Training method and device of data stream classification model, data stream classification method and device, computer equipment, storage medium and computer program product

Abstract

The invention relates to a data stream classification model training method and device, a data stream classification method and device, computer equipment, a storage medium and a computer program product. The method comprises the steps that position vectors of particles in a particle swarm algorithm are constructed according to candidate flow features and candidate selection values of hyper-parameters of an initial classification model, and the position vectors are used for representing at least one target candidate flow feature corresponding to the particles and target values corresponding to the hyper-parameters; iteratively updating the position vector of each particle by adopting a particle swarm algorithm until a preset condition is met, and obtaining a globally optimal solution; and according to the initial classification model, the target alternative flow features represented by the globally optimal solution and the target values of the hyper-parameters represented by the globally optimal solution, constructing a target initial classification model, and training the target initial classification model to obtain a trained data flow classification model. By adopting the method, the PCDN flow can be identified.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a training method and device for a data stream classification model, a data stream classification method and device, a computer device, a storage medium, and a computer program product. Background Art

[0002] Peer-to-Peer Content Delivery Network (P2P CDN or PCDN) is a low-cost, high-quality content distribution network service based on P2P technology, which is built by tapping into and utilizing massive fragmented idle resources (computing, storage, network, etc.) of the telecommunications edge network.

[0003] Since PCDN services use encrypted transmission, traditional deep packet inspection and other means cannot detect and identify PCDN traffic. Currently, there is no relevant detection and identification means for PCDN traffic in the PCDN field. Summary of the invention

[0004] Based on this, it is necessary to provide a data stream classification model training method and device, data stream classification method and device, computer equipment, storage medium and computer program product to address the above technical problems.

[0005] In a first aspect, the present application provides a method for training a data stream classification model. The method comprises:

[0006] According to each candidate flow feature and the candidate values ​​of the hyperparameters of the initial classification model, a position vector of each particle in the particle swarm algorithm is constructed, wherein the position vector is used to characterize at least one target candidate flow feature corresponding to the particle and a target value corresponding to the hyperparameter;

[0007] The particle swarm algorithm is used to iteratively update the position vector of each particle until a preset condition is met to obtain a global optimal solution;

[0008] According to the initial classification model, the target alternative flow features represented by the global optimal solution, and the target values ​​of the hyperparameters represented by the global optimal solution, a target initial classification model is constructed, and the target initial classification model is trained to obtain a trained data flow classification model.

[0009] In one embodiment, the iterative updating of the position vector of each particle using a particle swarm algorithm comprises:

[0010] For any of the particles, an initial test classification model is constructed based on the initial classification model, the target candidate flow feature represented by the position vector of the particle, and the target value of the hyperparameter represented by the position vector, and the initial test classification model is trained to obtain a test classification model;

[0011] Inputting the test data stream into the test classification model to obtain a classification result, and determining the fitness of the particle according to the classification result;

[0012] According to the fitness corresponding to each of the particles, the position vector of each of the particles is updated, and the step of jumping to the initial classification model, the target alternative flow feature represented by the position vector of the particle, and the target value of the hyperparameter represented by the position vector is used to construct an initial test classification model for any of the particles.

[0013] In one embodiment, updating the position vector of each particle according to the fitness corresponding to each particle includes:

[0014] Determine a current global optimal solution and a current individual optimal solution for each particle according to the fitness corresponding to each particle;

[0015] For any of the particles, a velocity vector of the particle is determined according to the current global optimal solution and the current individual optimal solution of the particle, and the position vector of the particle is updated according to the velocity vector.

[0016] In one embodiment, the candidate flow feature is a downstream flow feature, and the target initial classification model is constructed based on the initial classification model, the target candidate flow feature represented by the global optimal solution, and the target value of the hyperparameter represented by the global optimal solution, including:

[0017] A target initial classification model is constructed based on preset target upstream flow characteristics, the initial classification model, the target downstream flow characteristics represented by the global optimal solution, and the target values ​​of the hyperparameters represented by the global optimal solution.

[0018] In one embodiment, determining the fitness corresponding to the particle according to the classification result includes:

[0019] Determine the classification accuracy of the candidate classification model according to the data stream labels and classification results corresponding to each of the test data streams;

[0020] According to the classification accuracy, the fitness corresponding to the particle is determined, and the fitness is positively correlated with the classification accuracy.

[0021] In one embodiment, determining the fitness corresponding to the particle according to the classification accuracy includes:

[0022] The fitness corresponding to the particle is determined according to the number of the candidate flow features represented by the position vector of the particle and the classification accuracy, and the fitness is negatively correlated with the number of the candidate flow features.

[0023] In a second aspect, the present application also provides a data stream classification method. The method comprises:

[0024] Collecting data packets, and classifying and processing each of the data packets to obtain data streams corresponding to each of the data packets;

[0025] Each of the data streams is input into a data stream classification model respectively to obtain a classification result corresponding to each of the data streams, wherein the data stream classification model is obtained by training.

[0026] In a third aspect, the present application also provides a training device for a data stream classification model. The device comprises:

[0027] A construction module, used to construct a position vector of each particle in the particle swarm algorithm according to each candidate flow feature and the candidate value of the hyperparameter of the initial classification model, wherein the position vector is used to represent at least one target candidate flow feature corresponding to the particle and the target value corresponding to the hyperparameter;

[0028] An iteration module, used for iteratively updating the position vector of each particle using a particle swarm algorithm until a preset condition is met to obtain a global optimal solution;

[0029] A training module is used to construct a target initial classification model based on the initial classification model, the target alternative flow features represented by the global optimal solution, and the target values ​​of the hyperparameters represented by the global optimal solution, and to train the target initial classification model to obtain a trained data flow classification model.

[0030] In one embodiment, the iteration module is further used for:

[0031] For any of the particles, an initial test classification model is constructed based on the initial classification model, the target candidate flow feature represented by the position vector of the particle, and the target value of the hyperparameter represented by the position vector, and the initial test classification model is trained to obtain a test classification model;

[0032] Inputting the test data stream into the test classification model to obtain a classification result, and determining the fitness of the particle according to the classification result;

[0033] According to the fitness corresponding to each of the particles, the position vector of each of the particles is updated, and the step of jumping to the initial classification model, the target alternative flow feature represented by the position vector of the particle, and the target value of the hyperparameter represented by the position vector is used to construct an initial test classification model for any of the particles.

[0034] In one embodiment, the iteration module is further used for:

[0035] Determine a current global optimal solution and a current individual optimal solution for each particle according to the fitness corresponding to each particle;

[0036] For any of the particles, a velocity vector of the particle is determined according to the current global optimal solution and the current individual optimal solution of the particle, and the position vector of the particle is updated according to the velocity vector.

[0037] In one embodiment, the candidate flow feature is a downstream flow feature, and the training module is further used to:

[0038] A target initial classification model is constructed based on preset target upstream flow characteristics, the initial classification model, the target downstream flow characteristics represented by the global optimal solution, and the target values ​​of the hyperparameters represented by the global optimal solution.

[0039] In one embodiment, the iteration module is further used for:

[0040] Determine the classification accuracy of the candidate classification model according to the data stream labels and classification results corresponding to each of the test data streams;

[0041] According to the classification accuracy, the fitness corresponding to the particle is determined, and the fitness is positively correlated with the classification accuracy.

[0042] In one embodiment, the iteration module is further used for:

[0043] The fitness corresponding to the particle is determined according to the number of the candidate flow features represented by the position vector of the particle and the classification accuracy, and the fitness is negatively correlated with the number of the candidate flow features.

[0044] In a fourth aspect, the present application also provides a data stream classification device. The device comprises:

[0045] A collection module, used for collecting data packets, and classifying and processing each of the data packets to obtain data streams corresponding to each of the data packets;

[0046] A classification module is used to input each of the data streams into a data stream classification model to obtain a classification result corresponding to each of the data streams, wherein the data stream classification model is trained using the method described in any of the aforementioned embodiments.

[0047] In a fifth aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, any of the above methods is implemented.

[0048] In a sixth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements any of the above methods when executed by a processor.

[0049] In a seventh aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, any of the above methods is implemented.

[0050] The training method and device of the data stream classification model, the data stream classification method and device, the computer equipment, the storage medium and the computer program product predetermine a plurality of alternative stream features related to the data stream rather than the data packet content as optional features when classifying the data stream, and use the particle swarm algorithm to screen the values ​​of the alternative stream features and hyperparameters to obtain the optimal values ​​of the alternative stream features and hyperparameters, and then train the initial classification model according to the optimal values ​​of the alternative stream features and hyperparameters. The embodiment of the present application uses the feature training model of the data stream itself to classify the data stream without relying on the content of the data packet, so that the encrypted PCDN traffic with characteristics different from ordinary traffic can be identified. At the same time, the particle swarm algorithm is used to simultaneously optimize the values ​​of the alternative stream features and hyperparameters, which can speed up the acquisition of the optimal alternative stream features and hyperparameter values, thereby improving the training speed of the data stream classification model, and also improving the classification accuracy of the model finally trained. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 A schematic diagram of a flow chart of a method for training a data stream classification model in one embodiment;

[0052] Figure 2 is a flow chart of step 104 in one embodiment;

[0053] Figure 3 is a flow chart of step 206 in one embodiment;

[0054] Figure 4 is a flow chart of step 204 in one embodiment;

[0055] Figure 5 A schematic diagram of a flow chart of a data stream classification method in one embodiment;

[0056] Figure 6 FIG. 1 is a flow chart of a PCDN traffic identification method according to an embodiment;

[0057] Figure 7 is a structural block diagram of a training device for a data stream classification model in one embodiment;

[0058] Figure 8 is a structural block diagram of a data stream classification device in one embodiment;

[0059] Fig. 9 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0061] In one embodiment, Figure 1 As shown, a training method for a data stream classification model is provided. This embodiment takes the method applied to a server as an example for illustration. It is understandable that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0062] Step 102, constructing a position vector of each particle in the particle swarm algorithm according to each candidate flow feature and the candidate values ​​of the hyperparameters of the initial classification model, wherein the position vector is used to represent at least one target candidate flow feature corresponding to the particle and the target value corresponding to the hyperparameter.

[0063] In the embodiment of the present application, the candidate flow features are pre-determined features that may be used to distinguish PCDN network traffic, and the candidate flow features are independent of the content of the data packets, for example: the size of each data packet in the data stream, the number of data packets sent per second, the transmission time of each data packet, etc.

[0064] The initial classification model is any model that can be used for classification tasks. The hyperparameters of the initial classification model are determined according to the specific model used. For example, when a neural network model is used for classification, the hyperparameters may include the learning rate, batch size, type of activation function, type of loss function, number of iterations, etc. When a classification tree is used for classification, the hyperparameters may include the depth of the classification tree, the type of loss function, etc. When a support vector machine is used for classification, the hyperparameters may include the gamma value of the Gaussian kernel of the support vector machine, the type of loss function, etc.

[0065] Hyperparameters have predetermined alternative values, which can be a numerical range or a number of discrete alternative values. For hyperparameters such as the type of activation function and the type of loss function, a value can be set for each optional activation function or loss function to represent the function. These values ​​are alternative values. For example, setting 1 corresponds to the sigmoid activation function and setting 2 corresponds to the ReLU function. The alternative values ​​of the hyperparameter type of activation function are 1 and 2.

[0066] After determining the alternative values ​​of the candidate flow features and hyperparameters, the position vector of each particle in the particle swarm algorithm can be constructed. The number of position vector dimensions is the sum of the number of candidate flow features and the number of hyperparameters. Each dimension represents an alternative flow feature or a hyperparameter, and the value of each dimension represents whether the value of the feature or hyperparameter is used in the data flow classification model.

[0067] Taking a practical example to illustrate, suppose there are three features for device flow selection: the size of each data packet in the data stream, the number of data packets sent per second, and the average transmission time of the data packets. There are two hyperparameters: the learning rate and the type of activation function. Then the dimension of the position vector is 5.

[0068] Assume that the first dimension represents the size of each data packet, the second dimension represents the number of data packets sent per second, the third dimension represents the average transmission time of the data packet, the fourth dimension represents the learning rate, and the fifth dimension represents the type of activation function. It can be set that when the value of each dimension used to represent the alternative flow feature exceeds 0.5, it means that the feature is adopted, and when it does not exceed 0.5, it means that the feature is not adopted; set the value of the fifth dimension closer to which alternative value represents which activation function is adopted, then when the value of the position vector is [0.8, 0.2, 0.1, 0.02, 1.7], the meaning of the position vector is: in the data flow classification model, only the feature of the size of each data packet is used to classify each data flow, and the learning rate of the data flow classification model is set to 0.02, and the activation function is set to the ReLU function.

[0069] The position vector of each particle can cover all possible combinations of each candidate flow feature and each candidate value. Alternatively, the number of particles can be set in advance, and the target candidate flow feature and target value corresponding to each particle can be randomly selected, and the position vector can be constructed according to the randomly selected target candidate flow feature and target value.

[0070] Step 104, using a particle swarm algorithm to iteratively update the position vector of each particle until a preset condition is met to obtain a global optimal solution.

[0071] In the embodiment of the present application, the position vector of each particle is iteratively updated by executing the particle swarm algorithm. During the iterative update process, the particle swarm algorithm will calculate the fitness of each particle according to the position vector of each particle, and record the position vector corresponding to the highest fitness of each particle in the iterative process (individual optimal solution), and the position vector corresponding to the highest fitness of all particles (global optimal solution), and calculate the speed of the particle according to the individual optimal solution and the global optimal solution, and update the position vector of the particle according to the speed.

[0072] The present application embodiment does not specifically limit the calculation method of particle fitness. When the initial classification model uses each target candidate flow feature represented by the particle position vector and the target value of the hyperparameter to classify, the classification accuracy or F1 score can be used as the fitness.

[0073] Alternatively, a numerical value representing the quality of each target candidate flow feature corresponding to the particle can be calculated, and then a numerical value representing the quality of each target value of the hyperparameter corresponding to the particle can be calculated, and the fitness can be obtained by weighted summing these two numerical values.

[0074] Exemplarily, the quality of each target candidate stream feature can be determined based on the time required to collect each target candidate stream feature in the application (for example, the total size of all data packets in the data stream needs to wait until the data stream transmission is completed before it can be obtained, and the total size of data packets uploaded / downloaded per second can be obtained in real time during the data stream transmission process, so the former takes longer to collect than the latter), the number of target candidate stream features, the accuracy of classification using each target candidate stream feature, etc. Considering that the shorter the total collection time of each target candidate stream feature, the better, the fewer the number of target candidate stream features, the better, and the higher the accuracy of classification using each target candidate stream feature, the better, the numerical value used to characterize the quality of each target candidate stream feature can be set to be negatively correlated with the total collection time, negatively correlated with the number of target candidate stream features, and positively correlated with the accuracy.

[0075] Exemplarily, the quality of each hyperparameter target value can be determined based on the time required for training to reach the target accuracy when the model is trained based on the hyperparameter target value, the accuracy of classification based on the hyperparameter, etc. Considering that the shorter the model training time is, the better, and the higher the classification accuracy is, the better, the numerical value used to characterize the quality of each hyperparameter target value can be set to be negatively correlated with the training time and positively correlated with the accuracy.

[0076] The accuracy of classification using target candidate flow features or target values ​​of hyperparameters can be obtained by roughly training a test classification model according to the target candidate flow features and target values ​​of hyperparameters and determining the performance of the test classification model on the test set. The training time can also be obtained by roughly training a test classification model and determining the total time consumed in training the test classification model.

[0077] The weights of the numerical values ​​that characterize the quality of the target candidate flow characteristics and the weights of the numerical values ​​that characterize the quality of each hyperparameter target value can be determined according to actual needs. For example, if you need to shorten the time required to collect target candidate flow characteristics in an application so that the model classification efficiency is higher during application, you can increase the weights of the numerical values ​​that characterize the quality of the target candidate flow characteristics. If you need to shorten the training time, you can increase the weights of the numerical values ​​that characterize the quality of each hyperparameter target value.

[0078] The preset condition may be that the number of iterations reaches a maximum number, or the fitness corresponding to the global optimal solution is greater than a preset threshold, etc. When the preset condition is met, the iteration is stopped and the current global optimal solution is obtained.

[0079] Step 106, construct a target initial classification model based on the initial classification model, the target candidate flow features represented by the global optimal solution, and the target values ​​of the hyperparameters represented by the global optimal solution, train the target initial classification model, and obtain a trained data flow classification model.

[0080] In the embodiment of the present application, according to the target candidate flow features characterized by the global optimal solution and the target values ​​of the hyperparameters characterized by the global optimal solution, a target initial classification model can be constructed that uses the target candidate flow features for classification and uses the target values ​​of the hyperparameters for training. Sample data is input into the target initial classification model for training to obtain a trained data stream classification model.

[0081] The training method of the data flow classification model provided in the embodiment of the present application predetermines multiple alternative flow features related to the data flow rather than the data packet content as optional features when classifying the data flow, and uses a particle swarm algorithm to screen the values ​​of the alternative flow features and hyperparameters to obtain the optimal values ​​of the alternative flow features and hyperparameters, and then trains the initial classification model according to the optimal values ​​of the alternative flow features and hyperparameters. The embodiment of the present application uses the feature training model of the data flow itself to classify the data flow without relying on the content of the data packet, so it can identify encrypted PCDN traffic with characteristics that are different from ordinary traffic. At the same time, the use of a particle swarm algorithm to simultaneously optimize the values ​​of the alternative flow features and hyperparameters can speed up the acquisition of the optimal alternative flow features and hyperparameter values, thereby improving the training speed of the data flow classification model, and also improving the classification accuracy of the model finally trained.

[0082] In one embodiment, Figure 2 As shown, in step 104, the particle swarm algorithm is used to iteratively update the position vector of each particle, including:

[0083] Step 202, for any particle, an initial test classification model is constructed based on the initial classification model, the target candidate flow characteristics represented by the particle's position vector, and the target value of the hyperparameter represented by the position vector, and the initial test classification model is trained to obtain a test classification model.

[0084] Step 204: input the test data stream into the test classification model to obtain a classification result, and determine the fitness of the particle according to the classification result.

[0085] Step 206 , updating the position vector of each particle according to the fitness corresponding to each particle, and jumping to step 202 .

[0086] In the embodiment of the present application, the fitness of the particle is obtained by training the test classification model. For each particle, an initial test classification model can be constructed according to the initial classification model, the target candidate flow characteristics represented by the position vector of the particle, and the target value of the hyperparameter. The test classification model can be obtained by training the initial test classification model. It should be noted that the number of training iterations of the test classification model can be less than the number of training iterations of the data flow classification model, and the amount of sample data used for training can also be less, thereby speeding up the training speed of the test classification model.

[0087] For each test classification model corresponding to a particle, a pre-prepared test data stream is input into the test classification model to obtain a classification result. The classification accuracy of the test classification model can be determined according to the classification result, and then the fitness of the particle can be determined. The specific method of determining the fitness according to the classification accuracy can refer to the above embodiment, and the embodiment of the present application will not be repeated.

[0088] After updating the particle's position vector, a new test classification model needs to be trained again based on the particle's new position vector. Repeat this iterative process until the preset conditions are met.

[0089] It should be noted that in order to further save model training time, the trained test classification model can be saved after each training. After obtaining the global optimal solution, the test classification model corresponding to the global optimal solution can be obtained from each previously saved test classification model, and then the test classification model can be further trained to obtain a trained data stream classification model.

[0090] The training method of the data stream classification model provided in the embodiment of the present application can determine the fitness of the particles by constructing a test classification model and determining the classification result of the test classification model for the test data stream, so that the fitness of the particles is related to the classification accuracy, thereby improving the classification accuracy of the data stream classification model trained according to the global optimal solution with the highest fitness.

[0091] In one embodiment, Figure 3 As shown, in step 206, the position vector of each particle is updated according to the fitness corresponding to each particle, including:

[0092] Step 302: Determine the current global optimal solution and the current individual optimal solution of each particle according to the fitness corresponding to each particle.

[0093] Step 304 , for any particle, according to the current global optimal solution and the current individual optimal solution of the particle, determine the velocity vector of the particle, and update the position vector of the particle according to the velocity vector.

[0094] In the embodiment of the present application, the specific method for updating the particle position vector according to the fitness of the particle is: in the iterative process of the particle swarm algorithm, the global optimal solution and the individual optimal solution of each particle are recorded. The velocity vector of each particle is calculated according to the global optimal solution and the individual optimal solution, the velocity vector is added to the position vector, and the position vector is updated.

[0095] The global optimal solution and the individual optimal solution of each particle can be set to 0 at the beginning of the iteration. In each iteration, the highest fitness among all particles in this iteration is determined. If the highest fitness is greater than the current global optimal solution, the current global optimal solution is updated to the highest fitness. At the same time, in each iteration, for each particle, it is determined whether the fitness of the particle in this iteration is greater than the individual optimal solution of the particle. If it is greater, the current individual optimal solution of the particle is updated to the fitness in this iteration.

[0096] The embodiment of the present application does not specifically limit the calculation method of the velocity vector. Any method of calculating the velocity vector in the particle swarm algorithm is applicable to the embodiment of the present application. After calculating the velocity vector, the velocity vector and the position vector are added to obtain an updated position vector.

[0097] In one embodiment, the candidate flow feature is a downstream flow feature, and a target initial classification model is constructed according to the initial classification model, the target candidate flow feature represented by the global optimal solution, and the target value of the hyperparameter represented by the global optimal solution, including:

[0098] A target initial classification model is constructed based on preset target upstream flow characteristics, an initial classification model, target downstream flow characteristics represented by a global optimal solution, and target values ​​of hyperparameters represented by a global optimal solution.

[0099] In the embodiment of the present application, considering that the upstream traffic characteristics of PCDN traffic are relatively obvious, the target initial classification model can use at least one target upstream flow feature for identification. Considering that using the target upstream flow feature alone is prone to cause the model to misjudge or miss, the particle swarm algorithm can be used to select the optimal target downstream flow feature and the target upstream flow feature as the feature used when identifying PCDN traffic, thereby improving the accuracy of the model in identifying PCDN traffic.

[0100] It should be noted that when constructing the initial test classification model during the training process, the initial test classification model can also be constructed based on the preset target upstream flow characteristics, the initial classification model, the target downstream flow characteristics represented by the particle position vector, and the target value of the hyperparameter represented by the position vector.

[0101] The target upstream flow characteristics may include the minimum upload packet length, the maximum upload packet length, the average upload packet length, the standard deviation of the upload packet length, the transmission time of the minimum upload packet, the transmission time of the maximum upload packet, the average upload time, the standard deviation of the average upload time, the number of upload packets, and the data volume of the upload packets per second.

[0102] Downstream flow characteristics may include data packet length, total length of downloaded data packets, maximum length of downloaded data packets, minimum length of downloaded data packets, average length of downloaded data packets, standard deviation of download data packet length, UDP (User Datagram Protocol) length, timestamp, IPD (Inter-Packet Delay, that is, the time interval between two consecutive download data packets), maximum download IPD, minimum download IPD, average download IPD, standard deviation of download IPD, etc.

[0103] In application and training, you can first distinguish whether the data flow input to the classification model is upstream traffic or downstream traffic. If it is upstream traffic, extract the feature value of the data flow according to the target upstream flow feature, and set the feature value of the target downstream flow feature corresponding to the data flow to a default value (such as 0), and then classify the data flow according to the feature value corresponding to the data flow. Similarly, if the data flow is downstream traffic, extract the downstream feature value of the data flow according to the target downstream flow feature, and then set the feature value of the target upstream flow feature corresponding to the data flow to a default value.

[0104] Alternatively, the classification model may also add a label to the data flow according to whether the data flow is upstream traffic or downstream traffic when preprocessing the data flow input to the classification model. For the data flow whose label is upstream traffic, the model extracts the feature value of the data flow according to the target upstream traffic feature. For the data flow whose label is downstream traffic, the model extracts the feature value of the data flow according to the target downstream traffic feature.

[0105] The training method of the data flow classification model provided in the embodiment of the present application pre-sets the target upstream flow features to be used, and uses the particle swarm algorithm to screen the optimal target downstream flow features. Since the upstream features of PCDN traffic are more obvious, using more target upstream flow features for identification can improve the classification accuracy. At the same time, using the downstream flow features screened by the particle swarm algorithm for auxiliary identification can also further improve the classification accuracy.

[0106] In one embodiment, Figure 4 As shown, in step 204, the fitness corresponding to the particle is determined according to the classification result, including:

[0107] Step 402, determining the classification accuracy corresponding to the candidate classification model according to the data stream labels and classification results corresponding to each test data stream.

[0108] Step 404, determining the fitness corresponding to the particle according to the classification accuracy, and the fitness is positively correlated with the classification accuracy.

[0109] In the embodiment of the present application, the test data flow has a data flow label, and the data flow label includes common traffic and PCDN traffic. The classification result also includes common traffic result and PCDN traffic result.

[0110] The classification accuracy of the classification model for each test data stream can be determined based on the number of matches between the data stream labels and classification results of the test data stream to the number of all test data streams, and the classification accuracy and fitness are positively correlated, so that the global optimal solution is more likely to correspond to a position vector with higher classification accuracy, thereby improving the classification accuracy of the data stream classification model trained according to the global optimal solution.

[0111] In one embodiment, in step 404, determining the fitness corresponding to the particle according to the classification accuracy includes:

[0112] According to the number of alternative flow features represented by the particle's position vector and the classification accuracy, the fitness corresponding to the particle is determined, and the fitness is negatively correlated with the number of alternative flow features.

[0113] In the embodiment of the present application, the number of alternative flow features also needs to be considered when calculating the fitness. The number of alternative flow features is negatively correlated with the fitness, so that the corresponding classification accuracy is high, but the position vector with a small number of alternative flow features is more likely to be the global optimal solution, so as to achieve the effect of collecting fewer data flow features in the application to classify the data flow, improve the classification efficiency, and facilitate real-time monitoring during traffic transmission.

[0114] In one embodiment, Figure 5 As shown, a data flow classification method is provided. This embodiment uses the method applied to a server as an example for illustration. It can be understood that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0115] Step 502: collect data packets, and classify and process each data packet to obtain a data stream corresponding to each data packet.

[0116] Step 504, input each data stream into the data stream classification model respectively to obtain the classification result corresponding to each data stream, wherein the data stream classification model is trained by using the method of any of the above-mentioned embodiments.

[0117] In an embodiment of the present application, data packets passing through any network node can be collected at the network node, and the data packets can be classified according to the characteristics of the source IP address, destination IP address, etc. of the data packets to determine which data packets belong to the same data stream. The number of data packets collected for each data stream can be determined according to the target alternative stream characteristics used by the data stream classification model. For example, when the target alternative stream characteristic is the total length of the downloaded data packets, the collection of the data stream can be terminated after all data packets belonging to the same data stream are transmitted. When the target alternative stream characteristic is IPD, the collection of the data stream can be terminated after a preset number (for example, 10 or 20) of data packets are collected.

[0118] After collecting the required number of data packets, each data packet in the data stream is input into the data stream classification model. The data stream classification model extracts the characteristic value of the data stream according to the target candidate stream characteristics, and classifies the data stream according to the extracted characteristic values ​​to obtain the classification result of the data stream.

[0119] If the classification result is a normal traffic result, the network node may not process the data flow. If it is a PCDN traffic result, the network node may notify other nodes in the network to temporarily intercept the data flow, and after further confirming whether the PCDN traffic is malicious traffic based on relevant security measures, continue to transmit the PCDN traffic or discard the traffic.

[0120] The data stream classification method provided in the embodiment of the present application uses the data stream's own feature training model to classify the data stream, without relying on the content of the data packet, so it can detect and identify encrypted network traffic. At the same time, using the data stream classification model optimized by the particle swarm algorithm for classification can also improve the classification accuracy of the data stream.

[0121] In one embodiment, Figure 6 As shown, a PCDN traffic identification method is provided, including:

[0122] Step 601, collect the data packets accessed by the network card through the program, and classify the data packets according to the source IP address, destination IP address, source port, destination port and transport layer protocol of the data packets to obtain the data flow to which the data packets belong.

[0123] In the embodiment of the present application, the network card can be a network card in any network node. After collecting data packets of a certain length in the above manner, sample data for training can be obtained.

[0124] Step 602: for any data flow, after obtaining all data packets corresponding to the data flow, determine the characteristic values ​​of each upstream characteristic and downstream characteristic corresponding to the data flow.

[0125] Step 603: randomly select several features from the downstream features as target downstream features, randomly select the loss function type and the gamma value parameter of the Gaussian kernel from a preset range, and construct a particle position vector based on the above data. Repeat the above process until 60 particles are generated as the initial population.

[0126] In the embodiment of the present application, a support vector machine is used as the initial classification model, and the hyperparameters are set to the loss function type and gamma value of the support vector machine.

[0127] Step 604: In each iteration, the classification model is trained and tested for each particle, and the known PCDN traffic and ordinary traffic are classified to obtain the classification accuracy. The fitness of the particle is calculated according to the classification accuracy, and the position vector of the particle is updated according to the fitness and the next iteration is entered. After 60 iterations, the support vector machine is trained using the global optimal solution to construct the optimal classification hyperplane and obtain the data flow classification model.

[0128] Step 605: In the application, the collected data packets are classified to obtain unknown traffic.

[0129] Step 606, preprocessing the unknown traffic, and extracting characteristic values ​​of the unknown traffic according to the upstream flow characteristics and the target downstream flow characteristics corresponding to the global optimal solution.

[0130] Step 607: Classify the unknown traffic using the data flow classification model to determine whether the unknown traffic is PCDN traffic or common traffic.

[0131] The PCDN traffic identification method provided in the embodiment of the present application is based on the principle that PCDN utilizes the idle bandwidth in the edge network for distribution and transmission, and has relatively obvious upstream flow characteristics, and classifies and identifies the data flow by extracting the upstream flow characteristics of the data flow. At the same time, considering that the accuracy of identification and classification using only upstream flow characteristics is poor, and it is easy to produce misjudgments and missed judgments, the particle swarm algorithm is used to select the optimal downstream flow features to assist in the identification of the data flow. The feature set used for classifying the data flow can be optimized to avoid the situation where too many features are used, resulting in slow calculations and difficulty in real-time monitoring of the traffic. At the same time, the embodiment of the present application uses a particle swarm algorithm to simultaneously tune the features and hyperparameters used, without the need for external intervention, thereby achieving a complete automated closed loop.

[0132] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0133] Based on the same inventive concept, the embodiment of the present application also provides a data stream classification model training device for implementing the data stream classification model training method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of the training device for one or more data stream classification models provided below can refer to the limitations of the training method for the data stream classification model above, and will not be repeated here.

[0134] In one embodiment, Figure 7 As shown, a training device 700 for a data stream classification model is provided, comprising: a construction module 702, an iteration module 704, and a training module 706, wherein:

[0135] A construction module 702 is used to construct a position vector of each particle in the particle swarm algorithm according to each candidate flow feature and the candidate value of the hyperparameter of the initial classification model, wherein the position vector is used to represent at least one target candidate flow feature corresponding to the particle and the target value corresponding to the hyperparameter;

[0136] Iteration module 704, used for iteratively updating the position vector of each particle using a particle swarm algorithm until a preset condition is met to obtain a global optimal solution;

[0137] The training module 706 is used to construct a target initial classification model based on the initial classification model, the target alternative flow features represented by the global optimal solution, and the target values ​​of the hyperparameters represented by the global optimal solution, and train the target initial classification model to obtain a trained data flow classification model.

[0138] The training device for the data flow classification model provided in the embodiment of the present application predetermines a plurality of alternative flow features related to the data flow rather than the data packet content as optional features when classifying the data flow, and uses a particle swarm algorithm to screen the values ​​of the alternative flow features and hyperparameters to obtain the optimal values ​​of the alternative flow features and hyperparameters, and then trains the initial classification model according to the optimal values ​​of the alternative flow features and hyperparameters. The embodiment of the present application uses the feature training model of the data flow itself to classify the data flow without relying on the content of the data packet, so that encrypted PCDN traffic with characteristics that are different from ordinary traffic can be identified. At the same time, the use of a particle swarm algorithm to simultaneously optimize the values ​​of the alternative flow features and hyperparameters can speed up the acquisition of the optimal alternative flow features and hyperparameter values, thereby improving the training speed of the data flow classification model, and also improving the classification accuracy of the model finally trained.

[0139] In one embodiment, the iteration module 704 is further configured to:

[0140] For any of the particles, an initial test classification model is constructed based on the initial classification model, the target candidate flow feature represented by the position vector of the particle, and the target value of the hyperparameter represented by the position vector, and the initial test classification model is trained to obtain a test classification model;

[0141] Inputting the test data stream into the test classification model to obtain a classification result, and determining the fitness of the particle according to the classification result;

[0142] According to the fitness corresponding to each of the particles, the position vector of each of the particles is updated, and the step of jumping to the initial classification model, the target alternative flow feature represented by the position vector of the particle, and the target value of the hyperparameter represented by the position vector is used to construct an initial test classification model for any of the particles.

[0143] In one embodiment, the iteration module 704 is further configured to:

[0144] Determine a current global optimal solution and a current individual optimal solution for each particle according to the fitness corresponding to each particle;

[0145] For any of the particles, a velocity vector of the particle is determined according to the current global optimal solution and the current individual optimal solution of the particle, and the position vector of the particle is updated according to the velocity vector.

[0146] In one embodiment, the candidate flow feature is a downlink flow feature, and the training module 706 is further used to:

[0147] A target initial classification model is constructed based on preset target upstream flow characteristics, the initial classification model, the target downstream flow characteristics represented by the global optimal solution, and the target values ​​of the hyperparameters represented by the global optimal solution.

[0148] In one embodiment, the iteration module 704 is further configured to:

[0149] Determine the classification accuracy of the candidate classification model according to the data stream labels and classification results corresponding to each of the test data streams;

[0150] According to the classification accuracy, the fitness corresponding to the particle is determined, and the fitness is positively correlated with the classification accuracy.

[0151] In one embodiment, the iteration module 704 is further configured to:

[0152] The fitness corresponding to the particle is determined according to the number of the candidate flow features represented by the position vector of the particle and the classification accuracy, and the fitness is negatively correlated with the number of the candidate flow features.

[0153] In one embodiment, Figure 8 As shown, a data stream classification device 800 is provided, including: a collection module 802, a classification module 804, wherein:

[0154] The collection module 802 is used to collect data packets and classify each of the data packets to obtain data streams corresponding to each of the data packets;

[0155] The classification module 804 is used to input each of the data streams into a data stream classification model to obtain a classification result corresponding to each of the data streams, wherein the data stream classification model is trained using the method described in any of the aforementioned embodiments.

[0156] Each module in the above device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.

[0157] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig. 9 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a training method for a data stream classification model is implemented.

[0158] Those skilled in the art will understand that Fig. 9 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0159] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0160] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0161] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0162] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0163] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0164] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0165] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A training method for a data stream classification model, characterized in that: The method comprises: According to each candidate flow feature and the candidate values ​​of the hyperparameters of the initial classification model, a position vector of each particle in the particle swarm algorithm is constructed, wherein the position vector is used to characterize at least one target candidate flow feature corresponding to the particle and a target value corresponding to the hyperparameter; The particle swarm algorithm is used to iteratively update the position vector of each particle until a preset condition is met to obtain a global optimal solution; According to the initial classification model, the target alternative flow features represented by the global optimal solution, and the target values ​​of the hyperparameters represented by the global optimal solution, a target initial classification model is constructed, and the target initial classification model is trained to obtain a trained data flow classification model.

2. The method according to claim 1, characterized in that The adopting of the particle swarm algorithm to iteratively update the position vector of each particle comprises: For any of the particles, an initial test classification model is constructed based on the initial classification model, the target candidate flow feature represented by the position vector of the particle, and the target value of the hyperparameter represented by the position vector, and the initial test classification model is trained to obtain a test classification model; Inputting the test data stream into the test classification model to obtain a classification result, and determining the fitness of the particle according to the classification result; According to the fitness corresponding to each of the particles, the position vector of each of the particles is updated, and the step of jumping to the initial classification model, the target alternative flow feature represented by the position vector of the particle, and the target value of the hyperparameter represented by the position vector is used to construct an initial test classification model for any of the particles.

3. The method according to claim 2, characterized in that The updating the position vector of each particle according to the fitness corresponding to each particle includes: Determine a current global optimal solution and a current individual optimal solution for each particle according to the fitness corresponding to each particle; For any of the particles, a velocity vector of the particle is determined according to the current global optimal solution and the current individual optimal solution of the particle, and the position vector of the particle is updated according to the velocity vector.

4. The method according to any one of claims 1 to 3, characterized in that The candidate flow feature is a downstream flow feature, and the target initial classification model is constructed based on the initial classification model, the target candidate flow feature represented by the global optimal solution, and the target value of the hyperparameter represented by the global optimal solution, including: A target initial classification model is constructed based on preset target upstream flow characteristics, the initial classification model, the target downstream flow characteristics represented by the global optimal solution, and the target values ​​of the hyperparameters represented by the global optimal solution.

5. The method according to claim 2, characterized in that: Determining the fitness corresponding to the particle according to the classification result includes: Determine the classification accuracy of the candidate classification model according to the data stream labels and classification results corresponding to each of the test data streams; According to the classification accuracy, the fitness corresponding to the particle is determined, and the fitness is positively correlated with the classification accuracy.

6. The method according to claim 5, characterized in that Determining the fitness corresponding to the particle according to the classification accuracy includes: The fitness corresponding to the particle is determined according to the number of the candidate flow features represented by the position vector of the particle and the classification accuracy, and the fitness is negatively correlated with the number of the candidate flow features.

7. A data stream classification method, characterized in that: The method comprises: Collecting data packets, and classifying and processing each of the data packets to obtain data streams corresponding to each of the data packets; Input each of the data streams into a data stream classification model respectively to obtain a classification result corresponding to each of the data streams, wherein the data stream classification model is trained using the method described in any one of claims 1-6.

8. A training device for a data stream classification model, characterized in that: The device comprises: A construction module, used to construct a position vector of each particle in the particle swarm algorithm according to each candidate flow feature and the candidate value of the hyperparameter of the initial classification model, wherein the position vector is used to represent at least one target candidate flow feature corresponding to the particle and the target value corresponding to the hyperparameter; An iteration module, used for iteratively updating the position vector of each particle using a particle swarm algorithm until a preset condition is met to obtain a global optimal solution; A training module is used to construct a target initial classification model based on the initial classification model, the target alternative flow features represented by the global optimal solution, and the target values ​​of the hyperparameters represented by the global optimal solution, and to train the target initial classification model to obtain a trained data flow classification model.

9. A data stream classification device, characterized in that: The device comprises: A collection module, used for collecting data packets, and classifying and processing each of the data packets to obtain data streams corresponding to each of the data packets; A classification module is used to input each of the data streams into a data stream classification model to obtain a classification result corresponding to each of the data streams, wherein the data stream classification model is trained using the method described in any one of claims 1-6.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images