Traffic identification method and device, computer device, readable storage medium and program product

Abstract

The application relates to a traffic identification method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: obtaining target traffic to be identified; identifying the target traffic through a hotspot engine to obtain a first identification result; wherein the hotspot engine is constructed based on a hotspot rule set, and the hotspot rule set contains hotspot rules in an application identification engine that meet preset traffic hit conditions; if the first identification result is that a target hotspot rule in the hotspot rule set is hit, an application identification result corresponding to the target hotspot rule is output; and if the first identification result is that the hotspot rule set is not hit, the target traffic is identified through the application identification engine, and a second identification result is output. The method can effectively improve the efficiency of application identification.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a traffic identification method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] Application identification is a mechanism for classifying traffic based on the characteristics of the applications / protocols within it. Through application identification technology, various applications within traffic can be accurately identified, enabling refined traffic management.

[0003] In related technologies, technicians need to pre-establish a feature database containing traffic matching rules. After receiving network traffic, the network traffic is matched against the matching rules, and the application type corresponding to the network traffic is determined based on the matching rules matched by the network traffic.

[0004] However, as the feature library for application recognition accumulates, it becomes increasingly large, containing tens of thousands of rules, leading to low efficiency in application recognition. Summary of the Invention

[0005] Therefore, it is necessary to provide a traffic identification method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve application identification efficiency in response to the above-mentioned technical problems.

[0006] In a first aspect, this application provides a traffic identification method, the method comprising:

[0007] Obtain the target traffic to be identified;

[0008] The target traffic is identified by a hotspot engine to obtain a first identification result; wherein, the hotspot engine is constructed based on a hotspot rule set, and the hotspot rule set contains hotspot rules in the application identification engine that meet preset traffic hit conditions;

[0009] If the first identification result is a hit with the target hotspot rule in the hotspot rule set, then the application identification result corresponding to the target hotspot rule is output;

[0010] If the first identification result is that the hotspot rule set is not matched, the target traffic is identified by the application identification engine, and a second identification result is output.

[0011] In one embodiment, each hotspot rule in the hotspot rule set has a popularity value; the method further includes:

[0012] Based on the first identification result and / or the second identification result, update the hotspot rules in the hotspot rule set and / or the popularity value of each hotspot rule;

[0013] Based on the updated set of hotspot rules, a new hotspot engine is generated.

[0014] In one embodiment, updating the popularity value of each hotspot rule in the hotspot rule set based on the first identification result and / or the second identification result includes:

[0015] If the first identification result is a hit on the target hotspot rule in the hotspot rule set, then based on the preset hotspot value increase strategy, the hotspot value of the target hotspot rule is increased, and based on the preset hotspot value decrease strategy, the hotspot values ​​of other hotspot rules in the hotspot rule set other than the target hotspot rule are decreased.

[0016] If the first identification result is that the hot spot rule set is not matched, then the heat value of all hot spot rules in the hot spot rule set is reduced based on the preset heat value reduction strategy.

[0017] In one embodiment, updating the popularity value of each hotspot rule in the hotspot rule set based on the first identification result and / or the second identification result includes:

[0018] If the second recognition result matches the target matching rule corresponding to the application recognition engine, then the target matching rule is added to the hotspot rule set as a hotspot rule, and the preset popularity value is used as the popularity value of the newly added popularity rule.

[0019] In one embodiment, before regenerating the hotspot engine based on the updated hotspot rule set, the method further includes:

[0020] If, in the set of hotspot rules, there exists a hotspot rule with a popularity value less than or equal to a preset threshold, then that hotspot rule with a popularity value less than or equal to the preset threshold is deleted from the set of hotspot rules, and the first status flag corresponding to the set of hotspot rules is incremented by 1; and / or,

[0021] After adding the target matching rule to the hotspot rule set, increment the first state identifier corresponding to the hotspot rule set by 1.

[0022] In one embodiment, the step of regenerating the hotspot engine based on the updated hotspot rule set includes:

[0023] Obtain the second status identifier corresponding to the hotspot engine;

[0024] If the first status identifier is inconsistent with the second status identifier, the hotspot engine is regenerated based on the updated hotspot rule set.

[0025] Secondly, this application provides a traffic flow identification device, the device comprising:

[0026] The acquisition module is used to acquire the target traffic to be identified;

[0027] The determination module is used to identify the target traffic through a hotspot engine and obtain a first identification result; wherein, the hotspot engine is constructed based on a hotspot rule set, and the hotspot rule set includes hotspot rules in the application identification engine that meet preset traffic hit conditions;

[0028] The first output module is configured to output the application identification result corresponding to the target hotspot rule if the first identification result is a hit of the target hotspot rule in the hotspot rule set;

[0029] The second output module is used to identify the target traffic through the application identification engine and output a second identification result if the first identification result is that the hotspot rule set is not matched.

[0030] In one embodiment, each hotspot rule in the hotspot rule set has a popularity value; the device further includes:

[0031] The update module is used to update the hotspot rules in the hotspot rule set and / or the heat value of each hotspot rule based on the first identification result and / or the second identification result;

[0032] The generation module is used to regenerate the hotspot engine based on the updated set of hotspot rules.

[0033] In one embodiment, the update module is specifically used for:

[0034] If the first identification result is a hit on the target hotspot rule in the hotspot rule set, then based on the preset hotspot value increase strategy, the hotspot value of the target hotspot rule is increased, and based on the preset hotspot value decrease strategy, the hotspot values ​​of other hotspot rules in the hotspot rule set other than the target hotspot rule are decreased.

[0035] If the first identification result is that the hot spot rule set is not matched, then the heat value of all hot spot rules in the hot spot rule set is reduced based on the preset heat value reduction strategy.

[0036] In one embodiment, the update module is specifically used for:

[0037] If the second recognition result matches the target matching rule corresponding to the application recognition engine, then the target matching rule is added to the hotspot rule set as a hotspot rule, and the preset popularity value is used as the popularity value of the newly added popularity rule.

[0038] In one embodiment, the device further includes:

[0039] The first adding module is configured to, when there are hotspot rules in the hotspot rule set whose popularity value is less than or equal to a preset threshold, delete the hotspot rule whose popularity value is less than or equal to the preset threshold from the hotspot rule set, and increment the first status flag corresponding to the hotspot rule set by 1; and / or,

[0040] The second addition module is used to increment the first status identifier corresponding to the hot spot rule set by 1 after adding the target matching rule to the hot spot rule set.

[0041] In one embodiment, the generation module is specifically used for:

[0042] Obtain the second status identifier corresponding to the hotspot engine;

[0043] If the first status identifier is inconsistent with the second status identifier, the hotspot engine is regenerated based on the updated hotspot rule set.

[0044] Thirdly, this application provides a computer device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in any one of the first aspects.

[0045] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any one of the first aspects.

[0046] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in any one of the first aspects.

[0047] The aforementioned traffic identification method, apparatus, computer equipment, computer-readable storage medium, and computer program product can acquire target traffic to be identified, identify the target traffic through a hotspot engine, and obtain a first identification result. The hotspot engine is constructed based on a set of hotspot rules, which includes hotspot rules that meet preset traffic hit conditions. If the first identification result matches a target hotspot rule in the set of hotspot rules, the application identification result corresponding to the target hotspot rule is output. If the first identification result does not match the set of hotspot rules, the target traffic is identified through an application identification engine, and a second identification result is output. In this solution, the hotspot engine is constructed based on hotspot rules in the application identification engine that meet preset traffic hit conditions. Therefore, the hotspot engine has a higher matching degree with applications in the current traffic, and subsequent traffic has a higher probability of hitting the hotspot engine. This solution first identifies traffic through the hotspot engine; if a hit is found, an identification result is output; otherwise, identification is performed through a traditional application identification engine. Therefore, it can effectively reduce the number of times traffic enters the original engine. Since the number of rules in the hotspot engine is much smaller than the number of rules in the original engine, the rule scale of the hotspot engine can effectively improve the efficiency of application identification. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a flowchart illustrating a traffic identification method in one embodiment;

[0050] Figure 2 This is a flowchart illustrating the hotspot engine update steps in one embodiment;

[0051] Figure 3 This is a flowchart illustrating an example of a traffic identification method in another embodiment;

[0052] Figure 4 This is a structural block diagram of a traffic identification method apparatus in one embodiment;

[0053] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0055] This application provides a traffic identification method. In this embodiment, the method is applied to a network device, which can be a terminal device. It is understood that the method can also be applied to a server, and can also be applied to a system including a terminal device and a server, and is implemented through the interaction between the terminal device and the server.

[0056] The traffic identification method provided in this application will be explained in detail below with reference to specific implementation methods. For example... Figure 1 As shown, the method includes the following steps:

[0057] Step 102: Obtain the target traffic to be identified.

[0058] In this embodiment, the network device can receive traffic transmitted in the network, i.e., the target traffic to be identified. The network device can determine whether a hotspot engine exists. If it does, step 104 is executed; otherwise, the target traffic is identified using a traditional application identification engine.

[0059] Step 104: Identify the target traffic through the hotspot engine to obtain the first identification result; wherein, the hotspot engine is built based on the hotspot rule set, which contains hotspot rules that meet the preset traffic hit conditions.

[0060] In this embodiment, when a hotspot engine exists, the network device can input target traffic into the hotspot engine to obtain a first identification result. The hotspot engine is an engine built based on a set of hotspot rules, which contains hotspot rules that meet preset traffic hit conditions.

[0061] In one example, without a hotspot engine, the network device can establish a set of hotspot rules. When the network device receives traffic, it can input the target traffic into the application identification engine and copy and store the rules matched by the target traffic as hotspot rules into the hotspot rule set. Simultaneously, the hotspot rule's popularity value can be set to a preset value. When the number of hotspot rules in the hotspot rule set is greater than or equal to a preset threshold, the network device generates a hotspot engine based on the hotspot rule set and sets the hotspot engine before the application identification engine. This way, when traffic is received, it can be identified first through the hotspot engine.

[0062] Step 106: If the first identification result is a target hotspot rule in the hotspot rule set, then output the application identification result corresponding to the target hotspot rule.

[0063] In this embodiment of the application, if the first identification result is a target hotspot rule in the hotspot rule set, the network device can determine the application identification result corresponding to the target hotspot rule and output the identification result. Furthermore, it can also update the heat value of the hotspot rule in the hotspot rule set based on a preset heat value update strategy.

[0064] Step 108: If the first identification result is that the hot spot rule set is not matched, the target traffic is identified by applying the identification engine, and the second identification result is output.

[0065] In this embodiment, if the first identification result is a mismatch with the hotspot rule set, the network device inputs the target traffic into the application identification engine for identification to obtain a second identification result. If the second identification result matches the target rule in the application identification engine, the network device can determine the application identification result corresponding to the target rule and output the identification result; if the second identification result does not match the target rule in the application identification engine, the network device can output the identification result corresponding to the target traffic according to the configuration information.

[0066] In this solution, the hotspot engine is built based on hotspot rules in the application identification engine that meet preset traffic hit conditions. Therefore, the hotspot engine has a higher matching degree with applications in the current traffic, and subsequent traffic has a greater probability of hitting the hotspot engine. This solution first uses the hotspot engine to identify traffic; if a match is found, the identification result is output; otherwise, the traditional application identification engine is used for identification. Therefore, it can effectively reduce the number of times traffic enters the original engine. Since the number of rules in the hotspot engine is much smaller than the number of rules in the original engine, the rule scale of the hotspot engine can effectively improve the efficiency of application identification.

[0067] Optionally, each hotspot rule in the hotspot rule set has a popularity value; such as Figure 2 As shown, the method also includes:

[0068] Step 202: Based on the first identification result and / or the second identification result, update the hotspot rules and / or the popularity values ​​of each hotspot rule in the hotspot rule set.

[0069] Step 204: Regenerate the hotspot engine based on the updated set of hotspot rules.

[0070] In this embodiment, the network device can update the hotspot rule set based on the first identification result and / or the second identification result, and a preset update strategy. Specifically, it can update the hotspot rules included in the hotspot rule set, or it can update the popularity value of the hotspot rules and redetermine the hotspot rules that meet the preset hit conditions based on the updated popularity value, thereby updating the hotspot rule set. The network device can regenerate the hotspot engine based on the updated hotspot rule set.

[0071] In this solution, the hotspot engine can be dynamically generated based on the application identification results of the current traffic. Therefore, the number of rules in the hotspot engine is not only less than that in the original engine, but also has a higher matching degree with the applications in the current traffic. Subsequent traffic has a high probability of hitting the hotspot engine. Furthermore, the rule size of the hotspot engine is small, reducing the number of times traffic enters the original engine, thereby improving the efficiency of application identification. Moreover, since the hotspot engine is dynamically generated based on the current traffic, it can adapt to different network environments, exhibiting higher adaptability to the current network environment.

[0072] Optionally, based on the first identification result and / or the second identification result, the popularity value of each hot spot rule in the hot spot rule set is updated, including: if the first identification result is a hit on the target hot spot rule in the hot spot rule set, the popularity value of the target hot spot rule is increased based on a preset popularity value increase strategy, and the popularity value of other hot spot rules in the hot spot rule set other than the target hot spot rule is decreased based on a preset popularity value decrease strategy; if the first identification result is a miss on the hot spot rule set, the popularity value of all hot spot rules in the hot spot rule set is decreased based on a preset popularity value decrease strategy.

[0073] In this embodiment, each hotspot rule has a popularity value. When a hotspot rule is added to the hotspot rule set, its popularity value is initialized to a preset popularity value. Subsequently, the hotspot value of the hotspot rule is dynamically adjusted based on the traffic hit rate of the hotspot rule. Specifically, the hotspot value is positively correlated with the hit frequency of the hotspot rule.

[0074] If the first identification result matches the target hotspot rule in the hotspot rule set, the network device can increase the hotspot rule's popularity value based on a preset popularity value increase strategy. For example, the network device can obtain the current popularity value of the target hotspot rule and then increase its popularity value by a preset increase value or a preset increase ratio, such as adding 1 to the target hotspot rule's popularity value. Simultaneously, the network device can decrease the popularity values ​​of other hotspot rules in the hotspot rule set, excluding the target hotspot rule, based on a preset popularity value decrease strategy. For example, the network device can obtain the current popularity value of the target hotspot rule and then decrease its popularity value by a preset decrease value or a preset decrease ratio, such as subtracting 1 from the target hotspot rule's popularity value. Furthermore, if the first identification result does not match the hotspot rule set, the network device can decrease the popularity values ​​of all hotspot rules in the hotspot rule set based on a preset popularity value decrease strategy. The specific decrease method can be the same as the above methods.

[0075] In this solution, updating the popularity value of popularity rules maintains the freshness of the hot topic engine and prevents it from becoming too redundant, thus ensuring its efficiency. Specifically, for hot topic rules with high hit frequency, the popularity value of the rule can be increased, delaying its aging period and improving the hit rate; for hot topic rules with low hit frequency, the popularity value can be decreased, accelerating their aging process, thereby preventing the hot topic engine from becoming too redundant.

[0076] Optionally, based on the first identification result and / or the second identification result, the popularity value of each hot spot rule in the hot spot rule set is updated, including: if the second identification result is a target matching rule corresponding to the application identification engine, the target matching rule is added to the hot spot rule set as a hot spot rule, and the preset popularity value is used as the popularity value of the newly added hot spot rule.

[0077] In this embodiment of the application, if the second identification result matches the target matching rule corresponding to the application identification engine, the network device can add the target matching rule as a hotspot rule to the hotspot rule set, and initialize the hotspot value of the newly added hotspot rule to a preset hotspot value.

[0078] In this solution, if the traffic does not hit the hotspot engine, the rules in the application identification engine that the traffic does hit can be obtained and added to the hotspot rule set. This allows the hotspot rules in the hotspot rule set to be dynamically adjusted, so that the hotspot engine can be dynamically generated according to the current traffic and dynamically adjusted according to different network environments, making it more suitable for the current network environment.

[0079] Optionally, before regenerating the hotspot engine based on the updated hotspot rule set, the method further includes: if there are hotspot rules in the hotspot rule set with a popularity value less than or equal to a preset threshold, deleting the hotspot rules with a popularity value less than or equal to the preset threshold from the hotspot rule set and incrementing the first status flag corresponding to the hotspot rule set by 1; and / or, after adding the target matching rule to the hotspot rule set, incrementing the first status flag corresponding to the hotspot rule set by 1.

[0080] In this embodiment, after updating the popularity, the network device can determine whether there are any hotspot rules in the hotspot rule set whose popularity value is less than or equal to a preset threshold. If so, the hotspot rule with a popularity value less than or equal to the preset threshold is deleted from the hotspot rule set, and the first status flag corresponding to the hotspot rule set is incremented by 1. The first status flag is used to record the update status of the hotspot rule set. Furthermore, after adding a target matching rule to the hotspot rule set, the network device can also increment the first status flag corresponding to the hotspot rule set by 1.

[0081] This solution records the number of times the hotspot rule set has been updated by updating the first state identifier, which facilitates updating the hotspot engine.

[0082] Optionally, based on the updated hotspot rule set, a hotspot engine is regenerated, including: obtaining the second state identifier corresponding to the hotspot engine; if the first state identifier and the second state identifier are inconsistent, the hotspot engine is regenerated based on the updated hotspot rule set.

[0083] In this embodiment, the first state identifier and the second state identifier can be two different variables. The first state identifier is used to record the update status of the hotspot rule set. It is updated whenever a hotspot rule is added or deleted from the set. For example, the first state identifier can represent the number of times the hotspot rule set has been updated. The second state identifier is used to record the update status of the hotspot engine. It is updated whenever the hotspot engine is updated, and can be updated based on the first state identifier.

[0084] Specifically, the network device can obtain the second status identifier corresponding to the hotspot engine, and then determine whether the first status identifier and the second status identifier are consistent. If they are inconsistent, it means that the current hotspot rule set has been updated. The network device can obtain the current hotspot rule set (i.e., the updated hotspot rule set) and the current first status identifier, and then update the second status identifier to the obtained first status identifier. At the same time, the network device regenerates the hotspot engine based on the updated hotspot rule set. If the two are consistent, there is no need to update the hotspot engine.

[0085] In this solution, an independent hotspot engine maintenance process is added outside the message processing flow. This process periodically checks whether the hotspot engine needs updating. If an update is required, a new hotspot engine is generated to replace the old one. This avoids the hotspot engine generation process impacting message processing efficiency and ensures timely updates. Furthermore, asynchronous updates to the hotspot engine are achieved through first and second status identifiers. For example, if the hotspot rule set is updated while the hotspot engine is being updated, this can be recorded and identified using the first status identifier, allowing for further updates to the hotspot engine and ensuring no updates are missed.

[0086] like Figure 3 As shown in the figure, this application embodiment provides a method for updating a hotspot engine, including the following steps:

[0087] Step 301: Obtain the target traffic to be identified.

[0088] Step 302: Determine if a hotspot engine exists.

[0089] If the condition is met, proceed to step 303; otherwise, proceed to step 306.

[0090] Step 303: Identify target traffic using a hotspot engine.

[0091] The hotspot engine is built on a set of hotspot rules, which contains hotspot rules that meet preset traffic hit conditions.

[0092] If the target hotspot rule in the hotspot rule set is matched, proceed to step 304; otherwise, proceed to step 305.

[0093] Step 304: Based on the preset heat value increase strategy, increase the heat value of the target hot spot rule, and based on the preset heat value decrease strategy, decrease the heat value of other hot spot rules in the hot spot rule set other than the target hot spot rule.

[0094] Step 305: Based on the preset heat value reduction strategy, reduce the heat value of all hot rules in the hot rule set.

[0095] Step 306: Identify the target traffic by applying an identification engine.

[0096] If the target matching rule corresponding to the application recognition engine is matched, proceed to step 308; if the target matching rule corresponding to the application recognition engine is not matched, proceed to step 312.

[0097] Step 307: Add the target matching rule as a hotspot rule to the hotspot rule set, use the preset popularity value as the popularity value of the target matching rule, and increment the first status flag corresponding to the hotspot rule set by 1.

[0098] Step 308: If there are hot rules in the hot rule set whose popularity value is less than or equal to a preset threshold, delete the hot rule whose popularity value is less than or equal to the preset threshold from the hot rule set, and increment the first status flag corresponding to the hot rule set by 1.

[0099] Step 309: Obtain the second status identifier corresponding to the hotspot engine.

[0100] Step 310: Determine whether the first state identifier and the second state identifier are consistent.

[0101] If there is a discrepancy, proceed to step 311; otherwise, proceed to step 312.

[0102] Step 311: Regenerate the hotspot engine based on the updated set of hotspot rules.

[0103] Step 312, end processing.

[0104] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0105] Based on the same inventive concept, this application also provides a traffic identification device for implementing the traffic identification method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more traffic identification device embodiments provided below can be found in the limitations of the traffic identification method described above, and will not be repeated here.

[0106] In one exemplary embodiment, such as Figure 4 As shown, a traffic flow identification device is provided, the device comprising: an acquisition module 410, a determination module 420, a first output module 430, and a second output module 440, wherein:

[0107] The acquisition module 410 is used to acquire the target traffic to be identified;

[0108] The determination module 420 is used to identify the target traffic through a hotspot engine and obtain a first identification result; wherein, the hotspot engine is constructed based on a hotspot rule set, and the hotspot rule set includes hotspot rules in the application identification engine that meet preset traffic hit conditions;

[0109] The first output module 430 is used to output the application identification result corresponding to the target hotspot rule if the first identification result is a hit of the target hotspot rule in the hotspot rule set;

[0110] The second output module 440 is used to identify the target traffic through the application identification engine and output a second identification result if the first identification result is that the hotspot rule set is not matched.

[0111] In one embodiment, each hotspot rule in the hotspot rule set has a popularity value; the device further includes:

[0112] The update module is used to update the hotspot rules in the hotspot rule set and / or the heat value of each hotspot rule based on the first identification result and / or the second identification result;

[0113] The generation module is used to regenerate the hotspot engine based on the updated set of hotspot rules.

[0114] In one embodiment, the update module is specifically used for:

[0115] If the first identification result is a hit on the target hotspot rule in the hotspot rule set, then based on the preset hotspot value increase strategy, the hotspot value of the target hotspot rule is increased, and based on the preset hotspot value decrease strategy, the hotspot values ​​of other hotspot rules in the hotspot rule set other than the target hotspot rule are decreased.

[0116] If the first identification result is that the hot spot rule set is not matched, then the heat value of all hot spot rules in the hot spot rule set is reduced based on the preset heat value reduction strategy.

[0117] In one embodiment, the update module is specifically used for:

[0118] If the second recognition result matches the target matching rule corresponding to the application recognition engine, then the target matching rule is added to the hotspot rule set as a hotspot rule, and the preset popularity value is used as the popularity value of the newly added popularity rule.

[0119] In one embodiment, the device further includes:

[0120] The first adding module is configured to, when there are hotspot rules in the hotspot rule set whose popularity value is less than or equal to a preset threshold, delete the hotspot rule whose popularity value is less than or equal to the preset threshold from the hotspot rule set, and increment the first status flag corresponding to the hotspot rule set by 1; and / or,

[0121] The second addition module is used to increment the first status identifier corresponding to the hot spot rule set by 1 after adding the target matching rule to the hot spot rule set.

[0122] In one embodiment, the generation module is specifically used for:

[0123] Obtain the second status identifier corresponding to the hotspot engine;

[0124] If the first status identifier is inconsistent with the second status identifier, the hotspot engine is regenerated based on the updated hotspot rule set.

[0125] Each module in the aforementioned traffic identification device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0126] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 5As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by the processor, the computer program implements a traffic identification method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0127] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0128] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the traffic identification method described above.

[0129] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the traffic identification method described above.

[0130] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the traffic identification method described above.

[0131] It should be noted that the user information (including but not limited to user device identifiers, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0132] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0133] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0134] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A traffic flow identification method, characterized in that, The method includes: Obtain the target traffic to be identified; The target traffic is identified by a hotspot engine to obtain a first identification result; wherein, the hotspot engine is constructed based on a hotspot rule set, and the hotspot rule set contains hotspot rules in the application identification engine that meet preset traffic hit conditions; If the first identification result is a hit with the target hotspot rule in the hotspot rule set, then the application identification result corresponding to the target hotspot rule is output; If the first identification result is that the hotspot rule set is not matched, then the target traffic is identified by the application identification engine, and a second identification result is output. Each hotspot rule in the hotspot rule set has a popularity value; the method further includes: updating the hotspot rules in the hotspot rule set and / or the popularity values ​​of each hotspot rule based on the first identification result and / or the second identification result; and regenerating the hotspot engine based on the updated hotspot rule set. The step of updating the popularity value of each hotspot rule in the hotspot rule set based on the first identification result and / or the second identification result includes: if the first identification result is a hit on a target hotspot rule in the hotspot rule set, then based on a preset popularity value increase strategy, the popularity value of the target hotspot rule is increased, and based on a preset popularity value decrease strategy, the popularity values ​​of other hotspot rules in the hotspot rule set besides the target hotspot rule are decreased; if the first identification result is a miss on the hotspot rule set, then based on a preset popularity value decrease strategy, the popularity values ​​of all hotspot rules in the hotspot rule set are decreased. Before regenerating the hotspot engine based on the updated hotspot rule set, the method further includes: if there are hotspot rules in the hotspot rule set whose popularity value is less than or equal to a preset threshold, deleting the hotspot rules whose popularity value is less than or equal to the preset threshold from the hotspot rule set, and incrementing the first status identifier corresponding to the hotspot rule set by 1.

2. The method according to claim 1, characterized in that, The step of updating the popularity value of each hotspot rule in the hotspot rule set based on the first identification result and / or the second identification result includes: If the second recognition result matches the target matching rule corresponding to the application recognition engine, then the target matching rule is added to the hotspot rule set as a hotspot rule, and the preset popularity value is used as the popularity value of the newly added popularity rule.

3. The method according to claim 1 or 2, characterized in that, Before regenerating the hotspot engine based on the updated hotspot rule set, the process also includes: After adding the target matching rule to the hotspot rule set, increment the first state identifier corresponding to the hotspot rule set by 1.

4. The method according to claim 3, characterized in that, The process of regenerating the hotspot engine based on the updated set of hotspot rules includes: Obtain the second status identifier corresponding to the hotspot engine; If the first status identifier is inconsistent with the second status identifier, the hotspot engine is regenerated based on the updated hotspot rule set.

5. A flow rate identification device, characterized in that, The device includes: The acquisition module is used to acquire the target traffic to be identified; The determination module is used to identify the target traffic through a hotspot engine and obtain a first identification result; wherein, the hotspot engine is constructed based on a hotspot rule set, and the hotspot rule set includes hotspot rules in the application identification engine that meet preset traffic hit conditions; The first output module is configured to output the application identification result corresponding to the target hotspot rule if the first identification result is a hit of the target hotspot rule in the hotspot rule set; The second output module is used to identify the target traffic through the application identification engine and output a second identification result if the first identification result is that the hot spot rule set is not matched. Each hotspot rule in the hotspot rule set has a popularity value; the device further includes: an update module, used to update the hotspot rules in the hotspot rule set and / or the popularity values ​​of each hotspot rule based on the first identification result and / or the second identification result; and a generation module, used to regenerate the hotspot engine based on the updated hotspot rule set. The updating module is specifically configured to: if the first identification result is a hit on a target hotspot rule in the hotspot rule set, then increase the heat value of the target hotspot rule based on a preset heat value increase strategy, and decrease the heat value of other hotspot rules in the hotspot rule set other than the target hotspot rule based on a preset heat value decrease strategy; if the first identification result is a miss on the hotspot rule set, then decrease the heat value of all hotspot rules in the hotspot rule set based on a preset heat value decrease strategy. The device further includes: a first adding module, used to delete the hotspot rule with a heat value less than or equal to a preset threshold from the hotspot rule set when there is a hotspot rule in the hotspot rule set with a heat value less than or equal to a preset threshold, and to increment the first status identifier corresponding to the hotspot rule set by 1.

6. The apparatus according to claim 5, characterized in that, The update module is specifically used for: If the second recognition result matches the target matching rule corresponding to the application recognition engine, then the target matching rule is added to the hotspot rule set as a hotspot rule, and the preset popularity value is used as the popularity value of the newly added popularity rule.

7. The apparatus according to claim 5 or 6, characterized in that, The device further includes: The second addition module is used to increment the first status identifier corresponding to the hot spot rule set by 1 after adding the target matching rule to the hot spot rule set.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images