High-speed data packet classification method based on self-adaptive tuple replacement and application

Abstract

The invention relates to a high-speed data packet classification method based on self-adaptive tuple replacement and application, and belongs to the technical field of data packet classification in the field of computer networks. By constructing the mixed data structure, the decision tree and the tuple are combined, and bottleneck branches are detected and replaced in the rule updating process, so that the data packet classification efficiency is improved. According to the method, a low-efficiency branch in a decision tree is replaced by a lightweight hash table tuple structure, so that the stability of the classification speed is kept under the condition that the rule is frequently updated. According to the method, the classification performance can be remarkably improved while memory use is optimized, and the method has good hardware deployment adaptability and is suitable for rapid packet classification in a large-scale network environment.

Description

Technical Field

[0001] The invention relates to a high-speed data packet classification method based on adaptive tuple replacement and application, belonging to the technical field of data packet classification in the field of computer networks. Background Art

[0002] Packet classification is a vital part of network functions such as routing, firewall, and Quality of Service (QoS). Network devices need to classify incoming packets according to predefined rules and take corresponding actions based on the matched rules. As the scale and traffic of modern data center networks continue to grow, the performance requirements of packet classification also increase. For example, existing software switches such as Open vSwitch (OVS) are widely used in virtualization and software-defined networking (SDN) environments, allowing flexible management and allocation of network resources. The Tuple Space Search (TSS) algorithm used by OVS excels in supporting fast rule updates and stable memory consumption, but its classification performance will significantly degrade when faced with large-scale rule sets.

[0003] To improve classification efficiency, existing methods usually combine TSS and decision trees (DT) to form a hybrid structure, thereby supporting fast rule updates while improving classification speed. However, with the dynamic update of the rule set, the decision tree in the hybrid structure is prone to imbalance, resulting in the accumulation of rules in a specific branch, further slowing down the classification speed. Existing methods maintain classification performance by periodically rebuilding the data structure, but this reconstruction process is time-consuming and seriously affects the normal operation of the service. Summary of the invention

[0004] In view of the shortcomings of the prior art, the present invention provides a high-speed data packet classification method based on adaptive tuple replacement, which optimizes the classification speed and minimizes the memory usage by analyzing the bottleneck branches of the decision tree in the hybrid data structure and replacing them with a lightweight tuple structure. In the environment of frequent updates of large-scale network rule sets, the efficiency and stability of data packet classification are guaranteed.

[0005] The technical solution of the present invention is as follows:

[0006] A high-speed data packet classification method based on adaptive tuple replacement comprises the following steps:

[0007] (1) Analyze the decision tree in the hybrid structure and identify the bottleneck branches that affect the classification performance;

[0008] (2) Predict the trend of rule updates through Kalman filtering and determine the bottleneck branches that need to be replaced;

[0009] (3) Use a lightweight tuple replacement structure (PickTSS) to replace the bottleneck branch in the decision tree to optimize the classification performance.

[0010] Preferably, in step (1), the bottleneck branches that affect the classification performance are first identified by statically analyzing the decision tree in the hybrid data structure. Decision trees achieve efficient classification by gradually dividing the search space into smaller subspaces. However, during the rule update process, the fixed branch structure of the decision tree may accumulate too many rules on a specific branch, resulting in a decrease in matching performance on that branch. Therefore, it is necessary to evaluate each branch of the decision tree to determine whether there is a bottleneck branch that affects the matching performance. Specifically, the key to evaluating classification performance is to compare the classification speed of decision trees and tuple space search (TSS). First, the classification time is calculated. For TSS, the classification time can be expressed by T TSS (rules) = k(rules) × T hash Calculate, where k(rules) represents the average number of tuples that need to be traversed during the TSS matching process, T hash represents the average time of hash operation; the classification time of decision tree DT depends on the height of subtree and the average number of linear matching rules, which can be obtained by Calculation; where h(rules) represents the average height of the subtree, T r is the average time of node recursive operation, T m is the average time for matching a single rule, binth is the maximum number of rules in a decision tree leaf node; by comparing T TSS and T DT , it is determined that the matching efficiency of this branch is better than that of the decision tree structure when using the TSS classification structure, and these branches are marked as candidate bottleneck branches.

[0011] Further preferably, after obtaining the classification time of TSS and decision tree, a recursive algorithm based on bottleneck branch search is used for comparison. First, the child nodes are recursively searched from the root node, and the classification performance T of each child node is calculated one by one. TSS and T DT ; Then, according to the classification time of TSS and the classification time of decision tree DT node, the average time consumption of each node is calculated. The calculation is specifically expressed as: the classification performance of all child nodes of the node (possibly T TSS or T DT ) plus the average value of T r The node recursion time is calculated, and whether it is a candidate bottleneck branch is determined; if the total classification time of a node exceeds the classification time of TSS, the node is marked as a candidate bottleneck branch; if the node is marked as a candidate bottleneck branch, it is added to the candidate bottleneck branch list, and it is checked whether other child nodes under the branch are already in the list. If so, the corresponding child nodes in the list are cleared to prevent repeated processing.

[0012] Preferably, in step (2), in order to avoid overfitting the current rule set, a Kalman filter is used to predict the trend of future rule updates of the candidate bottleneck branch; by analyzing the historical rule insertion and deletion data on the branch, the Kalman filter can estimate the future trend of rule updates and help determine whether the bottleneck branch in the decision tree needs to be replaced.

[0013] First, the prediction of rule updates is described by the state transition equation. When the system rules are updated, the number of inserted and deleted rules is sampled. These data are used as the input of the Kalman filter. The state transition equation of the Kalman filter algorithm is as follows:

[0014]

[0015] in, They represent the number of prediction rules, the number of insertion rules, and the number of deletion rules at time k respectively; u k is the input value of the external control variable; matrices A and B represent the state transfer matrix and the control input matrix, respectively, and are defined as:

[0016]

[0017] Here, a and b represent the dynamic change factors of inserting and deleting rules, which are obtained by analyzing historical data; the current rule insertion and deletion status is obtained by u k to reflect;

[0018] The number of prediction rules pass Perform calculations and insert the number of rules and delete rules Through and Calculate, constants m and n represent the proportional relationship between rule insertion and deletion; Next, use the state transition equation of the Kalman filter in formula (1) to predict the state;

[0019] To facilitate matrix calculations, the vector u k Contains the number of real rules R sampled at the current moment k , the predicted covariance matrix Calculated by the following formula:

[0020]

[0021] Among them, P k-1 is the covariance matrix of the last estimate, and its result reflects the error of the system. Q is the process noise covariance matrix, which represents the uncertainty in the rule update process.

[0022] In order to estimate the actual situation of rule updates, the system will then observe the current rule updates. The number of rules actually observed is Z. k is given by the following measurement equation:

[0023] Z k =HX k ,H=[1,1,1](4)

[0024] Where H is the observation matrix, defined as H = [1,1,1], indicating that the system can directly observe the number of rules, the number of inserted rules, and the number of deleted rules. k =[R k ,I k ,D k ], R k ,I k ,D k They represent the number of rules actually sampled at time k, the number of inserted rules, and the number of deleted rules, respectively. k That is, the matrix representing the number of real rules, the number of inserted rules, and the number of deleted rules; by measuring the equation Z k =HX k Get the sample value, where Z k is a vector containing the number of rules, insertions, and deletions;

[0025] After obtaining the measurement data, the system uses the Kalman gain K according to the current observation value. k To correct the predicted value, the gain calculation formula is:

[0026]

[0027] Among them, R is the measurement noise covariance matrix, which reflects the uncertainty in the actual observation; through the Kalman gain, the system adjusts the predicted rule update trend, and the corrected state estimate is:

[0028]

[0029] is the rule prediction vector after Kalman filtering correction, and its result is obtained from the prediction equation result and the true observation X k It is fused through formula (6);

[0030] Then, the covariance matrix P k Updated by the following formula:

[0031]

[0032] Finally, for each candidate bottleneck branch, we can predict R k ,Ik and D k , by comparing I k -D k The value of , we can determine the future trend of the branch rule update. k -D k > 0, we mark it as a true bottleneck branch and perform step (3) tuple replacement.

[0033] Preferably, in step (3), after the bottleneck branch is determined, the bottleneck branch is replaced using a lightweight tuple replacement structure PickTSS; the traditional hash-based packet classification structure TSS divides tuples for each field involved in the classification, and hashes the prefix on each field to achieve rule matching and updating. PickTSS is oriented to the local branch of the decision tree, and by selecting some fields for tuple division and hashing operations, the number of tuples and hash fields that need to be maintained is reduced, the memory overhead is reduced, and a high classification speed is maintained. For example, when hashing on field X and field Y, the number of tuples is 4 (i.e. [4,4], [4,3], [3,4], [3,3]), while when hashing only on field X, the number of tuples is 2 (i.e. [4], [3]). This optimization greatly reduces the time and memory required for hashing operations.

[0034] Specifically, PickTSS first counts the number of different prefix lengths that the rules in the replacement branch node have on each field, and finally selects those fields whose number of different prefix lengths is greater than the average number of different prefix lengths on all fields for tuple division and hash calculation inside each tuple to map the content of the selected field to a fixed range for subsequent fast search and classification; for example, if the number of different length prefixes on field X is 6 and the number of different length prefixes on field Y is 3, field X is preferred for hashing because it has more different ranges. The fewer fields selected, the lower the complexity of the hash operation, thereby improving classification efficiency.

[0035] After selecting fields, PickTSS generates tuples based on the selected fields, and stores and manages the rules in the tuples through hashing on these selected fields. For each selected bottleneck branch, we replace all the rules on the branch with tuples to achieve structural optimization of the bottleneck branch. For branches with frequent rule updates, the classification efficiency is affected as little as possible.

[0036] A high-speed data packet classification system based on adaptive tuple replacement includes a search module, a prediction module, and a replacement optimization module. The search module is used to analyze a decision tree in a hybrid structure and identify candidate bottleneck branches that affect classification performance; the prediction module is used to predict the trend of rule update through Kalman filtering and determine the bottleneck branches that need to be replaced; the replacement optimization module is used to replace the bottleneck branches in the decision tree using a lightweight tuple replacement structure (PickTSS) to optimize classification performance.

[0037] A computer-readable storage medium stores a program, which, when executed by a processor, implements the steps in the above-mentioned high-speed data packet classification method based on adaptive tuple replacement.

[0038] The beneficial effects of the present invention are:

[0039] The present invention significantly improves the classification speed under large-scale rule updates and maintains low memory overhead by adaptively replacing the bottleneck branches in the decision tree. Compared with existing methods, the present invention does not require frequent reconstruction of data structures, greatly reduces system downtime, and is suitable for modern data center networks that require efficient classification performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 The overall structure diagram and flow chart of the method of the present invention are shown in FIG.

[0041] Figure 2 This is an example diagram of the bottleneck branch search of the method of the present invention.

[0042] Figure 3 This is an example diagram of rule update trend prediction of the method of the present invention.

[0043] Figure 4 The diagram is an example of lightweight tuple replacement of the method of the present invention, wherein (a) is a schematic diagram of subspace rules, and (b) is a schematic diagram of the lightweight tuple replacement process. DETAILED DESCRIPTION

[0044] The present invention will be further described below by way of embodiments in conjunction with the accompanying drawings, but is not limited thereto.

[0045] Embodiment 1:

[0046] The present invention provides a high-speed data packet classification method based on adaptive tuple replacement, which ensures efficient data packet classification in an environment of large-scale rule updates by identifying bottleneck branches in a decision tree and optimizing these branches using a lightweight tuple replacement structure. The method includes the following steps:

[0047] (1) Analyze the decision tree in the mixed data structure and identify the bottleneck branches that affect the classification performance;

[0048] (2) Predict the trend of rule updates through Kalman filtering and determine the bottleneck branches that need to be replaced;

[0049] (3) Use a lightweight tuple replacement structure (PickTSS) to replace the bottleneck branch in the decision tree to optimize the classification performance.

[0050] The following is the specific implementation process of the present invention.

[0051] Please refer to Figure 1 ,The present invention includes three main parts including bottleneck branch search, rule ,update trend prediction and lightweight tuple replacement.

[0052] (1) Bottleneck branch search

[0053] In the hybrid data structure, decision trees are used to efficiently recursively partition the search space into smaller subspaces, thereby achieving fast packet classification. However, as the rules are dynamically updated, some branches of the decision tree may accumulate too many rules, resulting in performance degradation. The first step of the present invention is to identify these bottleneck branches.

[0054] First, static analysis is performed on the decision tree in the hybrid data structure to evaluate the classification performance of each branch. By calculating the classification time of different branches, it is determined which branches will become performance bottlenecks after the rule update. The classification time is calculated as follows: For TSS, the classification time is calculated by the formula T TSS (rules) = k(rules) × T hash Calculation. Where k(rules) represents the number of tuples that need to be traversed during the TSS matching process, T hash is the average time of hash operation. For decision tree, the classification time is calculated by the formula Calculate. Where h(rules) represents the average height of the subtree, T r is the average time of node recursive operation, T m is the average time for matching a single linear rule, and binth represents the maximum number of rules in a decision tree leaf node.

[0055] By comparing the classification time T of TSS and decision tree DT , determine which branches will become bottlenecks after the rule update, and mark these branches as candidate bottleneck branches. Refer to Algorithm 1: Recursive algorithm based on bottleneck branch search. First, recursively search the child nodes from the root node. If the node is not a leaf node, substitute the decision tree nodes in its child nodes into the algorithm again, and calculate the classification performance T of each child node one by one. TSS and T DTThen, according to the classification time of TSS and DT nodes, the average time consumption of each node is calculated. The calculation is specifically expressed as: the classification performance of all child nodes of the node (may be T TSS or T DT ) plus the average value of T r The node recursion time is calculated and it is judged whether it is a candidate bottleneck branch. If the total classification time of a node (i.e. the above calculation result) exceeds the classification time of TSS, the node is marked as a candidate bottleneck branch. If the node is marked as a candidate bottleneck branch, it is added to the candidate bottleneck branch list and it is checked whether there are other nodes under the branch in the list. If so, the corresponding child nodes in the list are cleared to prevent repeated processing. The process can be referred to Figure 2 Finally, we can get the node set of all candidate bottleneck branches under the decision tree. By continuously performing the above steps, adjacent branches will be merged upward to become larger branches, and finally maintained in the bottleneck queue.

[0056] Algorithm 1: Bottleneck Branch Search Algorithm

[0057] Input: Root node r

[0058] Output: bnList

[0059] 1letbnList = [];

[0060] 2FunctionSearch(TreeNode node)→TreeNode

[0061] 3 / / Recursive search for child nodes

[0062] 4if node is not Leaf then

[0063] 5forchild∈node do

[0064] 6if child.mark is DTthen

[0065] 7child=Search(child)

[0066] 8 / / Estimate the average time cost

[0067] 9letT=0;

[0068] 10forchild∈node do

[0069] 11if child.mark is TSSthen

[0070] 12T+=T TSS(child.rules);

[0071] 13if child.mark is DTthen

[0072] 14T+=T DT (child.rules);

[0073] 15T = T / node.children_num;

[0074] 16 / / Decision whether to add the node to the bottleneck list

[0075] 16if T+T r >T TSS (node.rules)then

[0076] 17node.mark=TSS;

[0077] 18forchild∈node do

[0078] 19if bnList.exist(child)then

[0079] 20bnList.add(node);

[0080] 21returnnode;

[0081] (2) Rule update trend prediction

[0082] In order to improve the stability of the packet classification system under the condition of frequent rule updates, the present invention adopts the Kalman filter algorithm to predict the future rule update trend. By analyzing the historical data of rule insertion and deletion, the system can determine in advance which decision tree branches may become bottlenecks, and thus adopt corresponding optimization strategies. Figure 3 , the specific process is as follows:

[0083] First, each time the system updates the rules, it collects the number of inserted and deleted rules. This data is used as the input of the Kalman filter. By predicting the trend of future rule updates, the system can dynamically adjust the classification structure. The state transition equation of the Kalman filter algorithm is as follows:

[0084]

[0085] in, represents the number of prediction rules, insertion rules, and deletion rules at time k, They represent the number of prediction rules, the number of insertion rules, and the number of deletion rules at time k respectively; u kis the input value of the external control variable; matrices A and B represent the state transfer matrix and the control input matrix, respectively, and are defined as:

[0086]

[0087] Here, a and b represent the dynamic change factors of inserting and deleting rules, which are obtained by analyzing historical data. The current rule insertion and deletion situation is controlled by input u k To reflect.

[0088] The number of prediction rules pass Perform calculations and insert the number of rules and delete rules Through and Calculate, constants m and n represent the proportional relationship between rule insertion and deletion; Next, use the state transition equation of the Kalman filter in formula (1) to predict the state. Vector u k Contains the number of real rules R sampled at the current moment k .

[0089] In order to evaluate the predicted rule update trend, the Kalman filter algorithm also estimates the uncertainty of the system. The predicted covariance matrix Calculated by the following formula:

[0090]

[0091] Among them, P k-1 is the covariance matrix of the last estimate, and its result reflects the error of the system. Q is the process noise covariance matrix, which represents the uncertainty in the rule update process. Next, the system will observe according to the current rule update situation, and the actual number of rules observed is Z. k is given by the following measurement equation:

[0092] Z k =HX k ,H=[1,1,1](4)

[0093] Where H is the observation matrix, defined as H = [1,1,1], indicating that the system can directly observe the number of rules, the number of inserted rules, and the number of deleted rules. k =[R k ,I k ,D k ], R k ,I k ,D k They represent the number of rules actually sampled at time k, the number of inserted rules, and the number of deleted rules, respectively. kThat is, the matrix representing the number of real rules, the number of inserted rules, and the number of deleted rules; by measuring the equation Z k =HX k Get the sample value, where Z k is a vector containing the number of rules, insertions, and deletions.

[0094] After obtaining the measurement data, the system uses the Kalman gain K according to the current observation value. k To correct the predicted value, the gain calculation formula is:

[0095]

[0096] Among them, R is the measurement noise covariance matrix, which reflects the uncertainty in the actual observation. Through the Kalman gain, the system adjusts the predicted rule update trend, and the corrected state estimate is:

[0097]

[0098] is the rule prediction vector after Kalman filtering correction, and its result is obtained from the prediction equation result and the true observation X k It is fused by formula (6).

[0099] Finally, the covariance matrix P k Updated by the following formula:

[0100]

[0101] Finally, for each candidate bottleneck branch, we can predict R k ,I k and D k , by comparing I k -D k The value of , we can determine the future trend of the branch rule update. k -D k >0, we mark it as a true bottleneck branch and perform tuple replacement in step (3). By monitoring the rule update trend in real time, we can make predictions quickly in a dynamic rule change environment. We can avoid unnecessary adjustments to bottleneck branches under short-term rule changes and prevent overfitting problems caused by excessive adjustments. In addition, selectively converting bottleneck branches helps maintain the stability of the classification structure and reduce the negative impact of rule updates on the overall classification performance.

[0102] (3) Lightweight tuple replacement

[0103] When the bottleneck branch is identified and predicted to further affect the classification performance, it is replaced using a lightweight tuple replacement structure (PickTSS). The core idea of ​​PickTSS is to use a hash table structure to quickly match rules while reducing memory consumption.

[0104] PickTSS first counts the number of different prefix lengths that the rules in the replacement branch node have on each field, and finally selects those fields whose number of different prefix lengths is greater than the average number of different prefix lengths on all fields for tuple division and hash calculation inside each tuple to map the content of the selected field to a fixed range for subsequent fast search and classification. In order to simplify the tuple structure, only those fields whose range number is greater than the average are selected, rather than all fields. For example, refer to Figure 4 , assuming that in a certain subspace, the number of different length prefixes on field X is 6, and the number of different length prefixes on field Y is 3. By calculating the average value of the field range is 4.5, field X is selected for hashing (because 6> average value 4.5). This strategy enables the system to reduce the number of fields for hashing operations, thereby reducing the number of tuples and the number of parameters.

[0105] After selecting fields, PickTSS divides the rules and generates tuples based on the selected fields. It also stores and manages the rules in tuples through hashing on these selected fields. For each selected bottleneck branch, we replace all the rules on the branch with tuples to achieve structural optimization of the bottleneck branch. For branches with frequent rule updates, the classification efficiency is affected as little as possible.

[0106] These tuples are stored and managed through hash tables. Taking field X as an example, PickTSS will generate multiple tuples based on the range of field X, such as [4,4] and [4,3]. Compared with multi-field hashing (such as selecting X and Y at the same time), this single-field hashing can reduce the number of generated tuples and the number of hash operations. If field X and field Y are selected at the same time, more tuples will be generated, such as [4,4], [4,3], [3,4], [3,3], and each tuple requires more hash matching operations. With PickTSS, only field X is selected for hash operations, thereby reducing the number of tuples and computational complexity. Reducing unnecessary hash operation fields reduces memory space consumption and speeds up classification and updating.

[0107] The optimized classification structure can be locally adjusted when the rules are updated, avoiding global reconstruction, thereby significantly reducing the time and resource consumption during the reconstruction process.

[0108] Example 2

[0109] A high-speed data packet classification system based on adaptive tuple replacement includes a search module, a prediction module, and a replacement optimization module. The search module is used to analyze a decision tree in a hybrid structure and identify candidate bottleneck branches that affect classification performance; the prediction module is used to predict the trend of rule update through Kalman filtering and determine the bottleneck branches that need to be replaced; the replacement optimization module is used to replace the bottleneck branches in the decision tree using a lightweight tuple replacement structure (PickTSS) to optimize classification performance.

[0110] Example 3

[0111] A computer-readable storage medium stores a program, which, when executed by a processor, implements the steps in the above-mentioned high-speed data packet classification method based on adaptive tuple replacement.

[0112] The above are preferred embodiments of the present invention. Any changes made according to the technical solution of the present invention, as long as the resulting functions do not exceed the scope of the technical solution of the present invention, belong to the protection scope of the present invention.

Claims

1. A high-speed data packet classification method based on adaptive tuple replacement, characterized in that: The steps include: (1) Analyze the decision tree in the hybrid structure and identify the bottleneck branches that affect the classification performance; (2) Predict the trend of rule updates through Kalman filtering and determine the bottleneck branches that need to be replaced; (3) Use lightweight tuple replacement structure to replace the bottleneck branch in the decision tree and optimize the classification performance.

2. The high-speed data packet classification method based on adaptive tuple replacement according to claim 1, characterized in that: In step (1), firstly, the bottleneck branch that affects the classification performance is identified by statically analyzing the decision tree in the hybrid data structure; First, the classification time is calculated. For TSS, the classification time is given by T TSS (rules) = k(rules) × T hash Calculate, where k(rules) represents the average number of tuples that need to be traversed during the TSS matching process, T hash represents the average time of hash operation; the classification time of decision tree DT depends on the height of subtree and the average number of linear matching rules, through Calculation; where h(rules) represents the average height of the subtree, T r is the average time of node recursive operation, T m is the average time for matching a single rule, binth is the maximum number of rules in a decision tree leaf node; by comparing T TSS and T DT , it is determined that the matching efficiency of this branch is better than that of the decision tree structure when using the TSS classification structure, and these branches are marked as candidate bottleneck branches.

3. The high-speed data packet classification method based on adaptive tuple replacement according to claim 2 is characterized in that: After obtaining the classification time of TSS and decision tree, we compare them based on the recursive algorithm of bottleneck branch search. First, we recursively search the child nodes from the root node and calculate the classification performance T of each child node one by one. TSS and T DT ; Then, according to the classification time of TSS and the classification time of decision tree DT node, the average time consumption of each node is calculated. The calculation is specifically expressed as: the average classification performance of all child nodes of the node, plus T r The node recursion time is calculated and whether it is a candidate bottleneck branch; If the total classification time of a node exceeds the classification time of TSS, the node is marked as a candidate bottleneck branch; If the node is marked as a candidate bottleneck branch, it is added to the candidate bottleneck branch list, and a check is made to see if there are other child nodes under the branch already in the list. If so, the corresponding child nodes already in the list are cleared.

4. The high-speed data packet classification method based on adaptive tuple replacement according to claim 1, characterized in that: In step (2), in order to avoid overfitting the current rule set, a Kalman filter is used to predict the trend of future rule updates of the candidate bottleneck branch; First, the prediction of rule updates is described by the state transition equation. When the system rules are updated, the number of inserted and deleted rules is sampled. These data are used as the input of the Kalman filter. The state transition equation of the Kalman filter algorithm is as follows: in, They represent the number of prediction rules, the number of insertion rules, and the number of deletion rules at time k respectively; u k is the input value of the external control variable; matrices A and B represent the state transfer matrix and the control input matrix, respectively, and are defined as: Here, a and b represent the dynamic change factors of inserting and deleting rules, which are obtained through historical data; the current rule insertion and deletion situation is obtained through u k to reflect; The number of prediction rules pass Perform calculations and insert the number of rules and delete rules Through and Calculate, constants m and n represent the proportional relationship between rule insertion and deletion; Next, use the state transition equation of the Kalman filter in formula (1) to predict the state; Vector u k Contains the number of real rules R sampled at the current moment k , the predicted covariance matrix Calculated by the following formula: Among them, P k-1 is the covariance matrix of the last estimate, Q is the process noise covariance matrix; Next, the system observes the current rule update situation, and the actual number of rules observed is Z k is given by the following measurement equation: Z k =HX k ,H=[1,1,1](4) Where H is the observation matrix, defined as H = [1,1,1], indicating that the system can directly observe the number of rules, the number of inserted rules, and the number of deleted rules. k =[R k ,I k ,D k ], R k ,I k ,D k They represent the number of rules actually sampled at time k, the number of inserted rules, and the number of deleted rules respectively; According to the current observation value, use the Kalman gain K k To correct the predicted value, the gain calculation formula is: Among them, R is the measurement noise covariance matrix; the predicted rule update trend is adjusted through the Kalman gain, and the corrected state estimate is: is the rule prediction vector after Kalman filtering correction, and its result is obtained from the prediction equation result and the true observation X k It is fused through formula (6); Then, the covariance matrix P k Updated by the following formula: Finally, for each candidate bottleneck branch, the prediction is R k ,I k and D k , by comparing I k -D k The value of determines the future trend of the branch rule update. k -D k > 0, mark it as the real bottleneck branch and perform step (3) tuple replacement.

5. The high-speed data packet classification method based on adaptive tuple replacement according to claim 1, characterized in that: In step (3), after the bottleneck branch is determined, the bottleneck branch is replaced using a lightweight tuple replacement structure PickTSS; PickTSS is oriented to the local branches of the decision tree and performs tuple partitioning and hash operations by selecting some fields; Specifically, PickTSS first counts the number of different prefix lengths of the rules in the replacement branch node on each field, and finally selects those fields whose number of different prefix lengths is greater than the average number of different prefix lengths on all fields for tuple division and hash calculation within each tuple to map the content of the selected field to a fixed range; After selecting fields, PickTSS generates tuples based on the selected fields, and stores and manages the rules in the tuples through hashing on these selected fields. For each selected bottleneck branch, all the rules on the branch are replaced with tuples to achieve structural optimization of the bottleneck branch.

6. A high-speed data packet classification system based on adaptive tuple replacement, characterized in that: It includes a search module, a prediction module, and a replacement optimization module. The search module is used to analyze the decision tree in the hybrid structure and identify the candidate bottleneck branches that affect the classification performance; the prediction module is used to predict the trend of rule update through Kalman filtering and determine the bottleneck branches that need to be replaced; The replacement optimization module is used to replace the bottleneck branches in the decision tree using a lightweight tuple replacement structure to optimize the classification performance.

7. A computer-readable storage medium, characterized in that: A program is stored thereon, and when the program is executed by a processor, the steps in the high-speed data packet classification method based on adaptive tuple replacement as claimed in claim 1 are implemented.

Images