A data flow analysis method based on TCP timestamp detection

Abstract

The present invention provides a data flow analysis method based on TCP timestamp detection, comprising: acquiring traffic data from network boundary nodes and extracting timestamp sequences of multiple devices; preprocessing the timestamp sequences to generate a noise-reduced time sequence; calculating synchronization features between devices based on the noise-reduced time sequence and determining a synchronization index between devices; constructing a dynamic association graph between devices based on the synchronization index and calculating association weights; processing the dynamic association graph using a graph feature aggregation algorithm to determine the association between devices; outputting a device association topology graph based on the association results, and executing an isolation strategy for abnormal devices.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a data flow analysis method based on TCP timestamp detection. Background Art

[0002] With the widespread use of Network Address Translation (NAT) technology, multiple devices can potentially be hidden under the same public IP address, severely impacting traditional device identification methods based on IP / MAC addresses. Existing correlation analysis methods based on packet behavior characteristics (such as TTL values ​​and traffic patterns) lack generalizability and struggle to address feature drift caused by device firmware updates or changes in the network environment. Furthermore, existing timestamp analysis is often limited to one-way latency measurement or coarse-grained clock deviation estimation, failing to fully exploit the hardware clock synchronization characteristics inherent in TCP timestamps.

[0003] The current mainstream solutions have the following technical bottlenecks:

[0004] Insufficient NAT penetration capabilities: Methods based on port sequence prediction or payload feature matching are susceptible to interference from encrypted traffic, and in virtualized scenarios, clock virtualization leads to a sharp increase in identification errors.

[0005] Limited depth of timing analysis: Existing timestamp analysis methods only focus on statistical features (such as mean and variance) within a fixed time window, ignoring deep physical characteristics such as clock phase synchronization and dynamic changes in drift rate;

[0006] Weak adaptability to dynamic environments: Traditional graph modeling uses static association thresholds and cannot effectively handle dynamic network environments where mobile devices frequently connect / disconnect.

[0007] Therefore, a data flow analysis method that can integrate physical clock characteristics and dynamic topology analysis is needed to achieve cross-device association in order to meet the needs of precise device management in complex network environments. Summary of the Invention

[0008] The present invention provides a data flow analysis method based on TCP timestamp detection, which mainly includes:

[0009] Traffic data is obtained from network boundary nodes, and timestamp sequences of multiple devices are extracted; the timestamp sequences are preprocessed to generate a denoised time sequence; synchronization features between devices are calculated based on the denoised time sequence, and a synchronization index between devices is determined; a dynamic association graph between devices is constructed using the synchronization index, and association weights are calculated; the dynamic association graph is processed using a graph feature aggregation algorithm to determine the association between devices; a device association topology graph is output based on the association results, and an isolation strategy is implemented for abnormal devices.

[0010] Furthermore, the method of obtaining traffic data from network border nodes and extracting timestamp sequences of multiple devices includes: capturing message data of network border nodes through traffic mirroring technology; diverting the message data according to the five-tuple information of the message to establish an independent timestamp queue for each device; parsing the timestamp field in the message data to obtain the timestamp information of the device; if the timestamp information is in a local clock format, obtaining the offset through a time synchronization service and converting it into a unified time base; and outputting a timestamp sequence containing multiple devices as input data for subsequent processing.

[0011] Furthermore, the timestamp sequence is preprocessed to generate a denoised time series, including: segmenting the timestamp sequence using a sliding window to obtain data segments within multiple time windows; performing a frequency domain transformation operation on the data segments within each time window to calculate the power spectrum density; filtering out high-frequency noise components based on the power spectrum density and retaining low-frequency valid signals; and reorganizing the data segments after noise filtering into a continuous time series to generate the denoised time series for subsequent feature extraction.

[0012] Furthermore, the synchronization characteristics between devices are calculated based on the noise-reduced time series, and the synchronization index between devices is determined, including: calculating the difference between adjacent timestamps in the noise-reduced time series to generate an incremental sequence; analyzing the incremental sequence through a fitting method to obtain the reference clock frequency of the device; using a cross-correlation analysis method to calculate the phase difference between devices, and determining a phase locking value as the synchronization index; if the phase locking value exceeds a preset threshold, it is determined that a clock synchronization relationship exists between the devices.

[0013] Furthermore, the calculation formula of the phase lock value is:

[0014] ;

[0015] Among them, PLV is the phase locking value, that is, the average modulus length of the phase difference mapped to the unit circle in the complex plane, is the phase difference between the timestamp sequences of the two devices in the kth time window, and n is the number of sampling points.

[0016] Furthermore, the dynamic association graph between devices is constructed through the synchronization index, and the association weight is calculated, including: taking the device as a node in the graph and the synchronization index as the basis for the initial edge weight; combining the synchronization index, clock drift rate correlation coefficient and active period overlap rate between devices to comprehensively calculate the edge weight value; using the time decay factor to dynamically update the edge weight value to generate the dynamic association graph; if the edge weight value continuously exceeds the preset threshold, a device association event is triggered and the association relationship data is recorded.

[0017] Furthermore, the calculation formula of the clock drift rate correlation coefficient is:

[0018] ;

[0019] in, is the clock drift rate correlation coefficient, is the variance of the two series, is the maximum value of the cross-correlation function of the two time stamp sequences.

[0020] Furthermore, the dynamic association graph is processed using a graph feature aggregation algorithm to determine the association between devices, including: extracting feature vectors of nodes in the dynamic association graph, the feature vectors containing the synchronization index mean and the drift rate variance; aggregating neighbor node information of the feature vectors using a graph feature aggregation algorithm to generate an embedding vector; processing the embedding vectors using a classifier to calculate the association probability between devices; determining the association between devices based on the association probability, and outputting the association determination result.

[0021] Furthermore, the device association topology diagram is output according to the correlation result, and an isolation strategy is executed for abnormal devices, including: generating the device association topology diagram according to the correlation result, marking the synchronization parameters between devices; monitoring the changes in the synchronization index mean and the drift rate variance for the device group in the device association topology diagram; if the synchronization index mean drops by more than a preset proportion or the drift rate variance suddenly increases by more than a preset multiple, it is determined to be an abnormal device; calling the network controller interface to issue isolation rules for the abnormal device to limit abnormal traffic; and recording relevant parameters and time information of the isolation event.

[0022] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0023] The present invention discloses a data flow analysis method based on TCP timestamp detection. By capturing TCP packets at network boundary nodes and extracting timestamp sequences, the method performs synchronous feature extraction and dynamic association analysis on multi-device timestamps to construct a device association map. The present invention uses sliding windows and FFT filtering to preprocess timestamp data, evaluates device synchronization by calculating the phase lock value (PLV) and clock drift rate, and utilizes the GraphSAGE algorithm and WGAN-GP adversarial training to improve the accuracy and robustness of NAT device identification. When a device anomaly is detected under NAT, the present invention can automatically trigger a traffic isolation policy and record a security log, effectively solving the problem of accurate identification of NAT devices in complex network environments and improving the automation level of network security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 The present invention is a flow chart of a data flow analysis method based on TCP timestamp detection. DETAILED DESCRIPTION

[0025] The following will describe the technical solutions in the embodiments of the present invention in detail with reference to the accompanying drawings. The described embodiments are only a part of the embodiments of the present invention.

[0026] like Figure 1 In this embodiment, a data flow analysis method based on TCP timestamp detection may specifically include:

[0027] Step S101, obtaining traffic data from a network border node and extracting timestamp sequences of multiple devices, includes: capturing message data of a network border node through traffic mirroring technology; diverting the message data according to the five-tuple information of the message to establish an independent timestamp queue for each device; parsing the timestamp field in the message data to obtain the timestamp information of the device; if the timestamp information is in a local clock format, obtaining an offset through a time synchronization service and converting it into a unified time base; and outputting a timestamp sequence containing multiple devices as input data for subsequent processing.

[0028] Traffic mirroring captures packet data at network edge nodes. Traffic mirroring is a technique that copies network traffic to a designated port and is commonly used for network monitoring and analysis. Deploying traffic mirroring at network edge nodes captures all packets entering and leaving the node, ensuring that no device's timestamp information is missed.

[0029] Specifically, in an enterprise network, traffic mirroring is configured on a border router to copy all TCP packets passing through the router to a monitoring port for subsequent analysis. Packet data is then distributed based on the packet's five-tuple information: source IP address, destination IP address, source port, destination port, and transport layer protocol. This five-tuple information allows packet data to be distributed to different device flows, establishing independent timestamp queues for each device.

[0030] For example, in a network with multiple devices, messages from different devices can be separated using quintuple information, ensuring that each device's timestamp information is independently stored for subsequent processing. The timestamp field in the message data is parsed to obtain the device's timestamp information. The timestamp field is typically located in the TCP option field and records the time the message was sent or received. Parsing the timestamp field can obtain the device's timestamp information, providing a foundation for subsequent time synchronization and data processing.

[0031] Specifically, in a network monitoring system, the timestamp field in TCP packets is parsed to obtain timestamp information for each device for subsequent time series analysis. If the timestamp information is in a local clock format, an offset is obtained through a time synchronization service to convert it to a unified time base. Timestamps in local clock format are typically based on the device's local clock, and local clocks of different devices may deviate. Obtaining the UTC offset through a time synchronization service (such as NTP) converts timestamps in local clock format to a unified time base, ensuring that timestamps across devices are comparable.

[0032] Specifically, in a distributed system, the UTC offset is obtained through the NTP service, and the local clock timestamps of different devices are converted to UTC time, facilitating subsequent time series analysis and synchronization. The output contains a timestamp sequence of multiple devices, which serves as input data for subsequent processing. The timestamp sequence is the basis for subsequent processing and provides input data for subsequent time series analysis, filtering, and synchronization.

[0033] Specifically, in a network monitoring system, the output contains a timestamp sequence of multiple devices, which serves as the input data for subsequent FFT filtering and time series analysis to ensure the accuracy and consistency of the analysis.

[0034] Step S102, preprocessing the timestamp sequence to generate a denoised time series, includes: segmenting the timestamp sequence using a sliding window to obtain data segments within multiple time windows; performing a frequency domain transform operation on the data segments within each time window to calculate the power spectral density; filtering out high-frequency noise components based on the power spectral density and retaining low-frequency valid signals; and reorganizing the data segments after noise filtering into a continuous time series to generate the denoised time series for subsequent feature extraction.

[0035] When using a sliding window to segment a timestamp series, a window size of 200ms is typically chosen to divide the continuous timestamp data into multiple independent time segments. This segmentation method can effectively capture local features in the time series while avoiding the increased computational complexity caused by excessively long data.

[0036] Specifically, when processing timestamp data from network devices, a 200ms window can cover the arrival times of multiple TCP packets, providing sufficient data for subsequent frequency domain analysis. The step size of the sliding window can be adjusted based on actual needs, for example, setting it to 100ms to achieve partial overlap between windows and ensure the continuity of the time series.

[0037] When performing a frequency domain transformation on the data segments within each time window, a Fast Fourier Transform (FFT) is used to convert the time domain data into frequency domain data. The FFT decomposes a time series into components of varying frequencies, thereby revealing periodic characteristics within the data. For example, performing an FFT on a time window containing 4096 data points yields 2048 frequency components, each corresponding to a specific frequency value. This transformation provides the basis for subsequent power spectral density calculations.

[0038] When calculating power spectral density, the squared amplitude of the FFT transform result is normalized to obtain the energy distribution of each frequency component. Power spectral density can intuitively reflect the strength of different frequency components in a time series. Specifically, when processing device clock drift data, power spectral density can reveal the distribution of low-frequency drift signals and high-frequency noise signals. By analyzing power spectral density, it is possible to identify which frequency components are valid signals and which are noise.

[0039] When filtering out high-frequency noise components based on power spectral density, a frequency threshold (e.g., 50 Hz) is set. Frequency components above this threshold are considered noise and filtered out. This filtering operation preserves the low-frequency valid signal while removing high-frequency interference.

[0040] Specifically, when processing device timestamp data, high-frequency noise can be caused by network jitter or hardware instability, while low-frequency signals reflect the actual clock drift of the device. By filtering out high-frequency noise, the smoothness and accuracy of the time series can be improved.

[0041] When reconstructing the noise-filtered data segments into a continuous time series, the processing results of each time window need to be spliced ​​together in chronological order. For example, when processing data from multiple 200ms windows, the filtering results of each window are arranged in chronological order to form a new time series.

[0042] This reorganization operation preserves the continuity of the time series while removing noise. The resulting time series can be used for subsequent feature extraction and analysis, such as calculating timestamp increments or fitting clock frequencies. Through the above steps, timestamp sequence preprocessing effectively removes high-frequency noise while retaining low-frequency, significant signals, providing a high-quality data foundation for subsequent feature extraction and analysis. This noise reduction method has important application value in scenarios such as device clock synchronization and network traffic analysis, improving the accuracy and reliability of data analysis.

[0043] Step S103, calculating the synchronization characteristics between devices based on the denoised time series and determining the synchronization index between devices, includes: calculating the difference between adjacent timestamps in the denoised time series to generate a timestamp increment sequence; analyzing the increment sequence by a fitting method to obtain the reference clock frequency of the device; calculating the phase difference between devices by a cross-correlation analysis method to determine the phase lock value as the synchronization index; if the phase lock value exceeds a preset threshold, it is determined that a clock synchronization relationship exists between the devices.

[0044] For the denoised time series , calculate the adjacent timestamp increments:

[0045] ;

[0046] in, Indicates the timestamp increment, Represents the timestamp sequence value at time t, Indicates the timestamp sequence value of the next moment after time t.

[0047] Generate a timestamp increment sequence based on the calculation results .

[0048] Based on timestamp increment sequence , establish a linear relationship between the timestamp increment and the sampling sequence number:

[0049] ;

[0050] in, is the timestamp increment value of the kth sampling sequence number, represents the number of samples in the timestamp increment sequence used for regression analysis, is the slope, which represents the linear rate of change of increment over time, is the intercept, representing the initial incremental mean, k is the sampling point number, is the residual.

[0051] The optimal parameters are solved by minimizing the residual sum of squares. The calculation method is: .

[0052] Since the TCP timestamp is generated by the device hardware clock, its value usually increases at a fixed frequency. ,Right now , where T is the total sampling time window. For example, if the device clock frequency is =1000 Hz, then the timestamp is = 0.001 seconds increments. When there is no clock frequency drift, Constant (i.e. =0), the calculation method of the reference clock frequency is: ; When there is clock frequency drift, since the initial incremental mean is fixed , and the long-term average increment is determined by the slope leading, is much larger than b, so the calculation method of the reference clock frequency is approximately simplified to: ;

[0053] In the NAT device association scenario, it is necessary to capture the long-term stability characteristics of the device clock and also consider the situation where there is no clock frequency drift. Therefore, the calculation switching threshold is set to select the calculation method. For example, when the clock drift rate is greater than 100ppm, the formula is used. Calculate the reference frequency; when the slope is detected When <0.001, use the formula Calculate the base frequency.

[0054] During the cross-correlation analysis, time alignment is first performed. Using the timestamp of device A as a reference, linear interpolation is performed on the timestamp of device B to generate the aligned sequence. .For example, ms, then Find adjacent timestamps ms and ms, calculate interpolation:

[0055] ;

[0056] After completion, define the cross-correlation function of the two sequences:

[0057] ;

[0058] in, 、 is the sequence mean, is the time lag parameter, is the time-aligned sequence, The timestamp value of the kth sampling sequence number in the timestamp sequence of time device A.

[0059] Find the maximum value of the cross-correlation function and its corresponding time lag :

[0060] ;

[0061] Clock drift rate correlation coefficient The calculation method is:

[0062] ;

[0063] in, is the variance of the two series.

[0064] Clock drift rate correlation coefficient Characterizes that the timestamp sequences of the two devices are aligned on the time axis if ≥0.65, it indicates that the timestamp sequences of the two devices have a high correlation, which may be due to sharing the same clock source or being scheduled by the same NAT gateway; on the contrary, if If the correlation is less than 0.65, it indicates that the timestamp sequences of the two devices have low correlation and may belong to devices with independent clock sources.

[0065] When calculating the phase difference between devices, first and Perform Hilbert transform to obtain the analytical signal:

[0066] ;

[0067] in, Represents the timestamp sequence of device A, Timestamp sequence after device B performs time alignment.

[0068] Then, calculate the instantaneous phase:

[0069] ;

[0070] Calculate the phase difference point by point and constrain it to :

[0071] ;

[0072] in, is the phase difference between the timestamp sequences of the two devices in the kth time window, For the kth time window The timestamp phase value in , For the kth time window The timestamp phase value in .

[0073] After completion, calculate the phase lock value PLV:

[0074] ;

[0075] Wherein, PLV is the phase locking value, that is, the average modulus length of the unit circle of the complex plane mapped to the phase difference, and n is the number of sampling points.

[0076] When the PLV exceeds a preset threshold (e.g., 0.8), the clock phase difference between the two devices is stable and synchronization is established. The cross-correlation peak position reflects the fixed phase offset between the devices, while the peak amplitude reflects the strength of synchronization.

[0077] In the judgment logic of the phase lock value PLV, the preset threshold of 0.8 corresponds to the ±50ppm frequency drift range allowed by industrial-grade crystal oscillators. When PLV=0.85, it means that the clock drift between devices is controlled within ±30ppm, meeting the NTP synchronization accuracy requirements. The PLV indicator combines frequency deviation and phase jitter, and can better reflect the actual synchronization status than a single frequency comparison. At the same time, combined with the correlation index The reasons for the asynchrony of the devices with unsynchronized clocks can be further predicted.

[0078] Step S104, constructing a dynamic association graph between devices through the synchronization index and calculating the association weight, including: taking the device as a node in the graph and the synchronization index as the basis for the initial edge weight; combining the synchronization index, clock drift rate correlation coefficient and active period overlap rate between devices to comprehensively calculate the edge weight value; using the time decay factor to dynamically update the edge weight value to generate the dynamic association graph; if the edge weight value continuously exceeds the preset threshold, a device association event is triggered and the association relationship data is recorded.

[0079] In the construction of dynamic association graph, devices are abstracted as nodes in the graph, and the edge weights between nodes are determined by the synchronization index PLV, the clock drift rate correlation coefficient, and the and the overlap rate of active periods Joint decision. Active period overlap rate It is calculated by counting the intersection of the active time periods of the devices within a 24-hour period. For example, if the active time period overlap ratio of device A and device B is 0.6, it means that both are active at the same time 60% of the time.

[0080] The comprehensive calculation of edge weights usually adopts the weighted average method. Specifically, the edge weight calculation expression between nodes is:

[0081] ;

[0082] Among them, W is the edge weight between nodes, 、 、 is the weight coefficient and satisfies .

[0083] For example, suppose Take 0.6, Take 0.3, Taking 0.1, the synchronization index of device A and device B is 0.85, the clock drift rate correlation coefficient is 0.7, and the active period overlap rate is 0.6, then the initial edge weight is 0.85×0.6+0.7×0.3+0.6×0.1=0.78.

[0084] To reflect the dynamic changes in inter-device relationships, edge weights are updated using a time decay factor. For example, a time decay factor of λ = 0.9 means that 90% of the current edge weight comes from the weight in the previous cycle, and 10% comes from the calculation results in the current cycle. Assuming the edge weight between device A and device B was 0.78 in the previous cycle, and the edge weight calculated in the current cycle is 0.8, the updated edge weight is 0.78 × 0.9 + 0.8 × 0.1 = 0.782.

[0085] When edge weights continuously exceed a preset threshold (e.g., 0.75), a device association event is triggered. For example, if the edge weights of device A and device B exceed 0.75 for three consecutive detection cycles, 0.78, 0.79, and 0.81, respectively, then an association is determined between the two devices and the relevant data is recorded. This dynamic update and threshold triggering mechanism effectively captures changes in device associations and avoids misjudgments caused by single anomalies. The dynamic association graph constructed using this method accurately reflects inter-device synchronization, clock drift consistency, and similarity in active periods, providing important insights for network management and security analysis. For example, when a device anomaly is detected under NAT, analysis of the association graph can quickly locate the anomalous device and implement appropriate isolation measures, thereby improving network security and stability.

[0086] Step S105, the dynamic association graph is processed using a graph feature aggregation algorithm to determine the association between devices, including: extracting feature vectors of nodes in the dynamic association graph, the feature vectors including the synchronization index mean and the drift rate variance; aggregating neighbor node information of the feature vectors using a graph feature aggregation algorithm to generate an embedding vector; processing the embedding vectors using a classifier to calculate the association probability between devices; determining the association between devices based on the association probability, and outputting the association determination result.

[0087] When extracting the feature vectors of nodes in the dynamic association graph, the mean of the synchronization index (PLV mean) reflects the stability of clock synchronization between devices. For example, the PLV mean of device A and device B within a 60-second window is 0.92, indicating that the timestamp sequences of the two are highly linearly correlated, while the PLV mean of device C is only 0.45, which may be due to network jitter or crystal oscillator instability. The drift rate variance reflects the degree of fluctuation of the clock frequency. For example, the drift rate variance of device D is , much lower than that of device E , indicating that the crystal oscillator stability of D is better.

[0088] The feature vector combination needs to be normalized, for example, the PLV mean is mapped to the interval [0, 1], and the drift rate variance is scaled after taking the logarithm to avoid the influence of dimensional differences on subsequent aggregation.

[0089] When aggregating neighbor node information through a graph feature aggregation algorithm (such as GraphSAGE), a mean aggregator is used to iteratively calculate the one-hop neighbor features. For example, the feature vector of device F is , the feature vectors of its neighbor devices G and H are and , after aggregation, the embedding vector of F is generated , preserving its own characteristics while integrating neighborhood information. If an LSTM aggregator is used, the sequential dependencies between neighbors can be captured. For example, if the neighbors of device I are J and K in chronological order, their embedding vectors will reflect the temporal correlation pattern.

[0090] When using a Softmax classifier to process embedding vectors, the input layer receives a 128-dimensional embedding vector, and the hidden layer uses the ReLU activation function. For example, if the cosine similarity of the embedding vectors of devices L and M is 0.91, the classifier outputs an association probability of 0.97, exceeding the threshold of 0.95, indicating a strong association. Negative sampling is introduced during classifier training. For example, if a random pairing of unrelated devices N and O yields an embedding vector similarity of only 0.12, corresponding to a probability of 0.03, this enhances the model's discriminability.

[0091] The association determination results require dynamic threshold adjustment. For example, during low-load periods, when the average PLV is generally higher, the probability threshold can be raised to 0.98 to avoid false positives. During high-load periods, due to increased network latency, the threshold can be lowered to 0.93. The determination results are output as binary labels and confidence levels. For example, if the probability of association between devices P and Q is 0.96 (92% confidence), while the probability between P and R is 0.72 (65% confidence), only the former is labeled as an associated device.

[0092] Feature vector extraction comprehensively characterizes device status through multi-dimensional metrics (PLV mean and drift rate variance), avoiding bias from a single metric. GraphSAGE aggregation leverages graph structure information to address the inability of traditional methods to capture topological associations. The Softmax classifier provides flexible judgment through probabilistic output, adapting to network fluctuations. The entire process is end-to-end automated, from raw data to association judgment, providing a reliable basis for NAT penetration detection.

[0093] Step S106, outputting a device association topology diagram according to the correlation result, and executing an isolation strategy for abnormal devices, including: generating the device association topology diagram according to the correlation result, marking the synchronization parameters between devices; monitoring the changes in the synchronization index mean and the drift rate variance for the device group in the device association topology diagram; if the synchronization index mean drops by more than a preset proportion or the drift rate variance suddenly increases by more than a preset multiple, it is determined to be an abnormal device; calling the network controller interface to issue isolation rules for the abnormal device to limit abnormal traffic; and recording relevant parameters and time information of the isolation event.

[0094] When generating a device association topology diagram based on the association results, you first need to mark the synchronization parameters between devices in the diagram. These parameters include clock frequency. , PLV value and drift rate variance, etc. For example, in a network containing 10 devices, after aggregating node features through the GraphSAGE algorithm, a topology graph is generated, and the node of each device in the graph is labeled with its The frequency response time is 1.0005 Hz, the PLV value is 0.85, and the drift rate variance is 0.0002. These parameters intuitively reflect the synchronization status between devices and facilitate subsequent analysis and monitoring.

[0095] Monitoring changes in the synchronization mean and drift rate variance for device groups in the device association topology is a key step. For example, a device group might initially have a PLV mean of 0.8 and a drift rate variance of 0.0001. During monitoring, if the PLV mean drops to 0.64 (a 20% decrease) or the drift rate variance suddenly increases to 0.0003 (a threefold increase), the group is identified as having an abnormal device. This monitoring mechanism enables timely detection of synchronization anomalies between devices, preventing them from impacting the entire network.

[0096] When a device is identified as abnormal, the network controller interface is invoked to issue isolation rules to limit abnormal traffic. For example, if the IP address of an abnormal device is 192.168.1.100, the SDN controller will issue flow table rules to redirect its traffic to an isolated area and record the relevant parameters and time of the isolation event. This isolation strategy effectively prevents abnormal devices from interfering with other devices, ensuring network stability and security.

[0097] Recording the relevant parameters and time information of the isolated event is the final and crucial step. For example, the record includes the IP address, port number, protocol type, trigger parameters (such as a 20% drop in the mean PLV value or a 3-fold increase in the drift rate variance), and the timestamp of the event. This information provides crucial information for subsequent troubleshooting and network optimization, and also provides data support for security audits and log analysis.

[0098] Through the above steps, the generation of the device association topology and the isolation strategy for abnormal devices form a complete closed loop. This mechanism not only monitors the synchronization status between devices in real time, but also quickly implements isolation measures when anomalies are detected, thus ensuring stable operation and security of the network.

[0099] The preferred embodiments of the present invention disclosed above are intended only to help illustrate the present invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the present invention to specific embodiments. Obviously, many modifications and variations are possible based on the contents of this specification. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of the present invention, thereby enabling those skilled in the art to better understand and utilize the present invention.

Claims

1. A data flow analysis method based on TCP timestamp detection, characterized in that: include: Obtain traffic data from network edge nodes and extract timestamp sequences for multiple devices; Preprocessing the timestamp sequence to generate a noise-reduced time series; Calculating synchronization characteristics between devices based on the noise-reduced time series to determine a synchronization index between devices; Constructing a dynamic association map between devices through the synchronization index and calculating the association weight; Processing the dynamic association graph using a graph feature aggregation algorithm to determine the association between devices; Output a device association topology map based on the correlation results, and execute an isolation strategy for abnormal devices; The step of calculating the synchronization characteristics between devices based on the noise-reduced time series and determining the synchronization index between devices includes: Calculating the difference between adjacent timestamps in the noise-reduced time series to generate a timestamp increment sequence; Analyzing the incremental sequence by a fitting method to obtain a reference clock frequency of the device; A cross-correlation analysis method is used to calculate the phase difference between the devices, and a phase lock value is determined as the synchronization index; If the phase lock value exceeds a preset threshold, it is determined that there is a clock synchronization relationship between the devices; The step of constructing a dynamic association graph between devices using the synchronization index and calculating the association weight includes: The devices are regarded as nodes in the graph, and the synchronization index is used as the basis for the initial edge weights; The edge weight value is calculated comprehensively by combining the synchronization index between devices, the clock drift rate correlation coefficient, and the active period overlap rate; Dynamically updating the edge weight values ​​using a time decay factor to generate the dynamic association graph; If the edge weight value continuously exceeds the preset threshold, a device association event is triggered and the association relationship data is recorded.

2. The data flow analysis method based on TCP timestamp detection according to claim 1, characterized in that: The method of obtaining traffic data from network border nodes and extracting timestamp sequences of multiple devices includes: Capture packet data from network border nodes using traffic mirroring technology; Divert the message data according to the five-tuple information of the message and establish an independent timestamp queue for each device; Parsing the timestamp field in the message data to obtain the timestamp information of the device; If the timestamp information is in a local clock format, the offset is obtained through a time synchronization service and converted to a unified time base; The output contains timestamp sequences of multiple devices, which serve as input data for subsequent processing.

3. The data flow analysis method based on TCP timestamp detection according to claim 1, characterized in that: The preprocessing of the timestamp sequence to generate a noise-reduced time series includes: Segmenting the timestamp sequence using a sliding window to obtain data segments within multiple time windows; For each data segment within the time window, performing a frequency domain transform operation to calculate a power spectral density; filtering out high-frequency noise components according to the power spectrum density and retaining low-frequency effective signals; The data segments after noise filtering are reorganized into a continuous time series to generate the noise-reduced time series for subsequent feature extraction.

4. The data flow analysis method based on TCP timestamp detection according to claim 1, characterized in that: The calculation formula of the phase lock value is: ； in, is the phase lock value, is the phase difference between the timestamp sequences of the two devices in the kth time window, and n is the number of sampling points.

5. The method according to claim 1 The data flow analysis method of the detection is characterized in that: The calculation formula of the clock drift rate correlation coefficient is: ； in, is the clock drift rate correlation coefficient, is the variance of the two series, is the maximum value of the cross-correlation function of the two time stamp sequences.

6. The method according to claim 1 The data flow analysis method of the detection is characterized in that: The process of processing the dynamic association graph using a graph feature aggregation algorithm to determine the association between devices includes: Extracting a feature vector of a node in the dynamic association graph, wherein the feature vector includes a synchronization index mean and a drift rate variance; Aggregating neighbor node information of the feature vector using a graph feature aggregation algorithm to generate an embedding vector; Processing the embedding vectors using a classifier to calculate association probabilities between devices; The association between the devices is determined according to the association probability, and a correlation determination result is output.

7. The method according to claim 1 The data flow analysis method of the detection is characterized in that: Outputting a device association topology map according to the association result and executing an isolation strategy for abnormal devices includes: generating the device association topology map according to the association result, and marking the synchronization parameters between the devices; For the device group in the device association topology diagram, monitoring changes in the synchronization index mean and drift rate variance; If the synchronization index mean value drops by more than a preset ratio or the drift rate variance suddenly increases by more than a preset multiple, it is determined to be an abnormal device; Calling the network controller interface to issue isolation rules for the abnormal device to limit abnormal traffic; Record the relevant parameters and time information of the isolation event.

Images