Data packet processing method and device, equipment, storage medium and product

Abstract

The invention discloses a data packet processing method and device, equipment, a storage medium and a product. The invention relates to the technical field of computer networks. The method comprises the steps of coding features of data packets through a pre-trained data packet classification model and determining priorities; coding the numerical characteristics and / or type characteristics of the network traffic through a pre-trained traffic prediction model, and predicting the trend of the network traffic; adjusting the priority and queue length of each data packet according to the prediction result; and in each scheduling, according to the queue length, the priorities of the data packets in the queue and the waiting time, selecting one data packet in the queue, and sending the selected data packet to the network card for processing. The artificial intelligence algorithm is applied to data packet classification and network flow trend prediction, and the data packets in the queue are scheduled according to the priorities based on the data packet classification result and the network flow trend prediction result, so that the network flow change trend can be flexibly adapted while the service processing efficiency of different priorities is ensured.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer network technology, and in particular to a data packet processing method, device, equipment, storage medium and product. Background Art

[0002] With the rapid development of network technology, the widespread application of various application services, cloud computing, Internet of Things, high-definition video streaming and other technologies has led to an explosive growth in data traffic in the network.

[0003] Faced with such huge and changeable network traffic, traditional network cards have the following shortcomings when processing and forwarding data packets: low packet processing efficiency leads to high network latency, and packet congestion or packet loss often occurs, especially some important services may be delayed and cause serious impact; they cannot perceive changes in network traffic in a timely manner. In scenarios such as increased, decreased or unstable network traffic, the packet processing speed and scheduling method do not match the network traffic, further aggravating packet congestion or packet loss. Summary of the invention

[0004] The embodiments of the present invention provide a data packet processing method, device, equipment, storage medium and product to solve the problems of low processing efficiency and inability to flexibly adapt to the changing trend of network traffic in the existing data packet processing method.

[0005] In a first aspect, an embodiment of the present invention provides a method for processing a data packet, including:

[0006] Encoding the characteristics of each data packet of network data through a pre-trained data packet classification model and determining the priority of each data packet according to the characteristics of each data packet;

[0007] Encoding the numerical features and / or type features of network traffic through a pre-trained traffic prediction model and predicting the network traffic trend according to the features of the network traffic, wherein the numerical features are used to describe the numerical values ​​of parameters of the network traffic, and the type features are used to describe the type of the network traffic;

[0008] adjusting the priority of each of the data packets and the queue length of a queue according to the prediction result of the network traffic trend, wherein the queue is used to cache each of the data packets;

[0009] In each scheduling, according to the queue length, the priority of the data packets in the queue and the waiting time, a data packet in the queue is selected and sent to the network card for processing.

[0010] In a second aspect, an embodiment of the present invention further provides a data packet processing device, including:

[0011] A priority determination module, used to encode the characteristics of each data packet of network data through a pre-trained data packet classification model and determine the priority of each data packet according to the characteristics of each data packet;

[0012] A prediction module, used to encode the numerical features and / or type features of network traffic through a pre-trained traffic prediction model and predict the network traffic trend according to the features of the network traffic, wherein the numerical features are used to describe the numerical values ​​of parameters of the network traffic, and the type features are used to describe the type of the network traffic;

[0013] An adjustment module, used for adjusting the priority of each of the data packets and the queue length of the queue according to the prediction result of the network traffic trend, and the queue is used for caching each of the data packets;

[0014] The processing module is used to select a data packet in the queue and send it to the network card for processing according to the queue length, the priority of the data packets in the queue and the waiting time in each scheduling.

[0015] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a data packet processing method as described in any one of the embodiments of the present invention is implemented.

[0016] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a data packet processing method as described in any one of the embodiments of the present invention.

[0017] In a fifth aspect, an embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements a data packet processing method as described in any one of the embodiments of the present invention.

[0018] The technical solution provided by the embodiment of the present invention encodes the characteristics of each data packet of network data through a pre-trained data packet classification model and determines the priority of each data packet according to the characteristics of each data packet; encodes the characteristics of network traffic through a pre-trained traffic prediction model and predicts the network traffic trend according to the characteristics of network traffic; realizes the application of artificial intelligence algorithm to the determination of data packet priority and the prediction of network traffic trend; and then adjusts the priority of each data packet and the queue length of the queue according to the prediction result of the network traffic trend prediction. In each scheduling, according to the queue length, the priority of the data packet in the queue and the waiting time, a data packet in the queue is selected to be sent to the network card for processing, thereby realizing flexible adaptation to the changing trend of network traffic while ensuring the improvement of the efficiency of data packet processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 It is a flow chart of a data packet processing method provided by the present invention;

[0021] Figure 2 It is a structural schematic diagram of a data packet processing device provided by an embodiment of the present invention;

[0022] Figure 3 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0024] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. At the same time, in the description of the present invention, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance. The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0025] It should be noted that in the embodiments of the present application, some existing solutions in the industry such as certain software, components, models, etc. may be mentioned, which should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the relevant content of the solution.

[0026] Figure 1 This is a flow chart of a data packet processing method provided by the present invention. This embodiment is applicable to the case of processing data packets in network data. The method can be executed by a data packet processing device. The data packet processing device can be implemented in the form of hardware and / or software. The data packet processing device can be configured in an electronic device. Figure 1 As shown, the method includes:

[0027] S110, encoding the characteristics of each data packet of the network data through a pre-trained data packet classification model and determining the priority of each data packet according to the characteristics of each data packet.

[0028] In this embodiment, the pre-trained data packet classification model can be understood as a pre-trained network model for encoding the characteristics of a data packet and determining the priority of a data packet. Among them, the data packet classification model can be a decision tree, a support vector machine, a neural network, etc. A data packet can be understood as the basic unit of data transmission in a computer network. The characteristics of a data packet can be understood as a set of metadata carried during the transmission of a data packet, including but not limited to a source IP address, a destination IP address, a port number, a protocol type, and a data packet timestamp. The priority of a data packet can include a high priority, a medium priority, and a low priority, and can also include a plurality of different priority levels, such as a first priority, a second priority, a third priority, and a fourth priority from high to low.

[0029] Specifically, the features of each data packet in the network data are extracted, and the extracted features are preprocessed, such as normalization and standardization, and then, for the features of each preprocessed data packet, a pre-trained data packet classification model is used to encode the features of the preprocessed current data packet and determine the priority of the current data packet.

[0030] S120. Encode the numerical features and / or type features of the network traffic through a pre-trained traffic prediction model and predict the network traffic trend based on the features of the network traffic. The numerical features are used to describe the numerical size of the parameters of the network traffic, and the type features are used to describe the type of the network traffic.

[0031] In this embodiment, the pre-trained traffic prediction model can be understood as a pre-trained network model for predicting network traffic trends. Network traffic can be understood as the total amount of data transmitted through a network connection (such as the Internet or a local area network) at any given time. The numerical features of network traffic are used to describe the numerical size of the parameters of network traffic, and the type features are used to describe the type of network traffic.

[0032] Specifically, the numerical features and / or type features of the network traffic are input into a pre-trained traffic prediction model, the model is used to encode the numerical features and / or type features of the network traffic, and the network traffic trend is predicted based on the characteristics of the network traffic.

[0033] S130. Adjust the priority of each of the data packets and the queue length of a queue according to the prediction result of the network traffic trend, and the queue is used to cache each of the data packets.

[0034] In this embodiment, the queue can be understood as a buffer of data packets, which is used to store data packets waiting to be processed. The queue length can be understood as the number of data packets waiting to be processed in the queue at a specific time point. The prediction result of the network traffic trend is usually expressed in the form of a time series, where the horizontal axis represents time and the vertical axis represents the predicted network traffic.

[0035] Specifically, in order to reduce network delays and packet drops, it is necessary to dynamically adjust the priority of packets and the queue length of queues based on the prediction results of network traffic trends. That is, when a high-traffic period is predicted to be approaching, the priority of key packets (such as those with high real-time requirements or important business data) can be increased to ensure that they can be processed and transmitted first. At the same time, the queue length is dynamically adjusted to adapt to changes in traffic. For example, during peak traffic, increasing the queue length can reduce the risk of packet loss, while during low traffic, reducing the queue length can improve data processing efficiency.

[0036] It should be noted that in this embodiment, the length of one queue may be adjusted, or the lengths of multiple queues may be adjusted simultaneously.

[0037] S140. In each scheduling, according to the queue length, the priority of the data packets in the queue, and the waiting time, select a data packet in the queue and send it to the network card for processing.

[0038] In this embodiment, the waiting time of a data packet can be understood as the time interval between the time point when the data packet starts waiting for processing and the time point when the data packet is currently being considered for sending.

[0039] Specifically, in order to ensure the efficiency and fairness of data transmission, each time a data packet in a scheduled queue is scheduled, it can be determined whether the queue length of the queue meets the scheduling conditions. If so, the priority of the data packet in the queue and the waiting time of each data packet in the queue can be considered to select a data packet in the queue, and then send the selected data packet to the network card for processing. For example, when the preset conditions are met, key data packets in the scheduled queue are selected for scheduling, such as data packets for real-time voice or video communication services, and are given a higher processing priority to reduce delays and improve the real-time nature of transmission. For another example, data packets can be cached through one or more queues, and the queue length of each queue can be dynamically adjusted according to network traffic. If there are multiple queues, data packets in each queue can be processed in parallel.

[0040] Exemplarily, each time scheduling is performed, for the currently scheduled queue, the data packet with the highest priority can be selected from the queue for processing. If there are multiple data packets with the highest priority, the data packet with the longest waiting time can be selected from them for processing first; or the data packet with the longest waiting time can be selected from the queue for processing. If there are multiple data packets with the longest waiting time, the data packet with the highest priority can be selected from them for processing first; in addition, each time scheduling is performed, data packets with higher priority (higher than the set priority) and longer waiting time (longer than the set time) can be selected for processing, etc.

[0041] By comprehensively considering the priority and waiting time of data packets, on the one hand, the processing efficiency of data packets can be effectively improved, and on the other hand, the situation where data packets are not processed for a long time can be effectively avoided, thereby improving the fairness of data packet processing.

[0042] The technical solution provided by the embodiment of the present invention encodes the characteristics of each data packet of network data through a pre-trained data packet classification model and determines the priority of each data packet according to the characteristics of each data packet; encodes the characteristics of network traffic through a pre-trained traffic prediction model and predicts the network traffic trend according to the characteristics of the network traffic; realizes the application of artificial intelligence algorithm to the determination of data packet priority and the prediction of network traffic trend; and then adjusts the priority of each data packet and the queue length of the queue according to the prediction result of the network traffic trend prediction. In each scheduling, according to the queue length, the priority of the data packet in the queue and the waiting time, a data packet in the queue is selected to be sent to the network card for processing, thereby ensuring that the efficiency of data packet processing is improved while achieving flexible adaptation to the changing trend of network traffic.

[0043] In some embodiments, the data packet classification model includes a multilayer perceptron; the characteristics of each data packet of network data are encoded through a pre-trained data packet classification model and the priority of each data packet is determined based on the characteristics of each data packet, including: encoding the characteristics of each data packet through the input layer of the multilayer perceptron; using a linear rectification function through the hidden layer of the multilayer perceptron to process the encoding of the characteristics of each data packet; and using a normalized exponential function through the output layer of the multilayer perceptron to output the classification results of each data packet, the classification results including the priority of each data packet.

[0044] In this embodiment, the multilayer perceptron is a feedforward neural network having an input layer, one or more hidden layers and an output layer. The neurons of each layer receive the output from the neurons of the previous layer as input, and process these inputs through an activation function to generate the output of the current layer. The linear rectifier function (Rectified Linear Unit, ReLU) is an activation function commonly used in neural networks. The linear rectifier function introduces nonlinear characteristics by outputting the positive part of the input (i.e., the input remains unchanged when it is greater than 0, and the output is 0 when it is less than or equal to 0). It can increase the nonlinear expression ability of the network while maintaining the efficiency of the calculation. The normalized exponential function (Softmax Function) is a function that converts the original output of multiple classifications into a probability distribution. By exponentializing the original output and normalizing it, the sum of the output probabilities of all categories is 1.

[0045] The classification result includes the application type to which the data packet belongs and the priority of the data packet. Exemplarily, the relationship between the application type to which the data packet belongs and the priority of the data packet corresponds to the following:

[0046] High priority: real-time interactive applications such as video conferencing and voice calls;

[0047] Medium priority: non-real-time applications such as web browsing and file transfer;

[0048] Low priority: Email and software updates, etc. can be applied later.

[0049] Specifically, in the task of classifying and prioritizing packets using a trained multilayer perceptron (MLP), first, the input layer of the MLP is used to encode the extracted features into a format suitable for MLP processing. Subsequently, these encoded features are input into the hidden layer, where each neuron applies a linear rectifier function (ReLU) to process these encoded features so that the network learns a deeper representation of the features of the packet. Finally, the features processed by the hidden layer are passed to the output layer, which uses a normalized exponential function to convert the network output into a probability distribution, thereby generating a classification result for each packet, the application type to which the classification result packet belongs and the corresponding priority. Through the above technical solution, using a trained multilayer perceptron (MLP) for packet classification and priority determination can effectively automate network management tasks. This method can improve the efficiency of network resource allocation, ensure that key business packets are transmitted preferentially, and thus optimize network performance and user experience.

[0050] Optionally, in order to further improve the flexibility and performance of the multilayer perceptron, its hidden layer can also use a variant function of the linear rectification function, such as Leaky ReLU and Noisy ReLU.

[0051] Optionally, during the training process of the multilayer perceptron, the multilayer perceptron continuously adjusts its weights and biases through a back propagation algorithm to minimize the classification error. The trained multilayer perceptron can be deployed in a network card to classify actual network data packets.

[0052] In some embodiments, the characteristics of each data packet include: source IP address, destination IP address, port number, protocol type and data packet size; encoding the characteristics of each data packet of network data includes: converting the source IP address, destination IP address and port number into integers or floating point numbers for encoding; one-hot encoding the protocol type; converting the data packet size into bytes and encoding the bytes.

[0053] In this embodiment, the source IP address is the IP address of the device that initiates the connection or sends data in the network communication. The target IP address is the IP address of the device that receives the connection or data in the network communication. The port number is a logical concept used by the transport layer to distinguish different services or applications. Each IP data packet contains a source port number and a destination port number, which are usually 16-bit numbers used to identify specific applications running on the sending and receiving ends. For example, HTTP services usually use port 80. The protocol type is the network protocol used for data transmission, such as the Transmission Control Protocol (TCP), the User Datagram Protocol (UDP), or the Internet Control Message Protocol (ICMP). The packet size is the total number of bytes in the packet.

[0054] Specifically, the feature encoding of data packets involves key information of data packets, such as source IP address, destination IP address, port number, protocol type and packet size. Among them, the source IP address and destination IP address will be converted into integers or floating point numbers for numerical analysis and comparison; the port number is also converted into integers or floating point numbers for easy identification and processing; the protocol type uses a unique hot encoding method to map each protocol to a unique binary vector, so as to clearly distinguish different network protocols; finally, the packet size is quantized in bytes, and further encoding processing may be performed, such as normalization, to eliminate the impact of different magnitudes, ensuring that the model can learn and identify network traffic patterns more effectively.

[0055] For example, suppose there is a data packet with the following characteristics: source IP address: 192.168.1.1; destination IP address: 192.168.1.2; port number (source): 80; port number (destination): 8080; protocol type: TCP; data packet size: 1500 bytes. According to the above encoding rules, the characteristic encoding of this data packet can be expressed as: source IP address: 3232235777 (integer encoding); destination IP address: 3232235778 (integer encoding); port number (source): 80 (integer encoding); port number (destination): 8080 (integer encoding); protocol type: 1,0,0 (TCP); data packet size: 1500.

[0056] This encoding method not only helps to standardize the data format, but also enables the characteristics of the data packet to be accurately interpreted and processed by the algorithm, laying a good foundation for further improving the efficiency of data packet classification.

[0057] In some embodiments, the numerical characteristics include traffic size, duration, packet rate and number of connections; encoding the numerical characteristics of network traffic includes: converting the traffic size into bytes or bits for encoding; converting the duration into seconds or milliseconds for encoding; converting the packet rate into a numerical value of packets / second for encoding; encoding the number of connections in the form of an integer.

[0058] Specifically, the numerical features include traffic size, duration, packet rate, and number of connections. Among them, traffic size, as a key indicator for measuring the amount of data transmitted, can be encoded by converting it into bytes or bits, which can standardize the measurement units of traffic of different sizes. Duration refers to the time span between the start and end of a network activity or session. Converting this duration into seconds or milliseconds can provide the model with an intuitive understanding of the duration of the event. Packet rate, that is, the number of packets transmitted per unit time, is an important parameter for evaluating network load and activity. Converting it into a numerical value of packets per second can reveal the density of network traffic. The number of connections represents the total number of network connections established within a specific time. Encoding it in integer form can intuitively represent the connection density of the network. By encoding these numerical features, it helps the pre-trained traffic prediction model to understand and process network data more accurately.

[0059] In some embodiments, the type features include a protocol type, a source IP address, a destination IP address, and a port number; encoding the type features of the network traffic includes: one-hot encoding the protocol type; converting the source IP address, the destination IP address, and the port number into integers or floating point numbers for encoding, respectively, or one-hot encoding the source IP address, the destination IP address, and the port number.

[0060] Specifically, the type features include protocol type, source IP address, destination IP address, and port number. Among them, the protocol type can be represented by one-hot encoding, which assigns a unique binary vector to each protocol, thereby clearly distinguishing different network protocols, such as TCP, UDP, or others. For the source IP address and destination IP address, as well as the port number, two main encoding methods can be used: one is to convert them into integers or floating-point numbers, which usually involves mapping the IP address and port number to a numerical space so that the model can calculate and compare these values; the other method is to perform one-hot encoding to assign a unique binary vector to each possible IP address and port number. This method is particularly suitable for situations where the value range of IP addresses and port numbers is limited and clear. Through these encoding strategies, the type features of network traffic can be converted into a data format suitable for the input of the pre-trained traffic prediction model, thereby improving the accuracy and efficiency of network traffic trend prediction.

[0061] Optionally, the type feature may also include an application type, and the application type is one-hot encoded.

[0062] For example, for the following network traffic characteristics:

[0063] Protocol type: TCP; Source IP address: 192.168.1.10; Destination IP address: 192.168.1.20; Port number: 80; Application type: Web browsing.

[0064] It can be converted to the following form:

[0065] Protocol type: [1,0,0,...] (TCP); source IP address: [0.75,0.6666,...] (floating point encoding); destination IP address: [0.75,0.6666,...] (floating point encoding); port number: [0.5,0,0,...] (floating point encoding); application type: [1,0,0,...] (web browsing).

[0066] In some embodiments, the prediction result of the network traffic trend includes a time series of at least one of the following information: the network traffic at a set time; the confidence interval of the network traffic at a set time; the probability distribution of the network traffic at a set time.

[0067] In this embodiment, the set time can be understood as one or more time points in the future prediction period.

[0068] Specifically, the prediction results of network traffic trends are usually presented in the form of time series, with the horizontal axis representing time and the vertical axis representing the predicted network traffic. The prediction results include at least one of the following forms of time series: point prediction, that is, the network traffic at a set time; interval prediction, that is, the confidence interval of the network traffic at a set time, such as a 95% confidence interval; probability distribution: that is, the probability distribution of the network traffic at a set time, such as a normal distribution or a Poisson distribution. The specific form used may depend on the prediction model used and the actual application scenario. For example, for real-time network traffic monitoring and control, point prediction or interval prediction is more commonly used, while for network capacity planning and resource allocation, probability distribution is more useful. Through the above technical solution, it is possible to maintain network stability during peak traffic periods, reduce congestion, and enhance the network's responsiveness and service efficiency.

[0069] In some embodiments, the priority of each data packet and the queue length of the queue are adjusted according to the predicted results of the network traffic trend, including: determining a first threshold and / or a second threshold according to the predicted results of the network traffic trend; when the network traffic monitored in real time exceeds the first threshold, increasing the queue length of the queue and / or increasing the priority of the data packets in the current queue; when the network traffic monitored in real time is lower than the second threshold, reducing the queue length of the queue and / or lowering the priority of the data packets in the current queue.

[0070] In this embodiment, the first threshold and / or the second threshold can be determined according to the prediction result of the network traffic trend, the first threshold is used as a standard for judging whether to increase the queue length of the queue and / or to increase the priority of the data packet in the current queue, and the second threshold is used as a standard for judging whether to reduce the queue length of the queue and / or to reduce the priority of the data packet in the current queue. On this basis, the first threshold and / or the second threshold are determined according to the prediction result of the network traffic trend; and then the network traffic is monitored in real time using a traffic monitoring tool or algorithm, and the data packet priority and / or the queue length are dynamically adjusted according to the relationship between the real-time network traffic and the first threshold and / or the second threshold.

[0071] It should be noted that the first threshold value and the second threshold value may be the same or different. The first threshold value is greater than or equal to the second threshold value.

[0072] In the case where the first threshold is different from the second threshold, for example, the range of network traffic changes in the next hour is [x1, x2], the first threshold can be closer to x2, and the second threshold can be closer to x1. For example, the first threshold is set to a set ratio of the upper limit of the network traffic change range (such as x2*0.8), or the first threshold is set according to the network traffic change amount (x2-x1) (such as (x2-x1)*0.8), or the first threshold is set to the difference between the upper limit of the network traffic change range and a fixed value (such as x2-10). Similarly, the second threshold can be based on the lower limit of the network traffic change range, the network traffic change amount, or the sum of the lower limit of the network traffic change range and a fixed value.

[0073] Optionally, in the case where the first threshold value is different from the second threshold value, when the network traffic monitored in real time is between the second threshold value and the first threshold value, the current queue length and / or data packet priority may be kept unchanged.

[0074] Optionally, the first threshold and / or the second threshold may be one or more. Taking the case of multiple first thresholds as an example, different first thresholds may correspond to different adjustment ranges of priority and / or queue length. 1a and T 1b , T 1a >T 1b ), when the real-time monitored network traffic reaches T 1b , the queue length of the queue can be increased by a first preset value (such as increasing the queue length by 5) and / or the priority of the data packet in the current queue can be increased by a first preset level value (such as increasing the priority by 1 level); if the network traffic monitored in real time reaches T 1a , the queue length of the queue can be increased by a second preset value (such as increasing the queue length by 10) and / or the priority of the data packet in the current queue can be increased by a second preset level value (such as increasing the priority by 2 levels). The first preset value is smaller than the second preset value, and the first preset level value is smaller than the second preset level value.

[0075] It is understandable that, in the case of multiple second thresholds, different second thresholds may correspond to different adjustment ranges of priority and / or queue length. The smaller the second threshold, the larger the corresponding adjustment range.

[0076] Optionally, for the first threshold, if the real-time network traffic does not exceed the first threshold, the queue length of the queue can be reduced and / or the priority of the data packets in the current queue can be reduced, or the current queue length and / or data packet priority can be kept unchanged. For the second threshold, if the real-time network traffic is not lower than the second threshold, the queue length of the queue can be increased and / or the priority of the data packets in the current queue can be increased, or the current queue length and / or data packet priority can be kept unchanged.

[0077] Optionally, for the case where the first threshold value is the same as the second threshold value, assuming that there is a queue, the first threshold value or the second threshold value is 100 data packets. The prediction result of the network traffic trend is: there are 50 data packets at time t1, 75 data packets at time t2, and 120 data packets at time t3; by real-time monitoring of network traffic, if there are actually 47 data packets at time t1, the queue length of the queue can be reduced and / or the priority of the data packets in the current queue can be reduced, if there are actually 70 data packets at time t2, the queue length of the queue can be reduced and / or the priority of the data packets in the current queue can be reduced, and if there are actually 125 data packets at time t3, the queue length of the queue can be increased and / or the priority of the data packets in the current queue can be increased.

[0078] Through the above method, the queue length and priority can be dynamically adjusted to adapt to the changing network traffic, thereby reducing network congestion and packet discard and improving network performance.

[0079] It should be noted that in this embodiment, the length of one queue may be adjusted, or the lengths of multiple queues may be adjusted simultaneously.

[0080] In some embodiments, in each scheduling, according to the queue length, the priority of the data packets in the queue and the waiting time, a data packet in the queue is selected to be sent to the network card for processing, including: maintaining a queue list, the queue list includes at least two queues, each queue has a corresponding allocation weight, and each queue has a corresponding scheduling threshold; in each scheduling, a target queue is determined according to the allocation weight of each queue; if the queue length of the target queue exceeds the scheduling threshold corresponding to the target queue, the data packet with the longest waiting time in the target queue is selected and sent to the network card for processing; if the queue length of the target queue does not exceed the scheduling threshold corresponding to the target queue, the data packet with the highest priority in the target queue is selected and sent to the network card for processing; after sending the selected data packet to the network card, the queue length of the target queue and the waiting time of each data packet in the target queue are updated.

[0081] In this embodiment, the queue list can be understood as a list formed by at least two queues. The allocation weight can be understood as a weight pre-allocated to the queue, and the allocation weight is used to allocate scheduling opportunities to the queue, that is, the larger the allocation weight, the higher the probability of being scheduled. The scheduling threshold can be understood as a pre-set dynamic threshold, and the scheduling threshold can be adjusted according to network conditions and performance requirements. The target queue can be understood as the queue that currently needs to be scheduled.

[0082] Specifically, a queue list is maintained, which includes at least two queues, a scheduling threshold is set for each queue, and an allocation weight is assigned to each queue. In each scheduling, the target queue that needs to be scheduled currently is determined according to the allocation weights of each queue. Check whether the queue length of the target queue exceeds the scheduling threshold of the target queue. If it exceeds the scheduling threshold, the data packet with the longest waiting time in the target queue is selected and sent to the network card for processing. Selecting the "oldest" data packet can effectively avoid the starvation problem of the queue; if it does not exceed the scheduling threshold, the data packet with the highest priority in the target queue is selected and sent to the network card for processing. Then, the data packet is deleted from the target queue, and the queue length of the target queue and the waiting time of each data packet are updated. Through the above technical solution, the transmission quality and processing efficiency of high-priority services are guaranteed, and low-priority services can be prevented from not being processed for a long time.

[0083] For example, assume that there is a queue list, which includes two queues, namely:

[0084] Queue A: The allocation weight is 3 and the scheduling threshold is 30 packets;

[0085] Queue B: The allocation weight is 1 and the scheduling threshold is 50 packets;

[0086] Initial state: The queue length of queue A is 20, and the queue length of queue B is 60;

[0087] According to the assigned weights, it can be determined that the probability of queue A being scheduled is 3 / 4, and the probability of queue B being scheduled is 1 / 4. At this time, queue A is the target queue, and its scheduling process is as follows: since the queue length of queue A does not exceed the scheduling threshold, the highest priority data packet can be processed.

[0088] Optionally, when queue B is the target queue, its scheduling process is: since the queue length of queue B exceeds the scheduling threshold, the data packet with the longest waiting time can be processed.

[0089] In some embodiments, resource usage information of the network card is monitored; and a resource allocation optimization strategy is determined according to the resource usage information through a pre-trained resource allocation model.

[0090] In this embodiment, the resource usage information of the network card can be understood as the usage status and efficiency of various hardware resources of the network card when performing network communication tasks. The resource usage information can include memory utilization, DMA engine utilization, interrupt processing time, etc. The pre-trained resource allocation model can be understood as a pre-trained network model for dynamically optimizing resource allocation.

[0091] Specifically, a network monitoring tool is used to monitor the resource usage information of the network card in real time, such as memory utilization, DMA engine utilization, and interrupt processing time; the resource usage information is input into a pre-trained resource allocation model, and a resource allocation optimization strategy is output, wherein the resource allocation optimization strategy may include a network card memory allocation strategy, a DMA engine allocation strategy, and an interrupt processing strategy, etc., and then the network card memory allocation, DMA engine allocation, and interrupt processing can be adjusted according to the resource allocation optimization strategy, so as to effectively improve the network card throughput.

[0092] In some embodiments, the resource allocation model is constructed based on proximal policy optimization; the state space of proximal policy optimization includes resource usage information; the action space of proximal policy optimization includes resource allocation optimization strategy; and the reward function of proximal policy optimization is set according to network throughput.

[0093] In this embodiment, Proximal Policy Optimization (PPO) is a policy gradient algorithm widely used in the field of reinforcement learning. It improves the stability and efficiency of training by clipping probability ratios and allowing multiple updates on a single data batch. It aims to solve the problem of training instability caused by excessive policy updates in traditional policy gradient methods.

[0094] Specifically, a resource allocation model is constructed based on proximal policy optimization (PPO), wherein the state space of proximal policy optimization includes the resource usage information of the network card, such as memory utilization, DMA engine utilization, and interrupt processing time, etc.; the action space of proximal policy optimization includes resource allocation optimization strategies, such as network card memory allocation strategy, DMA engine allocation strategy, and interrupt processing strategy, etc.; the reward function of proximal policy optimization is set according to network throughput. Through the above technical solution, PPO is used to construct a resource allocation model, optimize resource allocation strategies, and effectively improve resource utilization.

[0095] In some embodiments, the data packet processing method further includes: using a support vector machine or a convolutional neural network to determine the security status of the network traffic based on the characteristics of the network traffic, where the security status includes a normal state and an attack state.

[0096] In this embodiment, both the support vector machine and the convolutional neural network can be pre-trained models for classifying the security status of network traffic. The security status of network traffic includes a normal state and an attack state. Among them, the normal state can be understood as a state in which network traffic is transmitted normally according to established network protocols and rules without any form of malicious attack or abnormal interference. The attack state can be understood as a state in which network traffic is subjected to malicious attacks or abnormal interference during transmission, resulting in serious consequences such as network performance degradation, data leakage or system crash.

[0097] Specifically, the network traffic features, such as packet size, timestamp, and protocol type, are extracted from the network traffic using a feature extractor, and the obtained network traffic features are input into a support vector machine or a convolutional neural network to obtain the security status of the network traffic. Through the above technical solution, artificial intelligence technology is applied to network security detection, which realizes the timely detection of attack behaviors and prevents malicious traffic from affecting packet processing efficiency and network security.

[0098] In some embodiments, the data packet processing method further includes: when the security status of the network traffic is an attack status, performing at least one of the following security protection operations: blocking attack traffic, isolating infected hosts, and initiating a security response mechanism.

[0099] Specifically, when the security status of network traffic is an attack status, a series of emergency security protection operations should be immediately performed, including but not limited to quickly blocking abnormal or malicious attack traffic to prevent it from spreading further and endangering the network; at the same time, isolate the suspected infected or confirmed compromised hosts from the network to contain the impact of the attack; in addition, it is necessary to immediately start the established security response mechanism, including but not limited to activating the emergency response team, executing the preset emergency plan, collecting and analyzing attack evidence, etc., to comprehensively respond to and deal with network security incidents. Through the above technical solution, protective measures are taken in a timely manner according to the security status, effectively maintaining network security.

[0100] Optionally, provide a security policy management interface to allow users to customize network security policies, such as whitelists, blacklists, intrusion detection rules, etc.

[0101] Figure 2 Schematic diagram of a data packet processing device provided by an embodiment of the present invention. Figure 2 As shown, the device comprises:

[0102] A priority determination module 21, used to encode the characteristics of each data packet of network data through a pre-trained data packet classification model and determine the priority of each data packet according to the characteristics of each data packet;

[0103] A prediction module 22, configured to encode numerical features and / or type features of network traffic through a pre-trained traffic prediction model and predict network traffic trends according to the features of the network traffic, wherein the numerical features are used to describe the numerical values ​​of parameters of the network traffic, and the type features are used to describe the types of the network traffic;

[0104] An adjustment module 23, used for adjusting the priority of each of the data packets and the queue length of the queue according to the prediction result of the network traffic trend, wherein the queue is used for caching each of the data packets;

[0105] The processing module 24 is used to select a data packet in the queue and send it to the network card for processing according to the queue length, the priority of the data packets in the queue and the waiting time in each scheduling.

[0106] The technical solution of the present invention can effectively improve the processing efficiency of data packets and flexibly adapt to the changing trend of network traffic.

[0107] Optionally, the data packet classification model includes a multi-layer perceptron;

[0108] Optionally, the priority determination module 21 includes:

[0109] A first encoding unit, used for encoding the features of each of the data packets through the input layer of the multi-layer perceptron;

[0110] A second encoding unit, used for processing the encoding of the features of each of the data packets using a linear rectification function through a hidden layer of the multi-layer perceptron;

[0111] A result output unit is used to output the classification result of each data packet by using a normalized exponential function through the output layer of the multi-layer perceptron, wherein the classification result includes the priority of each data packet.

[0112] Optionally, the characteristics of each of the data packets include: source IP address, destination IP address, port number, protocol type and data packet size;

[0113] Optionally, encode the characteristics of each packet of network data, including:

[0114] The source IP address, the target IP address and the port number are respectively converted into integers or floating point numbers for encoding;

[0115] One-hot encode the protocol type;

[0116] The packet size is converted to a byte number and the byte number is encoded.

[0117] Optionally, the numerical features include flow size, duration, packet rate and number of connections;

[0118] Encodes numerical features of network traffic, including:

[0119] Convert the traffic size into bytes or bits for encoding;

[0120] Convert the duration into seconds or milliseconds for encoding;

[0121] Convert the data packet rate into a value of data packets / second for encoding;

[0122] Encoding the connection number in the form of an integer;

[0123] Encodes the type characteristics of network traffic, including:

[0124] One-hot encode the protocol type;

[0125] The source IP address, the target IP address and the port number are respectively converted into integers or floating point numbers for encoding, or the source IP address, the target IP address and the port number are one-hot encoded.

[0126] Optionally, the type characteristics include protocol type, source IP address, target IP address and port number;

[0127] Encodes the type characteristics of network traffic, including:

[0128] One-hot encode the protocol type;

[0129] The source IP address, the target IP address and the port number are respectively converted into integers or floating point numbers for encoding, or the source IP address, the target IP address and the port number are one-hot encoded.

[0130] Optionally, the prediction result of the network traffic trend includes a time series of at least one of the following information:

[0131] Network traffic at a set time;

[0132] Confidence interval of network traffic at a set time;

[0133] Probability distribution of network traffic at a given time.

[0134] Optionally, the adjustment module 23 includes:

[0135] A threshold determination unit, configured to determine a first threshold and / or a second threshold according to a prediction result of a network traffic trend;

[0136] A first adjustment unit, configured to increase the queue length of the queue and / or improve the priority of the data packets in the current queue when the network traffic monitored in real time exceeds the first threshold;

[0137] The second adjustment unit is used to reduce the queue length of the queue and / or lower the priority of the data packet in the current queue when the network traffic monitored in real time is lower than the second threshold.

[0138] Optionally, the processing module 24 includes:

[0139] A list maintenance unit, used to maintain a queue list, the queue list includes at least two queues, each of the queues has a corresponding allocation weight, and each of the queues has a corresponding scheduling threshold;

[0140] A queue determination unit, configured to determine a target queue according to the allocation weights of the queues in each scheduling;

[0141] A first processing unit, configured to select a data packet with the longest waiting time in the target queue and send it to the network card for processing if the queue length of the target queue exceeds a scheduling threshold corresponding to the target queue;

[0142] A second processing unit, configured to select a data packet with the highest priority in the target queue and send it to the network card for processing if the queue length of the target queue does not exceed the scheduling threshold corresponding to the target queue;

[0143] The data updating unit is used to update the queue length of the target queue and the waiting time of each data packet in the target queue after sending the selected data packet to the network card.

[0144] Optionally, the data packet processing device further includes:

[0145] Network card monitoring module, used to monitor the resource usage information of the network card;

[0146] A strategy determination module is used to determine a resource allocation optimization strategy according to the resource usage information through a pre-trained resource allocation model.

[0147] Optionally, the resource allocation model is constructed based on proximal policy optimization (PPO);

[0148] The state space of the proximal policy optimization includes resource usage information; the action space of the proximal policy optimization includes resource allocation optimization strategy; and the reward function of the proximal policy optimization is set according to network throughput.

[0149] Optionally, the data packet processing device further includes:

[0150] The state determination unit is used to use a support vector machine or a convolutional neural network to determine the security state of the network traffic according to the characteristics of the network traffic, and the security state includes a normal state and an attack state.

[0151] Optionally, the data packet processing device further includes:

[0152] The security operation execution module is used to execute at least one of the following security protection operations when the security state of the network traffic is an attack state: blocking attack traffic, isolating infected hosts, and starting a security response mechanism.

[0153] The data packet processing device provided in the embodiment of the present invention can execute the data packet processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0154] Figure 3 : is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. The electronic device may be an electronic device intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0155] like Figure 3 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0156] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0157] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above, such as a data packet processing method.

[0158] In some embodiments, the data packet processing method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the data packet processing method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the data packet processing method in any other appropriate manner (e.g., by means of firmware).

[0159] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0160] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0161] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0162] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0163] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0164] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0165] An embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the data packet processing method provided in any embodiment of the present application.

[0166] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0167] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0168] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A data packet processing method, characterized in that: include: Encoding the characteristics of each data packet of network data through a pre-trained data packet classification model and determining the priority of each data packet according to the characteristics of each data packet; Encoding the numerical features and / or type features of network traffic through a pre-trained traffic prediction model and predicting the network traffic trend according to the features of the network traffic, wherein the numerical features are used to describe the numerical values ​​of parameters of the network traffic, and the type features are used to describe the type of the network traffic; adjusting the priority of each of the data packets and the queue length of a queue according to the prediction result of the network traffic trend, wherein the queue is used to cache each of the data packets; In each scheduling, according to the queue length, the priority of the data packets in the queue and the waiting time, a data packet in the queue is selected and sent to the network card for processing.

2. The method according to claim 1, characterized in that The data packet classification model includes a multi-layer perceptron; The method of encoding the characteristics of each data packet of network data by a pre-trained data packet classification model and determining the priority of each data packet according to the characteristics of each data packet includes: Encoding the features of each of the data packets through the input layer of the multi-layer perceptron; Processing the encoding of the features of each of the data packets using a linear rectification function through the hidden layer of the multilayer perceptron; The classification result of each data packet is outputted through the output layer of the multi-layer perceptron using a normalized exponential function, and the classification result includes the priority of each data packet.

3. The method according to claim 1, characterized in that The characteristics of each of the data packets include: source IP address, destination IP address, port number, protocol type and data packet size; Encode the characteristics of each packet of network data, including: The source IP address, the target IP address and the port number are converted into integers or floating point numbers for encoding respectively; One-hot encode the protocol type; The packet size is converted to a byte number and the byte number is encoded.

4. The method according to claim 1, characterized in that: The numerical characteristics include flow size, duration, packet rate and number of connections; Encodes numerical features of network traffic, including: Convert the traffic size into bytes or bits for encoding; Convert the duration into seconds or milliseconds for encoding; Convert the data packet rate into a value of data packets / second for encoding; The connection number is encoded in the form of an integer.

5. The method according to claim 1, characterized in that: The type characteristics include protocol type, source IP address, target IP address and port number; Encodes the type characteristics of network traffic, including: One-hot encode the protocol type; The source IP address, the target IP address and the port number are respectively converted into integers or floating point numbers for encoding, or the source IP address, the target IP address and the port number are one-hot encoded.

6. The method according to claim 1, characterized in that The prediction result of the network traffic trend includes a time series of at least one of the following information: Network traffic at a set time; Confidence interval of network traffic at a set time; Probability distribution of network traffic at a given time.

7. The method according to claim 1, characterized in that According to the prediction result of the network traffic trend, the priority of each data packet and the queue length of the queue are adjusted, including: Determining a first threshold and / or a second threshold according to a prediction result of a network traffic trend; When the network traffic monitored in real time exceeds the first threshold, increasing the queue length of the queue and / or increasing the priority of the data packets in the current queue; When the network traffic monitored in real time is lower than the second threshold, the queue length of the queue is reduced and / or the priority of the data packets in the current queue is lowered.

8. The method according to claim 1, characterized in that: For any of the queues, according to the queue length of the queue, the priority of the data packets in the queue, and the waiting time, each data packet in the queue is selected in turn and sent to the network card for processing, including: Maintaining a queue list, the queue list including at least two queues, each of the queues having a corresponding allocation weight, and each of the queues having a corresponding scheduling threshold; In each scheduling, a target queue is determined according to the allocation weights of the queues; If the queue length of the target queue exceeds the scheduling threshold corresponding to the target queue, the data packet with the longest waiting time in the target queue is selected and sent to the network card for processing; If the queue length of the target queue does not exceed the scheduling threshold corresponding to the target queue, select the data packet with the highest priority in the target queue and send it to the network card for processing; After the selected data packet is sent to the network card, the queue length of the target queue and the waiting time of each data packet in the target queue are updated.

9. The method according to claim 1, characterized in that: Also includes: Monitor the resource usage information of the network card; A resource allocation optimization strategy is determined according to the resource usage information using a pre-trained resource allocation model.

10. The method according to claim 9, characterized in that The resource allocation model is constructed based on the proximal policy optimization PPO; The state space of the proximal strategy optimization includes resource usage information; the action space of the proximal strategy optimization includes resource allocation optimization strategy; The reward function of the proximal policy optimization is set according to the network throughput.

11. The method according to claim 1, characterized in that Also includes: A support vector machine or a convolutional neural network is used to determine the security status of the network traffic according to the characteristics of the network traffic, and the security status includes a normal state and an attack state.

12. The method according to claim 11, characterized in that Also includes: When the security status of the network traffic is an attack status, at least one of the following security protection operations is performed: blocking attack traffic, isolating infected hosts, and starting a security response mechanism.

13. A data packet processing device, characterized in that: include: A priority determination module, used to encode the characteristics of each data packet of network data through a pre-trained data packet classification model and determine the priority of each data packet according to the characteristics of each data packet; A prediction module, used to encode the numerical features and / or type features of network traffic through a pre-trained traffic prediction model and predict the network traffic trend according to the features of the network traffic, wherein the numerical features are used to describe the numerical values ​​of parameters of the network traffic, and the type features are used to describe the type of the network traffic; An adjustment module, used for adjusting the priority of each of the data packets and the queue length of the queue according to the prediction result of the network traffic trend, and the queue is used for caching each of the data packets; The processing module is used to select a data packet in the queue and send it to the network card for processing according to the queue length, the priority of the data packets in the queue and the waiting time in each scheduling.

14. An electronic device, characterized in that: include: at least one processor; a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the data packet processing method as described in any one of claims 1-12.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the data packet processing method as described in any one of claims 1 to 12 is implemented.

16. A computer program product comprising a computer program and / or instructions, characterized in that: When the computer program and / or instructions are executed by a processor, the data packet processing method as described in any one of claims 1 to 12 is implemented.

Images