Data processing method and device, nonvolatile storage medium and electronic equipment

Abstract

The invention discloses a data processing method and device, a nonvolatile storage medium and electronic equipment. The method comprises the following steps: acquiring flow data of a broadband account within a historical preset time period; determining a first type of broadband accounts in the plurality of broadband accounts; determining external capability indexes of the first type of broadband accounts; according to whether a domain name corresponding to the IP address can be analyzed through the IP address of the first type of broadband account number, determining a domain name capability index of the first type of broadband account number; determining a distribution capability index of the first type of broadband accounts according to the external capability index and the domain name capability index; and determining the first type of broadband accounts of which the values of the distribution capability indexes are greater than a preset value as second type of broadband accounts, and reducing the values of the distribution capability indexes of the second type of broadband accounts. According to the invention, the technical problem of high bandwidth operation cost of an operator network caused by a large amount of flow data passing through a point-to-point content distribution network in the operator network is solved.

Description

Technical Field

[0001] The present application relates to the field of communication network data processing, and specifically, to a data processing method and device, a non-volatile storage medium, and an electronic device. Background Art

[0002] The growth trend of user Internet traffic has brought traffic dividends to Internet service providers, but it has also increased their reliance on and costs for the bandwidth of the operator's Content Delivery Network (CDN). In order to reduce CDN bandwidth costs, Internet service providers have begun to widely use Peer-to-Peer Content Delivery Network (PCDN) technology to transfer part of the traffic to the user side to reduce the bandwidth costs paid to the operator's CDN.

[0003] PCDN is a decentralized content distribution network based on point-to-point technology, which realizes decentralized content distribution by mining and utilizing the massive idle user resources in the edge network, such as user bandwidth and user storage. The relevant PCDN product is to deploy a special "box" under the broadband of a large number of users. The working stage of the box is divided into two stages: pre-caching and content distribution. In the pre-caching stage, the "box" will synchronize data with the CDN server of the Internet provider during the idle time of the business, such as 0:00 to 5:00 in the morning, and download a large amount of popular content data to cache locally. In the content delivery stage, when users around the "box" initiate content data requests to the CDN server, the scheduling request will be directed to the "box", which will provide users with partial content data delivery services, and the CDN server of the Internet provider will provide content data that is not available on the "box".

[0004] Due to the large number of distributed PCDN nodes, operators will face additional upstream traffic pressure. To ensure network quality, operators often need to increase costs to expand capacity. This decentralized transfer of traffic originally provided by Internet service providers' CDN servers to the user side greatly reduces the cost of CDN bandwidth paid by Internet service providers to operators, but it shifts the cost that should have been borne by Internet service providers to operators, making the bandwidth operation cost of operator networks higher.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The embodiments of the present application provide a data processing method and device, a non-volatile storage medium, and an electronic device to at least solve the technical problem of high bandwidth operating costs of the operator network due to a large amount of traffic data passing through a point-to-point content distribution network in the operator network.

[0007] According to one aspect of an embodiment of the present application, a data processing method is provided, comprising: obtaining flow data of each broadband account in a historical preset period of time among a plurality of broadband accounts; determining a first-class broadband account that meets a first preset condition among the plurality of broadband accounts, wherein the first preset condition comprises: a downlink transmission rate of the flow data in the first preset period of time is greater than an average downlink transmission rate in the historical preset period of time and / or an uplink transmission rate of the flow data in the second preset period of time is greater than an average uplink transmission rate in the historical preset period of time, wherein the transmission rate of the flow data in the first preset period of time is less than the transmission rate in the second preset period of time; determining an external capability index of the first-class broadband account, wherein the external capability index is used to characterize the number of service connections established by a port corresponding to an Internet Protocol IP address of the first-class broadband account; determining a domain name capability index of the first-class broadband account according to whether a domain name corresponding to the IP address can be resolved through the IP address of the first-class broadband account; determining a distribution capability index of the first-class broadband account according to the external capability index and the domain name capability index; determining a first-class broadband account whose distribution capability index has a value greater than a preset value as a second-class broadband account, and reducing the value of the distribution capability index of the second-class broadband account.

[0008] Optionally, the domain name capability index of the first type of broadband account is determined based on whether the domain name corresponding to the IP address can be resolved through the IP address of the first type of broadband account, including: if the domain name corresponding to the IP address can be determined through the IP address of the first type of broadband account, and the Internet service provider to which the domain name belongs can be determined, the distribution capability index of the first type of broadband account is determined as a first value; if the domain name corresponding to the IP address can be determined through the IP address of the first type of broadband account, and the Internet service provider to which the domain name belongs cannot be determined, the distribution capability index of the first type of broadband account is determined as a second value, wherein the second value is smaller than the first value; if the domain name corresponding to the IP address cannot be determined through the IP address of the first type of broadband account, the distribution capability index of the first type of broadband account is determined as a third value, wherein the third value is smaller than the second value.

[0009] Optionally, reducing the value of the distribution capability indicator of the second type of broadband account includes: obtaining a target IP message received by a network server accessed by the second type of broadband account, wherein the target IP message includes at least: five-tuple information, and the five-tuple information includes: source IP address information, source port information, destination IP address information, destination port information, and protocol information; if the source IP address information or the destination IP address information is preset address information, combining the five-tuple information into a target field in a preset order; performing a hash calculation on the target field to obtain a first hash value; obtaining a data list corresponding to the second type of broadband account stored in the network server, the data list including: target IP address information of the second type of broadband account, port information of the target port corresponding to the target IP address information, the number of service connections established by the target port, a second hash value corresponding to the five-tuple information of the second type of broadband account, and an aging time corresponding to the second hash value; matching the first hash value with the second hash value, and if the first hash value matches the second hash value successfully, forwarding the target IP message, and refreshing the aging time of the second hash value that matches successfully in the data list.

[0010] Optionally, the method also includes: if the first hash value fails to match the second hash value, detecting whether there are any remaining positions in the column where the second hash value is located in the data list; if there are any remaining positions in the column where the second hash value is located in the data list, adding the first hash value to the column where the second hash value is located in the data list, setting the aging time corresponding to the first hash value, and forwarding the target IP message; if there are no remaining positions in the column where the second hash value is located in the data list, not forwarding the target IP message.

[0011] Optionally, reducing the value of the distribution capability index of the second type of broadband account includes: detecting the number of resolutions of the domain name corresponding to the IP address of the second type of broadband account within a preset time period; if the number of resolutions is greater than a preset threshold, reducing the number of resolutions until the number of resolutions is less than the preset threshold.

[0012] Optionally, after determining a first-class broadband account whose distribution capability index value is greater than a preset value as a second-class broadband account, the method further includes: using a remote authentication dial-up user service to send tunnel information based on the Layer 2 tunnel protocol to a target broadband access server to which the second-class broadband account is connected, wherein the tunnel information is used to indicate that the second-class broadband account is connected to multiple Layer 2 tunnel protocol network servers.

[0013] Optionally, before determining a first type of broadband account that meets a first preset condition among multiple broadband accounts, the method further includes: obtaining uplink traffic data in a target broadband access server to which the multiple broadband accounts are connected; determining, in the uplink traffic data in the target broadband access server, an average value and a standard deviation of the uplink traffic data transmission volume of each broadband account within a historical preset time period; and retaining, among the multiple broadband accounts, broadband accounts whose uplink traffic data transmission volume within a current preset time period is greater than a target value, wherein the target value is the sum of the average value and the standard deviation.

[0014] Optionally, traffic data of each broadband account in a historical preset time period is obtained, including: using a remote authentication dial-up user service to obtain traffic list data of the broadband account in the historical preset time period; using a billing intermediate package in the remote authentication dial-up user service to obtain segmented traffic data of the broadband account, wherein the segmented traffic data is the difference between the traffic data in the billing intermediate package corresponding to the i+1th moment and the traffic data in the billing intermediate package corresponding to the i-th moment, and i is a positive integer; obtaining quintuple information of the first target broadband account, wherein the first target broadband account is a broadband account whose traffic list data and segmented traffic data both meet preset conditions, and the quintuple information includes: address information and port information corresponding to the target broadband account, address information and port information corresponding to the second target broadband account that transmits data with the first target broadband account, and a transmission protocol.

[0015] According to another aspect of the embodiment of the present application, a data processing device is further provided, including: an acquisition module, used to acquire flow data of each broadband account in a historical preset time period among a plurality of broadband accounts; a first determination module, used to determine a first type of broadband account that meets a first preset condition among the plurality of broadband accounts, wherein the first preset condition includes: a downlink transmission rate of flow data in the first preset time period is greater than an average downlink transmission rate in the historical preset time period and / or an uplink transmission rate of flow data in the second preset time period is greater than an average uplink transmission rate in the historical preset time period, wherein the transmission rate of flow data in the first preset time period is less than the transmission rate in the second preset time period; and a second determination module A block is used to determine the external capability index of the first type of broadband account, wherein the external capability index is used to characterize the number of service connections established by the port corresponding to the Internet Protocol IP address of the first type of broadband account; a third determination module is used to determine the domain name capability index of the first type of broadband account according to whether the domain name corresponding to the IP address can be resolved through the IP address of the first type of broadband account; a fourth determination module is used to determine the distribution capability index of the first type of broadband account according to the external capability index and the domain name capability index; a processing module is used to determine the first type of broadband account whose distribution capability index value is greater than a preset value as a second type of broadband account, and reduce the distribution capability index value of the second type of broadband account.

[0016] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, the storage medium includes a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute the above data processing method.

[0017] According to another aspect of the embodiments of the present application, there is further provided an electronic device, including: a memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the above data processing method is executed when the program is run.

[0018] According to yet another aspect of the embodiments of the present application, a computer program is further provided, wherein the above data processing method is implemented when the computer program is executed by a processor.

[0019] According to another aspect of the embodiments of the present application, a computer program product is provided, which includes a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above data processing method is implemented.

[0020] In an embodiment of the present application, traffic data of each broadband account in a historical preset time period is obtained from a plurality of broadband accounts; a first type of broadband account that meets a first preset condition is determined from the plurality of broadband accounts, wherein the first preset condition includes: a downlink transmission rate of traffic data in the first preset time period is greater than an average downlink transmission rate in the historical preset time period and / or an uplink transmission rate of traffic data in the second preset time period is greater than an average uplink transmission rate in the historical preset time period, wherein the transmission rate of traffic data in the first preset time period is less than the transmission rate in the second preset time period; an external capability index of the first type of broadband account is determined, wherein the external capability index is used to characterize the number of service connections established by the port corresponding to the Internet Protocol IP address of the first type of broadband account; and based on whether the first type of broadband account can be used, a service connection can be established by connecting to the first type of broadband account. The IP address is resolved to obtain the domain name corresponding to the IP address, and the domain name capability index of the first type of broadband account is determined; the distribution capability index of the first type of broadband account is determined according to the external capability index and the domain name capability index; the first type of broadband account whose distribution capability index value is greater than the preset value is determined as the second type of broadband account, and the distribution capability index value of the second type of broadband account is reduced, so as to improve the accuracy of identifying the traffic data of the point-to-point content distribution network in the operator network and limit the traffic data of the point-to-point content distribution network in the operator network, thereby achieving the technical effect of reducing the bandwidth operation cost of the operator network, and further solving the technical problem of high bandwidth operation cost of the operator network caused by more traffic data passing through the point-to-point content distribution network in the operator network. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0022] Figure 1 is a flow chart of a data processing method according to an embodiment of the present application;

[0023] Figure 2 is a flow chart of another data processing method according to an embodiment of the present application;

[0024] Figure 3 is a flow chart of a method for identifying PCDN traffic according to an embodiment of the present application;

[0025] Figure 4 is a flow chart of a method for handling PCDN traffic according to an embodiment of the present application;

[0026] Figure 5 is a structural diagram of a data processing device according to an embodiment of the present application;

[0027] Figure 6 It is a hardware structure block diagram of a computer terminal according to a data processing method of an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] According to an embodiment of the present application, a method embodiment of a data processing method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] Figure 1 is a flow chart of a data processing method according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0032] Step S101, obtaining traffic data of each broadband account in a historical preset time period among a plurality of broadband accounts.

[0033] Among them, broadband accounts include but are not limited to: broadband accounts of home broadband users.

[0034] In some optional embodiments of the present application, obtaining the flow data of each broadband account in a historical preset time period among multiple broadband accounts can be achieved by the following method: using a remote authentication dial-up user service to obtain the flow list data of the broadband account in the historical preset time period; using the billing intermediate package in the remote authentication dial-up user service to obtain the segmented flow data of the broadband account, wherein the segmented flow data is the difference between the flow data in the billing intermediate package corresponding to the i+1th moment and the flow data in the billing intermediate package corresponding to the i-th moment, and i is a positive integer; obtaining quintuple information of the first target broadband account, wherein the first target broadband account is a broadband account whose flow list data and segmented flow data both meet preset conditions, and the quintuple information includes: address information and port information corresponding to the target broadband account, address information and port information corresponding to the second target broadband account that transmits data with the first target broadband account, and transmission protocol.

[0035] Assume that you need to obtain the traffic list data for October 2023. The monthly traffic list of all broadband users under the specified Broadband Access Server (BAS) is obtained through the Remote Authentication Dial In User Service (Radius). The list records the total upstream and downstream traffic of each broadband account in that month. For example, for broadband account A12345, its upstream traffic in October is 30GB and its downstream traffic is 150GB. Set the time interval for sending the billing intermediate package to 15 minutes, that is, T = 15 minutes. At 00:00 and 00:15 on October 1, BAS sent two billing intermediate packages to Radius, recording the traffic data of broadband account A12345. Assume that the traffic data at 00:00 is 5GB of upstream traffic and 75GB of downstream traffic; the traffic data at 00:15 is 6GB of upstream traffic and 80GB of downstream traffic. The first split traffic data is 1GB (=6GB-5GB) for upstream traffic and 5GB (=80GB-75GB) for downstream traffic.

[0036] Through the above steps, possible Peer-to-Peer Content Delivery Network (PCDN) users are screened out, that is, the first target broadband account that meets the specific conditions of the traffic list data and the segmented traffic data, for example, broadband account A12345. For A12345, its five-tuple information during the busy hours (for example, 20:00-23:00) is further obtained. This includes the local address of A12345 during the busy hours (such as 192.168.1.100), the local port (such as 8080), the peer address (such as 203.0.113.50), the peer port (such as 12345), and the transmission protocol (such as TCP). These five-tuple information can be extracted from the session records sent by BAS to Radius, or captured in real time by network monitoring equipment.

[0037] Step S102, determining a first type of broadband account that meets a first preset condition among multiple broadband accounts, wherein the first preset condition includes: a downlink transmission rate of traffic data in a first preset time period is greater than an average downlink transmission rate in a historical preset time period and / or an uplink transmission rate of traffic data in a second preset time period is greater than an average uplink transmission rate in a historical preset time period, wherein the transmission rate of traffic data in the first preset time period is less than the transmission rate in the second preset time period.

[0038] In this embodiment, a set of specific data and steps will be used to demonstrate how to determine the first type of broadband account that meets the first preset condition among multiple broadband accounts. Taking the broadband user data of a provincial intelligent cloud network dispatching and operation center as an example, it is assumed that there are 500 broadband accounts, each of which has its detailed traffic records, as well as its upload and download rate data in different time periods. 1. Obtain the traffic list data of all broadband users last month in the Radius system, and obtain the segmented traffic data of these users through the billing intermediate package. In order to simplify the description, it is assumed that the traffic data of these users has been segmented by hour, and the traffic data of each hour is stored independently for subsequent analysis. At the same time, obtain the five-tuple information of these users during business busy hours (20:00-24:00) and business idle hours (00:00-05:00). 2. Set the first preset time period to business idle hours (00:00-05:00), and the second preset time period to business busy hours (20:00-24:00). The historical preset time periods are business idle hours and business busy hours last month. 3. Calculate the average downlink and uplink transmission rates during off-peak and busy hours last month. Assume that the average downlink transmission rate during off-peak hours is 1Mbps, and the average uplink transmission rate during busy hours is 0.5Mbps. 4. Filter out users whose downlink transmission rate is greater than 1Mbps during off-peak hours, and users whose uplink transmission rate is greater than 0.5Mbps during busy hours. Assume that among 500 users, 50 users have an average downlink transmission rate of 1.5Mbps during off-peak hours, and 30 users have an average uplink transmission rate of 0.75Mbps during busy hours. 5. 80 users were identified as the first type of broadband accounts, which exhibit high downlink rate characteristics during off-peak hours and high uplink rate characteristics during busy hours.

[0039] As some optional embodiments of the present application, before determining a first type of broadband account that meets the first preset condition among multiple broadband accounts, the following steps may also be performed: obtaining uplink traffic data in a target broadband access server to which the multiple broadband accounts are connected; determining, in the uplink traffic data in the target broadband access server, an average value and a standard deviation of the uplink traffic data transmission volume of each broadband account within a historical preset time period; retaining, among the multiple broadband accounts, broadband accounts whose uplink traffic data transmission volume within the current preset time period is greater than a target value, wherein the target value is the sum of the average value and the standard deviation.

[0040] Specifically, the monthly traffic list data of all broadband users in the previous natural month is obtained through the Radius system, especially the upstream traffic data. At the same time, through the billing intermediate package system, a time interval (for example, every 5 minutes) is set to regularly obtain the real-time traffic data of all broadband accounts on the target broadband access server (BAS), and on this basis, the segmented upstream traffic data in each time interval is calculated. For each broadband account, the average value (denoted as μ) of its upstream traffic data transmission volume in the historical preset period (the month before the current month) is calculated. The variance (denoted as σ2) of the upstream traffic data transmission volume of each broadband account in the historical preset period is calculated. The standard deviation (denoted as σ) is obtained by taking the arithmetic square root of the variance. After obtaining the above data, a threshold is set, that is, the target value, which is equal to the sum of the average value μ and the standard deviation σ (μ+σ). Then, the upstream traffic data transmission volume of each broadband account in the current preset period (for example, the early morning period) is compared, and those broadband accounts whose upstream traffic data transmission volume is greater than the target value μ+σ are retained. Assume that a BAS has 1,000 broadband accounts in the previous month, and the average value μ of the upstream traffic data in the month before the current month is 1GB, and the standard deviation σ is 0.5GB. Then, the target value μ+σ is 1.5GB. In the early morning of a certain day in the current month, check all 1,000 broadband accounts and keep all accounts with upstream traffic data transmission volume greater than 1.5GB. These accounts may be running PCDN nodes because of abnormal transmission volume and will be analyzed in subsequent steps.

[0041] Step S103, determining the external capability index of the first type of broadband account, wherein the external capability index is used to characterize the number of service connections established by the port corresponding to the Internet Protocol IP address of the first type of broadband account.

[0042] By analyzing the five-tuple information of the first-class broadband account on the BAS, the number of service connections N established by the port corresponding to the Internet Protocol IP address of the first-class broadband account i Perform statistics and calculate the external capacity value S of the home broadband address port i Among them, the external capability value S i The following conditions should be met: As the number of connections N provided by the broadband address port i increases, S i It should show an exponential increase, which can be determined according to the formula:

[0043]

[0044] Wherein, i is a positive integer less than n, n is the number of ports, and e is a natural exponent.

[0045] Finally, calculate the external capability value S of all ports under the home broadband address of the first type of broadband account = ∏i S i .

[0046] Step S104, determining the domain name capability index of the first type of broadband account according to whether the domain name corresponding to the IP address can be resolved through the IP address of the first type of broadband account.

[0047] According to some optional embodiments of the present application, step S104 can be implemented by the following method: if the domain name corresponding to the IP address can be determined through the IP address of the first-class broadband account, and the Internet service provider to which the domain name belongs can be determined, the distribution capability index of the first-class broadband account is determined as a first value; if the domain name corresponding to the IP address can be determined through the IP address of the first-class broadband account, and the Internet service provider to which the domain name belongs cannot be determined, the distribution capability index of the first-class broadband account is determined as a second value, wherein the second value is less than the first value; if the domain name corresponding to the IP address cannot be determined through the IP address of the first-class broadband account, the distribution capability index of the first-class broadband account is determined as a third value, wherein the third value is less than the second value.

[0048] Specifically, the domain name capability value V is calculated by performing a reverse resolution of the domain name system (Domain Name System, DNS) on the user's home broadband address. If the domain name corresponding to the user's home broadband address can be obtained after the reverse resolution of the DNS domain name, and the second-level domain name and the first-level domain name to which the domain name belongs are queried and found to belong to the Internet service provider, then V=3; if the domain name can be obtained after the reverse resolution of the DNS domain name but does not belong to the Internet service provider, then V=2; if the domain name cannot be obtained after the reverse resolution of the DNS domain name, then V=1.

[0049] Step S105, determining the distribution capability index of the first type of broadband account according to the external capability index and the domain name capability index.

[0050] Specifically, by combining the external capability value S and domain name capability value V of the user's home broadband address, its PCDN capability value P can be calculated using the following formula:

[0051]

[0052] If the PCDN capability value P of a user is greater than the preset P0, the user is considered to be a PCDN user.

[0053] Step S106: determine the first type broadband account whose distribution capability index value is greater than the preset value as the second type broadband account, and reduce the distribution capability index value of the second type broadband account.

[0054] In some optional embodiments of the present application, after determining a first-class broadband account whose distribution capability index has a value greater than a preset value as a second-class broadband account, the following steps may also be performed: utilizing a remote authentication dial-up user service to send tunnel information based on a layer 2 tunnel protocol to a target broadband access server to which the second-class broadband account is connected, wherein the tunnel information is used to indicate that the second-class broadband account is connected to multiple layer 2 tunnel protocol network servers.

[0055] Specifically, first, according to the preset strategy, tunnel information is generated to instruct the second-class broadband account to access multiple Layer Two Tunneling Protocol (L2TP) network servers (L2TP Network Server, LNS). The tunnel information contains at least the following key parameters: the IP address or domain name of the target LNS, which is used to guide the BAS to establish an L2TP connection with the LNS; the tunnel ID, which is used to distinguish the tunnel connections of different accounts; security parameters, such as the shared key (Shared Secret), which is used for the authentication and encryption of the L2TP connection. Secondly, the generated L2TP tunnel information is sent to the target BAS using the extended attributes of the Radius protocol. Ensure that the BAS can correctly parse the tunnel information sent by Radius, and establish L2TP connections with multiple LNS based on this information. Thirdly, when the BAS receives the traffic of the second-class broadband account, it uses the L2TP tunnel information to direct the traffic to any one of the multiple LNSs to achieve centralized control of PCDN user traffic. The LNS optimizes traffic based on the received traffic characteristics and the preset traffic restriction policy, such as limiting the number of external connections and adjusting the DNS resolution rate. Finally, the LNS device optimizes PCDN traffic based on the preset restriction policy, for example, setting an upper limit on the number of external connections to reduce the number of concurrent connections that the PCDN node provides services to the outside. At the same time, through the adjustment of the DNS resolution policy, the domain name resolution rate of the reverse resolution of the PCDN user's home broadband address is limited to reduce high-concurrency DNS requests and further control PCDN traffic.

[0056] According to some other optional embodiments of the present application, reducing the value of the distribution capability index of the second type of broadband account can be achieved by the following method: obtaining a target IP message received by a network server accessed by the second type of broadband account, wherein the target IP message includes at least: five-tuple information, and the five-tuple information includes: source IP address information, source port information, destination IP address information, destination port information, and protocol information; if the source IP address information or the destination IP address information is preset address information, the five-tuple information is combined into a target field in a preset order; a hash calculation is performed on the target field to obtain a first hash value; obtaining a data list corresponding to the second type of broadband account stored in the network server, the data list including: target IP address information of the second type of broadband account, port information of the target port corresponding to the target IP address information, the number of service connections established by the target port, a second hash value corresponding to the five-tuple information of the second type of broadband account, and an aging time corresponding to the second hash value; matching the first hash value with the second hash value, and if the first hash value matches the second hash value successfully, forwarding the target IP message, and refreshing the aging time of the second hash value that matches successfully in the data list.

[0057] Specifically, the above method can be implemented through the following steps:

[0058] Step 1: First, check whether the source IP address information or the destination IP address information in the target IP message matches the preset home broadband address information. If they match, it indicates that the IP message may involve the communication of the PCDN node.

[0059] Step 2, combine the five-tuple information into a target field in a preset order. For example, the combination order can be: source IP address information, source port information, destination IP address information, destination port information and protocol information, combined into a string or data structure.

[0060] Step 3: Perform hash calculation on the combined target fields to generate a first hash value of fixed length. The hash value is used for fast search and matching, ensuring efficient processing even for large amounts of data.

[0061] Step 4, obtain information related to the second type of broadband account (i.e., the account marked as a PCDN user) from the data list of the LNS device. The data list stores the following types of data: target IP address information: that is, home broadband address information; port information: the port associated with the home broadband address; number of service connections: the number of service connections established by the port to the outside; second hash value: the hash value previously calculated and stored, corresponding to the five-tuple information; aging time: the effective length of each second hash value, used to automatically clean up expired hash value records.

[0062] Step 5, match the generated first hash value with the second hash value in the data list to find out whether there is a second hash value that is the same as the first hash value. A successful match means that the five-tuple information in the message matches the communication mode of a PCDN user within a specific time.

[0063] Step 6: If the first hash value matches a second hash value in the data list, the LNS device will directly forward the target IP message and update the aging time of the second hash value that matches successfully to keep the active connection record. If the match fails, continue to check whether the capacity of the data list has reached the limit (that is, twice the number of connections provided by the user's home broadband to the outside world). If it is not full, add the first hash value to the data list and set an aging time for the newly added second hash value. If the data list capacity is full, new connection requests will be rejected to limit the excessive number of connections.

[0064] Step 7: When the aging time of the second hash value in the data list expires, these hash values ​​will be automatically cleared from the data list to ensure the dynamism and validity of the list and avoid invalid records occupying resources.

[0065] Through the above steps, LNS devices can effectively identify and control PCDN traffic, ensure the rational use of network resources, and minimize the impact on normal user services. This processing method based on hash tables and aging time mechanisms can quickly and accurately identify and limit high-concurrency connection requests from PCDN nodes, protecting the stability and security of the operator's network.

[0066] Furthermore, if the first hash value fails to match the second hash value, check whether there are any remaining positions in the column where the second hash value is located in the data list; if there are any remaining positions in the column where the second hash value is located in the data list, add the first hash value to the column where the second hash value is located in the data list, set the aging time corresponding to the first hash value, and forward the target IP message; if there are no remaining positions in the column where the second hash value is located in the data list, do not forward the target IP message.

[0067] Specifically, if the first hash value successfully matches any second hash value in the table, it means that the connection has been established and there is a record in the table. The device directly updates the aging time of the record and forwards the target IP message. If the first hash value fails to match all second hash values, further check whether there are remaining positions in the column where the second hash value is located in the table. If there are remaining positions in the column where the second hash value is located in the data list, add the first hash value to the column and set its corresponding aging time. The aging time setting can be based on the expected life of the connection or a specific policy. For example, the aging time can be set to 5 minutes or longer, and adjusted according to the actual network environment and traffic model. After adding the first hash value and setting the aging time, forward the target IP message and allow the connection to be established. If there are no remaining positions in the column where the second hash value is located in the data list, it means that the number of external connections of the user has reached the limit, and the LNS device will not forward the target IP message, thereby realizing the limitation of the external capacity value. When the aging time of any hash value in the column expires, the hash value will be automatically removed from the list, releasing the position so that a new connection request can be recorded.

[0068] On the other hand, reducing the value of the distribution capability index of the second type of broadband account can also be achieved by the following method: detecting the number of resolutions of the domain name corresponding to the IP address of the second type of broadband account within a preset time period; if the number of resolutions is greater than a preset threshold, reducing the number of resolutions until the number of resolutions is less than the preset threshold.

[0069] Specifically, through DNS reverse resolution, the domain names corresponding to the home broadband addresses (IP addresses of the second-class broadband accounts) confirmed as PCDN users are collected into a special PCDN domain name library. This step ensures that the subsequent resolution restriction operations can be performed on PCDN-related domain names. Secondly, the resolution rate restriction policy is set on the DNS server. For the domain names in the PCDN domain name library, the maximum number of resolution requests within one minute is set. For example, a normal domain name may allow thousands of resolution requests per minute, while for PCDN domain names, the limit can be reduced to dozens of times per minute or less. The specific value needs to be adjusted according to the actual network conditions and the characteristics of PCDN traffic. Then the DNS server needs to monitor all resolution requests. When receiving a resolution request for a PCDN domain name, check whether the number of resolutions of the domain name in the current minute exceeds the set limit. If it does not exceed, it will be resolved normally and the result will be returned; if it exceeds, the resolution request will be rejected or the cached result will be returned to avoid frequent resolution operations. For each PCDN domain name, the DNS server needs to maintain statistics on the number of resolution requests within one minute. When the number of requests reaches the limit, the event is recorded and the statistics are reset at the beginning of the next one-minute cycle. In order to more flexibly respond to changes in network traffic, the resolution limit can be dynamic, that is, adjusted according to the real-time network load and PCDN traffic detection results. For example, during periods of low network load, the resolution limit can be appropriately increased; when the network load is high or PCDN traffic increases abnormally, the resolution limit can be further reduced.

[0070] According to the above steps, the flow data of each broadband account in a historical preset time period is obtained from a plurality of broadband accounts; a first type of broadband account that meets a first preset condition is determined from the plurality of broadband accounts, wherein the first preset condition includes: a downlink transmission rate of the flow data in the first preset time period is greater than an average downlink transmission rate in the historical preset time period and / or an uplink transmission rate of the flow data in the second preset time period is greater than an average uplink transmission rate in the historical preset time period, wherein the transmission rate of the flow data in the first preset time period is less than the transmission rate in the second preset time period; an external capability index of the first type of broadband account is determined, wherein the external capability index is used to characterize the port corresponding to the Internet Protocol IP address of the first type of broadband account The number of service connections established; determining the domain name capability index of the first type of broadband account based on whether the domain name corresponding to the IP address can be resolved through the IP address of the first type of broadband account; determining the distribution capability index of the first type of broadband account based on the external capability index and the domain name capability index; determining the first type of broadband account whose distribution capability index value is greater than the preset value as the second type of broadband account, and reducing the distribution capability index value of the second type of broadband account, thereby achieving the purpose of improving the accuracy of identifying the traffic data of the point-to-point content distribution network in the operator network and limiting the traffic data of the point-to-point content distribution network in the operator network, thereby achieving the technical effect of reducing the bandwidth operation cost of the operator network.

[0071] Figure 2 is a flow chart of another data processing method according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0072] Step S201, obtaining basic data.

[0073] The monthly traffic list data of broadband users is obtained through the Radius system. The monthly traffic list data specifically involves the total upstream traffic of the user during the previous natural month for subsequent traffic analysis and screening. The billing intermediate package data is used to obtain the segmented traffic data of broadband users. The specific operation is: based on the billing intermediate package record of the user at a certain point in time, subtract the billing intermediate package record at the previous point in time, so as to calculate the upstream traffic increment and downstream traffic increment in the time period as the segmented traffic data. The external five-tuple information of the specified user is obtained. The five-tuple information includes but is not limited to the local address, local port, opposite address, opposite port and communication protocol. The specified user refers to those users whose monthly traffic list data and segmented traffic data meet the preset screening conditions, so as to further identify and analyze whether they are involved in PCDN traffic activities.

[0074] The above data collection steps are prerequisites for the present invention to identify and handle PCDN traffic, ensuring the accuracy and reliability of subsequent analysis. By accurately collecting and storing the above three types of data, the present invention can effectively identify PCDN traffic characteristics and provide a solid data foundation for subsequent PCDN user labeling and traffic handling.

[0075] Step S202: Identify PCDN traffic. Figure 3 is a flow chart of a method for identifying PCDN traffic according to an embodiment of the present application, such as Figure 3 As shown, the method includes the following steps.

[0076] Step S301, based on the monthly traffic list data of broadband users in Radius, with BAS as the dimension, analyze the monthly upstream traffic data of users under the BAS, calculate the mean and variance of the user traffic under the BAS, take the arithmetic square root of the variance to get the standard deviation, and filter out users whose monthly upstream traffic data is greater than the sum of the mean and the standard deviation to enter step S302.

[0077] Specifically, suppose the monthly uplink traffic data of users under a BAS are F1, F2, …, F k , the sampled data is X1, X2, …, X n , and calculate its mean and variance And the monthly upstream flow data F j Users with >u+σ,j=1,2,…,k are screened out and the process goes to step S302.

[0078] Step S302, according to the time characteristics of the traffic model of the PCDN service, the PCDN node will frequently download a large amount of resources from the Internet service provider and cache them locally during the business off-peak hours (0-5 o'clock), occupying a large amount of downstream bandwidth. At the same time, it will provide content distribution services to the outside during the business busy hours (19 o'clock-23 o'clock), occupying a large amount of upstream bandwidth. This time characteristic that is completely opposite to normal user traffic can help identify PCDN service traffic. For the users screened out in step S301, the billing intermediate packet data sent by BAS to Radius is used to segment the user's Internet traffic. Based on this, the segmented traffic data and time span data can be used to calculate the user's upstream and downstream flow rates during the business off-peak hours (0-5 o'clock) and busy hours (19-23 o'clock). If the user's downstream traffic rate during the off-peak hours is greater than its monthly average downstream rate or the upstream traffic rate during the busy hours is greater than its monthly average upstream rate, where the user's monthly average upstream and downstream rates can be obtained by dividing the user's monthly traffic by the monthly online time, then enter step S303 and step S304.

[0079] Specifically, assuming that the sending time interval of the charging intermediate packet set on the BAS is t, and the flow data of the split upstream and downstream flow data F under this interval is obtained through the flow data in the intermediate packet and the previous corresponding intermediate packet up ,F down , and calculate the downlink traffic rate of the user during idle time Or the upstream traffic rate during busy hours If the user's downlink traffic rate V down Greater than its monthly average downlink rate, or the busy hour uplink traffic rate V up If the user's monthly average uplink and downlink rates are greater than the user's monthly average uplink and downlink rates, which can be calculated by dividing the user's monthly traffic by the monthly online time, then the process goes to step S303 to step S304.

[0080] Step S303: It is understandable that a normal home broadband user generally does not need to use an external address to access the home broadband address. If so, it is to access the camera at home, etc. The number of connections provided by the home broadband address is limited to a single digit. By analyzing the five-tuple information of the user on the BAS during the busy period, the number of service connections N provided by port i to the outside is i Perform statistics and calculate the external capacity value S of a home broadband address port i . External capability value S i The following conditions should be met: As the number of connections N provided by the broadband address port i increases, S i It should show an exponential growth, which can be calculated according to the formula Where e is the natural exponent, and the external capacity value S of all ports under the home broadband address obtained by the user is calculated as i S i .

[0081] Step S304, perform a reverse DNS domain name resolution on the user's home broadband address to calculate its domain name capability value V. If the domain name corresponding to the user's home broadband address can be obtained after the reverse DNS domain name resolution, and the secondary domain name and primary domain name to which the domain name belongs are queried and found to belong to the Internet service provider, then V=3; if the domain name can be obtained after the reverse DNS domain name resolution but does not belong to the Internet service provider, then V=2; if the domain name cannot be obtained after the reverse DNS domain name resolution, then V=1.

[0082] Step S305: Calculate the PCDN capability value by combining the external capability value S and the domain capability value V of the user's home broadband address. If the PCDN capability value P of a user is greater than P0, the user is considered to be a PCDN user.

[0083] Step S203: Mark the PCDN user.

[0084] The user determined as PCDN in step S202 is specially marked, and the special mark is used to distinguish it from normal users, so that different policies can be implemented for the user according to the mark later. The mark can be a new column of user attributes in the broadband user information table. When the attribute value is 1, it means that the user is a PCDN user, while the attribute value of a normal user is 0. PCDN can be marked in the Radius system, so that different user authorization information can be sent to BAS, and the home broadband address of the PCDN user is passed to the DNS. After reverse resolution, the DNS adds the domain name corresponding to the home broadband address of the PCDN user to the PCDN domain name library for marking.

[0085] Step S204: PCDN traffic processing. Figure 4 is a flow chart of a method for handling PCDN traffic according to an embodiment of the present application, such as Figure 4 As shown in the figure, in order to reduce the impact of PCDN traffic, it is necessary to deal with it in combination with the characteristics of PCDN, which can be divided into the following two points:

[0086] First, L2TP tunnel information is sent to BAS through Radius to guide the PCDN users marked in step S203 to two or more LNS devices to achieve centralized control of PCDN users. At the same time, since the originally scattered PCDN users are centralized, their ability to dispatch nearby will be affected.

[0087] Second, the PCDN capability value P of concentrated PCDN users is reduced. The essence of PCDN is that a large amount of content data is provided to the outside during the content distribution and delivery phase. The external network will frequently initiate connection requests to the internal address. To reduce its PCDN capability value P, it can be divided into reducing the external capability value S of PCDN users and reducing the domain name capability value V. To reduce the external capability value S, the number of external connections can be limited on the LNS device according to the five-tuple information of the traffic, so that the same home broadband address port can only establish a number of connections within the limited number range with the outside. Such a table is formed on the LNS, and the fields in the table are the user home broadband address column, the user home broadband port column, the user home broadband external connection limit column, and the five-tuple Hash value column, where each Hash value in the five-tuple Hash column has an aging time, and the capacity of the five-tuple Hash value column is twice the number of connections provided by the user home broadband externally, that is, when the user home broadband external connection limit is 1, the five-tuple Hash value column can only store two different Hash values. When LNS receives an IP data packet and finds that the source IP or destination IP address is a home broadband address, it will combine the source IP, source port, destination IP, destination port, and protocol quintuple field message information of the IP message into a message M1 in order, perform hash calculation to obtain its external hash value H1, and compare H1 with the data in the quintuple hash value column in the table. If they match, the IP data packet is directly forwarded and the aging time of H1 in the table is refreshed. If they do not match, the capacity of the quintuple hash value column is further checked. If the capacity is not full, H1 is recorded in the quintuple hash column in the table and the IP data packet is forwarded. An aging time is set for H1. If the capacity is full, the data packet is discarded. When the aging time of the hash value H1 in the quintuple hash value column expires, H1 is cleared from the table. Obviously, the IP addresses here include both IPv4 and IPv6 addresses. To reduce the domain name capacity value V, the domain name obtained by reverse resolution of the home broadband address obtained by the marked PCDN user can be restricted through DNS to reduce the resolution rate of the domain name, that is, to limit the number of resolutions of the domain name within one minute, thereby limiting the high concurrency of PCDN.

[0088] Through the above steps, it can be seen that the relevant PCDN detection technology only focuses on the size characteristics of the upstream traffic, but does not pay attention to the time characteristics of the PCDN traffic. This application provides the characteristics of PCDN traffic over time. When the business is idle, its downstream traffic is large, and when the business is busy, its upstream traffic is large, which expands the PCDN detection surface and reduces misjudgment. The relevant PCDN detection technology is based on the address characteristics, traffic size characteristics, and content source characteristics of PCDN users for detection, while this application is based on the essential characteristics of PCDN providing content distribution services to the outside world, and uses the five-tuple information of user traffic and DNS reverse resolution to provide a method for calculating the user's PCDN capability value. The larger the user's PCDN capability value, the easier it is to be called a PCDN node. The relevant PCDN detection technologies all focus on how to analyze and detect PCDN services, and fail to dispose of the PCDN traffic after detection. This application provides a complete method from PCDN traffic identification to disposal. After the traffic disposal of PCDN, the traffic pressure reduction effect is good, the effect is fast, and there are few user complaints.

[0089] Figure 5 is a structural diagram of a data processing device according to an embodiment of the present application, such as Figure 5 As shown, the device comprises:

[0090] The acquisition module 51 is used to acquire the flow data of each broadband account in a historical preset time period of the multiple broadband accounts.

[0091] The first determination module 52 is used to determine a first type of broadband account that meets a first preset condition among multiple broadband accounts, wherein the first preset condition includes: a downlink transmission rate of traffic data in a first preset time period is greater than an average downlink transmission rate in a historical preset time period and / or an uplink transmission rate of traffic data in a second preset time period is greater than an average uplink transmission rate in a historical preset time period, wherein the transmission rate of traffic data in the first preset time period is less than the transmission rate in the second preset time period.

[0092] The second determination module 53 is used to determine the external capability index of the first type of broadband account, wherein the external capability index is used to represent the number of service connections established by the port corresponding to the Internet Protocol IP address of the first type of broadband account.

[0093] The third determination module 54 is configured to determine the domain name capability index of the first type of broadband account according to whether the domain name corresponding to the IP address can be resolved through the IP address of the first type of broadband account.

[0094] The fourth determination module 55 is used to determine the distribution capability index of the first type of broadband account according to the external capability index and the domain name capability index.

[0095] The processing module 56 is used to determine the first type of broadband account whose distribution capability index value is greater than a preset value as a second type of broadband account, and reduce the distribution capability index value of the second type of broadband account.

[0096] Optionally, the third determination module 54 is further used to perform the following steps: if the domain name corresponding to the IP address can be determined through the IP address of the first-class broadband account, and the Internet service provider to which the domain name belongs can be determined, the distribution capability index of the first-class broadband account is determined as a first value; if the domain name corresponding to the IP address can be determined through the IP address of the first-class broadband account, and the Internet service provider to which the domain name belongs cannot be determined, the distribution capability index of the first-class broadband account is determined as a second value, wherein the second value is less than the first value; if the domain name corresponding to the IP address cannot be determined through the IP address of the first-class broadband account, the distribution capability index of the first-class broadband account is determined as a third value, wherein the third value is less than the second value.

[0097] Optionally, the processing module 56 is also used to perform the following steps: obtaining a target IP message received by a network server accessed by the second type of broadband account, wherein the target IP message includes at least: five-tuple information, and the five-tuple information includes: source IP address information, source port information, destination IP address information, destination port information, and protocol information; if the source IP address information or the destination IP address information is preset address information, the five-tuple information is combined into a target field in a preset order; hash calculation is performed on the target field to obtain a first hash value; obtaining a data list corresponding to the second type of broadband account stored in the network server, the data list including: the target IP address information of the second type of broadband account, the port information of the target port corresponding to the target IP address information, the number of service connections established by the target port, the second hash value corresponding to the five-tuple information of the second type of broadband account, and the aging time corresponding to the second hash value; matching the first hash value with the second hash value, if the first hash value matches the second hash value successfully, forwarding the target IP message, and refreshing the aging time of the second hash value that matches successfully in the data list.

[0098] Optionally, the data processing device also includes: a fifth determination module, used to perform the following steps: if the first hash value fails to match the second hash value, detect whether there are any remaining positions in the column where the second hash value is located in the data list; if there are any remaining positions in the column where the second hash value is located in the data list, add the first hash value to the column where the second hash value is located in the data list, set the aging time corresponding to the first hash value, and forward the target IP message; if there are no remaining positions in the column where the second hash value is located in the data list, do not forward the target IP message.

[0099] Optionally, the processing module 56 is also used to perform the following steps: detecting the number of resolutions of the domain name corresponding to the IP address of the second type of broadband account within a preset time period; if the number of resolutions is greater than a preset threshold, reducing the number of resolutions until the number of resolutions is less than the preset threshold.

[0100] Optionally, the data processing device also includes: a sending module, which is used to execute the following steps after determining a first-class broadband account whose distribution capability index value is greater than a preset value as a second-class broadband account: using a remote authentication dial-up user service to send tunnel information based on the Layer 2 tunnel protocol to a target broadband access server to which the second-class broadband account is connected, wherein the tunnel information is used to indicate that the second-class broadband account is connected to multiple Layer 2 tunnel protocol network servers.

[0101] Optionally, the data processing device also includes: a fifth determination module, which is used to perform the following steps before determining the first type of broadband account that meets the first preset condition among multiple broadband accounts: obtaining the uplink traffic data in the target broadband access server to which the multiple broadband accounts are connected; determining the average value and standard deviation of the uplink traffic data transmission volume of each broadband account within the historical preset time period in the uplink traffic data in the target broadband access server; retaining the broadband accounts whose uplink traffic data transmission volume within the current preset time period is greater than the target value among the multiple broadband accounts, wherein the target value is the sum of the average value and the standard deviation.

[0102] Optionally, the acquisition module 51 is also used to perform the following steps: using the remote authentication dial-up user service to obtain the traffic list data of the broadband account within a historical preset time period; using the billing intermediate package in the remote authentication dial-up user service to obtain the segmented traffic data of the broadband account, wherein the segmented traffic data is the difference between the traffic data in the billing intermediate package corresponding to the i+1th moment and the traffic data in the billing intermediate package corresponding to the i-th moment, and i is a positive integer; obtaining the quintuple information of the first target broadband account, wherein the first target broadband account is a broadband account whose traffic list data and segmented traffic data both meet preset conditions, and the quintuple information includes: the address information and port information corresponding to the target broadband account, the address information and port information corresponding to the second target broadband account that transmits data with the first target broadband account, and the transmission protocol.

[0103] It should be noted that the above Figure 5 The modules in the embodiment may be program modules (e.g., a set of program instructions for implementing a specific function) or hardware modules. For the latter, they may be expressed in the following forms, but are not limited thereto: the expression form of the above modules is a processor, or the functions of the above modules are implemented by a processor.

[0104] It should be noted that Figure 5 The preferred implementation of the illustrated embodiment can be found in Figure 1 The relevant description of the illustrated embodiment will not be repeated here.

[0105] Figure 6 FIG. 1 shows a hardware structure block diagram of a computer terminal for implementing a data processing method. Figure 6 As shown, the computer terminal 60 may include one or more (602a, 602b, ..., 602n are used to illustrate) processors 602 (the processor 602 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 604 for storing data, and a transmission module 606 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 6 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 6 More or fewer components as shown, or with Figure 6 Different configurations shown.

[0106] It should be noted that the one or more processors 602 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 60. As involved in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0107] The memory 604 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the data processing method in the embodiment of the present application. The processor 602 executes various functional applications and data processing by running the software programs and modules stored in the memory 604, that is, realizing the above-mentioned data processing method. The memory 604 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 604 may further include a memory remotely arranged relative to the processor 602, and these remote memories may be connected to the computer terminal 60 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0108] The transmission module 606 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 60. In one example, the transmission module 606 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 606 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0109] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 60 .

[0110] It should be noted that, in some optional embodiments, the above Figure 6 The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 6 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0111] It should be noted that Figure 6 The computer terminal shown is used to execute Figure 1 The data processing method shown, therefore the relevant explanations in the execution method of the above command are also applicable to the electronic device and will not be repeated here.

[0112] An embodiment of the present application further provides a non-volatile storage medium, which includes a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute the above data processing method.

[0113] A program for a non-volatile storage medium to perform the following functions: obtaining flow data of each broadband account in a historical preset period of time among a plurality of broadband accounts; determining a first-category broadband account that meets a first preset condition among the plurality of broadband accounts, wherein the first preset condition includes: a downlink transmission rate of flow data in the first preset period of time is greater than an average downlink transmission rate in the historical preset period of time and / or an uplink transmission rate of flow data in the second preset period of time is greater than an average uplink transmission rate in the historical preset period of time, wherein the transmission rate of flow data in the first preset period of time is less than the transmission rate in the second preset period of time; determining an external capability index of the first-category broadband account, wherein the external capability index is used to characterize the number of service connections established by a port corresponding to an Internet Protocol IP address of the first-category broadband account; determining a domain name capability index of the first-category broadband account based on whether a domain name corresponding to the IP address can be resolved through the IP address of the first-category broadband account; determining a distribution capability index of the first-category broadband account based on the external capability index and the domain name capability index; determining a first-category broadband account whose distribution capability index has a value greater than a preset value as a second-category broadband account, and reducing the value of the distribution capability index of the second-category broadband account.

[0114] An embodiment of the present application further provides an electronic device, including: a memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the above data processing method is executed when the program is run.

[0115] The processor is used to run a program that performs the following functions: obtaining flow data of each broadband account in a historical preset period of time among a plurality of broadband accounts; determining a first-class broadband account that meets a first preset condition among the plurality of broadband accounts, wherein the first preset condition includes: a downlink transmission rate of flow data in the first preset period of time is greater than an average downlink transmission rate in the historical preset period of time and / or an uplink transmission rate of flow data in the second preset period of time is greater than an average uplink transmission rate in the historical preset period of time, wherein the transmission rate of flow data in the first preset period of time is less than the transmission rate in the second preset period of time; determining an external capability index of the first-class broadband account, wherein the external capability index is used to characterize the number of service connections established by a port corresponding to an Internet Protocol IP address of the first-class broadband account; determining a domain name capability index of the first-class broadband account according to whether a domain name corresponding to the IP address can be resolved through the IP address of the first-class broadband account; determining a distribution capability index of the first-class broadband account according to the external capability index and the domain name capability index; determining a first-class broadband account whose distribution capability index has a value greater than a preset value as a second-class broadband account, and reducing the value of the distribution capability index of the second-class broadband account.

[0116] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0117] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0118] In the above-mentioned embodiments of the present application, the collected information is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary protection measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0119] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0120] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0121] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0122] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0123] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data processing method, characterized in that: include: Obtaining traffic data of each broadband account in a historical preset time period among multiple broadband accounts; Determine a first type of broadband account that meets a first preset condition from among the plurality of broadband accounts, wherein the first preset condition includes: a downlink transmission rate of the traffic data in a first preset period is greater than an average downlink transmission rate in the historical preset period and / or an uplink transmission rate of the traffic data in a second preset period is greater than an average uplink transmission rate in the historical preset period, wherein the transmission rate of the traffic data in the first preset period is less than the transmission rate in the second preset period; Determining an external capability index of the first type of broadband account, wherein the external capability index is used to characterize the number of service connections established by the port corresponding to the Internet Protocol IP address of the first type of broadband account; determining a domain name capability indicator of the first type of broadband account according to whether a domain name corresponding to the IP address can be resolved through the IP address of the first type of broadband account; Determining a distribution capability index of the first type of broadband account according to the external capability index and the domain name capability index; A first-category broadband account whose distribution capability index value is greater than a preset value is determined as a second-category broadband account, and the distribution capability index value of the second-category broadband account is reduced.

2. The method according to claim 1, characterized in that Determining the domain name capability index of the first-category broadband account according to whether a domain name corresponding to the IP address can be resolved through the IP address of the first-category broadband account includes: If the domain name corresponding to the IP address can be determined through the IP address of the first type of broadband account, and the Internet service provider to which the domain name belongs can be determined, the distribution capability indicator of the first type of broadband account is determined to be a first value; If the domain name corresponding to the IP address can be determined through the IP address of the first type of broadband account, and the Internet service provider to which the domain name belongs cannot be determined, the distribution capability indicator of the first type of broadband account is determined as a second value, wherein the second value is less than the first value; If the domain name corresponding to the IP address cannot be determined through the IP address of the first type of broadband account, the distribution capability index of the first type of broadband account is determined as a third value, wherein the third value is smaller than the second value.

3. The method according to claim 1, characterized in that Reducing the value of the distribution capability indicator of the second type of broadband account includes: Obtaining a target IP message received by the network server accessed by the second type of broadband account, wherein the target IP message at least includes: five-tuple information, and the five-tuple information includes: source IP address information, source port information, destination IP address information, destination port information, and protocol information; If the source IP address information or the destination IP address information is preset address information, combining the five-tuple information into a target field in a preset order; Performing a hash calculation on the target field to obtain a first hash value; Obtaining a data list corresponding to the second type of broadband account stored in the network server, the data list including: target IP address information of the second type of broadband account, port information of a target port corresponding to the target IP address information, the number of service connections established by the target port, a second hash value corresponding to the five-tuple information of the second type of broadband account, and an aging time corresponding to the second hash value; The first Hash value is matched with the second Hash value. If the first Hash value matches the second Hash value successfully, the target IP message is forwarded, and the aging time of the successfully matched second Hash value in the data list is refreshed.

4. The method according to claim 3, characterized in that The method further comprises: If the first Hash value fails to match the second Hash value, detecting whether there is a remaining position in the column where the second Hash value is located in the data list; If there are remaining positions in the column where the second Hash value is located in the data list, add the first Hash value to the column where the second Hash value is located in the data list, set the aging time corresponding to the first Hash value, and forward the target IP message; If there is no remaining position in the column where the second hash value in the data list is located, the target IP message is not forwarded.

5. The method according to claim 1, characterized in that Reducing the value of the distribution capability indicator of the second type of broadband account includes: Detect the number of resolutions of the domain name corresponding to the IP address of the second type of broadband account within a preset time period; if the number of resolutions is greater than a preset threshold, reduce the number of resolutions until the number of resolutions is less than the preset threshold.

6. The method according to claim 1, characterized in that After determining a first-class broadband account whose distribution capability index has a value greater than a preset value as a second-class broadband account, the method further includes: using a remote authentication dial-up user service to send tunnel information based on a layer 2 tunnel protocol to a target broadband access server to which the second-class broadband account is connected, wherein the tunnel information is used to indicate that the second-class broadband account is connected to multiple layer 2 tunnel protocol network servers.

7. The method according to claim 1, characterized in that Before determining a first type of broadband account that meets a first preset condition among the plurality of broadband accounts, the method further includes: Acquire uplink traffic data in a target broadband access server to which the plurality of broadband accounts are connected; Determine, from the uplink traffic data in the target broadband access server, the average value and standard deviation of the uplink traffic data transmission volume of each broadband account within the historical preset time period; The broadband accounts whose uplink traffic data transmission volume in the current preset time period is greater than the target value are retained among the multiple broadband accounts, wherein the target value is the sum of the average value and the standard deviation.

8. The method according to claim 1, characterized in that Get the traffic data of each broadband account in the historical preset time period among multiple broadband accounts, including: Using a remote authentication dial-up user service to obtain traffic list data of the broadband account within the historical preset time period; Using the billing intermediate package in the remote authentication dial-up user service to obtain the split flow data of the broadband account, wherein the split flow data is the difference between the flow data in the billing intermediate package corresponding to the i+1th moment and the flow data in the billing intermediate package corresponding to the ith moment, where i is a positive integer; Acquire quintuple information of the first target broadband account, wherein the first target broadband account is a broadband account whose traffic list data and the segmented traffic data both meet preset conditions, and the quintuple information includes: address information and port information corresponding to the target broadband account, address information and port information corresponding to the second target broadband account for data transmission with the first target broadband account, and a transmission protocol.

9. A data processing device, characterized in that: include: An acquisition module, used to acquire traffic data of each broadband account in a historical preset time period among multiple broadband accounts; A first determination module is used to determine a first type of broadband account that meets a first preset condition from among the plurality of broadband accounts, wherein the first preset condition includes: a downlink transmission rate of the traffic data in a first preset period is greater than an average downlink transmission rate in the historical preset period and / or an uplink transmission rate of the traffic data in a second preset period is greater than an average uplink transmission rate in the historical preset period, wherein the transmission rate of the traffic data in the first preset period is less than the transmission rate in the second preset period; a second determination module, configured to determine an external capability index of the first type of broadband account, wherein the external capability index is used to characterize the number of service connections established by a port corresponding to the Internet Protocol IP address of the first type of broadband account; A third determination module, configured to determine the domain name capability index of the first type of broadband account according to whether a domain name corresponding to the IP address can be resolved through the IP address of the first type of broadband account; A fourth determination module, configured to determine a distribution capability indicator of the first type of broadband account according to the external capability indicator and the domain name capability indicator; The processing module is used to determine the first type of broadband account whose distribution capability index value is greater than a preset value as a second type of broadband account, and reduce the distribution capability index value of the second type of broadband account.

10. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored program, wherein when the program is executed, the device where the non-volatile storage medium is located is controlled to execute the data processing method according to any one of claims 1 to 8.

11. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program executes the data processing method according to any one of claims 1 to 8 when running.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the data processing method according to any one of claims 1 to 8 is implemented.

Images