Network QoS (Quality of Service) evaluation method, system, equipment and medium based on SIP (Session Initiation Protocol) message adaptive flow analysis

Abstract

The invention relates to the technical field of digital information transmission, in particular to a network QoS (Quality of Service) evaluation method, system, equipment and medium based on SIP (Session Initiation Protocol) message adaptive flow analysis. The network QoS evaluation method comprises the following steps of: segmenting data in sections to obtain basic characteristics of flow information in each time period; cleaning, denoising and standardizing the information; calculating the correlation degree between every two flow characteristics to obtain a mutual information correlation matrix; selecting the first k principal components according to the size of the feature values, and finally projecting the original data into a new feature space to obtain a k-dimensional feature set after dimension reduction; and the network administrator completes five-level classification evaluation on the network QoS based on the optimal feature set. According to the method, a self-adaptive feature extraction process is established, the weights of the features are automatically adjusted according to actual conditions, the attention on key features is improved, the influence on irrelevant features is reduced, and the range of the features to be evaluated is narrowed.

Description

Technical Field

[0001] The present invention relates to the technical field of digital information transmission, and in particular to a network QoS evaluation method, system, equipment and medium based on SIP message adaptive flow analysis. Technical Background

[0002] VoIP (Voice over Internet Protocol) is a technology that uses IP protocol for voice communication. VoIP can convert voice signals into digital data packets so that they can be transmitted over the Internet or other IP networks. Due to its low cost, flexible communication, high scalability and easy integration and management, VoIP communication technology has been widely used in homes, enterprises and operators, providing technical support for high-quality, affordable and versatile communication services.

[0003] Traffic mapping in the VoIP system environment network refers to extracting various performance indicators and characteristic information about call quality, network performance and user experience by measuring and analyzing traffic characteristics in VoIP communications, such as delay, jitter, packet loss, etc. By measuring, analyzing and evaluating actual communication traffic, VoIP network security can be effectively strengthened and VoIP service quality can be optimized, such as security monitoring, quality of service (QoS) evaluation, data compression, traffic classification, anomaly detection and business analysis. Summary of the invention

[0004] The present invention aims to improve the security and reliability of the network by adaptively measuring and analyzing the SIP-based traffic characteristics in the VoIP system environment network in the terminal soft switch network, exploring and analyzing the network problems that may occur in the communication of the SIP-based VoIP system environment, and providing new solutions and technical support for network security and network performance optimization. The specific technical solution is as follows:

[0005] In a first aspect, a network QoS evaluation method based on SIP message adaptive traffic analysis includes the following process:

[0006] S01: At a certain time interval T default The full-protocol traffic data is passed in, and the data is segmented according to the timestamp in the traffic data to obtain the basic characteristics of the traffic information in each time period, and the SIP-based traffic data in the full-protocol traffic data is further parsed to obtain a basic characteristic information table;

[0007] S02: Clean, denoise and standardize the collected raw traffic information in each time period;

[0008] S03: Calculate the correlation between the traffic features and obtain the mutual information correlation matrix; the formula is as follows:

[0009]

[0010] Among them, p(x) is the marginal probability density function of x, p(y) is the marginal probability density function of y, and p(x,y) is the joint probability density function of the current x and y, which can be understood as the probability of x occurring independently, the probability of y occurring independently, and the probability of x and y occurring simultaneously;

[0011] S04: Update the correlation matrix using the exponentially weighted moving average method. The update method is as follows:

[0012]

[0013] Among them, the update weight w is calculated from the cosine similarity CosSim or Euclidean distance EucilideanDist between the correlation matrices according to the user-defined calculation formula;

[0014] Among them, C, C*old and C*new are all correlation matrices, which are the parameter correlation matrix obtained based on the statistical data in the current cycle, the historical feature correlation matrix before the update (after the update in the previous cycle), and the historical feature correlation matrix after the update in this cycle;

[0015] S05: According to the updated correlation matrix, the principal component analysis (PCA) algorithm is used to calculate the covariance matrix of the data, and the eigenvectors and eigenvalues ​​of the covariance matrix are found. The first k principal components (k is specified by the user) are selected according to the size of the eigenvalues. Finally, the original data is projected into the new feature space to obtain the k-dimensional feature set after dimensionality reduction, so as to achieve the update of the optimal feature set and narrow the range of features to be studied. The formula is as follows:

[0016]

[0017] S06: The network administrator completes a five-level classification evaluation of the network QoS based on the optimal feature set. The SVM classifier combines the optimal feature set data and the network administrator's evaluation results. According to important network QoS evaluation indicators such as delay, packet loss rate, jitter and bandwidth, the classifier outputs the final five-level classification evaluation results of the research network to train the feature analysis model.

[0018] In a second aspect, a network QoS evaluation system based on SIP message adaptive traffic analysis is provided, the evaluation system comprising:

[0019] A flow characteristic analysis module, used to obtain a flow record file, and perform characteristic analysis on the flow record file to obtain a flow basic characteristic information table; wherein the flow basic characteristic information table includes the flow basic characteristic information in each time period;

[0020] A data preprocessing module, which is in communication with the flow feature analysis module and is used to preprocess the basic flow feature information in the basic flow feature information table to obtain a preprocessed flow feature information table;

[0021] A correlation calculation module, which is in communication with the data preprocessing module and is used to obtain a flow characteristic correlation matrix according to the preprocessed flow characteristic information table;

[0022] An adaptive feature extraction module, which is in communication connection with the correlation calculation module, is used to dynamically and adaptively update the pre-stored historical traffic feature correlation matrix according to the traffic feature correlation matrix to obtain an updated traffic feature correlation matrix, and obtain an optimal feature correlation set according to the updated traffic feature correlation matrix;

[0023] The feature analysis module is in communication with the adaptive feature extraction module and is used to obtain a flow evaluation result according to the optimal feature association set.

[0024] According to a third aspect, an electronic device includes:

[0025] a memory for storing computer program instructions; and,

[0026] The processor is used to execute the computer program instructions to complete the operation of the above-mentioned network QoS evaluation method based on SIP message adaptive traffic analysis.

[0027] In a fourth aspect, a computer-readable storage medium is used to store computer-readable computer program instructions, wherein the computer program instructions are configured to execute the operations of the above-mentioned network QoS evaluation method based on SIP message adaptive traffic analysis when running.

[0028] The present invention has the following advantages:

[0029] The present invention constructs an adaptive traffic analysis technology based on SIP messages, which is used to optimize the network performance indicators of the VoIP system environment, provides a new solution for further improving network security and network services, and has good practical applicability.

[0030] The present invention introduces mutual information as an indicator for measuring the correlation between features in the SIP-based traffic analysis and traffic feature extraction process. Mutual information analysis can help identify and quantify the interaction relationship between features and discover key information and patterns hidden in traffic data.

[0031] The present invention establishes an adaptive feature extraction process, which automatically adjusts the weight of features according to actual conditions, increases the focus on key features, reduces the impact on irrelevant features, and narrows the range of features to be evaluated. Adaptive feature extraction can improve the accuracy and effectiveness of traffic analysis, and can automatically adapt to different SIP traffic scenarios and extract the most representative features. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a flow chart of a network QoS evaluation method based on SIP message adaptive traffic analysis. DETAILED DESCRIPTION

[0033] Example 1

[0034] A network QoS evaluation method based on SIP message adaptive traffic analysis includes the following process:

[0035] S01: At a certain time interval T default The full-protocol traffic data is passed in, and the data is segmented according to the timestamp in the traffic data to obtain the basic characteristics of the traffic information in each time period, and the SIP-based traffic data in the full-protocol traffic data is further parsed to obtain a basic characteristic information table;

[0036] The collected raw traffic information of each time period is cleaned, denoised and standardized. First, the Z-Score standardization algorithm is used to standardize the data. The formula is as follows:

[0037]

[0038] Among them, X is the original data, μ is the data mean, and σ is the standard deviation of the data;

[0039] Then use the median filter algorithm to further remove the noise in the information.

[0040] Y i =median(X i-n+1 ,X i-n+2 ,…,X i );

[0041] Among them, Y i is the filtered data, X is the original data, and n is the filter window size, which is usually a positive integer greater than 3;

[0042] Calculate the degree of correlation between traffic features and obtain the mutual information correlation matrix; the formula is as follows:

[0043]

[0044] Among them, p(x) is the marginal probability density function of x, p(y) is the marginal probability density function of y, and p(x,y) is the joint probability density function of the current x and y, which can be understood as the probability of x occurring independently, the probability of y occurring independently, and the probability of x and y occurring simultaneously;

[0045] S04: Update the correlation matrix using the exponentially weighted moving average method. The update method is as follows:

[0046]

[0047] Among them, the calculation method of updating weight w is as follows:

[0048] w=α×CosSim+β×EucilideanDist,

[0049] CosSim represents the cosine similarity between C*old and C, and EucilideanDist represents the Euclidean distance between the matrices C*old and C; α+β=1, 0≤α≤1, 0≤β≤1;

[0050] Among them, C, C*old and C*new are all correlation matrices, which are the parameter correlation matrix obtained based on the statistical data in the current cycle, the historical feature correlation matrix before the update (after the update in the previous cycle), and the historical feature correlation matrix after the update in this cycle;

[0051] S05: According to the updated correlation matrix, the principal component analysis (PCA) algorithm is used to calculate the covariance matrix of the data, and the eigenvectors and eigenvalues ​​of the covariance matrix are found. The first k principal components (k is specified by the user) are selected according to the size of the eigenvalues. Finally, the original data is projected into the new feature space to obtain the k-dimensional feature set after dimensionality reduction, so as to achieve the update of the optimal feature set and narrow the range of features to be studied. The formula is as follows:

[0052]

[0053] S06: The network administrator completes a five-level classification evaluation of the network QoS based on the optimal feature set. The SVM classifier combines the optimal feature set data and the network administrator's evaluation results. According to important network QoS evaluation indicators such as delay, packet loss rate, jitter and bandwidth, the classifier outputs the final five-level classification evaluation results of the research network to train the feature analysis model.

[0054] First, through traffic measurement and analysis, network administrators can discover bottlenecks and problems in the network, and then take corresponding optimization measures, such as adjusting network parameters, increasing bandwidth, improving network topology, etc., to improve the quality and stability of VoIP calls; secondly, by measuring and analyzing user call traffic, service providers can understand the user experience in different network environments, and then optimize the user's communication experience and improve user satisfaction; in addition, regular VoIP network traffic analysis can identify and monitor abnormal activities and potential security threats in the network, prevent abnormal network behavior and intrusion attempts, and protect it from potential attacks and abuse, which is conducive to improving the security and reliability of VoIP networks.

[0055] Example 2

[0056] The difference between this embodiment and embodiment 1 is S02, and the rest of the embodiments are exactly the same.

[0057] In S02, the Min-Max normalization algorithm is used; the formula is as follows:

[0058]

Claims

1. A network QoS evaluation method based on SIP message adaptive traffic analysis, characterized in that: The process includes the following: S01: At a certain time interval T default The full-protocol traffic data is passed in, and the data is segmented according to the timestamp in the traffic data to obtain the basic characteristics of the traffic information in each time period, and the SIP-based traffic data in the full-protocol traffic data is further parsed to obtain a basic characteristic information table; S02: Clean, denoise and standardize the collected raw traffic information in each time period; S03: Calculate the correlation between the traffic features and obtain the mutual information correlation matrix; the formula is as follows: Among them, p(x) is the marginal probability density function of x, p(y) is the marginal probability density function of y, and p(x,y) is the joint probability density function of the current x and y, which can be understood as the probability of x occurring independently, the probability of y occurring independently, and the probability of x and y occurring simultaneously; S04: Update the correlation matrix using the exponentially weighted moving average method. The update method is as follows: Among them, the update weight w is calculated from the cosine similarity CosSim or Euclidean distance EucilideanDist between the correlation matrices according to the user-defined calculation formula; Among them, C, C*old and C*new are all correlation matrices, which are the parameter correlation matrix obtained based on the statistical data in the current cycle, the historical feature correlation matrix before the update (after the update in the previous cycle), and the historical feature correlation matrix after the update in this cycle; S05: According to the updated correlation matrix, the principal component analysis (PCA) algorithm is used to calculate the covariance matrix of the data, and the eigenvectors and eigenvalues ​​of the covariance matrix are found. The first k principal components (k is specified by the user) are selected according to the size of the eigenvalues. Finally, the original data is projected into the new feature space to obtain the k-dimensional feature set after dimensionality reduction, so as to achieve the update of the optimal feature set and narrow the range of features to be studied. The formula is as follows: S06: The network administrator completes a five-level classification evaluation of the network QoS based on the optimal feature set. The SVM classifier combines the optimal feature set data and the network administrator's evaluation results. According to important network QoS evaluation indicators such as delay, packet loss rate, jitter and bandwidth, the classifier outputs the final five-level classification evaluation results of the research network to train the feature analysis model.

2. According to claim 1, a network QoS evaluation method based on SIP message adaptive traffic analysis is characterized in that: In S02, the Z-Score standardization algorithm is first applied to standardize the data, and the formula is as follows: Among them, X is the original data, μ is the data mean, and σ is the standard deviation of the data; Then use the median filter algorithm to further remove the noise in the information. Y i =median(X i-n+1 ,X i-n+2 ,…,X i ); Among them, Y i is the filtered data, X is the original data, and n is the filter window size, which is usually a positive integer greater than 3.

3. According to claim 1, a network QoS evaluation method based on SIP message adaptive traffic analysis is characterized in that: In S02, the Min-Max normalization algorithm is used; the formula is as follows:

4. According to claim 1, a network QoS evaluation method based on SIP message adaptive traffic analysis is characterized in that: In S04, the calculation method of w is as follows: w=α×CosSim+β×EucilideanDist, CosSim represents the cosine similarity between C*old and C, and EucilideanDist represents the Euclidean distance between the matrices C*old and C; α+β=1, 0≤α≤1, 0≤β≤1.

5. A network QoS evaluation system based on SIP message adaptive traffic analysis, characterized in that: Used to implement a network QoS evaluation method based on SIP message adaptive traffic analysis as described in any one of claims 1 to 4; the evaluation system comprises: A flow characteristic analysis module, used to obtain a flow record file, and perform characteristic analysis on the flow record file to obtain a flow basic characteristic information table; wherein the flow basic characteristic information table includes the flow basic characteristic information in each time period; A data preprocessing module, which is in communication with the flow feature analysis module and is used to preprocess the basic flow feature information in the basic flow feature information table to obtain a preprocessed flow feature information table; A correlation calculation module, which is in communication with the data preprocessing module and is used to obtain a flow characteristic correlation matrix according to the preprocessed flow characteristic information table; An adaptive feature extraction module, which is in communication connection with the correlation calculation module, is used to dynamically and adaptively update the pre-stored historical traffic feature correlation matrix according to the traffic feature correlation matrix to obtain an updated traffic feature correlation matrix, and obtain an optimal feature correlation set according to the updated traffic feature correlation matrix; The feature analysis module is in communication with the adaptive feature extraction module and is used to obtain a flow evaluation result based on the optimal feature association set.

6. An electronic device, characterized in that: include: a memory for storing computer program instructions; as well as, A processor is used to execute the computer program instructions to complete the operation of the network QoS evaluation method based on SIP message adaptive traffic analysis as described in any one of claims 1 to 4.

7. A computer-readable storage medium for storing computer program instructions readable by a computer, characterized in that: The computer program instructions are configured to execute the operations of a network QoS evaluation method based on SIP message adaptive traffic analysis as claimed in any one of claims 1 to 4 when executed.

Images