Granularity self-adaptive abnormal traffic detection method based on software defined network

Abstract

The invention discloses a granularity self-adaptive abnormal traffic detection method based on a software defined network. The method comprises the following steps: S1, data preprocessing; s2, carrying out data matching, and when a matching result is that the data are matched, executing a step S3; when the matching result is mismatching, executing the step S4; s3, normally forwarding or discarding, and normally forwarding the data packet when the matching result is not less than the minimum confidence coefficient allowed to pass; when the matching result is smaller than the minimum confidence coefficient allowed to pass, discarding the data packet; s4, feature collection; s5, calculating a confidence coefficient; s6, generating a flow table item; and S7, when a new data packet enters the switch, executing the step S1. According to the invention, through the characteristic information obtained by carrying out characteristic extraction, flow table matching and control plane processing on the flow from the data plane of the switch, the detection granularity and the flow forwarding strategy are flexibly matched on the premise of not influencing the network performance, and more flexible and efficient abnormal flow protection is realized.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a granularity adaptive abnormal traffic detection method based on software-defined networking. Background Art

[0002] With the surge in network traffic and the continuous evolution of network attack methods, traditional network security technologies are gradually experiencing performance bottlenecks. Inadequate detection and defense capabilities are particularly critical when facing large-scale traffic and complex attacks. In particular, abnormal traffic detection and attack protection require not only efficient and accurate algorithms, but also the ability to adapt to dynamically changing network environments and conduct real-time traffic analysis.

[0003] With the rapid development of programmable switches and SDN technologies, leveraging these emerging technologies for traffic analysis and anomaly detection has become a key area of ​​network security research. Traditional traffic detection methods often rely on a single control plane or data plane for detection. These single-plane detection methods often present significant challenges, such as insufficient detection accuracy and disproportionate detection of traffic volumes. Furthermore, existing solutions typically issue forwarding rules for the flow upon detection, without considering the current switch load or the relationship between the flow and similar IP segments or port numbers. Summary of the Invention

[0004] To overcome the above-mentioned defects, the present invention aims to provide a granular adaptive abnormal traffic detection method based on software-defined networking. By extracting features from the switch data plane, matching flow tables, and processing the feature information on the control plane, the method flexibly matches the detection granularity and traffic forwarding strategy without affecting network performance, thereby achieving more flexible and efficient abnormal traffic protection.

[0005] To achieve the above object, the technical solution adopted by the present invention is as follows:

[0006] A granular adaptive abnormal traffic detection method based on software-defined networking includes the following steps:

[0007] S1. Data preprocessing: The data plane receives data packets entering the switch, parses and preprocesses the packet header, and obtains the packet header vector.

[0008] S2. Data matching: Extract the five-tuple information of the data packet and match it with the fine-grained matching table and the coarse-grained matching table in the TCAM space to obtain the matching results;

[0009] When the matching result is a match, execute step S3;

[0010] When the matching result is mismatch, execute step S4;

[0011] S3. Forward or discard normally: Calculate the minimum confidence level allowed by the current switch based on the current window time link utilization and TCAM space status of the switch, and compare the matching result with the minimum confidence level allowed;

[0012] If the matching result is not less than the minimum confidence level allowed to pass, the data packet is forwarded normally;

[0013] When the matching result is less than the minimum confidence level allowed to pass, the packet is discarded;

[0014] Execute step S7;

[0015] S4. Feature Collection: The feature information of the data packet is stored in the data plane register. The hash value of the data packet's five-tuple information is used as an index. The corresponding counter is incremented by 1, and default forwarding is performed. When the corresponding counter reaches the preset threshold, the five-tuple information and feature information of the data flow containing the data packet are encapsulated into a special data packet and uploaded to the control plane via a Packet-in message.

[0016] S5. Calculating confidence: The control plane receives the special data packet and calculates the confidence of the data flow using a pre-trained neural network model;

[0017] S6. Generate flow table entries: Based on the confidence level of the data flow, the control plane uses reinforcement learning to generate flow table entries suitable for fine-grained matching tables or coarse-grained matching tables, and sends them to the switch via a Packet-out message.

[0018] S7. When a new data packet enters the switch, execute step S1.

[0019] Preferably, in step S2, the match means that at least one item of the five-tuple information of the data packet is the same as the table entry in the fine-grained matching table or the coarse-grained matching table; the mismatch means that all items of the five-tuple information of the data packet are different from the table entries in the fine-grained matching table or the coarse-grained matching table.

[0020] Preferably, the data plane includes a multi-granularity hierarchical matching module, a data flow feature collection module, and an information reporting module; the control plane includes a flow classifier module, a flow rule generation module, and a decision module.

[0021] Preferably, in step S4, double hash verification is used when collecting features, and the features are reported after the required number of packets for each flow reaches the required number, and the position register row to which the flow belongs is set to be overwritten; a timeout time is set for each flow, and when enough data packets are not collected within the specified time, a certain row of feature registers is also set to be overwritten, and after the collection of certain flow features is completed, it will be encapsulated as a special data packet.

[0022] Preferably, in step S5, the method for calculating the confidence is as follows:

[0023] A hybrid architecture uses Transformer to capture long-term dependencies of timestamps, and LSTM models the local dynamics of feature sequences while simultaneously referencing forward and reverse timing information. The input features of the pre-trained neural network model are 14*N+N vectors, including 14 features of each packet and a timestamp feature. N represents the number of packets collected for the flow. The anomaly probability of each flow is calculated, and the confidence level of the flow is calculated based on this probability.

[0024] Preferably, the neural network model uses N consecutive packets per stream during training and adopts a sliding window format to obtain feature samples of the original data stream.

[0025] Preferably, in step S3, the calculation of the TCAM space state includes the calculation of the remaining capacity, and the remaining capacity R fine The calculation method is as follows:

[0026] R fine =capacity-Σcost (1)

[0027] Among them, capacity is the total capacity of the current fine-grained flow table, Σcost is the cumulative cost of the storage resources used in the table;

[0028] The remaining space ratio R of the i-th TCAM table i The calculation method is as follows:

[0029]

[0030] Among them, Σcost i Indicates the cumulative overhead of storage resources used by the i-th TCAM table, capacity i Indicates the maximum number of flow tables that the TCAM table can accommodate.

[0031] TCAM table weighted remaining space ratio R space The calculation method is as follows:

[0032]

[0033] Where n represents the total number of flow tables, w i represents the weight of the i-th flow table, R i is the remaining space ratio of the i-th TCAM table;

[0034] The current window time link utilization U link The calculation method is as follows:

[0035]

[0036] Where F represents the traffic passing through the window time, B represents the total link bandwidth, and T represents the window time;

[0037] The current switch allows the minimum flow confidence C min The calculation method is as follows:

[0038]

[0039] Among them, γ1 and γ2 are constants used to adjust the impact of the remaining space and link utilization on the minimum confidence, and α is the control parameter that determines the sensitivity of the minimum confidence calculation when the link utilization changes.

[0040] Preferably, in step S6, the reward function R(s) of reinforcement learning is:

[0041]

[0042] Where ∑(n orig -1) is the number of entries reduced after merging, n orig is the number of original flows, is the mean of the confidence error after merging, C merged is the combined group confidence mean, C orig is the confidence of the original flow, N is the total number of flows in the merged group, that is, n orig , I wildcard is the wildcard penalty triggered when the merged IP range is * or the port range is 0-65535. α and β are weight coefficients used to balance space saving and precision loss.

[0043] The beneficial effects of the present invention are as follows:

[0044] 1. Improve traffic detection efficiency: This invention can significantly improve the efficiency of abnormal traffic detection by combining feature extraction on the data plane and machine learning processing on the control plane.

[0045] 2. Adaptive forwarding strategy: By combining link utilization and dynamic calculation of TCAM space, the present invention can adaptively adjust the traffic forwarding strategy according to the current network status, ensuring that the switch can make reasonable actions under different load conditions. Even in a network environment with large traffic bursts when the network is attacked, it can also ensure a certain level of detection accuracy.

[0046] 3. Coarse-grained and fine-grained matching rule generation and compression: The control plane generates matching rules of different granularities based on the data flow five-tuple information and the confidence value of the flow, while ensuring a small loss of accuracy, and sends them down to the data plane for execution, completing the detection task with less TCAM space resources in the switch.

[0047] 4. Collaboration between the control plane and the data plane: The feature extraction, rule matching, switch resource status collection in the data plane and the flow classifier, table entry generation, confidence threshold and other steps in the control plane are reasonably assigned to the execution order and executed synchronously or asynchronously to cope with complex and changing network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is an architectural diagram of the data plane and control plane.

[0049] Figure 2 This is a schematic diagram of the multi-granularity hierarchical matching module provided by the present invention.

[0050] Figure 3 This is a flow chart of data stream feature collection provided by the present invention.

[0051] Figure 4 It is a schematic diagram of the information reporting module provided by the present invention.

[0052] Figure 5 This is the flow classifier module provided by the present invention.

[0053] Figure 6 It is a schematic diagram of the flow rule generation module provided by the present invention.

[0054] Figure 7 This is a system architecture diagram provided by the present invention. DETAILED DESCRIPTION

[0055] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings.

[0056] Example 1

[0057] like Figure 1 As shown, the specific structures of the data plane and control plane disclosed in this embodiment of the present invention are as follows:

[0058] The data plane includes:

[0059] Multi-granularity hierarchical matching module: defines a variety of matching rules and actions of different granularities. After the control plane issues the items, it matches them step by step in the order of hierarchical matching to obtain their confidence levels. It then makes the next action (forwarding, discarding, or collecting features) based on the comparison of the confidence levels with those issued by the current decision module.

[0060] Data flow feature collection module: uses a programmable switch to extract traffic features from each data packet and saves them in the corresponding position of the register. After a certain flow feature is collected, the information reporting module is called.

[0061] Information reporting module: encapsulates flow feature data into special data packets and reports them to the control plane flow classifier, and transmits the link status to the decision module in the same way every window time.

[0062] The control plane includes:

[0063] Flow classifier module: uses the pre-trained machine learning model to calculate the traffic confidence based on the corresponding features, and calls the flow table generation module after the calculation is completed.

[0064] Flow rule generation module: Generates fine-grained table entries based on the flow quintuple and confidence level, and dynamically writes them into the data plane matching module through the P4Runtime protocol. When the fine-grained table reaches the threshold, it executes the reinforcement learning-based flow table merging strategy, merges them into coarse-grained table entries, and simultaneously deletes redundant data plane entries.

[0065] Decision module: Dynamically adjusts the minimum confidence threshold based on link utilization and TCAM space remaining ratio. This threshold value guides data plane forwarding decisions.

[0066] Example 2

[0067] This embodiment discloses the specific method steps of the present invention as follows:

[0068] S1. Data preprocessing: The data plane receives data packets entering the switch, parses and preprocesses the packet header, and obtains the packet header vector.

[0069] S2. Data matching: Extract the five-tuple information of the data packet and match it with the fine-grained matching table and the coarse-grained matching table in the TCAM space to obtain the matching results;

[0070] When the matching result is a match, execute step S3;

[0071] When the matching result is mismatch, execute step S4;

[0072] S3. Forward or discard normally: Calculate the minimum confidence level allowed by the current switch based on the current window time link utilization and TCAM space status of the switch, and compare the matching result with the minimum confidence level allowed;

[0073] If the matching result is not less than the minimum confidence level allowed to pass, the data packet is forwarded normally;

[0074] When the matching result is less than the minimum confidence level allowed to pass, the packet is discarded;

[0075] Execute step S7;

[0076] S4. Feature Collection: The feature information of the data packet is stored in the data plane register. The hash value of the data packet's five-tuple information is used as an index. The corresponding counter is incremented by 1, and default forwarding is performed. When the corresponding counter reaches the preset threshold, the five-tuple information and feature information of the data flow containing the data packet are encapsulated into a special data packet and uploaded to the control plane via a Packet-in message.

[0077] S5. Calculating confidence: The control plane receives the special data packet and calculates the confidence of the data flow using a pre-trained neural network model;

[0078] S6. Generate flow table entries: Based on the confidence level of the data flow, the control plane uses reinforcement learning to generate flow table entries suitable for fine-grained matching tables or coarse-grained matching tables, and sends them to the switch via a Packet-out message.

[0079] S7. When a new data packet enters the switch, execute step S1.

[0080] Example 3

[0081] See also Figures 2 to 7 Based on Examples 1 and 2, this embodiment discloses a granular adaptive abnormal traffic detection method based on software-defined networking, including:

[0082] Using P4 language, flexible traffic feature extraction and traffic matching are implemented in the data plane, and real-time abnormal traffic detection and multi-granularity flow table generation are implemented in the control plane. The overall system framework is shown in the figure below. Figure 7 shown.

[0083] Specifically, after the data packet enters the switch, it first performs a match. If the match is successful, it jumps to the final decision. Figure 2 The matching process, if there is a mismatch, the flow feature collection steps will be performed as follows Figure 3 As shown, double hashing is used when collecting flow features to ensure that data packet features are not incorrectly assigned to other flows. When the required number of packets per flow is reached, the features are reported and the register row to which the flow belongs is set to be overwritten. A timeout is set for each flow. If not enough data packets are collected within the specified time, a row of feature registers is also set to be overwritten. When the collection of a flow feature is completed, it will be encapsulated as a special data packet. Figure 4 As shown, the information is reported to the control plane to perform the flow classification step to calculate the flow confidence.

[0084] Control plane flow classifiers such as Figure 5The hybrid architecture shown uses a Transformer to capture long-term dependencies in timestamps, and an LSTM to model the local dynamics of feature sequences while simultaneously considering forward and reverse timing information. The input feature vector (14*N+N) includes 14 features per packet, such as payload length, TTL, TCP length, and a timestamp feature, where N represents the number of packets collected for the flow. Training also uses N consecutive packets per flow and a sliding window to obtain raw data flow feature samples. The trained model is loaded onto the classifier to calculate the anomaly probability for each flow, and this probability is used as a basis to calculate the flow confidence information.

[0085] There are many different granularity entries predefined in the data plane, such as Figure 2 As shown in the figure, the fine-grained TCAM table stores rules that match the exact five-tuple, with the confidence being the original flow value. Coarse-grained TCAM table 1 stores mixed matching rules based on the longest source and destination IP prefixes and source and destination port ranges, with the confidence being the weighted average of all flows within the coverage area. Coarse-grained TCAM table 2 stores only rules that match the longest source and destination IP prefixes, with the confidence being the weighted average of all flows within the coverage area.

[0086] According to the calculated data flow confidence information and the five-tuple information, the table entry is written into the fine-grained TCAM table, and the remaining capacity R of the fine-grained TCAM table is reached. fine When the threshold is reached, reinforcement learning is used such as Figure 6 As shown, flow table compression is performed to merge and migrate fine-grained table entries into other coarse-grained table entries to ensure that the compressed table space is minimized while retaining the confidence accuracy to the maximum extent. The reward function R(s) of reinforcement learning is to maximize the accuracy of retaining confidence and compress the total flow table space as much as possible. The precision loss is the difference between the confidence and the original confidence when a certain flow is matched in sequence according to the fine-grained TCAM table, coarse-grained TCAM table 1, and coarse-grained TCAM table 2 until a hit. The state is represented by the statistical data of the flow information in all current tables. The action selection includes adding to the fine-grained table, allocating to a coarser-grained table, or creating a new table entry (parameters need to be specified, such as IP prefix length and port range). At this time, the coarse-grained table entry is called a group. When a new flow is added to the group, the change in precision loss is calculated, including the precision loss change ΔC of the existing flows in the group, and the total precision loss Loss total is the sum of the absolute differences of all flows within the group. Source port ranges and IP prefix lengths are predefined as discrete options (e.g., prefix lengths of 16, 24, and 32, and port range widths of 1000 and 2000), simplifying the action space. The PPO algorithm is used to train agents to handle both continuous and discrete action spaces and learn the optimal grouping strategy.

[0087] The remaining capacity formula is:

[0088] R fine=capacity-∑cost (1)

[0089] Where capacity is the total capacity of the current fine-grained flow table, and ∑cost is the cumulative cost of the storage resources used in the table.

[0090] The reward function formula is:

[0091]

[0092] Where ∑(n orig -1) is the number of entries reduced after merging, n orig is the number of original flows (the number of flows in the group before merging). is the mean of the confidence error after merging, C merged is the combined group confidence mean, C orig is the confidence of the original flow, N is the total number of flows in the merged group, that is, n orig , I wildcard The wildcard penalty is triggered when the merged IP range is * or the port range is 0-65535. α and β are weight coefficients used to balance space saving and accuracy loss.

[0093] The single-stream accuracy loss formula is:

[0094] ΔC=|C hit -C orig | (3)

[0095] Among them C hit is the confidence of the entry matched by the flow in the coarse-grained table, C orig The original confidence value of the stream.

[0096] The total accuracy loss formula is:

[0097]

[0098] in is the average confidence of the combined group, C i is the original confidence of the i-th flow in the group, and k is the total number of flows in the merged group.

[0099] The loss function formula of the PPO strategy is:

[0100]

[0101] in The importance sampling ratio measures the difference in action selection between the new and old strategies. The advantage function estimates the degree of performance of the action relative to the average performance, clip(r t(θ),1-∈,1+∈) is a truncation function to prevent the policy update from being too large, and min(·) is the minimum value before and after truncation to ensure the stability of the policy update.

[0102] The obtained flow table entries are updated synchronously to the corresponding TCAM table of the data plane. The data plane matches the data packets according to the flow matching rules of different granularities (such as quintuple exact matching or mixed matching) to obtain the confidence information C of the current flow. now .

[0103] The control plane maintains the decision module in real time and makes decisions based on the information provided by the data plane and the current link utilization U of the switch. link And the remaining TCAM space R space Dynamically calculate the minimum confidence value C allowed by the current switch min In the matching process, if the fine-grained matching strategy fails, the system will try to use the coarser-grained matching rules to obtain the current flow confidence information. now and the minimum confidence value C allowed by the current switch min , determines whether the data packet can be forwarded.

[0104] Current window time link utilization U link The calculation formula is:

[0105]

[0106] Where F represents the traffic passing through the window time (unit: bit), and B represents the total link bandwidth (unit:

[0107] bits / second), T represents the window time (unit: seconds).

[0108] The remaining space ratio R of the i-th TCAM table i The calculation formula is:

[0109]

[0110] Among them, ∑cost i Indicates the cumulative overhead of storage resources used by the i-th TCAM table, capacity i Indicates that

[0111] The TCAM table can accommodate a maximum number of flow tables.

[0112] TCAM table weighted remaining space ratio R space The calculation formula is:

[0113]

[0114] Where n represents the total number of flow tables, w i represents the weight of the i-th flow table, R i is the remaining space ratio of the i-th TCAM table.

[0115] The current switch allows the minimum flow confidence C min The calculation formula is:

[0116]

[0117] Among them, γ1 and γ2 are constants used to adjust the impact of the remaining space and link utilization on the minimum confidence, and α is the control parameter that determines the sensitivity of the minimum confidence calculation when the link utilization changes.

[0118] This paper proposes a method for detecting and dynamically controlling abnormal traffic based on SDN and programmable switches. Using the P4 programming language, the method extracts traffic features and performs hierarchical flow table matching on the data plane. In conjunction with the control plane, a neural network is used to calculate flow confidence. Based on the calculated results, reinforcement learning is used to generate matching rules of varying granularity (fine-grained precise matching and coarse-grained mixed matching). These rules are then sent to the data plane TCAM table for packet matching. The matching results are then compared with confidence thresholds dynamically calculated based on switch link utilization and TCAM space utilization to determine whether to forward the packet. This method ensures smooth forwarding of normal traffic even when the switch is under heavy load, while effectively compressing TCAM space at the expense of a small loss in matching accuracy.

[0119] Of course, the present invention may have many other embodiments. Without departing from the spirit and essence of the present invention, those skilled in the art may make various corresponding changes and modifications based on the present invention, but these corresponding changes and modifications should all fall within the scope of protection of the claims attached to the present invention.

Claims

1. A granular adaptive abnormal traffic detection method based on software-defined networking, characterized in that: The following steps are involved: S1. Data preprocessing: The data plane receives data packets entering the switch, parses and preprocesses the packet header, and obtains the packet header vector. S2. Data matching: Extract the five-tuple information of the data packet and match it with the fine-grained matching table and the coarse-grained matching table in the TCAM space to obtain the matching results; When the matching result is a match, execute step S3; When the matching result is mismatch, execute step S4; S3. Forward or discard normally: Calculate the minimum confidence level allowed by the current switch based on the current window time link utilization and TCAM space status of the switch, and compare the matching result with the minimum confidence level allowed; If the matching result is not less than the minimum confidence level allowed to pass, the data packet is forwarded normally; When the matching result is less than the minimum confidence level allowed to pass, the packet is discarded; Execute step S7; S4. Feature Collection: The feature information of the data packet is stored in the data plane register. The hash value of the data packet's five-tuple information is used as an index. The corresponding counter is incremented by 1, and default forwarding is performed. When the corresponding counter reaches the preset threshold, the five-tuple information and feature information of the data flow containing the data packet are encapsulated into a special data packet and uploaded to the control plane via a Packet-in message. S5. Calculating confidence: The control plane receives the special data packet and calculates the confidence of the data flow using a pre-trained neural network model; S6. Generate flow table entries: Based on the confidence level of the data flow, the control plane uses reinforcement learning to generate flow table entries suitable for fine-grained matching tables or coarse-grained matching tables, and sends them to the switch via a Packet-out message. S7. When a new data packet enters the switch, execute step S1.

2. The granular adaptive abnormal traffic detection method based on software defined network according to claim 1 is characterized in that: In step S2, the match means that at least one item of the five-tuple information of the data packet is the same as an entry in the fine-grained matching table or the coarse-grained matching table; the mismatch means that all items of the five-tuple information of the data packet are different from the entries in the fine-grained matching table or the coarse-grained matching table.

3. The granular adaptive abnormal traffic detection method based on software defined network according to claim 1 is characterized in that: The data plane includes a multi-granularity hierarchical matching module, a data flow feature collection module, and an information reporting module; the control plane includes a flow classifier module, a flow rule generation module, and a decision module.

4. The granular adaptive abnormal traffic detection method based on software defined network according to claim 1 is characterized in that: In step S4, double hash verification is used when collecting features. After the required number of packets for each flow is reached, the features are reported and the position register row to which the flow belongs is set to be overwritten. A timeout is set for each flow. When enough data packets are not collected within the specified time, a row of feature registers is also set to be overwritten. After the collection of features of a certain flow is completed, it will be encapsulated as a special data packet.

5. The granular adaptive abnormal traffic detection method based on software defined network according to claim 4 is characterized in that: In step S5, the confidence level is calculated as follows: A hybrid architecture uses Transformer to capture long-term dependencies of timestamps, and LSTM models the local dynamics of feature sequences while simultaneously referencing forward and reverse timing information. The input features of the pre-trained neural network model are 14*N+N vectors, including 14 features of each packet and a timestamp feature. N represents the number of packets collected for the flow. The anomaly probability of each flow is calculated, and the confidence level of the flow is calculated based on this probability.

6. The granular adaptive abnormal traffic detection method based on software defined network according to claim 5 is characterized in that: The neural network model uses N consecutive packets of each stream during training and adopts a sliding window form to obtain feature samples of the original data stream.

7. The granular adaptive abnormal traffic detection method based on software defined network according to claim 5 is characterized in that: In step S3, the calculation of the TCAM space state includes the calculation of the remaining capacity, the remaining capacity R fine The calculation method is as follows: R fine =capacity-∑cost (1) Among them, capacity is the total capacity of the current fine-grained flow table, ∑cost is the cumulative cost of the storage resources used in the table; The remaining space ratio R of the i-th TCAM table i The calculation method is as follows: Among them, ∑cost i Indicates the cumulative overhead of storage resources used by the i-th TCAM table, capacity i Indicates the maximum number of flow tables that the TCAM table can accommodate. TCAM table weighted remaining space ratio R space The calculation method is as follows: Where n represents the total number of flow tables, w i represents the weight of the i-th flow table, R i is the remaining space ratio of the i-th TCAM table; The current window time link utilization U link The calculation method is as follows: Where F represents the traffic passing through the window time, B represents the total link bandwidth, and T represents the window time; The current switch allows the minimum flow confidence C min The calculation method is as follows: Among them, γ1 and γ2 are constants used to adjust the impact of the remaining space and link utilization on the minimum confidence, and α is the control parameter that determines the sensitivity of the minimum confidence calculation when the link utilization changes.

8. The granular adaptive abnormal traffic detection method based on software defined network according to claim 5 is characterized in that: In step S6, the reward function R(s) of reinforcement learning is: Where Σ(n orig -1) is the number of entries reduced after merging, n orig is the number of original flows, is the mean of the confidence error after merging, C merged is the combined group confidence mean, C orig is the confidence of the original flow, N is the total number of flows in the merged group, that is, n orig , I wildcard is the wildcard penalty triggered when the merged IP range is * or the port range is 0-65535. α and β are weight coefficients used to balance space saving and precision loss.

Images