A high-speed data packet classification method based on adaptive tuple replacement and its application

Abstract

The present invention relates to a high-speed data packet classification method and application based on adaptive tuple replacement, and belongs to the field of data packet classification technology in the field of computer networks. By constructing a hybrid data structure, combining a decision tree with a tuple, and detecting and replacing bottleneck branches during the rule update process, the efficiency of data packet classification is improved. The present invention uses a lightweight hash table tuple structure to replace inefficient branches in the decision tree, ensuring that the stability of the classification speed is maintained when the rules are frequently updated. While optimizing memory usage, the method can significantly improve classification performance and has good hardware deployment adaptability, making it suitable for fast packet classification in large-scale network environments.

Description

Technical Field

[0001] The present invention relates to a high-speed data packet classification method based on adaptive tuple replacement and its application, belonging to the technical field of data packet classification in the field of computer networks. Background Art

[0002] Packet classification is a crucial part of network functions such as routing, firewalling, and Quality of Service (QoS). Network devices need to classify incoming packets according to predefined rules and take corresponding actions based on the matching rules. As the scale and traffic volume of modern data center networks continue to grow, the performance requirements of packet classification are also increasing. For example, existing software switches such as Open vSwitch (OVS) are widely used in virtualization and software-defined networking (SDN) environments, allowing flexible management and allocation of network resources. The Tuple Space Search (TSS) algorithm used by OVS performs well in supporting fast rule updates and stable memory consumption, but its classification performance will degrade significantly when faced with large rule sets.

[0003] To improve classification efficiency, existing methods typically combine TSS and decision trees (DTs) to form a hybrid structure, which supports rapid rule updates while increasing classification speed. However, as the rule set is dynamically updated, the decision tree in the hybrid structure is prone to imbalance, leading to an accumulation of rules in specific branches, further slowing classification. Existing methods maintain classification performance by periodically rebuilding the data structure, but this reconstruction process is time-consuming and seriously affects the normal operation of the service. Summary of the Invention

[0004] To address the shortcomings of existing technologies, the present invention provides a high-speed packet classification method based on adaptive tuple replacement. By analyzing the bottleneck branches of a decision tree in a hybrid data structure and replacing them with a lightweight tuple structure, this method optimizes classification speed and minimizes memory usage. This method also ensures efficient and stable packet classification in environments with frequent updates to large-scale network rule sets.

[0005] The technical solutions of the present invention are as follows:

[0006] A high-speed data packet classification method based on adaptive tuple replacement comprises the following steps:

[0007] (1) Analyze the decision tree in the hybrid structure and identify the bottleneck branches that affect the classification performance;

[0008] (2) Predict the trend of rule updates through Kalman filtering and determine the bottleneck branches that need to be replaced;

[0009] (3) Use a lightweight tuple replacement structure (PickTSS) to replace the bottleneck branch in the decision tree to optimize the classification performance.

[0010] Preferably, in step (1), the bottleneck branches that affect the classification performance are first identified by statically analyzing the decision tree in the hybrid data structure. The decision tree achieves efficient classification by gradually dividing the search space into smaller subspaces. However, during the rule update process, the fixed branch structure of the decision tree may accumulate too many rules on a specific branch, resulting in a decrease in matching performance on that branch. Therefore, it is necessary to evaluate each branch of the decision tree to determine whether there is a bottleneck branch that affects the matching performance. Specifically, the key to evaluating classification performance is to compare the classification speed of the decision tree and the tuple space search (TSS). First, the classification time is calculated. For TSS, its classification time can be expressed by T TSS (rules) = k(rules) × T hash Calculate, where k(rules) represents the average number of tuples that need to be traversed during the TSS matching process, T hash represents the average time of hash operation; the classification time of decision tree DT depends on the height of subtree and the average number of linear matching rules, which can be obtained by Calculation; where h(rules) represents the average height of the subtree, T r is the average time of node recursive operation, T m is the average time for matching a single rule, binth is the maximum number of rules in a decision tree leaf node; by comparing T TSS and T DT , it is determined that the matching efficiency of this branch is better than that of the decision tree structure when using the TSS classification structure, and these branches are marked as candidate bottleneck branches.

[0011] Further preferably, after obtaining the classification time of TSS and decision tree, a recursive algorithm based on bottleneck branch search is used for comparison. First, the child nodes are recursively searched from the root node, and the classification performance T of each child node is calculated one by one. TSS and T DT Then, according to the classification time of TSS and the classification time of decision tree DT node, the average time consumption of each node is calculated. The calculation is specifically expressed as: the classification performance of all child nodes of the node (possibly T TSS or T DT ) and T r The node recursion time is calculated and whether it is a candidate bottleneck branch is determined; if the total classification time of a node exceeds the classification time of TSS, the node is marked as a candidate bottleneck branch; if the node is marked as a candidate bottleneck branch, it is added to the candidate bottleneck branch list and a check is made as to whether other child nodes under the branch are already in the list. If so, the corresponding child nodes in the list are cleared to prevent duplicate processing.

[0012] Preferably, in step (2), in order to avoid overfitting the current rule set, a Kalman filter is used to predict the trend of future rule updates of the candidate bottleneck branch; by analyzing the historical rule insertion and deletion data on the branch, the Kalman filter can estimate the future trend of rule updates and help determine whether the bottleneck branch in the decision tree needs to be replaced.

[0013] First, the prediction of rule updates is described by the state transition equation. When the system rules are updated, the number of inserted and deleted rules is sampled. This data is used as the input of the Kalman filter. The state transition equation of the Kalman filter algorithm is as follows:

[0014]

[0015] in, They represent the number of prediction rules, number of insertion rules, and number of deletion rules at time k respectively; u k is the input value of the external control variable; matrices A and B represent the state transfer matrix and the control input matrix, respectively, and are defined as:

[0016]

[0017] Here, a and b represent the dynamic change factors of inserting and deleting rules, which are obtained by analyzing historical data; the current rule insertion and deletion status is obtained by u k to reflect;

[0018] The number of prediction rules pass Perform calculations and insert the number of rules and delete rules Through and Calculation is performed, where constants m and n represent the proportional relationship between rule insertion and deletion; next, the state transition equation of the Kalman filter in formula (1) is used for state prediction;

[0019] In order to facilitate matrix calculation, the vector u k Contains the number of real rules R obtained by sampling at the current moment k , the predicted covariance matrix Calculated by the following formula:

[0020]

[0021] Among them, P k-1 is the covariance matrix of the last estimate, which reflects the error of the system. Q is the process noise covariance matrix, which represents the uncertainty in the rule update process.

[0022] In order to estimate the actual situation of rule updates, the system will observe the current rule updates. The actual number of rules observed is Z. k is given by the following measurement equation:

[0023] Z k =HX k ,H=[1,1,1](4)

[0024] Among them, H is the observation matrix, defined as H = [1,1,1], which means that the system can directly observe the number of rules, the number of inserted rules, and the number of deleted rules. k =[R k ,I k ,D k ], R k ,I k ,D k They represent the number of rules actually sampled at time k, the number of inserted rules, and the number of deleted rules, respectively. k That is, the matrix representing the number of real rules, the number of inserted rules, and the number of deleted rules; by measuring the equation Z k =HX k Get the sample value, where Z k is a vector containing the number of rules, insertions, and deletions;

[0025] After obtaining the measurement data, the system uses the Kalman gain K according to the current observation value. k To correct the predicted value, the gain calculation formula is:

[0026]

[0027] Where R is the measurement noise covariance matrix, which reflects the uncertainty in the actual observation. Through the Kalman gain, the system adjusts the predicted rule update trend, and the corrected state estimate is:

[0028]

[0029] is the rule prediction vector after Kalman filter correction, and its result is obtained from the prediction equation result and the true observation X k It is formed by fusion of formula (6);

[0030] Then, the covariance matrix P k Updated by the following formula:

[0031]

[0032] Finally, for each candidate bottleneck branch, we can predict R k , Ik and D k , by comparing I k -D k The value of , we can determine the future trend of the branch rule update. k -D k When ∂>0, we mark it as a true bottleneck branch and perform step (3) tuple replacement.

[0033] Preferably, in step (3), after the bottleneck branch is determined, the bottleneck branch is replaced using a lightweight tuple replacement structure, PickTSS. The traditional hash-based packet classification structure, TSS, divides tuples for each field involved in the classification and hashes the prefix on each field to achieve rule matching and updating. PickTSS, however, is oriented towards the local branches of the decision tree. By selecting some fields for tuple division and hashing, it reduces the number of tuples and hash fields that need to be maintained, reduces memory overhead, and maintains a high classification speed. For example, when hashing on field X and field Y, the number of tuples is 4 (i.e., [4,4], [4,3], [3,4], [3,3]), while when hashing only on field X, the number of tuples is 2 (i.e., [4], [3]). This optimization greatly reduces the time and memory required for hashing operations.

[0034] Specifically, PickTSS first counts the number of different prefix lengths for each field in the replacement branch node. It then selects fields whose number of different prefix lengths is greater than the average number of different prefix lengths across all fields for tuple division. Within each tuple, a hash calculation is performed to map the contents of the selected fields to a fixed range for subsequent rapid search and classification. For example, if field X has 6 different prefix lengths and field Y has 3 different prefix lengths, field X is prioritized for hashing because it has a larger range of different prefix lengths. The fewer fields selected, the lower the complexity of the hash operation, thereby improving classification efficiency.

[0035] After selecting fields, PickTSS generates tuples based on the selected fields. It also stores and manages the rules in the tuples through hashing on these selected fields. For each selected bottleneck branch, all rules on that branch are replaced with tuples to optimize the structure of the bottleneck branch. This minimizes the impact on classification efficiency in branches with frequent rule updates.

[0036] A high-speed data packet classification system based on adaptive tuple replacement includes a search module, a prediction module, and a replacement optimization module. The search module is used to analyze the decision tree in the hybrid structure and identify candidate bottleneck branches that affect the classification performance; the prediction module is used to predict the trend of rule update through Kalman filtering and determine the bottleneck branches that need to be replaced; the replacement optimization module is used to replace the bottleneck branches in the decision tree using a lightweight tuple replacement structure (PickTSS) to optimize the classification performance.

[0037] A computer-readable storage medium stores a program thereon, which implements the steps of the above-mentioned high-speed data packet classification method based on adaptive tuple replacement when the program is executed by a processor.

[0038] The beneficial effects of the present invention are:

[0039] By adaptively replacing bottleneck branches in decision trees, this method significantly improves classification speed under large-scale rule updates while maintaining low memory overhead. Compared to existing methods, this method eliminates the need for frequent data structure reconstruction, significantly reducing system downtime and making it suitable for modern data center networks that require efficient classification performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 The figure shows the overall structure and flow chart of the method of the present invention.

[0041] Figure 2 This is an example diagram of the bottleneck branch search of the method of the present invention.

[0042] Figure 3 This is an example diagram of rule update trend prediction of the method of the present invention.

[0043] Figure 4 1 is an example diagram of lightweight tuple replacement according to the method of the present invention, wherein (a) is a schematic diagram of subspace rules, and (b) is a schematic diagram of the lightweight tuple replacement process. DETAILED DESCRIPTION

[0044] The present invention will be further described below with reference to embodiments and accompanying drawings, but is not limited thereto.

[0045] Example 1:

[0046] This paper provides a high-speed packet classification method based on adaptive tuple replacement. By identifying bottleneck branches in a decision tree and optimizing these branches using a lightweight tuple replacement structure, it ensures efficient packet classification in an environment with large-scale rule updates. The method includes the following steps:

[0047] (1) Analyze the decision tree in the mixed data structure and identify the bottleneck branches that affect the classification performance;

[0048] (2) Predict the trend of rule updates through Kalman filtering and determine the bottleneck branches that need to be replaced;

[0049] (3) Use a lightweight tuple replacement structure (PickTSS) to replace the bottleneck branch in the decision tree to optimize the classification performance.

[0050] The following is a specific implementation process of the present invention.

[0051] Please refer to Figure 1 ,The present invention includes three main parts: bottleneck branch search, rule ,update trend prediction, and lightweight tuple replacement.

[0052] (1) Bottleneck branch search

[0053] In hybrid data structures, decision trees are used to efficiently recursively partition the search space into smaller subspaces, enabling fast packet classification. However, as rules are dynamically updated, some branches of the decision tree may accumulate too many rules, resulting in performance degradation. The first step of the present invention is to identify these bottleneck branches.

[0054] First, static analysis is performed on the decision tree in the hybrid data structure to evaluate the classification performance of each branch. By calculating the classification time of different branches, it is determined which branches will become performance bottlenecks after the rule update. The classification time is calculated as follows: For TSS, the classification time is calculated by the formula T TSS (rules) = k(rules) × T hash Calculation. Where k(rules) represents the number of tuples that need to be traversed during the TSS matching process, T hash is the average time of hash operation. For decision tree, classification time is calculated by formula Calculation. Where h(rules) represents the average height of the subtree, T r is the average time of node recursive operation, T m is the average time for matching a single linear rule, and binth represents the maximum number of rules in a decision tree leaf node.

[0055] By comparing the classification time T of TSS and decision tree DT , determine which branches will become bottlenecks after the rule update, and mark these branches as candidate bottleneck branches. Refer to Algorithm 1: Recursive algorithm based on bottleneck branch search. First, recursively search the child nodes from the root node. If the node is not a leaf node, substitute the decision tree nodes in its child nodes into the algorithm again and calculate the classification performance T of each child node one by one. TSS and T DTThen, based on the classification time of TSS and DT nodes, the average time consumption of each node is calculated. The calculation is specifically expressed as: the classification performance of all child nodes of the node (possibly T TSS or T DT ) and T r The node recursion time is calculated and it is judged whether it is a candidate bottleneck branch. If the total classification time of a node (i.e. the above calculation result) exceeds the classification time of TSS, the node is marked as a candidate bottleneck branch. If the node is marked as a candidate bottleneck branch, it is added to the candidate bottleneck branch list and it is checked whether there are other nodes under the branch in the list. If so, the corresponding child nodes in the list are cleared to prevent repeated processing. The process can be referred to Figure 2 Finally, we can obtain the node set of all candidate bottleneck branches under the decision tree. By continuously performing the above steps, adjacent branches will be merged upward to form larger branches, and finally maintained in the bottleneck queue.

[0056] Algorithm 1: Bottleneck Branch Search Algorithm

[0057] Input: Root node r

[0058] Output: bnList

[0059] 1letbnList=[];

[0060] 2FunctionSearch(TreeNode node)→TreeNode

[0061] 3 / / Recursively search child nodes

[0062] 4if node is not Leaf then

[0063] 5forchild∈node do

[0064] 6if child.mark is DTthen

[0065] 7child=Search(child)

[0066] 8 / / Estimated average time cost

[0067] 9letT=0;

[0068] 10forchild∈node do

[0069] 11if child.mark is TSSthen

[0070] 12T+=T TSS(child.rules);

[0071] 13if child.mark is DTthen

[0072] 14T+=T DT (child.rules);

[0073] 15T=T / node.children_num;

[0074] 16 / / Decide whether to add the node to the bottleneck list

[0075] 16if T+T r >T TSS (node.rules)then

[0076] 17node.mark=TSS;

[0077] 18forchild∈node do

[0078] 19if bnList.exist(child)then

[0079] 20bnList.add(node);

[0080] 21returnnode;

[0081] (2) Rule update trend prediction

[0082] In order to improve the stability of the packet classification system under the condition of frequent rule updates, the present invention adopts the Kalman filter algorithm to predict the future trend of rule updates. By analyzing the historical data of rule insertion and deletion, the system can determine in advance which decision tree branches may become bottlenecks and adopt corresponding optimization strategies. Figure 3 The specific process is as follows:

[0083] First, the system collects the number of inserted and deleted rules each time the rules are updated. This data is used as input to the Kalman filter. By predicting future rule update trends, the system can dynamically adjust the classification structure. The state transition equation of the Kalman filter algorithm is as follows:

[0084]

[0085] in, represents the number of prediction rules, insertion rules, and deletion rules at time k, They represent the number of prediction rules, number of insertion rules, and number of deletion rules at time k respectively; u kis the input value of the external control variable; matrices A and B represent the state transfer matrix and the control input matrix, respectively, and are defined as:

[0086]

[0087] Here, a and b represent the dynamic change factors of the insertion and deletion rules, which are obtained by analyzing the historical data. The current rule insertion and deletion status is controlled by the input u k To reflect.

[0088] The number of prediction rules pass Perform calculations and insert the number of rules and delete rules Through and Calculate, constants m and n represent the proportional relationship between rule insertion and deletion; Next, use the state transition equation of the Kalman filter in formula (1) to predict the state. Vector u k Contains the number of real rules R obtained by sampling at the current moment k .

[0089] In order to evaluate the predicted rule update trend, the Kalman filter algorithm also estimates the uncertainty of the system. The predicted covariance matrix Calculated by the following formula:

[0090]

[0091] Among them, P k-1 is the covariance matrix of the last estimate, which reflects the error of the system. Q is the process noise covariance matrix, which represents the uncertainty in the rule update process. Next, the system will observe according to the current rule update situation. The actual number of rules observed is Z. k is given by the following measurement equation:

[0092] Z k =HX k ,H=[1,1,1](4)

[0093] Among them, H is the observation matrix, defined as H = [1,1,1], which means that the system can directly observe the number of rules, the number of inserted rules, and the number of deleted rules. k =[R k ,I k ,D k ], R k ,I k ,D k They represent the number of rules actually sampled at time k, the number of inserted rules, and the number of deleted rules, respectively. kThat is, the matrix representing the number of real rules, the number of inserted rules, and the number of deleted rules; by measuring the equation Z k =HX k Get the sample value, where Z k is a vector containing the number of rules, the number of insertions, and the number of deletions.

[0094] After obtaining the measurement data, the system uses the Kalman gain K according to the current observation value. k To correct the predicted value, the gain calculation formula is:

[0095]

[0096] Where R is the measurement noise covariance matrix, which reflects the uncertainty in the actual observation. Through the Kalman gain, the system adjusts the predicted rule update trend, and the corrected state estimate is:

[0097]

[0098] is the rule prediction vector after Kalman filter correction, and its result is obtained from the prediction equation result and the true observation X k It is fused by formula (6).

[0099] Finally, the covariance matrix P k Updated by the following formula:

[0100]

[0101] Finally, for each candidate bottleneck branch, we can predict R k , I k and D k , by comparing I k -D k The value of , we can determine the future trend of the branch rule update. k -D k When ∂ > 0, we mark it as a true bottleneck branch and perform tuple replacement in step (3). By monitoring the rule update trend in real time, we can quickly make predictions in a dynamic rule change environment. This can avoid unnecessary adjustments to the bottleneck branch under short-term rule changes and prevent overfitting problems caused by excessive adjustments. In addition, selectively transforming the bottleneck branch helps maintain the stability of the classification structure and reduce the negative impact of rule updates on the overall classification performance.

[0102] (3) Lightweight tuple replacement

[0103] When a bottleneck branch is identified and predicted to be likely to further affect classification performance, it is replaced using a lightweight tuple replacement structure (PickTSS). The core idea of ​​PickTSS is to use a hash table structure to quickly perform rule matching while reducing memory consumption.

[0104] PickTSS first counts the number of different prefix lengths on each field in the replacement branch node, and finally selects those fields whose number of different prefix lengths is greater than the average number of different prefix lengths on all fields for tuple division and hash calculation within each tuple to map the content of the selected field to a fixed range for subsequent fast search and classification. In order to simplify the tuple structure, only those fields whose range number is greater than the average are selected, rather than all fields. For example, referring to Figure 4 Suppose that in a certain subspace, the number of different prefix lengths for field X is 6, and the number of different prefix lengths for field Y is 3. By calculating the average value of the field range, it is 4.5, so field X is selected for hashing (because 6 > the average value 4.5). This strategy allows the system to reduce the number of fields in the hash operation, thereby reducing the number of tuples and parameters.

[0105] After selecting fields, PickTSS divides the rules and generates tuples based on the selected fields. It also stores and manages the rules in the tuples through hashing on these selected fields. For each selected bottleneck branch, we replace all the rules on that branch with tuples to optimize the structure of the bottleneck branch. For branches with frequent rule updates, the classification efficiency is affected as little as possible.

[0106] These tuples are stored and managed using a hash table. Taking field X as an example, PickTSS generates multiple tuples based on the range of field X, such as [4,4] and [4,3]. Compared to multi-field hashing (such as selecting X and Y at the same time), this single-field hashing can reduce the number of generated tuples and the number of hash operations. If field X and field Y are selected at the same time, more tuples will be generated, such as [4,4], [4,3], [3,4], [3,3], and each tuple will require more hash matching operations. With PickTSS, only field X is selected for hashing, thereby reducing the number of tuples and computational complexity. This reduces unnecessary hash operation fields, reduces memory space consumption, and speeds up classification and updates.

[0107] The optimized classification structure can be locally adjusted when the rules are updated, avoiding global reconstruction, thereby significantly reducing the time and resource consumption during the reconstruction process.

[0108] Example 2

[0109] A high-speed data packet classification system based on adaptive tuple replacement includes a search module, a prediction module, and a replacement optimization module. The search module is used to analyze the decision tree in the hybrid structure and identify candidate bottleneck branches that affect the classification performance; the prediction module is used to predict the trend of rule update through Kalman filtering and determine the bottleneck branches that need to be replaced; the replacement optimization module is used to replace the bottleneck branches in the decision tree using a lightweight tuple replacement structure (PickTSS) to optimize the classification performance.

[0110] Example 3

[0111] A computer-readable storage medium stores a program thereon, which implements the steps of the above-mentioned high-speed data packet classification method based on adaptive tuple replacement when the program is executed by a processor.

[0112] The above are preferred embodiments of the present invention. Any changes made according to the technical solution of the present invention, as long as the resulting functions and effects do not exceed the scope of the technical solution of the present invention, shall fall within the scope of protection of the present invention.

Claims

1. A high-speed data packet classification method based on adaptive tuple replacement, characterized in that: The steps include: (1) Analyze the decision tree in the hybrid structure and identify the bottleneck branches that affect the classification performance; (2) Predict the trend of rule updates through Kalman filtering and determine the bottleneck branches that need to be replaced; (3) Use lightweight tuple replacement structure to replace the bottleneck branch in the decision tree to optimize the classification performance.

2. The high-speed data packet classification method based on adaptive tuple replacement according to claim 1, characterized in that: In step (1), the bottleneck branches that affect the classification performance are first identified by statically analyzing the decision tree in the hybrid data structure; First, calculate the classification time. For TSS, the classification time is calculated by T TSS (rules) = k(rules) × T hash Calculate, where k(rules) represents the average number of tuples that need to be traversed during the TSS matching process, T hash Represents the average time of hash operation; the classification time of decision tree DT depends on the height of subtree and the average number of linear matching rules, through Calculation; where h(rules) represents the average height of the subtree, T r is the average time of node recursive operation, T m is the average time for matching a single rule, binth is the maximum number of rules in a decision tree leaf node; by comparing T TSS and T DT , it is determined that the matching efficiency of this branch is better than that of the decision tree structure when using the TSS classification structure, and these branches are marked as candidate bottleneck branches.

3. The high-speed data packet classification method based on adaptive tuple replacement according to claim 2, characterized in that: After obtaining the classification time of TSS and decision tree, we compare them based on the recursive algorithm of bottleneck branch search. First, we recursively search the child nodes from the root node and calculate the classification performance T of each child node one by one. TSS and T DT Then, according to the classification time of TSS and the classification time of decision tree DT node, the average time consumption of each node is calculated. The calculation is specifically expressed as: the average classification performance of all child nodes of the node, plus T r , and determine whether it is a candidate bottleneck branch; If the total classification time of a node exceeds the classification time of TSS, the node is marked as a candidate bottleneck branch; If a node is marked as a candidate bottleneck branch, it is added to the candidate bottleneck branch list and a check is made to see if there are other child nodes under the branch already in the list. If so, the corresponding child nodes already in the list are cleared.

4. The high-speed data packet classification method based on adaptive tuple replacement according to claim 1, characterized in that: In step (2), in order to avoid overfitting the current rule set, a Kalman filter is used to predict the trend of future rule updates of the candidate bottleneck branch; First, the prediction of rule updates is described by the state transition equation. When the system rules are updated, the number of inserted and deleted rules is sampled. This data is used as the input of the Kalman filter. The state transition equation of the Kalman filter algorithm is as follows: in, They represent the number of prediction rules, number of insertion rules, and number of deletion rules at time k respectively; u k is the input value of the external control variable; matrices A and B represent the state transfer matrix and the control input matrix, respectively, and are defined as: Here, a and b represent the dynamic change factors of inserting and deleting rules, which are obtained through historical data; the current rule insertion and deletion situation is obtained through u k to reflect; The number of prediction rules pass Perform calculations and insert the number of rules and delete rules Through and Calculation is performed, where constants m and n represent the proportional relationship between rule insertion and deletion; next, the state transition equation of the Kalman filter in formula (1) is used for state prediction; vector u k Contains the number of real rules R obtained by sampling at the current moment k , the predicted covariance matrix Calculated by the following formula: Among them, P k-1 is the covariance matrix of the last estimate, Q is the process noise covariance matrix; Next, the system observes the current rule update situation, and the actual number of rules observed is Z k is given by the following measurement equation: Z k =HX k ,H=[1,1,1](4) Among them, H is the observation matrix, defined as H = [1,1,1], which means that the system can directly observe the number of rules, the number of inserted rules, and the number of deleted rules. k =[R k ,I k ,D k ], R k ,I k ,D k They represent the number of rules actually sampled at time k, the number of inserted rules, and the number of deleted rules respectively; According to the current observation value, use the Kalman gain K k To correct the predicted value, the gain calculation formula is: Where R is the measurement noise covariance matrix; the predicted rule update trend is adjusted by the Kalman gain, and the corrected state estimate is: is the rule prediction vector after Kalman filter correction, and its result is obtained from the prediction equation result and the true observation X k It is formed by fusion of formula (6); Then, the covariance matrix P k Updated by the following formula: Finally, for each candidate bottleneck branch, the prediction is R k , I k and D k , by comparing I k -D k The value of determines the future trend of the branch rule update. k -D k When > 0, it is marked as a real bottleneck branch and step (3) tuple replacement is performed.

5. The high-speed data packet classification method based on adaptive tuple replacement according to claim 1, characterized in that: In step (3), after the bottleneck branch is determined, the lightweight tuple replacement structure PickTSS is used to replace the bottleneck branch; PickTSS is oriented towards the local branch of the decision tree and performs tuple partitioning and hashing operations by selecting some fields; Specifically, PickTSS first counts the number of different prefix lengths for each field in the replacement branch node, and finally selects those fields whose number of different prefix lengths is greater than the average number of different prefix lengths for all fields for tuple division. It then performs hash calculation within each tuple to map the contents of the selected fields to a fixed range. After selecting fields, PickTSS generates tuples based on the selected fields. It also stores and manages the rules in the tuples through hashing on these selected fields. For each selected bottleneck branch, all the rules on the branch are replaced with tuples to achieve structural optimization of the bottleneck branch.

6. A high-speed data packet classification system based on adaptive tuple replacement, characterized in that: It includes a search module, a prediction module, and a replacement optimization module. The search module is used to analyze the decision tree in the hybrid structure and identify candidate bottleneck branches that affect classification performance; the prediction module is used to predict the trend of rule updates through Kalman filtering and determine the bottleneck branches that need to be replaced; The replacement optimization module is used to replace the bottleneck branches in the decision tree using a lightweight tuple replacement structure to optimize the classification performance.

7. A computer-readable storage medium, characterized in that A program is stored thereon, and when the program is executed by a processor, the steps of the high-speed data packet classification method based on adaptive tuple replacement as claimed in claim 1 are implemented.

Images