Method and system for identifying and analyzing large-bandwidth network traffic protocol

Abstract

The invention discloses a large-bandwidth network flow protocol identification and analysis method and system, and relates to the technical field of network flow protocol analysis processing. The method comprises the following steps of: receiving original traffic of a network, storing the original traffic in a kernel mode buffer area in a data frame form, and directly mapping the data frame in the kernel mode buffer area to a user mode memory area based on a zero copy technology, logic classification is conducted on the data flow, the data flow is sent to the corresponding calculation processing cores through a dynamic distribution mechanism, and each calculation processing core completes layer-by-layer identification and analysis on a flow protocol and extracts corresponding metadata from a protocol identification result. According to the method, a protocol identification method of a three-level pipeline architecture is adopted in a computing processing core, layer-by-layer identification and analysis of a traffic protocol are completed, high-complexity deep analysis of all traffic is avoided, the whole identification process does not need to be reconstructed in the face of a newly-added protocol or a complex protocol, and each stage is independently optimized.

Description

Technical Field

[0001] The present invention relates to the technical field of network flow protocol analysis and processing, and in particular to a method and system for identifying and analyzing a large-bandwidth network flow protocol. Background Art

[0002] Existing protocol identification and parsing methods mainly include those based on feature matching and deep packet inspection (DPI). Among them, the feature matching-based method identifies by analyzing specific fields or key features of the protocol (such as port numbers, byte sequences), but when it comes to complex protocols in large bandwidth traffic and newly added protocols, the accuracy of protocol identification is low, and the maintenance cost for newly added protocols is high. DPI identifies protocols by deeply parsing the content of data packets. Although it has high accuracy, it has high computational complexity, especially when facing large bandwidth traffic, it is difficult to meet real-time requirements. When dealing with complex bandwidth network traffic, the above methods have deficiencies in real-time, scalability, and resource utilization. Summary of the invention

[0003] 1) Technical issues solved

[0004] The present invention provides a large bandwidth network traffic protocol identification and analysis method and system to solve the deficiencies of existing protocol identification and analysis methods in terms of real-time performance, scalability and resource utilization when processing complex bandwidth network traffic.

[0005] 2) Technical solution

[0006] To achieve the above object, the present invention provides the following technical solution: a method for identifying and parsing a large bandwidth network traffic protocol, comprising the following steps:

[0007] Receive the original traffic from the network and store it in the kernel buffer in the form of data frames;

[0008] Based on the zero-copy technology, the data frame in the kernel buffer is directly mapped to the user-state memory area as the starting point for the data flow to enter the user-state processing;

[0009] According to the principle of same source and same destination, the data flow is logically classified based on the source address, destination address, source port and destination port, and the classified data flow is sent to the corresponding computing processing core through a dynamic distribution mechanism; wherein the dynamic distribution mechanism distributes the data flow to different computing processing cores through a load balancing strategy;

[0010] Each of the computing processing cores will parse the assigned data stream layer by layer through a three-level pipeline architecture in turn; wherein the three-level pipeline architecture includes three parsing stages: bottom-level protocol identification, pattern matching identification, and high-level protocol matching identification. The bottom-level protocol identification determines the bottom-level protocol type by parsing the link layer and network layer fields, the pattern matching identification parses the middle-level protocol through field matching rules and a predefined pattern library, and the high-level protocol matching identification parses complex protocols by combining context information and a state machine mechanism; after the data stream is parsed at each stage, if the protocol type is determined, the result is directly output, otherwise it enters the next stage for parsing;

[0011] Based on the recognition result of the protocol, an adapted metadata extraction model is called in each of the computing processing cores to extract metadata from the recognition result; wherein each metadata extraction model is bound to the protocol feature and automatically matched and called according to the result of the protocol parsing stage;

[0012] Each of the computing processing cores combines the protocol identification result and the metadata extraction result into a data queue and then outputs it.

[0013] Furthermore, the zero-copy technology is specifically a zero-copy-based MFRU header data pre-fetch management algorithm, which adopts a two-level table structure of a first-level free table stack and a second-level bidirectional free linked list, and allocates a free table entry in the kernel buffer for storing header data in the data frame; specifically:

[0014] When the number of free table entries in the buffer is lower than a first set threshold, the algorithm creates a page call to the first-level free table stack to expand the number of available table entries.

[0015] When the number of free table entries in the buffer is greater than a set second set threshold, the algorithm releases the free table entries and recycles them into the first-level free table stack.

[0016] Furthermore, the load balancing strategy specifically adopts a feedback two-level balanced routing algorithm to perform two-level distribution of data streams, specifically:

[0017] The first stage obtains the real-time load information of each computing node and sends the data stream to the computing node according to the principle of same source and same destination according to the load situation;

[0018] In the second stage, inside each computing node, based on the load monitoring data of the computing processing core, the hash algorithm is dynamically adjusted and the data stream is distributed to each computing processing core again, so as to achieve balanced distribution of data streams within the computing node.

[0019] Furthermore, in the process of identifying and parsing the protocol, a distributed hash flow table management algorithm based on the Splay tree is used to construct a distributed flow table according to the number of the computing processing cores, and each computing processing core independently maintains a flow table of a Splay tree structure. When the data flow reaches the computing processing core, the corresponding flow table entry is searched in the Splay tree.

[0020] If the corresponding flow table entry is found, the protocol status stored in the flow table is directly obtained;

[0021] If the corresponding flow table entry is not found, a new flow table entry is created and inserted into the Splay tree.

[0022] Furthermore, the bottom layer protocol identification and parsing stage in the three-stage pipeline architecture is responsible for quickly identifying the link layer and network layer protocol types of the data packet, as the basic stage of protocol parsing; specifically, this stage performs preliminary identification based on the basic characteristics of the data packet and the protocol header information, and identifies the data link layer and the network layer;

[0023] If the link layer or network layer protocol type is successfully identified, the protocol identification result is directly output and the data stream is parsed;

[0024] If the protocol type cannot be determined, the data stream enters the next stage of pattern matching identification and parsing.

[0025] Furthermore, the pattern matching recognition and parsing stage in the three-stage pipeline architecture is responsible for further identifying the transport layer protocol type of the data packet, and confirming the transport layer protocol type by comparing the data packet content with the predefined matching pattern; specifically, a minimum perfect hash function is constructed to map the predefined matching pattern to a unique hash value to avoid hash conflicts and achieve fast matching, and regular expression matching and feature code matching are used to locate the protocol feature field;

[0026] If the transport layer protocol type is successfully confirmed, the protocol identification result is directly output and the data stream is parsed;

[0027] If the protocol type cannot be determined, the data stream enters the next stage of advanced protocol matching.

[0028] Furthermore, the advanced protocol matching, identification and parsing stage in the three-stage pipeline architecture is responsible for identifying complex application layer protocol types. This stage combines the logical association data packet identification method, the logical association data packet identification method and the statistical analysis characteristic method to identify the application layer protocol; correspondingly:

[0029] Logical association data packet identification method defines the protocol context by analyzing the logical association relationship between data packets;

[0030] Multi-association layer matching method combines the information and association relationships of multiple data packets to determine the application layer protocol type;

[0031] Statistical analysis method, which uses traffic statistics to analyze the protocol;

[0032] Output the complete protocol parsing results and complete the parsing of the data stream.

[0033] Furthermore, based on the recognition result of the protocol, an adapted metadata extraction model is called in each of the computing processing cores to extract metadata, correspondingly:

[0034] The packet-driven metadata extraction model extracts relevant metadata by extracting the IP header and data part of a single data packet;

[0035] The stream-driven metadata extraction model extracts relevant metadata by analyzing the data packets in the entire data stream;

[0036] The tunnel logical session driven metadata extraction model extracts the logical session information from the tunnel protocol data and extracts the relevant metadata after analyzing the logical session data;

[0037] The event-driven metadata extraction model first extracts the IP header and data part of the data, analyzes it according to the protocol requirements, and then extracts the corresponding metadata.

[0038] Furthermore, each of the computing processing cores integrates the protocol identification result and the metadata extraction result into a data queue, and manages the data queue by a bidirectional lock-free linked list. Specifically:

[0039] When the data queue output is completed, it is marked as processed, and the computing processing core stores the processed data queue into a bidirectional lock-free linked list;

[0040] The packet header table entries in the data queue are recovered through the MFRU packet header data pre-fetching management algorithm, and are re-added to the first-level idle stack for use by subsequent data flows.

[0041] A parsing system for a high-bandwidth network traffic protocol identification method is used to implement any of the above-mentioned protocol identification and parsing methods. The parsing system adopts an architecture based on the separation of data, control and computing planes, wherein:

[0042] The data plane is used to receive network traffic data, perform preliminary classification and distribution of the data, and ensure that the traffic can enter the user state for processing; wherein, the reception, classification and distribution of traffic data are completed through the MFRU packet header data pre-fetching management algorithm and the secondary feedback balanced routing algorithm;

[0043] The computing plane is used to perform protocol identification and analysis and metadata extraction on the data flow; wherein, the flow protocol identification and analysis and metadata extraction are completed by the Splay tree flow table management algorithm, and the data queue is managed in combination with the MFRU packet header data pre-fetching management algorithm;

[0044] The control plane is used to manage resource allocation, policy adjustment and global load balancing; wherein, flow table optimization and global load balancing are performed through the Splay tree flow table management algorithm and the secondary feedback balanced routing algorithm.

[0045] 3) Beneficial effects:

[0046] Compared with the prior art, the invention has the following beneficial effects:

[0047] The present invention dynamically adjusts routing distribution based on traffic load to ensure uniform load distribution of each computing processing core in a multi-core processor architecture.

[0048] The present invention adopts a protocol identification method of a three-level pipeline architecture in the computing processing core, that is, the data stream distributed into the processing core is successively identified and analyzed through the bottom-level protocol identification, pattern matching identification and high-level protocol matching; the three-level pipeline architecture analyzes the protocol type layer by layer, quickly locks the protocol characteristics of the data stream, avoids high-complexity in-depth analysis of all traffic, and significantly reduces the consumption of computing resources. It is particularly suitable for large-scale traffic analysis in high-speed network environments. When facing new protocols or complex protocols, the new protocol features or patterns can be dynamically expanded to the pattern matching identification and high-level protocol matching stages without the need to reconstruct the entire identification process. Each stage is independently optimized, with low update and maintenance costs and strong ability to adapt to new protocols. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 A schematic diagram of a flow chart of a network protocol parsing method provided by an embodiment of the present invention;

[0050] Figure 2 A principle block diagram of an analysis system based on a three-plane separation architecture provided by an embodiment of the present invention;

[0051] Figure 3 A schematic diagram of a flow chart of a feedback type two-level balanced routing algorithm provided in an embodiment of the present invention;

[0052] Figure 4 A schematic diagram of the flow of a feedback dynamic hash algorithm provided by an embodiment of the present invention;

[0053] Figure 5 A schematic diagram of a process of searching a session flow table based on a hash algorithm provided in an embodiment of the present invention;

[0054] Figure 6A principle block diagram of a high-speed DPI engine based on a three-stage pipeline architecture provided by an embodiment of the present invention;

[0055] Figure 7 This is a principle block diagram of four metadata extraction models provided in the embodiments of the present invention. DETAILED DESCRIPTION

[0056] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0057] In the description of the present invention, it should be understood that the terms "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside" and "outside" etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present invention.

[0058] It should be noted that, in the absence of conflict, the features in the embodiments of the present invention may be combined with each other.

[0059] In the existing network traffic protocol identification and parsing systems, their server architectures mostly adopt a multi-CPU, multi-core two-level SMP architecture, and an internal shared architecture. Therefore, when dealing with large-bandwidth network traffic and need to process high-throughput data, when a large number of data streams need to enter or leave the memory at the same time, it will cause congestion in the memory channel, limiting the rapid input and output of data; the resource scheduling overhead will increase, affecting the real-time and performance of data flow processing; because multiple CPU cores share memory, memory access conflicts will occur, especially in high concurrency situations, which leads to reduced memory access efficiency and affects the speed and efficiency of data processing; and in the architecture of shared memory channels, data frame forwarding processing and protocol parsing calculations will compete for memory bandwidth and CPU resources, which will lead to increased instability and latency in data processing.

[0060] Due to the above factors, the existing multi-CPU, multi-core shared memory channel architecture is difficult to effectively meet the continuous processing requirements of more than 40Gbps, especially under high load and high concurrency conditions.

[0061] Furthermore, in order to improve the various defects in the above-mentioned prior art, the embodiments of the present invention propose a large-bandwidth network traffic protocol identification and analysis method and system, which can adapt to the existing situation where network applications are rich, the types and structures of network protocols are complex and changing rapidly, and realize accurate data processing and network protocol analysis.

[0062] First of all, an embodiment of the present invention provides a large-bandwidth network traffic protocol identification and analysis system. The system is a high-speed network signal software processing architecture based on the separation of three planes: data, control, and computing. Among them, the data plane is responsible for the actual processing of network data forwarding, management, and protection; the control plane is responsible for managing the execution of control commands, updating data flow tables, and providing rule basis; the computing plane is responsible for executing computing functions such as protocol identification and analysis and metadata extraction.

[0063] More specifically, the data plane and the control plane communicate through the execution of control commands and the updating of data flow tables, and the control plane and the computing plane communicate through data transmission. The control plane provides rules and basis, and the computing plane performs corresponding computing tasks.

[0064] refer to Figure 2 , Figure 2 The present invention provides a block diagram of the principles of a parsing system based on a three-plane separation architecture. In the three-plane separation architecture design, the data plane, control plane, and management plane each operate independently with clearly defined functions and responsibilities. The data plane forwards different data to the computing plane through different transmission channels via several parallel processing layers. The control plane is responsible for the management of network policies and their distribution to the data plane and computing plane. After receiving different types of data forwarded by the data plane, the computing plane performs computing functions such as protocol identification and parsing and metadata extraction.

[0065] It is understandable that in the existing three-plane non-separated architecture parsing system, an internal shared architecture is adopted, the functions of each plane are more integrated, there is no clear logical division, and the management and distribution of data may be more inclined to be completed in the same device or system. Therefore, in the data distribution processing, there will be a situation where the shared channel is blocked when processing big data, which affects the accuracy and recognition efficiency of the subsequent protocol recognition results. In the three-plane separated architecture in the parsing system provided by the embodiment of the present invention, the data distribution logic is clearer and more layered, and there is a clear data flow path between each plane. Its design concept can better adapt to the growing data demand and complex network environment. Through the mutual cooperation between the three planes, the normal operation of the network, the effective forwarding of data packets, and the monitoring and management of network equipment are realized. This separation architecture can improve the scalability, reliability and security of the network, while maintaining the independence and functional focus between each plane.

[0066] Based on the above-mentioned three-plane separation design architecture of the analysis system, the embodiment of the present invention provides a large-bandwidth network traffic protocol identification and analysis method for how to evenly distribute data in network signal processing, how to identify network protocols, and how to extract metadata. Figures 1 to 3 , its workflow is as follows:

[0067] Step 101: Receive the original traffic of the network and store it in the form of data frames in the kernel state buffer. For example, in some embodiments of the present invention, the network interface card (NIC) directly receives high-speed traffic data from the external network through hardware, and these data are encapsulated into Ethernet frame format and stored in the kernel state buffer of the operating system. In order to meet the requirements of high bandwidth and low latency, the kernel state buffer adopts a multi-queue architecture, and realizes the initial dispersion of traffic through RSS technology. Each queue independently processes a part of the traffic, thereby avoiding data competition between queues and improving receiving efficiency.

[0068] Step 102: Based on the zero-copy technology, the data frame in the kernel-mode buffer is directly mapped to the user-mode memory area as the starting point for the data flow to enter the user-mode processing. For example, in some embodiments of the present invention, DPDK technology is used to establish a direct memory mapping between the user mode and the kernel mode. Zero-copy technology ensures that when the traffic data is transferred from the kernel-mode buffer to the user mode, no additional data copying is performed, thereby reducing memory bandwidth consumption and CPU overhead. This process is also based on the NUMA optimization strategy to allocate memory resources to the area closest to the physical distance of the computing core, thereby reducing memory access latency.

[0069] Step 103: According to the principle of same source and same destination, the data stream is logically classified based on the source address, destination address, source port and destination port, and the classified data stream is sent to the corresponding computing processing core through a dynamic distribution mechanism; wherein the dynamic distribution mechanism distributes the data stream to different computing processing cores through a load balancing strategy. For example, in some embodiments of the present invention, in the user state memory, the system logically classifies the data stream according to the traffic characteristics (such as source IP, destination IP, source port, destination port, protocol type, etc.). A hash algorithm is used to calculate the hash value of the traffic classification to ensure that the data frames of the same source session are allocated to the same computing core (same source and same destination principle), and the distribution process is completed through primary load balancing and secondary load balancing.

[0070] Level 1 load balancing: distributes received traffic to different CPU core channels according to data volume.

[0071] Secondary load balancing: Utilizes a dynamic distribution mechanism to dynamically adjust traffic distribution weights based on the real-time load status of the computing core to avoid uneven load and single-point bottlenecks.

[0072] Step 104: Each computing processing core will parse the assigned data stream layer by layer through the three-level pipeline architecture in turn; wherein, the three-level pipeline architecture includes three parsing stages: underlying protocol identification, pattern matching identification, and advanced protocol matching identification. The underlying protocol identification determines the underlying protocol type by parsing the link layer and network layer fields, the pattern matching identification parses the middle layer protocol through field matching rules and predefined pattern libraries, and the advanced protocol matching identification parses complex protocols by combining context information and state machine mechanisms; after the data stream is parsed at each stage, if the protocol type is determined, the result is directly output, otherwise it enters the next stage for parsing.

[0073] Specifically, in some embodiments of the present invention, in the computing processing core, the data stream enters the protocol parsing module, and the module performs the following parsing in sequence according to the layered protocol.

[0074] Bottom-layer protocol identification: Identify MAC address, frame type and other information in Ethernet frames.

[0075] Pattern matching recognition: parse network layer protocols (such as IPv4, IPv6) and transport layer protocols (such as TCP, UDP), and extract fields such as IP address, port number, and sequence number.

[0076] Advanced protocol matching: Deeply analyze application layer protocols (such as HTTP, DNS, FTP, etc.) to extract complete protocol fields and data content.

[0077] Step 105: Based on the recognition result of the protocol, call the adapted metadata extraction model in each computing processing core to extract metadata from the recognition result; wherein each metadata extraction model is bound to the protocol feature and automatically matched and called according to the result of the protocol parsing stage. For example, in some embodiments of the present invention, after the protocol parsing is completed, the system calls the adapted metadata extraction model to extract specific features of the data, for example:

[0078] For HTTP protocol, extract metadata such as URL, request method, status code, etc.

[0079] For the DNS protocol, extract metadata such as query domain names and response records;

[0080] For FTP protocol, extract metadata such as file transfer status and file name.

[0081] These metadata extraction models are predefined according to protocol characteristics, and the optimal extraction logic is automatically selected based on the parsing results of different protocol layers. The extracted metadata is used for traffic classification, monitoring and subsequent application analysis.

[0082] Step 106: Each computing processing core combines the protocol identification result and the metadata extraction result into a data queue and then outputs it. For example, in some embodiments of the present invention, after completing the protocol identification and metadata extraction, the system integrates the parsing result and the metadata result into a unified data structure to form a data queue. The structure of the data queue includes: protocol parsing result (layered field data), metadata extraction result (specific feature value) and additional information such as timestamp and traffic size.

[0083] Finally, the data queue is sent to the subsequent processing module for storage, further analysis or forwarding. The data output process supports multiple formats, such as JSON or Protobuf, to adapt to different downstream application scenarios.

[0084] In summary, it can be understood that this parsing method completes the reception, distribution, parsing and metadata extraction of network traffic, realizes efficient large-bandwidth data processing capabilities, and at the same time provides complete data support for subsequent network monitoring, threat detection and data analysis.

[0085] Regarding the zero copy technology implemented in step 102, more specifically, in some feasible embodiments of the present invention, in combination with Figure 3 ,Zero-copy technology is specifically a zero-copy based MFRU packet header data pre-fetch management algorithm, which adopts a two-level table structure of a first-level free table stack and a second-level bidirectional free list. When the network card puts the received data frame (including packet header and payload) into the memory through DPDK technology, the buffer pool mechanism of the MFRU algorithm will specifically manage the packet header data. Among them, the packet header data is a key part of data frame parsing and processing (for example, protocol parsing, data stream distribution, etc.). The MFRU algorithm centrally manages the unprocessed packet headers by building an efficient buffer pool to avoid frequent memory allocation and recovery overhead.

[0086] The details of the hierarchical management of the two-level table organization are as follows.

[0087] The first-level free table stack is used to manage all unallocated table entries, which are memory blocks used to store packet header data and are organized in paging to ensure efficient batch allocation and recycling. For example, during peak network traffic, when more memory needs to be allocated, the first-level stack will page the allocation table entries.

[0088] The second-level bidirectional free list is used to allocate and recycle the header data buffer. It is a structure that directly serves the data frame processing and stores the header buffer currently in use or to be allocated. Its bidirectional lock-free queue design avoids lock competition in a multi-threaded environment and improves multi-core parallel processing performance.

[0089] Based on the above, it can be understood that when distributing data frames, the system needs to determine the data flow characteristics based on the source IP, destination IP, port number and other fields in the packet header. At this time, the MFRU algorithm ensures that these packet header data are quickly extracted and stored in the buffer pool for efficient access by the distribution logic, and the bidirectional lock-free queue structure further reduces the delay during access, ensuring the real-time performance of the data flow distribution logic.

[0090] In addition, during the distribution process, the feedback mechanism needs to dynamically adjust the data flow allocation strategy, such as adjusting it according to the load or queue length. The MFRU algorithm enables the distribution module to efficiently manage and schedule memory resources by quickly allocating and recycling packet header buffers, thereby reducing the impact of memory management on the performance of the routing algorithm.

[0091] It is understandable that the core goal of zero copy is to avoid redundant memory copy operations. Once the data frame is received and stored in the memory, all subsequent operations (such as protocol parsing, distribution, and processing) are completed through pointer operations. M's zero-copy-based MFRU header data prefetch management algorithm ensures efficient and stable allocation and recovery of header data through a two-level table structure, providing memory management support for zero copy. The header buffer pool is responsible for managing the header data stored in the memory to ensure that this data can be transparently accessed in the user-mode process. The lock-free design avoids competition between kernel mode and user mode, greatly reducing context switching and memory access delays.

[0092] Regarding the allocation process of empty table entries and dynamic memory management, in some feasible embodiments of the present invention, the zero-copy-based MFRU packet header data pre-fetch management algorithm adopts a two-level table structure to construct a packet header data structure buffer pool equal to the number of buffer pools, each packet header data structure is a table entry, the size is 32 bytes and aligned according to the 128-bit boundary, so as to ensure that each packet header data structure is exactly a multiple of the bit width of the cache line and the channel bank of the memory, so as to maximize the use of the structure characteristics of the cache and memory. By storing this information in the packet header data structure and organizing it according to a specific alignment method, the access efficiency of this information can be improved, and it is also beneficial to the use of the cache.

[0093] More specifically, the MFRU algorithm uses a two-level header information free table management strategy. The first level is a large-capacity free table stack that stores all free table entries to be allocated to the second level. It adopts a paging design, in which the free table stack is divided into multiple pages, each of which contains a certain number of table entries. Here, the size of each page is 64K table entries, which means that the free table stack is divided into multiple pages of 64K in size. This paging design helps to organize and manage a large number of free table entries to improve the efficiency of allocation and recycling. The use of a stack algorithm means that each time a free table entry is allocated, the last (most recent) allocated page will be selected to ensure that the most frequently used page is allocated each time. This can improve the cache hit rate, because frequently used pages are likely to be used again, and these pages can be accessed faster through the stack algorithm.

[0094] The second level is a bidirectional free list, which is directly used to allocate and recycle the buffer queue used by unprocessed processes. It is constructed according to the number of protocol processing processes and adopts a bidirectional lock-free queue structure. The queue size is between the first set threshold and the second set threshold. In some feasible embodiments of the present invention, the queue size is between 32K and 128K entries. 32K as a threshold indicates that the system can effectively manage and allocate resources within this range of free entries while maintaining a high cache hit rate; when it exceeds 128K, the free entries are released to avoid excessive occupation of memory resources while maintaining the stability and performance of the system.

[0095] Based on the above, the following is the processing when the number of empty entries is less than 32K and greater than 128K:

[0096] When the number of free entries is lower than the 32K threshold, the system will invent paging to the first-level page table to obtain more free entries, and then insert these free entries into the second-level bidirectional free linked list.

[0097] When the number of empty table entries is greater than 128K, the system releases a 64K page of free table and pushes it into the first-level stack to free up space and maintain reasonable memory utilization.

[0098] It can be understood that, through this strategy of dynamically managing free table entries, the system can better handle data frame exchanges under different loads and improve data exchange efficiency and performance.

[0099] Now with Figure 3 Take the system in as an example, assuming that the system is processing a high-load network traffic scenario:

[0100] The network card receives data frames through DPDK, and the header and payload in the frame are stored in the memory. The MFRU algorithm allocates a free table entry in the buffer pool to store the header data. The system extracts the header data from the buffer pool, parses its source IP, destination IP, port number and other information, and distributes the data stream to the designated processing core according to the same source and same destination rule based on the parsing results.

[0101] If there are not enough free entries in the buffer pool (below the first-level threshold), the algorithm will invent pages from the first-level stack to expand the number of available entries; if the traffic decreases and there are too many free entries (exceeding the second-level threshold), the algorithm will recycle the excess entries to the first-level stack. After the data frame processing is completed, the entries of the packet header data are recycled to the buffer pool for use by the next batch of data frames.

[0102] Regarding how the classified data streams in step 103 are sent to the corresponding computing processing cores through a dynamic distribution mechanism, more specifically, in some feasible implementations of the present invention, a feedback two-level balanced routing algorithm is used to perform two-level distribution of data streams. The algorithm uses a two-level routing balanced distribution method to send the network data streams to be processed to the computing processing cores for parallel processing according to the principle of the same source and destination. The computing processing cores feed back the traffic monitoring data to the second-level balanced distribution core, and the second-level balanced distribution core adjusts the hash algorithm in real time according to the detection data to achieve dynamic balancing of the traffic.

[0103] On the basis of the above, refer to Figure 3 , Figure 3 The schematic diagram of the workflow of the feedback-type two-level balanced routing algorithm provided by the embodiment of the present invention is as follows: the first level adopts a multi-interface load cross-balanced routing algorithm to realize that multiple network card input data is sent to four CPU channels in a balanced manner, avoiding congestion and packet loss caused by unbalanced traffic between network cards, and making full use of the characteristics of the NUMA architecture to improve processing performance. The second level adopts a feedback-type dynamic balanced hash algorithm to solve the problem of evenly distributing data flows in the CPU channel to each processing core.

[0104] Specifically, the network data stream is received by multiple NICs, and each NIC distributes the received data stream to multiple receive side scaling (RSS) queues for preliminary load balancing. Through direct memory access (DMA) technology, the data is transferred from the RSS queue of the NIC to the corresponding NUMA (non-uniform memory access) memory area, where the NUMA memories are NUMA memory 1, NUMA memory 2, NUMA memory 3 and NUMA memory 4, and each NUMA memory area corresponds to a different CPU. The data in each NUMA memory area is transferred to the corresponding distribution queue for further processing. In each CPU, a second-level balanced distribution core and a computing processing core are included to monitor the load of the computing processing core of each processing core during the protocol parsing and metadata extraction process, and the monitoring data is fed back to the second-level balanced distribution core. The monitoring data includes information such as the current load and processing efficiency of each computing processing core.

[0105] The second-level balanced distribution core dynamically adjusts the hash algorithm based on the monitoring data and distributes the data stream to the appropriate computing plane processing core. For more information on how to dynamically adjust the hash function, refer to Figure 4 , Figure 4 The schematic diagram of the operation flow of the feedback dynamic hash algorithm provided in the embodiment of the present invention specifically includes the following judgment steps.

[0106] Determine whether the data stream received by the processing core is continuously unbalanced and overloaded. If yes, proceed to S201: count the current session quantity and growth rate during processing verification, and feed back to the distribution processing core; if no, end.

[0107] Determine whether the current number of sessions and the growth rate exceed the threshold. If yes, proceed to S202: the distribution core reselects the hash function; if no, end.

[0108] After the hash function is switched, it is determined whether the data flow has the same source and destination. If yes, proceed to S203: when the data packet arrives, calculate two hash values ​​and search the data flow table on the meta-hash routing path; if no, end.

[0109] Determine whether the old hash algorithm value is hit in the data flow table. If yes, proceed to S204: perform routing according to the original hash algorithm value; if no, end.

[0110] After the flow table is updated, it is determined whether the timeout period has expired and no new traffic has been added. If yes, proceed to S206: perform route calculation according to the new hash algorithm; if no, end.

[0111] Determine whether there is no old route hit within the set time window. Yes: indicates that the hash function switch is completed; No: End.

[0112] The hash algorithm is dynamically adjusted to distribute the data stream to each computing processing core. Each computing processing core processes the assigned data stream in parallel, and the processed data is sent back to the network through the output queue and NIC.

[0113] In summary, the feedback two-level balanced routing algorithm realizes efficient parallel processing of network data flow through a two-level balanced distribution method, and ensures balanced distribution of traffic and efficient operation of the system by dynamically adjusting the hash algorithm.

[0114] Protocol parsing and metadata extraction are performed with session flow as the granularity. Therefore, access to the flow table is one of the most frequent operations and is also the key bottleneck operation to be optimized. In an embodiment of the present invention, the flow table management layer adopts a distributed hash flow table management algorithm based on the Splay tree. This algorithm is different from traditional sharing technologies (such as shared memory or shared databases). The distributed hash flow table management algorithm based on the Splay tree achieves independence by distributing the flow table on each processing core, thereby avoiding competition for shared resources. The flow table is distributed on each processing core, and the scale of a single flow table is greatly reduced, making the management burden on each processing core lighter and improving processing efficiency. Since the flow tables are independent of each other and not shared, the algorithm can better utilize the parallelism of the processing core, thereby improving the overall processing power and throughput.

[0115] Regarding how to search the session flow table, in some feasible embodiments provided by the present invention, refer to Figure 5 , the specific process is as follows.

[0116] Step 301: Select a hash function and a loading factor; that is, select according to specific scenarios and data characteristics.

[0117] Step 302: Calculate the hash value of the flow table item to be searched through the hash function, and search the corresponding flow table item in the hash table according to the hash value. The system first searches the corresponding position in the hash table according to the calculated hash value. If the flow table item is found at this position, the result is directly returned. If a hash conflict occurs, go to step 303.

[0118] Step 303: When a hash conflict occurs at a corresponding position in the hash table, the data where the hash conflict occurs is stored in the Splay tree structure queue, and the hash value of the flow table item to be searched is repeatedly compared with the node of the Splay tree until the target flow table item is found. That is, in the hash table, if multiple data are mapped to the same position, the system needs to process further. At this time, the system can search for conflicting data through the Splay tree structure queue.

[0119] The system searches for conflicting data stored in the Splay tree structure queue. The Splay tree is a self-adjusting binary search tree that can adjust frequently accessed nodes to the root node position through rotation operations, thereby improving search efficiency.

[0120] Once the flow table entry corresponding to the conflicting data is found in the Splay tree, the system can return the corresponding result.

[0121] Among them, regarding how to search in the Splay tree: before searching, you first need to perform a series of Splay operations to move the data item to be searched to the root node of the tree. Once the target node (that is, the hash value of the flow table item to be searched) is moved to the root node, the system will compare the hash value of the flow table item to be searched with the value of the current root node. According to the comparison result, the system will move the target node to the appropriate position along the node movement path of the Splay tree. If the value of the target node is less than the value of the current node, it will move to the left subtree; if it is greater than the value of the current node, it will move to the right subtree. The system will repeat the comparison and node movement operations until the target node is found, or it is determined that the target node does not exist in the tree. Once the target node is found, the system will make a final position adjustment to ensure that the target node is at the root node position of the tree. In this way, the target node can be accessed faster the next time the same data is searched.

[0122] On the basis of the above, considering that frequent deletion of session flows may also cause bottleneck problems in flow table access, in some feasible embodiments of the present invention, a bidirectional linked list is used to manage the queue of the online flow table. According to the principle of locality, the new session flow is queued using the tail insertion method. The timeout scan is not performed in a timer manner, but is driven by the number of arriving data packets. A portion of the table is scanned each time, and the smooth timeout scan occupies computing resources.

[0123] The following is an example of optimizing the management of a doubly linked list queue using Python:

[0124] def_init_(self, data):

[0125] self.data = data

[0126] self.prev = None

[0127] self.next = None

[0128] class DoublyLinkedList:

[0129] def_init_(self):

[0130] self.head=None

[0131] self.tail = None

[0132] def append(self,data):

[0133] new_node=Node(data)

[0134]

[0135] def perform_timeout_scan():

[0136] #Execute the timeout scanning logic and process some flow table entries each time

[0137] Faced with the complex and fast-changing types and structures of existing network protocols, the accuracy and completeness of protocol type parsing have become more difficult, and real-time parsing and metadata extraction are difficult under high load and high concurrency conditions. In the embodiment provided by the present invention, the computing plane uses five protocol identification methods based on different parameters and features. The five identification methods based on different parameters and features are specifically described as follows.

[0138] The underlying protocol identification method is responsible for preliminary identification based on the basic characteristics of the data packet and the protocol header information; by using underlying protocol analysis techniques such as port identification, protocol identifiers, etc., the output includes the preliminary identified protocol type or characteristics.

[0139] The pattern matching recognition method confirms the protocol type by comparing the data packet content with the predefined pattern; by using pattern matching algorithms such as regular expression matching, feature code matching, etc., the confirmed protocol type or feature is output.

[0140] The logical association packet identification method further determines the protocol type by analyzing the logical association relationship between data packets; by using logical association analysis technology, such as TCP / IP connection status analysis, data packet sequence relationship, etc., it outputs further confirmed protocol types or characteristics.

[0141] The multi-association layer matching method combines the information and association relationships of multiple data packets to comprehensively determine the protocol type of the data packet; by using multi-association layer matching algorithms, such as protocol interaction pattern matching, multi-traffic feature analysis, etc., it outputs the comprehensive identification results of the data packet.

[0142] Statistical analysis characteristic method,Finally, the data packet enters the statistical analysis characteristic model for further characteristic,analysis and confirmation. The model finally determines the protocol type of the data packet through statistical analysis of the,characteristics of the data packet and outputs the final confirmed protocol type or,characteristic.

[0143] Based on the above five protocol identification methods, considering the complexity of the identification algorithm, hierarchical iterative calculation is implemented, and the host is progressively accurate. In some feasible embodiments of the present invention, a high-speed DPI engine based on a three-level pipeline matching architecture is designed and implemented. The data stream passes through the three-level pipeline architecture in sequence, that is, through the underlying protocol identification, pattern matching identification and high-level protocol matching in sequence, and the protocol identification and parsing are completed at one time. Figure 6 , Figure 6 The principle block diagram of the high-speed DPI engine based on the three-stage pipeline architecture provided by the embodiment of the present invention is as follows.

[0144] The underlying protocol identification method is used as the first level of identification to identify the underlying protocol with few rules and accuracy. By extracting IP header information and port numbers, algorithm identification is performed based on layer 3 / 4 features to achieve fast and accurate protocol identification.

[0145] Pattern matching recognition is used as the second level of recognition to handle more complex protocol recognition needs. Through the pattern matching algorithm, the pattern in a specific data packet is identified, thereby identifying the corresponding protocol type and achieving more sophisticated protocol recognition and processing.

[0146] Logical association packet identification method, multi-association layer matching method and statistical analysis characteristic method are used as the third-level identification, using regular matching, logical model matching and statistical analysis identification algorithm processing. By analyzing multi-level association, logical association and statistical characteristics, complex protocol types can be identified. These algorithms combined can improve the accuracy and efficiency of protocol identification.

[0147] Based on the above, it can be understood that the data packet first enters the underlying protocol identification algorithm (first-level identification) for fast and accurate rule identification. After the first-level identification is completed, the identification result is passed to the pattern matching identification algorithm (second-level identification) for more complex protocol identification processing. The data packet is then passed to the third-level identification, including the logical association data packet identification algorithm, the multi-association layer matching model and the statistical analysis characteristic model to handle more complex protocol identification requirements.

[0148] Through the three-level pipeline matching architecture, the data flow can pass through the pipeline architecture once, and after the three-level identification process of hierarchical iterative calculation, the accurate identification and analysis of the data packet can be achieved, thereby greatly improving the efficiency and accuracy of protocol identification. This design can effectively cope with the needs of protocol identification of different complexities and provide a more efficient and accurate solution for network data processing.

[0149] In order to realize the rapid extraction of different types of metadata, according to the extraction method and hierarchical granularity, in the embodiment of the present invention, four extraction method models are constructed in the computing plane. Figure 7 , Figure 7This is a principle block diagram of four metadata extraction models provided in the embodiments of the present invention.

[0150] The packet-driven metadata extraction model extracts the IP header and data part of the data packet, analyzes the data part, extracts the relevant metadata, and then outputs it. For example, the extraction of OSPF protocol packets.

[0151] The stream-driven metadata extraction model extracts data packets from the data stream, then extracts the IP header and data part of each data packet, and then extracts the relevant metadata after analyzing the entire stream data, such as the username and password extraction in the Telnet protocol.

[0152] The tunnel logical session drives the metadata extraction model, extracting the logical session information from the tunnel protocol data, then extracting the data packet, extracting the IP header and data part from the data packet, and outputting the relevant metadata by analyzing the logical session data, such as the session ID extraction of the L2TP protocol.

[0153] The event-driven metadata extraction model extracts the IP header and data part of the data, analyzes it according to the protocol requirements, extracts the corresponding metadata based on the analysis results, and outputs it. For example, metadata extraction in the ESP protocol.

[0154] From the above architecture, it can be seen that the pattern matching algorithm is the most frequently used algorithm in both the protocol identification process and the metadata extraction process, and its efficiency determines the real-time identification performance of various applications. In order to achieve multi-mode line-speed matching processing for various applications at a time complexity of O(n), in some feasible embodiments of the present invention, an automatic multi-mode matching algorithm based on perfect hashing is designed in the second-level identification.

[0155] Specifically, since the protocol feature rule library used for matching is static, the library can be preprocessed during compilation to construct a minimal perfect hash function for it. If a hash function satisfies any different key value x i and x j , if and only if i=j, then h(x i )=h(x j ), is a perfect hash function, that is, when a key value set L is hashed, no conflict occurs.

[0156] Assume that there is a static protocol feature rule base containing the following rules, which are taken as the key-value set L:

[0157] Rule 1: Protocol type: HTTP

[0158] Rule 2: Protocol type: FTP

[0159] Rule 3: Protocol type: SSH

[0160] Construct a key-value collection:

[0161] L={HTTP,FTP,SSH}

[0162] Choose appropriate parameters a and b to construct the hash function, usually randomly selected non-zero integers;

[0163] For a given key value x, the hash value is calculated by the hash function h(x):

[0164] h(x)=((ax+b)mod p)mod m

[0165] Where m is the size of the hash table, usually determined by the number of patterns that need to be stored; p is a large prime number, usually large enough to avoid conflicts;

[0166] For rule 1: Protocol type: HTTP

[0167] h(HTTP)=((a×ASCII value of H+b)mod p)mod m

[0168] For rule 2: Protocol type: FTP

[0169] h(FTP)=((a×ASCII value of F+b)mod p)mod m

[0170] For rule 3: Protocol type: SSH

[0171] h(SSH)=((a×ASCII value of S+b)mod p)mod m

[0172] Here, the ASCII value of each character is used instead of the key value. After the hash value is calculated, these rules are stored in the hash table to ensure that each hash value corresponds to a unique rule.

[0173] Next, these hash values ​​are stored in a hash table for fast pattern matching during data stream matching.

[0174] During the data stream matching process, a hash calculation is performed on part of the data stream, and a corresponding hash value is searched in the hash table to achieve pattern matching.

[0175] On the basis of the above, regarding the matching of the rule base, in some feasible embodiments of the present invention, the AC algorithm is adopted. The AC algorithm is a multi-pattern matching algorithm used to find the occurrence positions of multiple pattern strings in a text, and the minimum perfect hash function is used to quickly match and identify specific rules or keywords.

[0176] First, an automaton is constructed using the AC algorithm, which contains all the pattern strings to be matched (strings in the rule base). The construction process of the AC automaton can ensure efficient search for the occurrence positions of multiple pattern strings in the text.

[0177] Refer to the above steps to design a minimal perfect hash function.

[0178] For each string to be matched, first use the AC automaton to match it in the text and find the matching position.

[0179] The matching position is then verified using a minimal perfect hash function to ensure that the matched string is a valid string in the rule base.

[0180] In some feasible embodiments of the present invention, regarding the generation of the matching string, the data packet is not fully matched, but the 12 dimensions of the first 5 frames of each protocol are selected for splicing of 256 bytes of data. Wherein, the selection of the dimension is based on the partial position data of the most frequently appearing characteristic words in the protocol, and the character string is processed by the MPHF-AC algorithm to obtain a matching vector of multiple characteristic words. The vector includes position information and a string label of successful matching. This design realizes the rapid identification of the features of a specific protocol in a data packet without the need to fully match the entire data packet. By selecting key dimensions and characteristic words, protocol features can be effectively identified and matched, and these matches can be efficiently processed using the MPHF-AC algorithm to obtain position information and a string label of successful matching.

[0181] In addition, considering that if the value of the matching vector meets multiple protocol feature items, in some embodiments of the present invention, the DFA algorithm is used to further verify and identify the specific protocol. The DFA algorithm can accurately identify whether the input meets a specific pattern or rule based on the predefined state transition rules and terminal states.

[0182] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. The patent protection scope of the present invention shall be based on the claims. All equivalent structural changes made using the contents of the description and drawings of the present invention should also be included in the protection scope of the present invention.

Claims

1. A method for assessing sense of security in high-intensity urban areas based on the coupling of multi-source spatial elements, characterized by: The steps include: Receive the original traffic from the network and store it in the kernel buffer in the form of data frames; Based on the zero-copy technology, the data frame in the kernel buffer is directly mapped to the user-state memory area as the starting point for the data flow to enter the user-state processing; According to the principle of same source and same destination, the data flow is logically classified based on the source address, destination address, source port and destination port, and the classified data flow is sent to the corresponding computing processing core through a dynamic distribution mechanism; wherein the dynamic distribution mechanism distributes the data flow to different computing processing cores through a load balancing strategy; Each of the computing processing cores will parse the assigned data stream layer by layer through a three-level pipeline architecture in turn; wherein the three-level pipeline architecture includes three parsing stages: bottom-level protocol identification, pattern matching identification, and high-level protocol matching identification. The bottom-level protocol identification determines the bottom-level protocol type by parsing the link layer and network layer fields, the pattern matching identification parses the middle-level protocol through field matching rules and a predefined pattern library, and the high-level protocol matching identification parses complex protocols by combining context information and a state machine mechanism; after the data stream is parsed at each stage, if the protocol type is determined, the result is directly output, otherwise it enters the next stage for parsing; Based on the recognition result of the protocol, an adapted metadata extraction model is called in each of the computing processing cores to extract metadata from the recognition result; wherein each metadata extraction model is bound to the protocol feature and automatically matched and called according to the result of the protocol parsing stage; Each of the computing processing cores combines the protocol identification result and the metadata extraction result into a data queue and then outputs it.

2. The method for evaluating sense of security in high-intensity urban areas based on coupling of multi-source spatial elements according to claim 1 is characterized in that: The zero-copy technology is specifically a zero-copy-based MFRU header data pre-fetch management algorithm, which adopts a two-level table structure of a first-level free table stack and a second-level bidirectional free linked list, and allocates a free table entry in the kernel buffer for storing header data in the data frame; specifically: When the number of free table entries in the buffer is lower than a first set threshold, the algorithm creates a page call to the first-level free table stack to expand the number of available table entries. When the number of free entries in the buffer is greater than a set second threshold, the algorithm releases the free entries and recycles them into the first-level free table stack.

3. According to claim 1, a method for identifying and analyzing a large bandwidth network traffic protocol is characterized in that: The load balancing strategy specifically adopts a feedback two-level balanced routing algorithm to perform two-level distribution of data streams, specifically: The first stage obtains the real-time load information of each computing node and sends the data stream to the computing node according to the principle of same source and same destination according to the load situation; In the second stage, inside each computing node, based on the load monitoring data of the computing processing core, the hash algorithm is dynamically adjusted and the data stream is distributed to each computing processing core again, so as to achieve balanced distribution of data streams within the computing node.

4. According to claim 1, a method for identifying and analyzing a large bandwidth network traffic protocol is characterized in that: During the identification and parsing process of the protocol, a distributed hash flow table management algorithm based on the Splay tree is used to build a distributed flow table according to the number of computing processing cores. Each computing processing core independently maintains a flow table with a Splay tree structure. When the data flow reaches the computing processing core, the corresponding flow table entry is searched in the Splay tree. If the corresponding flow table entry is found, the protocol status stored in the flow table is directly obtained; If the corresponding flow table entry is not found, a new flow table entry is created and inserted into the Splay tree.

5. According to claim 1, a method for identifying and analyzing a large bandwidth network traffic protocol is characterized in that: The bottom layer protocol identification and parsing stage in the three-stage pipeline architecture is responsible for quickly identifying the link layer and network layer protocol types of the data packet, as the basic stage of protocol parsing; specifically, this stage performs preliminary identification based on the basic characteristics of the data packet and the protocol header information, and identifies the data link layer and the network layer; If the link layer or network layer protocol type is successfully identified, the protocol identification result is directly output and the data stream is parsed; If the protocol type cannot be determined, the data stream enters the next stage of pattern matching identification and parsing.

6. A method for identifying and analyzing a large bandwidth network traffic protocol according to claim 5, characterized in that: The pattern matching recognition and parsing stage in the three-stage pipeline architecture is responsible for further identifying the transport layer protocol type of the data packet, and confirming the transport layer protocol type by comparing the data packet content with the predefined matching pattern; specifically, a minimum perfect hash function is constructed to map the predefined matching pattern to a unique hash value to avoid hash conflicts and achieve fast matching, and regular expression matching and feature code matching are used to locate the protocol feature field; If the transport layer protocol type is successfully confirmed, the protocol identification result is directly output and the data stream is parsed; If the protocol type cannot be determined, the data stream enters the next stage of advanced protocol matching.

7. A method for identifying and analyzing a large bandwidth network traffic protocol according to claim 6, characterized in that: The advanced protocol matching, identification and parsing stage in the three-stage pipeline architecture is responsible for identifying complex application layer protocol types. This stage combines the logical association data packet identification method, the logical association data packet identification method and the statistical analysis characteristic method to identify the application layer protocol; correspondingly: Logical association data packet identification method defines the protocol context by analyzing the logical association relationship between data packets; Multi-association layer matching method combines the information and association relationships of multiple data packets to determine the application layer protocol type; Statistical analysis method, which uses traffic statistics to analyze the protocol; Output the complete protocol parsing results and complete the parsing of the data stream.

8. The method for identifying and analyzing a large bandwidth network traffic protocol according to claim 1, characterized in that: Based on the recognition result of the protocol, the adapted metadata extraction model is called in each of the computing processing cores to extract metadata, correspondingly: The packet-driven metadata extraction model extracts relevant metadata by extracting the IP header and data part of a single data packet; The stream-driven metadata extraction model extracts relevant metadata by analyzing the data packets in the entire data stream; The tunnel logical session driven metadata extraction model extracts the logical session information from the tunnel protocol data and extracts the relevant metadata after analyzing the logical session data; The event-driven metadata extraction model first extracts the IP header and data part of the data, analyzes it according to the protocol requirements, and then extracts the corresponding metadata.

9. The method for identifying and parsing a large bandwidth network traffic protocol according to claim 1, characterized in that: Each of the computing processing cores integrates the protocol identification result and the metadata extraction result into a data queue, and manages the data queue by a bidirectional lock-free linked list. Specifically: When the data queue output is completed, it is marked as processed, and the computing processing core stores the processed data queue into a bidirectional lock-free linked list; The packet header table entries in the data queue are recovered through the MFRU packet header data pre-fetching management algorithm, and are re-added to the first-level idle stack for use by subsequent data flows.

10. A high-bandwidth network traffic protocol identification method analysis system, used to implement the protocol identification and analysis method described in any one of claims 1 to 9, characterized in that: The analysis system adopts an architecture based on the separation of three planes: data, control and computation, where: The data plane is used to receive network traffic data, perform preliminary classification and distribution of the data, and ensure that the traffic can enter the user state for processing; wherein, the reception, classification and distribution of traffic data are completed through the MFRU packet header data pre-fetching management algorithm and the secondary feedback balanced routing algorithm; The computing plane is used to perform protocol identification and analysis and metadata extraction on the data flow; wherein, the flow protocol identification and analysis and metadata extraction are completed by the Splay tree flow table management algorithm, and the data queue is managed in combination with the MFRU packet header data pre-fetching management algorithm; The control plane is used to manage resource allocation, policy adjustment and global load balancing; wherein, flow table optimization and global load balancing are performed through the Splay tree flow table management algorithm and the secondary feedback balanced routing algorithm.

Images