Resource object dimension traffic analysis method based on genetic algorithm and related equipment

Abstract

The invention provides a resource object dimension flow analysis method based on a genetic algorithm, which is applied to a network topology system, the network topology system comprises a plurality of resource objects, any two resource objects are in communication connection, and the method comprises the following steps: obtaining a routing matrix in the network topology system and uplink and downlink data packets of each port; and decomposing the uplink and downlink data packets to determine a real traffic array. And carrying out dimension reduction processing on the routing matrix to obtain a dimension reduction matrix. And determining a first traffic matrix through operation according to the real traffic array and the dimension reduction matrix. And randomly generating a plurality of load factors, and scaling the first traffic matrix based on the plurality of load factors to obtain a plurality of second traffic matrixes. And shaping and expanding each second traffic matrix in the plurality of second traffic matrixes to obtain a plurality of third traffic matrixes. And determining a target traffic matrix related to the plurality of resource objects by adopting a genetic algorithm based on the plurality of third traffic matrixes.

Description

Technical Field

[0001] The present application relates to the technical field of network traffic analysis, and in particular to a resource object dimension traffic analysis method based on genetic algorithm and related equipment. Background Art

[0002] With the rapid development of cloud computing and network technology, building an efficient and intelligent cloud network system has become an important topic in the field of information technology. As an innovative solution, digital twin network provides new ideas for network management and optimization by integrating spatial and temporal dimensions. Digital twin network uses real-time data and advanced analysis technology to create a virtual model that is synchronized with the actual network, making network monitoring, analysis and prediction more accurate and efficient.

[0003] In the research and practice in this field, the study of traffic super-resolution in the resource object dimension on the spatial dimension is crucial. Port-level and tunnel-level traffic information is essential for understanding network performance, reliability, and security. However, existing traffic monitoring and analysis methods often have difficulty in accurately inferring traffic information at the IP flow level. Summary of the invention

[0004] In view of this, the purpose of this application is to propose a resource object dimension traffic analysis method and related equipment based on genetic algorithm to solve the problem that existing traffic monitoring and analysis methods are difficult to accurately infer traffic information at the IP flow level.

[0005] Based on the above purpose, the first aspect of the present application provides a resource object dimension traffic analysis method based on a genetic algorithm, which is applied to a network topology system, wherein the network topology system includes multiple resource objects, and any two resource objects are connected in communication. The method includes:

[0006] Acquire uplink and downlink data packets of each port in the network topology system, and a routing matrix in the network topology system;

[0007] Decomposing the uplink and downlink data packets to obtain uplink input traffic and uplink output traffic, and determining a real traffic array based on the uplink input traffic and the uplink output traffic;

[0008] Performing dimensionality reduction processing on the routing matrix to obtain a dimensionality reduction matrix;

[0009] Determine a first flow matrix through calculation according to the real flow array and the dimension reduction matrix;

[0010] randomly generating a plurality of load factors, and scaling the first traffic matrix based on the plurality of load factors to obtain a plurality of second traffic matrices;

[0011] Reshaping and expanding each of the plurality of second flow matrices to obtain a plurality of third flow matrices;

[0012] Based on the plurality of third traffic matrices, a genetic algorithm is used to determine a target traffic matrix associated with the plurality of resource objects.

[0013] Based on the same inventive concept, the present application also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein the processor implements the method described in the first aspect when executing the computer program.

[0014] Based on the same inventive concept, the present application also provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute the method described in the first aspect.

[0015] As can be seen from the above, the resource object dimension traffic analysis method based on a genetic algorithm provided by the present application is applied to a network topology system, wherein the network topology system includes multiple resource objects, and any two resource objects are connected in communication. The method includes: obtaining the uplink and downlink data packets of each port in the network topology system, and the routing matrix in the network topology system, to provide a data basis for subsequent traffic analysis. Decompose the uplink and downlink data packets to obtain the uplink input traffic and the uplink output traffic, and determine the real traffic array based on the uplink input traffic and the uplink output traffic. Perform dimensionality reduction processing on the routing matrix to obtain a reduced-dimensional matrix. The routing matrix after dimensionality reduction changes from sparse to full rank, so that the final solved traffic matrix has higher accuracy. According to the real traffic array and the reduced-dimensional matrix, a first traffic matrix is ​​determined through calculation. Multiple load factors are randomly generated, and the first traffic matrix is ​​scaled based on the multiple load factors to obtain multiple second traffic matrices. Each second traffic matrix in the multiple second traffic matrices is shaped and expanded to obtain multiple third traffic matrices. Based on multiple third flow matrices, a genetic algorithm is used to determine the target flow matrix related to the multiple resource objects, and the convergence speed of the solution is improved by the genetic algorithm to obtain the optimal solution, that is, the target flow matrix. Through the method of the present application, the flow information of the IP level can be inferred, and the flow conditions of each network node and port can be deeply understood, so as to achieve finer-grained control and optimization of the bandwidth. Based on the obtained IP-level flow data, the flow load balance can be adjusted in time to avoid overloading of individual paths, thereby reducing network congestion, improving data transmission efficiency and response speed. Through accurate flow management methods, network resources can be more reasonably allocated, resources can be allocated on demand, and waste of resources can be reduced, thereby improving the overall performance of the network, especially in a large-scale distributed network environment. In addition, by deeply analyzing the flow information of the IP flow level, it is easier to identify abnormal flow patterns and potential security threats. This fine-grained flow analysis and detection capability helps to build a more complete network security system and enhance the anti-attack capability of the entire network. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present application or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0017] Figure 1 A schematic diagram of the structure of a network topology system according to an embodiment of the present application;

[0018] Figure 2A schematic diagram of a flow chart of a resource object dimension traffic analysis method based on a genetic algorithm according to an embodiment of the present application;

[0019] Figure 3 A schematic diagram of a routing matrix according to an embodiment of the present application;

[0020] Figure 4 This is a schematic diagram of the structure of a resource object dimension flow analysis device based on a genetic algorithm according to an embodiment of the present application;

[0021] Figure 5 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0023] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be the usual meanings understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in the embodiments of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0024] As described in the background technology, existing traffic monitoring and analysis methods often have difficulty in accurately inferring traffic information at the IP flow level. In view of this, this application proposes a resource object dimension traffic analysis method based on a genetic algorithm, which can more effectively utilize port traffic information, topology structure, and forwarding routing table data to generate high-resolution business flow-level traffic data, providing a data source for building digital twin networks for various network service models.

[0025] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0026] Figure 1 FIG. 1 is a schematic diagram showing the structure of the network topology system of an embodiment of the present application. Figure 1As shown in the figure, the network topology system includes multiple resource objects, namely Pod1~PodM. Among them, Pod is the smallest resource management component in kubemetes, and Pod is also the resource object that minimizes the running of containerized applications. Each Pod includes a spine switch spine, a top rack switch ToR connected to the spine, and a server connected to the ToR. The spine is connected to each super spine switch logical super spine switch, and the above devices together constitute the network topology system. Figure 1 The number of Pods, spine switches, top rack switches, servers, and super spine switches is for illustrative purposes only and has no limiting effect on the method of the present application.

[0027] Figure 2 The schematic diagram of the flow chart of the resource object dimension traffic analysis method based on genetic algorithm in the embodiment of the present application is shown. The resource object dimension traffic analysis method based on genetic algorithm is applied to a network topology system, the network topology system includes multiple resource objects, any two resource objects are connected in communication, and the method includes the following steps:

[0028] Step 102: Acquire uplink and downlink data packets of each port in the network topology system and a routing matrix in the network topology system.

[0029] Specifically, the uplink and downlink data packets include uplink input traffic and downlink output traffic. The uplink input traffic is recorded as UI, which represents the traffic from the spine switch to the ToR. The downlink output traffic is recorded as UO, which represents the traffic from the ToR to the spine switch. Assuming that the number of resource objects in this embodiment is M, the routing matrix is ​​obtained according to the topology and forwarding routing table. Each row in the routing matrix represents the traffic from or to a Pod. 2 The columns represent the total number of all Pod pairs in the network. Figure 3 A schematic diagram of a routing matrix according to an embodiment of the present application is shown. The number of rows is 2M, including UI 1 ~UI M , UO 1 ~UO M . Figure 1 Each Pod contains two spines. For Pod1, UI 1 Indicates the upstream input traffic from the first spine in Pod1 to all ToRs in Pod1, UO 1 Indicates the upstream output traffic from all ToRs in Pod1 to the first spine in Pod1. UI 2Indicates the upstream input traffic from the second spine in Pod1 to all ToRs in Pod1, UO 2 Indicates the upstream output traffic from all ToRs in Pod1 to the second spine in Pod1. UI 3 Indicates the upstream input traffic from the first spine in Pod1 to all ToRs in Pod2, UO 3 Indicates the upstream outbound traffic from all ToRs in Pod2 to the first spine in Pod1. UI 4 Indicates the upstream input traffic from the second spine in Pod1 to all ToRs in Pod2, UO 4 Represents the upstream outbound traffic from all ToRs in Pod2 to the second spine in Pod1, and so on.

[0030] For Pod2, UI 1 Indicates the upstream input traffic from the first spine in Pod2 to all ToRs in Pod1, UO 1 Indicates the upstream outbound traffic from all ToRs in Pod1 to the first spine in Pod2. UI 2 Indicates the upstream input traffic from the second spine in Pod2 to all ToRs in Pod1, UO 2 Indicates the upstream outbound traffic from all ToRs in Pod1 to the second spine in Pod2. UI 3 Indicates the upstream input traffic from the first spine in Pod2 to all ToRs in Pod2, UO 3 Indicates the upstream outbound traffic from all ToRs in Pod2 to the first spine in Pod2. UI 4 Indicates the upstream input traffic from the second spine in Pod2 to all ToRs in Pod2, UO 4 Represents the upstream outbound traffic from all ToRs in Pod2 to the second spine in Pod2, and so on.

[0031] Routing Matrix In the example, the number of columns is M. 2 , including M groups Pod1 to PodM. Figure 3 In the routing matrix shown, for UI 1 In this row, the value of the Pod1 column corresponding to Pod1 is 1, indicating that the traffic of Pod1 itself passes through UI1. The value of the Pod3 column corresponding to Pod1 is 0, indicating that the traffic from Pod1 to Pod3 does not pass through UI 1 .

[0032] Step 104: Decompose the uplink and downlink data packets to obtain uplink input traffic and uplink output traffic, and determine a real traffic array based on the uplink input traffic and the uplink output traffic.

[0033] Specifically, the uplink and downlink data packets can be decomposed into uplink input traffic and uplink output traffic. The uplink input traffic and uplink output traffic in each Pod constitute a link traffic data Y with a size of 2M. 2M×1 , which is the real traffic array. 2M×1 =[UI 1 +UI 2 , UI 3 +UI 4 , ..., UI 2M-1 +UI 2M , UO 1 +UO 2 , UO 3 +UO 4 , ..., UO 2M-1 +UO 2M ]. For example, when the specific value of M is 60, Y 120×1 =[UI 1 +UI 2 , UI 3 +UI 4 , …, UI1 19 +UI 120 , UO 1 +UO 2 , UO 3 +UO 4 ,…,UO 119 +UO 120 ]=[0.03365 0.03146 ​​0.03355 0.03126 0.00942 … … 0.0155 0.0173 0.01574]. Correspondingly, the routing matrix For example,

[0034] R 120×3600 =[[1.1.1....0.0.0.] [0.0.0....0.0.0.] [0.0.0....0.0.0.] ... [0.0.0....1.0.0.] [0.0.0....0.1.0.]

[0040] [0.0.0....0.0.1.]].

[0041] Step 106: Perform dimensionality reduction processing on the routing matrix to obtain a dimensionality reduction matrix.

[0042] Further, step 106 includes:

[0043] Determining a target dimension according to the number of resource objects;

[0044] Based on the target dimension, randomly selecting columns of target dimension data from the routing matrix and combining them to obtain the dimension reduction matrix; or,

[0045] Based on the target dimension and according to the elephant flow information in the network topology system, columns of target dimension data are randomly selected from the routing matrix and combined to obtain the dimension reduction matrix.

[0046] Specifically, continuing the previous example, the routing matrix R 120×3600 It is a sparse matrix, and the solution of the target traffic matrix calculated based on the sparse matrix is ​​not unique. Therefore, it is necessary to reduce the dimension of the routing matrix so that the routing matrix is ​​transformed from a sparse matrix to a full-rank matrix. When the number of resource objects is M=60, the target dimension is determined to be 2*M=120. 120 columns of data are randomly selected from the routing matrix to obtain a reduced-dimensional matrix. There are two methods for selecting 120 columns of data. First, 120 columns of data are randomly selected from the 3600 columns of data of the routing matrix to obtain a reduced-dimensional matrix. Second, according to the elephant flow information in the network topology system, 120 columns of data are selected from the 3600 columns of data of the routing matrix to obtain a reduced-dimensional matrix. The selected column data is the column data related to the elephant flow. Elephant flow refers to network traffic with a long duration and a large amount of data in the network. The reduced-dimensional matrix obtained by selecting according to the elephant flow information is more accurate. Through the above two methods, the dimensionality reduction processing of the routing matrix is ​​realized to ensure that a unique target traffic matrix is ​​obtained later.

[0047] Step 108: Determine a first traffic matrix through calculation based on the real traffic array and the dimension reduction matrix.

[0048] Specifically, the first flow matrix is ​​determined by the following formula:

[0049] Y=R*X

[0050] Among them, Y is the real traffic array, R represents the dimension reduction matrix, and X represents the IP-level traffic matrix. The first traffic matrix is ​​the IP-level traffic matrix. X = R -1 Y, for example, when M=60,

[0051] Step 110: randomly generate a plurality of load factors, and scale the first traffic matrix based on the plurality of load factors to obtain a plurality of second traffic matrices.

[0052] Furthermore, step 110 includes:

[0053] For each load factor, each value in the first flow matrix is ​​multiplied by the load factor to obtain the second flow matrix.

[0054] Specifically, the number of load factors is the same as the number of samples used in the subsequent genetic algorithm. For example, if the number of samples used in the genetic algorithm is 1000, the number of load factors is 1000. The values ​​of the load factors are randomly generated, and the values ​​of each load factor are different. The value range of the load factor is [0.65, 0.95], so that the value of the scaled second flow matrix fluctuates within a small range. Multiply each load factor by the first flow matrix to obtain the second flow matrix. For example, the load factor is 0.74490, then the corresponding second flow matrix X′ 120×1 =0.74490*X 120×1 =[1.91559013e-02 2.56096404e-03 2.44188571e-03 1.31952891e-02 9.33212167e-03 2.32022605e-02 -1 … … 2.05398076e-02]. After scaling by 1000 load factors, 1000 second flow matrices are formed. Through the load factor introduced in this step, the second flow matrix can be shaped into the initial value of the subsequent genetic algorithm. The initial sample number of the subsequent genetic algorithm is determined by the load factor, which improves the convergence speed of the subsequent genetic algorithm to obtain the optimal solution.

[0055] Step 112: reshape and expand each of the multiple second flow matrices to obtain multiple third flow matrices.

[0056] Further, step 112 includes:

[0057] For each second flow matrix, a logarithmic algorithm is used to determine the total magnitude interval according to the maximum value and the minimum value in the second flow matrix;

[0058] Dividing the total magnitude interval to obtain a plurality of sub-magnitude intervals;

[0059] Using a logarithmic algorithm to process all values ​​in the second flow matrix, and dividing each processed value into a corresponding sub-level interval;

[0060] For each sub-level interval, the first quantity of data to be expanded is determined according to the column information of the numerical value corresponding to the sub-level interval, a first quantity of expanded data is randomly generated, and the first quantity of expanded data is filled into the second traffic matrix to obtain the third traffic matrix; wherein the column information is determined according to the routing matrix, and the numerical value of the expanded data is within the sub-level interval.

[0061] Specifically, before determining the total level interval, the second flow matrix needs to be detected for anomalies, specifically including: detecting whether there are anomalies in the values ​​of each second flow matrix, and if there are anomalies, correcting the abnormal data. In the aforementioned calculation process, the values ​​in the calculated second flow matrix may be negative, and the negative numbers are abnormal values. Correct the abnormal values ​​and set them to 0.

[0062] For each second flow matrix, determine the maximum value max and the minimum value min in the second flow matrix, perform logarithmic processing on the maximum value and the minimum value, and determine the total magnitude interval [logmin, logmax]. Divide the total magnitude interval [logmin, logmax] into multiple sub-magnitude intervals. The number of sub-magnitude intervals can be determined according to actual conditions. For example, the number of sub-magnitude intervals is 10, and the 10 sub-magnitude intervals are specifically recorded as [logmin, a1), [a1, a2) ... [a9, logmax). For each value X in the second flow matrix i Perform logarithmic processing, and according to the result of logarithmic processing Each value X i Divide into corresponding sub-level intervals.

[0063] The first traffic matrix is ​​obtained by operating the real traffic array and the dimension reduction matrix. The first traffic matrix carries the column information in the dimension reduction matrix, that is, it carries the column information in the routing matrix. The second traffic matrix is ​​obtained by scaling the first traffic matrix, so the second traffic matrix also carries the column information in the routing matrix. Each value in the second traffic matrix corresponds to a column in the routing matrix, and therefore has a corresponding column identifier. When the numerical value corresponding to each sub-magnitude interval is expanded, the column identifier of each numerical value is first determined, and then the column difference between the column identifier and the forward column identifier adjacent to the column identifier in the second traffic matrix is ​​determined, and the number of data to be expanded is determined according to the column difference. Exemplarily, if the column identifier of a numerical value in the sub-magnitude interval is 5, it means that the numerical value is associated with the 5th column in the routing matrix. Among the column identifiers corresponding to all numerical values ​​in the second traffic matrix, the column identifier adjacent to the column identifier 5 and less than 5 is determined to be 3, and the column identifier 3 and the column identifier 5 differ by one column. Therefore, the first number of data to be expanded is 1, and 1 expanded data is randomly generated, and the magnitude range of the expanded data is within the sub-magnitude interval. For another example, if the column identifier of a value in the sub-magnitude interval is 200, it means that the value is associated with the 200th column in the routing matrix. Among the column identifiers corresponding to all values ​​in the second traffic matrix, the column identifier 180 that is adjacent to column identifier 200 and less than 200 is determined. The difference between column identifier 180 and column identifier 200 is 19 columns. Therefore, the first number of data that needs to be expanded is 19. 19 expanded data are randomly generated, and the magnitude range of the expanded data is within the sub-magnitude interval. The expanded data is added to the second traffic matrix to obtain the second traffic matrix. Continuing with the above example, the second traffic matrix X′ 120×1 After expansion, the third traffic matrix X′ is obtained 3600×1 =[6.26858961e-04 9.96811741e-05 2.70170781e-04 ... 3.73887484e-04 1.17732451e-041.82967979e-02]. Correspondingly, the number of the second traffic matrix is ​​1000, and the number of the third traffic matrix obtained after expansion is also 1000.

[0064] Step 114: Based on the multiple third traffic matrices, a genetic algorithm is used to determine a target traffic matrix associated with the multiple resource objects.

[0065] Further, step 114 includes:

[0066] Perform multiple rounds of iterative operations, for each round of iterative operations:

[0067] According to the plurality of third flow matrices, a plurality of fourth flow matrices are obtained by adopting a multi-point crossover method;

[0068] generating a matrix set according to a plurality of third flow matrices and a plurality of fourth flow matrices;

[0069] For each matrix in the matrix set, a calculation is performed based on the matrix and the routing matrix to obtain a predicted traffic array;

[0070] Calculate the deviation between the predicted flow array and the actual flow array,

[0071] In response to the fact that the deviations obtained by the iterative calculation in this round do not converge, all the deviations obtained by the iterative calculation are sorted in order from small to large, and the matrices corresponding to the first N deviations in the sequence are used as multiple third flow matrices in the next round of iteration, where N is equal to the number of the multiple third flow matrices;

[0072] In response to the deviation obtained by this round of iterative calculation converging, a matrix corresponding to the minimum deviation obtained by this round of iterative calculation is used as the target flow matrix.

[0073] Specifically, in this embodiment, a genetic algorithm is used to determine the target flow matrix. In specific implementation, a multi-round iteration method is used to determine the target flow matrix. In each round of iterative operation, a selection crossover operation is first performed on multiple third flow matrices, and multiple third flow matrices are combined in pairs to perform multi-point crossover to generate a new flow matrix, that is, the fourth flow matrix. In this embodiment, a multi-point crossover method is selected, and three intersection points are randomly selected for crossover. After the crossover is completed, the fourth flow matrix is ​​obtained. It should be noted that the multi-point crossover method in this embodiment is a conventional method in the genetic algorithm and is not described in detail here. Exemplarily, the number of third flow matrices is 1000. After the crossover operation of this embodiment, 1000 fourth flow matrices are obtained. After merging the third flow matrix with the fourth flow matrix, a matrix set is obtained, and the matrix set contains 2000 matrices.

[0074] In addition, before merging to obtain the matrix set, the fourth flow matrix may be subjected to mutation processing, which specifically includes: randomly generating a mutation amount in a preset numerical interval, and subjecting the fourth flow matrix to mutation processing according to the mutation amount; and combining multiple third flow matrices and multiple fourth flow matrices subjected to mutation processing to obtain a matrix set.

[0075] The preset numerical range in this embodiment may be (-0.001, 0.001), and a variation is randomly generated within the preset numerical range. The variation is added to each value in the fourth flow matrix to obtain a fourth flow matrix after variation processing.

[0076] For each matrix in the matrix set, according to the formula Y′=R*X, each matrix is ​​taken as X, and the routing matrix is ​​taken as R, and a product operation is performed to obtain the predicted traffic array Y′. The deviation between each calculated predicted traffic array Y′ and the actual traffic array Y is calculated. In this embodiment, the deviation between the predicted traffic array Y′ and the actual traffic array Y is determined by calculating the Euclidean norm. The calculation process is expressed by the following formula: Exemplarily, the number of matrices in the matrix set is 2000, so the number of deviations calculated is also 2000. If the 2000 deviations calculated in this round of iterations reach the minimum value and tend to be stable, that is, the deviations calculated in this round of iterations converge, then the matrix corresponding to the minimum deviation calculated in this round of iterations can be used as the target flow matrix. On the contrary, if the deviations calculated in this round of iterations do not converge, it means that the deviations calculated in this round of iterations are not stable and need to be iterated further, then the matrices corresponding to 1000 deviations with smaller deviations are selected from the 2000 deviations as the 1000 third flow matrices required for the next round of iterations. By setting the number of samples of the 1000 third flow matrices, the optimal solution, that is, the target flow matrix, is obtained by iterative calculation.

[0077] In the specific implementation process, multiple groups of samples can be set, such as the first group includes 1000 third flow matrices, the second group includes 2000 third flow matrices, the third group includes 3000 third flow matrices, the fourth group includes 4000 third flow matrices, and the fifth group includes 5000 third flow matrices. Correspondingly, the number of load factors in the above-mentioned embodiment is determined to be 1000, 2000, 3000, 4000, and 5000. After multiple groups of experiments, it is determined that when the number of samples is 5000, the convergence effect of multiple rounds of iterative calculation deviation is the best.

[0078] Based on the above steps 102 to 114, the resource object dimension traffic analysis method based on a genetic algorithm provided in this embodiment is applied to a network topology system, wherein the network topology system includes multiple resource objects, and any two resource objects are connected in communication. The method includes: obtaining uplink and downlink data packets of each port in the network topology system, and a routing matrix in the network topology system, to provide a data basis for subsequent traffic analysis. Decomposing the uplink and downlink data packets to obtain uplink input traffic and uplink output traffic, and determining a real traffic array based on the uplink input traffic and the uplink output traffic. Performing dimensionality reduction processing on the routing matrix to obtain a reduced-dimensional matrix. The routing matrix after dimensionality reduction changes from sparse to full rank, so that the final solved traffic matrix has higher accuracy. According to the real traffic array and the reduced-dimensional matrix, a first traffic matrix is ​​determined through calculation. Multiple load factors are randomly generated, and the first traffic matrix is ​​scaled based on the multiple load factors to obtain multiple second traffic matrices. Each second traffic matrix in the multiple second traffic matrices is shaped and expanded to obtain multiple third traffic matrices. Based on multiple third traffic matrices, a genetic algorithm is used to determine the target traffic matrix related to the multiple resource objects, and the convergence speed of the solution is improved by the genetic algorithm to obtain the optimal solution, that is, the target traffic matrix. The method of the present application can infer the traffic information at the IP level, and can deeply understand the traffic conditions of each network node and port, so as to achieve finer-grained control and optimization of the bandwidth. Based on the obtained IP-level traffic data, the traffic load balance can be adjusted in time to avoid overloading of individual paths, thereby reducing network congestion, improving data transmission efficiency and response speed. Through accurate traffic management methods, network resources can be more reasonably allocated, resources can be allocated on demand, and waste of resources can be reduced, thereby improving the overall performance of the network, especially in a large-scale distributed network environment. After the IP flow level traffic information is known, the network manager can understand the use of resources in more detail. By understanding the traffic pattern of each IP flow, resources can be allocated on demand to reduce the waste of resources. For example, frequently used ports and links can get more bandwidth and computing resources, while idle or low-utilization parts can temporarily reduce resource allocation. Through resource optimization management, network operating costs can be significantly reduced and overall efficiency can be improved. In addition, by deeply analyzing traffic information at the IP flow level, it is easier to identify abnormal traffic patterns and potential security threats. Network attacks often generate abnormal traffic behaviors, such as DDoS attacks and IP spoofing. With the data perspective at the IP flow level, the system can more accurately detect these abnormal behaviors, quickly identify the source and target of malicious traffic, and then take effective security protection measures. This fine-grained traffic analysis and detection capability helps to build a more complete network security system and enhance the anti-attack capabilities of the entire network.

[0079] In some embodiments, the method further includes: shaping the target traffic matrix according to the number of the multiple resource objects.

[0080] Specifically, the target flow matrix obtained by the above embodiment is X 3600×1 , the target traffic matrix is ​​reshaped according to the number of multiple resources to obtain the reshaped target traffic matrix X 60×60 In the target traffic matrix X 60×60 In the example, each row represents a source Pod and each column represents a target Pod. 60×60 The inferred traffic data between any two Pods can be obtained, realizing the inference of IP-level traffic information.

[0081] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the described method.

[0082] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0083] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a resource object dimension traffic analysis device based on genetic algorithm.

[0084] refer to Figure 4 The resource object dimension traffic analysis device based on genetic algorithm is applied to a network topology system, wherein the network topology system includes a plurality of resource objects, and any two resource objects are connected in communication. The device includes:

[0085] The acquisition module 402 is configured to acquire uplink and downlink data packets of each port in the network topology system and a routing matrix in the network topology system;

[0086] The decomposition module 404 is configured to decompose the uplink and downlink data packets to obtain uplink input traffic and uplink output traffic, and determine a real traffic array based on the uplink input traffic and the uplink output traffic;

[0087] A dimension reduction module 406 is configured to perform dimension reduction processing on the routing matrix to obtain a dimension reduction matrix;

[0088] A determination module 408 is configured to determine a first flow matrix through calculation according to the real flow array and the dimension reduction matrix;

[0089] A scaling module 410 is configured to randomly generate a plurality of load factors, and scale the first traffic matrix based on the plurality of load factors to obtain a plurality of second traffic matrices;

[0090] An expansion module 412 is configured to perform shaping and expansion on each of the plurality of second flow matrices to obtain a plurality of third flow matrices;

[0091] The operation module 414 is configured to determine a target flow matrix related to the plurality of resource objects by using a genetic algorithm based on the plurality of third flow matrices.

[0092] In some embodiments, the dimension reduction module 406 is configured to determine the target dimension according to the number of resource objects; based on the target dimension, randomly select target dimension column data from the routing matrix, and combine them to obtain the dimension reduction matrix; or, based on the target dimension, according to the elephant flow information in the network topology system, randomly select target dimension column data from the routing matrix, and combine them to obtain the dimension reduction matrix.

[0093] In some embodiments, the scaling module 410 is configured to perform a product operation on each value in the first traffic matrix and the load factor for each load factor to obtain the second traffic matrix.

[0094] In some embodiments, the expansion module 412 is configured to determine the total magnitude interval using a logarithmic algorithm for each second traffic matrix according to the maximum value and the minimum value in the second traffic matrix;

[0095] Dividing the total magnitude interval to obtain a plurality of sub-magnitude intervals;

[0096] Using a logarithmic algorithm to process all values ​​in the second flow matrix, and dividing each processed value into a corresponding sub-level interval;

[0097] For each sub-level interval, the first quantity of data to be expanded is determined according to the column information of the numerical value corresponding to the sub-level interval, a first quantity of expanded data is randomly generated, and the first quantity of expanded data is filled into the second traffic matrix to obtain the third traffic matrix; wherein the column information is determined according to the routing matrix, and the numerical value of the expanded data is within the sub-level interval.

[0098] In some embodiments, the operation module 414 is configured to perform multiple rounds of iterative operations, and for each round of iterative operations:

[0099] According to the plurality of third flow matrices, a plurality of fourth flow matrices are obtained by adopting a multi-point crossover method;

[0100] generating a matrix set according to a plurality of third flow matrices and a plurality of fourth flow matrices;

[0101] For each matrix in the matrix set, a calculation is performed based on the matrix and the routing matrix to obtain a predicted traffic array;

[0102] Calculate the deviation between the predicted flow array and the actual flow array,

[0103] In response to the fact that the deviations obtained by the iterative calculation in this round do not converge, all the deviations obtained by the iterative calculation are sorted in order from small to large, and the matrices corresponding to the first N deviations in the sequence are used as multiple third flow matrices in the next round of iteration, where N is equal to the number of the multiple third flow matrices;

[0104] In response to the deviation obtained by this round of iterative calculation converging, a matrix corresponding to the minimum deviation obtained by this round of iterative calculation is used as the target flow matrix.

[0105] In some embodiments, the operation module 414 is configured to randomly generate a variation in a preset value interval, and perform variation processing on the fourth flow matrix according to the variation;

[0106] A plurality of third flow matrices and a plurality of fourth flow matrices that have undergone mutation processing are combined to obtain a matrix set.

[0107] In some embodiments, an exception processing module is further included, which is configured to detect whether there is an abnormality in the values ​​in each second flow matrix, and if there is an abnormality, correct the abnormal data.

[0108] In some embodiments, a shaping module is further included, which is configured to shape the target traffic matrix according to the number of the multiple resource objects.

[0109] For the convenience of description, the above device is described in terms of functions divided into various modules. Of course, when implementing the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0110] The device of the above embodiment is used to implement the corresponding resource object dimension traffic analysis method based on genetic algorithm in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0111] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the resource object dimension traffic analysis method based on genetic algorithm described in any of the above embodiments is implemented.

[0112] Figure 5 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0113] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0114] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0115] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0116] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0117] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0118] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0119] The electronic device of the above embodiment is used to implement the corresponding resource object dimension traffic analysis method based on genetic algorithm in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0120] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the genetic algorithm-based resource object dimension traffic analysis method as described in any of the above embodiments.

[0121] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0122] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the resource object dimension traffic analysis method based on genetic algorithm as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0123] Based on the same concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a computer program product, including computer program instructions. When the computer program instructions are run on a computer, the computer executes the method described in any of the above embodiments, which has the beneficial effects of the corresponding method embodiments and will not be repeated here.

[0124] A person skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0125] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power supply / ground connection with the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform to be implemented in the embodiments of the present application (that is, these details should be fully within the scope of understanding of those skilled in the art). In the case of elaborating specific details (e.g., circuits) to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0126] Although the present application has been described in conjunction with specific embodiments of the present application, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0127] The embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the present application. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the protection scope of the present application.

Claims

1. A resource object dimension flow analysis method based on genetic algorithm, characterized in that: Applied to a network topology system, the network topology system includes a plurality of resource objects, any two resource objects are communicatively connected, and the method includes: Acquire uplink and downlink data packets of each port in the network topology system, and a routing matrix in the network topology system; Decomposing the uplink and downlink data packets to obtain uplink input traffic and uplink output traffic, and determining a real traffic array based on the uplink input traffic and the uplink output traffic; Performing dimensionality reduction processing on the routing matrix to obtain a dimensionality reduction matrix; Determine a first flow matrix through calculation according to the real flow array and the dimension reduction matrix; randomly generating a plurality of load factors, and scaling the first traffic matrix based on the plurality of load factors to obtain a plurality of second traffic matrices; Reshaping and expanding each of the plurality of second flow matrices to obtain a plurality of third flow matrices; Based on the plurality of third traffic matrices, a genetic algorithm is used to determine a target traffic matrix associated with the plurality of resource objects.

2. The method according to claim 1, characterized in that The performing dimensionality reduction processing on the routing matrix to obtain a dimensionality reduction matrix includes: Determining a target dimension according to the number of resource objects; Based on the target dimension, randomly selecting columns of target dimension data from the routing matrix and combining them to obtain the dimension reduction matrix; or, Based on the target dimension and according to the elephant flow information in the network topology system, columns of target dimension data are randomly selected from the routing matrix and combined to obtain the dimension reduction matrix.

3. The method according to claim 1, characterized in that The scaling process of the first traffic matrix based on the multiple load factors to obtain multiple second traffic matrices includes: For each load factor, each value in the first flow matrix is ​​multiplied by the load factor to obtain the second flow matrix.

4. The method according to claim 1, characterized in that: The step of shaping and expanding each of the plurality of second flow matrices to obtain a plurality of third flow matrices includes: For each second flow matrix, a logarithmic algorithm is used to determine the total magnitude interval according to the maximum value and the minimum value in the second flow matrix; Dividing the total magnitude interval to obtain a plurality of sub-magnitude intervals; Using a logarithmic algorithm to process all values ​​in the second flow matrix, and dividing each processed value into a corresponding sub-level interval; For each sub-level interval, the first quantity of data to be expanded is determined according to the column information of the numerical value corresponding to the sub-level interval, a first quantity of expanded data is randomly generated, and the first quantity of expanded data is filled into the second traffic matrix to obtain the third traffic matrix; wherein the column information is determined according to the routing matrix, and the numerical value of the expanded data is within the sub-level interval.

5. The method according to claim 1, characterized in that The method of determining a target flow matrix related to the plurality of resource objects by using a genetic algorithm based on the plurality of third flow matrices includes: Perform multiple rounds of iterative operations, for each round of iterative operations: According to the plurality of third flow matrices, a plurality of fourth flow matrices are obtained by adopting a multi-point crossover method; generating a matrix set according to a plurality of third flow matrices and a plurality of fourth flow matrices; For each matrix in the matrix set, performing operations based on the matrix and the routing matrix to obtain a predicted traffic array; Calculate the deviation between the predicted flow array and the actual flow array, In response to the fact that the deviations obtained by the iterative calculation in this round do not converge, all the deviations obtained by the iterative calculation are sorted in order from small to large, and the matrices corresponding to the first N deviations in the sequence are used as multiple third flow matrices in the next round of iteration, where N is equal to the number of the multiple third flow matrices; In response to the deviation obtained by this round of iterative calculation converging, the matrix corresponding to the minimum deviation obtained by this round of iterative calculation is used as the target flow matrix.

6. The method according to claim 5, characterized in that The step of generating a matrix set according to the plurality of third flow matrices and the plurality of fourth flow matrices comprises: Randomly generate a variation in a preset numerical range, and perform variation processing on the fourth flow matrix according to the variation; A plurality of third flow matrices and a plurality of fourth flow matrices that have undergone mutation processing are combined to obtain a matrix set.

7. The method according to claim 4, characterized in that Before determining the total magnitude interval by using a logarithmic algorithm according to the maximum value and the minimum value in the second traffic matrix, the method includes: It is detected whether the values ​​in each second flow matrix are abnormal. If there is an abnormality, the abnormal data is corrected.

8. The method according to claim 1, characterized in that: Also includes: The target traffic matrix is ​​shaped according to the number of the multiple resource objects.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 8 is implemented.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 8.

Images