Session aging method, device and electronic device for traffic monitoring equipment

Abstract

The present invention discloses a session aging method, device and electronic device for a traffic monitoring device, which relates to the field of information security. The method includes inserting a smart pointer of a session object generating session activity into a red-black tree of the current tail node of a circular queue within a current time slice corresponding to the current tail node of the circular queue, and increasing the reference count of the session object pointed to by the smart pointer by 1; using a timer to drive the circular queue to move one node backward and popping out the red-black tree of the oldest node; reducing the reference count of the corresponding session object by 1, and when the reference count reaches 0, destroying the corresponding session object; repeating the above steps until the session aging detection is completed; and adjusting the detection cycle based on dynamic multi-level precision of the load. The present invention can reduce CPU consumption, optimize the timeliness of detection response, effectively alleviate the problem of memory fragmentation, and improve memory usage efficiency. Through the dynamic multi-level precision time window adjustment mechanism, an intelligent balance between system resource occupancy and aging detection timeliness is achieved.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to a session aging method, device and electronic equipment for flow monitoring equipment. Background Art

[0002] Traffic monitoring devices typically create a session table based on the five-tuple (source IP, source port, destination IP, destination port, and protocol type) of received packets and detect session timeouts. The current state of the art uses a linear table to periodically poll the update times of all session objects. However, this approach consumes more CPU when the number of sessions is large. Traversing the entire session list takes more time, resulting in delayed session aging. Furthermore, the linear table storage method leads to memory fragmentation, affecting memory utilization. Consequently, existing session aging detection methods suffer from poor performance. Summary of the Invention

[0003] To address these issues, the present invention proposes a session aging method, apparatus, and electronic device for traffic monitoring devices. These methods reduce CPU consumption, optimize detection response timeliness, effectively alleviate memory fragmentation, and improve memory usage efficiency. Through a dynamic, multi-level precision time window adjustment mechanism, an intelligent balance is achieved between system resource utilization and aging detection timeliness.

[0004] In a first aspect, the present invention provides a session aging method for a traffic monitoring device, comprising:

[0005] S1: In a current time slice corresponding to a current tail node of a pre-established circular queue, insert a smart pointer of a session object generating session activity into a red-black tree of the current tail node, and increment a reference count of the session object pointed to by the smart pointer by a preset first additional value each time the smart pointer is inserted; wherein the smart pointer stores the reference count of the session object;

[0006] S2, using a timer to drive the circular queue to move backward one node at a preset node update period, and popping out the red-black tree of the oldest node before the circular queue moves; wherein the preset node update period is determined based on the following formula (1):

[0007] T = Ttick × K , (1)

[0008] In formula (1), T is the circular queue node update period, Ttick is the unit time, K is the step size coefficient;

[0009] S3, reducing the reference count of the session object corresponding to the popped-up smart pointer by a preset first additional value, and when the reference count of the session object reaches a preset first threshold, destroying the corresponding session object;

[0010] S4, repeating steps S1 to S3 until the session aging detection is completed.

[0011] In an optional embodiment, the capacity of the circular queue C for:

[0012] , (2)

[0013] In formula (2), C Indicates the capacity of the circular queue; Indicates the time slice span value, Indicates the session aging time. n Indicates the preset second additional value; wherein, yes an integer multiple of ;

[0014] S5, adjust the step size coefficient based on dynamic load sensing mechanism K , to balance detection accuracy and session carrying capacity.

[0015] In an optional implementation, the preset second additional value is 1.

[0016] In an optional embodiment, the reference counts corresponding to the same session object in each node of the circular queue are the same. When the reference count of the session object in the current tail node is added to the preset first additional value, the reference counts of the same session object in the non-tail nodes in the circular queue are synchronously added to the preset first additional value.

[0017] In an optional implementation, the preset first additional value is 1.

[0018] In an optional implementation, the preset first threshold is 0.

[0019] In an optional embodiment, the S5 includes:

[0020] Determine the load value based on the following formula (3): Load ;

[0021] , (3)

[0022] In formula (3), and γ are weight coefficients respectively; Indicates CPU usage. Indicates the memory used. Indicates the total amount of memory, Indicates the current session number, Indicates the total number of sessions;

[0023] According to the load value Load Dynamic Adjustment K Value; where:

[0024] When the load value Load Greater than the first preset threshold M1 When , update immediately according to the following formula (4) K , to reduce K The value can improve detection accuracy, shorten session cycle, and release zombie sessions in time;

[0025] , (4)

[0026] In formula (4), for K The updated value of

[0027] When continuous evaluation N Evaluation cycle load value Load are both less than the second preset threshold M2 When , the progressive update is performed according to the following formula (5): K , to reduce the accuracy of session detection and carry long-term sessions;

[0028] , (5)

[0029] In formula (5), for K The updated value of is the default value, M2 Less than M1 ;

[0030] When the session growth rate is greater than the third pre-trial threshold, switch immediately K The value is 1.

[0031] In an optional embodiment, the first preset threshold is 0.65-0.75; the second preset threshold is 0.35-0.45; the third preset threshold is 950-1050 seconds; is 0.55~0.65, is 0.25~0.35, It is 0.05~0.15.

[0032] In a second aspect, the present invention provides a session aging device for a traffic monitoring device, comprising:

[0033] an insertion module, configured to insert a smart pointer of a session object generating session activity into the red-black tree of the current tail node of a pre-established circular queue within a current time slice corresponding to the current tail node of the queue, and to increase a reference count of the session object pointed to by the smart pointer by a preset first additional value each time the smart pointer is inserted; wherein the smart pointer stores the reference count of the session object;

[0034] A pop-up module is used to use a timer to drive the circular queue to move backward by one node at a preset node update period, and pop out the red-black tree of the oldest node before the circular queue moves; wherein the preset node update period is determined based on the following formula (2):

[0035] T = Ttick × K , (2)

[0036] In formula (2), T is the circular queue node update period, Ttick is the unit time, K is the step size coefficient;

[0037] a destruction module, configured to reduce a reference count of a session object corresponding to the popped-up smart pointer by a preset first additional value, and destroy the corresponding session object when the reference count of the session object reaches a preset first threshold;

[0038] A repeat module is used to repeatedly execute the insert module, the pop-up module and the destroy module until the session aging detection is completed;

[0039] Step coefficient update module, used to adjust the step coefficient based on dynamic load sensing mechanism K , to balance detection accuracy and session carrying capacity.

[0040] In a third aspect, the present invention provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0041] In a fourth aspect, the present invention provides a computer-readable medium having a non-volatile program code executable by a processor, wherein the program code enables the processor to execute the session aging method of the traffic monitoring device described in any one of the first aspects.

[0042] In a fifth aspect, the present invention provides a computer program product comprising a computer-readable code, or a non-volatile computer-readable storage medium carrying a computer-readable code. When the computer-readable code runs in an electronic device, the processor in the electronic device executes the session aging method of the traffic monitoring device described in any one of the first aspects.

[0043] The technical solution provided by the embodiments of the present invention has the following beneficial effects: the session aging method, apparatus, and electronic device of the traffic monitoring device of the present invention insert a smart pointer of the corresponding session object into the red-black tree of the current tail node of a pre-established circular queue when a new session object arrives or an existing session object is updated, and a reference count is added to a preset first additional value when the smart pointer points to the corresponding session object. When the oldest node expires and the red-black tree is popped out, the reference count of the session object corresponding to the popped-out smart pointer is subtracted from the preset first additional value; when the reference count of the session object reaches a preset first threshold, the corresponding session object is destroyed. In this way, each time the circular queue is traversed, it is only necessary to check whether the reference count of the session object popped out of the current oldest node is the first additional value, without traversing all session objects. This can reduce CPU consumption, reduce detection delay, reduce memory fragmentation, improve memory utilization, and ensure timely session aging. In addition, because the detection period is adjusted based on dynamic multi-level precision of the load, a dynamic multi-level precision time window adjustment mechanism can be used to achieve an intelligent balance between system resource usage and aging detection timeliness. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A flow chart of a session aging method for a traffic monitoring device according to an embodiment of the present invention;

[0045] Figure 2 A schematic diagram illustrating the principle of a session aging method for a traffic monitoring device provided in an embodiment of the present invention;

[0046] Figure 3 Another schematic diagram of the principle of the session aging method for a traffic monitoring device provided by an embodiment of the present invention;

[0047] Figure 4 Another schematic diagram of the principle of the session aging method of the traffic monitoring device provided in an embodiment of the present invention;

[0048] Figure 5 Another schematic diagram of the principle of the session aging method of the traffic monitoring device provided in an embodiment of the present invention;

[0049] Figure 6 A schematic diagram of the system principle of a session aging device for a traffic monitoring device provided by an embodiment of the present invention;

[0050] Figure 7 A schematic diagram of the system principle of an electronic device provided by an embodiment of the present invention.

[0051] In the figure: 100 - insertion module; 200 - eject module; 300 - destruction module; 400 - repeat module; 500 - step coefficient update module; 1000 - electronic device; 1001 - communication interface; 1002 - processor; 1003 - memory; 1004 - bus. DETAILED DESCRIPTION

[0052] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0053] Reference Figure 1 , a session aging method for a traffic monitoring device, comprising the following steps S1 to S5.

[0054] Step S1, within the current time slice corresponding to the current tail node of a pre-established circular queue, insert the smart pointer of the session object generating the session activity into the red-black tree of the current tail node, and increase the reference count of the session object pointed to by the smart pointer by a preset first additional value each time the insertion occurs; wherein the smart pointer stores the reference count of the session object.

[0055] Here, the circular queue is a fixed-size ring array that is connected from head to tail. When traversing, only the current tail node is processed, and the nodes are arranged in time slice order to form a natural time mapping, and its capacity is fixed.

[0056] The current time slice corresponding to the current tail node refers to the period of time during which the tail node is active (the length of this period is the span of the time slice). The time slice here is the smallest time unit of the circular queue, representing the fixed length of time corresponding to a node in the queue.

[0057] The tail node refers to the node where the latest data is inserted into the circular queue, such as Figure 2 The node 5 pointed to by the tail of the queue in is the tail node. When the timer expires, driven by the timer, the tail node moves back one node, the original tail node becomes an inactive node, and the current tail node becomes node 4, as shown in the following example: Figure 3 As shown in the following figure, there may be a session in the current time slice session table. This session may be a new session or an update of an existing session object.

[0058] Smart pointers are created for new or updated session objects generated within the current time slice. Each new or existing session object corresponds to a corresponding smart pointer. These smart pointers are inserted into a red-black tree, with each smart pointer pointing to its corresponding session object. The red-black tree is stored in nodes of a circular queue. The smart pointers include a reference count, which indicates that the current session object has a session within the current time slice. This means that the reference count of the current session object is increased by a preset first additional value. Typically, the preset first additional value is 1, which represents the weight of the session object within the current time slice.

[0059] That is, in the current time slice, session object 1 has 3 sessions, session object 2 has 1 session, and session object 3 has no session. Then the preset additional values ​​added to their reference counts are 1 (session object 1) and 1 (session object 2), respectively. Session object 3 has no session, and its smart pointer is not inserted into the current tail node of the queue.

[0060] The capacity of a circular queue refers to the total number of nodes in the circular queue. The capacity value C of the circular queue is:

[0061] , (2)

[0062] In formula (2), C Indicates the capacity of the circular queue; Indicates the time slice span value, Indicates the session aging time. n Indicates the preset second additional value; wherein, yes An integer multiple of .

[0063] In this embodiment, the second additional value is preset to 1, that is, the capacity of the circular queue is the session aging time plus 1.

[0064] S2, uses a timer to drive the circular queue to move one node backward at a preset node update period, and pops out the red-black tree of the oldest node before the circular queue moves. The preset node update period is determined based on the following formula (1):

[0065] T = Ttick × K , (1)

[0066] In formula (1), T is the circular queue node update period, Ttick is the unit time, K is the step size coefficient.

[0067] S3, reducing the reference count of the session object corresponding to the popped-up smart pointer by a preset first additional value, and destroying the corresponding session object when the reference count of the session object reaches a preset first threshold.

[0068] S4, repeating steps S1 to S3 until the session aging detection is completed.

[0069] S5, adjust the step size coefficient based on dynamic load sensing mechanism K , to balance detection accuracy and session carrying capacity.

[0070] In step S1, after the smart pointer points to the session object, the reference count is increased by the preset first additional value. Similarly, in step S3, the smart pointer is popped out along with the red-black tree, the smart pointer is deleted, and the reference count of the session object pointed to by the smart pointer is reduced by the preset first additional value.

[0071] Here, the reference count is a global variable. The first additional value is incremented based on the current value of the reference count. This ensures that the reference counts corresponding to the same session object in each node of the circular queue are identical. When the reference count of the session object at the tail node is incremented by the preset first additional value, the reference counts of the same session object in non-tail nodes in the circular queue are simultaneously incremented by the preset first additional value. In this embodiment, the preset first additional value is 1, and the preset first threshold is 0.

[0072] Step S4 means that the circular queue moves backward one node in each time slice, and the smart pointer of the new session object or the session object with session update in the corresponding time slice is inserted into the current tail node of the queue, maintaining the principle of new in and old out.

[0073] This embodiment will be further explained below with reference to the accompanying drawings.

[0074] like Figure 2 As shown, the timer is set to 1 second, meaning the time slice span is 1 second. The circular queue rotates based on the time slice, ensuring that new data is always in and old data is out. For example, assume that the session aging time is 5 seconds and the circular queue capacity is 6 (the session aging time is 5 plus 1). At 0 seconds, when a message from session 1 and a message from session 2 are received, the session smart pointer is inserted into the tail node 5 of the circular queue. The session smart pointers are connected via a red-black tree. Figure 2 The reference count = 1 in the current session 1 and session 2 means that the reference counts are both 1.

[0075] like Figure 3 As shown in the figure, when the circular queue moves back one node, that is, at the first second, the message of session 1 (first session) is received, and the smart pointer of session 1 is inserted into the tail node 4 of the circular queue. At this time, the reference count of session 1 is increased by 1, and its reference count = 2. The message of session 2 (second session) is not received, and the reference count of session 2 is still 1. Figure 3In the example, the reference count of session 1 in node 5 is 2. That is to say, in the entire circular queue, if other nodes also store the reference count of session 1, the reference count of session 1 in other nodes is synchronously updated to 2.

[0076] The circular queue rotates backward every 1s, the red-black tree of the oldest node needs to be popped out, and the popped red-black tree is cleared. Figure 4 As shown in , all sessions have not timed out within 5 seconds, so no red-black tree has popped up yet. Figure 5 As shown in the figure, after more than 5 seconds, Session 1 and Session 2 at the tail node 5 are dequeued. When the smart pointer is popped, the reference counts of Session 1 and Session 2 are reduced by 1. After the smart pointer of Session 2 is popped, its reference count is 0, and Session 2 is destroyed. After Session 1 is popped, its reference count is 1, so Session 1 is not destroyed.

[0077] When the 6th second expires, the tail node 4 is popped out, the reference count of session 1 is reduced by 1, the session object times out and is popped out, and session 1 is destroyed.

[0078] This embodiment only needs to check whether the reference count of the session object in the current time window is 0 each time, without having to traverse all session objects. Therefore, this embodiment greatly improves performance. The following further illustrates the beneficial effects of this embodiment in conjunction with test results.

[0079] During testing, a Linux system was used, with both the method of this embodiment and the existing timed polling method deployed in the traffic monitoring device firmware. Different aging times were set for different session sizes (1,000, 10,000, and 100,000): 5 seconds (for 1,000 sessions), 30 seconds (for 10,000 sessions), and 1 minute (for 100,000 sessions). Each session included a random source / destination IP address, port number, and timestamp. Both session aging detection methods were tested on the same hardware (a 4-core CPU and 8GB of RAM).

[0080] First, start the aging detection task (for existing scheduled polling, the default is to traverse the entire table; for this embodiment, only the head of the circular queue is checked). Record the detection time, peak / average CPU usage, and memory usage for each detection. Calculate the delay in clearing aged sessions (the time difference between timeout and actual clearing). For this embodiment, record the number of sessions actually processed for each detection (for example, the 100 sessions at the head of the queue). Test each combination of session size and aging time 10 times and take the average value. The test results are shown in Tables 1 to 3.

[0081] Table 1 Session size 1000

[0082]

[0083] Table 2 Session size 10000

[0084]

[0085] Table 3 Session size 100,000

[0086]

[0087] Tables 1 through 3 show that with existing timing discussion methods, traversal time increases linearly with increasing session size, leading to near-full CPU load (e.g., reaching a maximum of 98% at 100,000 sessions). Detection time also increases significantly with session size (e.g., a 5-second delay at 100,000 sessions), preventing timely cleanup of aging sessions. Memory usage fluctuates significantly (e.g., 1.5 GB at 100,000 sessions), likely due to memory fragmentation caused by the linear table.

[0088] The session detection method of the traffic monitoring device of this embodiment only processes the head-of-queue sessions, and CPU consumption is stabilized at a low level (e.g., 15% for 100,000 sessions). The delay is only related to the number of head-of-queue sessions and is not related to the total size (e.g., 20ms for 100,000 sessions). The method of this embodiment uses continuous memory in the circular queue, resulting in more stable usage (1.2 GB for 100,000 sessions).

[0089] Therefore, when there are a large number of sessions, traditional timed polling consumes more CPU and takes longer to complete, potentially leading to delayed session aging. Linear table storage can lead to memory fragmentation, impacting memory utilization. However, the method of this embodiment can reduce CPU usage, freeing up more CPU for data processing and computation, preventing delayed session aging. The circular queue structure employed can reduce memory fragmentation and improve memory utilization. Therefore, the method of this embodiment can effectively improve the performance of session aging detection.

[0090] In an optional embodiment, S5 includes:

[0091] Determine the load value based on the following formula (3): Load ;

[0092] , (3)

[0093] In formula (3), and γ are weight coefficients respectively; Indicates CPU usage. Indicates the memory used. Indicates the total amount of memory, Indicates the current session number, Indicates the total number of sessions;

[0094] According to the load value Load Dynamic Adjustment K Value; where:

[0095] When the load value Load Greater than the first preset threshold M1 When , update immediately according to the following formula (4) K , in order to reduce the K value to improve detection accuracy, shorten the session cycle, and release zombie sessions in time;

[0096] , (4)

[0097] In formula (4), for K The updated value of

[0098] When continuous evaluation N Evaluation cycle load value Load are both less than the second preset threshold M2 When , the progressive update is performed according to the following formula (5): K , to reduce the accuracy of session detection and carry long-term sessions;

[0099] , (5)

[0100] In formula (5), for K The updated value of is the default value, M2 Less than M1 ;

[0101] When the session growth rate is greater than the third pre-trial threshold, immediate switching with cooling K The value is 1.

[0102] Here, the first preset threshold is 0.65-0.75, preferably the first preset threshold is 0.7; the second preset threshold is 0.35-0.45, preferably the second preset threshold is 0.4; the third preset threshold is 950 per second to 1050 per second, preferably the third preset threshold is 1000 per second; 0.55~0.65, 0.25~0.35, is 0.05 to 0.15. Preferably, is 0.6, is 0.3, is 0.1. Generally, it is determined by the traffic analysis device based on the traffic session and stored in the hash table. It is a status parameter of the traffic analysis device. Refers to the maximum number of sessions processed by the traffic analysis device, generally the maximum capacity of the hash table.

[0103] This embodiment can dynamically adjust the detection accuracy, and the timer is based on the cycle T Update once, where T As shown in formula (1). T tick When 1s, K =1 per T tick Once is Δt (such as 1s), circular queue (capacity C The aging cycle is 5Δ t (5s). If K =2, each T tick * K =2s, then the circular queue (capacity C The aging cycle of 5) is 10Δ t (10s). If the maximum aging time is T_max =60s, 60 / 5 =12 then K =1,2,3...12, i.e. the maximum detection period in this embodiment The timeout period is 12s and can be adjusted.

[0104] and K The smaller the value, the higher the detection accuracy and the more timely the aging of zombie sessions. K The larger the value, the lower the detection accuracy and the longer the aging time, but it can carry long-term detection sessions. Policy execution depends on session status (such as access control based on connection length). Accidentally deleting valid sessions may lead to policy bypass, and prematurely releasing zombie sessions may cover up attack traces. When the detection is overloaded, Load >70%, dynamic reduction K value (the switching speed takes effect immediately), improve the detection accuracy, shorten the session cycle, and release the zombie session in time. When the throughput is low, such as the throughput is less than 10% of the average throughput, it can be dynamically increased K (Switching speed is gradual migration), reduce the accuracy of session detection, carry long-term sessions. When the session growth rate is greater than 1000 per second, K When it is 1, the switching speed is immediate switching with cooling.

[0105] The method of this embodiment is tested on a server with 4 core CPUs and 8G memory, where C=5. is 12. The results are shown in Table 4.

[0106] Table 4

[0107]

[0108] It can be seen that through a single parameter K The control can simultaneously meet the conflicting requirements of short-cycle fast recovery and long-cycle low overhead, and dynamically adjust according to real-time load K value. Reduces CPU fluctuations by 40%. Compared to traditional time wheel solutions, it can quickly clean up abnormal connections to avoid full session pools and periodic memory shortages, precisely regulate and smoothly transition, and avoid avalanches caused by detection delays. This embodiment supports mixed business scenarios with session periods ranging from seconds (1s) to minutes (60s), and the long connection retention rate is increased to 99.97%. This embodiment uses a progressive parameter adjustment algorithm to avoid session jitter caused by sudden changes in detection accuracy.

[0109] This embodiment adjusts the detection cycle based on dynamic multi-level precision of the load, and achieves an intelligent balance between system resource usage and aging detection timeliness through a dynamic multi-level precision time window adjustment mechanism.

[0110] See also Figure 6 The embodiment of the present invention provides a session aging device for a traffic monitoring device, comprising an insertion module 100, a pop-up module 200, a destruction module 300, a repetition module 400, and a step coefficient update module 500. The insertion module 100 is used to insert the smart pointer of the session object generating the session activity into the red-black tree of the current tail node of the pre-established circular queue within the current time slice corresponding to the current tail node of the pre-established circular queue, and increase the reference count of the session object pointed to by the smart pointer by a preset first additional value each time the insertion is performed; wherein the smart pointer stores the reference count of the session object. The pop-up module 200 is used to use a timer to drive the circular queue to move one node backward at a preset node update period, and pop out the red-black tree of the oldest node before the circular queue moves. The destruction module 300 is used to reduce the reference count of the session object corresponding to the popped smart pointer by a preset first additional value, and when the reference count of the session object reaches a preset first threshold, the corresponding session object is destroyed. The repetition module 400 is used to repeatedly execute the insertion module, the pop-up module, and the destruction module until the session aging detection is completed; the step coefficient update module 500 is used to adjust the step coefficient based on the dynamic load sensing mechanism. K , to balance detection accuracy and session carrying capacity.

[0111] The preset node update period is determined based on the following formula (1):

[0112] T = Ttick × K , (1)

[0113] In formula (1), T is the circular queue node update period, Ttick is the unit time, Kis the step size coefficient.

[0114] In an alternative embodiment, the capacity of the circular queue C for:

[0115] , (2)

[0116] In formula (2), C Indicates the capacity of the circular queue; Indicates the time slice span value, Indicates the session aging time. n Indicates the preset second additional value; wherein, yes An integer multiple of .

[0117] In an optional embodiment, the second additional value is preset to 1.

[0118] In an optional embodiment, the reference counts corresponding to the same session object in each node of the circular queue are the same. When the reference count of the session object in the current tail node is added to the preset first additional value, the reference counts of the same session object in the non-tail nodes in the circular queue are synchronously added to the preset first additional value.

[0119] In an optional embodiment, the first additional value is preset to 1.

[0120] In an optional embodiment, the first threshold is preset to 0.

[0121] In an optional embodiment, the step coefficient updating module 500 includes a load value determining module and a load value updating module. The load value determining module is used to determine the load value based on the following formula (3): Load ;

[0122] , (3)

[0123] In formula (3), and γ are weight coefficients respectively; Indicates CPU usage. Indicates the memory used. Indicates the total amount of memory, Indicates the current session number, Indicates the total number of sessions;

[0124] According to the load value Load Dynamic Adjustment K Value; where:

[0125] When the load value Load Greater than the first preset threshold M1 When , update immediately according to the following formula (4) K , to reduceK The value can improve detection accuracy, shorten session cycle, and release zombie sessions in time;

[0126] , (4)

[0127] In formula (4), for K The updated value of

[0128] The load value update module is used to continuously evaluate N Evaluation cycle load value Load are both less than the second preset threshold M2 When , the progressive update is performed according to the following formula (5): K , to reduce the accuracy of session detection and carry long-term sessions;

[0129] , (5)

[0130] In formula (5), for K The updated value of is the default value, M2 Less than M1 ;

[0131] When the session growth rate is greater than the third pre-trial threshold, switch immediately K The value is 1.

[0132] In an optional embodiment, the first preset threshold is 0.65-0.75; the second preset threshold is 0.35-0.45; the third preset threshold is 950 per second-1050 per second; 0.55~0.65, 0.25~0.35, It is 0.05~0.15.

[0133] The device provided in the embodiment of the present application adopts the same inventive concept as the above-mentioned method provided in the embodiment of the present application. On the premise that the method can solve the technical problem, the device can also solve the technical problem, and no further details will be given here.

[0134] Reference Figure 7 An embodiment of the present invention further provides an electronic device 1000, including a communication interface 1001, a processor 1002, a memory 1003 and a bus 1004, wherein the processor 1002, the communication interface 1001 and the memory 1003 are connected via the bus 1004; the memory 1003 is used to store a computer program that supports the processor 1002 to execute the session aging method of the traffic monitoring device, and the processor 1002 is configured to execute the program stored in the memory 1003.

[0135] Optionally, an embodiment of the present invention further provides a computer-readable medium having a non-volatile program code executable by the processor 1002 , where the program code enables the processor 1002 to execute the session aging detection method of the traffic monitoring device in the above embodiment.

[0136] It is understood from common technical knowledge that the present invention may be implemented by other embodiments that do not depart from its spirit or essential features. Therefore, the embodiments disclosed above are, in all respects, merely illustrative and not exclusive. All modifications within the scope of the present invention or equivalent to the scope of the present invention are intended to be encompassed by the present invention.

Claims

1. A session aging method for a traffic monitoring device, characterized in that: include: S1: In a current time slice corresponding to a current tail node of a pre-established circular queue, insert a smart pointer of a session object generating session activity into a red-black tree of the current tail node, and increment a reference count of the session object pointed to by the smart pointer by a preset first additional value each time the smart pointer is inserted; wherein the smart pointer stores the reference count of the session object; S2, using a timer to drive the circular queue to move backward one node at a preset node update period, and popping out the red-black tree of the oldest node before the circular queue moves; wherein the preset node update period is determined based on the following formula (1): T = Ttick × K ，（1） In formula (1), T is the circular queue node update period, Ttick is the unit time, K is the step size coefficient; S3, reducing the reference count of the session object corresponding to the popped-up smart pointer by a preset first additional value, and when the reference count of the session object reaches a preset first threshold, destroying the corresponding session object; S4, repeat steps S1 to S3 until the session aging detection is completed; S5, adjust the step size coefficient based on dynamic load sensing mechanism K , to balance detection accuracy and session carrying capacity.

2. The session aging method of the traffic monitoring device according to claim 1, characterized in that: The capacity of the circular queue C for: ，（2） In formula (2), C Indicates the capacity of the circular queue; Indicates the time slice span value, Indicates the session aging time. n Indicates the preset second additional value; wherein, yes An integer multiple of .

3. The session aging method of the traffic monitoring device according to claim 2, characterized in that: The preset second additional value is 1.

4. The session aging method of the traffic monitoring device according to claim 1, characterized in that: The reference counts corresponding to the same session object in each node of the circular queue are the same. When the reference count of the session object in the current tail node is added with a preset first additional value, the reference counts of the same session object in the non-tail nodes in the circular queue are synchronously added with the preset first additional value.

5. The session aging method of a traffic monitoring device according to any one of claims 1 or 4, characterized in that: The preset first additional value is 1.

6. The session aging method of the traffic monitoring device according to claim 1, characterized in that: The preset first threshold is 0.

7. The session aging method of the traffic monitoring device according to claim 1, characterized in that: The S5 includes: Determine the load value based on the following formula (3): Load ; ，（3） In formula (3), and γ are weight coefficients respectively; Indicates CPU usage. Indicates the memory used. Indicates the total amount of memory, Indicates the current session number, Indicates the total number of sessions; According to the load value Load Dynamic Adjustment K Value; where: When the load value Load Greater than the first preset threshold M1 When , update immediately according to the following formula (4) K , to reduce K The value can improve detection accuracy, shorten session cycle, and release zombie sessions in time; ，（4） In formula (4), for K The updated value of When continuous evaluation N Evaluation cycle load value Load are both less than the second preset threshold M2 When , the progressive update is performed according to the following formula (5): K , to reduce the accuracy of session detection and carry long-term sessions; ，（5） In formula (5), for K The updated value of is the default value, M2 Less than M1 ; When the session growth rate is greater than the third pre-trial threshold, switch immediately K The value is 1.

8. The session aging method of the traffic monitoring device according to claim 7, characterized in that: The first preset threshold is 0.65-0.75; the second preset threshold is 0.35-0.45; the third preset threshold is 950-1050 per second; is 0.55~0.65, is 0.25~0.35, It is 0.05~0.

15.

9. A session aging device for a traffic monitoring device, characterized in that: include: an insertion module, configured to insert a smart pointer of a session object generating session activity into the red-black tree of the current tail node of a pre-established circular queue within a current time slice corresponding to the current tail node of the queue, and to increase a reference count of the session object pointed to by the smart pointer by a preset first additional value each time the smart pointer is inserted; wherein the smart pointer stores the reference count of the session object; A pop-up module is used to use a timer to drive the circular queue to move backward by one node at a preset node update period, and pop out the red-black tree of the oldest node before the circular queue moves; wherein the preset node update period is determined based on the following formula (1): T = Ttick × K ，（1） In formula (1), T is the circular queue node update period, Ttick is the unit time, K is the step size coefficient; a destruction module, configured to reduce a reference count of a session object corresponding to the popped-up smart pointer by a preset first additional value, and destroy the corresponding session object when the reference count of the session object reaches a preset first threshold; A repeat module is used to repeatedly execute the insert module, the pop-up module and the destroy module until the session aging detection is completed; Step coefficient update module, used to adjust the step coefficient based on dynamic load sensing mechanism K , to balance detection accuracy and session carrying capacity.

10. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method implements the steps of the session aging method of the traffic monitoring device according to any one of claims 1 to 8.

Images