Method, device and system for classifying network traffic data of data center

Abstract

The invention relates to the technical field of network traffic classification, in particular to a network traffic data classification method, device and system for a data center, and the method specifically comprises the steps: constructing a feature data matrix based on all types of feature information of all traffic in a data set, obtaining principal components in the matrix through a principal component analysis algorithm, screening representative principal components based on the variance contribution rates of the principal components and the correlation between the variance contribution rates; calculating a dynamic flow interference degree index of the data set based on the Shannon entropy of the representative principal component and the density clustering characteristic; a dynamic threshold is set, a trigger condition of incremental learning is set in combination with a dynamic traffic interference degree index, and after the incremental learning is triggered, a bidirectional GRU network in an RNN model is dynamically adjusted through an elastic weight solidification method, so that traffic classification is carried out, historical knowledge is reserved, and meanwhile, the method adapts to a new traffic mode. The system is ensured to quickly respond to the traffic mode change, the performance degradation is avoided, and the accuracy of network traffic data classification is improved.

Description

Technical Field

[0001] The present application relates to the technical field of network traffic classification, and in particular to a method, device and system for classifying network traffic data in a data center. Background Art

[0002] As data centers continue to expand and their services become increasingly complex, data center networks face challenges such as high concurrency, diverse traffic types, and the coexistence of large and small flows. Traditional traffic management methods struggle to effectively address these challenges. Furthermore, data centers carry a variety of critical information services and face increasingly severe threats from cyberattacks, necessitating refined management of network traffic. Classifying network traffic data enables effective management and optimization. Through precise classification, data centers can adopt differentiated scheduling strategies for different types of traffic, helping to strengthen security monitoring and risk prevention, promptly detect and address abnormal traffic, and ensure stable data center operations and the reliability of information services.

[0003] In network traffic data classification based on RNN (Recurrent Neural Network) neural network models, high-dimensional sparse features significantly increase the model's computational complexity and resource consumption. Existing technologies typically convert the 128-byte payload of each packet into a sequence of numbers. The feature dimension of a single packet can reach 128 dimensions, with most bytes likely to be zero or invalid filler values. High-dimensional sparse features lead to an explosive growth in RNN model parameters, resulting in a surge in computational complexity and an imbalance in resource efficiency, which in turn reduces the accuracy of network traffic data classification. Summary of the Invention

[0004] In order to solve the above technical problems, the purpose of this application is to provide a method, device and system for classifying network traffic data in a data center. The technical solutions adopted are as follows:

[0005] In a first aspect, an embodiment of the present application provides a method for classifying network traffic data in a data center, the method comprising the following steps:

[0006] Obtain each data packet of each flow on the terminal device; record the set of all flows in each time period as the data set of each time period; obtain the metadata characteristics of each flow, the payload content of the data packet, and the time interval between the data packets in each flow, and use them to construct the metadata feature matrix, payload feature matrix, and time feature matrix of each data set;

[0007] Obtaining the variance contribution rate of each principal component of the load characteristic matrix through a principal component analysis algorithm; selecting representative principal components based on the variance contribution rate and the correlation between the principal components, and recording them as representative principal components;

[0008] The first dynamic flow interference degree of the data set is constructed based on the degree of chaos and cluster concentration of all representative principal components; the second and third dynamic flow interference degrees of the data set are obtained using the same acquisition method as the first dynamic flow interference degree based on the metadata feature matrix and the time feature matrix, respectively. Combined with the first dynamic flow interference degree, the mean dynamic flow interference degree of the data set is calculated;

[0009] The dynamic traffic threshold for each time period is calculated based on the average dynamic traffic interference of the data sets of all time periods before each time period. The incremental learning trigger condition is set in combination with the dynamic traffic interference average. After the incremental learning is triggered, the bidirectional GRU network in the RNN model is updated through the elastic weight solidification method to perform traffic classification.

[0010] In one embodiment, the process of obtaining the metadata feature matrix, the load feature matrix, and the time feature matrix is ​​as follows:

[0011] The vector composed of all metadata features of each flow is recorded as the metadata vector, and the matrix composed of the metadata vectors of all flows in the dataset is recorded as the metadata feature matrix of the dataset;

[0012] Convert each byte of the payload content of each data packet into a two-digit hexadecimal value, and record the vector composed of all the hexadecimal values ​​of all bytes of the data packet as a numerical vector; concatenate the numerical vectors of all data packets of a single flow into a vector, which is recorded as a load feature vector; and record the matrix composed of the load feature vectors of all flows in the data set as the load feature matrix of the data set;

[0013] The time intervals between data packets of a single flow constitute a time interval sequence, and the matrix composed of the time interval sequences of all flows in the data set is recorded as the time feature matrix of the data set.

[0014] In one embodiment, the process of obtaining the representative principal component is:

[0015] Obtain the mutual information mean between any principal component of the load feature matrix and all other principal components, and use the average of the mutual information mean and the variance contribution rate of any principal component as the flow characteristic efficiency value of any principal component;

[0016] The principal component whose traffic characteristic efficiency value is greater than or equal to the preset representative threshold is taken as the representative principal component.

[0017] In one embodiment, the process of obtaining the first dynamic traffic interference degree is:

[0018] Calculating the Shannon entropy of each representative principal component; clustering all representative principal components to obtain clusters; and determining a first dynamic flow interference degree of the data set based on the Shannon entropy and a metric distance from an element in each cluster to a cluster center.

[0019] In one embodiment, the expression of the first dynamic flow interference degree of the data set is:

[0020] Where B1 is the first dynamic traffic interference degree of the data set, J is the number of representative principal components of the load feature matrix, and d j is the Shannon entropy of the jth representative principal component of the load characteristic matrix, g j is the metric distance from the jth representative principal component of the load feature matrix to the cluster center of the cluster where it is located, It is the average value of the metric distance from all elements in the cluster where the j-th representative principal component of the load feature matrix is ​​located to the cluster center.

[0021] In one embodiment, the dynamic traffic interference mean is: an average value of the first dynamic traffic interference, the second dynamic traffic interference, and the third dynamic traffic interference of the data set.

[0022] In one embodiment, the expression of the dynamic flow threshold of each time period is:

[0023] Where θ t ′ is the dynamic threshold of traffic flow in the current time period, θ t is the preset initial threshold for the current time period, is the mean value of the dynamic traffic interference of the data set in the current time period, and σ is the preset attenuation coefficient.

[0024] In one embodiment, the incremental learning triggering condition is: when the average dynamic traffic interference of a preset number of consecutive time period data sets is greater than the corresponding traffic dynamic threshold, incremental learning based on elastic weight solidification is triggered.

[0025] In a second aspect, an embodiment of the present application further provides a network traffic data classification device for a data center, wherein a computer program is stored in the device, and when the computer program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0026] In a third aspect, an embodiment of the present application also provides a network traffic data classification system for a data center, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor implements the steps of the method described in the first aspect when executing the computer program.

[0027] The embodiments of the present application have at least the following beneficial effects:

[0028] This application constructs various feature data matrices of the data set through various feature information of all flows in the data set, obtains the principal components in various feature data matrices through the principal component analysis algorithm, selects representative principal components based on the variance contribution rate of the principal components and the correlation between the principal components, and significantly reduces the computational complexity of the load content through the PCA algorithm, selects highly discriminative features, and reduces noise interference; calculates the dynamic flow interference index of the data set based on the Shannon entropy and density clustering characteristics of the representative principal components, significantly improves the robustness of the flow classification system to dynamic high-dimensional and noise interference, and provides more accurate flow management and security protection capabilities for the data center; for the flow model of the data center The pattern may change dynamically over time, and traditional static models are difficult to adapt to it, resulting in a decrease in classification performance. Dynamic threshold monitoring is set, and the trigger conditions for incremental learning based on elastic weight solidification (EWC) are set in combination with the dynamic traffic interference index. After the incremental learning is triggered, the model parameters of the bidirectional GRU network in the RNN model are dynamically adjusted through the elastic weight solidification (EWC) method to obtain an updated bidirectional GRU network, so that it can adapt to new traffic patterns while retaining historical knowledge, ensuring that the system can quickly respond to changes in traffic patterns and avoid performance degradation. Then, the RNN model is combined for traffic classification to improve the accuracy of network traffic data classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present application or the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0030] Figure 1 A flowchart of a method for classifying network traffic data in a data center provided by one embodiment of the present application;

[0031] Figure 2 Schematic diagram of the process of obtaining representative principal components in the embodiments of this application. DETAILED DESCRIPTION

[0032] To further illustrate the technical means and effects employed by this application to achieve the intended invention objectives, the following, in conjunction with the accompanying drawings and preferred embodiments, describes in detail a method, device, and system for classifying network traffic data in a data center, including its specific implementation, structure, features, and effects. In the following description, different references to "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics of one or more embodiments may be combined in any suitable manner.

[0033] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.

[0034] The following describes in detail a method, device, and system for classifying network traffic data in a data center provided by the present application with reference to the accompanying drawings.

[0035] See also Figure 1 , which shows a flowchart of a method for classifying network traffic data of a data center provided by an embodiment of the present application, the method comprising the following steps:

[0036] Step S1, obtain each data packet of each flow on the terminal device; record the set of all flows in each time period as the data set of each time period; obtain the metadata characteristics of each flow, the load content of the data packet and the time interval between the data packets in each flow, which are used to construct the metadata feature matrix, load feature matrix and time feature matrix of each data set.

[0037] In the process of traffic classification through neural network models, the problem of high-dimensional sparse features stems from directly converting the packet payload content into a fixed-length numerical sequence, such as converting 128 bytes into a 128-dimensional vector. This results in a large number of zero values ​​or invalid padding values ​​in the feature matrix, causing computational redundancy, noise interference, and the risk of model overfitting.

[0038] Collect relevant information about the traffic flow. Specifically, directly capture the inbound and outbound traffic on the terminal device, use high-performance packet capture tools to achieve zero-copy packet capture, ensure low latency and high throughput, and only capture the first three data packets of each flow to avoid resource pressure caused by full traffic storage. Set the time period. Preferably, the time period length is set to 10s in the embodiment of the present application. As other embodiments of the present application, the implementer can set the time period length according to actual conditions. Collect traffic once every time period, and use the set of traffic in each time period as the data set of the time period to enhance the model's perception of traffic time.

[0039] Furthermore, the structured metadata information is captured in real time through the optical splitter to obtain the metadata of each flow. The first 128 bytes of the first three packets of each flow are intercepted. If it is less than 128 bytes, zero padding is performed to obtain the payload content of each data packet of each flow. The time interval between the data packets in each flow is also obtained.

[0040] Then, the relevant data of the acquired traffic is preprocessed, specifically:

[0041] (1) Metadata features of each flow, including protocol type, source port, destination port, packet 1 size, packet 2 size, packet 3 size, time interval 1, and time interval 2. The vector composed of all metadata features of each flow is recorded as the metadata vector of each flow, and the matrix composed of metadata vectors of all flows in the dataset is recorded as the metadata feature matrix of the dataset. Each metadata vector is a row vector in the metadata feature matrix. Time interval 1 is the time interval between packet 1 and packet 2, and time interval 2 is the time interval between packet 2 and packet 3.

[0042] (2) For the payload content of each data packet, convert each byte of the payload content into a two-digit hexadecimal value to form a 256-dimensional numerical sequence. That is, each data packet generates a 256-dimensional vector, which is recorded as a numerical vector. The numerical vectors of the three data packets of a single flow are spliced ​​in chronological order into a 768-dimensional vector, which is recorded as the load feature vector of the single flow. The matrix composed of the load feature vectors of all flows in the data set is recorded as the load feature matrix of the data set. Each load feature vector is a row vector in the load feature matrix.

[0043] (3) The time interval is extracted from each packet, and the time intervals between the data packets of a single flow are combined into a time interval sequence. The matrix composed of the time interval sequences of all the flow in the dataset is recorded as the time feature matrix of the dataset. Each time interval sequence is a row vector in the time feature matrix.

[0044] Metadata provides structured information about traffic, enabling quick identification of protocol types, communication endpoints, and basic behavior patterns. Payload content reveals traffic content details, such as protocol headers and encryption handshake information, enabling identification of encrypted traffic or attack signatures. Time interval sequences reflect the temporal dynamic characteristics of traffic, assisting in detecting abnormal behavior.

[0045] Step S2, obtaining the variance contribution rate of each principal component of the load characteristic matrix through the principal component analysis algorithm; selecting representative principal components based on the variance contribution rate and the correlation between the principal components, and recording them as representative principal components.

[0046] The schematic diagram of the process of obtaining representative principal components is as follows: Figure 2 shown.

[0047] Most dimensions of high-dimensional load features are zero or random noise. Directly inputting them into a neural network model can lead to wasted computing resources and overfitting. Therefore, the load feature matrix is ​​used as the input for the principal component analysis (PCA) algorithm. PCA retains 95% of the variance and outputs the variance contribution of each principal component, i.e., the proportion of the variance of each principal component to the total variance of all principal components. The variance contribution rate reflects the degree to which the principal component retains the original data information. The PCA algorithm is well known, and the specific process will not be elaborated on here.

[0048] The mutual information between the i-th principal component of the load characteristic matrix and the other principal components is calculated. The calculation of the mutual information is a well-known technique, and the specific process will not be described in detail.

[0049] Based on the above analysis, the flow characteristic efficiency value of each principal component of the load characteristic matrix is ​​calculated, and the expression is:

[0050]

[0051] Where A i is the flow characteristic efficiency value of the i-th principal component of the load characteristic matrix, a i is the variance contribution rate of the i-th principal component of the load characteristic matrix, b i is the mean of the mutual information between the i-th principal component of the load feature matrix and all other principal components.

[0052] The variance contribution rate measures the ability of the principal component to retain the original data information. The larger its value, the more important the principal component is to the classification task.

[0053] A i The data representativeness and classification relevance of the principal components are balanced, and it is used in traffic classification tasks to screen principal components that can retain the core information of the original traffic and are strongly related to the classification target. i The larger the value, the higher the variance contribution rate and the stronger the classification correlation of the principal component. i The closer it is to 1, the more representative the i-th feature is in the global structure and highly discriminative in local classification.

[0054] A representative threshold is set in the range of 0.5 to 0.7. When screening representative principal components, if the representative threshold is too low, noise components may be introduced, and if it is too high, useful information may be lost. Preferably, in the embodiment of the present application, the representative threshold is set to 0.6. Further, the principal component with a flow characteristic efficiency value greater than or equal to the representative threshold in the load characteristic matrix is ​​obtained as the representative principal component, recorded as the representative principal component, and all representative principal components in the load characteristic matrix are formed into a vector, recorded as the representative characteristic vector.

[0055] Step S3, construct the first dynamic traffic interference degree of the data set based on the degree of chaos and cluster concentration of all representative principal components; according to the metadata feature matrix and the time feature matrix, use the same acquisition method as the first dynamic traffic interference degree to obtain the second dynamic traffic interference degree and the third dynamic traffic interference degree of the data set, and combine the first dynamic traffic interference degree to calculate the mean dynamic traffic interference degree of the data set.

[0056] Due to the dynamic drift of network traffic patterns, traditional static models are unable to adaptively update, resulting in a continuous decline in classification accuracy and increased real-time response latency. Specifically, the non-stationary changes in traffic distribution over time can cause significant deviations in the characteristic distributions of training data and real-time data, making the model gradually "outdated."

[0057] Calculate the Shannon entropy of the jth principal component in the representative feature vector. This entropy directly quantifies the randomness of the traffic characteristics. High entropy may indicate abnormal traffic or the emergence of new protocols. Use the representative feature vector as the input of the DBSCAN density clustering algorithm, where the neighborhood radius is set to 1 and the minimum number of points is set to 2. Output each cluster and calculate the average Euclidean distance from all elements in the cluster where the jth principal component is located to the cluster center, which is recorded as the first distance mean. And the Euclidean distance g from the jth principal component to the cluster center of the cluster where it is located j .

[0058] Based on the above analysis, the first dynamic flow interference degree of the data set is calculated, and the expression is:

[0059]

[0060] Where B1 is the first dynamic traffic interference degree of the data set, J is the number of principal components in the representative eigenvector of the load feature matrix, and d j is the Shannon entropy of the jth principal component in the representative eigenvector, g j is the Euclidean distance from the jth principal component in the representative feature vector to the cluster center of the cluster where it belongs, is the first distance mean of the j-th principal component in the representative eigenvector.

[0061] d j It is used to quantify the randomness of the features corresponding to the principal component. The larger the entropy value, the more dispersed the eigenvalue distribution of the principal component and the higher the uncertainty. It may imply the emergence of abnormal traffic or new protocols, which will have a greater impact on the classification performance of the model. j Measures the degree of deviation of the principal component from the current traffic pattern. The larger the value, the more significant the deviation of the principal component from the current traffic pattern, and the greater the dynamic interference to the model classification performance. It reflects the degree of aggregation of samples within the cluster and is used to normalize the degree of deviation of the principal component.

[0062] B1 quantifies the degree of dynamic interference of the principal components in the load feature matrix on the model classification performance, reflecting the abnormality and dynamic change intensity of the traffic pattern. The larger its value, the more complex the traffic pattern of the dataset is and the stronger the dynamic interference to the model classification performance.

[0063] Furthermore, based on the metadata feature matrix and time feature matrix of the data set, the second dynamic flow interference degree B2 and the third dynamic flow interference degree B3 of the data set are calculated using the same acquisition method as the first dynamic flow interference degree, and the average values ​​of B1, B2 and B3 are calculated. Denoted as the mean value of dynamic traffic interference, It is a comprehensive measure of the dynamic complexity of load, metadata, and time characteristics. It reflects the overall dynamic anomaly of network traffic in the three dimensions of content distribution, protocol structure, and timing behavior. The higher the value, the more significant non-stationarity the traffic pattern exhibits in terms of statistical characteristics (entropy increase), clustering structure (deviation from the core pattern), and temporal regularity (timing disorder). The higher the value, the more likely it is that the global traffic distribution drift is caused by the emergence of new encryption protocols, the evolution of attack behaviors, or network service mutations.

[0064] Step S4, calculate the dynamic traffic threshold of each time period based on the average dynamic traffic interference of the data sets of all time periods before each time period, set the incremental learning trigger condition in combination with the dynamic traffic interference average, and after triggering incremental learning, update the bidirectional GRU network in the RNN model through the elastic weight solidification method to perform traffic classification.

[0065] Based on the above analysis, we can see that higher dynamic traffic interference indicates that the current network traffic pattern is complex and changeable, and the data distribution is non-stationary. Mini-batch training, by reducing the amount of data required for a single gradient update, enhances the model's sensitivity to local pattern changes and avoids interference from noisy data in large batches.

[0066] Therefore, a dynamic traffic threshold θ is set. Specifically, the dynamic traffic interference degree means of the data sets of all time periods before the current time period are sorted in ascending order, and the 95% quantile of the sequence is obtained as the initial threshold for the current time period. It should be noted that the initial threshold can be set by the implementer according to actual conditions and is not specifically limited in this application.

[0067] And introduce the sliding window mechanism for dynamic adjustment to obtain the adjusted traffic dynamic threshold, which is expressed as:

[0068]

[0069] Where θ t ′ is the dynamic threshold of traffic flow in the current time period, θ t is the initial threshold of the current time period, is the mean value of the dynamic traffic interference of the data set in the current time period, and σ is the attenuation coefficient.

[0070] Among them, for σ, its value range is 0.8~0.9. Preferably, in the embodiment of the present application, the value of σ is set to 0.9 to avoid the short-term fluctuation caused by too low a value and the threshold adjustment lag caused by too high a value. The instantaneous noise is suppressed by weighted average to avoid the threshold from fluctuating violently due to a single abnormal value. If changes, the threshold θ t ′ will change gradually to adapt to the changing pattern of traffic.

[0071] When it is detected that the mean dynamic traffic interference of all time period data sets within T consecutive minutes is greater than the corresponding dynamic traffic threshold, incremental learning based on elastic weight consolidation (EWC) is triggered. The value of T can be set by the implementer according to the actual situation. In the embodiment of this application, the value of T is set to 3. EWC achieves progressive learning by constraining the update of important parameters and retaining the weights that are critical to old tasks. This allows the RNN to trigger learning only when there is a substantial change in the traffic pattern, avoiding resource waste and reducing computing and storage overhead.

[0072] After incremental learning is triggered, the model parameters of the bidirectional GRU network in the RNN model are dynamically adjusted using the elastic weight curing (EWC) method. This results in an updated bidirectional GRU network that adapts to new traffic patterns while retaining its memory of historical normal traffic characteristics. Dynamically adjusting the model parameters of the bidirectional GRU network in the RNN model using the elastic weight curing (EWC) method is a well-known technique, and the specific process will not be detailed here.

[0073] The RNN model implements traffic classification through the following process: First, the real-time collected traffic data is preprocessed to extract structural features, load features, and time series features. The updated bidirectional GRU network performs time series modeling on the three types of features to capture the evolution of traffic in the time dimension, such as the smooth interaction of normal traffic and the sudden fluctuations of malicious traffic. The nonlinear relationship between features is integrated through the fully connected layer. When the output layer calculates the probability of each classification based on Softmax, a dynamic weight allocation mechanism is used to allocate the classification probability. The dynamic weight allocation mechanism is as follows: for historically known malicious traffic types (such as DDoS and port scanning), the model prioritizes matching their load feature patterns (such as fixed attack payloads) and metadata anomalies (uncommon ports); for new threats identified by incremental learning, the dynamic interference index is combined to evaluate the degree of deviation from the normal traffic pattern, and the density clustering results are used to determine whether it is an unknown attack cluster. During the classification decision-making process, normal traffic is quickly classified because it conforms to historical statistical distributions and exhibits low dynamic interference. Malicious traffic, however, triggers alerts due to significant deviations from normal cluster centers, abnormal load entropy values, or irregular time intervals. The EWC mechanism constrains model updates to avoid corruption of existing classification knowledge. Traffic classification using an RNN model is well-known, and the detailed process is omitted here.

[0074] Based on the same inventive concept as the above method, an embodiment of the present application also provides a network traffic data classification device for a data center, wherein a computer program is stored in the device, and when the computer program is executed by a processor, the steps of any one of the above-mentioned methods for classifying network traffic data for a data center are implemented.

[0075] Based on the same inventive concept as the above method, an embodiment of the present application also provides a network traffic data classification system for a data center, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, the steps of any one of the above-mentioned methods for classifying network traffic data in a data center are implemented.

[0076] In summary, the embodiment of the present application provides a method for classifying network traffic data in a data center, which constructs various feature data matrices of the data set based on various feature information of all traffic in the data set, obtains the principal components in the various feature data matrices through the principal component analysis algorithm, selects representative principal components based on the variance contribution rate of the principal components and the correlation between the principal components, and significantly reduces the computational complexity of the load content through the PCA algorithm, selects highly discriminative features, and reduces noise interference; calculates the dynamic traffic interference index of the data set based on the Shannon entropy and density clustering features of the representative principal components, significantly improves the robustness of the traffic classification system to dynamic high-dimensional and noise interference, and provides more accurate traffic management for the data center. Management and security protection capabilities; In view of the fact that the traffic pattern of the data center may change dynamically over time and the traditional static model is difficult to adapt, resulting in the degradation of classification performance, dynamic threshold monitoring is set, and the trigger conditions of incremental learning based on elastic weight solidification (EWC) are set in combination with the dynamic traffic interference index. After the incremental learning is triggered, the model parameters of the bidirectional GRU network in the RNN model are dynamically adjusted through the elastic weight solidification (EWC) method to obtain the updated bidirectional GRU network, so that it can adapt to the new traffic pattern while retaining historical knowledge, ensuring that the system can quickly respond to changes in traffic patterns and avoid performance degradation, thereby performing traffic classification and improving the accuracy of network traffic data classification.

[0077] It should be noted that the order in which the embodiments of the present application are presented is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. Furthermore, the above descriptions are of specific embodiments of the present application. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential sequence shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0078] The various embodiments in this application are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

[0079] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the principles of the present application should be included in the scope of protection of the present application.

Claims

1. A data center network traffic data classification method, characterized in that: The method comprises the following steps: Obtain each data packet of each flow on the terminal device; record the set of all flows in each time period as the data set of each time period; obtain the metadata characteristics of each flow, the payload content of the data packet, and the time interval between the data packets in each flow, and use them to construct the metadata feature matrix, payload feature matrix, and time feature matrix of each data set; Obtaining the variance contribution rate of each principal component of the load characteristic matrix through a principal component analysis algorithm; selecting representative principal components based on the variance contribution rate and the correlation between the principal components, and recording them as representative principal components; The first dynamic flow interference degree of the data set is constructed based on the degree of chaos and cluster concentration of all representative principal components; the second and third dynamic flow interference degrees of the data set are obtained using the same acquisition method as the first dynamic flow interference degree based on the metadata feature matrix and the time feature matrix, respectively. Combined with the first dynamic flow interference degree, the mean dynamic flow interference degree of the data set is calculated; The dynamic traffic threshold for each time period is calculated based on the average dynamic traffic interference of the data sets of all time periods before each time period. The incremental learning trigger condition is set in combination with the dynamic traffic interference average. After the incremental learning is triggered, the bidirectional GRU network in the RNN model is updated through the elastic weight solidification method to perform traffic classification.

2. A data center network traffic data classification method according to claim 1, characterized in that: The acquisition process of the metadata feature matrix, load feature matrix and time feature matrix is ​​as follows: The vector composed of all metadata features of each flow is recorded as the metadata vector, and the matrix composed of the metadata vectors of all flows in the dataset is recorded as the metadata feature matrix of the dataset; Convert each byte of the payload content of each data packet into a two-digit hexadecimal value, and record the vector composed of all the hexadecimal values ​​of all bytes of the data packet as a numerical vector; concatenate the numerical vectors of all data packets of a single flow into a vector, which is recorded as a load feature vector; and record the matrix composed of the load feature vectors of all flows in the data set as the load feature matrix of the data set; The time intervals between data packets of a single flow constitute a time interval sequence, and the matrix composed of the time interval sequences of all flows in the data set is recorded as the time feature matrix of the data set.

3. The method for classifying network traffic data of a data center according to claim 1, wherein: The process of obtaining the representative principal component is as follows: Obtain the mutual information mean between any principal component of the load feature matrix and all other principal components, and use the average of the mutual information mean and the variance contribution rate of any principal component as the flow characteristic efficiency value of any principal component; The principal component whose traffic characteristic efficiency value is greater than or equal to the preset representative threshold is taken as the representative principal component.

4. The method for classifying network traffic data in a data center according to claim 1, wherein: The process of obtaining the first dynamic traffic interference degree is as follows: Calculating the Shannon entropy of each representative principal component; clustering all representative principal components to obtain clusters; and determining a first dynamic flow interference degree of the data set based on the Shannon entropy and a metric distance from an element in each cluster to a cluster center.

5. A data center network traffic data classification method according to claim 4, characterized in that: The expression of the first dynamic flow interference degree of the data set is: Where B1 is the first dynamic traffic interference degree of the data set, J is the number of representative principal components of the load feature matrix, and d j is the Shannon entropy of the jth representative principal component of the load characteristic matrix, g j is the metric distance from the jth representative principal component of the load feature matrix to the cluster center of the cluster where it is located, It is the average value of the metric distance from all elements in the cluster where the j-th representative principal component of the load feature matrix is ​​located to the cluster center.

6. The method for classifying network traffic data in a data center according to claim 1, wherein: The dynamic flow interference mean is: an average value of the first dynamic flow interference, the second dynamic flow interference and the third dynamic flow interference of the data set.

7. The method for classifying network traffic data in a data center according to claim 1, wherein: The expression of the dynamic flow threshold of each time period is: Where θ t ′ is the dynamic threshold of traffic flow in the current time period, θ t is the preset initial threshold for the current time period, is the mean value of the dynamic traffic interference of the data set in the current time period, and σ is the preset attenuation coefficient.

8. The method for classifying network traffic data in a data center according to claim 1, wherein: The incremental learning triggering condition is: when the average values ​​of the dynamic traffic interference of the data sets for a consecutive preset number of time periods are greater than the corresponding traffic dynamic threshold, the incremental learning based on elastic weight solidification is triggered.

9. A network traffic data classification device for a data center, wherein a computer program is stored in the device, characterized in that: When the computer program is executed by a processor, the steps of the network traffic data classification method for a data center as described in any one of claims 1 to 8 are implemented.

10. A network traffic data classification system for a data center, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of the network traffic data classification method for a data center as described in any one of claims 1 to 8 are implemented.

Images