A message processing method, apparatus, electronic device, and storage medium

Abstract

This invention relates to the field of cloud computing technology and discloses a message processing method, apparatus, electronic device, and storage medium. The method includes: acquiring the current environment information of the host machine; determining the upper limit of the kernel-state flow table of the virtual switch based on the current environment information of the host machine; determining the kernel-state message interception conditions of the virtual switch based on the upper limit of the kernel-state flow table of the virtual switch; and intercepting the target message in the unprocessed message to be transmitted to the kernel state of the virtual switch when the number of kernel-state flow tables of the virtual switch meets the kernel-state message interception conditions. By predicting the upper limit of the kernel-state flow table of the virtual switch in advance and accurately controlling the number of kernel-state flow tables of the virtual switch, network bottlenecks caused by excessive kernel-state flow tables are effectively avoided, message processing efficiency is improved, and thus the network stability and operating efficiency of the cloud computing management platform are guaranteed.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a message processing method, apparatus, electronic device and storage medium. Background Technology

[0002] With the development of cloud computing technology, cloud management platforms have been widely used. Open Virtual Switch (OVS), as an open-source virtual switch software, is often used in cloud management platforms. OVS implements software switches with functions similar to most physical switches. However, as cloud management platforms experience increased network traffic due to a growing number of users, network bottlenecks may occur during the application of OVS, potentially leading to data loss.

[0003] In related technologies, when OVS reaches a network bottleneck, it typically analyzes the flow tables of all pending packets in the kernel mode, merges the flow table entries of pending packets with common characteristics, and then processes these pending packets in a merged manner.

[0004] However, the above methods can only be used to merge packets after the OVS network bottleneck problem occurs, and the merging process is quite cumbersome. Not only can it not fundamentally solve the network bottleneck problem of the cloud computing management platform, it also reduces the processing efficiency of packets to be processed. Summary of the Invention

[0005] This application provides a message processing method, apparatus, electronic device, and storage medium to address the shortcomings of related technologies, such as the inability to fundamentally solve the network bottleneck problem of cloud computing management platforms and the reduction of message processing efficiency.

[0006] The first aspect of this application provides a message processing method, including:

[0007] Obtain the current environment information of the host machine; wherein, the host machine is equipped with a virtual switch;

[0008] Based on the current environment information of the host machine, determine the upper limit of the kernel-state flow table of the virtual switch;

[0009] The kernel-mode packet interception conditions of the virtual switch are determined based on the upper limit value of the kernel-mode flow table of the virtual switch.

[0010] If the number of kernel-mode flow tables in the virtual switch meets the kernel-mode packet interception conditions, the target packet in the pending packet to be transmitted to the kernel mode of the virtual switch is intercepted.

[0011] In one optional implementation, determining the upper limit of the kernel-state flow table of the virtual switch based on the current environment information of the host machine includes:

[0012] Under a preset experimental environment, stress tests are performed on the host machine to obtain test environment information of the host machine under different numbers and types of pending messages; wherein, the test environment information includes at least processor utilization, memory usage, disk performance indicators and network performance indicators;

[0013] Based on the test environment information, multiple feature vectors are constructed; wherein, the feature vectors include various host machine performance indicators and the number of kernel-state flow tables;

[0014] The multiple feature vectors are divided into a model training sample set and a model test sample set;

[0015] Based on the model training sample set and the model test sample set, a kernel-state flow table upper limit prediction model is constructed.

[0016] The current environment information of the host machine is input into the kernel state flow table upper limit prediction model, so as to determine the kernel state flow table upper limit of the virtual switch based on the current environment information and the kernel state flow table upper limit prediction model.

[0017] In one optional implementation, the step of intercepting the target packet in the pending packet to be transmitted to the kernel state of the virtual switch when the kernel state flow table number of the virtual switch meets the kernel state packet interception condition includes:

[0018] If the number of kernel-mode flow tables of the virtual switch meets the kernel-mode packet interception condition, the kernel-mode flow tables of the virtual switch are subjected to classification feature extraction to obtain the classification feature information of each kernel-mode flow table of the virtual switch; wherein, the classification feature information includes at least destination address, source address, protocol type and packet type;

[0019] Based on the classification feature information of each kernel state flow table, the kernel state flow tables are classified to obtain the corresponding kernel state flow table classification results;

[0020] Based on the kernel-state flow table classification results, determine the abnormal kernel-state flow table type that caused the surge in the number of kernel-state flow tables of the virtual switch;

[0021] Based on the abnormal kernel state flow table type, target packets are filtered from the pending packets to be transmitted to the virtual switch kernel state, and the target packets are intercepted.

[0022] In one optional implementation, determining the abnormal kernel-state flow table type that causes a surge in the number of kernel-state flow tables of the virtual switch based on the kernel-state flow table classification results includes:

[0023] Based on the kernel state flow table classification results, various kernel state flow table types are determined, and corresponding type groups are performed to determine the number of kernel state flow tables in each group of the kernel state flow table types.

[0024] Based on the number of kernel-state flow tables within each group of the aforementioned kernel-state flow table types, the kernel-state flow table type with the highest number of kernel-state flow tables within the group is identified as the abnormal kernel-state flow table type that causes a surge in the number of kernel-state flow tables of the virtual switch.

[0025] In one optional implementation, the step of filtering target packets from the packets to be processed and transmitted to the virtual switch kernel state according to the abnormal kernel state flow table type, and intercepting the target packets, includes:

[0026] Based on the abnormal kernel state flow table type, determine the abnormal kernel state flow table configuration information;

[0027] Based on the abnormal kernel state flow table configuration information, the target packet is filtered from the pending packets to be transmitted to the virtual switch kernel state; wherein the configuration information of the target packet matches the abnormal kernel state flow table configuration information.

[0028] Based on the abnormal kernel state flow table configuration information, a corresponding abnormal packet interception command is constructed to intercept the target packet.

[0029] In one optional implementation, the method further includes:

[0030] If the number of kernel-mode flow tables in the virtual switch meets the kernel-mode packet interception conditions, an abnormal alarm message is generated.

[0031] The abnormal alarm information includes abnormal kernel-state flow table configuration information and abnormal message interception commands.

[0032] In one optional implementation, determining the kernel-mode packet interception conditions of the virtual switch based on the upper limit value of the kernel-mode flow table of the virtual switch includes:

[0033] Obtain the virtual switch flow table threshold issued by the user;

[0034] The kernel-mode packet interception conditions of the virtual switch are determined based on the virtual switch flow table threshold and the kernel-mode flow table upper limit.

[0035] The kernel-mode packet interception condition includes at least the kernel-mode flow table interception value. When the number of kernel-mode flow tables of the virtual switch reaches the kernel-mode flow table interception value, it is determined that the kernel-mode packet interception condition is met.

[0036] A second aspect of this application provides a message processing apparatus, comprising:

[0037] An acquisition module is used to acquire the current environment information of the host machine; wherein, the host machine is equipped with a virtual switch;

[0038] The first determining module is used to determine the upper limit value of the kernel state flow table of the virtual switch based on the current environment information of the host machine;

[0039] The second determining module is used to determine the kernel-mode packet interception conditions of the virtual switch based on the upper limit value of the kernel-mode flow table of the virtual switch.

[0040] The processing module is used to intercept the target packet in the unprocessed packet to be transmitted to the kernel state of the virtual switch when the number of kernel state flow tables of the virtual switch meets the kernel state packet interception conditions.

[0041] A third aspect of this application provides an electronic device, comprising: at least one processor and a memory;

[0042] The memory stores computer-executed instructions;

[0043] The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the method described in the first aspect above and various possible designs of the first aspect.

[0044] The fourth aspect of this application provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the method described in the first aspect above and various possible designs of the first aspect.

[0045] The fifth aspect of this application provides a computer program product including computer instructions for causing a computer to perform the methods described in the first aspect above and various possible designs of the first aspect.

[0046] The technical solution of this application has the following advantages:

[0047] This application provides a message processing method, apparatus, electronic device, and storage medium. The method includes: acquiring current environment information of a host machine; wherein the host machine deploys a virtual switch; determining the upper limit of the kernel-state flow table of the virtual switch based on the current environment information of the host machine; determining the kernel-state message interception condition of the virtual switch based on the upper limit of the kernel-state flow table of the virtual switch; and intercepting the target message in the unprocessed message to be transmitted to the kernel state of the virtual switch when the number of kernel-state flow tables of the virtual switch meets the kernel-state message interception condition. The method provided above, by predicting the upper limit of the kernel-state flow table of the virtual switch in advance and accurately controlling the number of kernel-state flow tables of the virtual switch, effectively avoids network bottlenecks caused by excessive kernel-state flow tables, improves message processing efficiency, and thus ensures the network stability and operating efficiency of the cloud computing management platform. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings.

[0049] Figure 1 This is a schematic diagram of the message processing system on which the embodiments of this application are based;

[0050] Figure 2 A flowchart illustrating the message processing method provided in this application embodiment;

[0051] Figure 3 A flowchart illustrating the packet processing of a virtual switch provided in this application embodiment;

[0052] Figure 4 A schematic diagram illustrating the training process of an exemplary kernel-state flow table upper limit prediction model provided in this application embodiment;

[0053] Figure 5 This is a schematic diagram of the structure of the message processing apparatus provided in the embodiments of this application;

[0054] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0055] The accompanying drawings have illustrated specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the present disclosure in any way, but rather to illustrate the concepts of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0057] Furthermore, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. In the following descriptions of embodiments, "a plurality of" means two or more, unless otherwise explicitly defined.

[0058] With the development of cloud computing technology, cloud management platforms are gaining popularity among users. However, as the user base of cloud management platforms expands, so too does the network traffic. Excessive network traffic can lead to network performance bottlenecks in cloud management platforms. This can range from minor issues like network lag and unstable data transmission in the user environment to major problems like data loss, system crashes, and incalculable losses. Although network modules in cloud computing have matured significantly, virtualized networks in cloud platforms can still reach performance bottlenecks under certain abnormal situations such as traffic surges and broadcast floods, causing interruptions to normal business operations and posing certain risks to users.

[0059] Openvswitch (OVS) is a high-quality, multi-layered virtual switching software. Its purpose is to support large-scale network automation through programmable extensions, while also supporting standard management interfaces and protocols. As an open-source virtual switching software, OVS implements software-defined switches with functionalities similar to most commercial closed-source switches and is widely used in production environments. Currently, the main network bottleneck in OVS is packet loss caused by excessive flow table entries in the kernel space being sent to user space for processing and delayed user space processing. To address this bottleneck, current OVS-based cloud computing platforms often solve the problem by merging flow table entries, increasing system resources, or modifying kernel parameters. Merging flow table entries is an adjustment made after the problem occurs and requires comparing flow tables one by one to merge entries with common characteristics, which is cumbersome and cannot prevent the problem from occurring. Increasing system resources may lead to increased costs or resource waste. Modifying kernel parameters may cause system instability, performance degradation, resource waste, complex maintenance, upgrades, and compatibility issues.

[0060] To address the aforementioned issues, this application provides a message processing method, apparatus, electronic device, and storage medium. The method includes: acquiring current environment information of a host machine; wherein the host machine deploys a virtual switch; determining the upper limit of the kernel-state flow table of the virtual switch based on the current environment information of the host machine; determining kernel-state message interception conditions of the virtual switch based on the upper limit of the kernel-state flow table of the virtual switch; and intercepting target messages in unprocessed messages to be transmitted to the kernel state of the virtual switch when the number of kernel-state flow tables of the virtual switch meets the kernel-state message interception conditions. The method provided by the above solution effectively avoids network bottlenecks caused by excessive kernel-state flow tables by predicting the upper limit of the kernel-state flow table of the virtual switch in advance and accurately controlling the number of kernel-state flow tables of the virtual switch, thereby improving message processing efficiency and ensuring the network stability and operational efficiency of the cloud computing management platform.

[0061] The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present invention will now be described with reference to the accompanying drawings.

[0062] First, the structure of the message processing system on which this application is based will be described:

[0063] The message processing method, apparatus, electronic device, and storage medium provided in this application are applicable to processing data packets sent to a virtual switch. Figure 1 The diagram shows the structure of the message processing system based on the embodiments of this application, mainly including a data acquisition device, a virtual switch, and a message processing device. This message processing system is configured on a host machine, and the cloud computing management platform consists of multiple host machines. The data acquisition device collects the current environment information of the host machine and sends the collected information to the message processing device. The message processing device predicts the upper limit of the virtual switch kernel-mode flow table based on the obtained information and intercepts target packets based on the prediction results to prevent target packets from entering the virtual switch.

[0064] This application provides a message processing method for processing data packets sent to a virtual switch. The execution subject of this application is an electronic device, such as a server, desktop computer, laptop computer, tablet computer, or other electronic device that can serve as a host to deploy a virtual switch.

[0065] like Figure 2 The diagram shown is a flowchart illustrating a message processing method provided in an embodiment of this application. The method includes:

[0066] Step 201: Obtain the current environment information of the host machine.

[0067] The host machine is equipped with a virtual switch. The current environment information of the host machine includes the current CPU utilization, current memory usage, current disk performance indicators (disk I / O), and network performance indicators (network I / O). The current environment information reflects the real-time operating status of the host machine and provides a basis for subsequent decision-making.

[0068] Step 202: Determine the upper limit of the kernel-mode flow table of the virtual switch based on the current environment information of the host machine.

[0069] Specifically, a specific algorithm or model can be used to determine the upper limit of the kernel-mode flow table of the virtual switch under the current operating state of the host machine, based on the current environment information of the host machine.

[0070] Step 203: Determine the kernel-mode packet interception conditions of the virtual switch based on the upper limit value of the kernel-mode flow table of the virtual switch.

[0071] Specifically, corresponding kernel-mode packet interception conditions can be set based on the determined upper limit of the kernel-mode flow table. These kernel-mode packet interception conditions are used to determine whether to initiate packet interception operations at each time point, ensuring the stable operation of the virtual switch.

[0072] Specifically, in one embodiment, the virtual switch flow table threshold issued by the user can be obtained; based on the virtual switch flow table threshold and the upper limit of the kernel flow table, the kernel-mode packet interception conditions of the virtual switch can be determined.

[0073] Among them, the kernel-mode packet interception conditions include at least the kernel-mode flow table interception value. When the number of kernel-mode flow tables of the virtual switch reaches the kernel-mode flow table interception value, it is determined that the kernel-mode packet interception conditions are met.

[0074] For example, if the threshold of the virtual switch flow table issued by the user is 80% and the upper limit of the kernel flow table is 1000, the kernel flow table interception value of the virtual switch is determined to be 1000 × 80%, that is, the kernel flow table interception value of the virtual switch is 800. When the number of kernel flow tables of the virtual switch reaches 800, it is determined that the kernel packet interception condition is met.

[0075] Step 204: If the number of kernel-mode flow tables of the virtual switch meets the kernel-mode packet interception conditions, intercept the target packet in the pending packet to be transmitted to the kernel mode of the virtual switch.

[0076] Specifically, when the number of kernel-mode flow tables in a virtual switch meets the preset interception conditions, the target packet is identified and intercepted from the packets to be transmitted to the kernel mode for processing. This prevents the virtual switch from uploading the kernel-mode flow tables to the user mode for processing due to an excessive number of kernel-mode flow tables, thus fundamentally solving the network bottleneck problem of the cloud computing management platform.

[0077] Among them, such as Figure 3 The diagram shows a data packet processing flowchart of a virtual switch provided in this application embodiment. When a data packet arrives at the system, the datapath kernel module intercepts and processes it. The datapath kernel module is responsible for performing data processing. The datapath kernel module matches data packets one by one in the flow table, checking the header information of the data packets, such as the source MAC address, destination MAC address, VLAN tag, IP address, etc., to determine the applicable flow table rules. If no match is found on the first attempt, the data packet is uploaded to the user-space vswitchd (virtual switch daemon) through an upcall (upward call mechanism). The vswitchd is the management and control service of OVS and can interact with the kernel module. The vswitchd communicates with the controller through the OpenFlow protocol provided by the management layer to obtain the flow table. The flow table queried in user space is cached in the kernel-space flow-table, which is a table used to store network traffic processing rules. The vswitchd uses a reinject (re-injection mechanism) to send the data packet back to the kernel module using the netlink network connection between kernel space and user space. The datapath then queries the corresponding action based on the data packet and processes it according to the action. The method provided in this application embodiment is used to intercept target packets during the process of sending them to the kernel module through the network card, so as to prevent them from entering the virtual switch.

[0078] The method involves caching packet processing methods in kernel space. These methods exist as flow tables in kernel space, so when a packet with the same characteristics arrives again, it is directly processed in kernel space. When the kernel space does not receive packets with the same characteristics for a certain period, the kernel-space flow table ages out. The forwarding path from kernel space to user space after an upcall when the flow table cannot be found is called a slow-path, while the path directly forwarded via the kernel-space datapath is called a fast-flow. When the kernel-space flow table exceeds its limit, new packets will continuously be upcalled to user space, exceeding the user space's processing limit, leading to network anomalies such as communication disconnection or lag. The method provided in this application avoids frequent upcalls from kernel space to user space, thus preventing user space processing from reaching its limit.

[0079] Based on the above embodiments, since the upper limit of the kernel-mode flow table directly affects the judgment of kernel-mode packet interception conditions, in order to further improve the accuracy of the determination result of the upper limit of the kernel-mode flow table, as an implementable method, based on the above embodiments, in one embodiment, the upper limit of the virtual switch's kernel-mode flow table is determined according to the current environment information of the host machine, including:

[0080] Step 2021: Under a preset experimental environment, stress test the host machine to obtain test environment information of the host machine under different numbers and types of pending messages; wherein, the test environment information includes at least processor utilization, memory usage, disk performance indicators and network performance indicators.

[0081] Step 2022: Based on the test environment information, construct multiple feature vectors; among which, the feature vectors include various host machine performance indicators and the number of kernel-state flow tables;

[0082] Step 2023: Divide the multiple feature vectors into a model training sample set and a model test sample set;

[0083] Step 2024: Based on the model training sample set and the model test sample set, construct a kernel-state flow table upper limit prediction model;

[0084] Step 2025: Input the current environment information of the host machine into the kernel state flow table upper limit prediction model, so as to determine the kernel state flow table upper limit of the virtual switch based on the current environment information according to the kernel state flow table upper limit prediction model.

[0085] Specifically, in a pre-defined experimental environment, various load conditions under real-world network scenarios are simulated by sending different numbers and types of packets to the host machine. During this process, relevant host machine information is collected, including processor utilization, memory usage, disk performance metrics (such as disk I / O), and network performance metrics (such as network I / O). This information constitutes the test environment information, providing foundational data for subsequent model construction. Based on the obtained test environment information, multiple host machine performance metrics (such as processor utilization, memory usage, disk performance metrics, and network performance metrics) are combined with the number of kernel-mode flow tables to construct multiple feature vectors. Each feature vector contains the host machine's performance under a specific load condition and the corresponding number of kernel-mode flow tables. These vectors comprehensively reflect the relationship between host machine performance and the number of flow tables.

[0086] Furthermore, the constructed feature vectors are divided into two parts: one part serves as the model training sample set, and the other part serves as the model testing sample set. The model training sample set is used to train the kernel-state flow table upper limit prediction model, enabling it to learn the inherent patterns and mapping relationships between host performance metrics and kernel-state flow table upper limits. The model testing sample set is used to evaluate the model's accuracy and generalization ability after training, ensuring that the model can reliably predict kernel-state flow table upper limits in practical applications. Based on the divided model training and testing sample sets, a suitable machine learning algorithm or statistical method is used to construct the kernel-state flow table upper limit prediction model. This model can predict the corresponding kernel-state flow table upper limit based on input host performance metrics and other information. During the construction process, the model's parameters and structure are continuously adjusted, and the model is trained using the model training sample set to make the model's prediction results as close to reality as possible. The model testing sample set is then used for verification and optimization to improve the model's accuracy and stability.

[0087] Specifically, after obtaining the current environment information of the host machine, this information is input into the pre-built kernel-mode flow table upper limit prediction model. Based on the input current environment information, the model uses the patterns and relationships learned during training to calculate and output the upper limit value of the virtual switch's kernel-mode flow table. This upper limit value will be used to determine subsequent kernel-mode packet interception conditions, thereby achieving effective control and management of the number of kernel-mode flow tables on the virtual switch, avoiding network performance problems caused by excessive flow tables, and improving packet processing efficiency and system stability.

[0088] It should be noted that the creation of the model training and testing datasets primarily involves collecting configuration information such as host machine processor utilization, memory usage, disk performance metrics (disk read / write speed), and network performance metrics, as well as information on the number of OVS kernel-mode flow tables and the latency when querying flow tables. This information is then processed into a standard dataset. The host machine's processor utilization, memory usage, disk performance metrics, and network performance metrics significantly impact the speed of user-mode flow table processing; therefore, this information is collected. The number of OVS kernel-mode flow tables reflects the current workload of kernel-mode data processing, and the latency information for command execution when querying kernel flow tables also reflects the number of kernel flow tables, and is strongly correlated with the host node system information.

[0089] It should be further explained that information collection can be achieved by writing scripts. The `mpstat` command is used to obtain system CPU usage, primarily showing the current CPU utilization, including user-space CPU utilization and system CPU utilization. The `free -m` command is used to obtain memory usage in MB. The `iostat` command is used to obtain disk I / O information. The `ifstat` command is used to obtain network I / O information. The `ovs-ofctl dump-flows|wc -l` command can be used to view the number of kernel flow tables, and the `time ovs-ofctl dump-flows` command can be used to obtain latency information for querying kernel flow tables. The above information can be collected at different intervals, which can be adjusted according to the subsequent model training. The features collected are not limited to those mentioned above. For the construction of the preset experimental environment, stress, fio, or iperf tools can be used to stress test the system. A stress index is set, and under different stress conditions, time-series data on processor utilization, memory usage, disk performance metrics (disk read / write speed), and network performance metrics are collected over time.

[0090] Finally, the collected time series data is processed. A feature vector X = [L] is constructed. 1t ,L 2t …L nt M t ], where L 1t ,L 2t …L nt M represents data at time t, including information such as processor utilization, memory usage, disk performance metrics (disk read / write speed), network performance metrics, and kernel flow table query latency. t This represents the number of kernel-state flow tables; this vector, along with time and the number of samples, forms a three-dimensional feature, where samples refer to virtualization platforms with different configurations. After constructing the standard three-dimensional neural network data, the data is then filtered, standardized, and normalized. The processed data is then divided into training and test sets in a 3:1 ratio.

[0091] For example, such as Figure 4The diagram illustrates the training process of an exemplary kernel-state flow table upper limit prediction model provided in this application embodiment. The network state model (kernel-state flow table upper limit prediction model) is trained using a neural network algorithm, taking LSTM (Long Short-Term Memory) as an example. LSTM is a special type of RNN commonly used for time series prediction problems. Compared to ordinary RNNs, LSTM performs better on longer sequences. First, the obtained dataset is divided, with 70% used as the training set and 30% as the test set. Then, an LSTM neural network is constructed, and training parameters (initializing model parameters) are set, including the number of hidden layers and hidden neurons, batch size, activation function, loss function, gradient descent algorithm, maximum number of iterations, optimization algorithm, and learning rate. Parameter tuning is performed based on the subsequent training results. Next, the training set is fed into the LSTM for training to iteratively optimize the model parameters until the preset maximum number of iterations is reached. Finally, the trained LSTM model is used to predict on the test set, and the model with the best performance is used as the flow table prediction model (kernel-state flow table upper limit prediction model).

[0092] In the process of creating model training and testing sample sets, data preprocessing such as filtering, normalization, and standardization can be performed to improve the data quality of the final model training and testing sample sets.

[0093] Specifically, in one embodiment, to ensure that the kernel-state flow table upper limit values ​​of the virtual switches output by the kernel-state flow table upper limit value prediction model conform to the actual situation, that is, to ensure the reliability of the prediction results of the kernel-state flow table upper limit value prediction model, a real-time monitoring mechanism can be created to monitor the frequency and magnitude of changes in host environment information in real time. When significant changes in the environment are detected, such as CPU utilization fluctuating by more than 20% (preset fluctuation threshold) within a short period (preset period), or network traffic suddenly increasing by more than 30% (exceeding the preset growth threshold), the update process of the kernel-state flow table upper limit value prediction model is triggered. This utilizes an online learning algorithm to incrementally incorporate newly generated environmental information and flow table data into the model training, enabling the model to quickly adapt to dynamic changes in the network environment and ensuring that it can continuously provide accurate kernel-state flow table upper limit value predictions.

[0094] Based on the above embodiments, as an implementable approach, in one embodiment, when the kernel-mode flow table count of the virtual switch meets the kernel-mode packet interception conditions, the target packet in the pending packet to be transmitted to the kernel mode of the virtual switch is intercepted, including:

[0095] Step 2041: If the number of kernel-mode flow tables of the virtual switch meets the kernel-mode packet interception conditions, perform classification feature extraction on the kernel-mode flow tables of the virtual switch to obtain the classification feature information of each kernel-mode flow table of the virtual switch; wherein, the classification feature information includes at least the destination address, source address, protocol type and packet type;

[0096] Step 2042: Based on the classification feature information of each kernel state flow table, classify the kernel state flow tables to obtain the corresponding kernel state flow table classification results;

[0097] Step 2043: Based on the kernel-mode flow table classification results, determine the abnormal kernel-mode flow table type that caused the surge in the number of kernel-mode flow tables in the virtual switch;

[0098] Step 2044: Based on the abnormal kernel state flow table type, filter the target packets from the pending packets to be transmitted to the virtual switch kernel state, and intercept the target packets.

[0099] The destination and source addresses can be the destination IP address, source IP address, destination MAC address, and source MAC address, respectively. The protocol type, also known as the network type, is such as the IPv4 protocol type. The data packet type includes HTTP data packets (Hypertext Transfer Protocol data packets), etc. The classification feature information can also include information that can be used for flow table classification, such as the number of bytes matched in the flow table. This classification feature information can be obtained by using the "ovs-ofctl dump-flows" command to statistically analyze the detailed flow table information.

[0100] Specifically, based on the extracted classification feature information of each kernel-mode flow table, a preset classification algorithm or rule is used to classify the kernel-mode flow tables. Flow tables with similar characteristics are grouped together to form different categories. For example, flow tables with the same destination address range or the same protocol type are grouped together, or flow tables with specific packet types are grouped together. Through classification, the distribution and inherent patterns of flow tables can be more clearly seen, providing a basis for identifying abnormal flow table types.

[0101] Specifically, in one embodiment, multiple kernel-mode flow table types can be determined based on the kernel-mode flow table classification results, and corresponding type grouping can be performed to determine the number of kernel-mode flow tables in each group of kernel-mode flow table types; based on the number of kernel-mode flow tables in each group of kernel-mode flow table types, the kernel-mode flow table type with the most kernel-mode flow tables in the group is taken as the abnormal kernel-mode flow table type that causes a surge in the number of kernel-mode flow tables in the virtual switch.

[0102] Specifically, after classification, statistics and analysis are performed on various flow tables to determine the number of kernel-mode flow tables within each group for each type. The extent of the increase in the number of flow tables of a certain type within a short period can also be determined, thus identifying the categories causing the surge in the number of kernel-mode flow tables. These categories are the abnormal kernel-mode flow table types. For example, it might be found that a certain type of flow table has the highest number of kernel-mode flow tables within its group, with its destination address pointing to a specific server, and its number increasing rapidly within a short period. This indicates that the server has been impacted by abnormal traffic. By identifying abnormal kernel-mode flow table types, the root cause of the problem can be accurately located, providing a clear direction for subsequent packet interception.

[0103] Furthermore, based on the identified abnormal kernel flow table type, target packets can be filtered among the pending packets to be transmitted to the virtual switch kernel to prevent them from entering the virtual switch through the network interface card (NIC). The filtering is based on characteristics matching the abnormal kernel flow table type. For example, if the abnormal kernel flow table type indicates a large number of packets destined for a specific address, then pending packets with that destination address can be filtered out as target packets. These target packets are then intercepted, preventing them from entering the kernel. This avoids performance degradation and resource exhaustion in the kernel due to processing too many abnormal packets, ensuring the normal operation of the virtual switch and the stability of the entire network system.

[0104] Specifically, in one embodiment, abnormal kernel-mode flow table configuration information can be determined based on the abnormal kernel-mode flow table type; target packets can be filtered from the pending packets to be transmitted to the virtual switch kernel mode based on the abnormal kernel-mode flow table configuration information; wherein the configuration information of the target packets matches the abnormal kernel-mode flow table configuration information; and a corresponding abnormal packet interception command can be constructed based on the abnormal kernel-mode flow table configuration information to intercept the target packets based on the abnormal packet interception command.

[0105] The abnormal kernel-mode flow table configuration information can be obtained by extracting various fields of the kernel-mode flow table. The abnormal kernel-mode flow table configuration information includes the abnormal destination address, abnormal source address, abnormal protocol type, or abnormal data packet type corresponding to the abnormal kernel-mode flow table type.

[0106] For example, if the target packet is determined to be a multicast flood packet, and the abnormal protocol type is IPv4 and the source address is in the 224.0.0.0 / 4 network segment (i.e., a multicast flood packet), then the following firewall rule (abnormal packet interception command) is constructed to perform a drop operation (intercept / discard operation) on the multicast flood packet to prevent normal service interruption caused by invalid flood packets:

[0107] firewall-cmd--permanent--add-rich-rule='rule family="ipv4" sourceaddress="224.0.0.0 / 4"drop'

[0108] Furthermore, in one embodiment, an abnormal alarm message can also be generated if the number of kernel-mode flow tables of the virtual switch meets the kernel-mode packet interception conditions.

[0109] The abnormal alarm information includes abnormal kernel state flow table configuration information (such as IPv4, source address="224.0.0.0 / 4") and abnormal packet interception commands.

[0110] Specifically, by generating and reporting abnormal alarm information, users can be notified to check their network environment, investigate the cause of the environmental performance bottleneck, resolve the problem, manually delete the firewall rules (abnormal packet interception command), and restore the network environment. This can achieve early prevention of sudden problems and ensure that users' normal business is not affected by abnormal traffic.

[0111] This application provides a packet processing method that obtains the current environment information of the host machine, wherein the host machine deploys a virtual switch. Based on the current environment information of the host machine, the upper limit of the kernel-state flow table of the virtual switch is determined. Based on the upper limit of the kernel-state flow table of the virtual switch, the kernel-state packet interception conditions of the virtual switch are determined. When the number of kernel-state flow tables of the virtual switch meets the kernel-state packet interception conditions, the target packet in the pending packet to be transmitted to the kernel state of the virtual switch is intercepted. The method provided above, by predicting the upper limit of the kernel-state flow table of the virtual switch in advance and accurately controlling the number of kernel-state flow tables of the virtual switch, effectively avoids network bottlenecks caused by excessive kernel-state flow tables, improves packet processing efficiency, and thus ensures the network stability and operational efficiency of the cloud computing management platform. Furthermore, combined with firewall rules, it avoids such problems before network packet loss failures caused by abnormal traffic surges occur in the user environment, thereby ensuring the reliable and stable operation of the cloud computing management platform network.

[0112] This application provides a message processing apparatus for executing the message processing method provided in the above embodiments.

[0113] like Figure 5 The diagram shown is a schematic representation of the message processing apparatus provided in an embodiment of this application. The message processing apparatus 50 includes: an acquisition module 501, a first determination module 502, a second determination module 503, and a processing module 504.

[0114] The system includes: an acquisition module for acquiring the current environment information of the host machine, wherein the host machine deploys a virtual switch; a first determination module for determining the upper limit of the kernel-mode flow table of the virtual switch based on the current environment information of the host machine; a second determination module for determining the kernel-mode packet interception conditions of the virtual switch based on the upper limit of the kernel-mode flow table of the virtual switch; and a processing module for intercepting the target packet in the unprocessed packet to be transmitted to the kernel mode of the virtual switch when the kernel-mode flow table of the virtual switch meets the kernel-mode packet interception conditions.

[0115] Regarding the message processing apparatus in this embodiment, the specific methods by which each module performs its operations have been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0116] The message processing apparatus provided in this application embodiment is used to execute the message processing method provided in the above embodiment. Its implementation method and principle are the same, and will not be described again.

[0117] This application provides an electronic device for executing the message processing method provided in the above embodiments.

[0118] like Figure 6 The diagram shown is a structural schematic of an electronic device provided in an embodiment of this application. The electronic device 60 includes at least one processor 61 and a memory 62.

[0119] The memory stores computer-executable instructions; at least one processor executes the computer-executable instructions stored in the memory, causing the at least one processor to perform the message processing method provided in the above embodiments.

[0120] The electronic device provided in this application embodiment is used to execute the message processing method provided in the above embodiment. Its implementation method and principle are the same, and will not be described again.

[0121] This application provides a computer-readable storage medium storing computer-executable instructions. When a processor executes the computer-executable instructions, it implements the message processing method provided in any of the above embodiments.

[0122] The storage medium containing computer-executable instructions provided in this application embodiment can be used to store computer-executable instructions for the message processing method provided in the foregoing embodiments. Its implementation method and principle are the same, and will not be described again.

[0123] This application provides a computer program product, including computer instructions, which are used to cause a computer to execute the message processing method provided in the foregoing embodiments.

[0124] The computer program product provided in this application embodiment can be used to execute the computer instructions of the message processing method provided in the foregoing embodiment. Its implementation method and principle are the same, and will not be described again.

[0125] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0126] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0127] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in a combination of hardware and software functional units.

[0128] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0129] A portion of this application can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the present invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0130] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional modules is merely an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0131] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A message processing method, characterized in that, include: Obtain the current environment information of the host machine; wherein, the host machine is equipped with a virtual switch; Based on the current environment information of the host machine, determine the upper limit of the kernel-state flow table of the virtual switch; The kernel-mode packet interception conditions of the virtual switch are determined based on the upper limit value of the kernel-mode flow table of the virtual switch. If the number of kernel-mode flow tables of the virtual switch meets the kernel-mode packet interception conditions, the target packet in the pending packet to be transmitted to the kernel mode of the virtual switch is intercepted. The step of determining the upper limit of the kernel-state flow table of the virtual switch based on the current environment information of the host machine includes: Under a preset experimental environment, stress tests are performed on the host machine to obtain test environment information of the host machine under different numbers and types of pending messages; wherein, the test environment information includes at least processor utilization, memory usage, disk performance indicators and network performance indicators; Based on the test environment information, multiple feature vectors are constructed; wherein, the feature vectors include various host machine performance indicators and the number of kernel-state flow tables; The multiple feature vectors are divided into a model training sample set and a model test sample set; Based on the model training sample set and the model test sample set, a kernel-state flow table upper limit prediction model is constructed. The current environment information of the host machine is input into the kernel state flow table upper limit prediction model, so as to determine the kernel state flow table upper limit of the virtual switch based on the current environment information and the kernel state flow table upper limit prediction model. When the kernel-mode flow table count of the virtual switch meets the kernel-mode packet interception condition, the target packet in the pending packet to be transmitted to the kernel mode of the virtual switch is intercepted, including: If the number of kernel-mode flow tables of the virtual switch meets the kernel-mode packet interception condition, the kernel-mode flow tables of the virtual switch are subjected to classification feature extraction to obtain the classification feature information of each kernel-mode flow table of the virtual switch; wherein, the classification feature information includes at least destination address, source address, protocol type and packet type; Based on the classification feature information of each kernel state flow table, the kernel state flow tables are classified to obtain the corresponding kernel state flow table classification results; Based on the kernel-state flow table classification results, determine the abnormal kernel-state flow table type that caused the surge in the number of kernel-state flow tables of the virtual switch; Based on the abnormal kernel state flow table type, target packets are filtered from the pending packets to be transmitted to the virtual switch kernel state, and the target packets are intercepted.

2. The method according to claim 1, characterized in that, The step of determining the abnormal kernel-state flow table types that cause a surge in the number of kernel-state flow tables in the virtual switch based on the kernel-state flow table classification results includes: Based on the kernel state flow table classification results, various kernel state flow table types are determined, and corresponding type groups are performed to determine the number of kernel state flow tables in each group of the kernel state flow table types. Based on the number of kernel-state flow tables within each group of the aforementioned kernel-state flow table types, the kernel-state flow table type with the highest number of kernel-state flow tables within the group is identified as the abnormal kernel-state flow table type that causes a surge in the number of kernel-state flow tables of the virtual switch.

3. The method according to claim 1, characterized in that, The step of filtering target packets from the pending packets to be transmitted to the virtual switch kernel state according to the abnormal kernel state flow table type, and intercepting the target packets, includes: Based on the abnormal kernel state flow table type, determine the abnormal kernel state flow table configuration information; Based on the abnormal kernel state flow table configuration information, the target packet is filtered from the pending packets to be transmitted to the virtual switch kernel state; wherein the configuration information of the target packet matches the abnormal kernel state flow table configuration information. Based on the abnormal kernel state flow table configuration information, a corresponding abnormal packet interception command is constructed to intercept the target packet.

4. The method according to claim 1, characterized in that, The method further includes: If the number of kernel-mode flow tables in the virtual switch meets the kernel-mode packet interception conditions, an abnormal alarm message is generated. The abnormal alarm information includes abnormal kernel-state flow table configuration information and abnormal message interception commands.

5. The method according to claim 1, characterized in that, The step of determining the kernel-mode packet interception conditions of the virtual switch based on the upper limit value of the kernel-mode flow table of the virtual switch includes: Obtain the virtual switch flow table threshold issued by the user; The kernel-mode packet interception conditions of the virtual switch are determined based on the virtual switch flow table threshold and the kernel-mode flow table upper limit. The kernel-mode packet interception condition includes at least the kernel-mode flow table interception value. When the number of kernel-mode flow tables of the virtual switch reaches the kernel-mode flow table interception value, it is determined that the kernel-mode packet interception condition is met.

6. A message processing apparatus, characterized in that, include: An acquisition module is used to acquire the current environment information of the host machine; wherein, the host machine is equipped with a virtual switch; The first determining module is used to determine the upper limit value of the kernel state flow table of the virtual switch based on the current environment information of the host machine; The second determining module is used to determine the kernel-mode packet interception conditions of the virtual switch based on the upper limit value of the kernel-mode flow table of the virtual switch. The processing module is used to intercept the target packet in the unprocessed packet to be transmitted to the kernel state of the virtual switch when the number of kernel state flow tables of the virtual switch meets the kernel state packet interception conditions. The first determining module is specifically used for: Under a preset experimental environment, stress tests are performed on the host machine to obtain test environment information of the host machine under different numbers and types of pending messages; wherein, the test environment information includes at least processor utilization, memory usage, disk performance indicators and network performance indicators; Based on the test environment information, multiple feature vectors are constructed; wherein, the feature vectors include various host machine performance indicators and the number of kernel-state flow tables; The multiple feature vectors are divided into a model training sample set and a model test sample set; Based on the model training sample set and the model test sample set, a kernel-state flow table upper limit prediction model is constructed. The current environment information of the host machine is input into the kernel state flow table upper limit prediction model, so as to determine the kernel state flow table upper limit of the virtual switch based on the current environment information and the kernel state flow table upper limit prediction model. The processing module is specifically used for: If the number of kernel-mode flow tables of the virtual switch meets the kernel-mode packet interception condition, the kernel-mode flow tables of the virtual switch are subjected to classification feature extraction to obtain the classification feature information of each kernel-mode flow table of the virtual switch; wherein, the classification feature information includes at least destination address, source address, protocol type and packet type; Based on the classification feature information of each kernel state flow table, the kernel state flow tables are classified to obtain the corresponding kernel state flow table classification results; Based on the kernel-state flow table classification results, determine the abnormal kernel-state flow table type that caused the surge in the number of kernel-state flow tables of the virtual switch; Based on the abnormal kernel state flow table type, target packets are filtered from the pending packets to be transmitted to the virtual switch kernel state, and the target packets are intercepted.

7. An electronic device, characterized in that, include: At least one processor and memory; The memory stores computer-executed instructions; The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, implement the method as described in any one of claims 1 to 5.

Images