Network policy optimization method and apparatus, and electronic device

Abstract

The invention relates to the technical field of internet, in particular to a network strategy optimization method and device and electronic equipment, and the method comprises the steps: obtaining a plurality of network strategies, each network strategy comprising a plurality of endpoints and a rule corresponding to each endpoint; for each endpoint included in the plurality of network strategies, obtaining a rule set based on the rules of the endpoint under each network strategy; determining the hit times of the network strategy under the endpoint based on the hit times of each rule in the rule set corresponding to the endpoint; based on the number of hit times of the network strategy under each endpoint, obtaining the total number of hit times of the network strategy, and optimizing the network strategy based on the total number of hit times of the network strategy; according to the method provided by the invention, the actual effect of the network strategy in flow control is represented by counting the total hit times of the network strategy, so that optimization of the network strategy can be realized based on the total hit times of the network strategy.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a network strategy optimization method, device and electronic device. Background Art

[0002] In Internet technology, network traffic is controlled by issuing network policies, which control network traffic communication between endpoints by defining and implementing rules.

[0003] In the related art, the overall network traffic and some basic network performance indicators are monitored through integrated logs, but the actual effect of a certain network strategy in network traffic control cannot be directly obtained through the logs, which is not conducive to adjusting the network strategy by optimizing the strategy. Summary of the invention

[0004] In view of this, the embodiments of the present application propose a network policy optimization method, device and electronic device, which can count the total hit times of multiple network policies, and characterize the actual effect of the network policy in traffic control by the total hit times of the network policy, so that the network policy can be optimized according to the total hit times of the network policy.

[0005] The embodiment of the present application is implemented by adopting the following technical solutions:

[0006] In a first aspect, an embodiment of the present application provides a network policy optimization method, the method comprising: obtaining multiple network policies, each of the network policies including multiple endpoints and rules corresponding to each endpoint; for each endpoint included in the multiple network policies, obtaining a rule set based on the rules corresponding to the endpoint under each of the network policies; determining the number of hits of the network policy under the endpoint based on the number of hits of each rule in the rule set corresponding to the endpoint, wherein if the traffic flowing through the endpoint matches the rule in the rule set corresponding to the endpoint, it is confirmed that the traffic hits the rule; based on the number of hits of the network policy under each of the endpoints, obtaining the total number of hits of the network policy; and optimizing the network policy based on the total number of hits of the network policy.

[0007] In a second aspect, an embodiment of the present application provides a network policy optimization device, which includes: an acquisition module, used to acquire multiple network policies, each of which includes multiple endpoints and rules corresponding to each endpoint; a processing module, used to obtain a rule set for each endpoint included in the multiple network policies based on the rules corresponding to the endpoint under each of the network policies; a statistical module, used to determine the number of hits of the network policy under the endpoint based on the number of hits of each rule in the rule set corresponding to the endpoint, wherein if the traffic flowing through the endpoint matches the rule in the rule set corresponding to the endpoint, it is confirmed that the traffic hits the rule; an output module, used to obtain the total number of hits of the network policy based on the number of hits of the network policy under each of the endpoints; and an optimization module, used to optimize the network policy based on the total number of hits of the network policy.

[0008] In some embodiments, a network policy corresponds to a creation time, and a statistical module is specifically used to determine, for each rule in a rule set corresponding to the endpoint, if the rule corresponds to one network policy, the number of hits of the rule as a reference number of hits of the network policy to which the rule belongs at the endpoint; if the rule corresponds to multiple network policies, the number of hits of the rule as a reference number of hits of the network policy with the earliest creation time among the multiple network policies corresponding to the rule at the endpoint; and the number of hits of the network policy at the endpoint is obtained based on all reference number of hits of the network policy at the endpoint.

[0009] In some embodiments, the network policy optimization device also includes a matching module, which is used to obtain traffic information of the endpoint, where the traffic information of an endpoint is used to describe the traffic flowing through the endpoint; based on the traffic information of the endpoint, determine the amount of traffic that matches each rule in the rule set corresponding to the endpoint; based on the amount of traffic that matches each rule, determine the number of hits for each rule.

[0010] In some embodiments, the acquisition module includes an extraction unit and a parsing unit. The extraction unit is used to obtain multiple initial policy information, each of which includes policy scope information and rule information; the parsing unit is used to parse the policy scope information for each initial policy information to obtain multiple endpoints corresponding to the initial policy information; and parse the rule information to obtain rules corresponding to each endpoint.

[0011] In some implementations, the endpoint corresponds to a label, and the parsing unit is specifically configured to extract a preset label from the policy scope information, and determine the endpoint indicated by the preset label as the endpoint corresponding to the network policy.

[0012] In some embodiments, an endpoint corresponds to at least one port, and the parsing unit is specifically used to determine the traffic direction based on the traffic direction field in the rule information; determine the network protocol type corresponding to the port indicated by the port identifier based on the port identifier in the rule information; determine the rule based on the traffic direction, port identifier and the network protocol type corresponding to the port; determine the endpoint corresponding to the rule based on the scenario type field in the rule information.

[0013] In some embodiments, the scene type field includes one of a label selection field, a namespace field and a network address field, and the endpoint corresponds to a label, a namespace and a network address. The parsing unit is specifically used to, if the scene type field in the rule information is a label selection field, determine the endpoint indicated by the label contained in the label selection field as the endpoint corresponding to the rule; if the scene type field in the rule information is a namespace field, determine the namespace indicated by the namespace field, and determine the endpoint under the namespace as the endpoint corresponding to the rule; if the scene type field in the rule information is a network address field, determine the network address indicated by the network address field, and determine the endpoint deployed by the network address as the endpoint corresponding to the rule.

[0014] In some implementations, the network policy optimization device further includes an update module, and the update module is used to reset the total hit count of the network policy if it is determined that the network policy has been updated.

[0015] In some implementations, the optimization module is specifically used to determine an optimization strategy for the network strategy based on the total hit count of the network strategy; and optimize the network strategy based on the optimization strategy.

[0016] In a third aspect, an embodiment of the present application provides an electronic device, which includes one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the above method.

[0017] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores program code, and the program code can be called by a processor to execute the above method.

[0018] The embodiments of the present application provide a network policy optimization method, device and electronic device, the method comprising obtaining multiple network policies, each network policy including multiple endpoints and rules corresponding to each endpoint; for each endpoint included in the multiple network policies, obtaining a rule set based on the rules corresponding to the endpoint under each network policy; determining the number of hits of the network policy under the endpoint based on the number of hits of each rule in the rule set corresponding to the endpoint, wherein if the traffic flowing through the endpoint matches the rule in the rule set corresponding to the endpoint, it is confirmed that the traffic hits the rule; based on the number of hits of the network policy under each endpoint, obtaining the total number of hits of the network policy, and determining the optimization strategy for optimizing the network policy based on the total number of hits of the network policy; the method provided by the present application determines the endpoint corresponding to the network policy by parsing the network policy, obtains the number of hits of the network policy under each endpoint through the number of hits of each rule corresponding to each endpoint and the network policy corresponding to the rule, and finally, obtains the total number of hits of the network policy based on the number of hits of the network policy under each endpoint, so that the actual effect of the network policy in traffic control can be determined through the total number of hits of the network policy, and then the network policy can be optimized based on the total number of hits of the network policy.

[0019] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 A flow chart of a network strategy optimization method provided in an embodiment of the present application is shown.

[0022] Figure 2 The embodiment of the present application provides Figure 1 Schematic diagram of the process of step S110.

[0023] Figure 3 The embodiment of the present application provides Figure 2 Schematic diagram of the process of step S113.

[0024] Figure 4 The embodiment of the present application provides Figure 1 Schematic diagram of the process of step S130.

[0025] Figure 5 The embodiment of the present application provides Figure 1Schematic diagram of the process of step S150.

[0026] Figure 6 Another flow chart of the network strategy optimization method provided in the embodiment of the present application is shown.

[0027] Figure 7 A schematic diagram of an application scenario involved in an embodiment of the present application is shown.

[0028] Figure 8 A schematic diagram of a network policy optimization device provided in an embodiment of the present application is shown.

[0029] Fig. 9 A schematic diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0030] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limiting the present application.

[0031] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0032] In the following description, the terms "first\second" and the like are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It is understandable that "first\second" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0033] The term "multiple" as used herein refers to two or more than two. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the related objects are in an "or" relationship.

[0034] In Internet technology, administrators control network traffic between endpoints by issuing network policies. Especially after the rapid development of cloud technology, for distributed cluster network environments, it is even more necessary to use multiple network policies to accurately control the traffic between endpoints (that is, pods in the cluster environment).

[0035] In related technologies, integrated logs are used to monitor the overall network traffic and some basic network performance indicators, such as the number of bytes, packet loss rate, etc. However, the actual effect of a certain network strategy in network traffic control cannot be directly derived from the log content, which is not conducive to adjusting the network strategy by optimizing the strategy.

[0036] In order to solve the above problems, the present application proposes a network policy optimization method, device and electronic device, the method comprising: obtaining multiple network policies, each network policy including multiple endpoints and rules corresponding to each endpoint; for each endpoint included in the multiple network policies, obtaining a rule set based on the rules corresponding to the endpoint under each network policy; determining the number of hits of the network policy under the endpoint based on the number of hits of each rule in the rule set corresponding to the endpoint, wherein if the traffic flowing through the endpoint matches the rule in the rule set corresponding to the endpoint, it is confirmed that the traffic hits the rule; based on the number of hits of the network policy under each endpoint, obtaining the total number of hits of the network policy; optimizing the network policy based on the total number of hits of the network policy; the method provided by the present application determines the endpoint corresponding to the network policy by parsing the network policy; obtaining the number of hits of the network policy under each endpoint through the number of hits of each rule corresponding to each endpoint and the network policy corresponding to the rule; finally, obtaining the total number of hits of the network policy based on the number of hits of the network policy under each endpoint, so that the actual effect of the network policy in traffic control can be determined through the total number of hits of the network policy, thereby facilitating the optimization of the network policy based on the total number of hits of the network policy.

[0037] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0038] See also Figure 1 , Figure 1 A flow chart of a network policy optimization method provided in an embodiment of the present application is given. The network policy optimization method includes steps S110-S150:

[0039] S110: Acquire multiple network policies, each network policy including multiple endpoints and rules corresponding to each endpoint.

[0040] Among them, the network policy is pre-configured and defines at least one rule. Each rule determines the traffic that can flow through one or more endpoints, and the one or more endpoints are the endpoints corresponding to the rule. Among them, the endpoint refers to an independent application running instance in the network. Different endpoints can communicate with each other through network traffic, and the network policy defines the rules for endpoints to communicate with each other through network traffic.

[0041] It is worth mentioning that when a rule determines the traffic flowing through a certain endpoint, there are two ways to limit it. One is to limit the traffic allowed to flow through the endpoint, and the other is to limit the traffic prohibited from flowing through the endpoint.

[0042] It should be noted that the endpoints included in a network policy are also the endpoints that need to execute the network policy; of course, an endpoint can also execute multiple network policies; further, the rules corresponding to an endpoint under a network policy can be one or more; the rules corresponding to an endpoint under different network policies can be the same or different.

[0043] In some embodiments, the network policy is also set with priority information. The higher the priority of the network policy, the higher the priority of the rules it contains. When an endpoint executes multiple network policies, the rules in the network policy with a higher priority will be matched first. If the rules in the network policy with a higher priority are successfully matched, the matching of the rules in the subsequent network policies will no longer be executed.

[0044] In some implementations, the policy rules have a standard data structure. Therefore, it is necessary to parse the initial policy information to obtain a network policy with a standard data structure. Figure 2 , Figure 2 The embodiment of the present application provides Figure 1 Schematic diagram of the process of step S110, step S110 includes steps S111-S113:

[0045] S111. Acquire multiple pieces of initial policy information, each piece of initial policy information including policy scope information and rule information.

[0046] The initial policy information is information used to describe the network policy. The initial policy information corresponds to the network policy one by one, that is, parsing one initial policy information can correspond to obtaining one network policy.

[0047] Among them, the policy scope information of the initial policy information describes the scope of endpoints on which the network policy corresponding to the initial policy information can apply; the rule information describes the network communication types allowed and prohibited for each endpoint under the network policy corresponding to the initial policy information, among which the network communication types include specific traffic directions (inflow or outflow), traffic ports, and network protocol types, etc.

[0048] S112: For each initial policy information, parse the policy scope information to obtain multiple endpoints corresponding to the initial policy information.

[0049] In some implementations, the endpoints have labels. Based on this, step S112 may specifically include:

[0050] A preset tag is extracted from the policy scope information, and the endpoint indicated by the preset tag is determined as the endpoint corresponding to the network policy.

[0051] S113: Analyze the rule information to obtain the rules corresponding to each endpoint.

[0052] Among them, the rule information contains multiple fields. Parsing the rule information is to extract the valid fields in the rule information, integrate the valid fields into the standard data structure, and then obtain the rules; valid fields include traffic direction field, endpoint label field, port number field, etc.

[0053] In some implementations, endpoints correspond to ports, based on which, see Figure 3 , Figure 3 The embodiment of the present application provides Figure 2 Schematic diagram of the process of step S113, step S113 includes steps S1131-S1134:

[0054] S1131. Determine the traffic direction based on the traffic direction field in the rule information.

[0055] Among them, for an endpoint, the traffic direction includes inflow and outflow; in a specific embodiment, if the traffic direction field is the ingress field, it means that the traffic direction is inflow, and if the traffic direction field is the egress field, it means that the traffic direction is outflow.

[0056] S1132: Based on the port identifier in the rule information, determine the network protocol type corresponding to the port indicated by the port identifier.

[0057] Among them, the port, also called the logical port, is an interface for communication between endpoints and is used to identify a process or service; different ports are used to distinguish different applications or services; it can be understood that the rules corresponding to different ports of an endpoint can be the same or different.

[0058] Among them, the network protocol type corresponding to the port mainly refers to the third layer (L3) protocol and the fourth layer (L4) protocol corresponding to the port; among them, the third layer (L3) protocol, that is, the network layer protocol, indicates the routing and transmission of the IP address where the port is located; the fourth layer (L4) protocol, that is, the transport layer protocol, such as TCP (Transmission Control Protocol), UDP (User Datagram Protocol), etc.

[0059] It should be noted that the network protocol type corresponding to the port is pre-configured. Therefore, by determining the corresponding port through the port identifier, the network protocol type corresponding to the port can be determined.

[0060] In some implementations, ports of different endpoints may have the same port identifier. On this basis, it is necessary to combine the port identifier and the corresponding endpoint to determine the port indicated by the port identifier, and then determine the network protocol type corresponding to the port.

[0061] S1133. Determine a rule based on the traffic direction, the port identifier, and the network protocol type corresponding to the port.

[0062] Specifically, the traffic direction, port identifier and the network protocol type corresponding to the port are integrated and filled into a predefined standard structure to obtain a rule.

[0063] S1134. Determine the endpoint corresponding to the rule based on the scenario type field in the rule information.

[0064] The scenario type field describes the endpoint range of the rule in different scenarios.

[0065] In some implementations, the scenario type field includes one of a label selection field, a namespace field, and a network address field, and the endpoint corresponds to a label, a namespace, and a network address. On this basis, step S1134 may specifically include:

[0066] Scenario 1: If the scenario type field in the rule information is a label selection field, the endpoint indicated by the label contained in the label selection field is determined as the endpoint corresponding to the rule.

[0067] Scenario 2: If the scenario type field in the rule information is a namespace field, the namespace indicated by the namespace field is determined, and the endpoint under the namespace is determined as the endpoint corresponding to the rule.

[0068] Scenario three: If the scenario type field in the rule information is a network address field, determine the network address indicated by the network address field, and determine the endpoint deployed by the network address as the endpoint corresponding to the rule.

[0069] Among them, the namespace is a mechanism for organizing and isolating codes, allowing different entities with the same name to be used in the same environment without conflict; that is, if two endpoints with the same label are in different namespaces, they actually indicate two different endpoints. In order to distinguish different endpoints with the same label, an endpoint identifier can also be introduced to uniquely identify the endpoint. The endpoint identifier can be obtained by reading the endpoint configuration information.

[0070] The network address field refers to the IP address range, such as the IP Block field in the K8S environment; different IP address mappings have different endpoints.

[0071] For ease of understanding, the preset structure is shown in Table 1 below. After parsing the initial policy information, fill in the corresponding field content into the structure shown in Table 1 below, and you can get a network policy with a structure, including the endpoint's identity, port identifier, network protocol type, and traffic direction identifier, where the endpoint's identity is used to uniquely identify the endpoint.

[0072] The identity of the endpoint Port ID Network protocol type Traffic direction indicator

[0073] Table 1

[0074] S120: For each endpoint included in the plurality of network policies, obtain a rule set based on the rules corresponding to the endpoint under each network policy.

[0075] It should be noted that an endpoint may have the same rules under different network policies. When determining the rule set of the endpoint, only one rule is retained for the same rules of the endpoint under different network policies, but the correspondence between the rule and different network policies needs to be retained.

[0076] In some implementations, the mapping relationship between endpoints and rule sets, as well as the mapping relationship between each rule and network policy can be stored in the form of key-value pairs; as shown in Table 2 below, the key value in the first key-value pair is the identity of the endpoint, and the value value is the nested second key-value pair, the key value of the second key-value pair is the rule, and the value value is the network policy corresponding to the rule.

[0077]

[0078] Table 2

[0079] It can be clearly seen from Table 2 that the rules included in the rule set corresponding to an endpoint include Rule 1 and Rule 2, among which the network policies corresponding to Rule 1 include Network Policy 1 and Network Policy 2, that is, both Network Policy 1 and Network Policy 2 define that the endpoint needs to satisfy Rule 1; the network policies corresponding to Rule 2 include Network Policy 3 and Network Policy 4, that is, both Network Policy 3 and Network Policy 4 define that the endpoint needs to satisfy Rule 2.

[0080] S130. Based on the hit count of each rule in the rule set corresponding to the endpoint, determine the hit count of the network policy under the endpoint, wherein if the traffic flowing through the endpoint matches the rule in the rule set corresponding to the endpoint, it is confirmed that the traffic hits the rule.

[0081] It is understandable that the traffic flowing through an endpoint must be traffic that satisfies a rule in the rule set corresponding to the endpoint; therefore, by determining the specific rules satisfied by the traffic flowing through the endpoint, the amount of traffic that satisfies a certain rule can be obtained, and then the number of times the rule is hit can be determined.

[0082] Meanwhile, in some implementations, based on determining the quantity of traffic satisfying a certain rule, the specific data volume of the traffic satisfying a certain rule can be obtained by counting the number of bytes of each traffic.

[0083] For example, for each rule under an endpoint, by counting the traffic flowing through the endpoint, a key-value pair as shown in Table 3 below can be obtained:

[0084]

[0085] Table 3

[0086] The traffic quantity is the number of hits of the network policy corresponding to the rule at the endpoint, and the traffic data volume is the amount of data of the network policy corresponding to the rule at the endpoint.

[0087] In some implementations, one rule corresponds to one network policy, that is, different network policies contain different rules. On this basis, it is only necessary to add up the number of hits of multiple rules belonging to the same network policy under an endpoint to obtain the number of hits of the network policy under the endpoint.

[0088] In other implementations, a rule may correspond to one or more network policies, that is, different network policies may contain the same rules. On this basis, in order to determine which network policy the number of hits of the rule belongs to, the network policy also corresponds to the creation time. Figure 4 , Figure 4 The embodiment of the present application provides Figure 1 Schematic diagram of the process of step S130, step S130 includes steps S131-S133:

[0089] S131. For each rule in the rule set corresponding to the endpoint, if the rule corresponds to one network policy, determine the hit count of the rule as the reference hit count of the network policy to which the rule belongs under the endpoint.

[0090] It is understandable that if there are multiple rules belonging to the same network policy under one endpoint, there will be multiple reference hit times for the network policy under the endpoint.

[0091] S132: If there are multiple network policies corresponding to the rule, determine the hit count of the rule as the reference hit count of the network policy with the earliest creation time among the multiple network policies corresponding to the rule under the endpoint.

[0092] It is understandable that when there are multiple network policies corresponding to a rule, for other network policies corresponding to the rule whose creation time is not the earliest, the reference hit count is 0.

[0093] S133. Obtain the hit count of the network policy at the endpoint based on all reference hit counts of the network policy at the endpoint.

[0094] Specifically, all reference hit counts of the network policy under the endpoint are accumulated to obtain the hit count of the network policy under the endpoint.

[0095] To facilitate understanding of steps S131-S133, please refer to Table 4. Taking the rules corresponding to endpoint A including Rule 1, Rule 2 and Rule 3 as an example, Rule 1 corresponds to network policy 1 and network policy 2, Rule 2 corresponds to network policy 2 and network policy 3, Rule 3 corresponds to network policy 3, the creation time of network policy 1 is earlier than that of network policy 2, and the creation time of network policy 2 is earlier than that of network policy 3. The corresponding relationship is shown in Table 4 below.

[0096]

[0097] Table 4

[0098] If the hit counts of rule 1, rule 2, and rule 3 under endpoint A are all 5, since rule 1 corresponds to network policy 1 and network policy 2, and network policy 1 was created earlier than network policy 2, then the reference hit count of network policy 1 under the endpoint is 5, and the reference hit count of network policy 2 under the endpoint is 0;

[0099] Since rule 2 corresponds to network policy 1 and network policy 3, and the creation time of network policy 1 is earlier than that of network policy 3, the reference hit count of network policy 1 under the endpoint is 5, and the reference hit count of network policy 3 under the endpoint is 0;

[0100] Since rule 3 only corresponds to network policy 3, the reference hit count of network policy 3 under endpoints is 5;

[0101] In summary, the number of hits of network strategy 1 at endpoint A is 10 (ie, 5+5=10), the number of hits of network strategy 2 at endpoint A is 0, and the number of hits of network strategy 3 at endpoint A is 5.

[0102] S140: Based on the hit counts of the network policy at each endpoint, obtain the total hit counts of the network policy.

[0103] It can be understood that by accumulating the number of hits of the network policy at each endpoint, the total number of hits of the network policy can be obtained.

[0104] In some implementations, after the total number of hits of the network policy is obtained, it can be stored in a key-value pair format, as shown in Table 5 below, where the key value of the key-value pair is the ID of the network policy, and the value is the total number of hits.

[0105] Key Value Policy ID Total hits

[0106] Table 5

[0107] S150: Optimize the network policy based on the total hit count of the network policy.

[0108] In some embodiments, see Figure 5 , Figure 5 The embodiment of the present application provides Figure 1 Schematic diagram of the process of step S150, step S150 includes steps S151-S152:

[0109] S151. Determine an optimization strategy for the network strategy based on the total hit count of the network strategy.

[0110] Among them, the optimization strategy can be an optimization strategy for the network policy itself, such as disabling the network policy, adjusting the priority of the network policy, or it can be an optimization strategy for the endpoints included in the network policy, such as allocating the cache size of the endpoint, adjusting the traffic limit of the endpoint, etc., or it can include both the optimization strategy for the network policy itself and the optimization strategy for the endpoints included in the network policy.

[0111] Exemplarily, when the total hit count of a network policy is low, it means that the actual effect of the network policy is limited. At this time, the optimization strategy may be to disable the network policy to reduce the occupation of network resources; when the total hit count of a network policy is high, it means that the endpoints included in the network policy need to process a large amount of traffic. At this time, the optimization strategy may be to increase the cache capacity of the endpoint corresponding to the network side path to enhance the ability of the endpoint corresponding to the network side path to process a large amount of traffic; when the total hit count of a network policy exceeds a certain security threshold, it means that the endpoints included in the network policy may be attacked by abnormal traffic or the priority of the network policy is too high. At this time, the optimization strategy may be to lower the priority of the network policy, or to increase the traffic limit of the endpoint to avoid system crashes, etc.

[0112] In some implementations, multiple optimization strategies may be pre-set, and each optimization strategy corresponds to a preset number interval; when determining the optimization strategy for the network strategy based on the total number of hits of the network strategy, the preset number interval is specifically determined based on the total number of hits of the network strategy, and the optimization strategy corresponding to the preset number interval is determined as the optimization strategy of the network strategy.

[0113] S152. Optimize the network strategy based on the optimization strategy.

[0114] Through the method provided in the present application, the optimization strategy is determined by the number of hits of the network strategy, so that the determined optimization strategy is more accurate; at the same time, after optimizing the network strategy according to the optimization strategy, the application effect of the network strategy in the system can be improved, and at the same time, the security of the system is guaranteed and the stability of the system operation is improved.

[0115] In other implementations, an optimization function with a network policy may be pre-set, and the total hit count is a parameter of the optimization function. The optimization function can be used to allocate resources required for the network policy, adjust the priority of the network policy, etc.; the network policy is optimized based on the total hit count of the network policy, that is, the total hit count of the network policy is substituted into the optimization function, and the network policy is optimized based on the optimization function, such as adjusting the priority of the network policy, confirming the life cycle of the network policy, etc.

[0116] The method provided in the present application determines the endpoints corresponding to the network policy by parsing the network policy, obtains the hit count of the network policy at each endpoint through the hit counts of each rule corresponding to each endpoint and the network policy corresponding to the rule, and finally, obtains the total hit count of the network policy based on the hit count of the network policy at each endpoint. Thus, the actual effect of the network policy in traffic control can be determined through the total hit count of the network policy, thereby facilitating the optimization of the network policy based on the total hit count of the network policy.

[0117] In some embodiments, see Figure 6 , Figure 6 Another flow chart of the network policy optimization method provided in the embodiment of the present application is provided. Before step S130, the network policy optimization method further includes:

[0118] S210: Obtain traffic information of an endpoint. The traffic information of an endpoint is used to describe the traffic flowing through the endpoint.

[0119] In some implementations, the traffic information of the endpoint may be obtained by monitoring the endpoint in real time, generating a monitoring log by monitoring the endpoint, and then extracting the traffic information from the monitoring log.

[0120] Traffic information may include traffic direction, source endpoint, network address, number of bytes, transmission protocol and other traffic related information; the specific information included can be set according to actual needs.

[0121] S220: Based on the traffic information of the endpoint, determine the amount of traffic that matches each rule in the rule set corresponding to the endpoint.

[0122] It is understandable that the traffic flowing through an endpoint will inevitably match a rule in the rule set corresponding to the endpoint; by analyzing the specific rules matched by each traffic, the number of traffic matched by each rule is obtained.

[0123] In some implementations, for multiple rules corresponding to the same endpoint, it can be a traversal match, that is, a flow needs to match multiple rules corresponding to the endpoint. If a flow matches multiple rules, the number of hits of the multiple rules is increased by 1; it can also be a sequential match, and the order of the rules can be the order of the creation time of the rules; it can also be the priority order of the network policies corresponding to the rules. After a flow matches a certain rule, the number of hits of the rule is increased by 1, and at the same time, the subsequent rules are no longer matched.

[0124] S230: Determine the number of hits for each rule based on the amount of traffic matched by each rule.

[0125] It can be understood that, for a rule in a rule set corresponding to an endpoint, the amount of traffic matched by the rule is the number of hits for the rule.

[0126] In some implementations, considering that the total hit count of the network policy is accumulated, when the network policy is updated, the corresponding total hit count should also be updated accordingly. Therefore, after step S140, the network policy optimization method may further include:

[0127] If it is determined that a network policy has been updated, the total hit count of the network policy is reset.

[0128] In some implementations, determining that a network policy has been updated may be that an administrator manually selects an updated network policy and resets the total hit count of the selected network policy to zero; or after a network policy is updated, the system automatically generates update information, and the update information is used to describe the updated network policy, so that it can be determined based on the update information that a network policy has been updated, and the total hit count of the network policy can be reset.

[0129] In some implementations, the total number of hits of each network strategy at multiple moments can also be recorded, and the neural network model can be trained by the total number of hits of the network measurement at multiple moments, so that the trained neural network model can be used to predict the total number of hits of the network strategy at the next moment. The input of the neural network model is the network strategy and the total number of hits of the network strategy at the current moment, and the output is the total number of hits of the network strategy at the next moment; then, the optimization strategy is determined based on the total number of hits of the network strategy at the next moment, so as to perform early optimization and further improve the optimization effect of the network measurement.

[0130] For easier understanding, see Figure 7 , Figure 7 A schematic diagram of an application scenario involved in an embodiment of the present application is provided, which is applied to a distributed system, wherein a monitoring module, a parsing module, and a serialization module together constitute a monitoring component for executing the network policy optimization method provided by the present application, which is specifically described as follows:

[0131] The configuration module is used to write the initial network policy, which includes the endpoints included in the network policy and the rules corresponding to the endpoints, and configures the initial number of hits of the network policy; as well as write the configuration information of the log module, such as the type of data required to be recorded in the log, the log validity period, etc.

[0132] The log module is used for log monitoring and generating log files. Log files are obtained by log monitoring of the system. The monitoring objects include network events and data flows. Among them, network events refer to specific behaviors or changes occurring at the network level, such as connection attempts, policy decisions, error reports, etc.; data flows refer to the flow of actual data packets transmitted through the network, such as the traffic information of this application.

[0133] The monitoring module is used to monitor system changes through interface services, including changes in network policies, such as updating and deleting network policies, and changes in monitoring endpoints, such as updating, deleting, and adding endpoints.

[0134] The parsing module is used to parse the log data provided by the log module to select the required data from the log data, such as the traffic information in this application; at the same time, read the initial network policy and update the total number of hits of the network policy based on the change data of the network policy and endpoints captured by the monitoring module.

[0135] The serialization module is used to serialize the total hit count of the network policy parsed by the parsing module into data in the target format to facilitate the collector to collect data. After collecting the required data, the collector will store the collected data accordingly and send it to the management personnel.

[0136] In some embodiments, see Figure 8 , Figure 8 A schematic diagram of a network policy optimization device provided in an embodiment of the present application is provided. The network policy optimization device 400 includes:

[0137] The acquisition module 410 is used to acquire multiple network policies, each of which includes multiple endpoints and rules corresponding to each endpoint.

[0138] The processing module 420 is used to obtain a rule set for each endpoint included in the multiple network policies based on the rules corresponding to the endpoint under each network policy.

[0139] The statistical module 430 is used to determine the number of hits of the network policy under the endpoint based on the number of hits of each rule in the rule set corresponding to the endpoint, wherein if the traffic flowing through the endpoint matches the rule in the rule set corresponding to the endpoint, it is confirmed that the traffic hits the rule.

[0140] The output module 440 is used to obtain the total hit count of the network policy based on the hit count of the network policy at each endpoint.

[0141] The optimization module 450 is used to optimize the network policy based on the total hit count of the network policy.

[0142] In some embodiments, a network policy corresponds to a creation time, and the statistical module 430 is specifically used to, for each rule in the rule set corresponding to the endpoint, if the rule corresponds to one network policy, determine the hit count of the rule as the reference hit count of the network policy to which the rule belongs at the endpoint; if the rule corresponds to multiple network policies, determine the hit count of the rule as the reference hit count of the network policy with the earliest creation time among the multiple network policies corresponding to the rule at the endpoint; and obtain the hit count of the network policy at the endpoint based on all reference hit counts of the network policy at the endpoint.

[0143] In some embodiments, the network policy optimization device 400 also includes a matching module, which is used to obtain traffic information of an endpoint, where the traffic information of an endpoint is used to describe the traffic flowing through the endpoint; based on the traffic information of the endpoint, determine the amount of traffic that matches each rule in the rule set corresponding to the endpoint; based on the amount of traffic that matches each rule, determine the number of hits for each rule.

[0144] In some embodiments, the acquisition module 410 includes an extraction unit and a parsing unit. The extraction unit is used to obtain multiple initial policy information, each initial policy information includes policy scope information and rule information; the parsing unit is used to parse the policy scope information for each initial policy information to obtain multiple endpoints corresponding to the initial policy information; and parse the rule information to obtain rules corresponding to each endpoint.

[0145] In some implementations, the endpoint corresponds to a label, and the parsing unit is specifically configured to extract a preset label from the policy scope information, and determine the endpoint indicated by the preset label as the endpoint corresponding to the network policy.

[0146] In some embodiments, an endpoint corresponds to at least one port, and the parsing unit is specifically used to determine the traffic direction based on the traffic direction field in the rule information; determine the network protocol type corresponding to the port indicated by the port identifier based on the port identifier in the rule information; determine the rule based on the traffic direction, port identifier and the network protocol type corresponding to the port; determine the endpoint corresponding to the rule based on the scenario type field in the rule information.

[0147] In some embodiments, the scenario type field includes one of a label selection field, a namespace field, and a network address field, and the endpoint corresponds to a label, a namespace, and a network address. The parsing unit is specifically used to, if the scenario type field in the rule information is a label selection field, determine the endpoint indicated by the label contained in the label selection field as the endpoint corresponding to the rule; if the scenario type field in the rule information is a namespace field, determine the namespace indicated by the namespace field, and determine the endpoint under the namespace as the endpoint corresponding to the rule; if the scenario type field in the rule information is a network address field, determine the network address indicated by the network address field, and determine the endpoint deployed by the network address as the endpoint corresponding to the rule.

[0148] In some implementations, the network policy optimization device 400 further includes an update module, and the update module is used to reset the total hit count of the network policy if it is determined that there is an update to the network policy.

[0149] In some implementations, the optimization module 450 is specifically configured to determine an optimization strategy for the network strategy based on the total hit count of the network strategy; and optimize the network strategy based on the optimization strategy.

[0150] In some implementations, based on the network policy optimization method provided in the above embodiments, the embodiments of the present application also provide an electronic device, such as Fig. 9 , Fig. 9 A structural block diagram of an electronic device provided in an embodiment of the present application is given, where the electronic device 500 includes one or more processors 510; a memory 520; and one or more programs, wherein the one or more programs are stored in the memory 520 and configured to be executed by the one or more processors 510, and the one or more programs are configured to execute the above method.

[0151] The electronic device 500 may be a terminal device, and the terminal device may be a computer, a tablet computer, a vehicle-mounted terminal, etc.

[0152] The processor 510 may include one or more processing cores. The processor 510 uses various interfaces and lines to connect various parts of the entire wearable device, and executes various functions of the wearable device and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 520, and calling data stored in the memory 520. Optionally, the processor 510 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 510 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor, but may be implemented separately through a communication chip.

[0153] The memory 520 may include a random access memory (RAM) or a read-only memory (ROM). The memory 520 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 520 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The data storage area may also store data created by the electronic device during use.

[0154] In some embodiments, the present application further provides a computer-readable storage medium, which stores program code, and the program code can be called by a processor to execute the above method.

[0155] The computer readable storage medium may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer readable storage medium includes a non-transitory computer-readable storage medium. The computer readable storage medium has storage space for program codes that execute any of the method steps in the above method. These program codes may be read from or written to one or more computer program products. The program code may be compressed in an appropriate form.

[0156] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of the overall module or unit of the module or unit function.

[0157] The above are only preferred embodiments of the present application, and are not intended to limit the present application in any form. Although the present application has been disclosed as above with preferred embodiments, it is not intended to limit the present application. Any technical personnel in the field can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present application. However, any brief modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present application without departing from the content of the technical solution of the present application are still within the scope of the technical solution of the present application.

Claims

1. A network strategy optimization method, characterized in that: include: Acquire multiple network policies, each of which includes multiple endpoints and rules corresponding to each endpoint; For each endpoint included in the plurality of network policies, obtaining a rule set based on the rule corresponding to the endpoint under each of the network policies; Based on the hit count of each rule in the rule set corresponding to the endpoint, determine the hit count of the network policy under the endpoint, wherein if the traffic flowing through the endpoint matches the rule in the rule set corresponding to the endpoint, it is confirmed that the traffic hits the rule; Based on the number of hits of the network policy at each of the endpoints, obtaining the total number of hits of the network policy; The network policy is optimized based on the total number of hits of the network policy.

2. The method according to claim 1, characterized in that: The network policy corresponds to a creation time, and the hit count of each rule in the rule set corresponding to the endpoint is determined based on the hit count of each rule in the rule set corresponding to the endpoint. The hit count includes: For each rule in the rule set corresponding to the endpoint, if the network policy corresponding to the rule is one, the hit count of the rule is determined as the reference hit count of the network policy to which the rule belongs under the endpoint; If there are multiple network policies corresponding to the rule, the hit count of the rule is determined as the reference hit count of the network policy with the earliest creation time under the endpoint among the multiple network policies corresponding to the rule; The hit count of the network policy at the endpoint is obtained based on all reference hit counts of the network policy at the endpoint.

3. The method according to claim 1, characterized in that The method includes: determining the number of hits of each rule in the rule set corresponding to the endpoint before the number of hits of each rule in the rule set corresponding to the network policy under the endpoint. Acquire the traffic information of the endpoint, where the traffic information of an endpoint is used to describe the traffic flowing through the endpoint; Based on the traffic information of the endpoint, determine the amount of traffic that matches each rule in the rule set corresponding to the endpoint; Based on the amount of traffic that each rule matches, the hit count for each rule is determined.

4. The method according to claim 1, characterized in that The obtaining of multiple network policies includes: Acquire multiple initial policy information, each of which includes policy scope information and rule information; For each of the initial policy information, the policy scope information is parsed to obtain a plurality of endpoints corresponding to the initial policy information; The rule information is parsed to obtain the rules corresponding to each endpoint.

5. The method according to claim 4, characterized in that The endpoints correspond to labels, and the policy scope information is parsed to determine multiple endpoints corresponding to the network policy, including: A preset tag is extracted from the policy scope information, and an endpoint indicated by the preset tag is determined as an endpoint corresponding to the network policy.

6. The method according to claim 4, characterized in that An endpoint corresponds to at least one port, and the parsing of the rule information to obtain the rules corresponding to each endpoint includes: Determine the traffic direction based on the traffic direction field in the rule information; Based on the port identifier in the rule information, determine the network protocol type corresponding to the port indicated by the port identifier; Determine a rule based on the traffic direction, the port identifier, and the network protocol type corresponding to the port; Based on the scenario type field in the rule information, an endpoint corresponding to the rule is determined.

7. The method according to claim 6, characterized in that The scenario type field includes one of a label selection field, a namespace field, and a network address field, the endpoint corresponds to a label, a namespace, and a network address, and determining the endpoint corresponding to the rule based on the scenario type field in the rule information includes: If the scenario type field in the rule information is a label selection field, determining the endpoint indicated by the label contained in the label selection field as the endpoint corresponding to the rule; If the scenario type field in the rule information is a namespace field, determine the namespace indicated by the namespace field, and determine the endpoint under the namespace as the endpoint corresponding to the rule; If the scenario type field in the rule information is a network address field, the network address indicated by the network address field is determined, and the endpoint deployed by the network address is determined as the endpoint corresponding to the rule.

8. The method according to claim 1, characterized in that: After obtaining the total hit count of the network policy based on the hit count of the network policy at each endpoint, the method further includes: If it is determined that the network policy has been updated, the total hit count of the network policy is reset.

9. The method according to claim 1, characterized in that: The optimizing the network strategy based on the total hit count of the network strategy includes: Determine an optimization strategy for the network strategy based on the total hit count of the network strategy; The network strategy is optimized based on the optimization strategy.

10. A network strategy optimization device, characterized in that: include: An acquisition module, used to acquire a plurality of network policies, each of which includes a plurality of endpoints and rules corresponding to each endpoint; A processing module, configured to obtain, for each endpoint included in the plurality of network policies, a rule set based on a rule corresponding to the endpoint under each of the network policies; A statistical module, used to determine the number of hits of the network policy under the endpoint based on the number of hits of each rule in the rule set corresponding to the endpoint, wherein if the traffic flowing through the endpoint matches a rule in the rule set corresponding to the endpoint, it is confirmed that the traffic hits the rule; An output module, configured to obtain a total hit count of the network policy based on the hit count of the network policy at each of the endpoints; The optimization module is used to optimize the network strategy based on the total hit count of the network strategy.

11. An electronic device, characterized in that: include: one or more processors; Memory; One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method as claimed in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: include: The computer-readable storage medium stores program codes, and the program codes can be called by a processor to execute the method according to any one of claims 1 to 9.

Images