Network flow distribution system based on rule matching

Abstract

The invention relates to the technical field of data processing, in particular to a network traffic distribution system based on rule matching, which is characterized in that a target distribution rule is screened out according to a matching result of an initial field name combination and a preset field name combination, and a target port is screened out according to a hit result between second intermediate traffic data and the target distribution rule. The target traffic data, the equipment information and the rule number are jointly distributed to the ports, so that the traffic type processed by each target port can be accurately determined, the traffic data distribution is better matched with the performance and characteristics of the equipment, network management personnel can clearly know the data distribution condition, and the network management efficiency is improved. The traffic can be accurately distributed to the appropriate processing port, the efficiency problem and the potential safety hazard caused by blind distribution are avoided, meanwhile, when the service demand changes, rule screening and matching can be carried out on new target traffic data only by adjusting the preset distribution rule, and the efficiency is improved. And the expandability and the distribution accuracy of the network flow distribution system are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a network traffic distribution system based on rule matching. Background Art

[0002] With the continuous development and diversification of Internet applications, a large amount of network traffic needs to be reasonably distributed among different devices and systems. The efficient distribution of network traffic is crucial.

[0003] Existing traffic distribution methods often rely on IP addresses or ports, and distribute data according to the source IP address, destination IP address or port number of the network traffic. When faced with complex and changeable network traffic data, traditional traffic distribution methods lack flexibility, scalability, and accurate identification and classification mechanisms. When business needs change and new traffic types or specific traffic rules need to be processed, it is often difficult to quickly and effectively adjust the distribution strategy. At the same time, it is difficult to accurately distinguish network traffic data from different sources and characteristics, resulting in blind distribution, which may cause low processing efficiency and may even cause system failures or data loss due to incorrect distribution, limiting users' ability to cope with the ever-changing market environment and business needs.

[0004] Therefore, how to improve the scalability and distribution accuracy of network traffic distribution systems has become an urgent problem to be solved. Summary of the invention

[0005] In view of the above technical problems, the technical solution adopted by the present invention is a network traffic distribution system based on rule matching, which includes a processor and a memory storing a computer program, wherein the memory also stores N target traffic data, a plurality of preset distribution rules, and a preset field name combination, a preset port and a rule number corresponding to each preset distribution rule. When the computer program is executed by the processor, the following steps are implemented:

[0006] S1, for any target flow data, extract all initial field names corresponding to the current target flow data, and first intermediate flow data corresponding to each initial field name.

[0007] S2, according to all the initial field names and the first intermediate flow data corresponding to each initial field name, obtain all the initial field name combinations corresponding to the current target flow data and the second intermediate flow data corresponding to each initial field name combination.

[0008] S3, according to each preset field name combination, the preset distribution rule corresponding to each preset field name combination, each initial field name combination and the second intermediate traffic data corresponding to each initial field name combination, filter out the target distribution rule corresponding to each second intermediate traffic data from all the preset distribution rules.

[0009] S4, matching each second intermediate traffic data with the corresponding target distribution rule, and obtaining a hit result between each second intermediate traffic data and the corresponding target distribution rule.

[0010] S5, according to the hit result between each second intermediate traffic data and the corresponding target distribution rule, and the preset port corresponding to each target distribution rule, obtain the target port corresponding to each second intermediate traffic data.

[0011] S6, distributing the current target flow data, the device information corresponding to the current target flow data, and the rule number corresponding to the target port according to the target port.

[0012] The present invention has at least the following beneficial effects: the target distribution rule is screened out according to the matching result between the initial field name combination corresponding to the target traffic data and the preset field name combination corresponding to the preset distribution rule; the target port is screened out according to the hit result between the second intermediate traffic data and the corresponding target distribution rule, so as to ensure that the traffic is accurately distributed to the appropriate processing port, avoiding the efficiency problems and safety hazards caused by blind distribution; the target traffic data is distributed to the port together with the device information and the rule number corresponding to the target port, so as to accurately determine the traffic type processed by each target port, better match the traffic data distribution with the performance and characteristics of the device, reasonably distribute the target traffic data to the port corresponding to the efficient processing device, avoid the misdistribution of traffic data, and facilitate network management personnel to clearly understand what kind of traffic data sent from which device is distributed to which port according to what rule, thereby improving the operation efficiency and reliability of the entire network system; at the same time, when business needs change, only the corresponding preset distribution rules and field name combinations need to be adjusted or added to perform rule screening and matching on the new target traffic data, thereby improving the scalability and distribution accuracy of the network traffic distribution system. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0014] Figure 1A flowchart of a processor executing a computer program to implement a rule-matching-based network traffic distribution system provided in Embodiment 1 of the present invention. DETAILED DESCRIPTION

[0015] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0016] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It is understood that, where appropriate, the above-mentioned terms used to distinguish similar objects can be interchanged so that the present invention can also implement other embodiments other than the above-mentioned illustrated embodiments or described embodiments. In addition, the terms "including" and "having" and any variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0017] Embodiment 1

[0018] The first embodiment provides a network traffic distribution system based on rule matching, which includes a processor and a memory storing a computer program, wherein the memory further stores N target traffic data, device information corresponding to the target traffic data, a plurality of preset distribution rules, and a preset field name combination, a preset port, and a rule number corresponding to each preset distribution rule. When the computer program is executed by the processor, the following steps are implemented, such as: Figure 1 As shown:

[0019] S1, for any target flow data, extract all initial field names corresponding to the current target flow data, and first intermediate flow data corresponding to each initial field name.

[0020] Among them, target traffic data refers to various data generated and transmitted at the network user end and the server end, which needs to be reasonably transmitted through the traffic distribution system. Target traffic data can include data packet header information and data payload, wherein the data packet header information contains key information such as source IP address, destination IP address, source port, destination port, protocol type (such as TCP, UDP), etc., which is used to determine the source, destination and transmission method of data in the network. Data payload is the core content of network traffic data, that is, the data actually to be transmitted, which can be various types of data such as text, images, audio, video, application data, etc. Taking online video services as an example, video stream data is the data payload part of network traffic data. The size and format of data payload depends on the specific application scenario and the network service adopted.

[0021] For example, target traffic data may include data generated when users visit websites, use mobile applications, and so on. For example, when users browse products on e-commerce websites, the data generated by each click and search operation of the users will form network traffic. These data include user request information, such as instructions for requesting to view the details page of a certain product, and the data content includes the user's IP address, request time, requested webpage URL, etc. Target traffic data may also include relevant data such as response data and push data generated by the server. For example, for online game servers, the server needs to continuously send game scene update data, other players' operation data, and other data to the player client. The size, frequency, and importance of the data vary. When transmitted in the network, network traffic is formed, and it needs to be reasonably transmitted to the client through the traffic distribution system.

[0022] Device information may include device number, slot number and board number, which are used to identify the physical transmission line of target traffic data. When the target traffic data is transmitted on the physical line, the device number can be used to track the device path through which the target traffic data passes. The slot number can help determine the specific module path through which the target traffic data passes. The board number can indicate the processing path of the target traffic data inside the device.

[0023] The preset distribution rules and their corresponding preset field name combinations are used to determine whether the target traffic data complies with the output rules of the corresponding port. The specific preset distribution rules and the corresponding preset field name combinations can be set by the implementer according to actual conditions.

[0024] For example, the preset distribution rules in this embodiment may include distribution rules based on quintuples, and the corresponding preset field name combination may include source IP address, destination IP address, source port, destination port and protocol type. Based on the distribution rules of feature codes, the corresponding preset field name combination may include source IP address feature code, destination IP address feature code, source port feature code, destination port feature code, network layer protocol feature code, transport layer protocol feature code, application layer protocol feature code, text content feature code and binary content feature code. Based on the distribution rules of authentication accounts, the corresponding preset field name combination may include account type, authentication status, authentication method, department and account authority level. Based on the distribution rules of audio and video, the corresponding preset field name combination may include protocol type and audio and video encoding format. Based on the distribution rules of attachment types carried by HTTP messages, the corresponding preset field name combination may include data type and file extension name. Based on the distribution rules of domain names, the corresponding preset field name combination may include domain names and domain name suffixes. Based on the distribution rules of models, the corresponding preset field name combination may include model identifiers and model parameters.

[0025] Therefore, this embodiment performs field extraction and corresponding data extraction on the target traffic data, obtains all initial field names corresponding to the target traffic data, and the first intermediate traffic data corresponding to each initial field name, as the basis for filtering the preset distribution rules, thereby determining the target port for data distribution transmission.

[0026] The first intermediate flow data refers to data representing the specific content of the corresponding initial field name.

[0027] In a specific implementation, the target flow data is obtained by the following steps:

[0028] S01, obtaining original traffic data and a preset data packet quantity threshold M, where M is an integer greater than 0.

[0029] S02, determining the first M packets of flow data in the original flow data as target flow data.

[0030] The preset data packet quantity threshold M can be set according to actual conditions. For example, M can be set to be no greater than the number of target devices. In the network traffic distribution scenario, the target device can refer to a network splitter, which mainly collects, filters, aggregates, and load balances the target traffic data.

[0031] S2, according to all the initial field names and the first intermediate flow data corresponding to each initial field name, obtain all the initial field name combinations corresponding to the current target flow data and the second intermediate flow data corresponding to each initial field name combination.

[0032] In a specific implementation, S2 includes the following steps:

[0033] S21, randomly combine all the initial field names to obtain all the initial field name combinations corresponding to the current target traffic data.

[0034] S22, according to the first intermediate flow data corresponding to each initial field name, the first intermediate flow data corresponding to all the initial field names in each initial field name combination are combined to obtain the second intermediate flow data corresponding to each initial field name combination.

[0035] Among them, each preset distribution rule may correspond to a single or multiple field names. Therefore, this embodiment randomly combines all the initial field names to obtain the initial field name combination, which is used to match the preset field name combination corresponding to the preset distribution rule, so as to filter out the target distribution rule corresponding to the target traffic data from the preset distribution rules.

[0036] At the same time, according to the first intermediate traffic data corresponding to each initial field name, the first intermediate traffic data corresponding to all the initial field names in each initial field name combination are combined, and the second intermediate traffic number corresponding to each initial field name combination is obtained, which is used to match the corresponding target distribution rule as the basis for distributing the target traffic data.

[0037] As described above, based on all the initial field names and the first intermediate flow data corresponding to each initial field name, all the initial field name combinations corresponding to the current target flow data and the second intermediate flow data corresponding to each initial field name combination are obtained, which can deeply explore the characteristics of the target flow data, provide a basis for screening out the target distribution rules corresponding to the target flow data and distributing the target flow data, and ensure that the target flow data is accurately distributed to the appropriate processing port, thereby improving the distribution accuracy of the network flow distribution system and avoiding the efficiency problems and safety hazards caused by blind distribution.

[0038] S3, according to each preset field name combination, the preset distribution rule corresponding to each preset field name combination, each initial field name combination and the second intermediate traffic data corresponding to each initial field name combination, filter out the target distribution rule corresponding to each second intermediate traffic data from all the preset distribution rules.

[0039] In a specific implementation, S3 includes the following steps:

[0040] S31, for any initial field name combination, matching the current initial field name combination with each preset field name combination, obtaining a matching result between the current initial field name combination and each preset field name combination, wherein the matching result includes a match and a mismatch.

[0041] S32, for any preset field name combination, if the matching result between the current initial field name combination and the current preset field name combination is a match, the preset distribution rule corresponding to the current preset field name combination is determined as the target distribution rule corresponding to the second intermediate traffic data corresponding to the current initial field name combination.

[0042] S33, traverse all initial field name combinations and all preset field name combinations to obtain the target distribution rule corresponding to each second intermediate traffic data.

[0043] Among them, when all the field names in the initial field name combination are consistent with all the field names in the current preset field name combination, it can be determined that the matching result between the current initial field name combination and the current preset field name combination is a match, and the preset distribution rule corresponding to the current preset field name combination can be determined as the target distribution rule corresponding to the second intermediate flow data corresponding to the current initial field name combination, so that the target distribution rule can be used to perform a hit judgment on the corresponding second intermediate flow data as the basis for distributing the target flow data, which can ensure that the target flow data is accurately distributed to the appropriate processing port, thereby improving the distribution accuracy of the network flow distribution system and avoiding efficiency problems and safety hazards caused by blind distribution.

[0044] S4, matching each second intermediate traffic data with the corresponding target distribution rule, and obtaining a hit result between each second intermediate traffic data and the corresponding target distribution rule.

[0045] Among them, the specific content of the target distribution rules includes requirements for traffic data. Taking the distribution rules based on authenticated accounts as an example, the specific content can be that the account type is a personal account, the authentication status is authenticated, the authentication method is mobile phone number authentication, the department is Department A, and the account authority level is general authority.

[0046] Therefore, each second intermediate traffic data is matched with the corresponding target distribution rule to determine whether each second intermediate traffic data meets the requirements of the corresponding target distribution rule, thereby obtaining a hit result between each second intermediate traffic data and the corresponding target distribution rule.

[0047] Wherein, the hit result includes a hit and a miss. Correspondingly, if the second intermediate flow data meets the requirements in the corresponding target distribution rule, the hit result between the second intermediate flow data and the corresponding target distribution rule is determined to be a hit, and the target flow data can be output through the preset port corresponding to the target distribution rule. If the second intermediate flow data does not meet the requirements in the corresponding target distribution rule, the hit result between the second intermediate flow data and the corresponding target distribution rule is determined to be a miss, and the target flow data does not need to be output through the preset port corresponding to the target distribution rule.

[0048] In the above, each second intermediate flow data is matched with the corresponding target distribution rule, and a hit result between each second intermediate flow data and the corresponding target distribution rule is obtained as the basis for distributing the target flow data. This can ensure that the target flow data is accurately distributed to the appropriate processing port, thereby improving the distribution accuracy of the network flow distribution system and avoiding efficiency problems and safety hazards caused by blind distribution.

[0049] S5, according to the hit result between each second intermediate traffic data and the corresponding target distribution rule, and the preset port corresponding to each target distribution rule, obtain the target port corresponding to each second intermediate traffic data.

[0050] In a specific implementation, the hit result includes a hit and a miss, and S5 includes the following steps:

[0051] S51, for any second intermediate traffic data, if the hit result between the current second intermediate traffic data and the corresponding target distribution rule is a hit, the preset port corresponding to the target distribution rule corresponding to the current second intermediate traffic data is determined as the target port corresponding to the current second intermediate traffic data.

[0052] S52, traverse all the second intermediate flow data, and obtain the target port corresponding to each second intermediate flow data.

[0053] S6, distributing the current target flow data, the device information corresponding to the current target flow data, and the rule number corresponding to the target port according to the target port.

[0054] In a specific implementation manner, the memory also stores the data volume and data input time corresponding to each target flow data, and the data processing rate and initial data volume corresponding to each target port, and S6 further includes the following steps:

[0055] S61, according to the data input time and a number of target ports corresponding to each target flow data, obtaining the data input queues corresponding to the N target flow data and the 0th target flow data queue corresponding to each target port;

[0056] S62, initializing i=1;

[0057] S63, according to the target ports corresponding to each target flow data, the output port corresponding to the i-1th target flow data, and the i-1th target flow data queue corresponding to each target port, obtain the i-th target flow data queue corresponding to each target port;

[0058] S64, for any target port, according to the i-th target traffic data queue corresponding to the current target port, the data volume corresponding to each target traffic data, the data processing rate corresponding to the current target port, and the initial data volume, obtain the output end time corresponding to each target traffic data in the i-th target traffic data queue corresponding to the current target port at the current target port;

[0059] S65, acquiring the output port corresponding to the i-th target flow data according to the output end time corresponding to each corresponding target port of the i-th target flow data in the data input queue;

[0060] S66, according to the output port corresponding to the i-th target flow data, update i=i+1, return to execute step S63, until i=N, and obtain the output ports corresponding to the 1st to Nth target flow data respectively;

[0061] S67, distributing corresponding target flow data, corresponding device information and corresponding rule number according to each output port.

[0062] The data input time refers to the time for calling the target flow data to be output from the port, which can represent the order in which the target flow data is subjected to port screening processing.

[0063] The data processing rate refers to the amount of data that the corresponding port can process per unit time. It is usually measured in units such as bits per second (bps), kilobits per second (kbps), megabits per second (Mbps) or gigabits per second (Gbps), reflecting the data transmission and processing capabilities of the corresponding port.

[0064] The initial data volume refers to the amount of unprocessed data in the traffic data being processed by each port when the first target traffic data is called for distribution and output. Correspondingly, before processing the gradually input new target traffic data, the port needs to first process the data corresponding to the initial data volume.

[0065] After determining the output port corresponding to the i-th target traffic data, by updating the value of i to i+1 and then returning to execute step S400, the 1st to N-th target traffic data can be processed in sequence, and in each iteration, the output port of the next target traffic data is recalculated based on the previous calculation results and the current network status, including the data processing rate of each port, the data volume of each target traffic data, and the input time and other factors, to ensure that the entire network traffic distribution control process covers all target traffic data.

[0066] In a specific implementation, S61 includes the following steps:

[0067] S610, sorting N target traffic data in order of data input time from earliest to latest, and obtaining data input queues corresponding to the N target traffic data.

[0068] S620: According to the target port corresponding to each target flow data, all target flow data corresponding to each target port are acquired.

[0069] S630, for any target port, sort all target flow data corresponding to the current target port in order of data input time from earliest to latest, and obtain the 0th target flow data queue corresponding to the current target port.

[0070] As described above, the target traffic data is sorted according to the data input time corresponding to the target traffic data from early to late, and the port screening and distribution control are performed preferentially on the target traffic data input earlier, thereby avoiding the backlog of early data by subsequent data while waiting for processing, reducing the queuing waiting time of early data, and thus accelerating the network interaction process.

[0071] In a specific implementation, when i=1, the 0th target flow data and the output port corresponding to the 0th target flow data are both empty.

[0072] Among them, when i=1, it is clear that the output ports corresponding to the 0th target flow data and the 0th target flow data are both empty, which serves as the initial state of the entire process and provides a benchmark for subsequent iterative operations.

[0073] In a specific implementation, S63 includes the following steps:

[0074] S631, determine the i-1th target flow data queue corresponding to the output port corresponding to the i-1th target flow data as the i-th target flow data queue corresponding to the output port corresponding to the i-1th target flow data.

[0075] S632, according to the several target ports corresponding to each target flow data and the output port corresponding to the i-1th target flow data, the target ports other than the output port corresponding to the i-1th target flow data are determined as non-output ports corresponding to the i-1th target flow data.

[0076] S633, delete the i-1th target traffic data from the i-1th target traffic data queue corresponding to the non-output port corresponding to the i-1th target traffic data, and obtain the i-th target traffic data queue corresponding to the non-output port corresponding to the i-1th target traffic data.

[0077] Among them, when transitioning from the i-1 step to the i-th step, for the output port corresponding to the previous target traffic data, its queue will naturally continue to the next iteration step when there is no new operation impact. For the non-output port corresponding to the previous target traffic data, the target traffic data queue corresponding to the non-output port is updated by removing the target traffic data that has been processed at other ports (i.e., the output port corresponding to the i-1th target traffic data), so as to ensure that the queue data of each port accurately reflects the current traffic processing situation, so that the target traffic data queue corresponding to each target port can be accurately obtained in each iteration step (i from 1 to N), which provides an important data basis for determining the output end time of each target traffic data at the port and other subsequent traffic data distribution control operations, thereby improving the accuracy and efficiency of network traffic distribution and improving the quality of network services.

[0078] In a specific implementation, S64 includes the following steps:

[0079] S641, for any target traffic data in the i-th target traffic data queue corresponding to the current target port, based on the i-th target traffic data queue corresponding to the current target port and the data volume corresponding to each target traffic data, the sum of the data volume corresponding to any target traffic data, the data volume corresponding to all target traffic data sorted before any target traffic data in the i-th target traffic data queue, and the initial data volume corresponding to the current target port is determined as the reference data volume corresponding to any target traffic data.

[0080] S642, according to the reference data volume and the data processing rate corresponding to the current target port, obtain the output end time corresponding to any target flow data at the current target port.

[0081] The ratio of the reference data volume to the data processing rate corresponding to the current target port is determined as the output end time corresponding to any target flow data at the current target port.

[0082] As mentioned above, by comprehensively considering factors such as the target traffic data queue, data volume, port data processing rate and initial data volume, the output end time of each target traffic data in the i-th target traffic data queue corresponding to any target port at the port is determined, which is of great significance for accurately controlling the processing and distribution order of the target traffic data at each port, and can achieve accurate estimation of the processing time of the target traffic data, providing a data basis for improving the accuracy and efficiency of network traffic distribution.

[0083] In a specific implementation, S65 includes the following steps:

[0084] S651, compare the output end time corresponding to each corresponding target port of the i-th target flow data in the data input queue, and determine the target port corresponding to the minimum output end time as the output port corresponding to the i-th target flow data.

[0085] Since the data processing rate, initial data volume and current target flow data queue of each target port are different, the processing end time of the same target flow data at different target ports may be different.

[0086] By comparing these output end times, the target port corresponding to the smallest output end time is determined as the output port corresponding to the i-th target traffic data, so as to select the target port that can complete the processing and output of the i-th target traffic data as quickly as possible, thereby minimizing the transmission delay of the target traffic data in the network and improving the overall processing efficiency of the network traffic.

[0087] In the above, by comprehensively considering the output end time corresponding to the target flow data at each target port, the optimal output port is selected to achieve efficient distribution and rapid processing of the target flow data, thereby improving the accuracy and efficiency of network flow distribution.

[0088] In a specific implementation, the memory also stores device information corresponding to each target flow data, and S67 further includes the following steps:

[0089] S671, acquiring target distribution data corresponding to each target flow data according to each target flow data, device information corresponding to each target flow data, and a rule number corresponding to each output port;

[0090] S672, distribute the target distribution data corresponding to each output port to the corresponding output port.

[0091] In a specific implementation, S671 includes the following steps:

[0092] S6711, obtain a preset first data combination template, where the first data combination template includes a first position corresponding to the target traffic data, a second position corresponding to the device information, and a third position corresponding to the rule number.

[0093] S6712, fill each target flow data, the device information corresponding to each target flow data and the rule number corresponding to each output port into the first data combination template, and obtain the target distribution data corresponding to each target flow data.

[0094] Among them, the rule number corresponding to the target distribution rule corresponding to the output port can accurately determine the type of traffic processed by each output port, avoid misdistribution of traffic data, and ensure that each output port receives traffic data that meets its processing capabilities and business needs.

[0095] Different devices may have different processing power, storage capacity, and network interface speeds.

[0096] Therefore, by distributing the target traffic data together with the device information and the rule number corresponding to the output port to the port, the traffic data distribution can be better matched with the performance and characteristics of the device, and the target traffic data can be reasonably allocated to the port corresponding to the efficient processing device. At the same time, it is convenient for network management personnel to clearly understand what kind of traffic data sent from which device is distributed to which port according to what rules, thereby improving the operating efficiency and reliability of the entire network system.

[0097] In a specific implementation manner, the memory further stores reference flow data corresponding to each target flow data, and S671 further includes the following steps:

[0098] S6713, deleting the corresponding reference flow data from each target flow data, and obtaining the to-be-distributed flow data corresponding to each target flow data;

[0099] S6714, according to the to-be-distributed traffic data and device information corresponding to each target traffic data, and the rule number corresponding to each output port, the target distribution data corresponding to each target traffic data is obtained.

[0100] In a specific implementation, S6714 includes the following steps:

[0101] S6715, obtaining a preset second data combination template, wherein the second data combination template includes a fourth position corresponding to the traffic data to be distributed, a second position corresponding to the device information, and a third position corresponding to the rule number;

[0102] S6716, fill the to-be-distributed traffic data and device information corresponding to each target traffic data, and the rule number corresponding to each output port into the second data combination template, and obtain the target distribution data corresponding to each target traffic data.

[0103] The reference traffic data may refer to data transmitted in the network tunnel technology, which is a technology that encapsulates data of one protocol in a data message of another protocol for transmission. The tunnel data may contain sensitive internal information of the enterprise or user privacy data. Therefore, in order to improve the security of data transmission, this embodiment deletes the tunnel data during the distribution of the target traffic data, and distributes the remaining traffic data to be distributed, device information and the rule number corresponding to each target port to the corresponding target port.

[0104] As described above, the target traffic data is distributed to the port together with the device information and the rule number corresponding to the target port, which can accurately determine the type of traffic processed by each target port, better match the traffic data distribution with the performance and characteristics of the device, and reasonably distribute the target traffic data to the port corresponding to the efficient processing device to avoid the misdistribution of traffic data. At the same time, it is convenient for network management personnel to clearly understand what kind of traffic data sent from which device is distributed to which port according to what rules, thereby improving the operating efficiency and reliability of the entire network system.

[0105] In the above, the target distribution rules are screened out according to the matching results between the initial field name combination corresponding to the target traffic data and the preset field name combination corresponding to the preset distribution rule, and the target port is screened out according to the hit result between the second intermediate traffic data and the corresponding target distribution rule, which can ensure that the traffic is accurately distributed to the appropriate processing port, avoiding efficiency problems and safety hazards caused by blind distribution, and distributing the target traffic data to the port together with the device information and the rule number corresponding to the target port, which can accurately determine the type of traffic processed by each target port, better match the traffic data distribution with the performance and characteristics of the device, and reasonably distribute the target traffic data to the port corresponding to the efficient processing device to avoid the misdistribution of traffic data. At the same time, it is convenient for network management personnel to clearly understand what kind of traffic data sent from which device is distributed to which port according to what rules, thereby improving the operating efficiency and reliability of the entire network system. At the same time, when business needs change, only the corresponding preset distribution rules and field name combinations need to be adjusted or added to perform rule screening and matching on the new target traffic data, thereby improving the scalability and distribution accuracy of the network traffic distribution system.

[0106] Although some specific embodiments of the present invention have been described in detail by way of example, it should be understood by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present invention. It should also be understood by those skilled in the art that various modifications may be made to the embodiments without departing from the scope and spirit of the present invention. The scope of the present invention is defined by the appended claims.

Claims

1. A network traffic distribution system based on rule matching, characterized in that: The network traffic distribution system based on rule matching includes a processor and a memory storing a computer program, wherein the memory further stores N target traffic data, device information corresponding to the target traffic data, a plurality of preset distribution rules, and a preset field name combination, a preset port and a rule number corresponding to each preset distribution rule. When the computer program is executed by the processor, the following steps are implemented: S1, for any target flow data, extract all initial field names corresponding to the current target flow data, and first intermediate flow data corresponding to each initial field name; S2, according to all the initial field names and the first intermediate flow data corresponding to each initial field name, obtaining all the initial field name combinations corresponding to the current target flow data and the second intermediate flow data corresponding to each initial field name combination; S3, according to each preset field name combination, the preset distribution rule corresponding to each preset field name combination, each initial field name combination and the second intermediate traffic data corresponding to each initial field name combination, filter out the target distribution rule corresponding to each second intermediate traffic data from all the preset distribution rules; S4, matching each second intermediate traffic data with the corresponding target distribution rule, and obtaining a hit result between each second intermediate traffic data and the corresponding target distribution rule; S5, acquiring the target port corresponding to each second intermediate traffic data according to the hit result between each second intermediate traffic data and the corresponding target distribution rule, and the preset port corresponding to each target distribution rule; S6, distributing the current target flow data, the device information corresponding to the current target flow data, and the rule number corresponding to the target port according to the target port.

2. The network traffic distribution system based on rule matching according to claim 1 is characterized in that: The target traffic data is obtained through the following steps: S01, obtaining original traffic data and a preset data packet quantity threshold M, where M is an integer greater than 0; S02, determining the first M packets of flow data in the original flow data as target flow data.

3. The network traffic distribution system based on rule matching according to claim 1 is characterized in that: S2 includes the following steps: S21, randomly combine all the initial field names to obtain all the initial field name combinations corresponding to the current target traffic data; S22, according to the first intermediate flow data corresponding to each initial field name, the first intermediate flow data corresponding to all the initial field names in each initial field name combination are combined to obtain the second intermediate flow data corresponding to each initial field name combination.

4. The network traffic distribution system based on rule matching according to claim 1 is characterized in that: S3 includes the following steps: S31, for any initial field name combination, matching the current initial field name combination with each preset field name combination, and obtaining a matching result between the current initial field name combination and each preset field name combination, wherein the matching result includes a match and a mismatch; S32, for any preset field name combination, if the matching result between the current initial field name combination and the current preset field name combination is a match, determining the preset distribution rule corresponding to the current preset field name combination as the target distribution rule corresponding to the second intermediate traffic data corresponding to the current initial field name combination; S33, traverse all initial field name combinations and all preset field name combinations to obtain the target distribution rule corresponding to each second intermediate traffic data.

5. The network traffic distribution system based on rule matching according to claim 1 is characterized in that: The hit result includes a hit and a miss, and S5 includes the following steps: S51, for any second intermediate traffic data, if the hit result between the current second intermediate traffic data and the corresponding target distribution rule is a hit, then the preset port corresponding to the target distribution rule corresponding to the current second intermediate traffic data is determined as the target port corresponding to the current second intermediate traffic data; S52, traverse all the second intermediate flow data, and obtain the target port corresponding to each second intermediate flow data.

6. The network traffic distribution system based on rule matching according to claim 1 is characterized in that: The memory also stores the data volume and data input time corresponding to each target flow data, and the data processing rate and initial data volume corresponding to each target port. S6 also includes the following steps: S61, according to the data input time and a number of target ports corresponding to each target flow data, obtaining the data input queues corresponding to the N target flow data and the 0th target flow data queue corresponding to each target port; S62, initializing i=1; S63, according to the target ports corresponding to each target flow data, the output port corresponding to the i-1th target flow data, and the i-1th target flow data queue corresponding to each target port, obtain the i-th target flow data queue corresponding to each target port; S64, for any target port, according to the i-th target traffic data queue corresponding to the current target port, the data volume corresponding to each target traffic data, the data processing rate corresponding to the current target port, and the initial data volume, obtain the output end time corresponding to each target traffic data in the i-th target traffic data queue corresponding to the current target port at the current target port; S65, acquiring the output port corresponding to the i-th target flow data according to the output end time corresponding to each corresponding target port of the i-th target flow data in the data input queue; S66, according to the output port corresponding to the i-th target flow data, update i=i+1, return to execute step S63, until i=N, and obtain the output ports corresponding to the 1st to Nth target flow data respectively; S67, distributing corresponding target flow data, corresponding device information and corresponding rule number according to each output port.

7. The network traffic distribution system based on rule matching according to claim 6 is characterized in that: The memory also stores device information corresponding to each target flow data, and S67 further includes the following steps: S671, acquiring target distribution data corresponding to each target flow data according to each target flow data, device information corresponding to each target flow data, and a rule number corresponding to each output port; S672, distribute the target distribution data corresponding to each output port to the corresponding output port.

8. The network traffic distribution system based on rule matching according to claim 7 is characterized in that: S671 also includes the following steps: S6711, obtaining a preset first data combination template, wherein the first data combination template includes a first position corresponding to the target traffic data, a second position corresponding to the device information, and a third position corresponding to the rule number; S6712, fill each target flow data, the device information corresponding to each target flow data and the rule number corresponding to each output port into the first data combination template, and obtain the target distribution data corresponding to each target flow data.

9. The network traffic distribution system based on rule matching according to claim 7, characterized in that: The memory also stores reference flow data corresponding to each target flow data. S671 further includes the following steps: S6713, deleting the corresponding reference flow data from each target flow data, and obtaining the to-be-distributed flow data corresponding to each target flow data; S6714, according to the to-be-distributed traffic data and device information corresponding to each target traffic data, and the rule number corresponding to each output port, the target distribution data corresponding to each target traffic data is obtained.

10. The network traffic distribution system based on rule matching according to claim 9, characterized in that: S6714 includes the following steps: S6715, obtaining a preset second data combination template, wherein the second data combination template includes a fourth position corresponding to the traffic data to be distributed, a second position corresponding to the device information, and a third position corresponding to the rule number; S6716, fill the to-be-distributed traffic data and device information corresponding to each target traffic data, and the rule number corresponding to each output port into the second data combination template, and obtain the target distribution data corresponding to each target traffic data.

Images