A super-spreader detection method, system, device and medium

Abstract

The application relates to a super-spreader detection method, system, device and medium, wherein the method comprises the following steps: S1, constructing a data structure and initializing the data structure; S2, obtaining a data packet, performing an updating operation on the data packet by using the data structure, and performing a super-spreader detection operation after successfully performing the updating operation on the data packet. By using an adaptive sampling strategy in the updating operation, the application can dynamically adjust the sampling probability of a flow element to adapt to different flow bases, thereby reducing the probability of a large-flow updating register, reducing the excessive occupation of register resources by a large flow, further improving the memory resource utilization rate, and more accurately detecting a super-spreader.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a super-spreader detection method, system, device and medium. BACKGROUND

[0002] Super-spreader detection is an important research direction in the field of network flow measurement, which refers to detecting flows with large cardinality in high-speed networks. A flow refers to a collection of packets with the same flow ID, where the definition of flow ID and elements can be flexibly configured according to different measurement scenarios. Flow cardinality, as an important indicator of flow size, refers to the number of different elements in the flow. Accurate detection of super-spreader is crucial for network security and management, including network hotspot positioning, detection of malicious attacks and other application scenarios. However, to meet the demand for high-speed traffic processing, network flow measurement functions are usually deployed on network processing chips on the chip. Due to the extremely limited size of the chip memory, this severely limits the available memory space for super-spreader detection. Therefore, a detection method that compresses large network traffic into a small memory space through a sketch structure to achieve high memory efficiency and expected accuracy has become a hot topic in recent years.

[0003] Currently, there are many studies on super-spreader detection using sketches, among which reversible algorithms are of great concern because they can recover the flow ID of the super-spreader from the data structure itself. However, in real-world data streams, most are small cardinality flows, and only a small part are large cardinality flows, where the cardinality of these large flows often differs by hundreds or even tens of thousands of times from small flows. Most reversible algorithms ignore the skewed characteristics of network flow distribution, resulting in low utilization of memory resources. Although some studies have made efforts to adapt to the highly skewed flow distribution, their specially designed data structures often cannot efficiently use limited memory resources and cannot more accurately detect super-spreader. SUMMARY

[0004] Therefore, the technical problem to be solved by the present application is to overcome the problem that the prior art cannot more accurately detect super-spreader.

[0005] To solve the above technical problems, the present application provides a super-spreader detection method, comprising:

[0006] Step S1: constructing a data structure and initializing it;

[0007] Step S2: obtaining a data packet, updating the data packet using the data structure, and performing a super-spreader detection operation after successfully updating the data packet.

[0008] In an embodiment of the present application, the method of constructing the data structure and initializing it in step S1 comprises:

[0009] constructing a data structure, which comprises a bucket array B, a register array R, and an independent counter q R , wherein,

[0010] the bucket array B comprises ω buckets, each bucket consists of λ cells, each cell contains two different fields, one field is an ID field, used to record the flow ID; the other field is a counter field, responsible for tracking the cardinality of the flow, wherein the flow refers to the set of data packets with the same flow ID, and the cardinality of the flow represents the number of different elements in the flow; B[i][j].ID and B[i][j].C represent the ID field and the counter field in the jth cell in the ith bucket, respectively, and all fields are initialized to 0;

[0011] the register array R comprises M registers, used to record the estimated cardinality, and all register values are initialized to 0;

[0012] the independent counter q R is used to save a probability, initialized to 1.

[0013] In an embodiment of the present application, the method of updating the data packet using the data structure in step S2 comprises:

[0014] S201: obtaining a data packet at time t, and extracting the flow ID f and the element e contained therein;

[0015] S202: calculating the binary string of the flow ID f and the element e by a hash function h(·), and calculating the position of the first 1 from the left of the binary string o = ρ(h(f, e)) by combining ρ(·), wherein ρ(·) represents a function that returns the position of the first 1 from the left of the input binary string; and then mapping the element e of the data packet to the position g = H1(f, e) mod M of the register in the register array R according to the hash function H1, to obtain the value of the register R[g];

[0016] S203: comparing the value of the register R[g] with o, if o is less than or equal to R[g], discarding the data packet, and jumping to step S201, the estimated cardinality of the flow with ID f will not change; if o is greater than R[g], executing step S204 on the data packet;

[0017] S204: obtaining the current value recorded in the independent counter q R ​Meanwhile, the flow ID f carried by the data packet is mapped to the position i of the bucket in the bucket array B through a hash function H2, i.e., i = H2(f) mod ω, and then the bucket B[i] is traversed;

[0018] S205: If the flow ID f has been recorded in a cell B[i][j] in the bucket B[i], step S206 is performed; if the flow ID f has not been recorded in the bucket B[i], step S209 is performed;

[0019] S206: The adaptive sampling probability p is set by using the cardinality estimate value of the flow recorded in the current bucket array B through the adaptive sampling strategy a , and the element of the flow with the ID f is sampled; if the element is not sampled, step S201 is performed; if the element is sampled, step S207 is performed;

[0020] S207: The probability p is updated , and the updated probability p is saved in an independent counter q R , and the register R[g] = o is updated;

[0021] S208: According to the comparison result difference between and p a , the updated value of the bucket array B is different; if is less than p a , the estimated cardinality B[i][j].C in the bucket array B is added by ; if is greater than or equal to p a , the estimated cardinality B[i][j].C is added by

[0022] S209: It is determined whether there is still an empty cell in the bucket B[i]; if there is an empty cell, the first empty cell in the bucket B[i] that is traversed is selected to perform step S210 to record the current flow information; if there is no empty cell, step S211 is performed;

[0023] S210: The first empty cell in the bucket B[i] that is traversed is B[i][j], and the flow is recorded in the cell B[i][j], i.e., B[i][j].ID = f,

[0024] S211: Through the traversal, the cell with the minimum estimated cardinality in the bucket B[i] is obtained, which is recorded as B[i][j'], and the corresponding estimated cardinality value C min is recorded as B[i][j'].C; the adaptive sampling probability p is set by using the cardinality estimate value of the flow recorded in the current bucket array B through the adaptive sampling strategy a, and then the element is sampled, if the element is not sampled, jump to step S201; if the sampling is successful, execute step S212;

[0025] S212: update the probability and save it to an independent counter q R , and update the register R[g]=o;

[0026] S213: for judging whether to update the information in the cell with the smallest estimated cardinality, set the probability P a according to p r and ; then, generate a random number T2 with a value in (0, 1] and compare P r with T2, judge whether to update the information in the cell with the smallest estimated cardinality, if T2 r , execute step S214; if T2≥P r , jump to step S201, i.e. do not update the information in the cell with the smallest estimated cardinality;

[0027] S214: update the information in the cell with the smallest estimated cardinality in the bucket array B, update B[i][j'].ID to IDf and B[i][j'].C to

[0028] In an embodiment of the present application, the adaptive sampling strategy in step S206 and step S211 sets the adaptive sampling probability p a according to the cardinality estimate value of the stream recorded in the current bucket array B, and the formula is:

[0029]

[0030] Wherein, σ is a predefined constant related to the estimation accuracy, and C is the cardinality estimate value of the stream recorded in the current bucket array B.

[0031] In an embodiment of the present application, the probability P a in step S213 is set according to p r and , and the formula is:

[0032]

[0033] Wherein, P min is the smaller value between p a and .

[0034] In an embodiment of the present application, the method of performing super-spreader detection operation on the data packet by using the data structure in step S2 comprises:

[0035] S41: In a measurement period, if the element e corresponding to the flow ID f successfully updates the bucket array B, the estimated cardinality of the flow to which the element e belongs is obtained from the bucket array B cell to which the element e is mapped;

[0036] S42: The estimated cardinality of the flow ID f obtained is compared with a preset threshold value, and if it is greater than or equal to the preset threshold value, it is determined to be a super-spreader; if it is less than the preset threshold value, it is not a super-spreader;

[0037] S43: After the measurement period ends, by traversing each cell B[i][j] in the bucket array B, the flow identifier B[i][j].ID stored in the cell B[i][j] and the corresponding cardinality estimate value B[i][j].C are detected;

[0038] S44: If the cardinality estimate value of the flow identifier B[i][j].ID recorded in a certain cell reaches or exceeds the preset threshold value ∈, that is, B[i][j].C≥∈, it is determined that the corresponding flow ID f of B[i][j].ID is a super-spreader; otherwise, it is not a super-spreader.

[0039] To solve the above technical problems, the present application provides a super-spreader detection system, comprising:

[0040] A construction module for constructing a data structure and initializing it;

[0041] A detection module for obtaining a data packet, performing an update operation on the data packet by using the data structure, and then performing a super-spreader detection operation after successfully performing the update operation on the data packet.

[0042] To solve the above technical problems, the present application provides an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the super-spreader detection method.

[0043] To solve the above technical problems, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the steps of the super-spreader detection method.

[0044] To solve the above technical problems, the present application provides a computer program product comprising a computer program, wherein the computer program is executed by a processor to implement the steps of the super-spreader detection method.

[0045] The above technical solutions of the present application have the following advantages compared with the prior art:

[0046] The super-spreader detection method of the present application constructs an adaptive sampling strategy, which can dynamically adjust the sampling probability of flow elements to adapt to different base flows, thereby reducing the probability of large flow updating registers, reducing the excessive occupation of register resources by large flows, further improving the memory resource utilization rate, and more accurately detecting super-spreaders. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to make the content of the present application more easily understood, the present application will be further described in detail below according to specific embodiments of the present application and in conjunction with the accompanying drawings.

[0048] Figure 1 is a method flowchart of the present application. DETAILED DESCRIPTION

[0049] The present application will be further described below in conjunction with the accompanying drawings and specific embodiments, so that those skilled in the art can better understand the present application and implement it, but the embodiments are not limiting the present application.

[0050] Embodiment one

[0051] Referring to Figure 1 The present application relates to a super-spreader detection method, comprising:

[0052] Step S1: constructing a data structure and initializing it;

[0053] Step S2: obtaining a data packet, performing an updating operation on the data packet using the data structure, and then performing a super-spreader detection operation after successfully performing the updating operation on the data packet.

[0054] (1) The data structure of the detection algorithm is implemented as follows:

[0055] Before the detection starts, a super-spreader detection data structure based on adaptive sampling is constructed, which includes a bucket array B containing ω buckets, a register array R containing M registers, and an independent counter q R .

[0056] Each bucket in the bucket array B consists of λ cells, each of which contains two different fields, one is the ID field, which is used to record the flow ID specifically; the other is the counter field, which is responsible for tracking the cardinality of the flow. Among them, the flow refers to the set of data packets with the same flow ID, and the cardinality of the flow represents the number of different elements in the flow. B[i][j].ID and B[i][j].C are used to represent the ID field and the counter field in the jth cell in the ith bucket, respectively.

[0057] Each register in the register array R is usually 5 bits in size and is used to record the estimated cardinality. At the beginning of any measurement period, the bucket array B and the register array R are initialized, that is, all fields and registers are set to 0.

[0058] Independent counter q R Used to save a probability, initialized to 1.

[0059] (2) The specific implementation of the data update operation is as follows:

[0060] For each arriving data packet, let its arrival time be t, and extract the flow ID f and element e from it. It should be noted that the flow ID and element in this embodiment are flexibly defined according to application needs, and will usually be defined as certain contents in the header field. For example, the flow ID is defined as the source address, and the element is defined as the destination address.

[0061] Subsequently, the flow ID f and the element e are subjected to hash calculation to obtain a 32-bit binary string, and ρ(·) is used to calculate the position o of the first 1 from the left of the binary string. Then, the data packet element is mapped to the position g of the register in the register array R according to the hash function, and the value of the register R[g] is obtained. The value of the register R[g] is compared with o: if o is less than or equal to R[g], the data packet is discarded, and the subsequent update operation is not performed, and the estimated cardinality of the flow with ID f will not change; if o is greater than R[g], the operation related to updating the register and the bucket array is performed on the data packet.

[0062] Next, the current value recorded in the independent counter q R is obtained as the sampling probability, denoted as This value represents the probability that the calculated o value of any new element is greater than the value of the register to which the element is mapped, that is,

[0063]

[0064] The flow ID f carried by the data packet is mapped to the position i of the bucket in the bucket array through hash calculation, and then the bucket B[i] is traversed. According to the state of the cell in the bucket, three different situations are obtained, and different operations are taken respectively.

[0065] Case 1: The flow ID f has been recorded in a cell B[i][j] of the bucket B[i]. Set the adaptive sampling probability and sample the element with ID f. If the element is not sampled, discard the element and do not update the register and the bucket array. If the element is sampled, update the probability and save it to the counter q R and then update the register R[g] = o and update the bucket array. According to the comparison result difference between and p a , the value of the bucket array update is different. If is less than p a , the estimated cardinality B[i][j].C in the bucket array plus If is greater than or equal to p a , B[i][j].C plus

[0066] Case 2: The flow ID f is not recorded in any cell, but there is still an empty cell in the bucket B[i]. The first empty cell B[i][j] encountered in the bucket B[i] is selected to record the flow, that is, B[i][j].ID = f,

[0067] Case 3: The flow ID f is not recorded in any cell of the bucket, and there is no empty cell. Through the traversal of the bucket array, the cell with the smallest estimated cardinality in the bucket is obtained and recorded as B[i][j'], and the corresponding estimated cardinality value C min = B[i][j'].C is set. Then the adaptive sampling probability is set. Then the element is sampled. If the element is not sampled, the subsequent register and bucket array are not updated. If the sampling is successful, the probability is updated, and the register R[g] = o is updated. To determine whether to update the information in the cell with the smallest estimated cardinality, the probability is set, where P min is the smaller value between p a and . Then, a random number T2 with a value in (0, 1] is generated and compared with P r to determine whether to update the information in the selected cell with the smallest estimated cardinality. If T2 < P r , the information in the cell with the smallest estimated cardinality in the bucket array is updated, B[i][j'].ID is updated to ID f, and B[i][j'].C is updated to If T2 ≥ Pr If the estimated cardinality of the cell with the smallest estimated cardinality is not smaller than the threshold, then the information in the cell is not updated.

[0068] (3) The super-spreader detection operation on the data specifically includes:

[0069] In the process of processing the data, after one element of the stream with ID f successfully updates the bucket array, the estimated cardinality of the stream with ID f is obtained from the cell of the bucket array to which the element is mapped, and is compared with a preset threshold. If the estimated cardinality of the stream with ID f is greater than or equal to the preset threshold, it is determined that the stream with ID f is a super-spreader, otherwise it is not a super-spreader.

[0070] After the measurement period ends, by traversing each cell B[i][j] in the bucket array B, the stream identifier B[i][j].ID stored in the cell and the corresponding cardinality estimate value B[i][j].C are detected. If the cardinality estimate value of the stream B[i][j].ID recorded in a certain cell reaches or exceeds a preset threshold ∈, that is, B[i][j].C≥∈. Then it is determined that the stream with ID B[i][j].ID is a super-spreader, otherwise it is not a super-spreader.

[0071] The following will introduce the embodiment in detail:

[0072] The method provided by the embodiment of the application comprises the following steps:

[0073] S11: Construct a detection data structure and initialize. The data structure comprises a bucket array (denoted as B), a register array (denoted as R) and an independent counter q R . The bucket array B comprises ω buckets, each bucket comprises λ cells, and each cell comprises two different fields, one is an ID field for specifically recording a stream ID, and the other is a counter field responsible for tracking the cardinality of the stream, wherein B[i][j].ID and B[i][j].C represent the ID field and the counter field in the jth cell in the ith bucket, respectively, and all fields are initialized to 0. The register array R comprises M registers, each register is usually 5 bits in size and is used to record the estimated cardinality, which can be regarded as a small counter, and all register values are initialized to 0. The independent counter q R is used to save a probability, which is initialized to 1.

[0074] S12: Obtain a data packet; the data packet comprises a stream ID f and an element e.

[0075] S13: The operation that the data packet needs to perform on the constructed detection data structure includes an update operation and a super-spreader detection operation.

[0076] Further, the specific implementation steps of the data updating operation in the embodiment are as follows:

[0077] S201: Obtain a data packet at time t, and extract a flow ID f and an element e contained in the data packet.

[0078] S202: Calculate a 32-bit binary string by using a hash function h(·) on the flow ID f and the element e, and calculate the position o of the first 1 in the binary string by using ρ(·), wherein ρ(·) represents a function returning the position of the first 1 in the input binary string. Then, map the element e of the data packet to the position g of a register in a register array R by using a hash function H1, and obtain the value of the register R[g], wherein g = H1(f, e) mod M.

[0079] S203: Compare the value of the register R[g] with o. If o is less than or equal to R[g], discard the data packet, and directly jump to step S201, so that the estimated cardinality of the flow with the ID f will not change; if o is greater than R[g], execute step S204 on the data packet.

[0080] S204: Obtain an independent counter q R and record the value of the counter q Meanwhile, calculate the position i of the bucket in a bucket array B to which the flow ID f carried by the data packet is mapped by using a hash function H2, and then traverse the bucket B[i].

[0081] S205: If the flow ID f has been recorded in a cell B[i][j] in the bucket B[i], execute step S206; if the flow ID f has not been recorded in the bucket B[i], jump to step S209.

[0082] S206: Set an adaptive sampling probability by using an adaptive sampling strategy wherein σ is a predefined constant related to the estimated accuracy, B[i][j].C is the estimated cardinality of the flow recorded in the current bucket array B, and the element of the flow with the ID f is sampled. If the element is not sampled, jump to step S201. If the element is sampled, continue to execute step S207.

[0083] S207: Update the probability and save the probability in the counter q R , and then update the register R[g] = o.

[0084] S208: According to the comparison result difference between and p a , the updated value of the bucket array B is different. If is less than p athen the estimated cardinality B[i][j].C of the bucket array B is added If is greater than or equal to p a then the estimated cardinality B[i][j].C of the bucket array B is added

[0085] S209: Determine whether there is still an empty cell in the bucket B[i]. If there is an empty cell, select the first empty cell in the bucket B[i] that is traversed to perform step S210 to record the current flow information; if there is no empty cell, perform step S211.

[0086] S210: Set the first empty cell in the bucket B[i] that is traversed to B[i][j], record the flow in the cell B[i][j], i.e., B[i][j].ID = f,

[0087] S211: Through traversal, record the cell with the smallest estimated cardinality in the bucket B[i] as B[i][j'], and record its corresponding estimated cardinality value C min = B[i][j'].C. Then set the adaptive sampling probability according to the adaptive sampling strategy, and then sample the element. If the element is not sampled, jump to step S201. If the sampling is successful, perform step S212.

[0088] S212: Update the probability and save it to the independent counter q R , and update the register R[g] = o.

[0089] S213: To determine whether to update the information in the cell with the smallest estimated cardinality, set the probability where P min is the smaller value between p a and . Then generate a random number T2 with a value in (0, 1] and compare P r with T2 to determine whether to update the information in the cell with the smallest estimated cardinality. If T2 < P r , perform step S214. If T2 ≥ P r , jump to step S201, i.e., do not update the information in the cell with the smallest estimated cardinality.

[0090] S214: Update the information in the cell with the smallest estimated cardinality in the bucket array B, update B[i][j'].ID to IDf, and update B[i][j'].C to

[0091] Further, the process of super-spreader detection in this embodiment specifically includes:

[0092] S41: In the measurement period, if an element e of the flow with ID f successfully updates the bucket array B, the estimated cardinality of the flow with ID f is obtained from the bucket array cell to which it is mapped.

[0093] S42: Compare the estimated cardinality of the flow with ID f obtained with the preset threshold value, if greater than or equal to the preset threshold value, determine that the flow with ID f is a super-spreader; if less than the preset threshold value, the flow with ID f is not a super-spreader.

[0094] S43: After the measurement period ends, by traversing each cell B[i][j] in the bucket array B, detecting the flow identifier B[i][j].ID stored in the cell B[i][j] and its corresponding cardinality estimate value B[i][j].C.

[0095] S44: If the cardinality estimate value of the flow identifier B[i][j].ID recorded in a certain cell reaches or exceeds the preset threshold value ∈, that is, B[i][j].C≥∈, then determine that the flow with ID B[i][j].ID is a super-spreader; otherwise, the flow with ID B[i][j].ID is not a super-spreader.

[0096] Embodiment two

[0097] The embodiment provides a super-spreader detection system, comprising:

[0098] A construction module for constructing and initializing a data structure;

[0099] A detection module for obtaining a data packet, performing an update operation on the data packet using the data structure, and performing a super-spreader detection operation after successfully performing the update operation on the data packet.

[0100] Embodiment three

[0101] The embodiment provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the super-spreader detection method of embodiment one.

[0102] Embodiment four

[0103] The embodiment provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the steps of the super-spreader detection method of embodiment one.

[0104] Embodiment five

[0105] The embodiment provides a computer program product comprising a computer program, characterized in that the computer program is executed by a processor to implement the steps of the super-spreader detection method in the embodiment one.

[0106] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. In addition, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) containing computer-usable program code. The solutions in the embodiments of the present application can be implemented in various computer languages, such as object-oriented programming languages Java and interpreted scripting language JavaScript.

[0107] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system) and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus for performing the functions specified in one or more flows and / or blocks.

[0108] These computer program instructions can also be stored in a computer-readable memory capable of guiding a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including instruction apparatus, which implements the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus for performing the functions specified in one or more flows and / or blocks.

[0109] These computer program instructions can also be loaded into a computer or other programmable data processing device, so that a series of operation steps are performed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide a process for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus for performing the functions specified in one or more flows and / or blocks.

[0110] While the preferred embodiments of the application have been described, additional variations and modifications can be made to the embodiments by those of ordinary skill in the art once they have the benefit of the foregoing description. Therefore, the appended claims are intended to encompass within their scope all such variations and modifications as are included within the scope of the application.

[0111] Obviously, the embodiments described above are merely examples for the purpose of clarity and are not intended to limit the scope of the application. Other variations and modifications can be made to the embodiments by those of ordinary skill in the art based on the above description. It is not necessary for all embodiments to be identical. The obvious variations and modifications are intended to be within the scope of the application.

Claims

1. A super-spreader detection method, characterized in that: The method comprises the following steps: Step S1: constructing a data structure and initializing the data structure; The method of constructing the data structure and initializing the data structure in the step S1 comprises: constructing a data structure comprising an array of buckets an array of registers and a separate counter wherein, The bucket array comprises buckets, each bucket is composed of cells, each cell contains two different fields, one field is an ID field for recording the flow ID; the other field is a counter field responsible for tracking the cardinality of the flow, wherein the flow refers to a set of data packets with the same flow ID, and the cardinality of the flow represents the number of different elements in the flow; the ID field and the counter field in the th cell in the th bucket are respectively represented by and , and all fields are initialized to 0; The register array comprising a register for recording the estimated base, initializing all register values to 0; said independent counter to hold a probability, initialized to 1; Step S2: obtaining a data packet, performing an update operation on the data packet by using the data structure, and then performing a super-spreader detection operation after the update operation on the data packet is successfully performed; The method of performing the update operation on the data packet by using the data structure in the step S2 comprises: S201: At time Obtain the data packet, extract the flow ID contained therein And element ; S202: For the stream ID and elements Through hash function The calculated binary string is combined with... Calculate the position of the first 1 from the left in the binary string. , This represents a function that returns the position of the first '1' from the left of the input binary string; then, based on the hash function... The elements of the data packet Mapping to register array Location of the register , obtain register The value; S203: compare the value of the register with , if is less than or equal to , discard the data packet, and jump to step S201, the estimated cardinality of the flow with ID does not change; if is greater than , execute step S204 on the data packet; S204: Get independent counter current record value , and through hash function Calculate the flow ID carried by the data packet Map to the bucket array The position of the bucket , then traverse the bucket ; S205: If the flow ID has been recorded in a cell of the bucket , then step S206 is performed; if the flow ID has not been recorded in the bucket , then the process jumps to step S209; S206: Set adaptive sampling probability by using the cardinality estimate value of the stream recorded in the current bucket array through the adaptive sampling strategy S206: Set adaptive sampling probability by using the cardinality estimate value of the stream recorded in the current bucket array through the adaptive sampling strategy S206: Set adaptive sampling probability by using the cardinality estimate value of the stream recorded in the current bucket array through the adaptive sampling strategy S206: Set adaptive sampling probability by using the cardinality estimate value of the stream recorded in the current bucket array through the adaptive sampling strategy S207: update the probability = + , and save it to an independent counter , and update the register ; S208: According to and The difference in comparison results, bucket array If the updated values ​​are different, Less than Then the bucket array Internal estimation base Plus ;like Greater than or equal to Then estimate the base number Plus ; S209: judging whether there is still an empty cell in the bucket If there is an empty cell, the first empty cell in the bucket is selected to execute step S210 to record the current flow information; if there is no empty cell, step S211 is executed. ​ S210: Set bucket The first empty cell traversed to in the middle is , the cell Record the flow, i.e. , ; S211: By traversing, obtain the buckets The cell with the smallest estimated cardinality is denoted as And record the corresponding estimated base value. Then, an adaptive sampling strategy is used to utilize the current bucket array. The cardinality estimate of the stream recorded in the middle is set with an adaptive sampling probability. Then, the element is sampled. If the element is not sampled, the process jumps to step S201; if the sampling is successful, step S212 is executed. S212: update the probability = + and save it to an independent counter and update the register ; S213: For judging whether to update the information in the cell with the smallest estimated cardinality, according to and set the probability ; then, generate a random number and make a size comparison to judge whether to update the information in the cell with the smallest estimated cardinality, if , execute step S214; if , jump to step S201, i.e. no longer update the information in the cell with the smallest estimated cardinality; S214: Update the bucket array Update the cell information in the cell with the smallest estimated cardinality to have ID , ID ; The method of performing the super-spreader detection operation on the data packet by using the data structure in the step S2 comprises: S41: During the measurement cycle, if ID is An element of the stream Successfully updated bucket array Then from the bucket array it maps to Get the ID from the cell The estimated base of the flow; S42: compare the estimated cardinality of the flow with ID with the preset threshold value, if greater than or equal to the preset threshold value, determine that the flow with ID is a super-spreader; if less than the preset threshold value, the flow with ID is not a super-spreader; S43: After the measurement cycle ends, iterate through the bucket array. Each cell Detect cells Stream identifiers stored in and its corresponding cardinality estimate ; S44: If a cell records a stream identifier The estimated base value reaches or exceeds the preset threshold. At that time, that is Then the ID is determined to be The stream is a super-spreader; otherwise, the ID is... The stream is not a super-spreader.

2. The super-spreader detection method of claim 1, wherein: The step S206 and step S211 use the current bucket array recorded in the step S206 and step S211 set the adaptive sampling probability The formula is: ； wherein, is a predefined constant related to the estimation accuracy, is the cardinality estimate of the stream recorded in the current bucket array .

3. The super-spreader detection method of claim 1, wherein: The step S213 according to and Setting the probability , the formula is: ； wherein is and the smaller of the two.

4. A super-spreader detection system for implementing the super-spreader detection method according to any one of claims 1 to 3, characterized in that: The method comprises the following steps: A constructing module, configured to construct a data structure and initialize the data structure; A detecting module, configured to obtain a data packet, perform an update operation on the data packet by using the data structure, and then perform a super-spreader detection operation after the update operation on the data packet is successfully performed.

5. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that: The processor executes the computer program to implement the steps of the super-spreader detection method according to any one of claims 1 to 3.

6. A computer readable storage medium having stored thereon a computer program, characterized in that: The computer program is executed by the processor to implement the steps of the super-spreader detection method according to any one of claims 1 to 3.

7. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the super-spreader detection method according to any one of claims 1 to 3.

Images