PCDN flow identification method, apparatus and device, and medium

Abstract

The invention discloses a PCDN traffic identification method, apparatus and device, and a medium. The method comprises the steps of periodically obtaining multicast traffic data in a set time period; inputting the multicast traffic data into a trained PCDN traffic identification model for processing to obtain a PCDN traffic probability output by the PCDN traffic identification model; and comparing the PCDN traffic probability with a set probability threshold to obtain a comparison result, and determining whether the multicast traffic data has PCDN traffic within a set time period based on the comparison result. According to the method, the accuracy of PCDN flow identification can be improved, and the efficiency of PCDN flow identification can be improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security, and in particular to a PCDN traffic identification method, apparatus, device, and medium. Background Art

[0002] PCDN (Peer-to-Peer Content Delivery Network) is a content delivery network based on P2P (Peer-to-Peer) technology. Content is transmitted through direct sharing between users instead of through a central server. In PCDN, users can share their bandwidth and storage resources, thereby reducing the burden on the central server and improving content distribution efficiency and reliability. This technology is often used in scenarios such as video streaming, file downloading, and online gaming.

[0003] Currently, PCDN traffic detection methods are mainly based on traditional traffic characteristics or NetFlow (network traffic) analysis. Although these methods can monitor PCDN traffic more comprehensively, they lack accuracy and real-time performance in IPv6 (Internet Protocol Version 6) and multicast environments. Summary of the invention

[0004] The embodiments of the present application provide a PCDN traffic identification method, apparatus, device, and medium to improve the accuracy of PCDN traffic identification and improve the efficiency of PCDN traffic identification.

[0005] In a first aspect, an embodiment of the present application provides a PCDN traffic identification method, including:

[0006] Periodically obtain multicast traffic data within a set time period;

[0007] Inputting the multicast traffic data into a trained PCDN traffic identification model for processing to obtain a PCDN traffic probability output by the PCDN traffic identification model;

[0008] The PCDN traffic probability is compared with a set probability threshold to obtain a comparison result, and based on the comparison result, it is determined whether the multicast traffic data includes PCDN traffic within the set time period.

[0009] In an embodiment of the present application, multicast traffic data within a set time period is periodically obtained, and the multicast traffic data is input into a trained PCDN traffic identification model for processing to obtain a PCDN traffic probability output by the PCDN traffic identification model to characterize the probability that the multicast traffic data has PCDN traffic within the set time period. In addition, the present application compares the PCDN traffic probability with a set probability threshold to obtain a comparison result, and based on the comparison result, it is more accurately determined whether the multicast traffic data has PCDN traffic within the set time period, thereby improving the accuracy of PCDN traffic identification and improving the efficiency of PCDN traffic identification.

[0010] In a possible design, inputting the multicast traffic data into a trained PCDN traffic identification model for processing to obtain a PCDN traffic probability output by the PCDN traffic identification model includes:

[0011] Inputting the multicast traffic data into the feature extraction layer of the PCDN traffic identification model, and extracting traffic feature information of the PCDN traffic through the feature extraction layer;

[0012] The traffic feature information is input into the output layer of the PCDN traffic identification model to determine the PCDN traffic probability of the traffic feature information.

[0013] In an embodiment of the present application, the traffic characteristic information of the multicast traffic data is extracted through the feature extraction layer of the PCDN traffic identification model, and the PCDN traffic probability of the traffic characteristic information is determined through the output layer of the multicast traffic data model to improve the accuracy of the determined PCDN traffic probability.

[0014] In one possible design, determining, based on the comparison result, whether the multicast traffic data includes PCDN traffic within the set time period includes:

[0015] If the comparison result indicates that the PCDN traffic probability is greater than or equal to the set probability threshold, determining that the multicast traffic data has PCDN traffic within the set time period;

[0016] If the comparison result indicates that the PCDN traffic probability is less than the set probability threshold, it is determined that there is no PCDN traffic in the multicast traffic data within the set time period.

[0017] In the embodiment of the present application, based on the size relationship between the PCDN traffic probability and the set probability threshold, it is determined whether there is PCDN traffic in the multicast traffic data within the set time period to improve the accuracy of identifying PCDN traffic.

[0018] In a possible design, the PCDN traffic identification model is trained by the following method:

[0019] Acquire a training data set, wherein the training data set includes a plurality of historical multicast traffic data, each piece of historical multicast traffic data includes historical multicast domain name system mDNS data and a label, and the label is used to characterize whether the historical multicast traffic data includes PCDN traffic;

[0020] Inputting each piece of historical multicast traffic data in the training data set into a preset PCDN traffic identification model respectively, processing the data using the preset PCDN traffic identification model, and training the preset PCDN traffic identification model with the goal of outputting a label of the historical multicast traffic data;

[0021] Until the preset PCDN traffic identification model converges, the PCDN traffic identification model is obtained.

[0022] In an embodiment of the present application, a preset PCDN traffic identification model is trained using a training data set including multiple historical multicast traffic data to obtain a PCDN traffic identification model, thereby improving the recognition accuracy of the PCDN traffic identification model.

[0023] In a possible design, periodically acquiring multicast traffic data within a set time period includes:

[0024] Periodically obtain mDNS data within a set time period;

[0025] Based on the mDNS data, multicast traffic data is determined.

[0026] In an embodiment of the present application, mDNS data within a set time period is periodically acquired, and multicast traffic data is determined based on the mDNS data, thereby more accurately characterizing traffic characteristics in the multicast traffic data.

[0027] In one possible design, determining the multicast traffic data based on the mDNS data includes part or all of the following:

[0028] Determine the multicast address information in the multicast traffic data based on the destination address and the destination port of the mDNS data;

[0029] Determining service record information in the multicast traffic data based on the existence of a specific service record in the mDNS data;

[0030] Determining service information in the multicast traffic data based on a service name of the mDNS data;

[0031] Determine the mDNS service response frequency in the multicast traffic data based on the number of mDNS services in the mDNS data and the set time period;

[0032] Determine the change information of the number of forwarding times in the multicast traffic data based on the number of forwarding times of each data packet in the mDNS data;

[0033] Based on the size of the message in each data packet in the mDNS data, the message information in the multicast traffic data is determined.

[0034] In an embodiment of the present application, multicast traffic data is determined based on mDNS data, wherein the multicast traffic data includes part or all of multicast address information, service record information, service information, mDNS service response frequency, forwarding number change information, and message information, thereby more accurately characterizing the traffic characteristics in the multicast traffic data.

[0035] In a possible design, after periodically acquiring the mDNS data within a set time period, the method further includes:

[0036] Periodically obtain Internet Protocol version 6 IPv6 multicast data within a set time period;

[0037] Determining multicast traffic data based on the mDNS data includes:

[0038] Based on the mDNS data and the IPv6 multicast data, multicast traffic data is determined.

[0039] In an embodiment of the present application, after periodically acquiring mDNS data within a set time period, IPv6 multicast data within a set time period is periodically acquired, and based on the mDNS data and the IPv6 multicast data, the multicast traffic data is determined, thereby ensuring the accuracy and completeness of the multicast traffic data and more accurately characterizing the traffic characteristics in the multicast traffic data.

[0040] In a second aspect, an embodiment of the present application provides a PCDN traffic identification device, including:

[0041] An acquisition module, used to periodically acquire multicast traffic data within a set time period;

[0042] A processing module, configured to input the multicast traffic data into a trained PCDN traffic identification model for processing, and obtain a PCDN traffic probability output by the PCDN traffic identification model;

[0043] The determination module is used to compare the PCDN traffic probability with a set probability threshold to obtain a comparison result, and based on the comparison result, determine whether the multicast traffic data contains PCDN traffic within the set time period.

[0044] In one possible design, the processing module is used to:

[0045] Inputting the multicast traffic data into the feature extraction layer of the PCDN traffic identification model, and extracting traffic feature information of the PCDN traffic through the feature extraction layer;

[0046] The traffic feature information is input into the output layer of the PCDN traffic identification model to determine the PCDN traffic probability of the traffic feature information.

[0047] In one possible design, the determining module is used to:

[0048] If the comparison result indicates that the PCDN traffic probability is greater than or equal to the set probability threshold, determining that the multicast traffic data has PCDN traffic within the set time period;

[0049] If the comparison result indicates that the PCDN traffic probability is less than the set probability threshold, it is determined that there is no PCDN traffic in the multicast traffic data within the set time period.

[0050] In a possible design, the processing module is used to train the PCDN traffic identification model by the following method:

[0051] Acquire a training data set, wherein the training data set includes a plurality of historical multicast traffic data, each piece of historical multicast traffic data includes historical multicast domain name system mDNS data and a label, and the label is used to characterize whether the historical multicast traffic data includes PCDN traffic;

[0052] Inputting each piece of historical multicast traffic data in the training data set into a preset PCDN traffic identification model respectively, processing the data using the preset PCDN traffic identification model, and training the preset PCDN traffic identification model with the goal of outputting a label of the historical multicast traffic data;

[0053] Until the preset PCDN traffic identification model converges, the PCDN traffic identification model is obtained.

[0054] In a possible design, the acquisition module is used to:

[0055] Periodically obtain mDNS data within a set time period;

[0056] Based on the mDNS data, multicast traffic data is determined.

[0057] In one possible design, the acquisition module is used to determine the multicast traffic data based on the mDNS data, including part or all of the following:

[0058] Determine the multicast address information in the multicast traffic data based on the destination address and the destination port of the mDNS data;

[0059] Determining service record information in the multicast traffic data based on the existence of a specific service record in the mDNS data;

[0060] Determining service information in the multicast traffic data based on a service name of the mDNS data;

[0061] Determine the mDNS service response frequency in the multicast traffic data based on the number of mDNS services in the mDNS data and the set time period;

[0062] Determine the change information of the number of forwarding times in the multicast traffic data based on the number of forwarding times of each data packet in the mDNS data;

[0063] Based on the size of the message in each data packet in the mDNS data, the message information in the multicast traffic data is determined.

[0064] In a possible design, after periodically acquiring the mDNS data within a set time period, the acquiring module is further used to:

[0065] Periodically obtain Internet Protocol version 6 IPv6 multicast data within a set time period;

[0066] The acquisition module is used to determine the multicast traffic data based on the mDNS data, including:

[0067] Based on the mDNS data and the IPv6 multicast data, multicast traffic data is determined.

[0068] In a third aspect, the present application provides an electronic device, including:

[0069] A memory for storing program instructions;

[0070] The processor is used to call the program instructions stored in the memory, and execute the steps included in any one of the methods in the first aspect according to the obtained program instructions.

[0071] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes any one of the methods described in the first aspect.

[0072] In a fifth aspect, the present application provides a computer program product, comprising: a computer program code, when the computer program code is run on a computer, the computer executes any one of the methods described in the first aspect.

[0073] The technical effects brought about by the second to fifth aspects and any one of their designs can refer to the technical effects brought about by the corresponding designs in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0075] Figure 2 A flowchart of a PCDN traffic identification method provided in an embodiment of the present application;

[0076] Figure 3 A detailed flow chart of a PCDN traffic identification method provided in an embodiment of the present application;

[0077] Figure 4 A flowchart of a method for obtaining a PCDN traffic probability output by a PCDN traffic identification model provided in an embodiment of the present application;

[0078] Figure 5 A flowchart of a PCDN traffic identification model training method provided in an embodiment of the present application;

[0079] Figure 6 A schematic diagram of the structure of a PCDN traffic identification device provided in an embodiment of the present application;

[0080] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0081] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0082] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0083] In the technical solution of this application, the collection, dissemination, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0084] Before introducing a PCDN traffic identification method provided in an embodiment of the present application, for ease of understanding, the technical background of the embodiment of the present application is first introduced in detail.

[0085] PCDN is a content distribution network based on P2P technology. Content is transmitted through direct sharing between users, rather than through a central server. In PCDN, users can share their bandwidth and storage resources, thereby reducing the burden on the central server and improving content distribution efficiency and reliability. This technology is often used in scenarios such as video streaming, file downloading, and online gaming.

[0086] Currently, PCDN traffic detection methods are mainly based on traditional traffic characteristics or NetFlow analysis. Although these methods can monitor PCDN traffic more comprehensively, they lack accuracy and real-time performance in IPv6 and multicast environments.

[0087] In order to solve the above problems, the present application proposes a PCDN traffic identification method, apparatus, device and medium to improve the accuracy of PCDN traffic identification and improve the efficiency of PCDN traffic identification.

[0088] First reference Figure 1, which is a schematic diagram of the application scenario of the embodiment of the present application, including a collector 11 and a server 12. Among them, the collector 11 and the server 12 are connected to each other through a network, which can be a local area network, a wide area network, etc. The collector 11 is deployed on any edge node in the local area network, and the local area network includes multiple edge nodes. The server 12 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, and big data and artificial intelligence platforms. The collector 11 is used to periodically collect multicast traffic data within a set time period, and send the multicast traffic data to the server 12. The server 12 determines whether there is PCDN traffic in the multicast traffic data within the set time period based on the multicast traffic data within the set time period.

[0089] In an embodiment of the present application, as an optional implementation, the server 12 periodically obtains the multicast traffic data collected by the collector 11 within a set time period; inputs the multicast traffic data into a trained PCDN traffic identification model for processing, and obtains the PCDN traffic probability output by the PCDN traffic identification model; compares the PCDN traffic probability with a set probability threshold to obtain a comparison result, and based on the comparison result, determines whether there is PCDN traffic in the multicast traffic data within the set time period.

[0090] Reference below Figure 2 A flowchart of a PCDN traffic identification method is shown to illustrate the technical solution provided by the embodiment of the present application:

[0091] Step 201: periodically obtain multicast traffic data within a set time period.

[0092] The set time period can be set according to actual conditions. For example, the set time period can be 1 second.

[0093] Step 202: Input the multicast traffic data into the trained PCDN traffic identification model for processing to obtain the PCDN traffic probability output by the PCDN traffic identification model.

[0094] The PCDN traffic identification model is a probabilistic model that can be pre-trained using a machine learning method (such as a supervised learning method). The basic model used to train the PCDN traffic identification model, i.e., the preset PCDN traffic identification model, can be any model with prediction functions, such as a convolutional neural network model, a neural network model, a logistic regression, a random forest, a support vector machine (SVM) and other models.

[0095] Step 203: Compare the PCDN traffic probability with a set probability threshold to obtain a comparison result, and determine whether the multicast traffic data has PCDN traffic within a set time period based on the comparison result.

[0096] The probability threshold may be set according to actual conditions, for example, the probability threshold may be set to 0.8. The PCDN traffic probability represents the probability that PCDN traffic exists in the multicast traffic data within a set time period.

[0097] Optionally, based on the comparison result, determining whether the multicast traffic data includes PCDN traffic within a set time period includes:

[0098] If the comparison result indicates that the PCDN traffic probability is greater than or equal to the set probability threshold, it is determined that the multicast traffic data has PCDN traffic within the set time period;

[0099] If the comparison result indicates that the PCDN traffic probability is less than the set probability threshold, it is determined that there is no PCDN traffic in the multicast traffic data within the set time period.

[0100] In an embodiment of the present application, multicast traffic data within a set time period is periodically obtained, and the multicast traffic data is input into a trained PCDN traffic identification model for processing to obtain a PCDN traffic probability output by the PCDN traffic identification model to characterize the probability that the multicast traffic data has PCDN traffic within the set time period. In addition, the present application compares the PCDN traffic probability with a set probability threshold to obtain a comparison result, and based on the comparison result, it is more accurately determined whether the multicast traffic data has PCDN traffic within the set time period, thereby improving the accuracy of PCDN traffic identification and improving the efficiency of PCDN traffic identification.

[0101] The specific steps of the PCDN traffic identification method provided above are described in detail below. Figure 3 As shown:

[0102] Step 301, periodically obtain multicast traffic data within a set time period.

[0103] The multicast traffic data within the set time period may be mDNS data within the set time period.

[0104] Optionally, periodically obtain multicast traffic data within a set time period, including:

[0105] Periodically obtain mDNS (Multicast Domain Name System) data within a set time period; and determine multicast traffic data based on the mDNS data.

[0106] Among them, mDNS is a protocol based on DNS (Domain Name System), which allows devices to discover each other and services in the local area network through multicast DNS messages. It does not require a traditional DNS server, but directly performs service discovery and name resolution in the local area network.

[0107] mDNS data refers to network traffic data based on UDP (User Datagram Protocol) port 5353, which includes domain name resolution request and response information. mDNS is used for name resolution of devices in the local area network, so it includes the device's service name, IP (Internet Protocol) address, service type, etc.

[0108] In the embodiment of the present application, mDNS data is collected at the cell exit, and the edge node in MEC (Multi-access Edge Computing) is the best location for mDNS data collection, because the edge node can efficiently collect mDNS data across cells and has the ability to analyze in real time. By collecting and processing mDNS data on MEC, not only can PCDN activities be identified in a timely manner, but the results can also be quickly fed back to the core network for response.

[0109] Among them, MEC is an edge computing technology that deploys servers near the base stations of the mobile communication system and migrates computing tasks that originally needed to be completed in the core network or cloud to the edge of the network, thereby reducing signal transmission delay and improving data processing efficiency.

[0110] In an embodiment of the present application, the multicast traffic data includes part or all of the multicast address information, service record information, service information, mDNS service response frequency, forwarding number change information, and message information.

[0111] If the multicast traffic data includes multicast address information, the multicast address information is determined by the following method:

[0112] Based on the destination address and the destination port of the mDNS data, the multicast address information in the multicast traffic data is determined.

[0113] Specifically, the destination address and the destination port of the mDNS data are analyzed to determine whether a multicast address and a multicast port exist. If so, the first mark is used as the multicast address information; if not, the second mark is used as the multicast address information.

[0114] Among them, the multicast address is ff02::fb, the multicast port is udp5353, and the first mark and the second mark can be set according to actual conditions. For example, the first mark can be 1 and the second mark can be 0.

[0115] If the multicast traffic data includes service record information, the service record information is determined by:

[0116] Based on the existence of a specific type of record in the mDNS data, service record information in the multicast traffic data is determined.

[0117] Among them, the specific type of record can be a service (SRV) record or other records. SRV record is a type of record in DNS, which is used to specify the address of the server that provides a specific service. SRV record contains information such as the name, protocol, priority, weight, port and target host name of the service. SRV records (service location records) and A / AAAA records (address records) in mDNS are often used by PCDN to register and distribute service information. These records will contain features such as service name, port number or IP address, which can reflect the activity characteristics of PCDN nodes. By analyzing these specific records, especially their usage frequency, content pattern and other information, the detection system can more accurately identify PCDN traffic.

[0118] Specifically, if the mDNS data has a record of a specific type, the third tag is used as the service record information; if the mDNS data does not have a record of a specific type, the fourth tag is used as the service record information.

[0119] The third mark and the fourth mark can be set according to actual conditions. For example, the third mark can be 1, and the fourth mark can be 0.

[0120] If the multicast traffic data includes service information, the service information is determined by the following method:

[0121] Based on the service name of the mDNS data, service information in the multicast traffic data is determined.

[0122] Specifically, based on the service name of the mDNS data, determine whether there is a service name belonging to a regular service or a service name belonging to a PCDN service in the mDNS data; if so, use the fifth tag as the multicast address information; if not, use the sixth tag as the multicast address information.

[0123] The service name of the conventional service may be http._tcp.local, and the service name of the PCDN service may be hostname.local. The fifth and sixth flags may be set according to actual conditions. For example, the fifth flag may be 1, and the sixth flag may be 0.

[0124] If the multicast traffic data includes the mDNS service response frequency, the mDNS service response frequency is determined by the following method:

[0125] Based on the number of mDNS services in the mDNS data and a set time period, the mDNS service response frequency in the multicast traffic data is determined.

[0126] Specifically, the ratio of the number of mDNS service times to the set time period is used as the mDNS service response frequency.

[0127] The number of mDNS service times refers to the number of times the mDNS node responds to query requests within the LAN, which is used to measure the activeness of the device in participating in domain name resolution. For PCDN, frequent responses may be related to the distribution characteristics of node services.

[0128] In addition to the above mDNS service response frequency, multicast traffic data can also include query records (PCDN may be biased towards specific types), response delays, service name patterns (the service name of PCDN services is usually different from that of ordinary services), and other information.

[0129] If the multicast traffic data includes forwarding times change information, the forwarding times change information is determined by the following method:

[0130] Based on the forwarding times of each data packet in the mDNS data, forwarding times change information in the multicast traffic data is determined.

[0131] The forwarding times (TTL, Time To Live) of each data packet refers to the maximum number of hops that the data packet can be forwarded in a computer network, which is an 8-bit (Binary digit) data in an IP segment. TTL can also be called in network protocols. Its main function is to limit the survival time of a data packet in the network to prevent the data packet from circulating infinitely in the network. For example, if a data packet needs to pass through 2 routers on the entire forwarding path from the source to the destination, the forwarding times of the data packet is 3. The forwarding times change information includes part and all of the forwarding times mean and forwarding times frequency.

[0132] TTL is widely used in network diagnostic tools (such as traceroute) to gradually determine the path and network nodes that a data packet passes through. By observing the changes in TTL, the number of hops that a data packet passes through can be inferred, thereby analyzing the network path.

[0133] Specifically, based on the number of forwarding times of each data packet in the mDNS data and the total number of data packets in the mDNS data, the average number of forwarding times is determined, that is, the ratio of the sum of the number of forwarding times of each data packet in the mDNS data to the total number of data packets in the mDNS data is taken as the average number of forwarding times.

[0134] For example, the mDNS data includes m packets, the number of forwarding times of packet j is bj, and the value range of j is [1, m]. Here, m is an integer greater than 0.

[0135] Specifically, based on the forwarding times of each data packet in the mDNS data, the first number of data packets with abnormal forwarding times is determined, and based on the first number and the total number of data packets in the mDNS data, the forwarding frequency is determined, that is, the ratio of the first number to the total number of data packets in the mDNS data is used as the forwarding frequency.

[0136] If the multicast traffic data includes message information, the message information is determined by the following method:

[0137] Based on the size of the message in each data packet in the mDNS data, the message information in the multicast traffic data is determined.

[0138] The message information includes the mean value of the message size and part or all of the variation of the message size.

[0139] Specifically, based on the size of the message in each data packet in the mDNS data and the total number of messages in the mDNS data, the mean of the message size is determined, that is, the ratio of the sum of the sizes of the messages in each data packet in the mDNS data to the total number of messages in the mDNS data is taken as the mean of the message size.

[0140] For example, mDNS data includes n messages, the size of message i is ai, and the value range of i is [1, n]. The average message size Wherein, n is an integer greater than 0.

[0141] Specifically, based on the size of the message in each data packet in the mDNS data, the maximum value and the minimum value of the message size in the mDNS data are determined, and based on the maximum value of the message size, the minimum value of the message size and the set time period, the change in the message size is determined.

[0142] In the embodiment of the present application, the change in message size R can be determined using the following formula: size :

[0143]

[0144] Among them, S max is the maximum message size in mDNS data, S min It is the minimum message size in mDNS data, and T is the set time period.

[0145] Since some mDNS data may exist in the IPv6 multicast data, after periodically obtaining the mDNS data within a set time period, it also includes: periodically obtaining the IPv6 multicast data within the set time period, and determining the multicast traffic data based on the mDNS data and the IPv6 multicast data to ensure the integrity and accuracy of the multicast traffic data.

[0146] Among them, IPv6 multicast data refers to data packets with a multicast address as the destination address. For example, the IPv6 multicast address of mDNS is ff02::fb. The main function of IPv6 multicast data is to broadcast data to a specified group of devices in the network, rather than unicast or broadcast, to optimize network efficiency.

[0147] Step 302: Input the multicast traffic data into the trained PCDN traffic identification model for processing to obtain the PCDN traffic probability output by the PCDN traffic identification model.

[0148] The PCDN traffic probability output by the PCDN traffic identification model indicates the possibility that a certain observed traffic is judged as PCDN traffic. The observed traffic here mainly includes mDNS data, which is the key basis for PCDN detection. By analyzing the content of mDNS requests and responses (such as service name, query frequency, and other features), the model can capture PCDN-related behavior patterns and calculate the probability of PCDN traffic based on these patterns.

[0149] In the embodiment of the present application, the PCDN traffic identification model can determine the PCDN traffic probability P(PCDN|X) of the multicast traffic data X by the following formula:

[0150]

[0151] Among them, β0 is the bias term (Bias), β1, β2, β3, β4, β5 and β6 are the weights of the PCDN traffic identification model, X1 is the multicast address information, X2 is the service record information, X3 is the service information, X4 is the mDNS service response frequency, X5 is the forwarding number change information, and X6 is the message information.

[0152] The bias term is an additional parameter for each neuron (or the output channel corresponding to the convolution kernel) in the PCDN traffic identification model, which is used to translate or offset the input and thus adjust the output range of the neuron. The bias term can be understood as adding a constant term to the convolution operation, which is usually added after the weighted sum of the convolution operation and before the activation function is applied. By updating the weights and bias terms during the training process, the PCDN traffic identification model can gradually reduce the value of the loss function, thereby improving the accuracy and generalization ability of the model.

[0153] Figure 4 A flowchart of a method for obtaining a PCDN traffic probability output by a PCDN traffic identification model provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, the above step 302 at least includes the following steps 401-402:

[0154] Step 401, input the multicast traffic data into the feature extraction layer of the PCDN traffic identification model, and extract the traffic feature information of the PCDN traffic through the feature extraction layer.

[0155] The PCDN traffic identification model includes an input layer, a feature extraction layer and an output layer. The feature extraction layer may also be called a hidden layer, and the hidden layer may include one or more layers.

[0156] Step 402, input the traffic feature information into the output layer of the PCDN traffic identification model to determine the PCDN traffic probability of the traffic feature information.

[0157] Specifically, the output layer is used to map the traffic feature information output by the hidden layer to the interval [0, 1] using an activation function, thereby obtaining the PCDN traffic probability.

[0158] in, Figure 5 A flowchart of a PCDN traffic identification model training method provided in an embodiment of the present application is shown in FIG. Figure 5 As shown, the PCDN traffic identification model is trained through the following steps 501-503:

[0159] Step 501, obtaining a training data set.

[0160] The training data set includes multiple historical multicast traffic data, each of which includes historical multicast domain name system mDNS data and a label, and the label is used to characterize whether the historical multicast traffic data contains PCDN traffic. Specifically, if the multicast traffic data contains PCDN traffic, the label is marked as the seventh label value, and if the multicast traffic data does not contain PCDN traffic, the label is marked as the eighth label value. The seventh label value and the eighth label value can be set according to actual conditions, for example, the seventh label value is 1 and the eighth label value is 0.

[0161] Step 502, each piece of historical multicast traffic data in the training data set is input into a preset PCDN traffic identification model, and processed by the preset PCDN traffic identification model, so as to train the preset PCDN traffic identification model with the output of the label of the historical multicast traffic data as the goal.

[0162] Step 503: until the preset PCDN traffic identification model converges, a PCDN traffic identification model is obtained.

[0163] During the training process, the historical multicast traffic data in the training data set can be input into the preset PCDN traffic identification model one by one to obtain the detection result output by the preset PCDN traffic identification model (i.e., the PCDN traffic probability corresponding to the historical multicast traffic data). Then, the loss function can be used to determine the loss value between the detection result and the label corresponding to the input historical multicast traffic data. The loss function is a non-negative real-valued function that can be used to characterize the difference between the detection result and the label (true result) corresponding to the input historical multicast traffic data. In general, the smaller the loss value, the better the robustness of the preset PCDN traffic identification model. The loss function can be set according to actual needs. Afterwards, the loss value can be used to update the weight of the preset PCDN traffic identification model. Therefore, each time the historical multicast traffic data is input, the weight of the preset PCDN traffic identification model can be updated based on the loss value corresponding to the historical multicast traffic data until the training is completed. The preset PCDN traffic identification model when the training is completed can be used as the PCDN traffic identification model.

[0164] In the embodiment of the present application, the PCDN traffic identification model is evaluated using a validation set, focusing on key indicators such as accuracy and recall. For scenarios with poor performance, the PCDN traffic identification model is re-optimized or additional feature correction methods are introduced to improve the generalization ability of the PCDN traffic identification model. The validation set includes multiple historical multicast traffic data, each of which includes historical multicast domain name system mDNS data and labels.

[0165] In the embodiments of the present application, the applicability of the PCDN traffic identification model is tested in different simulated network environments, including scenarios such as multicast high load and frequent mDNS queries. At the same time, the response speed and detection efficiency of the PCDN traffic identification model in the actual network are tested to ensure reliability after deployment.

[0166] In an embodiment of the present application, the trained PCDN traffic identification model is deployed to an actual detection environment to replace or run in parallel with the old model to avoid detection blind spots, and a version management system is configured to ensure the traceability and rollback capability of the PCDN traffic identification model.

[0167] Step 303, determining whether the PCDN traffic probability is greater than or equal to a set probability threshold, if so, executing step 304, otherwise executing step 305.

[0168] Step 304: Determine whether the network traffic data contains PCDN traffic within a set time period.

[0169] Taking the setting probability threshold as 0.8 as an example, if the PCDN traffic probability of the multicast traffic data in the set time period is 0.9, and it is determined that the PCDN traffic probability is greater than 0.8, it is determined that the multicast traffic data has PCDN traffic in the set time period.

[0170] In an embodiment of the present application, if it is determined that there is PCDN traffic in the multicast traffic data within a set time period, a detection report is generated so that the user can perform corresponding processing according to the content in the detection report, such as executing processing such as limiting traffic and isolating nodes, thereby providing data support for network management and security policy adjustment.

[0171] Among them, the detection report includes information such as abnormal nodes, traffic information, and identification efficiency.

[0172] Step 305: Determine that there is no PCDN traffic in the multicast traffic data within a set time period.

[0173] Taking the setting probability threshold as 0.8 as an example, if the PCDN traffic probability of the multicast traffic data in the set time period is 0.3, and it is determined that the PCDN traffic probability is less than 0.8, it is determined that there is no PCDN traffic in the multicast traffic data in the set time period.

[0174] Based on the same technical concept, the present application exemplarily provides a PCDN traffic identification device, such as Figure 6 As shown, the device comprises:

[0175] The acquisition module 601 is used to periodically acquire multicast traffic data within a set time period;

[0176] A processing module 602 is used to input the multicast traffic data into a trained PCDN traffic identification model for processing to obtain a PCDN traffic probability output by the PCDN traffic identification model;

[0177] The determination module 603 is used to compare the PCDN traffic probability with a set probability threshold to obtain a comparison result, and based on the comparison result, determine whether the multicast traffic data contains PCDN traffic within the set time period.

[0178] Optionally, the processing module 602 is used to:

[0179] Inputting the multicast traffic data into the feature extraction layer of the PCDN traffic identification model, and extracting traffic feature information of the PCDN traffic through the feature extraction layer;

[0180] The traffic feature information is input into the output layer of the PCDN traffic identification model to determine the PCDN traffic probability of the traffic feature information.

[0181] Optionally, the determining module 603 is used to:

[0182] If the comparison result indicates that the PCDN traffic probability is greater than or equal to the set probability threshold, determining that the multicast traffic data has PCDN traffic within the set time period;

[0183] If the comparison result indicates that the PCDN traffic probability is less than the set probability threshold, it is determined that there is no PCDN traffic in the multicast traffic data within the set time period.

[0184] Optionally, the processing module 602 is used to train the PCDN traffic identification model by the following method:

[0185] Acquire a training data set, wherein the training data set includes a plurality of historical multicast traffic data, each piece of historical multicast traffic data includes historical multicast domain name system mDNS data and a label, and the label is used to characterize whether the historical multicast traffic data includes PCDN traffic;

[0186] Inputting each piece of historical multicast traffic data in the training data set into a preset PCDN traffic identification model respectively, processing the data using the preset PCDN traffic identification model, and training the preset PCDN traffic identification model with the goal of outputting a label of the historical multicast traffic data;

[0187] Until the preset PCDN traffic identification model converges, the PCDN traffic identification model is obtained.

[0188] Optionally, the acquisition module 601 is used to:

[0189] Periodically obtain mDNS data within a set time period;

[0190] Based on the mDNS data, multicast traffic data is determined.

[0191] Optionally, the acquisition module 601 is used to determine multicast traffic data based on the mDNS data, including part or all of the following:

[0192] Determine the multicast address information in the multicast traffic data based on the destination address and the destination port of the mDNS data;

[0193] Determine the service record information in the multicast traffic data based on the existence of the specific service record SRV of the mDNS data;

[0194] Determining service information in the multicast traffic data based on a service name of the mDNS data;

[0195] Determine the mDNS service response frequency in the multicast traffic data based on the number of mDNS services in the mDNS data and the set time period;

[0196] Determine the change information of the number of forwarding times in the multicast traffic data based on the number of forwarding times of each data packet in the mDNS data;

[0197] Based on the size of the message in each data packet in the mDNS data, the message information in the multicast traffic data is determined.

[0198] Optionally, after periodically acquiring the mDNS data within a set time period, the acquiring module 601 is further used to:

[0199] Periodically obtain Internet Protocol version 6 IPv6 multicast data within a set time period;

[0200] The acquisition module is used to determine the multicast traffic data based on the mDNS data, including:

[0201] Based on the mDNS data and the IPv6 multicast data, multicast traffic data is determined.

[0202] Based on the same inventive concept, the present application embodiment provides an electronic device, which can implement the functions of the PCDN traffic identification device discussed above. Please refer to Figure 7 , the device comprises a processor 701 and a memory 702, wherein the memory 702 is used to store program instructions;

[0203] The processor 701 calls the program instructions stored in the memory and executes the program instructions to implement the following steps:

[0204] Periodically obtain multicast traffic data within a set time period;

[0205] Inputting the multicast traffic data into a trained PCDN traffic identification model for processing to obtain a PCDN traffic probability output by the PCDN traffic identification model;

[0206] The PCDN traffic probability is compared with a set probability threshold to obtain a comparison result, and based on the comparison result, it is determined whether the multicast traffic data includes PCDN traffic within the set time period.

[0207] Optionally, the step of inputting the multicast traffic data into a trained PCDN traffic identification model for processing to obtain a PCDN traffic probability output by the PCDN traffic identification model includes:

[0208] Inputting the multicast traffic data into the feature extraction layer of the PCDN traffic identification model, and extracting traffic feature information of the PCDN traffic through the feature extraction layer;

[0209] The traffic feature information is input into the output layer of the PCDN traffic identification model to determine the PCDN traffic probability of the traffic feature information.

[0210] Optionally, the determining, based on the comparison result, whether the multicast traffic data includes PCDN traffic within the set time period includes:

[0211] If the comparison result indicates that the PCDN traffic probability is greater than or equal to the set probability threshold, determining that the multicast traffic data has PCDN traffic within the set time period;

[0212] If the comparison result indicates that the PCDN traffic probability is less than the set probability threshold, it is determined that there is no PCDN traffic in the multicast traffic data within the set time period.

[0213] Optionally, the PCDN traffic identification model is trained by the following method:

[0214] Acquire a training data set, wherein the training data set includes a plurality of historical multicast traffic data, each piece of historical multicast traffic data includes historical multicast domain name system mDNS data and a label, and the label is used to characterize whether the historical multicast traffic data includes PCDN traffic;

[0215] Inputting each piece of historical multicast traffic data in the training data set into a preset PCDN traffic identification model respectively, processing the data using the preset PCDN traffic identification model, and training the preset PCDN traffic identification model with the goal of outputting a label of the historical multicast traffic data;

[0216] Until the preset PCDN traffic identification model converges, the PCDN traffic identification model is obtained.

[0217] Optionally, the periodically acquiring multicast traffic data within a set time period includes:

[0218] Periodically obtain mDNS data within a set time period;

[0219] Based on the mDNS data, multicast traffic data is determined.

[0220] Optionally, the determining the multicast traffic data based on the mDNS data includes part or all of the following:

[0221] Determine the multicast address information in the multicast traffic data based on the destination address and the destination port of the mDNS data;

[0222] Determining service record information in the multicast traffic data based on the existence of a specific service record in the mDNS data;

[0223] Determining service information in the multicast traffic data based on a service name of the mDNS data;

[0224] Determine the mDNS service response frequency in the multicast traffic data based on the number of mDNS services in the mDNS data and the set time period;

[0225] Determine the change information of the number of forwarding times in the multicast traffic data based on the number of forwarding times of each data packet in the mDNS data;

[0226] Based on the size of the message in each data packet in the mDNS data, the message information in the multicast traffic data is determined.

[0227] Optionally, after periodically acquiring the mDNS data within a set time period, the method further includes:

[0228] Periodically obtain Internet Protocol version 6 IPv6 multicast data within a set time period;

[0229] Determining multicast traffic data based on the mDNS data includes:

[0230] Based on the mDNS data and the IPv6 multicast data, multicast traffic data is determined.

[0231] Based on the same inventive concept, the embodiment of the present application provides a computer-readable storage medium, and the computer program product includes: computer program code, when the computer program code is executed on a computer, the computer executes any of the PCDN traffic identification methods discussed above. Since the principle of solving the problem by the above computer-readable storage medium is similar to that of the PCDN traffic identification method, the implementation of the above computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0232] Based on the same inventive concept, the embodiment of the present application also provides a computer program product, which includes: computer program code, when the computer program code is run on a computer, the computer executes any of the PCDN traffic identification methods discussed above. Since the principle of solving the problem by the above computer program product is similar to that of the PCDN traffic identification method, the implementation of the above computer program product can refer to the implementation of the method, and the repeated parts will not be repeated.

[0233] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0234] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0235] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0236] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of user-operated steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0237] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for identifying PCDN traffic in a peer-to-peer content distribution network, characterized in that: include: Periodically obtain multicast traffic data within a set time period; Inputting the multicast traffic data into a trained PCDN traffic identification model for processing to obtain a PCDN traffic probability output by the PCDN traffic identification model; The PCDN traffic probability is compared with a set probability threshold to obtain a comparison result, and based on the comparison result, it is determined whether the multicast traffic data includes PCDN traffic within the set time period.

2. The method according to claim 1, characterized in that The step of inputting the multicast traffic data into a trained PCDN traffic identification model for processing to obtain a PCDN traffic probability output by the PCDN traffic identification model includes: Inputting the multicast traffic data into the feature extraction layer of the PCDN traffic identification model, and extracting traffic feature information of the PCDN traffic through the feature extraction layer; The traffic feature information is input into the output layer of the PCDN traffic identification model to determine the PCDN traffic probability of the traffic feature information.

3. The method according to claim 1, characterized in that The determining, based on the comparison result, whether the multicast traffic data includes PCDN traffic within the set time period includes: If the comparison result indicates that the PCDN traffic probability is greater than or equal to the set probability threshold, determining that the multicast traffic data has PCDN traffic within the set time period; If the comparison result indicates that the PCDN traffic probability is less than the set probability threshold, it is determined that there is no PCDN traffic in the multicast traffic data within the set time period.

4. The method according to claim 1, characterized in that The PCDN traffic identification model is trained by the following method: Acquire a training data set, wherein the training data set includes a plurality of historical multicast traffic data, each piece of historical multicast traffic data includes historical multicast domain name system mDNS data and a label, and the label is used to characterize whether the historical multicast traffic data includes PCDN traffic; Inputting each piece of historical multicast traffic data in the training data set into a preset PCDN traffic identification model respectively, processing the data using the preset PCDN traffic identification model, and training the preset PCDN traffic identification model with the goal of outputting a label of the historical multicast traffic data; Until the preset PCDN traffic identification model converges, the PCDN traffic identification model is obtained.

5. The method according to any one of claims 1 to 4, characterized in that: The periodically acquiring multicast traffic data within a set time period includes: Periodically obtain mDNS data within a set time period; Based on the mDNS data, multicast traffic data is determined.

6. The method according to claim 5, characterized in that The determining of the multicast traffic data based on the mDNS data includes part or all of the following: Determine the multicast address information in the multicast traffic data based on the destination address and the destination port of the mDNS data; Determining service record information in the multicast traffic data based on the existence of a specific service record in the mDNS data; Determining service information in the multicast traffic data based on a service name of the mDNS data; Determine the mDNS service response frequency in the multicast traffic data based on the number of mDNS services in the mDNS data and the set time period; Determine the change information of the number of forwarding times in the multicast traffic data based on the number of forwarding times of each data packet in the mDNS data; Based on the size of the message in each data packet in the mDNS data, the message information in the multicast traffic data is determined.

7. The method according to claim 5, characterized in that After periodically acquiring the mDNS data within the set time period, the method further includes: Periodically obtain Internet Protocol version 6 IPv6 multicast data within a set time period; Determining multicast traffic data based on the mDNS data includes: Based on the mDNS data and the IPv6 multicast data, multicast traffic data is determined.

8. A PCDN traffic identification device, characterized in that: include: An acquisition module, used to periodically acquire multicast traffic data within a set time period; A processing module, configured to input the multicast traffic data into a trained PCDN traffic identification model for processing, and obtain a PCDN traffic probability output by the PCDN traffic identification model; The determination module is used to compare the PCDN traffic probability with a set probability threshold to obtain a comparison result, and based on the comparison result, determine whether the multicast traffic data contains PCDN traffic within the set time period.

9. An electronic device, characterized in that: include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps included in any one of claims 1-7 according to the obtained program instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes the method according to any one of claims 1 to 7.

11. A computer program product, characterized in that The computer program product comprises: a computer program code, and when the computer program code is run on a computer, the computer is enabled to execute the method according to any one of claims 1 to 7.

Images