Airborne satellite internet management method and system based on deep packet inspection

Abstract

The invention discloses an airborne satellite internet management method and system based on deep packet inspection, and the method comprises the steps: obtaining a user networking request, and guiding a user to complete the opening of an internet surfing package; constructing an integrated interface; based on the integrated interface, collecting and analyzing user traffic data by applying a deep packet inspection technology; constructing a dynamic bandwidth allocation algorithm to realize identification and classification dynamic allocation of user bandwidth based on airborne real-time network load and user application; and monitoring the use condition of the internet surfing package of the user, and controlling the airborne equipment used by the user to be offline when the package expires. According to the method, the flow data of the users can be collected and analyzed, the most suitable internet surfing strategy can be allocated, meanwhile, the constructed dynamic bandwidth allocation algorithm is matched with the deep packet detection result, the bandwidth can be dynamically allocated based on the real-time network loads of all the users, and the overall resource allocation proportion is balanced.

Description

Technical Field

[0001] The present invention relates to the technical field of satellite communication and network management, and in particular to an airborne satellite Internet management method and system based on deep packet inspection. Background Art

[0002] Airborne satellite Internet service refers to providing high-speed and stable satellite Internet access services to users on aircraft based on satellite communication technology, covering multiple fields such as airborne office, entertainment, and education. At present, the Internet access management of satellite Internet users mainly adopts AAA-RADIUS authentication mode, which can only support basic authentication, authorization and billing functions, and cannot support advanced functions such as fine-grained access control and flow control. It also has poor data accumulation ability and insufficient flexibility, and cannot meet the diverse communication needs of users on board. At the same time, the traditional bandwidth management method only measures the load occupancy through network usage. In the face of the various classification methods of current network applications, it is impossible to make targeted dynamic bandwidth adjustments. Therefore, it is urgent to solve the shortcomings of the current Internet access management method. Summary of the invention

[0003] In view of this, the present invention proposes an airborne satellite Internet management method and system based on deep packet inspection, which can achieve more accurate and reasonable allocation of network resources through in-depth monitoring of user Internet behavior. The present invention provides the following technical solutions:

[0004] A method for managing airborne satellite Internet based on deep packet inspection, the method comprising: obtaining a user's Internet access request, guiding the user to complete the activation of an Internet access package and allowing the user to access the Internet; constructing an integrated interface to manage user data and airborne network data; based on the integrated interface, applying deep packet inspection technology to collect and analyze user traffic data; constructing a dynamic bandwidth allocation algorithm to dynamically allocate user bandwidth based on identification and classification of airborne real-time network load and user applications; monitoring the use of the user's Internet access package, and controlling the airborne device used by the user to go offline when the package expires.

[0005] Optionally, the method of obtaining a user's Internet access request, guiding the user to complete the activation of an Internet access package and allowing the user to access the Internet includes: identifying whether the user is connected to an onboard satellite Internet network, and if so, performing user authentication; if the authentication is successful, pushing different Internet access packages for selection and activation, and guiding the user to complete payment; after successful payment, activating Internet access for the current user, and matching the Internet access policy based on the type of package activated.

[0006] Optionally, the method of applying deep packet inspection technology to collect and parse user traffic data to identify and classify user applications and match Internet access strategies includes: deploying deep packet inspection between airborne satellite Internet links in bridging mode; identifying traffic data of multiple users through deep packet inspection; parsing and extracting each layer of header information added during the encapsulation process of the traffic data packet, and identifying and parsing the user application through feature matching.

[0007] Optionally, the method for parsing and extracting the header information of each layer added during the encapsulation process of the traffic data packet, and realizing identification and analysis of the user application through feature matching includes: parsing the traffic data packet into the application layer and the base layer, and extracting the header information respectively; constructing a regular rule set for the base layer, the regular rule set containing regular expressions for matching IP addresses and port numbers; constructing an adaptive regular chain for the application layer, and dynamically updating the regular chain to complete regular chain matching and realize the positioning of high-frequency traffic data; performing distributed parallel analysis on the header information of the base layer and the application layer; and constructing a multi-dimensional feature matrix based on the analysis results and the corresponding header information to realize identification and analysis of subsequent traffic data through feature matching.

[0008] Optionally, the method for constructing a dynamic bandwidth allocation algorithm to dynamically allocate user bandwidth based on identification and classification of onboard real-time network load and user application includes: dividing the total bandwidth of the onboard satellite terminal into a service bandwidth Bb and a reserved bandwidth Br; setting a plurality of initial weights S1, S2, ... S j , divide the service bandwidth into multiple Bb1, Bb2, ...Bb according to multiple initial weights m ; Set multiple business priorities A1, A2, ...A according to multiple application categories n ;Periodically detect the real-time network load of multiple business bandwidths and dynamically allocate them based on initial weights and business priorities.

[0009] Optionally, the method of periodically detecting the real-time network loads of multiple service bandwidths and dynamically allocating them based on initial weights and service priorities includes: monitoring the authentication status of onboard users, and calculating the service offset based on the stage distribution, threshold ratio and guarantee offset of users with different authentication statuses, and completing the service priority adjustment, specifically:

[0010]

[0011] in, is the stage distribution of users, α is the threshold ratio, i is the guaranteed offset, X k represents the number of users in the current stage k, The service offset is used to monitor the real-time load of each service bandwidth and calculate the ratio of bandwidth usage. Specifically:

[0012]

[0013] Among them, U m Bb is the current service bandwidth m The dynamic weight is calculated based on the service priority and bandwidth utilization ratio. Specifically:

[0014]

[0015] When it is detected that the service bandwidth Bb is consumed, half of the reserved bandwidth Br is allocated according to the dynamic weight.

[0016] The present invention further discloses an airborne satellite Internet management system based on deep packet inspection, including: an authentication management module, which is used to obtain a user's Internet access request, guide the user to complete the activation of an Internet access package and allow the user to connect to the Internet; it is also used to monitor the use of the user's Internet access package and control the airborne device used by the user to go offline when the package expires; an interface management module, which is used to build an integrated interface to manage user data and airborne network data; a behavior monitoring module, which is used to apply deep packet inspection technology to collect and analyze user traffic data; a bandwidth management module, which is used to build a dynamic bandwidth allocation algorithm to dynamically allocate user bandwidth based on the identification and classification of airborne real-time network load and user applications.

[0017] The present invention further discloses a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program implements the above method when executed by a processor.

[0018] The present invention further discloses an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the program.

[0019] The present invention further discloses a computer program product, comprising a computer program, wherein the computer program implements the above method when executed by a processor.

[0020] By applying deep packet inspection technology, the present invention can collect and analyze user traffic data, analyze the user's network usage purpose and preference, and allocate the most suitable Internet access strategy. At the same time, the constructed dynamic bandwidth allocation algorithm, in conjunction with the result of deep packet inspection, can dynamically allocate bandwidth based on the real-time network load of all users, balance the overall resource allocation ratio, and avoid service degradation due to resource preemption. At the same time, it can also reasonably divide access priorities according to the identified user network access classification to ensure the smooth operation of key applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] For the purpose of illustration and not limitation, the present invention is now described in conjunction with the embodiments of the present invention and the accompanying drawings, in which:

[0022] Figure 1 It is a flowchart of an airborne satellite Internet management method based on deep packet inspection in an embodiment of the present invention;

[0023] Figure 2 is a schematic diagram of an airborne satellite Internet management system based on deep packet inspection in an embodiment of the present invention;

[0024] Figure 3 is a schematic structural diagram of an electronic device in an embodiment of the present invention;

[0025] Figure 4 is a diagram of the implementation architecture of deep packet inspection in an embodiment of the present invention;

[0026] Figure 5 It is a schematic diagram of implementing the deep packet inspection function in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the implementation mode of the present application will be clearly and completely described below in conjunction with the drawings in the implementation mode of the present application. Obviously, the described implementation mode is only a part of the implementation mode of the present application, not all the implementation modes. Based on the implementation mode in the present application, all other implementation modes obtained by ordinary technicians in the field without creative work should fall within the scope of protection of the present application.

[0028] It should be noted that the terms "first", "second", etc. in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] In the present application, the terms "upper", "lower", "left", "right", "front", "back", "top", "bottom", "inner", "outer", "middle", "vertical", "horizontal", "lateral", "longitudinal" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings. These terms are mainly used to better describe the present application and its implementation methods, and are not used to limit the indicated devices, elements or components to have a specific orientation, or to be constructed and operated in a specific orientation.

[0030] In addition, some of the above terms may be used to express other meanings in addition to indicating orientation or positional relationship. For example, the term "on" may also be used to express a certain dependency or connection relationship in some cases. For those of ordinary skill in the art, the specific meanings of these terms in this application can be understood according to the specific circumstances. In addition, the term "plurality" should mean two or more than two.

[0031] It should be noted that, in the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other. The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0032] refer to Figure 1 This embodiment discloses an airborne satellite Internet management method based on deep packet inspection, the method comprising:

[0033] S100: Obtaining a user's Internet access request, guiding the user to complete Internet access package activation and allowing the user to connect to the Internet.

[0034] When the onboard user wants to connect to the Internet, he needs to use the onboard networking device to initiate a network request, and the onboard device is connected to the satellite Internet network. When the network request is received, the device that initiates the request is connected to the Internet. This embodiment takes the airplane scenario as an example. At this time, the user is allowed to access some websites, such as the relevant websites of the airline, so that the user can obtain the current flight information and data related to the voyage, and can also access the relevant network services of the airline cooperation. At this time, the user can initiate an external network request to access the network for entertainment and other services. Specifically, it is identified whether the user who initiates the request is connected to the onboard satellite Internet network. If so, the login and real-name authentication are completed according to the authentication and authorization rules formulated by the system. Specifically, the user is required to confirm his identity, such as completing the real-name authentication by matching the real-name authentication with the passenger information, and registering and logging in with the airline account and password. When the user authentication is passed, the user's permission address book is established to correspond to the current user's authentication status and role. For example, the user's cabin class is determined by the user's ticket information, such as economy class, business class, etc., and the corresponding optional packages in the permission address book are pushed according to the cabin class to achieve accurate diversion of users, which is conducive to flexible allocation of network resources, while ensuring network security and rational use of resources, and the background management of users is more flexible. After the user selects the target package, guide the user to complete the payment. After the user pays successfully, the Internet access function is enabled for the current user, and the preset Internet access policy is matched according to the enabled package type, and the Internet access policy corresponds to the user's permission address book, that is, when accessing network content, the permission address book will be used to query whether the current accessing user has the corresponding network access rights.

[0035] S200: Construct an integrated interface to manage user data and airborne network data. The integrated interface includes multiple types of API interfaces, which realize functions such as real-time monitoring of airborne user traffic, refined control of Internet behavior, and comprehensive business auditing. Specifically, construct multiple types of API interfaces. For example, the interfaces in this embodiment include: traffic monitoring interface: real-time monitoring and analysis of traffic data usage through deep packet inspection; behavior control interface: restricting access to users according to the user's package situation, in conjunction with deep packet inspection; business audit interface: based on the analysis and statistics of deep packet inspection, comprehensive business log processing and statistics of network data usage. For the above-mentioned interfaces, after integration, they can be called by external systems, so that there is no need to build a traffic management system, and this interface can be directly called to realize the method of directly using network management based on deep packet inspection. This embodiment exemplarily discloses the process of externally calling this solution: requesting an API protocol access token and initiating an authentication request to the server. If the authentication is successful, the authorization server returns an access token; calling different API interfaces by requesting URLs according to needs, and realizing corresponding functions; parsing the format data returned by the called API. In this way, the call of this integrated interface is completed.

[0036] S300: Based on the integrated interface, deep packet inspection technology is used to collect and analyze user traffic data to identify and classify user applications and match Internet access strategies. Specifically, the user's current network usage is monitored in real time through deep packet inspection technology. For example, in the user authentication stage in step S100, the user's current authentication stage can be monitored by identifying the current user's traffic data, which can be unauthenticated, authenticating, authenticated, failed, etc. Taking the above authentication stage as an example, when it is detected that the user is in the unauthenticated stage according to the network traffic data, the current user's personal information is added to the pre-constructed interception address book to complete the restriction of the user's Internet access. When it is detected that the user is in the authentication stage according to the network traffic data, the user's personal information is transferred to the authentication address book, and the user's payment network access rights can be opened, such as WeChat payment, UnionPay payment, etc. When it is detected that the user is in the authentication pass stage, the user's personal information is transferred to the activation address book, and the current user's activation package data is read to connect the user's network access. At the same time, the network data accessed by the user is parsed using deep packet inspection technology, and the network traffic that does not meet the preset of the current user package is automatically blocked. For another example, when it is detected that the user is in the authentication failure stage, the user information is retrieved back to the interception address book to block the user's network access.

[0037] refer to Figure 4 and Figure 5, deep packet inspection technology can detect data at the data link layer, network layer, transport layer, and application layer by identifying the protocol of application layer data and detecting the content of data packets. Specifically, deep packet inspection is deployed between airborne satellite Internet links in bridging mode to identify traffic to obtain data content, and the identified traffic is parsed and the header information of each layer added to the traffic data packet during the encapsulation process is extracted, and the user application is identified and parsed through feature matching. Specifically: a multi-dimensional feature matrix is ​​constructed based on the parsing results and the corresponding header information to achieve identification and parsing of subsequent traffic data through feature matching. The traffic data packet is parsed into the application layer and the base layer, and the header information is extracted separately, refer to Figure 4, including a base layer (L2-L4) and an application layer (L7), wherein the basic protocol representation of the base layer is parsed, including an IP address, a port number, and a dynamically identified protocol type. At the same time, the content of the application layer is parsed through the application data, including a protocol flag and a session information identifier. In one or more embodiments, in order to adapt to the ever-changing application protocols, the scheme for dynamically identifying protocol types can also be to set up an adaptive feature library, which uses the feature vector of the newly accessed data packet to match the protocol vector in the current feature library, and automatically expands new protocol feature entries based on feature differences. A regular rule set is constructed for the base layer, and the regular rule set contains regular expressions for matching IP addresses and port numbers. An adaptive regular chain is constructed for the application layer, and the regular chain is dynamically updated to complete the regular chain matching and realize the positioning of high-frequency traffic data. The header information of the base layer and the application layer is parsed in a distributed and parallel manner. Based on the parsed base layer and application layer, regular expression rule sets are constructed respectively, and the header information of the base layer and the application layer is parsed to further improve the efficiency of feature matching during parsing. For example, taking IPV4 address matching as an example, a regular expression is constructed to identify the protocol field of the base layer: ^192\.168\.\d{1,3}\.\d{1,3}$, which can filter out data packets of standard protocols in a very short time. For another example, for data packets of the application layer, an adaptive regular expression chain based on a preset feature library is used. Taking video data as an example, a regular chain expression is constructed: ^(video|mp4|mkv), which can identify the application protocol of a specific video application. At the same time, the regular chain is dynamically updated according to the traffic monitoring results, which can achieve the parsing and identification speed of high-frequency traffic types. A multi-dimensional feature matrix for adaptive protocol identification is constructed for airborne applications and airborne network services, specifically, including protocol type features, traffic pattern features, port number range features and transmission delay features. At the same time, a deep learning algorithm is embedded, and the changing features are adaptively updated through the deep learning algorithm to dynamically adapt to the state changes of multiple users in the network. Further, a dynamic protocol matching algorithm is constructed based on the multi-dimensional feature matrix to analyze the feature values ​​of network traffic data packets in real time and match the protocol features in the corresponding matrix to identify the current protocol type. Further, the above scheme can be used to identify and parse the user's traffic data features in real time. In order to further improve the subsequent traffic identification and parsing efficiency, the parsed traffic features are assigned feature IDs for marking, and a feature tag library is constructed based on this. For the subsequent identified marked feature traffic data, the parsing results can be directly read without repeating the parsing steps. At the same time, the LRU (least recently used) algorithm is used in combination with the feature tag library for cache management, that is, high-frequency application feature data packets are cached first, which not only realizes the rapid identification of traffic data, but also further improves the reading efficiency of data packets.

[0038] S400: Build a dynamic bandwidth allocation algorithm to dynamically allocate user bandwidth based on the identification and classification of onboard real-time network load and user applications.

[0039] For the dynamic allocation of bandwidth, the allocation algorithm disclosed in this embodiment is designed based on the real-time airborne network load and the user behavior identified by deep packet inspection. The algorithm can actively adjust the bandwidth limit of the airborne satellite Internet terminal according to the network status and user needs, balance the overall resource allocation ratio, and avoid service degradation due to resource preemption. At the same time, it can also reasonably divide the priorities according to different application categories based on the usage of the onboard network to ensure the smooth operation of the application. Specifically, this algorithm is a feedback adaptive algorithm, which is designed as follows: the total bandwidth of the airborne satellite terminal is divided into business bandwidth Bb and reserved bandwidth Br. The business bandwidth is used to provide network services for each device connected to the airborne satellite Internet. It should be understood that there are multiple categories of services, which are determined by the type of data accessed by the user, such as video services, graphic services, audio services, etc. The terminal also sets multiple initial weights S1, S2, ...S j , j represents the number of initial weights set. The number of initial weights is not limited in this embodiment. Taking the aircraft passenger service as an example, the initial weight includes passenger weight and application weight. The passenger weight includes first-class passenger weight, business-class passenger weight and economy-class passenger weight, etc. The application weight is determined according to the package purchased by the user. For example, if the passenger purchases an audio-visual package, the application weight includes the weight of each audio-visual related application. For another example, if the passenger purchases an office package, the application weight includes the weight of each office application. Divide the service bandwidth Bb into Bb1, Bb2, ...Bb m , multiple service bandwidths correspond to passenger weights and application weights. It should be understood that, based on this, the service bandwidth may include passenger classification bandwidth and application classification bandwidth. Further, service priorities A1, A2, ...A are set according to service categories. n , where n is the number of service categories, and in this embodiment, the number is not limited. Service categories are classifications of applications, including, for example, video streaming services, communication services, office services, gaming services, and shopping mall services. The usage of service bandwidth is detected at fixed periods, and dynamically allocated based on the initial weight and service priority. Specifically, it is necessary to detect the authentication status of passengers on board, and calculate the service offset based on the stage distribution, threshold ratio, and guarantee offset of users with different authentication statuses, and complete the service priority adjustment. Among them, the stage distribution refers to the proportion of users in the current stage among all users. The stages include pre-authentication users, users in authentication, users who passed authentication, and users who failed authentication. The threshold ratio and guarantee offset are the fine-tuning parameters that are set. Specifically:

[0040]

[0041] in, is the stage distribution of users, Xk represents the number of users in the current stage k, α is the threshold ratio, i is the guaranteed offset, is the business offset;

[0042] Monitor the real-time load of each service bandwidth and calculate the ratio of bandwidth usage. Specifically:

[0043]

[0044] Among them, U m Bb is the current service bandwidth m Utilization rate;

[0045] Dynamic weights are calculated based on service priority and bandwidth usage ratio. Specifically:

[0046]

[0047] When it is detected that the service bandwidth Bb is consumed, half of the reserved bandwidth Br is allocated according to the dynamic weight.

[0048] S500: Monitor the usage of the user's Internet package, and control the onboard device used by the user to go offline when the package expires. In this embodiment, there are many packages, such as audio and video packages, communication packages, office packages, etc. When the user accesses network data, this solution uses deep packet inspection to perform in-depth analysis of the uplink and downlink traffic data accessed by the user, and the parsed data type is included in the user's traffic usage to complete the monitoring of the user's package usage. The monitoring of the package also includes duration monitoring. Deep packet inspection can identify the user's network session identifier, such as IP address or MAC address, when the user accesses the network, and start recording the user's access start time, and continue to track the user's network access duration through traffic data packet detection, thereby monitoring the user's network usage duration in combination with the package content. Furthermore, based on the application layer protocol parsed in step S400, the user's network access traffic can be classified, such as video traffic, web traffic, social traffic, etc. Based on this, the proportion of each type of traffic in the user's total traffic access can be counted, and specific traffic types can be further controlled. For example, the user's access duration or access volume to high-bandwidth network data can be controlled to balance the network access of multiple users. Refined control can further improve the efficiency and rationality of bandwidth allocation.

[0049] Based on this, after completing the user's use management of the airborne satellite Internet, this embodiment further discloses a method for user network traffic statistics and report query. Specifically, based on the integrated interface constructed in step S200 of this embodiment, the user can query the specific usage of his traffic in real time. Through deep packet inspection, the user can know the specific access volume of each application and generate statistical reports for analysis and use by operation and maintenance personnel. And by summarizing the usage of traffic data by all users, the weight distribution between different applications can be optimized.

[0050] In summary, the airborne satellite Internet management method based on deep packet inspection disclosed in this embodiment avoids the problems of Internet access authentication, authorization and billing that can only be achieved by traditional AAA-RADIUS technology by applying deep packet inspection technology, and can support real-time monitoring of user Internet traffic, bandwidth guarantee, and refined control of Internet behavior. At the same time, by identifying and analyzing the user's traffic, the service accessed by the user can be detected, based on which, directional traffic access restrictions can be implemented, and further refined billing and user usage management can be achieved. The dynamic bandwidth allocation algorithm can allocate bandwidth to higher priority service access when bandwidth is tight to ensure smooth operation and access of key application services. The open interface further disclosed in this embodiment can support external developers to participate in the ecological construction of airborne satellite Internet.

[0051] refer to Figure 2 This embodiment further discloses an airborne satellite Internet management system based on deep packet inspection, including:

[0052] The authentication management module 21 is used to obtain the user's Internet access request, guide the user to complete the activation of the Internet access package and allow the user to connect to the Internet; specifically, it identifies whether the user is connected to the onboard satellite Internet network. If so, user authentication is performed; if the authentication is passed, different Internet access packages are pushed for selection and activation, and the user is guided to complete payment; after the payment is successful, Internet access is activated for the current user, and the Internet access strategy is matched according to the activated package type.

[0053] The authentication management module 21 is also used to monitor the usage of the user's Internet package and control the onboard device used by the user to go offline when the package expires;

[0054] The interface management module 22 is used to construct an integrated interface to manage user data and airborne network data.

[0055] The behavior monitoring module 23 is used to collect and analyze user traffic data based on an integrated interface using deep packet inspection technology; specifically, deep packet inspection is deployed between airborne satellite Internet links in bridging mode; traffic data of multiple users is identified through deep packet inspection; the header information of each layer added during the encapsulation of the traffic data packet is parsed and extracted, and the user application is identified and analyzed through feature matching. Specifically, the traffic data packet is parsed into an application layer and a basic layer, and the header information is extracted respectively; a regular rule set is constructed for the basic layer, and the regular rule set contains regular expressions for matching IP addresses and port numbers; an adaptive regular chain is constructed for the application layer, and the regular chain is dynamically updated to complete regular chain matching and realize the positioning of high-frequency traffic data; distributed parallel analysis is performed on the header information of the basic layer and the application layer; a multi-dimensional feature matrix is ​​constructed based on the analysis results and the corresponding header information to realize the identification and analysis of subsequent traffic data through feature matching.

[0056] The bandwidth management module 24 is used to construct a dynamic bandwidth allocation algorithm to dynamically allocate user bandwidth based on the identification and classification of the onboard real-time network load and user applications; specifically, the total bandwidth of the onboard satellite terminal is divided into a business bandwidth Bb and a reserved bandwidth Br; multiple initial weights S1, S2, ... S j , divide the service bandwidth into multiple Bb1, Bb2, ...Bb according to multiple initial weights m ; Set multiple business priorities A1, A2, ...A according to multiple application categories n ;Periodically detect the real-time network load of multiple service bandwidths and dynamically allocate them based on the initial weight and service priority. Specifically: monitor the authentication status of on-board users, and calculate the service offset based on the stage distribution, threshold ratio and guarantee offset of users with different authentication statuses, and complete the service priority adjustment. Specifically:

[0057]

[0058] in, is the stage distribution of users, α is the threshold ratio, i is the guaranteed offset, X k represents the number of users in user stage k, is the business offset;

[0059] Monitor the real-time load of each service bandwidth and calculate the ratio of bandwidth usage. Specifically:

[0060]

[0061] Among them, U m Bb is the current service bandwidth m Utilization rate;

[0062] Dynamic weights are calculated based on service priority and bandwidth usage ratio. Specifically:

[0063]

[0064] When it is detected that the service bandwidth Bb is consumed, half of the reserved bandwidth Br is allocated according to the dynamic weight.

[0065] Figure 3 A schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention, such as Figure 3 As shown, the electronic device 50 includes: a processor 501 (processor), a memory 502 (memory) and a bus 503;

[0066] The processor 501 and the memory 502 communicate with each other via the bus 503 ; the processor 501 is used to call program instructions in the memory 502 to execute the methods provided by the above-mentioned method implementation methods.

[0067] This embodiment provides a non-transitory computer-readable storage medium, which stores computer instructions. The computer instructions enable a computer to execute the methods provided by the above-mentioned method embodiments.

[0068] This embodiment provides a computer program product, including a computer program, and when the computer program is executed by a processor, the method provided by the above method embodiments is implemented.

[0069] A person skilled in the art can understand that all or part of the steps for implementing the above-mentioned method implementation method can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium, which, when executed, executes the steps of the above-mentioned method implementation method; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various storage media that can store program codes.

[0070] The device implementation described above is merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present implementation scheme. Those of ordinary skill in the art may understand and implement it without creative effort.

[0071] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each implementation method or some parts of the implementation method.

[0072] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for airborne satellite Internet management based on deep packet inspection, characterized in that: The method comprises: Obtain the user's Internet access request, guide the user to complete the Internet package activation and allow the user to connect to the Internet; Build an integrated interface to manage user data and airborne network data; Based on the integrated interface, deep packet inspection technology is used to collect and analyze user traffic data; Build a dynamic bandwidth allocation algorithm to dynamically allocate user bandwidth based on the identification and classification of onboard real-time network load and user applications; Monitor the usage of users' Internet packages and control the onboard devices used by users to go offline when the packages expire.

2. The airborne satellite Internet management method based on deep packet inspection as claimed in claim 1, characterized in that: The method of obtaining a user's Internet access request, guiding the user to complete Internet access package activation and allowing the user to connect to the Internet includes: Identify whether the user is connected to the onboard satellite Internet network, and if so, perform user authentication; If the authentication is successful, different Internet packages will be pushed for selection and activation, and the user will be guided to complete the payment; After the payment is successful, Internet access is enabled for the current user, and the Internet access strategy is matched according to the enabled package type.

3. The airborne satellite Internet management method based on deep packet inspection as claimed in claim 1, characterized in that: The method of applying deep packet inspection technology to collect and analyze user traffic data to identify and classify user applications and match Internet access strategies includes: Deploy deep packet inspection between onboard satellite Internet links in bridge mode; Identify traffic data of multiple users through deep packet inspection; Parse and extract the header information of each layer added during the encapsulation process of the traffic data packet, and use feature matching to identify and parse the user application.

4. The airborne satellite Internet management method based on deep packet inspection as claimed in claim 3, characterized in that: The method of parsing and extracting the header information of each layer added in the encapsulation process of the traffic data packet and realizing the identification and parsing of the user application through feature matching includes: Parse the traffic data packets into the application layer and the base layer, and extract the header information respectively; Constructing a regular rule set for the base layer, wherein the regular rule set contains regular expressions for matching IP addresses and port numbers; Build an adaptive regular chain for the application layer and dynamically update the regular chain to complete regular chain matching and locate high-frequency traffic data; Distributed parallel parsing of header information at the base layer and application layer; A multi-dimensional feature matrix is ​​constructed based on the analysis results and the corresponding header information to enable identification and analysis of subsequent traffic data through feature matching.

5. The airborne satellite Internet management method based on deep packet inspection as claimed in claim 1, characterized in that: The method of constructing a dynamic bandwidth allocation algorithm to dynamically allocate user bandwidth based on identification and classification of onboard real-time network load and user applications includes: Divide the total bandwidth of the airborne satellite terminal into business bandwidth Bb and reserved bandwidth Br; Set multiple initial weights S1, S2, ...S j , divide the service bandwidth into multiple Bb1, Bb2, ...Bb according to multiple initial weights m ; Set multiple service priorities A1, A2, ...A according to multiple application categories n ; The real-time network load of multiple service bandwidths is periodically detected and dynamically allocated based on initial weights and service priorities.

6. The airborne satellite Internet management method based on deep packet inspection as claimed in claim 5, characterized in that: The method of periodically detecting the real-time network loads of multiple service bandwidths and dynamically allocating them based on initial weights and service priorities includes: Monitor the authentication status of users on board, calculate the service offset based on the stage distribution, threshold ratio and guarantee offset of users with different authentication status, and complete the service priority adjustment. Specifically: in, is the stage distribution of users, α is the threshold ratio, i is the guaranteed offset, X k represents the number of users in the current stage k, is the business offset; Monitor the real-time load of each service bandwidth and calculate the ratio of bandwidth usage. Specifically: Among them, U m Bb is the current service bandwidth m Utilization rate; Dynamic weights are calculated based on service priority and bandwidth usage ratio. Specifically: When it is detected that the service bandwidth Bb is consumed, half of the reserved bandwidth Br is allocated according to the dynamic weight.

7. An airborne satellite Internet management system based on deep packet inspection, characterized in that: include: The authentication management module is used to obtain the user's Internet access request, guide the user to complete the Internet package activation and allow the user to connect to the Internet; Also used for Monitor the usage of users' Internet packages and control the onboard devices used by users to go offline when the packages expire; The interface management module is used to build an integrated interface to manage user data and airborne network data; Behavior monitoring module, used to collect and analyze user traffic data using deep packet inspection technology; The bandwidth management module is used to build a dynamic bandwidth allocation algorithm to dynamically allocate user bandwidth based on the identification and classification of onboard real-time network load and user applications.

8. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images