PCDN flow dynamic identification and suppression method of network probe

Abstract

The invention belongs to the technical field of communication data processing, and particularly relates to a PCDN flow dynamic identification and suppression method of a network probe, which comprises the following steps: S1, obtaining CNAME information through DNS analysis, and constructing a CNAME feature data set; s2, constructing a decision tree model, and outputting a preliminary classification result; whether the PCDN traffic behavior exists in the new CNAME feature data set or not is judged; s3, if the decision tree model cannot complete sample classification or the classification result is' non PCDN '; if so, carrying out Bayesian probability calculation; and S4, calculating the probability that the feature set belongs to each category according to the Bayesian probability. Precise identification of PCDN traffic is realized through a hybrid model combining a decision tree and Bayesian probability. The decision tree provides efficient preliminary classification, and the Bayesian algorithm is used as a supplement; the double classification mechanism significantly improves the recognition accuracy and reduces the misjudgment rate.

Description

Technical Field

[0001] The present invention belongs to the technical field of communication data processing, and specifically, relates to a method for dynamically identifying and suppressing PCDN traffic of a network probe. Background Art

[0002] With the explosive growth of Internet applications, bandwidth-intensive applications such as video streaming media, online games, and large file downloads have dominated network traffic. To optimize content delivery, a large number of content providers have adopted the peer content delivery network (PCDN) technology to reduce costs and accelerate the user experience. However, while the PCDN technology provides convenience for content providers, some PCDN services violate the use of this technology, seriously affecting the normal operations of telecommunications operators; especially in terms of network resource scheduling and traffic management.

[0003] Traditional PCDN detection methods mainly rely on analyzing the radius traffic of AAA. Through the AAA traffic, the operator can obtain the uplink and downlink bandwidth data of users, and then determine the PCDN traffic behavior according to certain set thresholds. This method is simple to implement, but has obvious defects: once the PCDN service provider adjusts its technical parameters or deploys new nodes, the preset identification rules will fail, resulting in a sharp increase in the missed detection rate.

[0004] In recent years, some studies have attempted to apply deep learning technology to identify PCDN traffic. Although such methods have achieved high identification accuracy on specific datasets, they also face severe challenges: Firstly: For different types of network data features (such as IP addresses, HTTP information, etc.), how to design optimal encoding and processing methods to improve the feature expression ability.

[0005] Secondly: A single model often performs well in specific scenarios, but when faced with a complex and changing network environment, its generalization ability is insufficient. When the PCDN traffic changes or disguises to be highly similar to ordinary traffic, the identification accuracy of a single model drops significantly. Summary of the Invention

[0006] To solve the technical problems of the limitations of a single model and the lack of pertinence in the feature encoding and processing method in the prior art, the present invention provides a method for dynamically identifying and suppressing PCDN traffic of a network probe; through refined feature engineering, hybrid model identification, and feedback optimization mechanism; effectively solves the above problems, realizes the accurate identification of PCDN traffic, and provides strong technical support for the reasonable allocation of network resources and traffic optimization management.

[0007] The object of the present invention can be achieved by the following technical solutions: A method for dynamically identifying and suppressing PCDN traffic of a network probe, comprising the following steps: S1. Obtain CNAME information through DNS resolution and construct a CNAME feature dataset; the CNAME information includes the source domain name address, the distribution target IP address, and HTTP information; Preferably, in step S1, the specific implementation manner of obtaining CNAME information through DNS resolution includes: Remotely configure a programmed network probe in the optical modem, router, or core gateway device on the user side through the operator platform; The network probe collects DNS data packets on the user side and obtains CNAME information through DNS resolution, including the source domain name address, the distribution target IP address, and HTTP information; the HTTP information includes the Server field, the Via field, and the X-Cache field value.

[0008] Preferably, in step S1, the specific implementation manner of constructing the CNAME feature dataset includes: Perform encoding processing on each CNAME information in all samples; among them, for the source domain name address and the distribution target IP address, assign a unique integer to each unique domain name or IP address and count the frequency of its occurrence in the dataset; For the Server field and the Via field, use one-hot encoding to convert them into a multi-value discretized form; The X-Cache field value is HIT or MISS, and it is encoded into a binary form, marked as 1 or 0; Use the encoded CNAME feature dataset for subsequent model training.

[0009] S2. Construct a decision tree model, train the decision tree model based on the CNAME feature datasets of the labeled PCDN IP nodes and ordinary IP nodes; output a preliminary classification result; thereby determine whether there is PCDN traffic behavior in the new CNAME feature dataset; Preferably, in step S2, the specific implementation manner of constructing the decision tree model includes: Collect the CNAME feature datasets of the labeled PCDN IP nodes and ordinary IP nodes; Construct and initialize the decision tree model, and set the hyperparameters of the decision tree model; The decision tree starts from the root node, selects the best attribute for splitting based on the information gain method, and constructs the entire decision tree through recursive partitioning; Divide the labeled CNAME feature dataset into a training set and a test set, and use the training set data to train the decision tree model; Input the new CNAME feature dataset into the trained decision tree model; the output of the model is the preliminary classification result.

[0010] Preferably, the specific steps of the information gain method include: a) Calculate the information entropy of the initial dataset; b) For each feature's attribute, divide the dataset according to different values, and calculate the weighted sum of the information entropy of each subset; c) Traverse all feature attributes, and calculate the information gain of the dataset after its division; d) Compare the calculated information gains, and select the feature attribute with the maximum information gain as the best splitting attribute of the current node; e) According to the selected best feature attribute, how to divide the dataset into different sub-nodes; f) Recursively repeat steps b - e) for each sub-node until the stopping condition is met; the stopping conditions include that all samples in the subset belong to the same category, or there are no more attributes available for splitting.

[0011] S3. If the decision tree model fails to complete the classification of the sample or the classification result is 'non - PCDN'; then perform Bayesian probability calculation; S4. Use the feature set encoded by HTTP information, and calculate the probability that the feature set belongs to each category (PCDN or non - PCDN) according to Bayesian probability.

[0012] Preferably, in step S4, the specific implementation method of calculating the probability that the feature set belongs to each category (PCDN or non - PCDN) according to the Bayesian algorithm includes: Define the prior probability distribution: Count the occurrence frequencies of each category in the total number of samples, that is, the prior probabilities of each category; Let the number of samples belonging to data category D j be X, and the total number of samples be Z, then the expression of the prior probability is: ; Conditional probability calculation: Count the probability that the entire feature set Y appears given the category , and its expression is: ; In the formula, represents the conditional probability of observing the entire feature set Y given the data category ; represents the probability of observing a single feature given the data category ; Posterior probability calculation: According to Bayes' theorem, calculate the probability that the feature set Y belongs to the data category The posterior probability; the calculation expression of the posterior probability in Bayes' theorem is: ; In the formula, represents the posterior probability that the feature set Y belongs to the category ; represents the prior probability; represents the conditional probability.

[0013] S5. Compare the calculated PCDN probability with the non-PCDN probability; if the PCDN probability is greater than the non-PCDN probability (P > non-P), the final classification result is 'PCDN'; otherwise, it is 'non-PCDN'.

[0014] Preferably, it further includes step S6: when the final classification result calculated by the Bayesian probability is 'PCDN', use this CNAME feature data set as a new feature marked as 'PCDN' and put it into the training set to update the training decision tree model to enhance the classification ability of the decision tree model.

[0015] Preferably, step S6 further includes: Manual verification: Obtain the unit information of the domain name and CNAME that appear during the DNS resolution process; Check whether the unit to which the domain name belongs is different from the unit to which the CNAME feature belongs; Check whether the number of customers associated with this CNAME feature (i.e., the number of different domain names using this CNAME) reaches a preset threshold; If the number of customers reaches the threshold, use this CNAME feature data set as a new feature marked as 'PCDN' and put it into the training set to update the training decision tree model.

[0016] Preferably, it further includes step S7) PCDN traffic interception / suppression: For the IP ports determined to be 'PCDN', maintain a long-term service listening mode, collect DNS server logs. If a specific domain name of the DNS server is resolved to a MAN IP and meets the optical modem NAT public IP, and it is found that the long-term upstream traffic ratio is too large (60% of the traffic is in the server upload mode), then the platform side issues a suppression policy; and update the suppression policy regularly (regularly update every 1 hour - 24 hours); The suppression policy includes: limiting the upstream traffic of the optical modem; For the multi-line aggregation type bridge dial-up mode, provide a multi-line discovery report with the same MAC address, and after manual verification by the local city, block it.

[0017] Advantages of the present invention: 1. The accurate identification of PCDN traffic is achieved through a hybrid model that combines decision trees and Bayesian probability. The decision tree provides efficient preliminary classification, while the Bayesian algorithm serves as a supplement to handle cases that the decision tree cannot determine. This dual classification mechanism significantly improves the accuracy of identification and reduces the misjudgment rate.

[0018] 2. The frequency statistics processing of IP addresses, the one-hot encoding of HTTP fields, and the binary processing of X-Cache fields all fully consider the characteristics of various types of data and adopt different encoding methods, making the feature expression both accurate and efficient. This improves the expression ability of the hybrid model for network traffic characteristics and lays a foundation for subsequent accurate classification.

[0019] 3. By feeding the newly identified PCDN traffic characteristics back into the training set, the system can continuously learn and adapt to the complex changing scenarios of PCDN traffic behavior, realizing the continuous optimization of the decision tree model and effectively solving the problem of the decline in the recognition rate of traditional static models in the face of complex changing scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] To more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the drawings required for describing the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0021] Figure 1 It is a flowchart of the steps of a method for dynamically identifying and suppressing PCDN traffic of a network probe according to the present invention.

[0022] Figure 2 It is a flowchart of the steps of a decision tree model in a method for dynamically identifying and suppressing PCDN traffic of a network probe according to the present invention.

[0023] Figure 3 It is a flowchart of the steps of a Bayesian algorithm in a method for dynamically identifying and suppressing PCDN traffic of a network probe according to the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0024] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0025] Please refer to Figures 1-3As shown in the figure, a method for dynamically identifying and suppressing PCDN traffic of a network probe includes the following steps: S1. Obtain CNAME information through DNS resolution and construct a CNAME feature data set; the CNAME information includes the source domain name address, the distribution target IP address, and HTTP information.

[0026] Furthermore, in step S1, the specific implementation method for obtaining CNAME information through DNS resolution includes: Through the operator platform, remotely configure a programmed network probe in the optical modem, router, or core gateway device on the user side; The network probe collects DNS data packets on the user side and obtains CNAME information through DNS resolution, including the source domain name address, the distribution target IP address, and HTTP information; the HTTP information includes the Server field, the Via field, and the X-Cache field value.

[0027] In the specific implementation process, a programmed network probe (software probe) is adopted, which supports remote configuration, such as being issued through the TR-069 protocol. The mechanism of remotely configuring the network probe in the optical modem, router, or core gateway device on the user side gives great flexibility to the deployment. The network probe adopts an asynchronous acquisition method and supports dynamic adjustment of the sampling rate, enabling the system to adapt to network environments with different traffic scales. By analyzing the DNS requests and their HTTP response data (i.e., DNS data packets) to which it belongs, the following CNAME information is parsed and extracted to construct a data set: Source domain name address: The domain name address of the CDN service provider (such as kunlun.com of Alibaba Cloud, cdntip.com of Tencent Cloud).

[0028] Distribution target IP address: The IP address of the PCDN distribution target (such as the home router address 220.181.38.150 being used as a CDN edge node).

[0029] HTTP information: Parse the Server (such as nginx / CDN identifier), Via (such as cdn-proxy), and X-Cache (such as HIT or MIS) fields through the HTTP request header.

[0030] This software-based deployment method reduces the performance requirements for network devices, expands the applicable scope of the solution, making it applicable to both small networks and large operator networks, and has universal value.

[0031] Furthermore, in step S1, the specific implementation method for constructing the CNAME feature data set includes: Encode each CNAME information in all samples. Among them, for the source domain name address and the distribution target IP address, assign a unique integer to each unique domain name or IP address, and count the frequency of its occurrence in the dataset; For the Server field and the Via field, use one-hot encoding to convert them into a multi-valued discretized form; The value of the X-Cache field is HIT or MISS, encode it into a binary form, marked as 1 or 0; Use the encoded CNAME feature dataset for subsequent model training.

[0032] In the specific implementation process, perform hash encoding on the source domain name address and the distribution target IP address. Each unique domain name or IP address is mapped to a unique integer (e.g., 192.168.1.100 → 1001011). And count the IP occurrence frequency to generate a frequency feature (e.g., 1001011 appears 60 times / total 1000 numbers, the frequency is 0.06). For the encoding of HTTP information: perform one-hot encoding on the multi-state feature Server field to convert it into a digital vector suitable for machine learning algorithms. First, the system must collect all unique values shown in the Server and Via fields in the dataset: after determining all unique values, create an encoding dictionary and map each value to a specific position in the encoding vector: for each Server or Via field in the dataset, create and fill the encoding vector; where the encoding vectors maintain a consistent ratio. After such feature encoding processing, it can be ensured that the values of the Server and Via fields in the dataset are correctly converted into a digital format suitable for the decision tree model and Bayesian probability calculation in the PCDN traffic recognition system.

[0033] The present invention uses a variety of encoding techniques. Among them, the frequency statistics processing of IP addresses, the one-hot encoding of HTTP fields, and the binary processing of the X-Cache field all fully consider the characteristics of various types of data, making the feature expression accurate and efficient. Especially the multi-valued discretization processing of the Server and Via fields solves the problem of the complex and changeable HTTP header information, improves the model's ability to express network traffic characteristics, and lays a foundation for subsequent accurate classification.

[0034] S2. Build a decision tree model, train the decision tree model based on the CNAME feature dataset of the labeled PCDN IP nodes and ordinary IP nodes; output a preliminary classification result; thereby determine whether there is PCDN traffic behavior in the new CNAME feature dataset; Furthermore, in step S2, the specific implementation method of building the decision tree model includes: Collect the CNAME feature dataset of the labeled PCDN IP nodes and ordinary IP nodes; Construct and initialize the decision tree model, and set the hyperparameters of the decision tree model; Starting from the root node, the decision tree selects the best attribute for splitting based on the information gain method, and constructs the entire decision tree through recursive partitioning; Divide the labeled CNAME feature dataset into a training set and a test set, and use the training set data to train the decision tree model; Input the new CNAME feature dataset into the trained decision tree model; the output of the model is the preliminary classification result.

[0035] In the specific implementation process, the labeled dataset is randomly split according to the ratio of 8:2 to ensure a balanced class distribution (e.g., 70% for CDN IP and 30% for ordinary IP). Among them, the hyperparameters of the decision tree model are set as follows: Maximum tree depth: 6 - 10 layers (to prevent overfitting).

[0036] Minimum number of samples for splitting: Set to 1% of the total number of samples to ensure that each node has enough samples Minimum number of samples in leaf nodes: Set to 0.5% of the total number of samples to avoid generating overly small leaf nodes Pruning parameter: Adopt the cost complexity pruning algorithm, and the pruning parameter α is determined through cross - validation.

[0037] During the training process, 10 - fold cross - validation is adopted to evaluate the generalization ability of the model. At the same time, to handle the possible class imbalance problem, the weighted sampling method is adopted to ensure that the samples of the PCDN class and the non - PCDN class are equally treated during training. In addition, the evaluation metrics of the decision tree model include three metrics: accuracy (ACC), true positive rate (TPR), and true negative rate (TNR) to measure the model performance.

[0038] Furthermore, the specific steps of the information gain method include: a) Calculate the information entropy of the initial dataset; its formula is: ; where is the sample proportion of the i - th class (PCDN or non - PCDN, m = 2) in the dataset.

[0039] b) For each feature attribute, divide the dataset according to different values, and calculate the weighted sum of the information entropy of each subset, that is, the conditional entropy; its formula is: ; where v is the number of values of the feature attribute, ∣D j ∣ is the number of samples in the j - th subset; ∣D∣ is the number of samples in the dataset D.

[0040] c) Traverse all feature attributes and calculate the information gain of the divided data set; the information gain is the difference between the information entropy and the conditional entropy.

[0041] d) Compare the calculated information gains and select the feature attribute with the maximum information gain as the best splitting attribute of the current node; e) According to the selected best feature attribute, how to divide the data set into different child nodes; f) Recursively repeat steps b - e) for each child node until the stopping condition is met; the stopping conditions include that all samples in the subset belong to the same category, or there are no more attributes available for splitting.

[0042] In the specific implementation process, using the information gain method as the splitting criterion, the CNAME feature with high discrimination and high gain is preferentially selected as the splitting attribute of the root node to construct the decision tree. Among them, the training data used in the decision tree model stage is the CNAME feature data set of the labeled PCDN IP nodes and ordinary IP nodes; these features are obtained through DNS resolution and processed by feature encoding to obtain the digital format that conforms to the input data of the decision tree model; the output of the decision tree model is the preliminary classification result, and new samples can be directly classified as 'PCDN', that is, identified as PCDN IP nodes.

[0043] On the other hand, for samples that the decision tree model cannot classify or classifies as 'non - PCDN', the present invention further calculates the Bayesian probability classification based on HTTP information (such as X - Cache, Via fields).

[0044] S3. If the decision tree model cannot complete the classification of the sample or the classification result is 'non - PCDN'; then perform Bayesian probability calculation; S4. Using the feature set encoded by HTTP information, calculate the probability that the feature set belongs to each category (PCDN or non - PCDN) according to Bayesian probability; It should be noted that the data sets used in the Bayesian algorithm stage and the decision tree model stage are not exactly the same. Among them, the decision tree is efficient and has low time delay when dealing with strongly discriminative features (such as source domain name address and distribution target IP address). Samples can be directly and quickly identified and classified through the use of the decision tree model; for samples that are mixed and difficult to directly classify, that is, samples not classified by the decision tree, mainly collect the feature set encoded by their HTTP information; then perform further classification according to the Bayesian probability calculation.

[0045] Furthermore, in step S4, the specific implementation method of calculating the probability that the feature set belongs to each category (PCDN or non - PCDN) according to the Bayesian algorithm includes: Define the prior probability distribution: Count the occurrence frequencies of each category in the total sample set, i.e., the prior probabilities of each category; assume that the number of samples belonging to data category D j is X, and the total number of samples is Z. Then the expression for the prior probability is: ; Conditional probability calculation: Count the probability of the entire feature set Y occurring given a certain category . Its expression is: ; In the formula, represents the conditional probability of observing the entire feature set Y given data category ; represents the probability of observing a single feature given data category ; Posterior probability calculation: According to Bayes' theorem, calculate the posterior probability that the feature set Y belongs to data category . The calculation expression for the posterior probability in Bayes' theorem is: ; In the formula, represents the posterior probability that the feature set Y belongs to category ; represents the prior probability; represents the conditional probability.

[0046] Specifically, the Bayes algorithm is a classification method based on probabilistic inference. Its core idea is to use prior knowledge (prior probability) and conditional probability to combine with newly obtained data evidence to calculate the posterior probability. It is an intuitive and mathematically rigorous probabilistic inference method. When training a Bayes model, we need to estimate the prior probability and conditional probability through labeled data, and then use methods such as smoothing techniques and maximum likelihood estimation to ensure the accuracy of the model parameters. The trained Bayes model can output the posterior probability of each category according to the input multi-dimensional feature vector, thereby achieving precise classification of the data.

[0047] In the specific implementation process, the Bayes algorithm classifies these unrecognized samples, mainly using the features encoded from HTTP request header information (such as fields like Server, X-Cache, Via, etc.) for classification calculation.

[0048] As a preferred implementation, in Bayes probability calculation, there may be problems with handling zero probabilities. To avoid the entire posterior probability calculation result being zero due to a zero conditional probability, Laplace smoothing (add-one smoothing) technology can be used to correct the expressions of the prior probability and conditional probability.

[0049] S5. Compare the calculated PCDN probability with the non-PCDN probability; if P > non-P, the final classification result is 'PCDN'; otherwise, it is 'non-PCDN'.

[0050] Specifically, in the Bayesian algorithm stage, the probability that a sample belongs to each category is estimated, and it is classified into the category with a higher probability. This phased and sequential processing mechanism combines the advantages of decision trees and naive Bayes.

[0051] Furthermore, it also includes step S6: when the final classification result calculated by the Bayesian probability is 'PCDN', use this CNAME feature dataset as a new feature marked as 'PCDN' and put it into the training set to update the training decision tree model, so as to enhance the classification ability of the decision tree model.

[0052] It should be noted that the present invention also uses three indicators, namely accuracy (ACC), true positive rate (TPR), and true negative rate (TNR), to measure the effect of the overall stage compared with using the Bayesian algorithm alone; the results show that: the combination of the two performs better in terms of accuracy (ACC) and true negative rate (TNR), especially when the true positive rate (TPR) is similar. The classification accuracy has increased significantly from about 86.6% to about 99.8%. This is because the decision tree part correctly classifies in advance the samples that may be misclassified by the naive Bayesian algorithm. By allowing the decision tree to process some samples first, the number of input samples for the naive Bayesian part and the potential misjudgment rate are reduced. This mechanism combines the advantages of the two algorithms and is optimized through cyclic updates, thereby improving the overall classification accuracy and efficiency.

[0053] Furthermore, step S6 also includes: Manual verification: Obtain the unit information of the domain name and CNAME that appear during the DNS resolution process; Check whether the unit to which the domain name belongs is different from the unit to which the CNAME feature belongs; Check whether the number of customers associated with this CNAME feature (i.e., the number of different domain names using this CNAME) reaches a preset threshold; If the number of customers reaches the threshold, use this CNAME feature dataset as a new feature marked as 'PCDN' and put it into the training set to update the training decision tree model.

[0054] In the specific implementation process, the following conditions are manually verified: 1. Whether the domain name and the CNAME belong to the same service provider; 2. The number of customers associated with the CNAME feature exceeds the preset threshold (it is recommended to set it to 10 - 15 different domain names); Thereby, the traffic characteristics are checked and analyzed to rule out the possibility of misjudgment and confirm whether it conforms to the PCDN behavior pattern. Furthermore, the model update strategy is improved, including: Triggered update: When the newly added samples exceed 5% of the original training set, the model is triggered to be updated.

[0055] Incremental learning: When the newly added samples are less than 5% of the original training set, the incremental learning method is adopted to avoid the computational overhead caused by complete retraining. Through this closed-loop feedback mechanism, the decision tree model can continuously learn new PCDN traffic characteristics, improve the recognition accuracy, and adapt to the mixed scenarios of PCDN traffic behavior. This adaptive learning ability makes the hybrid model become more and more intelligent as the usage time increases, and the classification accuracy is greatly improved.

[0056] Furthermore, it also includes step S7) PCDN traffic interception / suppression: For the IP ports determined to be 'PCDN', maintain the long-term service monitoring mode, collect DNS server logs. If a specific domain name of the DNS server is resolved to a MAN IP and meets the optical modem NAT public IP, and it is found that the proportion of the long-term upstream traffic is too large (60% of the traffic is in the server upload mode), the suppression policy is issued by the platform side; and the suppression policy is updated regularly (updated regularly every 1 hour - 24 hours); The suppression policy includes: limiting the upstream traffic of the optical modem; For the multi-line aggregated bridging dial-up mode, provide a multi-line discovery report with the same MAC address, and after manual verification and on-site inspection arranged by the local city, it is blocked.

[0057] In summary, the provided method for dynamically identifying and suppressing PCDN traffic of a network probe in the present invention converts various information (source domain name, distribution target IP address, HTTP information, etc.) in DNS packets into features available for machine learning, and adopts a suitable coding method to process different types of data. The accurate identification of PCDN traffic is achieved through a hybrid model combining decision tree and Bayesian probability. The decision tree is used as the main classifier and Bayesian probability as a supplement, making full use of the interpretability of the decision tree and the ability of the Bayesian algorithm to handle uncertainties. By feeding the newly identified PCDN traffic characteristics back to the training set of the decision tree model, the continuous optimization of the decision tree model is realized, enabling it to adapt to the mixed change scenarios of PCDN traffic behavior. It effectively solves the problem of the decline in the recognition rate of traditional static models in the face of technical mixed change scenarios.

[0058] When optimizing the model, the manual verification and review behavior is also combined, which not only improves the efficiency but also ensures the accuracy. The present invention provides a method for network operators to efficiently identify and suppress PCDN traffic by efficiently combining various machine learning algorithms and data processing technologies, and has strong practical value.

[0059] In the description of the specification, the descriptions referring to terms such as "further", "in a specific implementation process", "specific example", etc. mean that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. The above content is only an example and explanation of the structure of the present invention. Those skilled in the art of this technology can make various modifications or supplements to the described specific embodiments or use similar ways to replace them, as long as they do not deviate from the structure of the invention or exceed the scope defined by the claims of the present invention, they shall fall within the protection scope of the present invention.

Claims

1. A method for dynamically identifying and suppressing PCDN traffic of a network probe, characterized in that: It includes the following steps: S1. Obtain CNAME information through DNS resolution and construct a CNAME feature dataset; The CNAME information includes the source domain name address, the distribution target IP address, and HTTP information; S2. Construct a decision tree model, train the decision tree model based on the CNAME feature datasets of the labeled PCDN IP nodes and ordinary IP nodes; output the preliminary classification result; thereby determine whether there is PCDN traffic behavior in the new CNAME feature dataset; S3. If the decision tree model cannot complete the classification of the samples or the classification result is 'non-PCDN'; then perform Bayesian probability calculation; S4. Use the feature set encoded by the HTTP information to calculate the probability that the feature set belongs to each category according to the Bayesian probability; S5. Compare the calculated PCDN probability with the non-PCDN probability; if the PCDN probability is greater than the non-PCDN probability, the final classification result is 'PCDN', otherwise it is 'non-PCDN'.

2. The method for dynamically identifying and suppressing PCDN traffic of a network probe according to claim 1, wherein: In step S1, the specific implementation method for obtaining CNAME information through DNS resolution includes: Remotely configure a programmatic network probe in the optical modem, router, or core gateway device on the user side through the operator platform; The network probe collects DNS data packets on the user side and obtains CNAME information through DNS resolution. The CNAME information includes the source domain name address, the distribution target IP address, and HTTP information; the HTTP information includes the Server field, the Via field, and the X-Cache field value.

3. A method for dynamically identifying and suppressing PCDN traffic of a network probe according to claim 1, characterized in that: In step S1, the specific implementation method for constructing the CNAME feature dataset includes: Perform encoding processing on each CNAME information in all samples; among them, for the source domain name address and the distribution target IP address, assign a unique integer to each unique domain name or IP address and count its frequency of occurrence in the dataset; For the Server field and the Via field, use one-hot encoding to convert them into a multi-valued discrete form; The X-Cache field value is HIT or MISS, encode it into a binary form, marked as 1 or 0; Use the encoded CNAME feature dataset for subsequent model training.

4. A method for dynamically identifying and suppressing PCDN traffic of a network probe according to claim 1, characterized in that: In step S2, the specific implementation method for constructing the decision tree model includes: Collect the CNAME feature datasets of the labeled PCDN IP nodes and ordinary IP nodes; Construct and initialize the decision tree model, and set the hyperparameters of the decision tree model; The decision tree starts from the root node, selects the best attribute for splitting based on the information gain method, and constructs the entire decision tree through recursive partitioning; Divide the labeled CNAME feature dataset into a training set and a test set, and use the training set data to train the decision tree model; Input the new CNAME feature dataset into the trained decision tree model; the output of the model is the preliminary classification result.

5. A method for dynamically identifying and suppressing PCDN traffic of a network probe according to claim 4, characterized in that: The specific steps of the information gain method include: a) Calculate the information entropy of the initial dataset; b) For each feature attribute, divide the dataset according to different values, and calculate the weighted sum of the information entropy of each subset; c) Traverse all feature attributes and calculate the information gain of the dataset after its partitioning; d) Compare the calculated information gain and select the feature attribute with the maximum information gain as the best splitting attribute for the current node; e) According to the selected best feature attribute, how to partition the data set into different child nodes; f) Recursively repeat steps b - e) for each child node until the stopping condition is met.

6. A method for dynamically identifying and suppressing PCDN traffic of a network probe according to claim 5, characterized in that: The stopping condition includes that all samples in the subset belong to the same category or there are no more attributes available for splitting.

7. A method for dynamically identifying and suppressing PCDN traffic of a network probe according to claim 1, characterized in that: In step S4, the specific implementation of calculating the probability that the feature set belongs to each category according to the Bayesian algorithm includes: Define the prior probability distribution: Count the occurrence frequencies of each category in the total sample, that is, the prior probabilities of each category; assume that the number of samples belonging to data category D j is X, and the total number of samples is Z, then the expression for the prior probability is: ； Conditional probability calculation: Statistically calculate the probability of the entire feature set Y occurring given the category D j ; Its expression is: ； wherein, represents the conditional probability of observing the entire feature set Y under the data class ; represents the probability of observing a single feature under the data class ; Posterior probability calculation: According to Bayes' theorem, calculate the posterior probability that the feature set Y belongs to the data category ; The calculation expression of the posterior probability is as follows: ； In the formula, represents the posterior probability that the feature set Y belongs to the category ; represents the prior probability; represents the conditional probability.

8. A method for dynamically identifying and suppressing PCDN traffic of a network probe according to any one of claims 1-7, characterized in that, It further includes step S6: When the final classification result calculated by the Bayesian probability is 'PCDN', use this CNAME feature data set as a new feature marked as 'PCDN' and put it into the training set to update the training decision tree model to enhance the classification ability of the decision tree model.

9. A method for dynamically identifying and suppressing PCDN traffic of a network probe according to claim 8, characterized in that, Step S6 further includes: Obtain the unit information of the domain name and CNAME that appear during the DNS resolution process; Check whether the unit to which the domain name belongs is different from the unit to which the CNAME feature belongs; Check whether the number of customers associated with this CNAME feature reaches a preset threshold; If the number of customers reaches the threshold, use this CNAME feature data set as a new feature marked as 'PCDN' and put it into the training set to update the training decision tree model.

10. A method for dynamically identifying and suppressing PCDN traffic of a network probe according to claim 8, characterized in that: It further includes step S7) PCDN traffic interception / suppression: For the IP ports determined to be 'PCDN', maintain a long-term service listening mode. By collecting DNS server logs, if a specific domain name of the DNS server is resolved to a MAN IP and meets the optical modem NAT public IP, and it is found that the proportion of the long-term upstream traffic is too large, then limit the upstream traffic of the optical modem; For the multi-line aggregation type bridge dial-up mode, provide a multi-line discovery report with the same MAC address, and after manual on-site verification arranged by the local city, block it.

Images