stream to be detected, a target area is searched in a preset index layer; based on the categories of the sample transport streams in the target area, the category of the transport stream to be detected is determined.

[0034] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0035] Extracting the timing characteristics of the transmission stream to be detected;

[0036] According to a preset classification algorithm and the timing characteristics of the transport stream to be detected, a target area is searched in a preset index layer; based on the categories of the sample transport streams in the target area, the category of the transport stream to be detected is determined.

[0037] The above-mentioned traffic classification method, device, computer equipment, readable storage medium and program product extract the time series characteristics of the transmission stream to be detected, and according to the preset classification algorithm, use the time series characteristics to search the target area in the preset index layer, and determine the category of the transmission stream to be detected according to the category of the sample transmission stream in the target area. Using the time series characteristics to search in the preset index layer can greatly reduce the number of data calculations and improve the accuracy and rate of detecting the category of the transmission stream to be detected. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0039] FIG1 is a flow chart of a flow classification method in one embodiment;

[0040] FIG2 is a flow chart of a flow classification method in one embodiment;

[0041] FIG3 is a flow chart of a traffic classification method in one embodiment;

[0042] FIG4 is a flow chart of a flow classification method in one embodiment;

[0043] FIG5 is a structural block diagram of a flow classification method and apparatus according to an embodiment;

[0044] FIG. 6 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0046] In an exemplary embodiment, as shown in FIG1 , a traffic classification method is provided. This embodiment uses the method applied to a terminal as an example for illustration. It is understandable that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0047] Step 101: extract the timing characteristics of the transmission stream to be detected.

[0048] The transmission stream to be detected may be a network flow of an unknown category. The timing characteristics may be timing and statistical characteristics that characterize the transmission stream, and the timing and statistical characteristics may include any one or more of the following multiple dimensional characteristics: bit rate or data rate, throughput, delay, packet loss rate, bandwidth, round trip time, congestion control, average packet length, maximum / minimum packet length, and fluctuation of data packet arrival time.

[0049] Specifically, the terminal can collect network traffic of the network port through a data collection tool. The terminal can preprocess the network traffic to obtain a transmission stream to be detected. The terminal can extract the timing characteristics of the transmission stream to be detected through a feature extraction strategy. Exemplarily, the feature extraction strategy can be a feature extraction tool or a feature extraction algorithm, etc., and the data collection tool can be Wireshark (a network protocol analysis tool). The feature extraction tool can also be Wireshark. The terminal can extract the timing characteristics of the transmission stream to be detected through Wireshark. It should be understood that this is only used for example, and the method of extracting timing characteristics cannot be specifically limited. The process of preprocessing network traffic may include one or more of packet filtering, header removal, packet padding, truncation, and data normalization, and may also include other processing methods, which will not be repeated here.

[0050] Step 102: Search for a target area in a preset index layer according to a preset classification algorithm and the timing characteristics of the transport stream to be detected; determine the category of the transport stream to be detected based on the category of the sample transport streams in the target area.

[0051] The preset classification algorithm may be a k-nearest neighbor (kNN). The preset index layer may be a multi-layer index layer, and the target area may be an area closest to the transmission flow to be detected. The categories of the transmission flow may include traffic type 1, traffic type 2, ..., traffic type m, for example, business-critical applications and non-business-critical applications, etc.

[0052] Specifically, the terminal can use the timing characteristics of the transmission stream to be detected to perform nearest neighbor search processing in multiple index layers through a preset classification algorithm. The area included in each layer of the preset index layer is a sub-area of ​​the previous index layer.

[0053] In each area included in the first index layer in the preset index layer, the terminal can search for the area closest to the timing characteristics of the transmission stream to be detected, and determine the sub-sub-area closest to the timing characteristics of the transmission stream to be detected in each sub-area included in the second index layer corresponding to the closest area, until the area closest to the transmission stream to be detected in the last index layer is finally found, and the area is determined as the target area. The terminal can obtain the category of the sample transmission stream in the target area, and determine the category of the transmission stream to be detected based on the category of the sample transmission stream.

[0054] The above-mentioned traffic classification method extracts the time series features of the transmission flow to be detected, searches the target area in the preset index layer using the time series features according to the preset classification algorithm, and determines the category of the transmission flow to be detected according to the category of the sample transmission flow in the target area. Using the time series features to search in the preset index layer can greatly reduce the number of data calculations and improve the accuracy and rate of detecting the category of the transmission flow to be detected.

[0055] In an exemplary embodiment, the traffic classification method further includes:

[0056] The sample traffic data packets are classified according to preset labels to obtain multiple sample transmission streams; the timing characteristics of each sample data stream are extracted; based on the preset density clustering algorithm and the timing characteristics, the multiple sample transmission streams are clustered to obtain at least one first area, and a first-level index layer is determined based on the at least one first area; for the i-th layer, based on the preset density clustering algorithm, the sample transmission streams contained in each area in the i-1-th index layer are clustered respectively to obtain at least one sub-area corresponding to each area, and the i-th index layer is determined based on the at least one sub-area; the first-level index layer and multiple i-th index layers are determined as preset index layers.

[0057] The preset index layer may include n index layers, 1<i≤n, i is a positive integer. The sample traffic data packet may include multiple transmission streams. The preset density clustering algorithm may be a density-based clustering method with noise (Density-Based Spatial Clustering of Applications with Noise, DBSCAN). The region may be a cluster cluster.

[0058] Specifically, the terminal can identify multiple transmission streams in the sample traffic data packet and the preset label of each transmission stream. The terminal can integrate the multiple transmission streams in the sample data packet by labeling based on the preset label to obtain a data set. The terminal can select some or all transmission streams in the data set and determine some or all transmission streams as sample transmission streams. The terminal can extract the timing characteristics of each sample transmission stream through a feature extraction strategy.

[0059] The sub-regions corresponding to the first-layer index layer in the preset index layer can be clustering of each sample transmission stream of the first-layer index layer to obtain multiple clustering results, each clustering result is a sub-region of the first-layer index layer, and the terminal can determine each sub-region of the first-layer index layer as the second index layer.

[0060] The specific indexing process may be: for the first layer, the terminal may use a preset density clustering algorithm to cluster the timing characteristics of multiple sample transmission streams to obtain at least one first region, then complete the first layer indexing, and determine at least one first region as the first layer index layer. Exemplarily, the specific clustering process may be to determine the number and shape of clusters according to the point density of multiple sample transmission streams to obtain multiple clusters (i.e., obtain multiple clustering results), and the terminal may determine each cluster as a first region to obtain multiple first regions.

[0061] For the second layer, the terminal can cluster the sample transmission streams contained in each first area in the first index layer based on a preset density clustering algorithm, obtain at least one second area corresponding to each first area, and determine the second index layer based on the at least one second area.

[0062] i≥3, for the i-th layer, based on the preset density clustering algorithm, cluster the sample transmission streams contained in each i-1th region in the i-1th index layer, obtain at least one sub-region corresponding to each i-1th region, determine the i-th index layer based on multiple sub-regions; and determine each sub-region as the i-th region of the i-th layer.

[0063] For the nth layer, based on the preset density clustering algorithm, the sample transmission streams contained in each n-1th region in the n-1th index layer are clustered respectively to obtain at least one sub-region corresponding to each nth region, and the i-th index layer is determined based on multiple sub-regions, and each sub-region is determined as the nth region of the nth layer.

[0064] The terminal uses the first index layer, the second index layer, ..., the nth index layer as preset index layers.

[0065] In this embodiment, by indexing layer by layer according to the time series characteristics of the sample transmission stream, a spatial index is established, which improves the classification efficiency of the machine learning algorithm, thereby achieving real-time and accuracy of classification.

[0066] In an exemplary embodiment, each index layer includes at least one index key value, and each index key value is the center point of the region.

[0067] Specifically, the terminal may identify the center point of each area included in each index layer by using a recognition algorithm or an image processing method. The recognition algorithm may be a geometric center algorithm or a minimum enclosing rectangle algorithm, etc., the image processing method may be target detection and key point positioning based on a deep learning model, etc., and the deep learning module may be CenterNet.

[0068] The terminal determines the timing characteristics of the sample transmission stream corresponding to the center point of each area as the index key value of this area.

[0069] In this embodiment, the center point is determined as the index key value, so as to establish a unified index for unknown network traffic, thereby improving the accuracy and efficiency of classification.

[0070] In an exemplary embodiment, the traffic classification method further includes:

[0071] When the number of sample transport streams in each sub-region is less than or equal to the number of index key values ​​of the index layer, the index layer is determined to be the nth index layer.

[0072] Specifically, the terminal can identify the number of sample transmission streams in each area in the index layer, and identify the number of index key values ​​in the index layer. The terminal can compare the number of sample transmission streams in each area with the number of index key values ​​in the layer. In each index layer, when the terminal identifies that the number of sample transmission streams in at least one area is greater than the number of index key values ​​in the current index layer, it is necessary to continue indexing, that is, for the next index layer of the current index layer, continue to execute the step of "for the i-th layer, based on the preset density clustering algorithm, cluster the sample transmission streams contained in each area in the i-1th index layer, obtain at least one sub-area corresponding to each area, and determine the i-th index layer based on at least one sub-area" described in the above embodiment. If in the current index layer, the terminal detects that the number of sample transmission streams in each area is less than or equal to the number of index key values ​​of the current index layer, then the current index layer is determined as the n-th index layer, and the multi-layer indexing is completed, that is, the spatial indexing of the entire data is completed.

[0073] In this embodiment, by determining the index layer in which the number of sample transmission streams in each sub-region is less than or equal to the number of index key values ​​of the index layer as the nth index layer, spatial indexing of the entire data is completed, thereby improving the accuracy of classification.

[0074] In an exemplary embodiment, searching for a target area in a preset index layer according to a preset classification algorithm and a timing feature of a transmission stream to be detected includes:

[0075] A nearest neighbor search is performed based on the timing characteristics of the transmission stream to be detected and the index key values ​​contained in the first index layer to obtain multiple first index values; an area corresponding to the first index value that meets the preset index condition is determined as the first area to be indexed; among the multiple sub-areas contained in the first area to be indexed, for the i-th index layer, in the area to be indexed of the index layer of the i-1th layer, a nearest neighbor search is performed in the sub-area in the area to be indexed based on the timing characteristics of the transmission stream to be detected to obtain multiple index values, and an area corresponding to the index value that meets the preset index condition is determined as the second area to be indexed; when i=n, ​​the second area to be indexed is determined as the target area.

[0076] The area to be indexed may be an area in the current index layer (i-th layer) that is closest to the transport stream to be detected. The area to be indexed may be an index area in the secondary index layer (i+1th layer).

[0077] Specifically, the terminal may index the transport streams to be detected in sequence at a preset index layer, find the closest area, and use the closest area as the target area.

[0078] The specific indexing methods include:

[0079] In the first index layer, the terminal can perform proximity calculations on the timing characteristics of the transmission stream to be detected and the index key values ​​in each first area to obtain multiple first index values. The terminal can select the maximum value from the multiple first index values ​​and determine the maximum value as the index value that meets the preset index condition. The terminal can identify the first area corresponding to the index value that meets the preset index condition and determine the first area as the first area to be indexed.

[0080] In the second index layer, the terminal can perform a nearest neighbor search process in the second area included in the first area to be indexed, calculate the timing characteristics of the transmission stream to be detected and perform proximity calculations with each second area included in the first area to be indexed, and obtain multiple second index values. The terminal can select the maximum value from the multiple second index values ​​and determine the maximum value as the index value that meets the preset index condition. The terminal can identify the second area corresponding to the index value that meets the preset index condition and determine the second area as the second area to be indexed.

[0081] In the i-th index layer (3≤i<n), the terminal can perform a nearest neighbor search process on the i-th region included in the i-1th to-be-indexed region, calculate the timing characteristics of the transmission stream to be detected and perform a nearest neighbor calculation on the i-th region included in the i-1th to-be-indexed region, and obtain multiple i-th index values. The terminal can select the maximum value from the multiple i-th index values ​​and use the maximum value as the index value that meets the preset index condition. The terminal can identify the i-th region corresponding to the index value that meets the preset index condition, and determine the i-th region as the i-th to-be-indexed region.

[0082] In the nth index layer, the terminal can perform a nearest neighbor search process on the nth region included in the n-1th to-be-indexed region, calculate the timing characteristics of the transmission stream to be detected and perform proximity calculations on each nth region included in the n-1th to-be-indexed region, and obtain multiple nth index values. The terminal can select the maximum value from the multiple nth index values ​​and determine the maximum value as the index value that meets the preset index condition. The terminal can identify the nth region corresponding to the index value that meets the preset index condition, determine the nth region as the nth to-be-indexed region, and determine the nth to-be-indexed region as the target region.

[0083] In this embodiment, by searching the timing characteristics of the transmission stream to be detected in the preset index layers in sequence until the target area is searched in the nth index layer, spatial indexing of the transmission stream to be detected is achieved, the target area is found, and the accuracy of indexing and classification is improved.

[0084] In an exemplary embodiment, determining the category of the transmission flow to be detected based on the category of the sample transmission flow in the target area includes:

[0085] Determine the number of categories of sample transmission streams in the target area; select the category of the largest number of sample transmission streams, and determine the category of the largest number of sample transmission streams as the category of the transmission stream to be detected.

[0086] Specifically, the terminal may store the corresponding relationship between the category of each sample transmission stream included in each area and each area in a preset database in advance. The terminal may identify the category of each sample transmission stream from the preset database. Alternatively, the terminal may identify the label of each sample transmission stream in the target area and determine the identifier of the label as the category of each sample transmission stream. The terminal may count the number of categories of each sample transmission stream in the target area. The terminal may select the maximum value of the number of categories of the sample transmission stream, and determine the category of the sample transmission stream with the maximum value as the category of the transmission stream to be detected. The specific method of selecting the category of the largest number of sample transmission streams is not specifically limited here, and may be through arrangement or other methods.

[0087] In this embodiment, the accuracy of traffic data classification is improved by determining the category of the largest number of sample transmission traffic in the target area as the category of the transmission flow to be detected.

[0088] In an exemplary embodiment, the preset tag includes a quintuple, and the quintuple includes a source address, a source port, a destination address, a destination port, and a protocol type.

[0089] Specifically, since the quintuple corresponding to each sample transmission stream is unique, the terminal can distinguish the sample transmission streams in the sample traffic data packet through the quintuple.

[0090] In addition, the preset tag may also carry the category of the sample transport stream. The terminal may determine the category of each sample transport stream by identifying the preset tag.

[0091] In an exemplary embodiment, the traffic classification method may include: a data set index establishment process. FIG2 is a flow chart of a traffic classification method provided by an embodiment, which specifically includes the following steps:

[0092] Step 201: The terminal integrates sample traffic data packets through preset tags to obtain an encrypted traffic classification data set, which includes multiple sample transmission streams, and the sample transmission streams are distinguished according to five-tuples.

[0093] Step 202: The terminal performs data preprocessing on each sample transmission stream and extracts the timing characteristics of the sample transmission stream.

[0094] Step 203: The terminal constructs an index based on the DBSCAN algorithm. Specifically, the terminal clusters the sample transmission streams to obtain multiple regions, uses the center points of the multiple regions as the index key values ​​of the regions, and clusters the sample transmission streams in each region based on the DBSCAN algorithm to obtain multiple sub-regions, until the number of samples in the region is less than or equal to the number of index key values ​​in each layer, and obtains a preset index layer. The data set after the spatial index is constructed is obtained.

[0095] In an exemplary embodiment, the traffic classification method may further include a real-time classification process. FIG3 is a flow chart of a traffic classification method provided by an embodiment, which specifically includes the following steps:

[0096] Step 301: The terminal obtains a transport stream to be detected.

[0097] Step 302: The terminal performs data preprocessing on the transmission stream to be detected, and extracts the timing characteristics of the transmission stream to be detected.

[0098] Step 303: Search in the index layer after the KNN algorithm and the constructed spatial index. When the nearest neighbor element to the transmission stream to be detected in the first index layer corresponds to the index key value of region A, the element is searched in the sub-layer index of region A. This process is iterated to the last layer of the index layer. After reaching the last layer of index, the index key value of the nearest neighbor is found to determine the sub-region (target region) to which the transmission stream to be detected belongs.

[0099] Step 304: The terminal may consider the category with the largest number of sample transmission flows in the target area as the category of the transmission flow to be detected.

[0100] In an exemplary embodiment, FIG. 4 is a flow chart of a traffic classification method provided by an embodiment. The traffic classification method may include: a data set index establishment process and a real-time classification process.

[0101] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0102] Based on the same inventive concept, the embodiment of the present application also provides a flow classification device for implementing the flow classification method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more flow classification device embodiments provided below can refer to the limitations on the flow classification method above, and will not be repeated here.

[0103] In an exemplary embodiment, as shown in FIG5 , a traffic classification device 50 is provided, comprising: a feature extraction module 51 and a classification module 52, wherein:

[0104] A feature extraction module 51 is used to extract the timing features of the transmission stream to be detected;

[0105] The classification module 52 is used to search for a target area in a preset index layer according to a preset classification algorithm and the timing characteristics of the transmission stream to be detected; and determine the category of the transmission stream to be detected based on the category of the sample transmission stream in the target area.

[0106] In one of the embodiments, the preset index layer includes n index layers, and the feature extraction module 51 is further used to classify the sample traffic data packets according to the preset labels to obtain multiple sample transmission flows;

[0107] Extract the time series features of each sample data stream;

[0108] Based on a preset density clustering algorithm and time series characteristics, multiple sample transmission streams are clustered to obtain at least one first region, and a first index layer is determined based on the at least one first region;

[0109] For the i-th layer, based on the preset density clustering algorithm, the sample transmission streams contained in each area in the i-1-th index layer are clustered respectively to obtain at least one sub-area corresponding to each area, and the i-th index layer is determined based on the at least one sub-area, 1<i≤n, i is a positive integer;

[0110] A first index layer and a plurality of i-th index layers are determined as preset index layers.

[0111] In one embodiment, each index layer includes at least one index key value, and each index key value is the center point of the region.

[0112] In one of the embodiments, the classification module 52 is further configured to determine the index layer as the nth index layer when the number of sample transmission streams in each sub-region is less than or equal to the number of index key values ​​of the index layer.

[0113] In one embodiment, the classification module 52 is specifically used to perform nearest neighbor search processing based on the timing characteristics of the transmission stream to be detected and the index key values ​​contained in the first index layer to obtain multiple first index values; determine the area corresponding to the first index value that meets the preset index condition as the first area to be indexed;

[0114] Among the multiple sub-areas included in the first area to be indexed, for the i-th index layer, in the area to be indexed of the index layer of the i-1th layer, a nearest neighbor search process is performed in the sub-areas in the area to be indexed based on the timing characteristics of the transmission stream to be detected, to obtain multiple index values, and the area corresponding to the index value that meets the preset index condition is determined as the second area to be indexed;

[0115] When i=n, ​​the second area to be indexed is determined as the target area.

[0116] In one embodiment, the classification module 52 is specifically configured to determine the number of categories of sample transmission flows in the target area;

[0117] The category of the largest number of sample transmission streams is selected, and the category of the largest number of sample transmission streams is determined as the category of the transmission stream to be detected.

[0118] In one of the embodiments, the preset tag includes a quintuple, and the quintuple includes a source address, a source port, a destination address, a destination port, and a protocol type.

[0119] Each module in the above-mentioned traffic classification device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0120] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG6. The computer device includes a processor, a memory, an input / output interface, a communication interface, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, a near field communication (NFC) or other technologies. When the computer program is executed by the processor, a traffic classification method is implemented.

[0121] Those skilled in the art will understand that the structure shown in FIG. 6 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0122] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0123] Extracting the timing characteristics of the transmission stream to be detected;

[0124] According to a preset classification algorithm and the timing characteristics of the transmission stream to be detected, a target area is searched in a preset index layer; based on the category of the sample transmission stream in the target area, the category of the transmission stream to be detected is determined.

[0125] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0126] Classify the sample traffic data packets according to preset labels to obtain multiple sample transmission flows;

[0127] Extract the time series features of each sample data stream;

[0128] Based on a preset density clustering algorithm and the timing characteristics, clustering the multiple sample transmission streams to obtain at least one first region, and determining a first index layer based on the at least one first region;

[0129] For the i-th layer, based on the preset density clustering algorithm, cluster the sample transmission streams contained in each area in the i-1-th index layer respectively to obtain at least one sub-area corresponding to each area, and determine the i-th index layer based on the at least one sub-area, 1<i≤n, i is a positive integer;

[0130] The first index layer and multiple i-th index layers are determined as the preset index layers.

[0131] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0132] Each index layer includes at least one index key value, and each index key value is the center point of the region.

[0133] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0134] When the number of the sample transmission streams in each sub-area is less than or equal to the number of index key values ​​of the index layer, the index layer is determined as the nth index layer.

[0135] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0136] Performing nearest neighbor search processing based on the timing characteristics of the transmission stream to be detected and the index key values ​​contained in the first index layer to obtain multiple first index values; determining the area corresponding to the first index value that meets the preset index condition as the first area to be indexed;

[0137] Among the multiple sub-areas included in the first area to be indexed, for the i-th index layer, in the area to be indexed of the index layer of the i-1 layer, a nearest neighbor search process is performed in the sub-areas of the area to be indexed based on the timing characteristics of the transport stream to be detected, to obtain multiple index values, and the area corresponding to the index value that meets the preset index condition is determined as the second area to be indexed;

[0138] When i=n, ​​the second area to be indexed is determined as the target area.

[0139] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0140] Determining the number of categories of sample transport flows in the target area;

[0141] The categories of the largest number of the sample transmission streams are selected, and the categories of the largest number of the sample transmission streams are determined as the categories of the transmission streams to be detected.

[0142] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0143] The preset label includes a quintuple, and the quintuple includes a source address, a source port, a destination address, a destination port, and a protocol type.

[0144] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0145] Extracting the timing characteristics of the transmission stream to be detected;

[0146] According to a preset classification algorithm and the timing characteristics of the transmission stream to be detected, a target area is searched in a preset index layer; based on the category of the sample transmission stream in the target area, the category of the transmission stream to be detected is determined.

[0147] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0148] Classify the sample traffic data packets according to preset labels to obtain multiple sample transmission flows;

[0149] Extract the time series features of each sample data stream;

[0150] Based on a preset density clustering algorithm and the timing characteristics, clustering the multiple sample transmission streams to obtain at least one first region, and determining a first index layer based on the at least one first region;

[0151] For the i-th layer, based on the preset density clustering algorithm, cluster the sample transmission streams contained in each area in the i-1-th index layer respectively to obtain at least one sub-area corresponding to each area, and determine the i-th index layer based on the at least one sub-area, 1<i≤n, i is a positive integer;

[0152] The first index layer and multiple i-th index layers are determined as the preset index layers.

[0153] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0154] Each index layer includes at least one index key value, and each index key value is the center point of the region.

[0155] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0156] When the number of the sample transmission streams in each sub-area is less than or equal to the number of index key values ​​of the index layer, the index layer is determined as the nth index layer.

[0157] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0158] Performing nearest neighbor search processing based on the timing characteristics of the transmission stream to be detected and the index key values ​​contained in the first index layer to obtain multiple first index values; determining the area corresponding to the first index value that meets the preset index condition as the first area to be indexed;

[0159] Among the multiple sub-areas included in the first area to be indexed, for the i-th index layer, in the area to be indexed of the index layer of the i-1 layer, a nearest neighbor search process is performed in the sub-areas of the area to be indexed based on the timing characteristics of the transport stream to be detected, to obtain multiple index values, and the area corresponding to the index value that meets the preset index condition is determined as the second area to be indexed;

[0160] When i=n, ​​the second area to be indexed is determined as the target area.

[0161] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0162] Determining the number of categories of sample transport flows in the target area;

[0163] The categories of the largest number of the sample transmission streams are selected, and the categories of the largest number of the sample transmission streams are determined as the categories of the transmission streams to be detected.

[0164] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0165] The preset label includes a quintuple, and the quintuple includes a source address, a source port, a destination address, a destination port, and a protocol type.

[0166] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0167] Extracting the timing characteristics of the transmission stream to be detected;

[0168] According to a preset classification algorithm and the timing characteristics of the transmission stream to be detected, a target area is searched in a preset index layer; based on the category of the sample transmission stream in the target area, the category of the transmission stream to be detected is determined.

[0169] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0170] Classify the sample traffic data packets according to preset labels to obtain multiple sample transmission flows;

[0171] Extract the time series features of each sample data stream;

[0172] Based on a preset density clustering algorithm and the timing characteristics, clustering the multiple sample transmission streams to obtain at least one first region, and determining a first index layer based on the at least one first region;

[0173] For the i-th layer, based on the preset density clustering algorithm, cluster the sample transmission streams contained in each area in the i-1-th index layer respectively to obtain at least one sub-area corresponding to each area, and determine the i-th index layer based on the at least one sub-area, 1<i≤n, i is a positive integer;

[0174] The first index layer and multiple i-th index layers are determined as the preset index layers.

[0175] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0176] Each index layer includes at least one index key value, and each index key value is the center point of the region.

[0177] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0178] When the number of the sample transmission streams in each sub-area is less than or equal to the number of index key values ​​of the index layer, the index layer is determined as the nth index layer.

[0179] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0180] Performing nearest neighbor search processing based on the timing characteristics of the transmission stream to be detected and the index key values ​​contained in the first index layer to obtain multiple first index values; determining the area corresponding to the first index value that meets the preset index condition as the first area to be indexed;

[0181] Among the multiple sub-areas included in the first area to be indexed, for the i-th index layer, in the area to be indexed of the index layer of the i-1 layer, a nearest neighbor search process is performed in the sub-areas of the area to be indexed based on the timing characteristics of the transport stream to be detected, to obtain multiple index values, and the area corresponding to the index value that meets the preset index condition is determined as the second area to be indexed;

[0182] When i=n, ​​the second area to be indexed is determined as the target area.

[0183] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0184] Determining the number of categories of sample transport flows in the target area;

[0185] The categories of the largest number of the sample transmission streams are selected, and the categories of the largest number of the sample transmission streams are determined as the categories of the transmission streams to be detected.

[0186] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0187] The preset label includes a quintuple, and the quintuple includes a source address, a source port, a destination address, a destination port, and a protocol type.

[0188] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0189] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0190] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A traffic classification method, characterized in that: The method comprises: Extracting the timing characteristics of the transmission stream to be detected; According to a preset classification algorithm and the timing characteristics of the transport stream to be detected, a target area is searched in a preset index layer; based on the categories of the sample transport streams in the target area, the category of the transport stream to be detected is determined.

2. The method according to claim 1, characterized in that The preset index layer includes n index layers, and the method further includes: Classify the sample traffic data packets according to preset labels to obtain multiple sample transmission flows; Extract the time series features of each sample data stream; Based on a preset density clustering algorithm and the timing characteristics, clustering the multiple sample transmission streams to obtain at least one first region, and determining a first index layer based on the at least one first region; For the i-th layer, based on the preset density clustering algorithm, cluster the sample transmission streams contained in each area in the i-1-th index layer respectively to obtain at least one sub-area corresponding to each area, and determine the i-th index layer based on the at least one sub-area, 1<i≤n, i is a positive integer; The first index layer and multiple i-th index layers are determined as the preset index layers.

3. The method according to claim 2, characterized in that Each index layer includes at least one index key value, and each index key value is the center point of the region.

4. The method according to claim 3, characterized in that The method further comprises: When the number of the sample transmission streams in each sub-area is less than or equal to the number of index key values ​​of the index layer, the index layer is determined as the nth index layer.

5. The method according to claim 3, characterized in that: The step of searching for a target area in a preset index layer according to a preset classification algorithm and the timing characteristics of the transport stream to be detected includes: Performing nearest neighbor search processing based on the timing characteristics of the transmission stream to be detected and the index key values ​​contained in the first index layer to obtain multiple first index values; determining the area corresponding to the first index value that meets the preset index condition as the first area to be indexed; Among the multiple sub-areas included in the first area to be indexed, for the i-th index layer, in the area to be indexed of the index layer of the i-1 layer, a nearest neighbor search process is performed in the sub-areas of the area to be indexed based on the timing characteristics of the transport stream to be detected, to obtain multiple index values, and the area corresponding to the index value that meets the preset index condition is determined as the second area to be indexed; When i=n, ​​the second area to be indexed is determined as the target area.

6. The method according to claim 1, characterized in that The determining the category of the transport stream to be detected based on the category of the sample transport stream in the target area includes: Determining the number of categories of sample transport flows in the target area; The categories of the largest number of the sample transmission streams are selected, and the categories of the largest number of the sample transmission streams are determined as the categories of the transmission streams to be detected.

7. The method according to claim 2, characterized in that: The preset label includes a quintuple, and the quintuple includes a source address, a source port, a destination address, a destination port, and a protocol type.

8. A flow classification device, characterized in that: The device comprises: A feature extraction module, used to extract the timing features of the transmission stream to be detected; The classification module is used to search for a target area in a preset index layer according to a preset classification algorithm and the timing characteristics of the transmission stream to be detected; and determine the category of the transmission stream to be detected based on the category of the sample transmission stream in the target area.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images