Industrial internet client network flow control method, device, equipment and medium

Abstract

The invention relates to an industrial internet client network flow control method, device and equipment and a medium. The method comprises the following steps: acquiring a network flow data packet of each network connection request from an industrial internet client; the whale optimization algorithm is adopted to carry out feature extraction on the network flow data packets so as to determine a flow feature combination, and the flow feature combination comprises any multiple items of total flow, uplink and downlink flow bit rates, average packet length, total packet number, retransmission packet number, retransmission rate packet number, packet loss rate and response time delay; performing traffic identification on the network traffic data packet by adopting a traffic identification model trained by traffic feature combination to determine the traffic type of each quintuple corresponding to each network connection request; and determining a network configuration strategy corresponding to each network connection request according to the flow type corresponding to each quintuple. The application can improve the overall network performance and optimize the user experience.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to an industrial Internet client network traffic control method, corresponding device, electronic device and computer-readable storage medium. Background Art

[0002] Two common network traffic classification methods in the industrial Internet also have shortcomings. One is a traffic classification method based on port numbers, which identifies different network application protocols according to the source port number and destination port number of the TCP segment or UDP datagram header. In the early days of the Internet, there were fewer network applications, and different applications used different network protocols. The Internet Assigned Numbers Authority (IANA) assigned certain port numbers to several commonly used network protocols. This classification method is simple and convenient. However, with the development of the Internet, the number and types of application software are constantly increasing. Coupled with the emergence of technologies such as port obfuscation, the classification accuracy of this classification method has continued to decline, and it can no longer meet people's needs for network traffic classification. The other is a traffic classification method based on deep packet inspection (DPI), which determines the traffic category by matching the payload part of the data packet with the predefined feature expressions of each category. Although applications with characteristic strings can be identified more accurately, the analysis cost is too high. After data is encrypted, it becomes increasingly difficult to extract feature strings. Therefore, DPI can only be used to identify known non-encrypted traffic, and may also lead to information security issues such as privacy leakage [1].

[0003] At the same time, in the Industrial Internet (Internet of Things, IoT), the currently commonly used message feature extraction technology relies on existing network device fingerprints. Network device fingerprints refer to the various feature information contained in the messages sent by the device. It requires a lot of manpower to analyze and extract device fingerprints, which is too costly and time-consuming.

[0004] To sum up, deep packet inspection in the existing technology can only be used to identify known non-encrypted traffic, and may bring about information security problems such as privacy leakage. In addition, the message feature extraction technology relies on existing network device fingerprints, which requires a lot of manpower to analyze and extract device fingerprints, and has problems such as high cost and long time. The applicant has made corresponding explorations to solve this problem. Summary of the invention

[0005] The purpose of this application is to solve the above-mentioned problems and provide an industrial Internet client network traffic control method, corresponding device, electronic device and computer-readable storage medium.

[0006] In order to meet the various objectives of this application, this application adopts the following technical solutions:

[0007] An industrial Internet client network traffic control method proposed to meet one of the purposes of this application includes:

[0008] Responding to the instruction to control the flow of the industrial Internet client, obtaining the network flow data packets from each network connection request in the industrial Internet client;

[0009] A whale optimization algorithm is used to extract features of the network traffic data packets to determine a traffic feature combination, wherein the traffic feature combination includes any multiple items of total traffic, uplink and downlink traffic bit rate, average packet length, total number of packets, number of retransmission packets, number of retransmission rate packets, packet loss rate, and response delay;

[0010] Using a traffic identification model trained with the traffic feature combination, the network traffic data packet is subjected to traffic identification to determine the traffic type of each five-tuple corresponding to each network connection request;

[0011] The network configuration strategy corresponding to each network connection request is determined according to the traffic type corresponding to each quintuple to complete the network traffic control of the industrial Internet client.

[0012] Optionally, the step of extracting features from the network traffic data packets using a whale optimization algorithm to determine a traffic feature combination includes:

[0013] The whale optimization algorithm is used to extract the characteristics of the network traffic data packets of each network connection request to determine the traffic feature combination. Each traffic feature combination is a whale. The current position x of the i-th whale in the whale group is i , initialize the position x of the whale group i , where i = 1, 2, ..., N, N represents the number of whales;

[0014] Initialize the parameters required for the whale optimization algorithm, including the number of whales N, the spiral shape constant b, the current number of iterations t, and the maximum number of iterations T max ;

[0015] Calculate the fitness function value of the initial position of the whale group in the whale optimization algorithm, and take the flow feature combination with the highest fitness function value as the optimal spatial position of the individual whale in the current whale group;

[0016] Calculate the coefficient vectors A and C, generate a random number p in the range [0,1], and choose different ways to update the spatial position of the whale group according to the value of p;

[0017] The updated position vector of the whale group is decoded into a corresponding traffic feature combination and displayed to the industrial Internet client. The user scores the traffic feature combination according to his or her network connection request type, and uses it as the fitness function value to find and save the best spatial position found by the individual whale in the current whale group.

[0018] By comparing the fitness function values ​​corresponding to the position vectors of the whale group before and after the update, the position of the next generation of whale group is determined;

[0019] Determine whether the current number of calculations has reached the maximum number of iterations T max If it is reached, the optimal solution is obtained, and the flow characteristic combination corresponding to the location of the whale group individual with the highest fitness value is output.

[0020] Optionally, the step of generating a traffic identification model includes:

[0021] Step (1), determine the sample data set, determine whether the samples in the sample data set belong to the same class, if so, select the class to generate a leaf node, and enter step (5); otherwise, extract the feature set A, and enter step (2), wherein the sample data set includes a flow feature combination and its corresponding flow type label;

[0022] Step (2), determine whether the feature set A is empty, if so, select the class with the largest proportion in the sample data set to generate a leaf node, and go to step (5); otherwise, go to step (3);

[0023] Step (3), determine whether all features are unique. If so, select the class with the largest proportion in the sample data set to generate a leaf node, and proceed to step (5); otherwise, calculate the information gain rate of the attributes in the attribute list, select the attribute with the highest information gain rate to generate a leaf node, and proceed to step (4);

[0024] Step (4), determine whether the traversal of feature values ​​is completed, if so, proceed to step (5); otherwise, generate a data subset, remove the feature set A, and return to step (1);

[0025] Step (5): Pruning is performed using the PEP pruning method, and the process ends.

[0026] Optionally, the step of using a traffic identification model trained with the traffic feature combination to perform traffic identification on the network traffic data packet to determine the traffic type of each five-tuple corresponding to each network connection request includes:

[0027] The traffic feature combinations and their corresponding traffic type labels are constructed as a sample data set, and a traffic recognition model trained with the sample data set is used to classify all traffic feature combinations in the sample data set into multiple sample subsets, and obtain a rule set corresponding to each sample subset;

[0028] Filter out multiple rule sets as target rule sets according to statistical indicators of sample subsets corresponding to each rule set;

[0029] The target rule set is used to configure the traffic identification strategy of the traffic control system, so that the traffic control system can identify the traffic type corresponding to any network connection request according to the traffic identification strategy.

[0030] Optionally, the step of determining a network configuration policy corresponding to each network connection request according to the traffic type corresponding to each quintuple includes:

[0031] Determine the network response priority corresponding to the traffic type of each quintuple, wherein the traffic type includes voice call, video call, file download or web search, the network response priority includes a first network response priority, a second network response priority and a third network response priority, the network response priority corresponding to the voice call or video call is the first network response priority, the network response priority corresponding to the web search is the second network response priority, and the network response priority corresponding to the file download is the third network response priority;

[0032] According to the network response priority corresponding to the traffic type of each quintuple, the bandwidth and traffic rate corresponding to the traffic type of each quintuple are determined to complete the network configuration corresponding to each network connection request.

[0033] Optionally, the quintuple includes a source IP address, a destination IP address, a source port number, a destination port number, and a transport protocol.

[0034] Optionally, the basic network architecture of the traffic identification model is a decision tree model.

[0035] An industrial Internet client network traffic control device provided for another purpose of the present application includes:

[0036] A data packet acquisition module is configured to respond to an instruction to perform flow control on an industrial Internet client and acquire network flow data packets from each network connection request in the industrial Internet client;

[0037] A feature extraction module is configured to use a whale optimization algorithm to extract features from the network traffic data packets to determine a traffic feature combination, wherein the traffic feature combination includes any multiple items of total traffic, uplink and downlink traffic bit rates, average packet length, total number of packets, number of retransmission packets, number of retransmission rate packets, packet loss rate, and response delay;

[0038] A traffic type identification module is configured to use a traffic identification model trained with the traffic feature combination to perform traffic identification on the network traffic data packets to determine the traffic type of each five-tuple corresponding to each network connection request;

[0039] The traffic control optimization module is configured to determine the network configuration strategy corresponding to each network connection request according to the traffic type corresponding to each quintuple, so as to complete the network traffic control of the industrial Internet client.

[0040] An electronic device provided to meet another purpose of the present application includes a central processing unit and a memory, wherein the central processing unit is used to call and run a computer program stored in the memory to execute the steps of the industrial Internet client network traffic control method described in the present application.

[0041] A computer-readable storage medium is provided to meet another purpose of the present application, which stores a computer program implemented according to the industrial Internet client network traffic control method in the form of computer-readable instructions. When the computer program is called and executed by a computer, the steps included in the corresponding method are executed.

[0042] Compared with the prior art, the present application aims at the problems that deep packet inspection in the prior art can only be used to identify known non-encrypted traffic, and may bring about information security problems such as privacy leakage, and the message feature extraction technology relies on the existing network device fingerprint, which requires a lot of manpower to analyze and extract device fingerprints, and has the problems of high cost and long time. The present application includes but is not limited to the following beneficial effects:

[0043] The present application uses a whale optimization algorithm to extract features from the network traffic data packets to determine a traffic feature combination; uses a traffic identification model trained with the traffic feature combination to identify the network traffic data packets to determine the traffic type of each five-tuple corresponding to each network connection request; compared with traditional traffic analysis technology, the traffic analysis technology of machine learning algorithms has become the current mainstream data flow classification method due to its high accuracy and strong scalability. This data flow analysis method is no longer affected by specific ports or load feature strings in the data flow, but by extracting features that conform to relevant statistical laws from the entire flow, such as average packet length, average data flow transmission rate, and average load length, etc. to classify different flows, and solves the problem of difficult identification of encrypted traffic;

[0044] Furthermore, the present application ensures optimal network performance by monitoring network traffic in real time and adjusting bandwidth configuration according to actual traffic changes and user needs. It can effectively manage the priorities of different traffic types to ensure that real-time applications (such as voice, video, etc.) obtain the necessary network resources while taking into account the needs of non-real-time traffic, thereby improving overall network performance and optimizing user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0046] Figure 1 This is a flow chart of the method for controlling network traffic of an industrial Internet client in an embodiment of the present application;

[0047] Figure 2 This is a flowchart of using the whale optimization algorithm to extract features from the network traffic data packets in an embodiment of the present application;

[0048] Figure 3 A schematic diagram of a flow chart for generating a traffic identification model in an embodiment of the present application;

[0049] Figure 4 This is a principle block diagram of the industrial Internet client network traffic control device in an embodiment of the present application;

[0050] Figure 5 It is a schematic diagram of the structure of the computer device in the embodiment of the present application. DETAILED DESCRIPTION

[0051] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present application.

[0052] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be intermediate elements. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0053] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with those in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as here.

[0054] It will be understood by those skilled in the art that the terms "client", "terminal" and "terminal device" as used herein include both devices with wireless signal receivers, which are devices with only wireless signal receivers without transmission capability, and devices with receiving and transmitting hardware, which are devices with receiving and transmitting hardware capable of two-way communication over a two-way communication link. Such devices may include: cellular or other communication devices such as personal computers, tablet computers, which have single-line displays or multi-line displays or cellular or other communication devices without multi-line displays; PCS (Personal Communications Services) which may combine voice, data processing, fax and / or data communication capabilities; PDA (Personal Digital Assistant) which may include a radio frequency receiver, pager, Internet / intranet access, web browser, notepad, calendar and / or GPS (Global Positioning System) receiver; conventional laptop and / or palmtop computers or other devices which have and / or include a radio frequency receiver. The "client", "terminal" and "terminal device" used herein may be portable, transportable, installed in a vehicle (air, sea and / or land), or adapted and / or configured to run locally, and / or in a distributed form, at any other location on the earth and / or in space. The "client", "terminal" and "terminal device" used herein may also be a communication terminal, an Internet terminal, a music / video playing terminal, such as a PDA, a MID (Mobile Internet Device) and / or a mobile phone with a music / video playing function, or may be a smart TV, a set-top box and other devices.

[0055] The hardware referred to by the names such as "server", "client", and "service node" in this application is essentially an electronic device with the equivalent capabilities of a personal computer. It is a hardware device with the necessary components revealed by the von Neumann principle, such as a central processing unit (including an arithmetic unit and a controller), a memory, an input device, and an output device. The computer program is stored in its memory, and the central processing unit calls the program stored in the external memory into the internal memory for execution, executes the instructions in the program, and interacts with the input and output devices to complete specific functions.

[0056] It should be pointed out that the concept of "server" referred to in this application can also be extended to the case of server clusters. According to the network deployment principle understood by those skilled in the art, the servers should be logically divided. In physical space, these servers can be independent of each other but can be called through interfaces, or integrated into a physical computer or a set of computer clusters. Those skilled in the art should understand this flexibility, and should not use it to restrict the implementation of the network deployment method of this application.

[0057] Unless expressly specified, one or more technical features of the present application can be deployed on a server for implementation and accessed by a client through a remote call to obtain an online service interface provided by the server, or can be directly deployed and run on a client for access.

[0058] The neural network models referenced or may be referenced in this application, unless expressly specified, can be deployed on a remote server and remotely called on the client, or can be deployed and directly called on a client with sufficient device capabilities. In some embodiments, when it runs on the client, its corresponding intelligence can be obtained through transfer learning to reduce the requirements for the client's hardware operating resources and avoid excessive occupation of the client's hardware operating resources.

[0059] Unless explicitly specified, the various data involved in this application can be stored remotely on a server or on a local terminal device, as long as it is suitable for being called by the technical solution of this application.

[0060] Those skilled in the art should be aware that, although the various methods of the present application are described based on the same concept and thus present commonality to each other, unless otherwise specified, these methods can be independently executed. Similarly, for each embodiment disclosed in the present application, they are all proposed based on the same inventive concept, therefore, concepts with the same expression, and concepts that are appropriately changed for convenience despite different expressions, should be understood as equivalent.

[0061] Unless the mutually exclusive relationship between the embodiments to be disclosed in this application is explicitly stated, the relevant technical features involved in each embodiment can be cross-combined to flexibly construct a new embodiment, as long as such combination does not deviate from the creative spirit of this application and can meet the needs of the prior art or solve certain deficiencies in the prior art. Those skilled in the art should be aware of this flexibility.

[0062] See also Figure 1 In one embodiment, the industrial Internet client network traffic control method of the present application includes:

[0063] Step S10: responding to an instruction to perform flow control on the industrial Internet client, obtaining network flow data packets from each network connection request in the industrial Internet client;

[0064] The traffic control system in the industrial Internet can respond to instructions for traffic control on the industrial Internet client to obtain network traffic data packets from each network connection request in the industrial Internet client; specifically, the industrial Internet client includes a Web client, a mobile client, a desktop client or an API client, etc.

[0065] In some embodiments, the network traffic data packet refers to a data unit transmitted on the network. Each data packet contains the necessary information for correct transmission and reception in the network. The basic components of the data packet include a header, a payload, and a tail. The header contains control information, such as source IP address, destination IP address, source port number, destination port number, transmission protocol, total traffic, upstream and downstream traffic bit rate, average packet length, total number of packets, number of retransmitted packets, number of retransmission rate packets, packet loss rate, response delay, etc.; the payload is the actual transmitted data content, such as web page content, files, video streams, etc.; the tail is usually used for checksum information for error detection and data integrity verification.

[0066] In some embodiments, the web client accesses the web application through a browser, such as Chrome, Firefox, etc.; the mobile client is an application designed for mobile devices, such as applications on smartphones and tablets; the API client is a program used to interact with the API, usually for data acquisition or service invocation.

[0067] In some embodiments, the acquisition and processing of network traffic data packets can be either active or passive (receiving traffic forwarded by other devices). In addition, the acquired network traffic data packets themselves can be either real-time traffic or historical traffic, which can be configured according to actual conditions. The solution of the present application focuses on how to subsequently identify the traffic type corresponding to the traffic.

[0068] Step S20, using the whale optimization algorithm to extract features from the network traffic data packets to determine a traffic feature combination, wherein the traffic feature combination includes any multiple of the total traffic, the upstream and downstream traffic bit rate, the average packet length, the total number of packets, the number of retransmission packets, the number of retransmission rate packets, the packet loss rate, and the response delay;

[0069] After obtaining network traffic data packets from each network connection request in the industrial Internet client, a whale optimization algorithm is used to extract features of the network traffic data packets to determine a traffic feature combination, wherein the traffic feature combination includes any multiple items of total traffic, upstream and downstream traffic bit rates, average packet length, total number of packets, number of retransmission packets, number of retransmission rate packets, packet loss rate, and response delay;

[0070] In some embodiments, see Figure 2 , the whale optimization algorithm is used to extract features from the network traffic data packets. The whale optimization algorithm (WOA) is a bionic optimization algorithm based on the predation behavior of whale groups. It was proposed by Mi rja lili et al. in 2016. The algorithm simulates the aggregation and collaboration behavior of whale groups during foraging. In this algorithm, a single whale itself represents a solution and preys in the current single-dimensional or multi-dimensional space by changing its position vector. The position of the candidate solution represents the parameters of the solution. The position of the individual with the highest fitness is considered to be the target position or close to the optimal position and is used as the initial setting of the best individual. The algorithm consists of three main behaviors: surrounding prey, capturing prey, and global prey search.

[0071] The encirclement of prey refers to the ability of humpback whales to identify the location of prey and encircle it. Since the location of the optimal design in the search space is a priori unknown, the whale optimization algorithm assumes that the current best candidate solution is the target prey or close to the optimal one. The purpose of the effort is to determine the best search agent, and other search agents will update their positions near the best search agent. This behavior is represented by the following calculation formula, which includes:

[0072]

[0073] A=2a·r-a (3),

[0074] C = 2·r (4),

[0075]

[0076] in, Represents the best spatial position found by individual whales in the current whale group, represents the current position of the individual whale, represents the distance between the whale's current position and the optimal position, t represents the current number of iterations, A and C are both calculated coefficient vectors, a represents a value that decreases linearly in the range of 2 to 0 during the iteration process, r is a random number uniformly distributed in the range [0,1], T max Indicates the maximum number of iterations for the initial setting.

[0077] Capturing prey refers to the whale swimming towards its prey in a spiral motion when hunting. The calculation formula includes:

[0078]

[0079] in, represents the distance between the whale and the prey, b is a constant, which represents the shape of the spiral, l is a random number in the range of [-1,1], and p is a random number in the range of [0,1]. When the whale surrounds the prey in a spiral, it also needs to continuously shrink the encirclement, so it is necessary to set the probability P for selecting the shrinking encirclement mechanism and the spiral model. i To update the whale's position, by probability P i , parameter a and fluctuation range A, whales will update their positions in different ways and move towards a better position.

[0080] The search for prey refers to ensuring that all whales can fully search in the solution space. The whale optimization algorithm updates the position according to the distance between individual whales to achieve the purpose of random search. The calculation formula includes:

[0081]

[0082] in, is a random whale position. When A≥1, a whale individual is randomly selected and the positions of other whales are updated to increase the randomness of exploration, hoping to find a better prey. By strengthening the algorithm's search ability, the whale optimization algorithm can explore the global optimal solution.

[0083] Further, the step of extracting features from the network traffic data packets using a whale optimization algorithm to determine a traffic feature combination includes:

[0084] Step S201: Use the whale optimization algorithm to extract features from the network traffic data packets of each network connection request to determine a traffic feature combination, where each traffic feature combination is a whale, and the current position x of the i-th whale in the whale group is i , initialize the position x of the whale group i , where i = 1, 2, ..., N, N represents the number of whales;

[0085] Step S202: Initialize the parameters required by the whale optimization algorithm, including the number of whales N, the spiral shape constant b, the current number of iterations t, and the maximum number of iterations T. max ;

[0086] Step S203, calculating the fitness function value of the initial position of the whale group in the whale optimization algorithm, and taking the flow feature combination with the highest fitness function value as the optimal spatial position of the individual whale in the current whale group;

[0087] Step S204, calculate the coefficient vectors A and C, generate a random number p in the range of [0,1], and select different ways to update the spatial position of the whale group according to the value of p;

[0088] Step S205: decode the updated position vector of the whale group into a corresponding traffic feature combination and display it to the industrial Internet client. The user scores the obtained traffic feature combination according to his own network connection request type as the fitness function value, finds and saves the best spatial position found by the individual whale in the current whale group

[0089] Step S206, determining the position of the next generation of whale groups by comparing the fitness function values ​​corresponding to the position vectors of the whale groups before and after the update;

[0090] Step S207: Determine whether the current number of calculations has reached the maximum number of iterations T max If it is reached, the optimal solution is obtained, and the flow characteristic combination corresponding to the location of the whale group individual with the highest fitness value is output.

[0091] Specifically, the steps of extracting features from the network traffic data packets using the whale optimization algorithm to determine the traffic feature combination specifically include:

[0092] Step S2001: Use the whale optimization algorithm to extract features from the network traffic data packets of each network connection request to determine a traffic feature combination, where each traffic feature combination is a whale, and the current position x of the i-th whale in the whale group is i , initialize the position x of the whale group i , where i = 1, 2, ..., N, N represents the number of whales;

[0093] Step S2002: Initialize the parameters required by the whale optimization algorithm, including the number of whales N, the spiral shape constant b, the current number of iterations t, and the maximum number of iterations T. max ;

[0094] Step S2003: Calculate the fitness value of each individual whale, find the position of the current optimal whale and retain it, where the calculation formula of the fitness function is as follows:

[0095]

[0096] Step S2004, use the above formula (3), formula (4) and formula (5) to calculate the parameters a, p and coefficient vectors A and C, and determine whether the probability p is less than 0.5. If it is, proceed to step S2005, otherwise use the algorithm of surrounding the prey, use formula (1) and formula (2) to update the position, and then directly proceed to step 5).

[0097] Step S2005, determine whether the absolute value of coefficient A is greater than or equal to 1, if yes, use the search prey algorithm to update the position using formula (9) and formula (10); otherwise, use the capture prey algorithm to update the position using formula (6), formula (7), and formula (8);

[0098] Step S2006, position update is completed, the optimal target position of each whale is calculated, and compared with the previously retained optimal whale position, if it is better than the previous one, the new optimal solution is used to replace it.

[0099] Step S2007: Determine whether the current number of calculations has reached the maximum number of iterations T max If yes, the optimal solution is obtained, the calculation is completed, and the flow feature combination corresponding to the location of the whale group individual with the highest fitness value is output. Otherwise, it enters the next iteration and returns to step S2004.

[0100] Step S30, using the traffic identification model trained by the traffic feature combination to perform traffic identification on the network traffic data packet to determine the traffic type of each five-tuple corresponding to each network connection request;

[0101] The whale optimization algorithm is used to extract features from the network traffic data packets to determine the traffic feature combination, and then the traffic identification model trained with the traffic feature combination is used to perform traffic identification on the network traffic data packets to determine the traffic type of each five-tuple corresponding to each network connection request; wherein the five-tuple includes the source IP address, the destination IP address, the source port number, the destination port number and the transmission protocol; the basic network architecture of the traffic identification model is a decision tree model, and common decision tree models, including C4.5, CART, RF, random forest algorithm, etc., can all be used as the selection of the decision tree model of this application.

[0102] In some embodiments, the step of using a traffic identification model trained with the traffic feature combination to perform traffic identification on the network traffic data packet to determine the traffic type of each five-tuple corresponding to each network connection request includes:

[0103] Step S301: construct the traffic feature combination and its corresponding traffic type label into a sample data set, use the traffic recognition model trained with the sample data set to classify all traffic feature combinations in the sample data set into multiple sample subsets, and obtain a rule set corresponding to each sample subset, wherein the sample data set includes the traffic feature combination and its corresponding traffic type label;

[0104] Step S302: Filter out multiple rule sets as target rule sets according to statistical indicators of sample subsets corresponding to each rule set;

[0105] Step S303: Use the target rule set to configure a traffic identification strategy of the traffic control system, so that the traffic control system identifies the traffic type corresponding to any network connection request according to the traffic identification strategy.

[0106] Specifically, in order to use the sample data set to extract the rules of the traffic type to which each quintuple corresponding to any network connection request belongs, a decision tree model is trained using the sample data set. The decision tree model is a simple, efficient, and highly interpretable prediction model, which is generally generated from top to bottom. Each decision or event (i.e., natural state) may lead to two or more events and different results. When this decision branch is drawn into a graph, it looks like a branch of a tree, so it is called a decision tree. Another way to express it is to use a tree diagram to represent the expected value of each decision, and finally select the decision method with the greatest benefit and the lowest cost through calculation.

[0107] The decision tree model trained with the sample data set can obtain, at each leaf node, a sample subset obtained by classifying and grouping all traffic feature combinations in the sample data set. Each sample subset contains a partial traffic feature combination in the sample data set. A corresponding classification path is constructed from the root node of the decision tree model to each leaf node. The features of the internal nodes in each classification path correspond to the conditions of the rules, and the class labels of the leaf nodes correspond to the conclusions of the rules. Therefore, each classification path provides a corresponding rule set.

[0108] In some embodiments, the present application takes the C4.5 decision tree algorithm as an example, which does not constitute a limitation on the present application. The decision tree model of the present application can be prepared and used according to the following principles:

[0109] First, train the decision tree model: apply the C4.5 decision tree algorithm to build a multi-classification model to constitute the decision tree model of the present application. The relevant parameter settings of the model are roughly determined according to the distribution of traffic feature combinations in the sample data set, and fine-tuning or parameter grid search can be performed later; and the traffic feature combinations can be iteratively screened according to the importance of variables, retaining the traffic feature combinations with higher importance, and eliminating the traffic feature combinations with lower importance, until the model technical indicators are stable or the retained features meet the online requirements.

[0110] Secondly, evaluate the effect of the decision tree model: the technical evaluation indicators of the decision tree model generally use AUC (area under curve) and KS (Ko lmogorov-Smi rnov, the intercept of the tangent line with a slope of 1 on the ROC curve). It can evaluate the ability of the decision tree model to distinguish between black and white samples. The larger the AUC and KS, the better the effect of the decision tree model. To ensure the stability of the model, it is best to add cross-time sample effect verification when evaluating the model.

[0111] It can be seen from the above steps that, first, the present application uses the traffic feature combination and its corresponding traffic type label as a sample data set, first trains a decision tree model, and then uses the decision tree model to classify each sample data set, and determines the rule set and sample subset corresponding to each classification path. Then, the target rule set is optimized according to the statistical indicators of the sample subset, and the traffic identification strategy of the traffic control system is configured using the optimized target rule set, so that the traffic control system can adapt to various changes in the industrial Internet client, and correctly identify the traffic type corresponding to each network connection request in the industrial Internet client according to the traffic identification strategy, such as voice calls, video calls, file downloads or web searches, etc.

[0112] In some embodiments, the C4.5 decision tree algorithm, the decision tree is a supervised learning classification method, based on the tree structure to make decisions. The decision tree uses a tree structure to represent the corresponding relationship between the classified attributes and the final type. Usually a decision tree is composed of a root node, multiple internal nodes and multiple leaf nodes. The final classification result of the decision tree is represented by a leaf node, and the other nodes represent a comparative test of a certain attribute, which is used to separate different characteristics. Therefore, only samples that can meet all judgment conditions on the path from the root node to the leaf node can reach the leaf node. The C4.5 decision tree algorithm is a classic algorithm for generating decision trees. It is an extension and optimization of the ID3 algorithm. It has the advantages of selecting split attributes through information gain rate, overcoming the shortcomings of the ID3 algorithm that tends to select attributes with multiple attribute values ​​as split attributes through information gain; it can handle discrete and continuous attribute types, that is, discretize continuous attributes; perform pruning operations after constructing the decision tree; and can handle training data with missing attribute values.

[0113] In some embodiments, the process of generating a decision tree is to learn classification rules from a data set. Decision tree learning is a process of recursively selecting features, selecting the best features, and dividing the training data according to the selected features so that each subset has the best classification. Division according to "information gain" and "information gain rate" are the two main methods. Information gain is related to information entropy, and entropy is often used to measure the purity of data in a sample set. Assuming that the random variable X is discrete and has only a finite number of n values, and the probability distribution of the i-th category of values ​​is P, the expression of the information entropy of X is expressed as follows:

[0114] P(X=x i )=p i i=1,2,…,n (12),

[0115]

[0116] The information gain indicates the degree to which the uncertainty of category Y is reduced after knowing the information of a certain feature X. Assuming there is feature A and data set D, the empirical entropy H(D) of D minus the empirical conditional entropy H(D|A) of feature A under given conditions is the information gain, denoted as G(D,A), and its expression is as follows:

[0117] G(D,A)=H(D)-H(D|A) (14),

[0118] The number of samples in the training set D is defined as |D|, and there are m categories C j , j = 1, 2, ..., m, | C j| represents the number of samples for classification. Assume that feature A has n values ​​{a1, a2, …, a n}, the value of feature A divides the subset of D into D i ,i=1,2,…,n。 |D i | represents the number of samples for classification. Subset D i C j The sample set of class is D ij ,|D ij | represents the number of classified samples. Then the empirical entropy formula of data set D is as follows:

[0119]

[0120] The formula for the empirical conditional entropy H(D|A) of feature A on data set D is as follows:

[0121]

[0122] When the subsets are divided by information gain, they are more easily affected by features with more values, and need to be expressed by information gain rate. The expression of information gain rate is as follows:

[0123]

[0124] Through the above calculation, if the information gain is larger, it means that using feature set A for division can improve the "purity" of the node more, and the C4.5 decision tree algorithm uses the "gain rate" to make the optimal division of attributes to reduce the impact of the preference for a large number of attributes.

[0125] In some embodiments, decision tree pruning, since the establishment of the decision tree is completely dependent on the training sample, the decision tree can produce a perfect fitting effect for the training sample. However, such a decision tree is too large and complex for the test sample, and may produce a high classification error rate. This phenomenon is called overfitting. Therefore, it is necessary to simplify the complex decision tree, that is, remove some nodes to solve the overfitting problem. This process is called pruning. Pruning methods are divided into two categories: pre-pruning and post-pruning. Pre-pruning is to terminate the growth of the decision tree in advance during the construction of the decision tree, so as to avoid the generation of too many nodes. Although the pre-pruning method is simple, it is not very practical because it is difficult to accurately determine when to terminate the growth of the tree. Post-pruning is to replace the node subtrees whose confidence does not meet the standard with leaf nodes after the decision tree is built, and the class label of the leaf node is marked with the class with the highest frequency in the node subtree. Post-pruning methods are divided into two types, one is to divide the training data set into the growth set and the pruning set of the tree; the other type of algorithm uses the same data set for decision tree growth and pruning. Common post-pruning methods include CCP (Cost Completion Pruning), REP (Reduced Error Pruning), PEP (Peasitic Error Pruning), and MEP (Minimum Error Pruning).

[0126] The C4.5 decision tree algorithm applied in this application adopts the PEP (Pessed Error Pruning) pruning method. The PEP pruning method was proposed by Quinlan and is a top-down pruning method that determines whether to prune a subtree based on the error rate before and after pruning, so a separate pruning data set is not required.

[0127] The PEP (Pessed Error Pruning) pruning method is described as follows:

[0128] For a leaf node, it covers n samples, of which there are e errors, then the error rate of the leaf node is (e+0.5) / n, where 0.5 is the penalty factor (the penalty factor is generally taken as 0.5). For a subtree, it has L leaf nodes, then the error rate R(L) of the subtree is:

[0129]

[0130] Among them, e i Indicates the number of samples misclassified in the i-th leaf node of the subtree, n i Represents the total number of samples in the i-th leaf node of the subtree.

[0131] Assuming that a subtree misclassifies a sample with a value of 1 and correctly classifies a sample with a value of 0, the number of misclassifications of the subtree can be considered as a Bernoulli distribution. Therefore, the mean M(L) and standard deviation SE(L) of the number of misclassifications of the subtree can be obtained as follows:

[0132]

[0133] After replacing the subtree with a leaf node, the misjudgment rate R(l) of the leaf node is:

[0134]

[0135] At the same time, the number of misjudgments of the leaf node is also a Bernoulli distribution, so the mean M(l) of the number of misjudgments of the leaf node is:

[0136]

[0137] The pruning conditions are:

[0138] M(L)+SE(L)≥M(l) (24),

[0139] That is, the number of misjudgments of the lth leaf node e l Pruning is required when the following formula is met:

[0140]

[0141] For further information, see Figure 3 ,The steps of generating a traffic identification model include:

[0142] Step (1), determine the sample data set, determine whether the samples in the sample data set belong to the same class, if so, select the class to generate a leaf node, and enter step (5); otherwise, extract the feature set A, and enter step (2), wherein the sample data set includes a flow feature combination and its corresponding flow type label;

[0143] Step (2), determine whether the feature set A is empty, if so, select the class with the largest proportion in the sample data set to generate a leaf node, and go to step (5); otherwise, go to step (3);

[0144] Step (3), determine whether all features are unique. If so, select the class with the largest proportion in the sample data set to generate a leaf node, and proceed to step (5); otherwise, calculate the information gain rate of the attributes in the attribute list, select the attribute with the highest information gain rate to generate a leaf node, and proceed to step (4);

[0145] Step (4), determine whether the traversal of feature values ​​is completed, if so, proceed to step (5); otherwise, generate a data subset, remove the feature set A, and return to step (1);

[0146] Step (5) uses the PEP pruning method to perform pruning, and the process ends to generate a traffic identification model.

[0147] Step S40: Determine the network configuration policy corresponding to each network connection request according to the traffic type corresponding to each quintuple to complete the network traffic control of the industrial Internet client.

[0148] A traffic identification model trained with the traffic feature combination is used to perform traffic identification on the network traffic data packets to determine the traffic type of each five-tuple corresponding to each network connection request, and then the network configuration policy corresponding to each network connection request is determined according to the traffic type corresponding to each five-tuple to complete the network traffic control of the industrial Internet client, wherein the five-tuple includes the source IP address, the destination IP address, the source port number, the destination port number and the transmission protocol.

[0149] Further, the step of determining the network configuration policy corresponding to each network connection request according to the traffic type corresponding to each quintuple includes:

[0150] Step S401, determining the network response priority corresponding to the traffic type of each quintuple, wherein the traffic type includes voice call, video call, file download or web search, the network response priority includes a first network response priority, a second network response priority and a third network response priority, the network response priority corresponding to the voice call or video call is the first network response priority, the network response priority corresponding to the web search is the second network response priority, and the network response priority corresponding to the file download is the third network response priority;

[0151] Step S402: Determine the bandwidth and traffic rate corresponding to the traffic type of each quintuple according to the network response priority corresponding to the traffic type of each quintuple, so as to complete the network configuration corresponding to each network connection request.

[0152] From the above steps, we can see that by real-time monitoring of network traffic, adjusting bandwidth configuration according to actual traffic changes and user needs, we can ensure optimal network performance; we can effectively manage the priorities of different types of traffic to ensure that real-time applications (such as voice and video) obtain the necessary network resources while taking into account the needs of non-real-time traffic, thereby improving overall network performance and optimizing user experience.

[0153] It can be seen from the above embodiments that, compared with the prior art, the present application aims at the problems that the deep packet inspection in the prior art can only be used to identify known non-encrypted traffic, and may bring about information security problems such as privacy leakage, and the message feature extraction technology relies on the existing network device fingerprint, which requires a lot of manpower to analyze and extract the device fingerprint, and there are problems such as high cost and long time consumption. The present application includes but is not limited to the following beneficial effects:

[0154] The present application uses a whale optimization algorithm to extract features from the network traffic data packets to determine a traffic feature combination; uses a traffic identification model trained with the traffic feature combination to identify the network traffic data packets to determine the traffic type of each five-tuple corresponding to each network connection request; compared with traditional traffic analysis technology, the traffic analysis technology of machine learning algorithms has become the current mainstream data flow classification method due to its high accuracy and strong scalability. This data flow analysis method is no longer affected by specific ports or load feature strings in the data flow, but by extracting features that conform to relevant statistical laws from the entire flow, such as average packet length, average data flow transmission rate, and average load length, etc. to classify different flows, and solves the problem of difficult identification of encrypted traffic;

[0155] Furthermore, the present application ensures optimal network performance by monitoring network traffic in real time and adjusting bandwidth configuration according to actual traffic changes and user needs. It can effectively manage the priorities of different traffic types to ensure that real-time applications (such as voice, video, etc.) obtain the necessary network resources while taking into account the needs of non-real-time traffic, thereby improving overall network performance and optimizing user experience.

[0156] See also Figure 4, an industrial Internet client network traffic control device provided to meet one of the purposes of this application, includes a data packet acquisition module 1100, a feature extraction module 1200, a traffic type identification module 1300 and a traffic control optimization module 1400. Among them, the data packet acquisition module 1100 is configured to respond to the instruction of traffic control on the industrial Internet client, and obtain the network traffic data packet from each network connection request in the industrial Internet client; the feature extraction module 1200 is configured to use the whale optimization algorithm to extract features of the network traffic data packet to determine the traffic feature combination, wherein the traffic feature combination includes any multiple items of total traffic, upstream and downstream traffic bit rate, average packet length, total number of packets, number of retransmission packets, number of retransmission rate packets, packet loss rate and response delay; the traffic type identification module 1300 is configured to use the traffic identification model trained with the traffic feature combination to perform traffic identification on the network traffic data packet to determine the traffic type of each five-tuple corresponding to each network connection request; the traffic control optimization module 1400 is configured to determine the network configuration policy corresponding to each network connection request according to the traffic type corresponding to each five-tuple to complete the network traffic control of the industrial Internet client.

[0157] Based on any embodiment of this application, please refer to Figure 5 Another embodiment of the present application further provides an electronic device, which can be implemented by a computer device, such as Figure 5 As shown, a schematic diagram of the internal structure of a computer device. The computer device includes a processor, a computer-readable storage medium, a memory, and a network interface connected via a system bus. Among them, the computer-readable storage medium of the computer device stores an operating system, a database, and computer-readable instructions. The database may store a control information sequence. When the computer-readable instructions are executed by the processor, the processor can implement an industrial Internet client network traffic control method. The processor of the computer device is used to provide computing and control capabilities to support the operation of the entire computer device. The memory of the computer device may store computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor can execute the industrial Internet client network traffic control method of the present application. The network interface of the computer device is used to connect and communicate with a terminal. Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0158] In this embodiment, the processor is used to execute Figure 4The memory stores the program code and various data required to execute the above modules or submodules. The network interface is used to transmit data between user terminals or servers. The memory in this embodiment stores the program code and data required to execute all modules / submodules in the industrial Internet client network traffic control device of this application, and the server can call the program code and data of the server to execute the functions of all submodules.

[0159] The present application also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the industrial Internet client network traffic control method described in any embodiment of the present application.

[0160] The present application also provides a computer program product, including a computer program / instruction, which, when executed by one or more processors, implements the steps of the industrial Internet client network traffic control method described in any embodiment of the present application.

[0161] A person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments of the present application can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a computer-readable storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0162] The above description is only a partial implementation method of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

[0163] To summarize, this application ensures optimal network performance by monitoring network traffic in real time and adjusting bandwidth configuration according to actual traffic changes and user needs. It can effectively manage the priorities of different traffic types to ensure that real-time applications (such as voice, video, etc.) obtain the necessary network resources while taking into account the needs of non-real-time traffic, thereby improving overall network performance and optimizing user experience.

Claims

1. A method for controlling network traffic of an industrial Internet client, characterized in that: include: . Responding to the instruction to control the flow of the industrial Internet client, obtaining the network flow data packets from each network connection request in the industrial Internet client; A whale optimization algorithm is used to extract features of the network traffic data packets to determine a traffic feature combination, wherein the traffic feature combination includes any multiple items of total traffic, uplink and downlink traffic bit rate, average packet length, total number of packets, number of retransmission packets, number of retransmission rate packets, packet loss rate, and response delay; Using a traffic identification model trained with the traffic feature combination, the network traffic data packet is subjected to traffic identification to determine the traffic type of each five-tuple corresponding to each network connection request; The network configuration strategy corresponding to each network connection request is determined according to the traffic type corresponding to each quintuple to complete the network traffic control of the industrial Internet client.

2. The method for controlling network traffic of an industrial Internet client according to claim 1, characterized in that: The step of extracting features from the network traffic data packets using a whale optimization algorithm to determine a traffic feature combination includes: The whale optimization algorithm is used to extract the characteristics of the network traffic data packets of each network connection request to determine the traffic feature combination. Each traffic feature combination is a whale. The current position x of the i-th whale in the whale group is i , initialize the position x of the whale group i , where i = 1, 2, ..., N, N represents the number of whales; Initialize the parameters required for the whale optimization algorithm, including the number of whales N, the spiral shape constant b, the current number of iterations t, and the maximum number of iterations T max ; Calculate the fitness function value of the initial position of the whale group in the whale optimization algorithm, and take the flow feature combination with the highest fitness function value as the optimal spatial position of the individual whale in the current whale group; Calculate the coefficient vectors A and C, generate a random number p in the range [0,1], and choose different ways to update the spatial position of the whale group according to the value of p; The updated position vector of the whale group is decoded into a corresponding traffic feature combination and displayed to the industrial Internet client. The user scores the traffic feature combination according to his or her network connection request type, and uses it as the fitness function value to find and save the best spatial position found by the individual whale in the current whale group. By comparing the fitness function values ​​corresponding to the position vectors of the whale group before and after the update, the position of the next generation of whale group is determined; Determine whether the current number of calculations has reached the maximum number of iterations T max If it is reached, the optimal solution is obtained, and the flow characteristic combination corresponding to the location of the whale group individual with the highest fitness value is output.

3. The method for controlling network traffic of an industrial Internet client according to claim 1, characterized in that: The steps of generating a traffic identification model include: Step (1), determine the sample data set, determine whether the samples in the sample data set belong to the same class, if so, select the class to generate a leaf node, and enter step (5); otherwise, extract the feature set A, and enter step (2), wherein the sample data set includes a flow feature combination and its corresponding flow type label; Step (2), determine whether the feature set A is empty, if so, select the class with the largest proportion in the sample data set to generate a leaf node, and go to step (5); otherwise, go to step (3); Step (3), determine whether all features are unique. If so, select the class with the largest proportion in the sample data set to generate a leaf node, and proceed to step (5); otherwise, calculate the information gain rate of the attributes in the attribute list, select the attribute with the highest information gain rate to generate a leaf node, and proceed to step (4); Step (4), determine whether the traversal of feature values ​​is completed, if so, proceed to step (5); otherwise, generate a data subset, remove the feature set A, and return to step (1); Step (5): Pruning is performed using the PEP pruning method, and the process ends.

4. The method for controlling network traffic of an industrial Internet client according to claim 1, characterized in that: The step of using the traffic identification model trained by the traffic feature combination to perform traffic identification on the network traffic data packet to determine the traffic type of each five-tuple corresponding to each network connection request includes: The traffic feature combinations and their corresponding traffic type labels are constructed as a sample data set, and a traffic recognition model trained with the sample data set is used to classify all traffic feature combinations in the sample data set into multiple sample subsets, and obtain a rule set corresponding to each sample subset; Filter out multiple rule sets as target rule sets according to statistical indicators of sample subsets corresponding to each rule set; The target rule set is used to configure the traffic identification strategy of the traffic control system, so that the traffic control system can identify the traffic type corresponding to any network connection request according to the traffic identification strategy.

5. The method for controlling network traffic of an industrial Internet client according to claim 1, characterized in that: The step of determining the network configuration policy corresponding to each network connection request according to the traffic type corresponding to each quintuple includes: Determine the network response priority corresponding to the traffic type of each quintuple, wherein the traffic type includes voice call, video call, file download or web search, the network response priority includes a first network response priority, a second network response priority and a third network response priority, the network response priority corresponding to the voice call or video call is the first network response priority, the network response priority corresponding to the web search is the second network response priority, and the network response priority corresponding to the file download is the third network response priority; According to the network response priority corresponding to the traffic type of each quintuple, the bandwidth and traffic rate corresponding to the traffic type of each quintuple are determined to complete the network configuration corresponding to each network connection request.

6. The method for controlling network traffic of an industrial Internet client according to claim 1, characterized in that: The quintuple includes a source IP address, a destination IP address, a source port number, a destination port number, and a transport protocol.

7. The method for controlling network traffic of an industrial Internet client according to any one of claims 1 to 6, characterized in that: The basic network architecture of the traffic identification model is a decision tree model.

8. An industrial Internet client network traffic control device, characterized in that: include: A data packet acquisition module is configured to respond to an instruction to perform flow control on an industrial Internet client and acquire network flow data packets from each network connection request in the industrial Internet client; A feature extraction module is configured to use a whale optimization algorithm to extract features from the network traffic data packets to determine a traffic feature combination, wherein the traffic feature combination includes any multiple items of total traffic, uplink and downlink traffic bit rates, average packet length, total number of packets, number of retransmission packets, number of retransmission rate packets, packet loss rate, and response delay; A traffic type identification module is configured to use a traffic identification model trained with the traffic feature combination to perform traffic identification on the network traffic data packets to determine the traffic type of each five-tuple corresponding to each network connection request; The traffic control optimization module is configured to determine the network configuration strategy corresponding to each network connection request according to the traffic type corresponding to each quintuple, so as to complete the network traffic control of the industrial Internet client.

9. An electronic device, comprising a central processing unit and a memory, characterized in that: The central processing unit is used to call and run the computer program stored in the memory to execute the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: It stores a computer program implemented according to the method described in any one of claims 1 to 7 in the form of computer-readable instructions, and when the computer program is called and executed by a computer, the steps included in the corresponding method are executed.

Images