Network policy optimization method, apparatus and electronic device
By statistically analyzing the total number of hits of network strategies, the problem of being unable to evaluate the actual effectiveness of network strategies in existing technologies is solved, enabling accurate optimization of network strategies and improved system stability.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SANGFOR TECH INC
- Filing Date
- 2024-12-03
- Publication Date
- 2026-05-29
AI Technical Summary
In existing technologies, the actual effectiveness of network policies in network traffic control cannot be directly evaluated through integrated logs, making it difficult to make effective optimizations and adjustments.
By counting the total number of hits of the network strategy, and based on the rule matching situation of each endpoint, the actual effect of the network strategy is determined, and optimization is carried out based on the total number of hits.
It achieves accurate optimization of network policies, improves the actual effectiveness of network policies in traffic control, and ensures the security and stability of the system.
Smart Images
Figure CN119728430B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of Internet technology, specifically to a network strategy optimization method, apparatus, and electronic device. Background Technology
[0002] In internet technology, network traffic is controlled by issuing network policies. Network policies control network traffic communication between endpoints by defining and enforcing rules.
[0003] In related technologies, integrated logs are used to monitor overall network traffic and some basic network performance indicators. However, the actual effect of a certain network policy on network traffic control cannot be directly obtained from the logs, which is not conducive to adjusting the network policy to optimize it. Summary of the Invention
[0004] In view of this, embodiments of this application propose a network policy optimization method, apparatus, and electronic device, which can count the total number of hits of multiple network policies, characterize the actual effect of network policies in traffic control by the total number of hits of network policies, and thus optimize the network policy based on the total number of hits of the network policy.
[0005] The embodiments of this application are implemented using the following technical solutions:
[0006] In a first aspect, embodiments of this application provide a network policy optimization method, the method comprising: acquiring multiple network policies, each network policy including multiple endpoints and rules corresponding to each endpoint; for each endpoint included in the multiple network policies, obtaining a rule set based on the rules corresponding to that endpoint under each network policy; determining the hit count of the network policy under that endpoint based on the hit count of each rule in the rule set corresponding to the endpoint, wherein if traffic flowing through the endpoint matches a rule in the rule set corresponding to that endpoint, then confirming that the traffic hits that rule; obtaining the total hit count of the network policy based on the hit count of the network policy under each endpoint; and optimizing the network policy based on the total hit count of the network policy.
[0007] Secondly, embodiments of this application provide a network policy optimization apparatus, comprising: an acquisition module for acquiring multiple network policies, each network policy including multiple endpoints and rules corresponding to each endpoint; a processing module for obtaining a rule set for each endpoint included in the multiple network policies based on the rules corresponding to that endpoint under each network policy; a statistics module for determining the hit count of the network policy under that endpoint based on the hit count of each rule in the rule set corresponding to that endpoint, wherein if the traffic flowing through the endpoint matches a rule in the rule set corresponding to that endpoint, then the traffic is confirmed to have hit that rule; an output module for obtaining the total hit count of the network policy based on the hit count of the network policy under each endpoint; and an optimization module for optimizing the network policy based on the total hit count of the network policy.
[0008] In some implementations, network policies correspond to creation times. The statistics module is specifically used for each rule in the rule set corresponding to the endpoint. If the rule corresponds to one network policy, the hit count of the rule is determined as the reference hit count of the network policy to which the rule belongs under the endpoint. If the rule corresponds to multiple network policies, the hit count of the rule is determined as the reference hit count of the network policy with the earliest creation time among the multiple network policies corresponding to the rule under the endpoint. The hit count of the network policy under the endpoint is obtained based on all the reference hit counts of the network policy under the endpoint.
[0009] In some implementations, the network policy optimization device further includes a matching module, which is used to acquire traffic information of the endpoint, wherein the traffic information of an endpoint is used to describe the traffic flowing through the endpoint; based on the traffic information of the endpoint, the number of traffic matched by each rule in the rule set corresponding to the endpoint is determined; and based on the number of traffic matched by each rule, the number of hits of each rule is determined.
[0010] In some implementations, the acquisition module includes an extraction unit and a parsing unit. The extraction unit is used to acquire multiple initial policy information, each of which includes policy scope information and rule information. The parsing unit is used to parse the policy scope information for each initial policy information to obtain multiple endpoints corresponding to the initial policy information, and to parse the rule information to obtain the rules corresponding to each endpoint.
[0011] In some implementations, the endpoints are labeled, and the parsing unit is specifically used to extract preset labels from the policy scope information and determine the endpoints indicated by the preset labels as the endpoints corresponding to the network policy.
[0012] In some implementations, an endpoint corresponds to at least one port. The parsing unit is specifically used to determine the traffic direction based on the traffic direction field in the rule information; determine the network protocol type corresponding to the port indicated by the port identifier based on the port identifier in the rule information; determine the rule based on the traffic direction, port identifier and the network protocol type corresponding to the port; and determine the endpoint corresponding to the rule based on the scenario type field in the rule information.
[0013] In some implementations, the scenario type field includes one of a tag selection field, a namespace field, and a network address field. The endpoint corresponds to a tag, a namespace, and a network address. Specifically, the parsing unit is used to determine the endpoint indicated by the tag included in the tag selection field as the endpoint corresponding to the rule if the scenario type field in the rule information is a tag selection field; determine the namespace indicated by the namespace field as the endpoint under the namespace as the endpoint corresponding to the rule if the scenario type field in the rule information is a namespace field; and determine the network address indicated by the network address field as the endpoint deployed at the network address as the endpoint corresponding to the rule if the scenario type field in the rule information is a network address field.
[0014] In some implementations, the network policy optimization apparatus further includes an update module, which is used to reset the total hit count of the network policy if it is determined that the network policy has been updated.
[0015] In some implementations, the optimization module is specifically used to determine an optimization strategy for the network policy based on the total number of hits of the network policy; and to optimize the network policy based on the optimization strategy.
[0016] Thirdly, embodiments of this application provide an electronic device, which includes one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to perform the methods described above.
[0017] Fourthly, embodiments of this application provide a computer-readable storage medium storing program code that can be called by a processor to execute the method described above.
[0018] This application provides a network policy optimization method, apparatus, and electronic device. The method includes acquiring multiple network policies, each network policy including multiple endpoints and rules corresponding to each endpoint; for each endpoint included in the multiple network policies, obtaining a rule set based on the rules corresponding to that endpoint under each network policy; determining the hit count of the network policy under that endpoint based on the hit count of each rule in the rule set corresponding to the endpoint, wherein if the traffic flowing through the endpoint matches a rule in the rule set corresponding to that endpoint, then the traffic is confirmed to have hit that rule; obtaining the total hit count of the network policy based on the hit count of the network policy under each endpoint; and determining an optimization policy for optimizing the network policy based on the total hit count of the network policy. The method provided in this application, by parsing the network policy, determines the endpoints corresponding to the network policy, obtains the hit count of the network policy under each endpoint by using the hit count of each rule corresponding to each endpoint and the network policy corresponding to the rule, and finally obtains the total hit count of the network policy based on the hit count of the network policy under each endpoint. Thus, the actual effect of the network policy in traffic control can be determined by the total hit count of the network policy, and the network policy can be optimized based on the total hit count of the network policy.
[0019] These or other aspects of this application will become more apparent in the following description of the embodiments. Attached Figure Description
[0020] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0021] Figure 1 A flowchart illustrating the network policy optimization method provided in an embodiment of this application is shown.
[0022] Figure 2 The embodiments provided in this application are shown. Figure 1 A flowchart of step S110.
[0023] Figure 3 The embodiments provided in this application are shown. Figure 2 A flowchart of step S113.
[0024] Figure 4 The embodiments provided in this application are shown. Figure 1 A flowchart of step S130.
[0025] Figure 5 The embodiments provided in this application are shown. Figure 1A flowchart of step S150.
[0026] Figure 6 This illustration shows another flowchart of the network policy optimization method provided in an embodiment of this application.
[0027] Figure 7 A schematic diagram of the application scenarios involved in the embodiments of this application is shown.
[0028] Figure 8 A schematic diagram of the network policy optimization device provided in an embodiment of this application is shown.
[0029] Figure 9 A schematic diagram of an electronic device provided in an embodiment of this application is shown. Detailed Implementation
[0030] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application.
[0031] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort are within the scope of protection of the present application.
[0032] In the following description, the terms "first" and "second" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first" and "second" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.
[0033] In this article, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.
[0034] In internet technology, administrators control network traffic between endpoints by issuing network policies. Especially with the rapid development of cloud technology, for distributed cluster network environments, it is even more necessary to use a variety of network policies to precisely control the traffic between endpoints (i.e., pods in the cluster environment).
[0035] In related technologies, integrated logs are used to monitor overall network traffic and some basic network performance indicators, such as byte count and packet loss rate. However, the actual effect of a certain network strategy on network traffic control cannot be directly obtained from the log content, which is not conducive to adjusting the network strategy to optimize it.
[0036] To address the aforementioned issues, this application proposes a network policy optimization method, apparatus, and electronic device. The method includes: acquiring multiple network policies, each network policy including multiple endpoints and rules corresponding to each endpoint; for each endpoint included in the multiple network policies, obtaining a rule set based on the rules corresponding to that endpoint under each network policy; determining the hit count of the network policy under that endpoint based on the hit count of each rule in the rule set corresponding to the endpoint, wherein if the traffic flowing through the endpoint matches a rule in the rule set corresponding to that endpoint, then the traffic is confirmed to have hit that rule; obtaining the total hit count of the network policy based on the hit count of the network policy under each endpoint; and optimizing the network policy based on the total hit count of the network policy. The method provided in this application determines the endpoints corresponding to the network policy by parsing the network policy; obtains the hit count of the network policy under each endpoint by using the hit count of each rule corresponding to each endpoint and the network policy corresponding to the rule; and finally, obtains the total hit count of the network policy based on the hit count of the network policy under each endpoint. Thus, the actual effect of the network policy in traffic control can be determined by the total hit count of the network policy, thereby facilitating the optimization of the network policy based on the total hit count of the network policy.
[0037] The embodiments of this application will now be described in detail with reference to the accompanying drawings.
[0038] Please see Figure 1 , Figure 1 A flowchart illustrating the network policy optimization method provided in this application embodiment is given. The network policy optimization method includes steps S110-S150:
[0039] S110. Obtain multiple network policies, each network policy including multiple endpoints and the rules corresponding to each endpoint.
[0040] The network policy is pre-configured and defines at least one rule. Each rule determines the traffic that can flow through one or more endpoints, which are the endpoints corresponding to that rule. An endpoint refers to an independent application instance running in the network. Different endpoints can communicate with each other through network traffic, and the network policy defines the rules for endpoints to communicate with each other through network traffic.
[0041] It is worth mentioning that when a rule determines the flow through a certain endpoint, it can restrict the flow in two ways: one is to restrict the flow that is allowed to flow through the endpoint, and the other is to restrict the flow that is prohibited from flowing through the endpoint.
[0042] It should be noted that a network policy includes endpoints, which are the endpoints that need to execute the network policy; of course, an endpoint can execute multiple network policies; furthermore, an endpoint can have one or more rules under a network policy; the rules corresponding to an endpoint under different network policies can be the same or different.
[0043] In some implementations, network policies are also configured with priority information. The higher the priority of a network policy, the higher the priority of the rules it contains. When an endpoint executes multiple network policies, the rules in the network policy with the higher priority will be matched first. If the rules in the network policy with the higher priority are successfully matched, the matching of rules in subsequent network policies will not be performed.
[0044] In some implementations, policy rules have standard data structures; therefore, it is necessary to parse the initial policy information to obtain network policies with standard data structures. Please refer to [link to relevant documentation]. Figure 2 , Figure 2 The embodiments provided in this application are given Figure 1 A flowchart of step S110 is shown. Step S110 includes steps S111-S113:
[0045] S111. Obtain multiple initial policy information, each of which includes policy scope information and rule information.
[0046] The initial policy information is used to describe the network policy. There is a one-to-one correspondence between the initial policy information and the network policy, that is, parsing an initial policy information can yield a corresponding network policy.
[0047] The initial policy information describes the range of endpoints that the network policy corresponding to the initial policy information can apply to; the rule information describes the types of network communication that are allowed and prohibited for each endpoint under the network policy corresponding to the initial policy information. The network communication types include specific traffic direction (inflow or outflow), traffic port, and network protocol type.
[0048] S112. For each initial policy information, parse the policy range information to obtain multiple endpoints corresponding to the initial policy information.
[0049] In some implementations, the endpoints correspond to labels. Based on this, step S112 may specifically include:
[0050] Extract preset labels from the policy scope information and determine the endpoints indicated by the preset labels as the endpoints corresponding to the network policy.
[0051] S113. Parse the rule information to obtain the rules corresponding to each endpoint.
[0052] The rule information contains multiple fields. Parsing the rule information involves extracting the valid fields and integrating them into a standard data structure to obtain the rule. Valid fields include traffic direction, endpoint label, and port number.
[0053] In some implementations, the endpoint corresponds to a port; for further details, please refer to [link / reference]. Figure 3 , Figure 3 The embodiments provided in this application are given Figure 2 The flowchart of step S113 is shown below. Step S113 includes steps S1131-S1134:
[0054] S1131. Determine the traffic direction based on the traffic direction field in the rule information.
[0055] For one endpoint, the flow direction includes inflow and outflow. In a specific embodiment, if the flow direction field is the ingress field, it means that the flow direction is inflow; if the flow direction field is the egress field, it means that the flow direction is outflow.
[0056] S1132. Based on the port identifier in the rule information, determine the network protocol type corresponding to the port indicated by the port identifier.
[0057] A port, also called a logical port, is an interface used for communication between endpoints to identify processes or services. Different ports are used to distinguish different applications or services. It can be understood that the rules corresponding to different ports of an endpoint can be the same or different.
[0058] The network protocol type corresponding to the port mainly refers to the Layer 3 (L3) protocol and the Layer 4 (L4) protocol corresponding to the port. The Layer 3 (L3) protocol, namely the network layer protocol, indicates the routing and transmission of the IP address where the port is located. The Layer 4 (L4) protocol, namely the transport layer protocol, such as TCP (Transmission Control Protocol) and UDP (User Datagram Protocol).
[0059] It should be noted that the network protocol type corresponding to the port is pre-configured. Therefore, by identifying the corresponding port through the port identifier, the network protocol type corresponding to the port can be determined.
[0060] In some implementations, ports on different endpoints may have the same port identifier. Based on this, it is necessary to combine the port identifier and the corresponding endpoint to determine the port indicated by the port identifier, and then determine the network protocol type corresponding to the port.
[0061] S1133. Determine the rules based on the traffic direction, port identifier, and the network protocol type corresponding to the port.
[0062] Specifically, the traffic direction, port identifier, and the network protocol type corresponding to the port are integrated and populated into a predefined standard structure to obtain the rules.
[0063] S1134. Based on the scenario type field in the rule information, determine the endpoint corresponding to the rule.
[0064] The scenario type field describes the endpoint range in which the rule applies under different scenarios.
[0065] In some implementations, the scenario type field includes one of a label selection field, a namespace field, and a network address field, and the endpoint corresponds to a label, a namespace, and a network address. Based on this, step S1134 can specifically include:
[0066] Scenario 1: If the scenario type field in the rule information is a label selection field, the endpoints indicated by the labels contained in the label selection field will be determined as the endpoints corresponding to the rule.
[0067] Scenario 2: If the scenario type field in the rule information is a namespace field, determine the namespace indicated by the namespace field, and determine the endpoint under the namespace as the endpoint corresponding to the rule.
[0068] Scenario 3: If the scenario type field in the rule information is a network address field, determine the network address indicated by the network address field, and determine the endpoint deployed at that network address as the endpoint corresponding to the rule.
[0069] Namespaces are a mechanism for organizing and isolating code, allowing different entities with the same name to be used in the same environment without conflict. In other words, if two endpoints with the same label are located in different namespaces, they actually indicate two different endpoints. To distinguish between different endpoints with the same label, an endpoint identifier can be introduced to uniquely identify the endpoint. The endpoint identifier can be obtained by reading the endpoint's configuration information.
[0070] The network address field refers to the range of IP addresses, such as the IP Block field in a Kubernetes environment; different IP addresses are mapped to different endpoints.
[0071] For ease of understanding, the preset structure is shown in Table 1 below. After parsing the initial policy information, the corresponding field content is filled into the structure shown in Table 1 below, and a network policy with a structure can be obtained, including the endpoint identity identifier, port identifier, network protocol type and traffic direction identifier. Among them, the endpoint identity identifier is used to uniquely identify the endpoint.
[0072] Endpoint Identification Port identifier Network protocol types Flow direction indicator
[0073] Table 1
[0074] S120. For each endpoint included in multiple network policies, obtain a rule set based on the rules corresponding to that endpoint under each network policy.
[0075] It should be noted that an endpoint may have the same rules under different network policies. When determining the rule set of an endpoint, for the same rules of the endpoint under different network policies, only one rule should be retained, but the correspondence between the rule and the different network policies should be retained.
[0076] In some implementations, the mapping relationship between endpoints and rule sets, as well as the mapping relationship between each rule and network policy, can be stored in the form of key-value pairs; as shown in Table 2 below, the key value of the first key-value pair is the identity identifier of the endpoint, and the value value is the nested second key-value pair, where the key value of the second key-value pair is the rule, and the value value is the network policy corresponding to the rule.
[0077]
[0078] Table 2
[0079] As can be clearly seen from Table 2, the rule set corresponding to an endpoint contains rule 1 and rule 2. The network policy corresponding to rule 1 includes network policy 1 and network policy 2, that is, both network policy 1 and network policy 2 define that the endpoint must satisfy rule 1. The network policy corresponding to rule 2 includes network policy 3 and network policy 4, that is, both network policy 3 and network policy 4 define that the endpoint must satisfy rule 2.
[0080] S130. Based on the number of hits of each rule in the rule set corresponding to the endpoint, determine the number of hits of the network policy under the endpoint. If the traffic flowing through the endpoint matches a rule in the rule set corresponding to the endpoint, then confirm that the traffic has hit the rule.
[0081] It is understandable that the traffic flowing through an endpoint must satisfy a certain rule in the rule set corresponding to that endpoint; therefore, by determining the specific rule satisfied by the traffic flowing through the endpoint, we can obtain the number of traffic satisfying a certain rule, and thus determine the number of times that rule is hit.
[0082] In addition, in some implementations, based on determining the number of traffic flows that satisfy a certain rule, the specific data volume of traffic flows that satisfy a certain rule can be obtained by counting the number of bytes in each flow.
[0083] For example, for each rule under an endpoint, by statistically analyzing the traffic flowing through that endpoint, the key-value pairs shown in Table 3 below can be obtained:
[0084]
[0085] Table 3
[0086] The number of traffic flows can be used as the number of times the network policy corresponding to the rule is hit at this endpoint, and the amount of traffic data can be used as the amount of data of the network policy corresponding to the rule at this endpoint.
[0087] In some implementations, a rule corresponds to a single network policy, meaning that different network policies contain different rules. Based on this, the hit count of multiple rules belonging to the same network policy under a single endpoint can be accumulated to obtain the hit count of the network policy under that endpoint.
[0088] In other implementations, a rule may correspond to one or more network policies; that is, different network policies may contain the same rules. Furthermore, to determine which network policy a rule's hit count belongs to, the network policy also corresponds to a creation time. Please refer to [link to relevant documentation]. Figure 4 , Figure 4 The embodiments provided in this application are given Figure 1 A flowchart of step S130 is shown. Step S130 includes steps S131-S133:
[0089] S131. For each rule in the rule set corresponding to the endpoint, if the network policy corresponding to the rule is one, the number of hits of the rule is determined as the reference number of hits of the network policy to which the rule belongs under the endpoint.
[0090] It is understandable that if multiple rules belong to the same network policy under one endpoint, then the reference hit count of that network policy under that endpoint will be multiple.
[0091] S132. If there are multiple network policies corresponding to this rule, the hit count of this rule shall be determined as the reference hit count of the network policy with the earliest creation time among the multiple network policies corresponding to this rule under this endpoint.
[0092] It is understandable that when there are multiple network policies corresponding to a rule, the reference hit count for other network policies whose creation time is not the earliest is 0.
[0093] S133. The number of hits of the network policy at this endpoint is obtained based on all reference hit counts of the network policy at this endpoint.
[0094] Specifically, the number of reference hits of the network policy at this endpoint is summed to obtain the number of hits of the network policy at this endpoint.
[0095] To facilitate understanding of steps S131-S133, please refer to Table 4. Taking the rules corresponding to endpoint A as an example, which include rule 1, rule 2 and rule 3, rule 1 corresponds to network policy 1 and network policy 2, rule 2 corresponds to network policy 2 and network policy 3, and rule 3 corresponds to network policy 3. The creation time of network policy 1 is earlier than that of network policy 2, and the creation time of network policy 2 is earlier than that of network policy 3. The correspondence is shown in Table 4 below.
[0096]
[0097] Table 4
[0098] If the number of hits for rules 1, 2, and 3 under endpoint A is 5, since rule 1 corresponds to network policy 1 and network policy 2, and network policy 1 was created earlier than network policy 2, then the reference number of hits for network policy 1 under endpoint A is 5, and the reference number of hits for network policy 2 under endpoint A is 0.
[0099] Since rule 2 corresponds to network policy 1 and network policy 3, and network policy 1 was created earlier than network policy 3, the reference hit count for network policy 1 under the endpoint is 5, while the reference hit count for network policy 3 under the endpoint is 0.
[0100] Since rule 3 only corresponds to network strategy 3, the reference hit count for network strategy 3 at the endpoint is 5.
[0101] In summary, network strategy 1 has a hit count of 10 at endpoint A (i.e., 5 + 5 = 10), network strategy 2 has a hit count of 0 at endpoint A, and network strategy 3 has a hit count of 5 at endpoint A.
[0102] S140. Based on the number of hits of the network policy at each endpoint, obtain the total number of hits of the network policy.
[0103] It is understandable that by summing up the number of hits of the network policy at each endpoint, the total number of hits of the network policy can be obtained.
[0104] In some implementations, after obtaining the total number of hits of the network policy, it can be stored in the form of key-value pairs, as shown in Table 5 below. The key value of the key-value pair is the ID of the network policy, and the value is the total number of hits.
[0105] Key Value Policy ID Total hits
[0106] Table 5
[0107] S150. Optimize the network policy based on the total number of hits.
[0108] In some implementations, please refer to Figure 5 , Figure 5 The embodiments provided in this application are given Figure 1 A flowchart of step S150 is provided. Step S150 includes steps S151-S152:
[0109] S151. Determine the optimization strategy for the network policy based on the total number of hits of the network policy.
[0110] The optimization strategy can be an optimization strategy for the network policy itself, such as disabling the network policy or adjusting the priority of the network policy, or it can be an optimization strategy for the endpoints included in the network policy, such as allocating the cache size of the endpoints or adjusting the traffic limits of the endpoints, or it can include both optimization strategies for the network policy itself and optimization strategies for the endpoints included in the network policy.
[0111] For example, when the total hit count of a network policy is low, it means that the actual effect of the network policy is limited. In this case, the optimization strategy could be to disable the network policy to reduce the consumption of network resources. When the total hit count of a network policy is high, it means that the endpoints included in the network policy need to handle a large amount of traffic. In this case, the optimization strategy could be to increase the cache capacity of the endpoints corresponding to the network side path to enhance the ability of the endpoints corresponding to the network side path to handle a large amount of traffic. When the total hit count of a network policy exceeds a certain security threshold, it means that the endpoints included in the network policy may be attacked by abnormal traffic or that the priority of the network policy is too high. In this case, the optimization strategy could be to reduce the priority of the network policy or increase the traffic limit of the endpoints to avoid system crashes, etc.
[0112] In some implementations, multiple optimization strategies may be preset, each corresponding to a preset number of hits interval. When determining the optimization strategy for a network strategy based on the total number of hits of the network strategy, specifically, the preset number of hits interval to which the network strategy belongs is determined based on the total number of hits of the network strategy, and the optimization strategy corresponding to the preset number of hits interval is determined as the optimization strategy for the network strategy.
[0113] S152. Optimize the network strategy based on the optimization strategy.
[0114] The method provided in this application determines the optimization strategy by the number of times the network policy is hit, making the determined optimization strategy more accurate. At the same time, after optimizing the network policy according to the optimization strategy, the application effect of the network policy in the system can be improved, while ensuring the security of the system and improving the stability of the system operation.
[0115] In other implementations, a pre-set optimization function for the network policy can be used, with the total hit count as a parameter of the optimization function. The optimization function can be used to allocate resources required by the network policy, adjust the priority of the network policy, and so on. The network policy is optimized based on the total hit count, that is, the total hit count of the network policy is substituted into the optimization function, and the network policy is optimized based on the optimization function, such as adjusting the priority of the network policy, determining the life cycle of the network policy, etc.
[0116] The method provided in this application parses the network policy to determine the endpoints corresponding to the network policy. By analyzing the hit count of each rule corresponding to each endpoint and the network policy corresponding to the rule, the hit count of the network policy under each endpoint is obtained. Finally, based on the hit count of the network policy under each endpoint, the total hit count of the network policy is obtained. Thus, the actual effect of the network policy in traffic control can be determined by the total hit count of the network policy, which facilitates the optimization of the network policy based on the total hit count.
[0117] In some implementations, please refer to Figure 6 , Figure 6 Another flowchart of the network policy optimization method provided in this application embodiment is given. Before step S130, the network policy optimization method further includes:
[0118] S210. Obtain the flow information of the endpoint. The flow information of an endpoint is used to describe the flow through that endpoint.
[0119] In some implementations, traffic information of an endpoint can be obtained by real-time monitoring of the endpoint, generating monitoring logs, and then extracting traffic information from the monitoring logs.
[0120] Traffic information can include traffic direction, source endpoint, network address, number of bytes, transmission protocol, and other traffic-related information; the specific information included can be set according to actual needs.
[0121] S220. Based on the traffic information of the endpoint, determine the amount of traffic that matches each rule in the rule set corresponding to the endpoint.
[0122] It is understandable that traffic flowing through an endpoint will inevitably match a rule in the rule set corresponding to that endpoint; by analyzing the specific rule matched by each traffic flow, the number of traffic flows matched by each rule can be obtained.
[0123] In some implementations, for multiple rules corresponding to the same endpoint, it can be traversal matching, that is, a traffic needs to be matched with multiple rules corresponding to the endpoint. If a traffic matches multiple rules, the hit count of each rule is incremented by 1. Alternatively, it can be sequential matching, where the order of the rules can be the order of their creation times or the priority order of the network policies corresponding to the rules. After a traffic matches a certain rule, the hit count of that rule is incremented by 1, and no further matching of subsequent rules is performed.
[0124] S230. Based on the number of traffic matched by each rule, determine the number of hits for each rule.
[0125] It is understandable that the number of traffic matching a rule in the rule set corresponding to an endpoint is the number of times that rule is hit.
[0126] In some implementations, considering that the total hit count of the network policy is accumulated, the corresponding total hit count should also be updated after the network policy is updated. Therefore, after step S140, the network policy optimization method may further include:
[0127] If it is determined that a network policy has been updated, reset the total hit count for that network policy.
[0128] In some implementations, determining that a network policy has been updated can be achieved by the administrator manually selecting the updated network policy and resetting the total hit count of the selected network policy to zero; alternatively, after a network policy is updated, the system can automatically generate update information describing the updated network policy, thereby determining that a network policy has been updated and resetting the total hit count of that network policy.
[0129] In some implementations, the total hit count of each network strategy at multiple time points can be recorded. The neural network model can be trained using the total hit count of the network strategy at multiple time points. The trained neural network model can then be used to predict the total hit count of the network strategy at the next time point. The input of the neural network model is the network strategy and the total hit count of the network strategy at the current time point, and the output is the total hit count of the network strategy at the next time point. Furthermore, the optimization strategy can be determined based on the total hit count of the network strategy at the next time point for early optimization, thereby further improving the optimization effect of the network strategy.
[0130] For easier understanding, please refer to Figure 7 , Figure 7 The application scenario diagram of the embodiments of this application is given, which is applied to a distributed system. The monitoring module, parsing module and serialization module together constitute a monitoring component, which is used to execute the network policy optimization method provided in this application. The specific description is as follows:
[0131] The configuration module is used to write the initial network policy, which includes the endpoints included in the network policy and the rules corresponding to the endpoints, and configures the initial hit count of the network policy; as well as the configuration information for writing the log module, such as the data type to be recorded in the log and the log validity period.
[0132] The logging module is used for log monitoring and generating log files. The log files are obtained by monitoring the system, and the monitored objects include network events and data flows. Among them, network events refer to specific behaviors or changes that occur at the network layer, such as connection attempts, policy decisions, and error reports; data flows refer to the flow of actual data packets transmitted through the network, such as the traffic information in this application.
[0133] The monitoring module is used to monitor changes in the system through interface services, including changes in network policies, such as updates and deletions of network policies, as well as changes in monitoring endpoints, such as updates, deletions, and additions of endpoints.
[0134] The parsing module is used to parse the log data provided by the log module to select the required data from the log data, such as the traffic information in this application; at the same time, it reads the initial network policy and updates the total number of network policy hits based on the network policy and endpoint change data captured by the monitoring module.
[0135] The serialization module is used to serialize the total number of network policy hits parsed by the parsing module into data in the target format, so that the collector can collect data. After collecting the required data, the collector stores the collected data and sends it to the administrator.
[0136] In some implementations, please refer to Figure 8 , Figure 8 A schematic diagram of a network policy optimization device provided in an embodiment of this application is given. The network policy optimization device 400 includes:
[0137] The acquisition module 410 is used to acquire multiple network policies, each of which includes multiple endpoints and the rules corresponding to each endpoint.
[0138] The processing module 420 is used to obtain a rule set for each endpoint included in multiple network policies, based on the rules corresponding to that endpoint under each network policy.
[0139] The statistics module 430 is used to determine the number of times a network policy is hit at a given endpoint based on the number of hits of each rule in the rule set corresponding to that endpoint. If the traffic flowing through the endpoint matches a rule in the rule set corresponding to that endpoint, then the traffic is confirmed to have hit that rule.
[0140] Output module 440 is used to obtain the total number of hits of the network policy based on the number of hits at each endpoint.
[0141] The optimization module 450 is used to optimize the network policy based on the total number of hits of the network policy.
[0142] In some implementations, network policies correspond to creation times. The statistics module 430 is specifically used for each rule in the rule set corresponding to the endpoint. If the rule corresponds to one network policy, the hit count of the rule is determined as the reference hit count of the network policy to which the rule belongs under the endpoint. If the rule corresponds to multiple network policies, the hit count of the rule is determined as the reference hit count of the network policy with the earliest creation time among the multiple network policies corresponding to the rule under the endpoint. The hit count of the network policy under the endpoint is obtained based on all the reference hit counts of the network policy under the endpoint.
[0143] In some implementations, the network policy optimization device 400 further includes a matching module, which is used to acquire traffic information of an endpoint, the traffic information of an endpoint being used to describe the traffic flowing through the endpoint; based on the traffic information of the endpoint, determining the number of traffic matched by each rule in the rule set corresponding to the endpoint; and based on the number of traffic matched by each rule, determining the number of hits for each rule.
[0144] In some implementations, the acquisition module 410 includes an extraction unit and a parsing unit. The extraction unit is used to acquire multiple initial policy information, each initial policy information including policy scope information and rule information. The parsing unit is used to parse the policy scope information for each initial policy information to obtain multiple endpoints corresponding to the initial policy information, and to parse the rule information to obtain the rules corresponding to each endpoint.
[0145] In some implementations, the endpoints are labeled, and the parsing unit is specifically used to extract preset labels from the policy scope information and determine the endpoints indicated by the preset labels as the endpoints corresponding to the network policy.
[0146] In some implementations, an endpoint corresponds to at least one port. The parsing unit is specifically used to determine the traffic direction based on the traffic direction field in the rule information; determine the network protocol type corresponding to the port indicated by the port identifier based on the port identifier in the rule information; determine the rule based on the traffic direction, port identifier and the network protocol type corresponding to the port; and determine the endpoint corresponding to the rule based on the scenario type field in the rule information.
[0147] In some implementations, the scenario type field includes one of a tag selection field, a namespace field, and a network address field. The endpoints correspond to tags, namespaces, and network addresses. Specifically, the parsing unit is used to determine the endpoints indicated by the tags contained in the tag selection field as the endpoints corresponding to the rule if the scenario type field in the rule information is a tag selection field; to determine the namespace indicated by the namespace field as the endpoints under the namespace as the endpoints corresponding to the rule if the scenario type field in the rule information is a namespace field; and to determine the network address indicated by the network address field as the endpoints deployed on the network address as the endpoints corresponding to the rule if the scenario type field in the rule information is a network address field.
[0148] In some embodiments, the network policy optimization device 400 further includes an update module, which is used to reset the total hit count of a network policy if it is determined that a network policy has been updated.
[0149] In some implementations, the optimization module 450 is specifically used to determine an optimization strategy for the network policy based on the total number of hits of the network policy; and to optimize the network policy based on the optimization strategy.
[0150] In some implementations, based on the network policy optimization method provided in the above embodiments, this application also provides an electronic device, such as... Figure 9 , Figure 9 A structural block diagram of an electronic device provided in an embodiment of this application is given. The electronic device 500 includes one or more processors 510; a memory 520; and one or more programs, wherein the one or more programs are stored in the memory 520 and configured to be executed by the one or more processors 510, and the one or more programs are configured to perform the above-described method.
[0151] Among them, electronic device 500 can be a terminal device, which can be a computer, tablet computer, vehicle terminal, etc.
[0152] Processor 510 may include one or more processing cores. Processor 510 connects to various parts of the wearable device using various interfaces and lines, and performs various functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in memory 520, and by calling data stored in memory 520. Optionally, processor 510 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). Processor 510 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and Modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content to be displayed; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the processor and may be implemented separately through a communication chip.
[0153] The memory 520 may include random access memory (RAM) or read-only memory (ROM). The memory 520 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 520 may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as touch functionality, sound playback functionality, image playback functionality, etc.), and instructions for implementing the various method embodiments described below. The data storage area may also store data created during the use of the electronic device.
[0154] In some embodiments, this application also provides a computer-readable storage medium storing program code that can be invoked by a processor to execute the above-described methods.
[0155] Computer-readable storage media can be electronic storage devices such as flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM, hard disk, or ROM. Optionally, computer-readable storage media includes non-transitory computer-readable storage media. The computer-readable storage medium has storage space for program code that performs any of the method steps described above. This program code can be read from or written to one or more computer program products. The program code can be compressed in an appropriate form.
[0156] In the embodiments of this application, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal. It can be implemented wholly or partially using software, hardware (e.g., processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that functions as a whole.
[0157] The above are merely preferred embodiments of this application and are not intended to limit this application in any way. Although this application has disclosed preferred embodiments as above, it is not intended to limit this application. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the technical solution of this application. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of this application without departing from the scope of the technical solution of this application shall still fall within the scope of the technical solution of this application.
Claims
1. A network strategy optimization method, characterized in that, include: Multiple network policies are obtained, each network policy including multiple endpoints and rules corresponding to each endpoint, wherein the endpoints are associated with at least two types of identification information, including labels, namespaces, and network addresses; For each endpoint included in the plurality of network policies, a rule set is obtained based on the rules corresponding to that endpoint under each network policy. The rule set stores the mapping relationship between rules and corresponding network policies in the form of key-value pairs, and retains the many-to-one association between the same rule and different network policies. Based on the number of hits of each rule in the rule set corresponding to the endpoint, the number of hits of the network policy under the endpoint is determined. If the traffic flowing through the endpoint matches a rule in the rule set corresponding to the endpoint, it is confirmed that the traffic has hit the rule. The hit count includes port protocol type verification and traffic direction verification when the traffic matches. The total number of hits of the network strategy is obtained based on the number of hits of the network strategy at each endpoint; The network strategy is optimized based on the total number of hits.
2. The method according to claim 1, characterized in that, The network policy corresponds to a creation time. Determining the hit count of each rule in the rule set corresponding to the endpoint under that endpoint, based on the hit count of each rule in the rule set, includes: For each rule in the rule set corresponding to the endpoint, if the network policy corresponding to the rule is one, the number of hits of the rule is determined as the reference number of hits of the network policy to which the rule belongs under the endpoint; If there are multiple network policies corresponding to this rule, the hit count of this rule is determined as the reference hit count of the network policy with the earliest creation time among the multiple network policies corresponding to this rule under this endpoint; The hit count of the network policy at this endpoint is obtained based on all reference hit counts of the network policy at this endpoint.
3. The method according to claim 1, characterized in that, Before determining the hit count of each rule in the rule set corresponding to the endpoint at that endpoint based on the hit count of each rule in the rule set, the method includes: Obtain the flow information of the endpoint, whereby the flow information of an endpoint is used to describe the flow through that endpoint; Based on the traffic information of the endpoint, determine the number of traffic matching each rule in the rule set corresponding to the endpoint; The number of times each rule is matched is determined based on the number of traffic matches for each rule.
4. The method according to claim 1, characterized in that, The acquisition of multiple network policies includes: Obtain multiple initial policy information, each of which includes policy scope information and rule information; For each of the initial policy information, the policy range information is parsed to obtain multiple endpoints corresponding to the initial policy information; The rule information is parsed to obtain the rules corresponding to each endpoint.
5. The method according to claim 4, characterized in that, The endpoints are labeled, and the process of parsing the policy scope information to determine multiple endpoints corresponding to the network policy includes: Extract preset tags from the policy scope information, and determine the endpoints indicated by the preset tags as the endpoints corresponding to the network policy.
6. The method according to claim 4, characterized in that, An endpoint corresponds to at least one port. Parsing the rule information to obtain the rules corresponding to each endpoint includes: The traffic direction is determined based on the traffic direction field in the rule information; Based on the port identifier in the rule information, determine the network protocol type corresponding to the port indicated by the port identifier; Based on the traffic direction, port identifier, and the network protocol type corresponding to the port, the rules are determined; Based on the scenario type field in the rule information, the endpoint corresponding to the rule is determined.
7. The method according to claim 6, characterized in that, The scenario type field includes one of a tag selection field, a namespace field, and a network address field. The endpoint corresponds to a tag, a namespace, and a network address. Determining the endpoint corresponding to the rule based on the scenario type field in the rule information includes: If the scenario type field in the rule information is a label selection field, the endpoint indicated by the label contained in the label selection field is determined as the endpoint corresponding to the rule; If the scenario type field in the rule information is a namespace field, determine the namespace indicated by the namespace field, and determine the endpoint under the namespace as the endpoint corresponding to the rule; If the scenario type field in the rule information is a network address field, determine the network address indicated by the network address field, and determine the endpoint deployed at that network address as the endpoint corresponding to the rule.
8. The method according to claim 1, characterized in that, After obtaining the total hit count of the network policy based on the hit count of the network policy at each of the endpoints, the method further includes: If it is determined that the network policy has been updated, the total hit count of the network policy is reset.
9. The method according to claim 1, characterized in that, The optimization of the network policy based on the total number of hits includes: The optimization strategy for the network strategy is determined based on the total number of hits of the network strategy. The network strategy is optimized based on the optimization strategy.
10. A network policy optimization device, characterized in that, include: The acquisition module is used to acquire multiple network policies, each of which includes multiple endpoints and rules corresponding to each endpoint, and the endpoints are associated with at least two types of identification information, including labels, namespaces, and network addresses. The processing module is used to obtain a rule set for each endpoint included in the plurality of network policies based on the rules corresponding to the endpoint under each network policy. The rule set stores the mapping relationship between rules and corresponding network policies in the form of key-value pairs, and retains the many-to-one association between the same rule and different network policies. The statistics module is used to determine the number of times the network policy is hit under the endpoint based on the number of hits of each rule in the rule set corresponding to the endpoint. If the traffic flowing through the endpoint matches a rule in the rule set corresponding to the endpoint, it is confirmed that the traffic hits the rule. The hit count statistics include port protocol type verification and traffic direction verification when the traffic matches. The output module is used to obtain the total number of hits of the network policy based on the number of hits of the network policy at each of the endpoints; An optimization module is used to optimize the network policy based on the total number of hits of the network policy.
11. An electronic device, characterized in that, include: One or more processors; Memory; One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs being configured to perform the method as claimed in any one of claims 1-9.
12. A computer-readable storage medium, characterized in that, include: The computer-readable storage medium stores program code that can be invoked by a processor to perform the method as claimed in any one of claims 1-9.