Traffic classification method and device, electronic equipment and storage medium

Abstract

The invention provides a traffic classification method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring multiple types of traffic data to be classified and traffic information of the traffic data; performing feature extraction on the flow data to obtain feature data with a unified mode; generating time sequence flow fingerprint features according to the feature data and the flow information; the time sequence flow fingerprint features are input into a flow classification model to obtain a classification result of the flow data, the flow classification model is obtained after a first model is trained according to label data corresponding to the classification task, and the first model is used for learning the time sequence flow fingerprint features of various types of flow data to obtain a flow data classification result; and obtaining a feature relationship between the traffic data. The traffic classification can be performed according to the time sequence traffic fingerprint features, and the model classification model can be obtained by training the pre-trained first model according to the label data corresponding to the classification task, so that the adaptability, flexibility and accuracy of the model can be improved.

Description

Technical Field

[0001] The present application relates to the field of traffic processing technology, and in particular to a traffic classification method, device, electronic device and storage medium. Background Art

[0002] Traffic classification is a key technology in network management, which aims to identify and classify different types of traffic data. In related technologies, when classifying traffic data, the traffic data can be manually labeled, and a model can be trained based on the labeled traffic data, and then the trained model can be used to identify the type of traffic data. However, in actual application scenarios, due to the variety of traffic data types, the classification tasks of traffic data are diverse. For different classification tasks, it is often necessary to re-label a large amount of data and re-train the model, which not only consumes a lot of time and human resources, but also reduces the adaptability, flexibility and accuracy of the model. Summary of the invention

[0003] The present application provides a traffic classification method, device, electronic device and storage medium, which are used to solve the problem of low adaptability, flexibility and accuracy of the model when classifying traffic data.

[0004] To solve the above technical problems, this application is implemented as follows: In a first aspect, a traffic classification method is provided, comprising: Acquire multiple types of flow data to be classified and flow information of the flow data; Extracting features from the flow data to obtain feature data with a unified modality; Generate a time series traffic fingerprint feature according to the feature data and the traffic information; The time series traffic fingerprint feature is input into the traffic classification model to obtain the classification result of the traffic data. The traffic classification model is obtained by training the first model according to the label data corresponding to the classification task. The first model is used to learn the time series traffic fingerprint features of various types of traffic data to obtain the characteristic relationship between the traffic data.

[0005] In a second aspect, a flow classification device is provided, comprising: An acquisition module, which acquires multiple types of flow data to be classified and flow information of the flow data; An extraction module performs feature extraction on the flow data to obtain feature data with a unified modality; A generation module, generating a time series traffic fingerprint feature according to the feature data and the traffic information; The classification module inputs the time series traffic fingerprint features into the traffic classification model to obtain the classification results of the traffic data. The traffic classification model is obtained by training the first model according to the label data corresponding to the classification task. The first model is used to learn the time series traffic fingerprint features of various types of traffic data to obtain the characteristic relationship between the traffic data.

[0006] According to a third aspect, an electronic device is provided, including: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method as described in the first aspect.

[0007] According to a fourth aspect, a computer-readable storage medium is provided. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the method described in the first aspect.

[0008] According to a fifth aspect, a computer program product is provided, the computer program product comprising a non-transitory computer-readable storage medium storing a computer program, wherein the computer program is operable to cause a computer to execute part or all of the steps in the method described in the first aspect.

[0009] In the embodiment of the present application, the first model can be used in advance to learn the time series traffic fingerprint features of various types of traffic data to obtain the characteristic relationship between the traffic data. When classifying various types of traffic data, the first model can be fine-tuned according to the actual classification task using the label data corresponding to the classification task to obtain a traffic classification model, and the traffic data can be classified according to the traffic classification model. In this way, for different classification tasks, only a small amount of label data can be used to train the required traffic classification model, which greatly reduces the manpower cost and time investment of data annotation and model training, and improves the adaptability and flexibility of the model. In addition, when classifying traffic data, since it is possible to extract features from various types of traffic data to obtain feature data with a unified modality, clean and standardized feature data can be provided for subsequent processing. Since the time series traffic fingerprint features generated according to traffic features and traffic information can comprehensively and accurately describe the characteristics of the traffic, capture the potential laws and patterns in the traffic, and retain the time series information of the traffic data, traffic classification based on the time series traffic fingerprint features can effectively improve the accuracy of the classification results. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the present application or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0011] Figure 1 It is a flow chart of a flow classification method according to an embodiment of the present application; Figure 2 is a schematic diagram of a multimodal self-supervisory model according to an embodiment of the present application; Figure 3 It is a schematic diagram of generating time series traffic fingerprint features according to an embodiment of the present application; Figure 4 is a schematic diagram of a mamba model according to an embodiment of the present application; Figure 5 It is a schematic diagram of traffic classification and traffic playback in one embodiment of the present application; Figure 6 is a schematic diagram of the structure of an electronic device according to an embodiment of the present application; Figure 7 It is a structural diagram of a flow classification device according to an embodiment of the present application. DETAILED DESCRIPTION

[0012] Traffic classification is a key technology in network management. It aims to identify and classify different types of data traffic. It is of great significance in network optimization, resource allocation, security monitoring, etc. Different types of traffic usually have different characteristics and attributes. By analyzing these characteristics and attributes, effective traffic identification and classification can be achieved. Traffic identification and classification plays an important role in modern network management. In practical applications, the selection of appropriate deep learning algorithms depends on the specific traffic characteristics, data volume, and computing resources. By reasonably selecting and combining these algorithms, efficient traffic classification can be achieved, thereby optimizing business system performance and improving user experience.

[0013] In related technologies, traffic identification and classification face many technical challenges, which affect the accuracy, efficiency and adaptability of the model, resulting in certain difficulties and limitations in practical applications, as follows: (1) The diversity of traffic data classification tasks is an important challenge. Traditional machine learning models often need to train a large amount of labeled data before performing classification tasks so that the model can learn how to handle the corresponding classification tasks. The labeling of traffic data requires professional knowledge and usually requires manual labeling by experts, which is not only time-consuming and labor-intensive, but also costly. In addition, when the classification task changes, for example, one task may be to classify traffic as mysql, redis, kafka, service applications, etc., and another task may be to classify traffic as json or xml, etc., each time a different classification task is started, a large amount of data needs to be re-labeled and the model needs to be retrained, which not only consumes a lot of time and human resources, but also reduces the adaptability and flexibility of the model.

[0014] (2) Network traffic usually contains a large amount of noise and outliers and has a high feature dimension, which has a serious impact on the performance of traffic identification models. First, noisy data and outliers may cause the model training process to deviate from the correct direction and affect the classification accuracy. Especially in the network environment, the volatility and instability of traffic make noise and outliers more common and difficult to avoid. This requires the model to not only have strong noise processing capabilities, but also maintain high robustness in the face of abnormal situations. However, achieving this is not easy and requires special processing during model design and training, such as data preprocessing, feature selection, and anomaly detection. Secondly, the traffic data in the network may contain a large amount of text data in one data. The larger the amount of data, the larger the network structure and calculation time of the model, which will lead to low classification efficiency.

[0015] The embodiment of the present application provides a traffic classification method, device, electronic device and storage medium, which can use a first model to learn the time series traffic fingerprint features of multiple types of traffic data in advance to obtain the characteristic relationship between the traffic data. When classifying multiple types of traffic data, the first model can be fine-tuned according to the actual classification task using the label data corresponding to the classification task to obtain the traffic classification model, and the traffic data is classified according to the traffic classification model. In this way, for different classification tasks, only a small amount of label data can be used to train the required traffic classification model, which greatly reduces the human cost and time investment of data annotation and model training, and improves the adaptability and flexibility of the model. In addition, when classifying traffic data, since it is possible to extract features from multiple types of traffic data to obtain feature data with a unified modality, clean and standardized feature data can be provided for subsequent processing. Since the time series traffic fingerprint features generated according to the traffic features and traffic information can comprehensively and accurately describe the characteristics of the traffic, capture the potential laws and patterns in the traffic, and retain the time series information of the traffic data, traffic classification based on the time series traffic fingerprint features can effectively improve the accuracy of the classification results.

[0016] Traffic replay is a step after traffic identification and classification. It sends previously classified traffic data to the system to test and verify the performance of the system in real scenarios. Traffic replay can be used to observe the status of the system, application, or service and identify potential bottlenecks and performance issues. When performing traffic classification or identification, traffic replay can provide a large amount of historical data for training and optimizing models. By replaying multiple types of traffic data, the model can better learn different traffic patterns and improve the accuracy and generalization of classification.

[0017] In the related art, the data after traffic classification and the hardware configuration need to be closely matched to prevent hardware incompatibility. However, traffic after different classifications is often played back on different servers, which means that each time a traffic replay task is executed, the traffic replay engine needs to be manually redeployed on the corresponding server, and additional manual recovery is required after the task is completed. This method not only increases deployment costs and equipment losses, but also leads to repeated work and reduces resource utilization. In view of this, an embodiment of the present application also provides a traffic replay method, which performs traffic replay through a unified and centrally deployed traffic replay engine, thereby reducing deployment costs, avoiding repeated operations, and effectively improving resource utilization, so that traffic replay technology can serve service performance evaluation and optimization tasks more economically and efficiently.

[0018] In order to enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in this application will be described clearly and completely below in conjunction with the drawings in one or more embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0019] The terms "first", "second", etc. in the present application and claims are used to distinguish similar objects, and are not used to describe a particular order or precedence. It should be understood that the data used in this way can be interchanged where appropriate so that the present application can be implemented in an order other than those illustrated or described herein. In addition, "and / or" in the present application and claims means at least one of the connected objects, and the character " / " generally means that the objects associated with each other are in an "or" relationship.

[0020] The technical solutions provided by various embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0021] Figure 1 It is a flow chart of a traffic classification method according to an embodiment of the present application. Figure 1 The traffic classification method shown is described below.

[0022] S12: Acquire multiple types of traffic data to be classified and traffic information of the traffic data.

[0023] When classifying traffic data, the traffic data to be classified and the traffic information of the traffic data can be obtained. The traffic data to be classified can be multiple types of traffic data (can also be represented as traffic data in multiple formats or traffic data in multiple modes), and the multiple types of traffic data can be, for example, different services or data in different formats such as application systems, databases, redis, json, xml, etc. The traffic information of the traffic data can be address information or protocol information of the traffic data. In some embodiments, the traffic information of the traffic data can include at least one of the source address, destination address, network protocol type, port number, and data packet header of the traffic data.

[0024] When acquiring multiple types of flow data to be classified and flow information of the flow data, flow data at multiple moments and flow information of each of the flow data at the multiple moments can be acquired. For example, flow data at moments T1 to TN (N is a positive integer greater than 1) can be collected according to a time period T, and flow information of these flow data can be acquired simultaneously when collecting flow data. That is, the flow data acquired by the embodiment of the present application can include flow data collected at multiple moments, and the acquired flow information can include flow information corresponding to the multiple moments.

[0025] S14: Extract features from the traffic data to obtain feature data with a unified modality.

[0026] After obtaining various types of traffic data to be classified, feature extraction can be performed on the traffic data to obtain feature data with a unified modality, that is, feature data with a unified format, so that clean and standardized feature data can be provided for subsequent processing.

[0027] In some implementations, feature extraction is performed on the traffic data to obtain feature data with a unified modality, which may include: The traffic data is featured by extracting features through a multimodal self-supervised model to obtain feature data with unified modality.

[0028] The multimodal self-supervised model is used to perform self-supervised learning on multimodal data, aiming to reduce data dimensions and effectively deal with noise and outliers, reduce data size, and improve the accuracy and robustness of traffic identification and classification. The multimodal self-supervised model includes an encoding layer (or encoder) based on an attention mechanism, an intermediate layer, and a decoding layer (or decoder) based on an attention mechanism. The encoding layer is used to extract features, reduce feature dimensions, and filter and denoise different types of traffic data to obtain feature data of multiple modalities. The intermediate layer is used to convert the format of feature data of different modalities to obtain feature data with unified modality and denoised, which can provide clean and standardized feature data for subsequent processing. The decoding layer is used to ensure the consistency of data obtained through encoding and decoding during the training process of the model.

[0029] Figure 2 It is a structural diagram of a multimodal self-supervisory model of an embodiment of the present application.

[0030] Figure 2In the training phase of the multimodal self-supervised model, the sample data may include traffic data of multiple different modalities. When training the model on the sample data, some data may be hidden by local masking technology (some data may be randomly selected for hiding each time during the multiple training processes of the model) to enhance the robustness and generalization ability of the model. Then, the encoding layer based on the attention mechanism is used for feature extraction to deeply mine the features of the data of each modality and extract valuable information. The output features of the encoding layer are processed by a unified intermediate layer to be converted into feature information of the same format. The design of the intermediate layer can make the data of different modalities consistent at the feature level, thereby providing standardized input for subsequent processing steps. The decoding layer decodes the feature data output by the intermediate layer, predicts the possible results of the mask information, and performs feature learning by comparing whether the predicted results are consistent with the real data of the mask. In the inference phase (or application phase) of the multimodal self-supervised model, that is, when extracting traffic data features through the multimodal self-supervised model, the output results of the intermediate layer can be used as feature extraction results to obtain feature data with a unified model. In this way, the multimodal self-supervised model can achieve feature unification and noise filtering. It can not only process diverse data formats and solve the problem that different modal traffic data cannot be processed uniformly, but also effectively deal with noise and outliers in the data and extract clean and standardized feature information.

[0031] In an embodiment of the present application, the traffic data to be classified may include traffic data collected at multiple moments. When feature extraction is performed on the traffic data, feature extraction can be performed on the traffic data collected at the multiple moments respectively to obtain feature data corresponding to each of the multiple moments, and the feature data corresponding to each moment has a unified modality.

[0032] S16: Generate a time series traffic fingerprint feature based on the feature data and traffic information.

[0033] As mentioned above, the feature data obtained after feature extraction of the traffic data may include feature data corresponding to multiple moments, and the traffic information of the traffic data may include traffic information corresponding to the multiple moments. After obtaining these feature data and traffic information, in order to more comprehensively and accurately describe the traffic characteristics and capture the potential laws and patterns in the traffic, time series traffic fingerprint features can be generated based on these feature data and traffic information, that is, the feature data and traffic information are processed into quantitative feature data with time series information in chronological order. In this way, not only can the time series information of the data be retained and the accuracy of traffic classification be achieved, but also data quantification can be achieved.

[0034] In some implementations, generating a time series traffic fingerprint feature based on the feature data and traffic information may include: For any first moment among the multiple moments, generating a traffic fingerprint feature corresponding to the first moment according to the feature data and traffic information corresponding to the first moment; The traffic fingerprint features corresponding to multiple moments are concatenated in sequence to obtain the time series traffic fingerprint features.

[0035] Specifically, for each moment in the multiple moments (here, for the sake of distinction, it can be expressed as the first moment), the traffic fingerprint feature corresponding to the first moment can be generated based on the characteristic data and traffic information corresponding to the first moment. In this way, for the characteristic data and traffic information corresponding to the multiple moments, the traffic fingerprint features corresponding to each of the multiple moments can be obtained through the same processing. Afterwards, the traffic fingerprint features corresponding to each of the multiple moments can be spliced ​​in a certain order (for example, in the chronological order of the multiple moments), and finally a complete time series traffic fingerprint feature can be generated. The time series traffic fingerprint feature can fully describe the characteristics of the network traffic and retain the time series information of the data. Among them, when generating the traffic fingerprint feature corresponding to the first moment based on the characteristic data and traffic information corresponding to the first moment, in some embodiments, it can include: The traffic information corresponding to the first moment is encoded according to the Word2vec technology to obtain a first feature; Perform position encoding processing on the first feature according to the traffic propagation process to obtain the second feature; A traffic fingerprint feature corresponding to the first moment is generated based on the second feature and the feature data corresponding to the first moment.

[0036] The time series traffic fingerprint feature is an important identifier for describing network traffic, which can capture the time series characteristics and protocol characteristics in the traffic. In order to generate high-quality time series traffic fingerprint features, when generating the traffic fingerprint feature corresponding to the first moment, the Word2vec technology can be used to encode the traffic information corresponding to the first moment (such as source address, destination address, protocol type, port number, data packet header, etc.) and convert it into a high-dimensional vector representation, that is, the first feature. After obtaining the first feature, the first feature can be positionally encoded according to the traffic propagation process to retain the time series information of the traffic data and obtain the second feature. After that, the second feature can be combined with the feature data corresponding to the first moment, and finally the traffic fingerprint feature corresponding to the first moment can be obtained.

[0037] To understand the generation process of time series traffic fingerprint data, please refer to Figure 3 .

[0038] Figure 3In the above, Time1, Time2, ..., Time N are the time points of traffic collection. That is, when collecting traffic data, the first traffic collection starts from Time1 and a complete traffic collection process is completed at TimeN. Each time the traffic data collected can be extracted to obtain feature data with a unified model ( Figure 3 The traffic information of each collected traffic data includes source address, destination address, port number and protocol type. When generating the time series traffic fingerprint feature, for each moment, the source address, destination address, protocol type and port number information of that moment can be processed by word2vec and position encoding, and then spliced ​​together with the unified modal feature to form the traffic fingerprint feature of each moment. Subsequently, the traffic fingerprint features of different moments are spliced ​​together in the order of the traffic collection moments, and finally a complete time series traffic fingerprint feature can be formed.

[0039] S18: Input the time series traffic fingerprint features into the traffic classification model to obtain the classification results of the traffic data. The traffic classification model is obtained by training the first model according to the label data corresponding to the classification task. The first model is used to learn the time series traffic fingerprint features of various types of traffic data to obtain the characteristic relationship between the traffic data.

[0040] Before classifying traffic, the embodiment of the present application can first use the first model to learn sample data (including time series traffic fingerprint features of various types of traffic data, and the method of obtaining these data can refer to the specific implementation method of S12 to S16 above) to obtain the characteristic relationship between the traffic data, and then set the corresponding label data according to the classification task, and train the pre-trained first model according to the label data (that is, fine-tune the first model) to obtain a traffic classification model. In this way, when classifying traffic data, after obtaining the time series traffic fingerprint features of the traffic data based on S12 to S16 above, the time series traffic fingerprint features can be input into the traffic classification model, and the traffic classification model can output the classification results of the traffic data.

[0041] In some embodiments, the first model may be a mamba model. The mamba model is a new type of deep learning architecture, which can establish a knowledge base of traffic data information through pre-training, and the knowledge base includes all feature relationship information of traffic data learned by the mamba model. Since the mamba model combines the characteristics of recurrent neural network (RNN) and convolutional neural network (CNN), it can efficiently capture complex dependencies in sequence data.

[0042] Figure 4 Shown is a schematic diagram of a mamba model according to an embodiment of the present application.

[0043] Figure 4 In the figure, the mamba model includes a fully connected layer, a normalization layer, multiple mamba modules and a fully connected layer from bottom to top. In the model training stage, the mamba model can be pre-trained through a large number of unlabeled time series traffic fingerprint features to learn the potential feature relationships in the traffic data and establish an efficient traffic knowledge base. Specifically, the complex relationship between traffic features can be captured through the selective state space model (SSM) architecture, and a knowledge base containing rich traffic feature information (i.e., the pre-trained mamba model) can be constructed through the pre-training of the mamba model. The pre-trained mamba model can well understand and map the feature relationships between traffic data, and can provide strong support for subsequent classification tasks.

[0044] In some embodiments, the characteristic relationship between traffic data learned according to the first model may include but is not limited to the characteristic relationship between different types of traffic data and the characteristic relationship between the same type of traffic data, such as the similarity and degree of similarity between the same type of traffic data, the difference and degree of difference between different types of traffic data, etc.

[0045] In some embodiments, the label data corresponding to the classification task can be set manually. In addition, the amount of label data corresponding to the classification task can be less than or equal to the first threshold value. The first threshold value can be set according to actual needs, such as 1,000 items, which is not specifically limited here. In this way, when the pre-trained first model is trained according to the label data corresponding to the classification task, a small amount of label data is used to fine-tune the pre-trained first model to obtain a traffic classification model. Since the first model has learned the feature mapping relationship of the traffic data during the pre-training process, and the amount of data required for the training process of the first model is small and the time consumption is low, it can quickly adapt to different traffic classification tasks through knowledge transfer. This method can greatly reduce the manpower cost and time investment of data labeling and model training, and effectively improve the adaptability and flexibility of the model.

[0046] The traffic classification method provided in the embodiment of the present application can use the first model to learn the time series traffic fingerprint features of various types of traffic data in advance to obtain the characteristic relationship between the traffic data. When classifying various types of traffic data, the first model can be fine-tuned according to the actual classification task using the label data corresponding to the classification task to obtain the traffic classification model, and the traffic data is classified according to the traffic classification model. In this way, for different classification tasks, only a small amount of label data can be used to train the required traffic classification model, which greatly reduces the manpower cost and time investment of data annotation and model training, and improves the adaptability and flexibility of the model. In addition, when classifying traffic data, since it is possible to extract features from various types of traffic data to obtain feature data with a unified modality, clean and standardized feature data can be provided for subsequent processing. Since the time series traffic fingerprint features generated according to the traffic features and traffic information can comprehensively and accurately describe the characteristics of the traffic, capture the potential laws and patterns in the traffic, and retain the time series information of the traffic data, traffic classification based on the time series traffic fingerprint features can effectively improve the accuracy of the classification results.

[0047] In some implementations, after the classification result of the traffic data is obtained, traffic playback may also be performed. Specifically, it may include: Establish a remote connection with the server, where a traffic playback engine is deployed; Traffic replay and resource recovery are performed through the traffic replay engine.

[0048] That is to say, the traffic replay engine can be deployed on a fixed server, and the classified traffic can be replayed through the traffic replay engine centrally deployed on the server. Specifically, after the traffic classification task is completed, when there is a traffic replay task, an idle port number can be obtained from the existing replay engine, and then the replay engine allocation program is called to remotely connect the traffic replay engine on the server to the target server (i.e., the server that performs the traffic classification task, and different classification tasks can be performed by different target servers) that requests traffic replay, and match the corresponding server port number. After that, the traffic replay engine will automatically replay the classified traffic, and after the traffic replay is completed, the resource recycling operation will be automatically triggered, that is, after the task is completed, the traffic replay engine will automatically capture and notify the end of the task. After the task is completed, the recycling program will be called to restore the state of the traffic replay engine to idle, and release all occupied computing resources, such as memory, port and other resource occupation, and return these resources to the public resource pool. This process is designed to maximize the utilization efficiency of system resources so that resources can be quickly reallocated to support the deployment and execution of subsequent tasks. In addition, since task completion notifications can be automatically generated and sent to the management background through designated channels, the management background can grasp the progress of tasks in real time, thus realizing automated operations and reducing manual intervention, thereby improving the system's response speed and resource scheduling efficiency, and ensuring efficient and continuous execution of playback tasks after traffic classification.

[0049] In this way, since the traffic replay engine can be uniformly deployed on a fixed server instead of being deployed separately on each server that needs to perform traffic identification and classification tasks, the entire process can be simplified. Through centralized management, system administrators can configure and maintain the traffic identification and classification engine more efficiently, avoiding the complexity of repeatedly deploying the engine on each server. This can not only reduce errors and inconsistencies that may occur during the deployment process, but also make system updates and maintenance more convenient. After the replay task is completed, the replay engine will promptly recycle the allocated nginx listening port and replay engine resources to prevent idle resources, optimize resource allocation, and reduce resource waste.

[0050] Figure 5 It is a schematic diagram of traffic classification and traffic playback according to an embodiment of the present application.

[0051] Figure 5In the process of traffic classification, first, the traffic data is outputted as feature data of a unified mode through a multimodal encoder, and the traffic information such as source address, destination address, protocol type, port number, etc. processed by word2vec and position encoding is combined to generate time series traffic fingerprint features. Secondly, the traffic knowledge base (i.e., the pre-trained mamba model) is obtained by pre-training the mamba model. Finally, a small amount of data is annotated according to the specific classification task, and the mamba model is fine-tuned according to the annotated data. Based on the fine-tuned model, the corresponding traffic classification task can be achieved. After the classification task is completed and the classification result is obtained, the classified traffic can be replayed through the uniformly deployed traffic replay engine, and resource recovery is automatically triggered after the traffic replay is completed.

[0052] The embodiment of the present application can reduce labor costs in traffic identification, classification and traffic playback. At the same time, clean and lower-dimensional feature information can be extracted through a multimodal self-supervisory model, so that it not only has the ability to process diversified data, but also can maintain high robustness in the face of complex and noisy data. The unified modal features output by the middle layer of the multimodal self-supervisory model are combined with traffic information such as source address, destination address, network protocol type, port number, etc. to generate time series traffic fingerprint features, and the mamba model of the selective state space model (SSM) architecture is used for pre-training, so that the model can learn the potential feature relationship of traffic information and establish a traffic knowledge base containing rich feature information. In the specific traffic identification and classification task, only a small amount of label data is needed to fine-tune the model to achieve traffic classification, which greatly reduces the time and labor cost required for data annotation and training, and can quickly adapt to different classification requirements, such as website traffic and application traffic classification, different components or application classification, etc. In this way, the embodiment of the present application realizes the flexible and efficient completion of the identification and classification tasks of different types of traffic and finally replays the traffic while reducing labor costs, providing strong technical support for network management and performance optimization.

[0053] The above describes specific embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0054] Figure 6 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. Figure 6At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0055] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0056] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0057] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a traffic classification device at the logical level. The processor executes the program stored in the memory and is specifically used to perform the following operations: Acquire multiple types of flow data to be classified and flow information of the flow data; Extracting features from the flow data to obtain feature data with a unified modality; Generate a time series traffic fingerprint feature according to the feature data and the traffic information; The time series traffic fingerprint feature is input into the traffic classification model to obtain the classification result of the traffic data. The traffic classification model is obtained by training the first model according to the label data corresponding to the classification task. The first model is used to learn the time series traffic fingerprint features of various types of traffic data to obtain the characteristic relationship between the traffic data.

[0058] The above application Figure 6The method performed by the traffic classification device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or instructions in software form. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in this application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in this application can be directly embodied as a hardware decoding processor for execution, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0059] The electronic device may also perform Figure 1 The method and the flow classification device are implemented in Figure 1 The functions in the illustrated embodiments will not be described in detail in this application.

[0060] Of course, in addition to software implementation, the electronic device of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0061] The present application also proposes a computer-readable storage medium, which stores one or more programs, wherein the one or more programs include instructions, which, when executed by a portable electronic device including a plurality of application programs, enable the portable electronic device to execute Figure 1 The method of the embodiment shown is specifically used to perform the following operations: Acquire multiple types of flow data to be classified and flow information of the flow data; Extracting features from the flow data to obtain feature data with a unified modality; Generate a time series traffic fingerprint feature according to the feature data and the traffic information; The time series traffic fingerprint feature is input into the traffic classification model to obtain the classification result of the traffic data. The traffic classification model is obtained by training the first model according to the label data corresponding to the classification task. The first model is used to learn the time series traffic fingerprint features of various types of traffic data to obtain the characteristic relationship between the traffic data.

[0062] Figure 7 This is a schematic diagram of the structure of a flow classification device 70 according to an embodiment of the present application. Figure 7 In a software implementation, the traffic classification device 70 may include: an acquisition module 71, an extraction module 72, a generation module 73 and a classification module 74, wherein: An acquisition module 71, which acquires multiple types of flow data to be classified and flow information of the flow data; An extraction module 72 performs feature extraction on the flow data to obtain feature data with a unified modality; A generating module 73 generates a time series traffic fingerprint feature according to the feature data and the traffic information; The classification module 74 inputs the time series traffic fingerprint features into the traffic classification model to obtain the classification results of the traffic data. The traffic classification model is obtained by training the first model according to the label data corresponding to the classification task. The first model is used to learn the time series traffic fingerprint features of various types of traffic data to obtain the characteristic relationship between the traffic data.

[0063] In some implementations, the extraction module 72 performs feature extraction on the flow data to obtain feature data with a unified modality, including: Extracting features from the traffic data using a multimodal self-supervised model to obtain feature data with a unified modality; Among them, the multimodal self-supervised model includes an encoding layer and an intermediate layer based on an attention mechanism. The encoding layer is used to perform feature extraction, feature dimension reduction and feature screening and noise reduction on different types of traffic data to obtain feature data of multiple modalities. The intermediate layer is used to convert the format of feature data of different modalities to obtain feature data with a unified modality.

[0064] In some implementations, the traffic data includes traffic data collected at multiple moments, the feature data includes feature data corresponding to the multiple moments, and the traffic information includes traffic information corresponding to the multiple moments; the generating module 73 generates a time series traffic fingerprint feature according to the feature data and the traffic information, including: For any first moment among the multiple moments, generating a traffic fingerprint feature corresponding to the first moment according to the feature data and traffic information corresponding to the first moment; The traffic fingerprint features corresponding to the multiple moments are concatenated in sequence to obtain the time series traffic fingerprint feature.

[0065] In some implementations, the generating module 73 generates the traffic fingerprint feature corresponding to the first moment according to the feature data and traffic information corresponding to the first moment, including: The traffic information corresponding to the first moment is encoded according to the Word2vec technology to obtain a first feature; Performing position encoding processing on the first feature according to the traffic propagation process to obtain a second feature; A traffic fingerprint feature corresponding to the first moment is generated according to the second feature and the feature data corresponding to the first moment.

[0066] In some implementations, the flow information includes at least one of the following: Source address; Destination address; Network protocol type; Port number; Packet header.

[0067] In some embodiments, the first model includes a mamba model, and the characteristic relationship includes a characteristic relationship between different types of traffic data and a characteristic relationship between the same type of traffic data; The data volume of the tag data is less than or equal to a first threshold.

[0068] In some implementations, the flow classification device 70 further includes a recovery module. After obtaining the classification result of the flow data, the recovery module: Establishing a remote connection with a server, wherein a traffic playback engine is deployed in the server; Traffic replay and resource recovery are performed through the traffic replay engine.

[0069] The flow classification device 70 provided in the present application can also perform Figure 1 The method is implemented by the flow classification device 70. Figure 1 The functions of the illustrated embodiments will not be described in detail in this application.

[0070] The present application also proposes a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to enable a computer to execute part or all of the steps in the above-mentioned traffic classification method embodiment.

[0071] In short, the above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0072] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0073] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0074] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0075] Each embodiment in this application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A traffic classification method, characterized in that: include: Acquire multiple types of flow data to be classified and flow information of the flow data; Extracting features from the flow data to obtain feature data with a unified modality; Generate a time series traffic fingerprint feature according to the feature data and the traffic information; The time series traffic fingerprint feature is input into the traffic classification model to obtain the classification result of the traffic data. The traffic classification model is obtained by training the first model according to the label data corresponding to the classification task. The first model is used to learn the time series traffic fingerprint features of various types of traffic data to obtain the characteristic relationship between the traffic data.

2. The method according to claim 1, characterized in that The feature extraction of the flow data to obtain feature data with a unified modality includes: Extracting features from the traffic data using a multimodal self-supervised model to obtain feature data with a unified modality; Among them, the multimodal self-supervised model includes an encoding layer and an intermediate layer based on an attention mechanism. The encoding layer is used to perform feature extraction, feature dimension reduction and feature screening and noise reduction on different types of traffic data to obtain feature data of multiple modalities. The intermediate layer is used to convert the format of feature data of different modalities to obtain feature data with a unified modality.

3. The method according to claim 1, characterized in that The flow data includes flow data collected at multiple moments, the feature data includes feature data corresponding to the multiple moments, and the flow information includes flow information corresponding to the multiple moments; generating a time series flow fingerprint feature according to the feature data and the flow information includes: For any first moment among the multiple moments, generating a traffic fingerprint feature corresponding to the first moment according to the feature data and traffic information corresponding to the first moment; The traffic fingerprint features corresponding to the multiple moments are concatenated in sequence to obtain the time series traffic fingerprint feature.

4. The method according to claim 3, characterized in that The generating, according to the feature data and the traffic information corresponding to the first moment, the traffic fingerprint feature corresponding to the first moment includes: The traffic information corresponding to the first moment is encoded according to the Word2vec technology to obtain a first feature; Performing position encoding processing on the first feature according to the traffic propagation process to obtain a second feature; A traffic fingerprint feature corresponding to the first moment is generated according to the second feature and the feature data corresponding to the first moment.

5. The method according to any one of claims 1 to 4, characterized in that: The flow information includes at least one of the following: Source address; Destination address; Network protocol type; Port number; Packet header.

6. The method according to claim 1, characterized in that The first model includes a mamba model, and the characteristic relationship includes a characteristic relationship between different types of traffic data and a characteristic relationship between the same type of traffic data; The data volume of the tag data is less than or equal to a first threshold.

7. The method according to claim 1, characterized in that After obtaining the classification result of the flow data, the method further includes: Establishing a remote connection with a server, wherein a traffic playback engine is deployed in the server; Traffic replay and resource recovery are performed through the traffic replay engine.

8. A flow classification device, characterized in that: include: An acquisition module, which acquires multiple types of flow data to be classified and flow information of the flow data; An extraction module performs feature extraction on the flow data to obtain feature data with a unified modality; A generation module, generating a time series traffic fingerprint feature according to the feature data and the traffic information; The classification module inputs the time series traffic fingerprint features into the traffic classification model to obtain the classification results of the traffic data. The traffic classification model is obtained by training the first model according to the label data corresponding to the classification task. The first model is used to learn the time series traffic fingerprint features of various types of traffic data to obtain the characteristic relationship between the traffic data.

9. An electronic device, comprising: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, when instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method according to any one of claims 1 to 7.

Images