Super propagator detection method, system, equipment and medium

Abstract

The invention relates to a super propagator detection method, system and device and a medium, and the method comprises the steps: S1, constructing a data structure, and initializing the data structure; and S2, acquiring a data packet, performing updating operation on the data packet by using the data structure, and after the data packet is successfully updated, performing super propagator detection operation. According to the method, the sampling probability of the stream elements can be dynamically adjusted through the self-adaptive sampling strategy in the updating operation to adapt to streams with different cardinal numbers, so that the probability of updating a register by a large stream is reduced, excessive occupation of the large stream on register resources is reduced, the utilization rate of memory resources is further improved, and the memory performance is improved. And the super propagator can be detected more accurately.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a super spreader detection method, system, equipment and medium. Background Art

[0002] Super-spreader detection is an important research direction in the field of network flow measurement, which refers to the detection of flows with large cardinality in high-speed networks. A flow refers to a collection of data packets with the same flow ID, where the definition of flow ID and elements can be flexibly configured according to different measurement scenarios. The flow cardinality, as an important indicator to measure the flow scale, refers to the number of different elements in the flow. Accurate detection of super-spreaders is crucial for network security and management, including many application scenarios such as network hotspot location and detection of malicious attacks. However, in order to cope with the needs of high-speed traffic processing, network traffic measurement functions are usually deployed on on-chip network processing chips. Due to the extremely limited memory size of the chip, this severely limits the memory space available for super-spreader detection. Therefore, the detection method that compresses the huge network traffic into a very small memory space through the sketch structure to achieve high memory efficiency and expected accuracy has become a hot topic in recent years.

[0003] At present, there have been many studies on super-spreader detection using sketch, among which reversible algorithms have attracted much attention because they can recover the flow ID of super-spreaders from the data structure itself. However, in real-world data streams, most are small-cardinality streams, and only a small number are large-cardinality streams, where the cardinality of these large streams is often hundreds, thousands, or even tens of thousands of times different from that of small streams. Most reversible algorithms ignore the skewed distribution of network flows, resulting in low utilization of memory resources. Although some studies have made efforts to adapt to highly skewed flow distributions, their specially designed data structures often cannot efficiently use limited memory resources, nor can they detect super-spreaders more accurately. Summary of the invention

[0004] To this end, the technical problem to be solved by the present invention is to overcome the problem in the prior art that super spreaders cannot be detected more accurately.

[0005] In order to solve the above technical problems, the present invention provides a super spreader detection method, comprising:

[0006] Step S1: construct a data structure and initialize it;

[0007] Step S2: Obtain a data packet, use the data structure to update the data packet, and after successfully updating the data packet, perform a super spreader detection operation.

[0008] In one embodiment of the present invention, the method of constructing and initializing the data structure in step S1 includes:

[0009] Construct a data structure, the data structure includes a bucket array B, a register array R, and an independent counter q R ,in,

[0010] The bucket array B includes ω buckets, each bucket consists of λ cells, each cell contains two different fields, one field is an ID field, which is used to record the flow ID; the other field is a counter field, which is responsible for tracking the cardinality of the flow, where a flow refers to a set of data packets with the same flow ID, and the cardinality of the flow represents the number of different elements in the flow; B[i][j].ID and B[i][j].C are used to represent the ID field and the counter field in the jth cell in the i-th bucket, respectively, and all fields are initialized to 0;

[0011] The register array R includes M registers, which are used to record the estimated cardinality, and all register values ​​are initially set to 0;

[0012] The independent counter q R , used to save a probability, initialized to 1.

[0013] In one embodiment of the present invention, the method of performing an update operation on the data packet using the data structure in step S2 includes:

[0014] S201: Obtain a data packet at time t, and extract the flow ID f and element e contained therein;

[0015] S202: Calculate the binary string by using the hash function h(·) for the flow ID f and the element e, and calculate the position of the first 1 from the left of the binary string by combining ρ(·), o=ρ(h(f,e)), where ρ(·) represents a function that returns the position of the first 1 from the left of the input binary string; then map the element e of the data packet to the position of the register in the register array R by g=H1(f,e)modM according to the hash function H1, and obtain the value of the register R[g];

[0016] S203: Compare the value of register R[g] with o. If o is less than or equal to R[g], discard the data packet and jump to step S201. The estimated cardinality of the flow with ID f will not change. If o is greater than R[g], execute step S204 for the data packet.

[0017] S204: Get independent counter q R The value of the current record in At the same time, the flow ID f carried by the data packet is calculated through the hash function H2 and mapped to the position i of the bucket in the bucket array B = H2(f) mod ω, and then the bucket B[i] is traversed;

[0018] S205: If the flow IDf has been recorded in a cell B[i][j] in bucket B[i], execute step S206; if the flow IDf has not been recorded in bucket B[i], jump to step S209;

[0019] S206: Using the adaptive sampling strategy to set the adaptive sampling probability p using the estimated cardinality of the stream recorded in the current bucket array B a , and samples the element of the stream with ID f. If the element has not been sampled, jump to step S201; if the element is sampled, execute step S207;

[0020] S207: Update probability And save it to the independent counter q R In the process, the register R[g]=o is updated again;

[0021] S208: According to and p a The comparison results are different, and the updated values ​​of bucket array B are different. Less than p a , then the estimated cardinality B[i][j].C in the bucket array B plus like Greater than or equal to p a , then the estimated cardinality B[i][j].C plus

[0022] S209: Determine whether there are still empty cells in bucket B[i]. If there are empty cells, select the first empty cell traversed in bucket B[i] to execute step S210 to record the current flow information; if there are no empty cells, execute step S211;

[0023] S210: Assume that the first empty cell traversed in bucket B[i] is B[i][j], and record the flow in cell B[i][j], that is, B[i][j].ID=f.

[0024] S211: By traversing, the cell with the minimum estimated cardinality in the obtained bucket B[i] is recorded as B[i][j'], and its corresponding estimated cardinality value C is recorded min = B[i][j'].C; then the adaptive sampling strategy is used to set the adaptive sampling probability p using the estimated cardinality of the stream recorded in the current bucket array B a, then sample the element, if the element is not sampled, jump to step S201; if the sampling is successful, execute step S212;

[0025] S212: Update probability And save it to the independent counter q R And update register R[g]=o;

[0026] S213: To determine whether to update the information in the cell with the minimum estimated cardinality, according to p a and Set the probability P r ; Next, generate a random decimal T2 and P with a value between (0,1] r Compare the size to determine whether to update the information in the cell with the smallest estimated base. If T2 <P r , then execute step S214; if T2 ≥ P r , then jump to step S201, that is, no longer update the information in the cell with the minimum estimated cardinality;

[0027] S214: Update the information in the cell with the minimum estimated cardinality in the bucket array B, update B[i][j'].ID to IDf, and update B[i][j'].C to

[0028] In one embodiment of the present invention, the adaptive sampling probability p is set by using the estimated cardinality of the stream recorded in the current bucket array B through the adaptive sampling strategy in step S206 and step S211. a The formula is:

[0029]

[0030] Among them, σ is a predefined constant related to the estimation accuracy, and C is the estimated cardinality of the stream recorded in the current bucket array B.

[0031] In one embodiment of the present invention, in step S213, according to p a and Set the probability P r , the formula is:

[0032]

[0033] Among them, P min For p a and The smaller value between the two.

[0034] In one embodiment of the present invention, the method of performing a super spreader detection operation on the data packet using the data structure in step S2 includes:

[0035] S41: In the measurement cycle, if the element e corresponding to the flow ID f successfully updates the bucket array B, the estimated cardinality of the subordinate flow of the element e is obtained from the cell of the bucket array B to which it is mapped;

[0036] S42: Compare the estimated cardinality of the obtained flow IDf with a preset threshold. If it is greater than or equal to the preset threshold, it is determined to be a super spreader; if it is less than the preset threshold, it is not a super spreader;

[0037] S43: After the measurement cycle ends, by traversing each cell B[i][j] in the bucket array B, the flow identifier B[i][j].ID stored in the cell B[i][j] and its corresponding cardinality estimate B[i][j].C are detected;

[0038] S44: If the cardinality estimate of the flow identifier B[i][j].ID recorded in a cell reaches or exceeds the preset threshold ∈, that is, B[i][j].C≥∈, then the flow IDf corresponding to B[i][j].ID is determined to be a super spreader; otherwise, it is not a super spreader.

[0039] In order to solve the above technical problems, the present invention provides a super spreader detection system, comprising:

[0040] Building blocks: used to build data structures and initialize them;

[0041] Detection module: used to obtain data packets, use the data structure to update the data packets, and then perform super spreader detection operations after successfully updating the data packets.

[0042] To solve the above technical problems, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above super-spreader detection method when executing the computer program.

[0043] In order to solve the above technical problems, the present invention provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above super-spreader detection method are implemented.

[0044] To solve the above technical problems, the present invention provides a computer program product, including a computer program, which implements the steps of the above super spreader detection method when executed by a processor.

[0045] The above technical solution of the present invention has the following advantages compared with the prior art:

[0046] The super-spreader detection method described in the present invention constructs an adaptive sampling strategy, through which the sampling probability of flow elements can be dynamically adjusted to adapt to flows of different cardinalities, thereby reducing the probability of large flows updating registers, reducing the excessive occupation of register resources by large flows, and further improving memory resource utilization. The present invention can detect super-spreaders more accurately. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to make the contents of the present invention more clearly understood, the present invention is further described in detail below based on specific embodiments of the present invention in conjunction with the accompanying drawings.

[0048] Figure 1 It is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0049] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it, but the embodiments are not intended to limit the present invention.

[0050] Embodiment 1

[0051] Reference Figure 1 As shown, the present invention relates to a super spreader detection method, comprising:

[0052] Step S1: construct a data structure and initialize it;

[0053] Step S2: Obtain a data packet, use the data structure to update the data packet, and after successfully updating the data packet, perform a super spreader detection operation.

[0054] (1) The data structure of the detection algorithm is specifically implemented as follows:

[0055] Before the detection begins, a super-spreader detection data structure based on adaptive sampling is constructed. The data structure includes a bucket array B containing ω buckets, a register array R containing M registers, and an independent counter q R .

[0056] Each bucket in the bucket array B consists of λ cells, each of which contains two different fields: an ID field, which is used to record the specific flow ID; and a counter field, which is responsible for tracking the cardinality of the flow. A flow refers to a set of packets with the same flow ID, and the cardinality of a flow refers to the number of different elements in the flow. B[i][j].ID and B[i][j].C are used to represent the ID field and counter field in the jth cell in the i-th bucket, respectively.

[0057] Each register in the register array R is usually 5 bits in size and is used to record the estimated cardinality. At the beginning of any measurement cycle, the bucket array B and the register array R are initialized, that is, all fields and registers are set to 0.

[0058] Independent counter q R Used to save a probability, initialized to 1.

[0059] (2) The specific implementation of the data update operation is as follows:

[0060] For each arriving data packet, let its arrival time be t, and extract the flow ID f and element e from it. It should be noted that the flow ID and element of this embodiment are flexibly defined according to application needs, and are usually defined as certain contents in the header field. For example, the flow ID is defined as the source address, and the element is defined as the destination address.

[0061] Subsequently, the flow ID f and element e are hashed to obtain a 32-bit binary string, and the position o of the first 1 from the left of the binary string is calculated in combination with ρ(·). The packet element is then mapped to the position g of the register in the register array R according to the hash function to obtain the value of register R[g]. The value of register R[g] is compared with o: if o is less than or equal to R[g], the packet is discarded and no subsequent update operations are performed, and the estimated cardinality of the flow with ID f does not change; if o is greater than R[g], the operations related to updating the register and bucket array are performed on the packet.

[0062] Next, from the independent counter q R Get the current recorded value as the sampling probability, recorded as This value represents the probability that the value of o calculated by any new element is greater than the register value mapped to the element, that is,

[0063]

[0064] The flow ID f carried by the data packet is calculated by hashing and mapped to the position i of the bucket in the bucket array, and then bucket B[i] is traversed. According to the status of the cells in the bucket, three different situations are obtained and different actions are taken respectively.

[0065] Case 1: Flow ID f has been recorded in a cell B[i][j] in bucket B[i]. Set adaptive sampling probability And sample the stream element with ID f. If the element is not sampled, discard the element and do not update the register and bucket array. If the element is sampled, update the probability And save it to the counter q R Then, the register R[g]=o is updated, and then the bucket array is updated. and p a If the comparison results are different, the updated values ​​of the bucket array are different. Less than p a , then the estimated cardinality in the bucket array B[i][j].C plus like Greater than or equal to p a , then B[i][j].C plus

[0066] Case 2: Flow ID f is not recorded in any of the cells, but there are still empty cells in bucket B[i]. Then the first empty cell B[i][j] traversed in bucket B[i] is selected to record the flow, that is, B[i][j].ID=f.

[0067] Case 3: Flow ID f is not recorded in a cell in the bucket, and there is no empty cell. By traversing the bucket array, the cell with the minimum estimated cardinality in the bucket is recorded as B[i][j'], and its corresponding estimated cardinality value C is set. min =B[i][j'].C. Then set the adaptive sampling probability Then the element is sampled. If the element is not sampled, the subsequent register and bucket array updates are not performed. If the sampling is successful, the probability is updated And update register R[g] = o. To determine whether to update the information in the cell with the minimum estimated cardinality, set the probability Where P min For p a and Next, generate a random decimal T2 and P between (0,1]. r Compare the size to determine whether to update the information in the selected cell with the smallest estimated base. <P r , then update the information in the cell of the bucket array with the minimum estimated cardinality, update B[i][j'].ID to ID f, and update B[i][j'].C to If T2 ≥ Pr , the information in the cell with the smallest estimated cardinality will not be updated.

[0068] (3) The specific operations for super-spreader detection of data include:

[0069] During the data processing process, when an element of the stream with ID f successfully updates the bucket array, the estimated cardinality of the stream with ID f is obtained from the bucket array cell to which the element is mapped and compared with the preset threshold. If the estimated cardinality of the stream with ID f is greater than or equal to the preset threshold, the stream with ID f is determined to be a super spreader, otherwise it is not a super spreader.

[0070] After the measurement cycle ends, by traversing each cell B[i][j] in the bucket array B, the flow identifier B[i][j].ID stored in the cell and its corresponding cardinality estimate B[i][j].C are detected. If the cardinality estimate of the flow B[i][j].ID recorded in a cell reaches or exceeds the preset threshold ∈, that is, B[i][j].C≥∈. Then the flow with ID B[i][j].ID is determined to be a super spreader, otherwise it is not a super spreader.

[0071] The following is a detailed introduction to this embodiment:

[0072] The method provided in the embodiment of the present invention comprises the following steps:

[0073] S11: Build and initialize the detection data structure. The data structure includes a bucket array (denoted as B), a register array (denoted as R) and an independent counter q R . The bucket array B includes ω buckets, each bucket consists of λ cells, and each cell contains two different fields, one is the ID field, which is used to record the specific flow ID; the other is the counter field, which is responsible for tracking the cardinality of the flow, where B[i][j].ID and B[i][j].C represent the ID field and counter field in the jth cell in the i-th bucket, respectively. Initialize all fields to 0. The register array R includes M registers, each of which is usually 5 bits in size and is used to record the estimated cardinality. It can be regarded as a small counter, and all register values ​​are initialized to 0. Independent counter q R , used to save a probability, initialized to 1.

[0074] S12: Get a data packet; the data packet includes a flow ID f and an element e.

[0075] S13: The operations that need to be performed on the data packet on the constructed detection data structure include update operations and super spreader detection operations.

[0076] Furthermore, the specific implementation steps of the data update operation in this embodiment are as follows:

[0077] S201: Obtain a data packet at time t, and extract the flow ID f and element e contained therein.

[0078] S202: The flow ID f and the element e are calculated by the hash function h(·) to obtain a 32-bit binary string, and the position of the first 1 from the left of the binary string is calculated by combining ρ(·), where ρ(·) represents a function that returns the position of the first 1 from the left of the input binary string. Then, according to the hash function H1, the element e of the data packet is mapped to the position of the register in the register array R g=H1(f,e)mod M to obtain the value of the register R[g].

[0079] S203: Compare the value of register R[g] with o. If o is less than or equal to R[g], discard the data packet and jump directly to step S201. The estimated cardinality of the flow with ID f will not change. If o is greater than R[g], execute step S204 for the data packet.

[0080] S204: Get independent counter q R The value of the current record in At the same time, the flow ID f carried by the data packet is calculated through the hash function H2 and mapped to the position i=H2(f)modω of the bucket in the bucket array B, and then the bucket B[i] is traversed.

[0081] S205: If the flow IDf has been recorded in a cell B[i][j] in bucket B[i], execute step S206; if the flow IDf has not been recorded in bucket B[i], jump to step S209.

[0082] S206: Setting the adaptive sampling probability through the adaptive sampling strategy Where σ is a predefined constant related to the estimation accuracy, B[i][j].C is the estimated cardinality of the stream recorded in the current bucket array B, and the element of the stream with ID f is sampled. If the element is not sampled, jump to step S201. If the element is sampled, continue to execute step S207.

[0083] S207: Update probability And save it to the counter q R Then update register R[g]=o.

[0084] S208: According to and p a The comparison results are different, and the updated values ​​of bucket array B are different. Less than p a, then the estimated cardinality B[i][j].C in the bucket array B plus like Greater than or equal to p a , then the estimated cardinality B[i][j].C plus

[0085] S209: Determine whether there are still empty cells in bucket B[i]. If there are empty cells, select the first empty cell traversed in bucket B[i] to execute step S210 to record the current flow information; if there are no empty cells, execute step S211.

[0086] S210: Assume that the first empty cell traversed in bucket B[i] is B[i][j], and record the flow in cell B[i][j], that is, B[i][j].ID=f.

[0087] S211: By traversing, the cell with the minimum estimated cardinality in the obtained bucket B[i] is recorded as B[i][j'], and its corresponding estimated cardinality value C is recorded min =B[i][j'].C. Then set the adaptive sampling probability through the adaptive sampling strategy Then the element is sampled. If the element is not sampled, the process jumps to step S201. If the sampling is successful, the process executes step S212.

[0088] S212: Update probability And save it to the independent counter q R and updates register R[g]=o.

[0089] S213: To determine whether to update the information in the cell with the minimum estimated cardinality, set the probability Where P min For p a and Next, generate a random decimal T2 and P between (0,1]. r Compare the size to determine whether to update the information in the cell with the smallest estimated base. <P r , then execute step S214. If T2 ≥ P r , then jump to step S201, that is, no longer update the information in the cell with the minimum estimated cardinality.

[0090] S214: Update the information in the cell of the bucket array B with the minimum estimated cardinality, and update B[i][j'].ID to IDf, and update B[i][j'].C to

[0091] Furthermore, the process of super-spreader detection in this embodiment specifically includes:

[0092] S41: During the measurement cycle, if an element e of the stream with ID f successfully updates the bucket array B, the estimated cardinality of the stream with ID f is obtained from the cell of the bucket array B to which it is mapped.

[0093] S42: Compare the estimated cardinality of the flow with ID f with the preset threshold. If it is greater than or equal to the preset threshold, the flow with ID f is determined to be a super spreader; if it is less than the preset threshold, the flow with ID f is not a super spreader.

[0094] S43: After the measurement cycle ends, by traversing each cell B[i][j] in the bucket array B, the flow identifier B[i][j].ID stored in the cell B[i][j] and its corresponding cardinality estimate B[i][j].C are detected.

[0095] S44: If the cardinality estimate of the flow identifier B[i][j].ID recorded in a cell reaches or exceeds the preset threshold ∈, that is, B[i][j].C≥∈, then the flow with ID B[i][j].ID is determined to be a super spreader; otherwise, the flow with ID B[i][j].ID is not a super spreader.

[0096] Embodiment 2

[0097] This embodiment provides a super spreader detection system, including:

[0098] Building blocks: used to build data structures and initialize them;

[0099] Detection module: used to obtain data packets, use the data structure to update the data packets, and then perform super spreader detection operations after successfully updating the data packets.

[0100] Embodiment 3

[0101] This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the super-spreader detection method described in Embodiment 1 when executing the computer program.

[0102] Embodiment 4

[0103] This embodiment provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the super-spreader detection method described in Embodiment 1 are implemented.

[0104] Embodiment 5

[0105] This embodiment provides a computer program product, including a computer program, characterized in that when the computer program is executed by a processor, the steps of the super-spreader detection method described in Example 1 are implemented.

[0106] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0107] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0108] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0109] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0110] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0111] Obviously, the above embodiments are merely examples for clear explanation and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived from these are still within the protection scope of the invention.

Claims

1. A super spreader detection method, characterized in that: include: Step S1: construct a data structure and initialize it; Step S2: Obtain a data packet, use the data structure to update the data packet, and after successfully updating the data packet, perform a super spreader detection operation.

2. The super spreader detection method according to claim 1, characterized in that: The method for constructing and initializing the data structure in step S1 includes: Construct a data structure, the data structure includes a bucket array B, a register array R, and an independent counter q R ,in, The bucket array B includes ω buckets, each bucket consists of λ cells, each cell contains two different fields, one field is an ID field, which is used to record the flow ID; the other field is a counter field, which is responsible for tracking the cardinality of the flow, where a flow refers to a set of data packets with the same flow ID, and the cardinality of the flow represents the number of different elements in the flow; B[i][j].ID and B[i][j].C are used to represent the ID field and the counter field in the jth cell in the i-th bucket, respectively, and all fields are initialized to 0; The register array R includes M registers, which are used to record the estimated cardinality, and all register values ​​are initially set to 0; The independent counter q R , used to save a probability, initialized to 1.

3. The super spreader detection method according to claim 2, characterized in that: The method for updating the data packet using the data structure in step S2 includes: S201: Obtain a data packet at time t, and extract the flow ID f and element e contained therein; S202: Calculate the binary string by using the hash function h(·) for the flow ID f and the element e, and calculate the position of the first 1 from the left of the binary string by combining ρ(·), o=ρ(h(f,e)), where ρ(·) represents a function that returns the position of the first 1 from the left of the input binary string; then map the element e of the data packet to the position of the register in the register array R by g=H1(f,e)mod M according to the hash function H1, and obtain the value of the register R[g]; S203: Compare the value of register R[g] with o. If o is less than or equal to R[g], discard the data packet and jump to step S201. The estimated cardinality of the flow with ID f will not change. If o is greater than R[g], execute step S204 for the data packet. S204: Get independent counter q R The value of the current record in At the same time, the flow ID f carried by the data packet is calculated through the hash function H2 and mapped to the position i of the bucket in the bucket array B = H2(f) mod ω, and then the bucket B[i] is traversed; S205: If the flow IDf has been recorded in a cell B[i][j] in bucket B[i], execute step S206; if the flow IDf has not been recorded in bucket B[i], jump to step S209; S206: Using the adaptive sampling strategy to set the adaptive sampling probability p using the estimated cardinality of the stream recorded in the current bucket array B a , and samples the element of the stream with ID f. If the element has not been sampled, jump to step S201; if the element is sampled, execute step S207; S207: Update probability And save it to the independent counter q R In the process, the register R[g]=o is updated again; S208: According to and p a The comparison results are different, and the updated values ​​of bucket array B are different. Less than p a , then the estimated cardinality B[i][j].C in the bucket array B plus like Greater than or equal to p a , then the estimated cardinality B[i][j].C plus S209: Determine whether there are still empty cells in bucket B[i]. If there are empty cells, select the first empty cell traversed in bucket B[i] to execute step S210 to record the current flow information; if there are no empty cells, execute step S211; S210: Assume that the first empty cell traversed in bucket B[i] is B[i][j], and record the flow in cell B[i][j], that is, B[i][j].ID=f. S211: By traversing, the cell with the minimum estimated cardinality in the obtained bucket B[i] is recorded as B[i][j'], and its corresponding estimated cardinality value C is recorded min = B[i][j'].C; then the adaptive sampling strategy is used to set the adaptive sampling probability p using the estimated cardinality of the stream recorded in the current bucket array B a , then sample the element, if the element is not sampled, jump to step S201; if the sampling is successful, execute step S212; S212: Update probability And save it to the independent counter q R And update register R[g]=o; S213: To determine whether to update the information in the cell with the minimum estimated cardinality, according to p a and Set the probability P r ; Next, generate a random decimal T2 and P with a value between (0,1] r Compare the size to determine whether to update the information in the cell with the smallest estimated base. If T2 <P r , then execute step S214; if T2 ≥ P r , then jump to step S201, that is, no longer update the information in the cell with the minimum estimated cardinality; S214: Update the information in the cell with the minimum estimated cardinality in the bucket array B, update B[i][j'].ID to IDf, and update B[i][j'].C to 4. The super spreader detection method according to claim 3, characterized in that: In step S206 and step S211, the adaptive sampling probability p is set by using the estimated cardinality of the stream recorded in the current bucket array B through the adaptive sampling strategy. a The formula is: Among them, σ is a predefined constant related to the estimation accuracy, and C is the estimated cardinality of the stream recorded in the current bucket array B.

5. The super spreader detection method according to claim 3, characterized in that: In step S213, according to p a and Set the probability P r , the formula is: Among them, P min For p a and The smaller value between the two.

6. The super spreader detection method according to claim 3, characterized in that: The method for performing a super spreader detection operation on the data packet using the data structure in step S2 includes: S41: During the measurement period, if an element e of the flow with ID f successfully updates the bucket array B, the estimated cardinality of the flow with ID f is obtained from the cell of the bucket array B to which it is mapped; S42: Compare the estimated cardinality of the flow with ID f obtained with a preset threshold value, if it is greater than or equal to the preset threshold value, determine that the flow with ID f is a super spreader; if it is less than the preset threshold value, determine that the flow with ID f is not a super spreader; S43: After the measurement cycle ends, by traversing each cell B[i][j] in the bucket array B, the flow identifier B[i][j].ID stored in the cell B[i][j] and its corresponding cardinality estimate B[i][j].C are detected; S44: If the cardinality estimate of the flow identifier B[i][j].ID recorded in a cell reaches or exceeds the preset threshold ∈, that is, B[i][j].C≥∈, then the flow with ID B[i][j].ID is determined to be a super spreader; otherwise, the flow with ID B[i][j].ID is not a super spreader.

7. A super spreader detection system, characterized by: include: Building blocks: used to build data structures and initialize them; Detection module: used to obtain data packets, use the data structure to update the data packets, and then perform super spreader detection operations after successfully updating the data packets.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the super spreader detection method as described in any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the super spreader detection method as described in any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the super spreader detection method described in any one of claims 1 to 6 are implemented.

Images