Traffic management method, device and system and nonvolatile storage medium

Abstract

The invention discloses a traffic management method, device and system and a nonvolatile storage medium. The method comprises the following steps: in a preset time period, an optical network terminal detects abnormal traffic in exit traffic and an abnormal port corresponding to the abnormal traffic according to a preset judgment rule; traffic control is carried out on the abnormal port, a processing log and an exit traffic log are generated, the processing log comprises processing information of traffic control, and the exit traffic log comprises exit traffic information which flows through the optical network terminal in a preset time period and is not identified as abnormal traffic; the processing log and the exit traffic log are sent to a cloud platform, and the processing log and the exit traffic log are jointly used for updating a preset judgment rule; and the optical network terminal receives the updated preset judgment rule. The technical problem that the user communication quality and the communication experience are affected due to the fact that the user dialing rate is integrally limited in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the field of communications, and more specifically, to a traffic management method, device, system, and non-volatile storage medium. Background Art

[0002] In related technologies, traffic control is usually performed by limiting the overall user dial-up rate. The problem with this approach is that it affects normal users' Internet access, and abnormal uplink traffic still squeezes user bandwidth, seriously affecting the user's communication experience and communication quality.

[0003] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0004] The embodiments of the present application provide a traffic management method, device, system and non-volatile storage medium to at least solve the technical problem that the user communication quality and communication experience are affected due to the overall speed limit on the user dial-up rate in the related art.

[0005] According to one aspect of an embodiment of the present application, a traffic management method is provided, including: within a preset time period, an optical network terminal detects abnormal traffic in the export traffic and the abnormal port corresponding to the abnormal traffic according to preset judgment rules; traffic control is performed on the abnormal port, and a processing log and an export traffic log are generated, wherein the processing log includes processing information of the traffic control, and the export traffic log includes export traffic information that is not identified as abnormal traffic and flows through the optical network terminal within the preset time period; the processing log and the export traffic log are sent to a cloud platform, wherein the processing log and the export traffic log are used together to update the preset judgment rules; the optical network terminal receives the updated preset judgment rules.

[0006] Optionally, the optical network terminal determines the abnormal traffic in the export traffic and the abnormal port corresponding to the abnormal traffic according to preset judgment rules, including: in a preset sub-time period in a preset time period, capturing and parsing the data link layer and network layer data packets of the export traffic, and determining the parsing result of the export traffic, wherein the parsing result includes source address information, destination address information, and port information; based on the parsing result and the data packet capture result, determining the export traffic information sent by each source port, wherein the export traffic information includes the number of outbound target ports, the number of data packets, the cumulative traffic and the flow rate of the source port in the preset sub-time period; determining the abnormal traffic according to the preset judgment rules and the export traffic information.

[0007] Optionally, determining abnormal traffic based on preset judgment rules and export traffic information, and the abnormal port corresponding to the abnormal traffic includes: when the number of target ports is greater than a first preset number, determining the source port as an abnormal port, and determining the export traffic sent by the source port as abnormal traffic; when the number of data packets is greater than a second preset number, determining the source port as an abnormal port, and determining the export traffic sent by the source port as abnormal traffic; when the flow rate exceeds a preset flow rate threshold, determining the source port as an abnormal port, and determining the export traffic sent by the source port as abnormal traffic.

[0008] Optionally, sending the export traffic log to the cloud platform includes: determining the cumulative traffic emitted by each target source port within a preset time period, and determining that the source port whose cumulative traffic exceeds a preset traffic threshold is a missed abnormal port, and determining that the export traffic emitted by the missed abnormal port is the missed abnormal traffic, wherein the target source port is a port that is not determined as an abnormal port according to the preset judgment rule, and the export traffic emitted by the target source port is not determined as abnormal traffic according to the preset judgment rule; recording the missed abnormal port and the missed abnormal traffic in the traffic log, and sending the traffic log to the cloud platform.

[0009] Optionally, the method further includes: using a long short-term memory network model to process traffic logs and export traffic logs to determine traffic characteristics of missed abnormal ports and missed abnormal traffic; and updating preset judgment rules based on the traffic characteristics.

[0010] Optionally, the method also includes: the cloud platform determines the abnormal port that has not been determined by the optical network terminal based on the traffic log, and obtains the missing abnormal port information; the cloud platform sends the missing abnormal port information to the optical network terminal, and instructs the optical network terminal to perform traffic control on the port indicated by the missing abnormal port information.

[0011] Optionally, the method also includes: determining a target abnormal port that has been determined to be an abnormal port within a preset number of preset time periods; sending port information of the target abnormal port to a cloud platform, wherein the cloud platform is used to instruct each optical network terminal in the communication network to perform flow control on the target abnormal port.

[0012] According to another aspect of an embodiment of the present application, a traffic management method is also provided, including: a cloud platform receives a processing log and an export traffic log sent by an optical network terminal, wherein the processing log includes processing information of the traffic control performed by the optical network terminal on the abnormal port, and the export traffic log includes export traffic information that is not identified as abnormal traffic and flows through the optical network terminal within a preset time period, and the optical network terminal is used to detect abnormal traffic in the export traffic and the abnormal port corresponding to the abnormal traffic within a preset time period; updating the preset judgment rules based on the processing log and the export traffic log; and sending the updated preset judgment rules to the optical network terminal.

[0013] According to another aspect of an embodiment of the present application, a traffic management system is also provided, including an optical network terminal and a cloud platform, wherein the optical network terminal is used to determine the abnormal traffic in the export traffic and the abnormal port corresponding to the abnormal traffic according to preset judgment rules within a preset time period; perform traffic control on the abnormal port, and generate a processing log and an export traffic log, wherein the processing log includes processing information of the traffic control, and the export traffic log includes export traffic information that is not identified as abnormal traffic flowing through the optical network terminal within a preset time period; send the processing log and the export traffic log to the cloud platform, wherein the processing log and the export traffic log are used together to update the preset judgment rules; the cloud platform is used to update the preset judgment rules based on the processing log and the export traffic log, and send the updated preset judgment rules to the optical network terminal.

[0014] According to another aspect of an embodiment of the present application, a traffic management device is also provided, which is suitable for use in an optical network terminal, and includes: a first processing module, used to detect abnormal traffic in the export traffic and the abnormal port corresponding to the abnormal traffic according to preset judgment rules within a preset time period; a second processing module, used to perform traffic control on the abnormal port, and generate a processing log and an export traffic log, wherein the processing log includes processing information of the traffic control, and the export traffic log includes export traffic information that is not identified as abnormal traffic flowing through the optical network terminal within a preset time period; a third processing module, used to send the processing log and the export traffic log to a cloud platform, wherein the processing log and the export traffic log are used together to update the preset judgment rules; and a fourth processing module, used to receive the updated preset judgment rules.

[0015] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, in which a program is stored. When the program is running, a device where the non-volatile storage medium is located is controlled to execute a traffic management method.

[0016] According to another aspect of an embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein the processor is configured to run a program stored in the memory, wherein the traffic management method is executed when the program is run.

[0017] According to another aspect of an embodiment of the present application, a computer program product is provided, including a computer program, which implements a traffic management method when executed by a processor.

[0018] In an embodiment of the present application, within a preset time period, the optical network terminal detects abnormal traffic in the export traffic and the abnormal port corresponding to the abnormal traffic according to preset judgment rules; traffic control is performed on the abnormal port, and a processing log and an export traffic log are generated, wherein the processing log includes processing information of the traffic control, and the export traffic log includes export traffic information that is not identified as abnormal traffic flowing through the optical network terminal within the preset time period; the processing log and the export traffic log are sent to the cloud platform, wherein the processing log and the export traffic log are used together to update the preset judgment rules; the optical network terminal receives the updated preset judgment rules, determines the abnormal traffic through cloud-edge collaboration and performs traffic control on the abnormal port corresponding to the abnormal traffic, thereby achieving the purpose of automatically identifying abnormal ports and controlling and processing abnormal ports and abnormal traffic, thereby achieving the technical effect of avoiding affecting the communication process of normal users, and further solving the technical problem of affecting user communication quality and communication experience due to the overall speed limit of user dial-up rate in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 This is a schematic diagram of the structure of a traffic management system provided according to an embodiment of the present application;

[0021] Figure 2 This is a flow chart of a cloud-edge collaborative workflow of a traffic management system provided according to an embodiment of the present application;

[0022] Figure 3 This is a flow chart of a traffic management method provided according to an embodiment of the present application;

[0023] Figure 4 This is a flow chart of another traffic management method provided according to an embodiment of the present application;

[0024] Figure 5 This is a schematic structural diagram of a flow management device provided according to an embodiment of the present application;

[0025] Figure 6 This is a schematic structural diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:

[0029] PCDN (Private Content Delivery Network): A PCDN is a private content delivery network built on P2P technology and CDN (Content Delivery Network). PCDN distributes user-requested content from origin servers to these cache servers by adding a large number of low-cost cache servers to the network, enabling faster and more stable content delivery to end users.

[0030] ONU (Optical Network Unit): ONU is the user-side device in the optical fiber access network, located between the optical distribution network (ODN) and user equipment, and is a key component of the optical fiber communication system.

[0031] An Optical Network Terminal (ONT) is a user-side device in PON (Passive Optical Network) technology. The ONT's primary function is to convert optical signals transmitted through optical fibers into electrical signals and transmit these signals to user devices, such as computers, phones, and televisions. The ONT connects directly to user devices, providing high-speed, stable network services.

[0032] Optical Line Terminal (OLT): This is the core central office equipment in a PON network. The OLT's primary functions include signal modulation, demodulation, multiplexing, and transmission. It converts signals from the core network into optical signals and transmits them to the ONUs / ONTs via the Optical Distribution Network (ODN). The OLT also controls the flow of information across the optical distribution network and manages bandwidth allocation, ensuring that each user's data is transmitted in an orderly manner across the optical network. The OLT is typically located at the operator's central office and connected via optical fiber to the user's optical splitter, which in turn connects to each user's ONUs / ONTs.

[0033] Multi-Service Edge (MSE): Typically deployed at the edge of a carrier's network, MSEs support the access and aggregation of multiple services, including broadband data, voice, and video. MSEs provide high-performance data processing, support multiple access technologies and service types to meet diverse user needs, and enable rapid deployment and flexible expansion of services.

[0034] In order to optimize the metropolitan area network (MAN) egress traffic and optimize MAN traffic settlement fees, it is necessary to manage cross-MAN outflow traffic, and users with abnormally large upstream traffic need to be controlled.

[0035] Traffic control methods offered by related technologies can limit user dial-up rates across the board, but this approach also impacts normal Internet access. Abnormal uplink traffic still squeezes user bandwidth, impacting the user experience. Another approach involves adding hardware cards to network elements to identify and block abnormal traffic, but this requires hardware deployment, which is time-consuming and expensive.

[0036] In order to solve the above problems, relevant solutions are provided in the embodiments of the present application, which are described in detail below.

[0037] According to an embodiment of the present application, a method embodiment of a traffic management method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0038] The method embodiments provided in the embodiments of the present application can be executed in a communication system composed of a mobile terminal, a computer terminal or similar computing devices. Figure 1 The traffic management system shown in Figure 1 is executed. Figure 1As can be seen, the system includes: an optical network terminal 10, a cloud platform 12, wherein the optical network terminal 10 is used to determine the abnormal traffic in the export traffic and the abnormal port corresponding to the abnormal traffic according to the preset judgment rules within a preset time period; perform traffic control on the abnormal port and generate a processing log and an export traffic log, wherein the processing log includes processing information of the traffic control, and the export traffic log includes export traffic information that is not identified as abnormal traffic flowing through the optical network terminal 10 within a preset time period; send the processing log and the export traffic log to the cloud platform 12, wherein the processing log and the export traffic log are used together to update the preset judgment rules; the cloud platform 12 is used to update the preset judgment rules based on the processing log and the export traffic log, and send the updated preset judgment rules to the optical network terminal 10.

[0039] In some embodiments of the present application, the cloud platform 12 includes distributed cloud servers or centralized servers. The optical network terminal 10 may also be an optical network unit, which may also be called an optical modem or an optical modem gateway in actual application scenarios.

[0040] As an optional implementation, an embedded plug-in can be used to execute Figure 3 The plug-in for the traffic management method shown in [1] is inserted into the optical network terminal 10, and edge computing technology is used to analyze gateway egress and intranet interface traffic data, screening and blocking abnormal network ports. The cloud platform 12 can use fixed rule algorithms and AI algorithms to anomaly mark abnormal traffic, assisting in detecting abnormal traffic that was missed by the edge.

[0041] In some embodiments of the present application, the process of collaboratively determining abnormal traffic and abnormal ports between the optical network terminal 10 and the cloud platform 12 is as follows: Figure 2 As shown. Figure 2 As can be seen in the figure, after the built-in traffic management plug-in in the optical network terminal 10 is activated, it captures traffic packets and matches them against pre-set judgment rules to see if any of the captured packets are identified as abnormal traffic data packets, thereby identifying abnormal traffic and abnormal source ports. Abnormal traffic is then restricted and non-abnormal traffic is allowed. For traffic identified as non-abnormal, its various traffic characteristics are compiled to generate a traffic log. A restriction processing log is also generated. The restriction processing log and traffic log are then sent together to the cloud platform 12.

[0042] The cloud platform 12 primarily functions as AI analysis services and AI model building. AI model building involves collecting training data and training the model. The AI ​​analysis service utilizes the trained model to process restriction processing logs and traffic logs, deriving updated preset judgment rules and providing feedback to the optical network terminal 10. Furthermore, the cloud platform 12 can also send information related to identified abnormal ports to the optical network terminal 10, allowing the optical network terminal 10 to control these abnormal ports, including limiting, intercepting, and blocking them.

[0043] In the above operating environment, the embodiment of the present application provides a traffic management method, such as Figure 3 As shown, the method includes the following steps:

[0044] Step S302: within a preset time period, the optical network terminal detects abnormal traffic in the egress traffic and the abnormal port corresponding to the abnormal traffic according to a preset judgment rule;

[0045] In the technical solution provided in step S302, the step of the optical network terminal determining the abnormal traffic in the egress traffic and the abnormal port corresponding to the abnormal traffic according to the preset judgment rules includes: in a preset sub-time period in the preset time period, capturing and parsing the data link layer and network layer data packets of the egress traffic, and determining the parsing result of the egress traffic, wherein the parsing result includes source address information, destination address information, and port information; based on the parsing result and the data packet capture result, determining the egress traffic information sent by each source port, wherein the egress traffic information includes the number of outgoing target ports, the number of data packets, the cumulative traffic, and the flow rate of the source port in the preset sub-time period; determining the abnormal traffic according to the preset judgment rules and the egress traffic information.

[0046] In some embodiments of the present application, the outbound traffic network L2-L3 layer data packets can be parsed to obtain the MAC, source IP and port, destination IP and port, and protocol number of each outbound flow. Then, within each cycle (i.e., a preset time period), fixed packet capture and analysis is performed for N seconds (i.e., a preset sub-time period), and based on preset judgment rules, it is determined whether the traffic is abnormal and whether the source port corresponding to the traffic is an abnormal port.

[0047] In some embodiments of the present application, the steps of determining abnormal traffic and abnormal ports corresponding to the abnormal traffic based on preset judgment rules and export traffic information include: when the number of target ports is greater than a first preset number, determining the source port as an abnormal port, and determining the export traffic sent by the source port as abnormal traffic; when the number of data packets is greater than a second preset number, determining the source port as an abnormal port, and determining the export traffic sent by the source port as abnormal traffic; when the flow rate exceeds a preset flow rate threshold, determining the source port as an abnormal port, and determining the export traffic sent by the source port as abnormal traffic.

[0048] In some embodiments of the present application, the number of times different source ports are identified as abnormal ports within each preset time period can be counted. If the number of times exceeds the preset number, more stringent control measures can be taken for the traffic of the port, such as directly blocking the traffic of the port and extending the blocking period.

[0049] As an optional implementation, a Hashmap data structure may be used to record the judgment result, and a counter may be used to count the number of times each source port is counted as an abnormal port.

[0050] Step S304: Flow control is performed on the abnormal port, and a processing log and an egress flow log are generated. The processing log includes flow control processing information, and the egress flow log includes egress flow information that is not identified as abnormal flow and that passes through the optical network terminal within a preset time period.

[0051] In the technical solution provided in step S304, specific control methods of flow control include flow limiting, blocking and interception.

[0052] In some embodiments of the present application, a threshold value x for the number of destination ports, a threshold value y for the number of packets, a flow rate z, etc., can be set for each source port. During actual communication, if one or more corresponding communication behavior statistics exceed the threshold, the source port is identified as an abnormal port and subjected to flow control. The communication behavior statistics include the number of destination ports in the traffic packets sent by the source port within a preset time period, the number of traffic packets, and the flow rate. Furthermore, abnormal IPv4 and IPv6 ports can be rate-limited or blocked by calling the iptables and ip6tables commands of the optical network terminal operating system.

[0053] Step S306: Send the processing log and the egress traffic log to the cloud platform, wherein the processing log and the egress traffic log are used together to update the preset judgment rules;

[0054] In the technical solution provided in step S306, the step of sending the export traffic log to the cloud platform includes: determining the cumulative traffic emitted by each target source port within a preset time period, and determining that the source port whose cumulative traffic exceeds the preset traffic threshold is a missed abnormal port, and determining that the export traffic emitted by the missed abnormal port is the missed abnormal traffic, wherein the target source port is a port that is not determined as an abnormal port according to the preset judgment rule, and the export traffic emitted by the target source port is not determined as abnormal traffic according to the preset judgment rule; recording the missed abnormal port and the missed abnormal traffic in the traffic log, and sending the traffic log to the cloud platform.

[0055] As an optional implementation, the cloud platform updates the preset judgment rules by using a long short-term memory network model to process traffic logs and egress traffic logs, determine the traffic characteristics of missed abnormal ports and missed abnormal traffic, and update the preset judgment rules based on the traffic characteristics. The egress traffic log includes a detailed five-tuple of information (source IP / port, destination IP / port, protocol type) for the missed abnormal traffic, as well as the number of IP addresses that each source port reported, the recording time, and the total amount of upstream traffic in a preset time period.

[0056] Optionally, during the actual communication process, there may be some abnormal ports, and the detection results in each preset time period are normal, but after combining multiple preset time periods, it is found that the port is an omitted abnormal port with abnormal cumulative traffic or abnormal cumulative number of corresponding target ports. For such omitted abnormal ports, the cloud platform or optical network terminal can be used to summarize the export traffic logs of multiple time periods to determine. The cloud platform can then use the long short-term memory network (LSTM) model to identify these abnormal ports and the traffic characteristics of the abnormal traffic emitted by these abnormal ports, thereby updating the preset judgment rules. In addition, during this update process, the interception log data can also provide some auxiliary information to prevent the updated preset judgment rules from failing to identify abnormal ports that could have been normally identified.

[0057] Step S308: The optical network terminal receives the updated preset judgment rule.

[0058] As an optional implementation method, the cloud platform can determine the omitted abnormal ports and perform flow control processing in the following manner: the cloud platform determines the abnormal ports that have not been determined by the optical network terminal based on the flow log, and obtains the omitted abnormal port information; the cloud platform sends the omitted abnormal port information to the optical network terminal, and instructs the optical network terminal to perform flow control on the port indicated by the omitted abnormal port information.

[0059] In some embodiments of the present application, the cloud platform can synchronize abnormal port information in the communication network in the following manner to instruct each optical network terminal to perform flow control on the abnormal port: determine the target abnormal port that has been determined to be an abnormal port within a preset number of preset time periods; send the port information of the target abnormal port to the cloud platform, wherein the cloud platform is used to instruct each optical network terminal in the communication network to perform flow control on the target abnormal port.

[0060] Optionally, for the target abnormal port indicated by the cloud platform, the optical network terminal can store the identification information of the target abnormal port. When the export traffic sent by the port is received, the traffic control methods such as deleting, limiting, intercepting or blocking can be performed according to the preset instructions.

[0061] By adopting the method of detecting abnormal traffic in the export traffic and the abnormal port corresponding to the abnormal traffic according to preset judgment rules within a preset time period by the optical network terminal; performing traffic control on the abnormal port, and generating a processing log and an export traffic log, wherein the processing log includes processing information of the traffic control, and the export traffic log includes export traffic information that is not identified as abnormal traffic flowing through the optical network terminal within the preset time period; sending the processing log and the export traffic log to the cloud platform, wherein the processing log and the export traffic log are jointly used to update the preset judgment rules; the optical network terminal receives the updated preset judgment rules, determines the abnormal traffic through cloud-edge collaboration and performs traffic control on the abnormal port corresponding to the abnormal traffic, thereby achieving the purpose of automatically identifying abnormal ports and controlling and processing abnormal ports and abnormal traffic, thereby achieving the technical effect of avoiding affecting the communication process of normal users, and further solving the technical problem of affecting the user communication quality and communication experience due to the overall speed limit of the user dial-up rate in the related technology.

[0062] Furthermore, the method provided in the embodiments of this application changes the traffic blocking approach from overall speed limiting to speed limiting or blocking traffic ports targeted by abnormal applications, enabling precise blocking of abnormal PCDN traffic. The closed-loop process from traffic port detection to blocking takes only one minute, while traditional cloud computing methods typically experience delays of one hour to one day. Furthermore, compared to related technologies, the method provided in the embodiments of this application eliminates the need for adding hardware analysis boards to network elements such as MSEs and OLTs. Instead, it requires only software plug-in upgrades within existing equipment, avoiding additional hardware investment in MSE and OLT network equipment.

[0063] Moreover, the method provided in the embodiment of the present application adopts a dual-engine analysis mechanism of rules and AI models to assist in detecting abnormal traffic that is missed on the edge side. First, the rule engine definition is adopted, combined with the massive data analysis capabilities of the cloud, to analyze the terminal-side traffic that continues to appear and is not successfully blocked, and the blocking rules identified by the cloud are sent to the optical network terminal plug-in side. This method increases the annotation data through the interactive process, improves the recognition accuracy of the abnormal traffic model, further improves the success rate of abnormal traffic blocking, improves the traffic suppression capability, and reduces the cost settlement of out-of-province traffic.

[0064] The present application also provides another traffic management method applicable to the cloud platform. Figure 4 This is a flow chart of the method. Figure 4 As can be seen, the method includes:

[0065] Step S402: The cloud platform receives a processing log and an egress traffic log sent by the optical network terminal, wherein the processing log includes processing information of flow control performed by the optical network terminal on the abnormal port, and the egress traffic log includes egress traffic information that is not identified as abnormal traffic and flows through the optical network terminal within a preset time period. The optical network terminal is configured to detect abnormal traffic in the egress traffic and the abnormal port corresponding to the abnormal traffic within the preset time period.

[0066] Step S404: updating the preset judgment rules based on the processing log and the egress traffic log;

[0067] Step S406: Send the updated preset judgment rule to the optical network terminal.

[0068] The embodiment of the present application provides a traffic management device suitable for use in an optical network terminal. Figure 5 It is a schematic diagram of the structure of the device. Figure 5 It can be seen that the device includes: a first processing module 50, which is used to detect abnormal traffic in the export traffic and the abnormal port corresponding to the abnormal traffic according to the preset judgment rules within a preset time period; a second processing module 52, which is used to control the traffic of the abnormal port and generate a processing log and an export traffic log, wherein the processing log includes processing information of the traffic control, and the export traffic log includes export traffic information that is not identified as abnormal traffic flowing through the optical network terminal within the preset time period; a third processing module 54, which is used to send the processing log and the export traffic log to the cloud platform, wherein the processing log and the export traffic log are used together to update the preset judgment rules; a fourth processing module 56, which is used to receive the updated preset judgment rules.

[0069] In some embodiments of the present application, the first processing module 50 optical network terminal determines the abnormal traffic in the export traffic and the abnormal port corresponding to the abnormal traffic according to the preset judgment rules, including: in a preset sub-time period in a preset time period, capturing and parsing the data link layer and network layer data packets of the export traffic, and determining the parsing result of the export traffic, wherein the parsing result includes source address information, destination address information, and port information; based on the parsing result and the data packet capture result, determining the export traffic information sent by each source port, wherein the export traffic information includes the number of outbound target ports, the number of data packets, the cumulative traffic and the flow rate of the source port in the preset sub-time period; determining the abnormal traffic according to the preset judgment rules and the export traffic information.

[0070] In some embodiments of the present application, the first processing module 50 determines the abnormal traffic based on preset judgment rules and export traffic information, and the steps of determining the abnormal port corresponding to the abnormal traffic include: when the number of target ports is greater than a first preset number, determining the source port as an abnormal port, and determining the export traffic sent by the source port as abnormal traffic; when the number of data packets is greater than a second preset number, determining the source port as an abnormal port, and determining the export traffic sent by the source port as abnormal traffic; when the flow rate exceeds a preset flow rate threshold, determining the source port as an abnormal port, and determining the export traffic sent by the source port as abnormal traffic.

[0071] In some embodiments of the present application, the step of the third processing module 54 sending the export traffic log to the cloud platform includes: determining the cumulative traffic emitted by each target source port within a preset time period, and determining that the source port whose cumulative traffic exceeds the preset traffic threshold is a missed abnormal port, and determining that the export traffic emitted by the missed abnormal port is the missed abnormal traffic, wherein the target source port is a port that is not determined as an abnormal port according to the preset judgment rule, and the export traffic emitted by the target source port is not determined as abnormal traffic according to the preset judgment rule; recording the missed abnormal port and the missed abnormal traffic in the traffic log, and sending the traffic log to the cloud platform.

[0072] In some embodiments of the present application, the cloud platform is also used to: use a long short-term memory network model to process traffic logs and export traffic logs, determine the traffic characteristics of missed abnormal ports and missed abnormal traffic; and update preset judgment rules based on the traffic characteristics.

[0073] In some embodiments of the present application, the cloud platform method is also used to: determine the abnormal port that has not been determined by the optical network terminal based on the traffic log, and obtain the missing abnormal port information; send the missing abnormal port information to the optical network terminal, and instruct the optical network terminal to perform traffic control on the port indicated by the missing abnormal port information.

[0074] In some embodiments of the present application, the cloud platform method is also used to: determine a target abnormal port that has been determined to be an abnormal port within a preset number of preset time periods; send port information of the target abnormal port to the cloud platform, wherein the cloud platform is used to instruct each optical network terminal in the communication network to perform flow control on the target abnormal port.

[0075] It should be noted that the various modules in the above-mentioned traffic management device can be program modules (for example, a set of program instructions that implement a certain specific function) or hardware modules. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0076] Figure 6 FIG1 shows a hardware structure block diagram of an electronic device for implementing a flow management method. Figure 6 As shown, the electronic device 60 may include one or more (illustrated by 602a, 602b, ..., 602n in the figure) processors 602 (the processor 602 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 604 for storing data, and a transmission device 606 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 6 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 6 More or fewer components than shown, or with Figure 6 Different configurations shown.

[0077] It should be noted that the one or more processors 602 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry". The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single independent processing module, or may be incorporated in whole or in part into any of the other components of the electronic device 60. As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0078] The memory 604 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the traffic management method in the embodiment of the present application. The processor 602 executes various functional applications and data processing by running the software programs and modules stored in the memory 604, that is, implementing the above-mentioned traffic management method. The memory 604 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 604 may further include a memory remotely located relative to the processor 602, and these remote memories may be connected to the electronic device 60 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0079] Transmission device 606 is used to receive or send data via a network. A specific example of the aforementioned network may include a wireless network provided by the communications provider of computer terminal 60. In one embodiment, transmission device 606 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, transmission device 606 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0080] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the electronic device 60 .

[0081] According to an embodiment of the present application, a non-volatile storage medium is also provided, in which a program is stored, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the following traffic management method: within a preset time period, the optical network terminal detects abnormal traffic in the export traffic and the abnormal port corresponding to the abnormal traffic according to preset judgment rules; performs traffic control on the abnormal port, and generates a processing log and an export traffic log, wherein the processing log includes processing information of the traffic control, and the export traffic log includes export traffic information that is not identified as abnormal traffic flowing through the optical network terminal within the preset time period; sends the processing log and the export traffic log to the cloud platform, wherein the processing log and the export traffic log are used together to update the preset judgment rules; the optical network terminal receives the updated preset judgment rules.

[0082] In some embodiments of the present application, when the program is running, the device where the non-volatile storage medium is located can also be controlled to execute the following traffic management method: the cloud platform receives the processing log and the export traffic log sent by the optical network terminal, wherein the processing log includes the processing information of the traffic control performed by the optical network terminal on the abnormal port, and the export traffic log includes the export traffic information that is not identified as abnormal traffic flowing through the optical network terminal within a preset time period. The optical network terminal is used to detect abnormal traffic in the export traffic and the abnormal port corresponding to the abnormal traffic within a preset time period; update the preset judgment rules based on the processing log and the export traffic log; and send the updated preset judgment rules to the optical network terminal.

[0083] According to an embodiment of the present application, a computer program product is also provided, including a computer program, which implements the following traffic management method when executed by a processor: within a preset time period, the optical network terminal detects abnormal traffic in the export traffic and the abnormal port corresponding to the abnormal traffic according to preset judgment rules; performs traffic control on the abnormal port, and generates a processing log and an export traffic log, wherein the processing log includes processing information of the traffic control, and the export traffic log includes export traffic information that is not identified as abnormal traffic flowing through the optical network terminal within the preset time period; sends the processing log and the export traffic log to the cloud platform, wherein the processing log and the export traffic log are used together to update the preset judgment rules; the optical network terminal receives the updated preset judgment rules.

[0084] In some embodiments of the present application, the computer program can also implement the following traffic management method when executed by the processor: the cloud platform receives the processing log and the export traffic log sent by the optical network terminal, wherein the processing log includes processing information of the traffic control performed by the optical network terminal on the abnormal port, and the export traffic log includes export traffic information that is not identified as abnormal traffic flowing through the optical network terminal within a preset time period. The optical network terminal is used to detect abnormal traffic in the export traffic and the abnormal port corresponding to the abnormal traffic within the preset time period; update the preset judgment rules based on the processing log and the export traffic log; and send the updated preset judgment rules to the optical network terminal.

[0085] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0086] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0087] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0088] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0089] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the relevant technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0090] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A traffic management method, characterized in that: include: Within a preset time period, the optical network terminal detects abnormal traffic in the egress traffic and the abnormal port corresponding to the abnormal traffic according to a preset judgment rule; Performing flow control on the abnormal port and generating a processing log and an egress flow log, wherein the processing log includes processing information of the flow control, and the egress flow log includes egress flow information that is not identified as abnormal flow and flows through the optical network terminal within the preset time period; Sending the processing log and the egress traffic log to a cloud platform, wherein the processing log and the egress traffic log are used together to update the preset judgment rule; The optical network terminal receives the updated preset judgment rule.

2. The traffic management method according to claim 1, wherein: The optical network terminal determines abnormal traffic in the egress traffic according to a preset judgment rule, and the abnormal port corresponding to the abnormal traffic includes: In a preset sub-time period within the preset time period, capturing and parsing data packets of a data link layer and a network layer of the egress traffic, and determining a parsing result of the egress traffic, wherein the parsing result includes source address information, destination address information, and port information; Determine, based on the analysis results and the data packet capture results, the egress traffic information sent by each source port, wherein the egress traffic information includes the number of destination ports, the number of data packets, the cumulative traffic, and the flow rate sent by the source port in the preset sub-time period; The abnormal flow is determined according to the preset judgment rule and the outlet flow information.

3. The traffic management method according to claim 2, characterized in that: Determining the abnormal flow according to the preset judgment rule and the outlet flow information, and the abnormal port corresponding to the abnormal flow includes: In a case where the number of the target ports is greater than a first preset number, determining that the source port is an abnormal port, and determining that the egress traffic sent by the source port is abnormal traffic; When the number of data packets is greater than a second preset number, determining that the source port is an abnormal port, and determining that the egress traffic sent by the source port is abnormal traffic; In a case where the flow rate exceeds a preset flow rate threshold, the source port is determined to be an abnormal port, and the egress flow sent by the source port is determined to be abnormal flow.

4. The traffic management method according to claim 1, wherein: Sending the egress traffic log to the cloud platform includes: Determining the cumulative flow emitted by each target source port within the preset time period, determining a source port whose cumulative flow exceeds a preset flow threshold as a missed abnormal port, and determining the egress flow emitted by the missed abnormal port as missed abnormal flow, wherein the target source port is a port that is not determined to be an abnormal port according to the preset judgment rule, and the egress flow emitted by the target source port is not determined to be abnormal flow according to the preset judgment rule; The omitted abnormal port and the omitted abnormal traffic are recorded in the traffic log, and the traffic log is sent to the cloud platform.

5. The traffic management method according to claim 4, characterized in that: The method further comprises: Processing the traffic log and the egress traffic log using a long short-term memory network model to determine traffic characteristics of the omitted abnormal port and the omitted abnormal traffic; The preset judgment rule is updated according to the traffic characteristics.

6. The traffic management method according to claim 1, characterized in that: The method further comprises: The cloud platform determines the abnormal port not determined by the optical network terminal according to the traffic log, and obtains the missing abnormal port information; The cloud platform sends the missing abnormal port information to the optical network terminal, and instructs the optical network terminal to perform flow control on the port indicated by the missing abnormal port information.

7. The traffic management method according to claim 1, characterized in that: The method further comprises: Determining target abnormal ports that have been determined to be abnormal ports within a preset number of preset time periods; The port information of the target abnormal port is sent to the cloud platform, wherein the cloud platform is used to instruct each optical network terminal in the communication network to perform flow control on the target abnormal port.

8. A traffic management method, characterized in that: include: The cloud platform receives a processing log and an egress traffic log sent by the optical network terminal, wherein the processing log includes processing information of flow control performed by the optical network terminal on the abnormal port, and the egress traffic log includes egress traffic information that is not identified as abnormal traffic and flows through the optical network terminal within a preset time period. The optical network terminal is used to detect abnormal traffic in the egress traffic within the preset time period, and the abnormal port corresponding to the abnormal traffic; Updating preset judgment rules according to the processing log and the export traffic log; The updated preset judgment rule is sent to the optical network terminal.

9. A traffic management system, characterized in that: Including optical network terminals, cloud platforms, among which, The optical network terminal is configured to determine abnormal traffic in the outlet traffic and the abnormal port corresponding to the abnormal traffic according to a preset judgment rule within a preset time period; perform traffic control on the abnormal port and generate a processing log and an outlet traffic log, wherein the processing log includes processing information of the traffic control, and the outlet traffic log includes outlet traffic information that is not identified as abnormal traffic and flows through the optical network terminal within the preset time period; Sending the processing log and the egress traffic log to the cloud platform, wherein the processing log and the egress traffic log are used together to update the preset judgment rule; The cloud platform is used to update the preset judgment rule according to the processing log and the export traffic log, and send the updated preset judgment rule to the optical network terminal.

10. A traffic management device, suitable for use in an optical network terminal, characterized in that: include: A first processing module is configured to detect abnormal traffic in the egress traffic and abnormal ports corresponding to the abnormal traffic according to preset judgment rules within a preset time period; a second processing module, configured to perform flow control on the abnormal port and generate a processing log and an egress flow log, wherein the processing log includes processing information of the flow control, and the egress flow log includes egress flow information that is not identified as abnormal flow and flows through the optical network terminal within the preset time period; A third processing module is used to send the processing log and the egress traffic log to a cloud platform, wherein the processing log and the egress traffic log are used together to update the preset judgment rule; The fourth processing module is used to receive the updated preset judgment rule.

11. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the traffic management method according to any one of claims 1 to 7 or claim 8.

12. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program executes the traffic management method according to any one of claims 1 to 7 or claim 8 when running.

13. A computer program product, characterized in that The computer program comprises a computer program which, when executed by a processor, implements the traffic management method according to any one of claims 1 to 7 or claim 8.

Images