Proactive quality of service awareness method and apparatus based on network traffic

Abstract

The application discloses a kind of active service quality perception method and device based on network flow, the method includes: by obtaining the first feature sequence of network flow transmission behavior of service data stream during service operation;The first feature sequence is time series modeling, and service state estimation is generated;According to the service state estimation, service state sequence is obtained, and the service state sequence is weighted fusion operation, and fusion service state vector is generated;Based on the fusion service state vector, end-side service quality is predicted, and service quality prediction result is obtained.The application can improve service quality perception ability and efficiency, and can be widely applied in network communication and service quality monitoring technical field.

Description

Technical Field

[0001] This invention relates to the field of network communication and service quality monitoring technology, and in particular to a proactive service quality perception method and apparatus based on network traffic. Background Technology

[0002] With the rapid development of the digital economy, highly interactive network services such as cloud gaming, high-definition video, and online education are placing higher demands on network service quality and user experience. Although significant progress has been made in network infrastructure construction in recent years, the rate of improvement in communication resources and data transmission capabilities lags far behind the rapid expansion of digital business needs. Furthermore, network infrastructure construction is constrained by both physical bottlenecks and operating costs, making it difficult to solve service quality issues through unlimited expansion. Secondly, the traditional TCP / IP protocol architecture, with its layered and independent design, limits efficient cross-layer information collaboration and struggles to flexibly adapt to the rapidly changing needs of digital business development. Moreover, under limited communication resources, the traditional best-effort transmission mode cannot meet the current widespread demand for customized and deterministic service guarantees.

[0003] Most existing service quality awareness methods rely on client feedback or explicit feature extraction, such as client-server collaborative service adaptive mechanisms, network traffic-based application identification methods, and IPv6-based application-aware IPv6 networking (APN6). However, these methods all have significant limitations in practical applications: client-server collaborative methods have significant response delays, only driving the server to adjust service data transmission methods after the client senses service quality degradation or network deterioration, making it difficult to reflect service quality changes in real time; application identification technologies lose their effectiveness in scenarios such as protocol reuse and application reuse; the APN6 method uses IPv6 extended headers to transmit information, relying on active cooperation from upper layers, resulting in strong passivity and high security risks. In recent years, some research has attempted to achieve proactive awareness of client-side service quality based solely on network-side data. However, most existing methods rely on static, coarse-grained statistical features, often ignoring contextual information and temporal dependencies in network behavior, failing to systematically model the temporal dynamic characteristics of traffic behavior, and struggling to effectively identify instantaneous fluctuations or trend changes in service quality. This significantly limits its ability to fully perceive the actual user experience when facing complex business scenarios (such as high-definition video playback, real-time communication, interactive applications, etc.). Summary of the Invention

[0004] In view of this, the main objective of the embodiments of the present invention is to provide a proactive service quality perception method and apparatus based on network traffic, in order to solve at least one of the problems of the prior art. The present invention can improve the service quality perception capability and efficiency.

[0005] To achieve the above objectives, one aspect of the present invention provides a proactive service quality awareness method based on network traffic, the method comprising:

[0006] Obtain the first characteristic sequence of network traffic transmission behavior of business data streams during business operation;

[0007] Perform time-series modeling on the first feature sequence to generate a business state estimate;

[0008] Based on the business state estimation, a business state sequence is obtained, and a weighted fusion operation is performed on the business state sequence to generate a fused business state vector.

[0009] Based on the fused service state vector, the service quality on the terminal side is predicted to obtain the service quality prediction result.

[0010] In some embodiments, obtaining a first feature sequence of network traffic transmission behavior of service data streams during service operation includes the following steps:

[0011] Based on a preset time interval, the initial network traffic is segmented to obtain data packets in several time window slices;

[0012] Multi-level feature extraction operations are performed on data packets of several time window slices to obtain several first feature sequences.

[0013] In some embodiments, the step of performing multi-level feature extraction operations on data packets of several time window slices to obtain several first feature sequences includes the following steps:

[0014] Multi-level feature extraction is performed on the data packets of the time window slice to obtain stream-level features and address-level features;

[0015] The flow-level features and the address-level features are integrated to obtain a second feature sequence;

[0016] The second feature sequence is subjected to a max-min normalization operation to obtain the first feature sequence.

[0017] In some embodiments, the step of performing multi-level feature extraction operations on data packets of several time window slices to obtain several first feature sequences includes the following steps:

[0018] Based on the source address, source port, destination address, destination port, and protocol of the data packets, the data packets belonging to the same service data flow are aggregated to generate the first set of session flows;

[0019] Obtain the first total data volume for each session stream in the corresponding data transmission direction, and obtain a first statistic based on the first total data volume;

[0020] Obtain the number of first data packets for each session stream in the corresponding data transmission direction, and obtain a second statistic based on the number of first data packets;

[0021] The flow-level features are obtained based on the first total number of the session flows, the first statistic, and the second statistic.

[0022] In some embodiments, the step of performing multi-level feature extraction operations on data packets of several time window slices to obtain several first feature sequences further includes the following step:

[0023] The data packets belonging to the same server address within the time window slice are aggregated to generate a second set of server sessions;

[0024] Obtain the second total data volume for each server session in the corresponding data transmission direction, and obtain a third statistic based on the second total data volume;

[0025] Obtain the number of second data packets for each server session in the corresponding data transmission direction, and obtain a fourth statistic based on the number of second data packets;

[0026] The address hierarchy features are obtained based on the second total number of server sessions, the third statistic, and the fourth statistic.

[0027] In some embodiments, performing time-series modeling on the first feature sequence to generate a business state estimate includes the following steps:

[0028] Based on the first feature sequence, construct a first context window;

[0029] Based on the first context window, the forward and backward service states are obtained through a bidirectional long short-term memory network;

[0030] The forward service state and the backward service state are fused to obtain the service state estimate.

[0031] In some embodiments, obtaining a business state sequence based on the business state estimation, and performing a weighted fusion operation on the business state sequence to generate a fused business state vector, includes the following steps:

[0032] Based on the context fusion window of the estimated service state, obtain the service state sequence within the context fusion window;

[0033] Each of the business state sequences is multiplied by the query mapping matrix, the key mapping matrix, and the value mapping matrix respectively to obtain the query vector, the key vector, and the value vector;

[0034] Based on the query vector and the key vector, obtain the correlation between the current business state sequence and each business state sequence within the context fusion window;

[0035] The attention weights are obtained by normalizing the correlation using the softmax function.

[0036] The value vector is weighted and summed according to the attention weights to obtain the fused service state vector.

[0037] In some embodiments, predicting the service quality on the terminal side based on the converged service state vector to obtain a service quality prediction result includes the following steps:

[0038] The fused service state vector is subjected to nonlinear feature transformation using the SELU activation function, and potential high-order features are extracted.

[0039] Extract the correlation strength between the potential higher-order features and the business quality level to obtain a score vector;

[0040] The score vector is normalized using the softmax function to obtain the probability distribution of each of the service quality levels.

[0041] The business quality level corresponding to the largest probability distribution is selected as the business quality prediction result.

[0042] To achieve the above objectives, another aspect of this invention proposes a proactive service quality awareness device based on network traffic, the device comprising:

[0043] The network traffic feature capture module is used to acquire the first feature sequence of network traffic transmission behavior of business data streams during business operation;

[0044] The business state estimation module is used to perform time-series modeling on the first feature sequence to generate a business state estimate.

[0045] The business state fusion module is used to obtain a business state sequence based on the business state estimation, perform a weighted fusion operation on the business state sequence, and generate a fused business state vector.

[0046] The service quality perception module is used to predict the service quality on the terminal side based on the fused service state vector, and obtain the service quality prediction result.

[0047] To achieve the above objectives, another aspect of the present invention provides an electronic device, the electronic device including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method described above.

[0048] To achieve the above objectives, another aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the methods described above.

[0049] To achieve the above objectives, another aspect of the present invention provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions to cause the computer device to perform the aforementioned method.

[0050] The embodiments of the present invention include at least the following beneficial effects: The present invention provides a proactive service quality perception method and apparatus based on network traffic. This scheme obtains a first feature sequence of network traffic transmission behavior of service data streams during service operation; performs time-series modeling on the first feature sequence to generate a service state estimate; obtains a service state sequence based on the service state estimate; performs a weighted fusion operation on the service state sequence to generate a fused service state vector; and predicts the end-side service quality based on the fused service state vector to obtain a service quality prediction result, thereby improving the service quality perception capability and efficiency. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 This is a flowchart of the proactive service quality perception method based on network traffic provided in an embodiment of the present invention;

[0053] Figure 2 This is a schematic diagram of the business status estimation process provided in an embodiment of the present invention.

[0054] Figure 3 This is a schematic diagram of the business status fusion process provided in an embodiment of the present invention;

[0055] Figure 4A schematic diagram of the structure of the proactive service quality perception device based on network traffic provided in this embodiment of the invention;

[0056] Figure 5 A schematic diagram of the hardware structure of the electronic device provided in this embodiment of the invention. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this invention; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this invention as detailed in the appended claims.

[0058] It should be noted that although functional modules are divided in the system diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms "first / S100" and "second / S200" in the specification, claims, and the foregoing drawings may be used herein to describe various concepts, but unless specifically stated otherwise, these concepts are not limited by these terms. These terms are used only to distinguish one concept from another. For example, first information may also be referred to as second information without departing from the scope of the embodiments of the invention, and similarly, second information may also be referred to as first information. Depending on the context, the words "if" or "when" as used herein may be interpreted as "when," "in response to a determination," or "in the event of a determination."

[0059] The terms “at least one,” “multiple,” “each,” “any,” etc., used in this invention, “at least one” includes one, two, or more than two; “multiple” includes two or more than two; “each” refers to each of the corresponding multiple; and “any” refers to any one of the multiple.

[0060] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein is for the purpose of describing embodiments of the invention only and is not intended to limit the invention.

[0061] like Figure 1 As shown, this embodiment of the invention provides a proactive service quality awareness method based on network traffic, which may include, but is not limited to, steps S100 to S400:

[0062] Step S100: Obtain the first feature sequence of network traffic transmission behavior of service data stream during service operation;

[0063] Step S200: Perform time-series modeling on the first feature sequence to generate a business state estimate;

[0064] Step S300: Based on the business state estimation, obtain a business state sequence, perform a weighted fusion operation on the business state sequence, and generate a fused business state vector.

[0065] Step S400: Based on the fused service state vector, predict the service quality on the terminal side to obtain the service quality prediction result.

[0066] In step S100 of some embodiments, network traffic monitoring is used to collect the transmission behavior characteristic sequence of the service data stream during service operation. Without interfering with normal service operation, real-time monitoring of the network transmission behavior of the target service stream is achieved, and feature sequences that can be used for modeling and analysis are extracted. Network traffic monitoring is implemented using tools (such as Wireshark or tcpdump) deployed on intelligent control nodes or bypass mirroring devices, possessing good cross-platform compatibility and adapting to various operating systems, thus ensuring the method's universality and scalability.

[0067] In some embodiments, step S100 may include, but is not limited to, steps S110 to S120:

[0068] Step S110: According to a preset time interval, the initial network traffic is segmented to obtain data packets of several time window slices;

[0069] Step S120: Perform multi-level feature extraction operations on the data packets of several time window slices respectively to obtain several first feature sequences.

[0070] In steps S110 to S120 of some embodiments, a preset time interval is first used to segment the original network traffic, resulting in data packets for multiple time window slices. Data packets within each time window slice are processed independently, and multi-level feature extraction is performed. The extracted features cover multiple protocol layers, reflecting the transmission behavior of the service flow at different granularities. For example, the original network traffic is first segmented at a fixed time interval of 1 second, and data packets within each window are processed independently. Multi-level feature extraction is performed on the data packets, and the extracted features may include, but are not limited to, flow-level features and address-level features (i.e., IP-level features).

[0071] In some embodiments, step S120 may include, but is not limited to, steps S121 to S123:

[0072] Step S121: Perform multi-level feature extraction on the data packets of the time window slice to obtain stream-level features and address-level features;

[0073] Step S122: Integrate the flow-level features and the address-level features to obtain a second feature sequence;

[0074] Step S123: Perform a max-min normalization operation on the second feature sequence to obtain the first feature sequence.

[0075] In step S121 of some embodiments, the data packets of each time window slice are processed independently, and multi-level feature extraction operations are performed on the data packets in each time window slice to obtain flow-level features and address-level features, which reflect the transmission behavior of the service flow at different granularities.

[0076] In some embodiments, based on the quintuple (source IP, source port, destination IP, destination port, protocol) of data packets within a certain time window slice, data packets belonging to the same business data flow are aggregated to generate a first set of session flows. The first total data volume (in bytes) of each session flow in the corresponding data transmission direction is obtained, and a first statistic is obtained based on the first total data volume, including a first entropy value, a first sum, a first mean, a first variance, a first maximum value, a first minimum value, a first kurtosis, and a first skewness. The first number of data packets (in bytes) of each session flow in the corresponding data transmission direction is also obtained, and a second statistic is obtained based on the first number of data packets, including a second entropy value, a second sum, a second mean, a second variance, a second maximum value, a second minimum value, a second kurtosis, and a second skewness. Based on the total number of elements in the first set, i.e., the total number of session flows, combined with the first and second statistics, flow-level features can be obtained. For example, the process of extracting flow-level features is as follows:

[0077] 1. Based on the 5-tuple (source IP, source port, destination IP, destination port, protocol), aggregate bidirectional data packets belonging to the same service data flow to generate the first set F = (F1, F2, ..., F...). n ), where F1, F2, ..., F n Each represents a session stream, and n represents the total number of session streams.

[0078] 2. Each session stream F i Based on the data transmission direction, it is divided into three directions: uplink (client to server), downlink (server to client), and bidirectional (uplink and downlink combined). For each direction, the following statistics are calculated:

[0079] 1) Obtain the first total data volume (in bytes) for each session stream in the corresponding data transmission direction, and obtain the following 8 first statistics: first entropy value, first sum, first mean, first variance, first maximum value, first minimum value, first kurtosis, and first skewness. This yields 8 first statistics for each session stream in the uplink direction, 8 first statistics for the downlink direction, and 8 first statistics for both directions, for a total of 24 features.

[0080] 2) Obtain the number of first data packets (in units) for each session stream in the corresponding data transmission direction, and obtain the following 8 second statistics: second entropy, second sum, second mean, second variance, second maximum, second minimum, second kurtosis, and second skewness. This yields 8 second statistics for each session stream in the uplink direction, 8 second statistics for the downlink direction, and 8 second statistics for both directions, for a total of 24 features.

[0081] Optionally, taking the first total data volume as an example, assume that each session stream F i The first total data volume in the corresponding data transmission direction is b. i The calculation methods for each primary statistic are as follows:

[0082] a) Entropy value: First, perform equal-width binning, taking the minimum to maximum value among all samples and dividing the interval evenly into 10 intervals. For each interval, count the number of data points n within that interval. i and normalize it to frequency. These frequencies satisfy Finally, the entropy value is calculated based on these frequencies.

[0083] b) Total

[0084] c) Mean

[0085] d) Variance

[0086] e) Maximum value Max = max{b1,b2,…,b n}

[0087] f) Minimum value Min = min{b1,b2,…,b} n}

[0088] g) Kurtosis

[0089] h) Skewness

[0090] Similarly, the process of obtaining the second statistic is the same as the calculation method of the first statistic.

[0091] 3. Based on the total number of session streams n within the time window slice and two sets of eight statistics calculated in three directions, the stream layer captured a total of 49 features.

[0092] For example, the process of address hierarchy features is as follows:

[0093] 1. All traffic packets involving the same server IP within a time window slice are aggregated into a single server session, forming the second set of server sessions. in, For each server session, n S This represents the total number of server sessions.

[0094] 2. Each server session stream S i Based on the data transmission direction, it is divided into three directions: uplink, downlink, and bidirectional. For each direction, the following statistics are calculated:

[0095] 1) Obtain the second total data volume (in bytes) for each server session in the corresponding data transmission direction, and obtain the following 7 third statistics: third entropy, third mean, third difference, third maximum, third minimum, third kurtosis, and third skewness. This yields 7 third statistics for each server session in the uplink direction, 7 third statistics for the downlink direction, and 7 third statistics for both directions, totaling 21 features.

[0096] 2) Obtain the number of second data packets (in units) for each server session in the corresponding data transmission direction, and obtain the following 7 fourth statistics: fourth entropy, fourth mean, fourth variance, fourth maximum, fourth minimum, fourth kurtosis, and fourth skewness. This yields 7 fourth statistics for each server session in the uplink direction, 7 fourth statistics for the downlink direction, and 7 fourth statistics for both directions, totaling 21 features.

[0097] Similarly, the calculation methods for the third and fourth statistics are the same as those for the first entropy, first mean, first variance, first maximum, first minimum, first kurtosis, and first skewness of the first statistics.

[0098] 3. Based on the total number of server sessions n within the time window slice. S With two sets of seven statistics calculated in three directions, the IP layer captured a total of 43 features.

[0099] In step S122 of some embodiments, the flow-level features and address-level features are integrated, wherein the flow-level features capture 49 features and the address-level features capture 43 features. Then, a 92-dimensional feature vector x′ is output for each time window.t When the data is finally formed in the form of time series data, the second feature sequence x′ is obtained. 1:T ={x′1,x′2,…,x′ T}, where T represents the total duration of the terminal-side service operation.

[0100] In step S123 of some embodiments, the second feature sequence x′ is... 1:T All statistical features are subjected to min-max normalization to eliminate the influence of different feature dimensions. Optionally, the normalization formula is as follows: Where x′ t [d] represents the original d-th dimension feature value at time step t, x t [d] represents its corresponding normalization result; min d and max d Let x and y represent the minimum and maximum values ​​of the d-th feature in the entire training dataset, respectively, which are calculated and fixed on the training set. After normalization, the final standardized temporal feature sequence is obtained, i.e., the first feature sequence x. 1:T ={x1,x2,…,x T}

[0101] In step S200 of some embodiments, based on the temporal evolution characteristics of network traffic, context modeling is performed on the network traffic transmission behavior feature sequence sliced ​​by time to generate a service state representation corresponding to each time point, which serves as an intermediate state estimate of the current service quality of the client. This intermediate state comprehensively considers the contextual dependency of network behavior in the time dimension, and acts as a bridge connecting the underlying traffic characteristics and the higher-level service quality, playing a key role in the final determination of service quality.

[0102] In some embodiments, step S200 may include, but is not limited to, steps S210 to S230:

[0103] Step S210: Construct a first context window based on the first feature sequence;

[0104] Step S220: Based on the first context window, obtain the forward service state and the backward service state through a bidirectional long short-term memory network;

[0105] Step S230: Perform a fusion operation on the forward service state and the backward service state to obtain the service state estimate.

[0106] In steps S210 to S230 of some embodiments, considering the significant temporal correlation of network traffic, optionally, a bidirectional long short-term memory (BiLSTM) network is used to model the traffic transmission behavior feature sequence after being sliced ​​by time window, that is, for the first feature sequence x 1:T ={x1,x2,…,x T The modeling process is as follows: BiLSTM consists of a forward LSTM chain and a backward LSTM chain: the forward LSTM predicts the current service state based on historical traffic transmission behavior, while the backward LSTM infers the current service state by assuming that future traffic transmission behavior is known. For example, as... Figure 2 As shown, in order to estimate the service quality status at time t, a context window w of the traffic transmission behavior feature sequence is selected. S It contains 2μ+1 traffic transmission behavior observation points, denoted as x. (t-μ:t+μ) Forward LSTM based on x (t-μ):t Calculate forward service status Backward LSTM by x t:(t+t) Calculate the backward business status Finally and splicing to bidirectional service status By gradually moving the context window w S It will output a business state sequence that incorporates traffic behavior context information. Here, T represents the last moment of service quality perception, rather than the endpoint of the observed traffic. By utilizing the aforementioned method, feature information from both sides of the target time point can be used during state estimation to enhance the modeling capability of the temporal context, accurately depicting the intrinsic state of network traffic behavior at that moment, and providing temporally continuous state input for subsequent state fusion and quality perception.

[0107] In step S300 of some embodiments, since the service state has significant contextual relevance, utilizing this contextual dependency can not only enhance the expressive power of local service states but also suppress mutation noise caused by abnormal fluctuations to a certain extent. Considering the influence of network dynamics, the contextual relevance of the service state does not have a fixed pattern. Therefore, a self-attention mechanism is used to adaptively fuse the temporal contextual information of the service state.

[0108] In some embodiments, step S3O0 may include, but is not limited to, steps S310 to S350:

[0109] Step S310: Obtain the service state sequence within the context fusion window based on the context fusion window of the service state estimation;

[0110] Step S320: Multiply each of the business state sequences by the query mapping matrix, the key mapping matrix, and the value mapping matrix respectively to obtain the query vector, the key vector, and the value vector;

[0111] Step S330: Based on the query vector and the key vector, obtain the correlation between the current business state sequence and each business state sequence in the context fusion window;

[0112] Step S340: Normalize the correlation using the softmax function to obtain the attention weights;

[0113] Step S350: Based on the attention weights, perform a weighted summation on the value vector to obtain the fused service state vector.

[0114] In some embodiments, steps S310 to S350, such as Figure 3 As shown, let δ be the width of one side of the service state context fusion window. Then, in order to obtain the fused service state at time step t, the fusion window w... M It contains a total of 2δ+1 business state sequences before and after t. Then there is Each of the business state sequences Multiplying the query vector q by the query mapping matrix, key mapping matrix, and value mapping matrix respectively yields the query vector q. τ Key vector k τ Sum vector v τ , where τ∈[t-δ,t+δ]. In this mechanism, q τ Indicates the business status at time τ The contextual information being studied is used to assess the importance of neighboring business states in the fusion process; k τ This information can be used to match queries from other business states; v τ This is the actual content used for fusion. Then through... The correlation between the current time t service state sequence and each service state sequence within the context fusion window is calculated and normalized using the softmax function to obtain the attention weights. Finally, the fused business state vector is obtained by weighted summation of the value vectors. Then there is

[0115] In step S400 of some embodiments, the current service quality level of the client is proactively perceived based on the fused service state vector. This process establishes a mapping relationship between service state and service quality level, enabling real-time perception of the client-side service experience solely based on observable network traffic transmission behavior characteristics on the network side.

[0116] In some embodiments, step S400 may include, but is not limited to, steps S410 to S440:

[0117] Step S410: The fused service state vector is subjected to nonlinear feature transformation using the SELU activation function, and potential high-order features are extracted.

[0118] Step S420: Extract the correlation strength between the potential high-order features and the business quality level to obtain a score vector;

[0119] Step S430: Normalize the score vector using the softmax function to obtain the probability distribution of each of the service quality levels;

[0120] Step S440: Select the service quality level corresponding to the largest probability distribution as the service quality prediction result.

[0121] In steps S410 to S440 of some embodiments, the corresponding edge service quality is predicted based on the fused service state vector. Exemplarily, a three-level processing structure is used to realize the mapping relationship between service state and service quality level: In the first stage, a fully connected layer with a SELU activation function is used to perform nonlinear feature transformation on the fused service state vector to extract its latent high-order features; in the second stage, the second fully connected layer further integrates feature information to extract expressions highly correlated with user-perceived quality, i.e., extracting the correlation strength between latent high-order features and service quality level, resulting in a score vector; since edge service quality is a discrete service experience indicator, the output layer of the third stage uses a softmax activation function to normalize the predicted probability of each service quality level, i.e., normalizing each score vector, outputting the probability distribution of each candidate service quality level, and selecting the service quality level corresponding to the largest probability distribution as the service quality prediction result for the current time point. This three-level processing structure can support binary classification tasks (such as "stuttering / smooth", "normal / abnormal") or multi-classification tasks (such as different quality level classifications), adapting to the quality assessment needs of various real-world business scenarios.

[0122] In some embodiments, taking online video-on-demand (VOD) in multimedia services as an example, the service experience metrics include resolution level and buffer status. Resolution level levels include four levels: 360p, 480p, 720p, and 1080p; buffer status levels include stuttering, rising, decaying, and stable. Stuttering refers to the online video playback stopping due to the player buffer running out; rising refers to the player buffer continuously increasing; decaying refers to the buffer continuously decreasing; and stable refers to the player buffer stabilizing within a certain range. Traffic mirroring of the target video stream is performed at the home gateway device, and the video resolution level and player buffer status level are recorded in real time per second through a monitoring program on the browser. Using this method, a traffic dataset covering different network conditions and video content is constructed, and corresponding end-side service quality labels are assigned to it. Subsequently, an end-to-end supervised learning approach is used to train the model. Let the parameter set of the model be denoted as Ω, and it is optimized using maximum likelihood estimation. Since the service quality perception problem can be classified as a classification task, the training objective is to minimize the difference between the model's predicted probability distribution and the true label. This difference is measured using the cross-entropy loss function. Let the training set contain N video data samples, and the length of each sample be denoted as T. (n) Overall cross-entropy loss function The definition is as follows:

[0123]

[0124] Where J is the total number of categories in the classification task; The indicator variable for the true label takes a value of 1 if the label of the nth sample at time t belongs to the jth class, and 0 otherwise; while This is the predicted probability corresponding to the model.

[0125] To minimize the aforementioned loss function, a first-order gradient-based Adam optimizer is used during training to iteratively update the parameters Ω. The gradient of the loss function with respect to each parameter is calculated via backpropagation. The optimizer then dynamically adjusts the learning rate based on the current gradient information, determining the update direction and step size for each iteration. This ensures that the updated parameters continuously bring the loss function value closer to the global minimum. This process iterates until the loss function value falls below a set threshold ε or the maximum number of iterations is reached. Ultimately, the model converges to a set of optimal or near-optimal parameters, giving it strong business quality awareness capabilities.

[0126] This invention also provides a proactive service quality awareness device based on network traffic, which can implement the above-described method. The device includes:

[0127] The network traffic feature capture module is used to acquire the first feature sequence of network traffic transmission behavior of business data streams during business operation;

[0128] The business state estimation module is used to perform time-series modeling on the first feature sequence to generate a business state estimate.

[0129] The business state fusion module is used to obtain a business state sequence based on the business state estimation, perform a weighted fusion operation on the business state sequence, and generate a fused business state vector.

[0130] The service quality perception module is used to predict the service quality on the terminal side based on the fused service state vector, and obtain the service quality prediction result.

[0131] For example, refer to Figure 4 The proactive service quality perception device based on network traffic comprises four main components: a network traffic feature capture unit (module), a service state estimator (module), a service state fusion unit (module), and a service quality perceiver (module). Deployed on terminal-side or edge-side devices, this device performs real-time monitoring and intelligent analysis of network behavior in a non-intrusive manner, thereby achieving automatic identification and accurate assessment of service quality. The main execution approach is as follows: real-time collection and feature extraction of network traffic during service playback, combined with a sliding window mechanism to estimate the service operation status at each moment, and then further fusion processing of the service status of vector time slices to ultimately achieve intelligent prediction of terminal service quality. This device and its implementation method can be widely applied to various typical network service scenarios such as online video-on-demand, voice communication, distance education, and AR / VR applications. It is particularly suitable for deployment on devices with certain computing capabilities, such as SDN controllers, gateway devices, home routers, edge nodes, and mobile terminals, forming a non-intrusive, lightweight, and real-time service quality perception capability. It has advantages such as automation and high efficiency. Through non-intrusive network traffic collection, it can directly complete quality judgment based on network layer data without relying on business servers or modifying terminal applications.

[0132] For example, refer to Figure 4 The specific working principles of each module are as follows:

[0133] I. Network Traffic Feature Collector

[0134] The network traffic feature collector operates on the intelligent control node or bypass mirroring device. Its function is to capture network traffic during service operation and extract traffic features that can be used for subsequent sensing. This process specifically includes the following steps:

[0135] Step 1-1: During business operations, capture raw network traffic data passing through terminal devices in real time. Raw network traffic may include, but is not limited to, TCP / UDP packet length, timestamps, packet intervals, IP addresses and port numbers of uplink and downlink data, data packet protocols, retransmission counts, connection establishment information, etc., to characterize network behavior features during business operations.

[0136] Steps 1-2: Segment the captured network traffic according to a fixed time granularity. Construct a sliding time window with a time window length of 1 second, perform statistical processing on the data packets within each time window, extract the network behavior features within that time window, and form a preliminary feature vector.

[0137] Steps 1-3: To improve the stability and accuracy of subsequent modeling, the extracted original feature vectors are standardized. The min-max normalization method is used to map all feature values ​​to the [0,1] interval, thereby eliminating the scale effect between features of different dimensions. The normalized feature data are then sequentially stored in the feature window, forming a time-continuous feature sequence x. 1:T ={x1,x2,…,x T This provides input for subsequent business status estimation.

[0138] II. Business Status Estimator

[0139] After completing feature data collection and preprocessing, the business status estimation stage begins. This stage aims to estimate the current operational status of the business based on the traffic feature sequence within a sliding feature window. Specifically, it includes the following steps:

[0140] Step 2-1: First, determine whether the length of the current feature window meets the minimum number of samples required for state estimation. Set the estimation window length to 2μ+1, where μ represents the half-window length required for state estimation, which is set to 3 seconds in this specific embodiment. Service state estimation is only performed when the accumulated data within the feature window reaches this length; otherwise, return to the network traffic capture process and continuously replenish the feature window data.

[0141] Step 2-2: When the feature window length reaches 2μ+1, the center time point of the feature window is selected as the target time point. At this time, the complete traffic behavior feature sequence within the feature window is input into the pre-trained state estimation model for inference. This step uses a bidirectional long short-term memory (BiLSTM) network structure to model the forward and backward dependencies in the time series. In input processing, the feature sequence is divided into two sub-sequences: the forward sub-sequence contains the target time point and μ feature points before it (μ+1 in total), which serves as the input to the forward LSTM; the backward sub-sequence contains the target time point and μ feature points after it (μ+1 in total), which serves as the input to the backward LSTM. The forward LSTM models the evolution trend of traffic features from the past to the present, while the backward LSTM looks back from the future to the present, capturing the potential impact of subsequent features on the current state. The model outputs hidden state vectors in both directions, and finally, the forward and backward hidden states are merged through a concatenation operation to form a business state representation for the target time point.

[0142] Steps 2-3: Store the estimated business status results in the status window in chronological order for subsequent status fusion processing.

[0143] Steps 2-4: To ensure the feature window is up-to-date and its length does not exceed the limit, after the business state estimation is completed, the feature corresponding to the earliest time point in the feature window is removed, thereby completing the sliding update of the feature window.

[0144] III. Business Status Fusion Device

[0145] To further enhance the ability to represent local business states and, to some extent, suppress abrupt noise caused by abnormal fluctuations, this module performs a state fusion operation based on state estimation to generate a more stable business state representation. This stage includes the following steps:

[0146] Step 3-1: First, determine whether the length of the current state window has reached the minimum data volume required for state fusion. Set the state fusion window length to 2δ+1, where δ is half the length of the fusion window; in this specific embodiment, it is set to 3 seconds. If the state window does not meet this length requirement, the fusion operation is not performed; instead, new state estimation results are received and the window is updated.

[0147] Step 3-2: When the state window length satisfies 2δ+1, the system constructs a time-series input of the business states at each time point within the state window. Subsequently, using a self-attention mechanism, the system models the correlation between the state vectors in this sequence, automatically calculates the importance of each time point state to the current central state, and generates a weighted fused state representation as the fused business state corresponding to the central time point of the state window. This provides a stable and reliable input foundation for the subsequent business quality perception module. This process not only considers the temporal positional relationship of each business state but also flexibly models the nonlinear dependencies between states, highlighting key state information and effectively suppressing state jitter caused by instantaneous fluctuations or misjudgments, adapting to various complex state fluctuation patterns.

[0148] Step 3-3: After completing the business status fusion, delete the status at the earliest time point in the status window to ensure that the status window length remains constant.

[0149] IV. Business Quality Perceiver

[0150] Finally, based on the merged service status results, the quality of terminal services is predicted. The specific steps are as follows:

[0151] Step 4-1: The system takes the fused business status as input and feeds it into the business quality perception model to generate the user-perceived quality index for the corresponding time point. This quality perception model is a shallow neural network structure, specifically comprising three stages, used to model the mapping relationship between business status and perceived quality. The first stage uses a fully connected layer with a SELU activation function to perform a nonlinear feature transformation on the fused business status vector, extracting its latent high-order features. The second stage uses a linear transformation to map the high-order features to generate unnormalized scores. The third stage uses a softmax function to output the probability distribution of each candidate business quality level, and selects the category corresponding to the highest probability as the business quality prediction result for the current time point.

[0152] It is understood that the content of the above method embodiments is applicable to the present device embodiments. The specific functions implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0153] This invention also provides an electronic device, which includes a processor and a memory. The memory stores a computer program, and the processor executes the computer program to implement the above-described method. This electronic device can be any smart terminal, including a tablet computer, an in-vehicle computer, or similar device.

[0154] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0155] refer to Figure 5 , Figure 5 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes:

[0156] The processor 501 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention.

[0157] The memory 502 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 502 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 502 and is called and executed by the processor 501.

[0158] The input / output interface 503 is used to implement information input and output;

[0159] The communication interface 504 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0160] Bus 505 transmits information between various components of the device (e.g., processor 501, memory 502, input / output interface 503, and communication interface 504);

[0161] The processor 501, memory 502, input / output interface 503, and communication interface 504 are connected to each other within the device via bus 505.

[0162] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0163] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0164] This invention also provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions to cause the computer device to perform the aforementioned method.

[0165] In summary, the proactive service quality perception method and apparatus based on network traffic of this invention infers user-side service quality indicators by real-time monitoring of network traffic transmission behavior characteristics and combining them with a deep learning model, without requiring user application layer feedback or decryption of traffic content. This solution has advantages such as simple implementation, strong scalability, and good adaptability, and is suitable for scenarios such as service quality prediction, encrypted traffic analysis, and network resource scheduling optimization. Specifically, it has the following advantages:

[0166] 1. The embodiments of the present invention estimate state services based on the statistical behavior characteristics of traffic, without involving plaintext protocol parsing or application layer content. Therefore, it still has good adaptability and effectiveness in encrypted transmission scenarios such as HTTPS and QUIC, and can cover the current mainstream privacy-enhanced network communication environment.

[0167] 2. The embodiments of the present invention implement an active perception mechanism initiated from the network side. It can actively infer the quality of higher-level services based solely on conventionally measurable underlying network traffic behavior characteristics, without relying on client feedback or service protocol cooperation. This avoids the perception lag problem caused by end-side response delay and reduces dependence on external information interaction and potential risks.

[0168] 3. The embodiments of the present invention rely on the traffic monitoring capabilities of existing network infrastructure. They do not require the introduction of additional sensing mechanisms or modification or expansion of the existing protocol stack. They can be quickly deployed in the current network system at low cost, which helps to improve the intelligent perception capabilities of the network side.

[0169] 4. The embodiments of the present invention quantitatively describe the dynamic change patterns and causal mapping relationships of network traffic and service quality over time by service state estimation and service state fusion, which better characterizes network behavior in the real world and provides a reliable decision-making basis for subsequent transmission optimization, scheduling control and resource allocation.

[0170] 5. The embodiments of this invention can be widely applied to intelligent control nodes on the network side, including but not limited to network controllers (such as SDN controllers), access gateway devices (such as edge gateways, home gateways, and enterprise-level routers), and edge computing nodes. This solution can proactively perceive end-side service quality from network transmission behavior without relying on plaintext application layer information or client feedback, thereby providing a basis for network scheduling and resource optimization decisions. Supported service types include, but are not limited to, multimedia services (such as video-on-demand, live streaming, and online conferencing) and real-time interactive services (such as cloud gaming, remote desktop, and telemedicine).

[0171] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is altered and sub-operations described as part of a larger operation are executed independently.

[0172] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the described functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0173] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0174] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0175] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0176] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0177] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0178] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0179] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the embodiments described. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of the present invention.

Claims

1. A proactive service quality perception method based on network traffic, characterized in that, Includes the following steps: Obtaining a first feature sequence of network traffic transmission behavior of service data streams during service operation includes: segmenting initial network traffic according to a preset time interval to obtain data packets of several time window slices; performing multi-level feature extraction operations on the data packets of the several time window slices respectively to obtain several first feature sequences; wherein, performing multi-level feature extraction operations on the data packets of the several time window slices respectively to obtain several first feature sequences includes: aggregating data packets belonging to the same service data stream based on the source address, source port, destination address, destination port and protocol of the data packets to generate a first set of session streams; obtaining a first total data volume of each session stream in the corresponding data transmission direction, and obtaining a first feature sequence based on the first total data volume. The process involves several steps: First, obtaining the number of first data packets in the corresponding data transmission direction for each session stream, and obtaining a second statistic based on the number of first data packets. Second, obtaining a stream-level feature based on the first total number of session streams, the first statistic, and the second statistic. Third, aggregating data packets belonging to the same server address within the time window slice to generate a second set of server sessions. Fourth, obtaining the second total data volume in the corresponding data transmission direction for each server session, and obtaining a third statistic based on the second total data volume. Fifth, obtaining the number of second data packets in the corresponding data transmission direction for each server session, and obtaining a fourth statistic based on the number of second data packets. Finally, obtaining an address-level feature based on the second total number of server sessions, the third statistic, and the fourth statistic. The process of performing time-series modeling on the first feature sequence to generate a business state estimate includes: constructing a first context window based on the first feature sequence; obtaining forward and backward business states through a bidirectional long short-term memory network based on the first context window, including: selecting the center time point of the first context window as the target time point, dividing the first feature sequence into forward sub-sequences and backward sub-sequences; calculating the forward business state based on the forward sub-sequences; calculating the backward business state based on the backward sub-sequences; and performing a fusion operation on the forward and backward business states to obtain the business state estimate; wherein the forward sub-sequences include the target time point and feature points before the target time point; and the backward sub-sequences include the target time point and feature points after the target time point. Based on the business state estimation, a business state sequence is obtained, and a weighted fusion operation is performed on the business state sequence to generate a fused business state vector. Based on the fused service state vector, the service quality on the terminal side is predicted to obtain the service quality prediction result.

2. The method according to claim 1, characterized in that, The step of performing multi-level feature extraction operations on data packets of several time window slices to obtain several first feature sequences includes the following steps: Multi-level feature extraction is performed on the data packets of the time window slice to obtain stream-level features and address-level features; The flow-level features and the address-level features are integrated to obtain a second feature sequence; The second feature sequence is subjected to a max-min normalization operation to obtain the first feature sequence.

3. The method according to claim 1, characterized in that, The step of obtaining a business state sequence based on the business state estimation, and performing a weighted fusion operation on the business state sequence to generate a fused business state vector includes the following steps: Based on the context fusion window of the estimated service state, obtain the service state sequence within the context fusion window; Each of the business state sequences is multiplied by the query mapping matrix, the key mapping matrix, and the value mapping matrix respectively to obtain the query vector, the key vector, and the value vector; Based on the query vector and the key vector, obtain the correlation between the current business state sequence and each business state sequence within the context fusion window; The attention weights are obtained by normalizing the correlation using the softmax function. The value vector is weighted and summed according to the attention weights to obtain the fused service state vector.

4. The method according to claim 1, characterized in that, The process of predicting the service quality on the terminal side based on the fused service state vector to obtain the service quality prediction result includes the following steps: The fused service state vector is subjected to nonlinear feature transformation using the SELU activation function, and potential high-order features are extracted. Extract the correlation strength between the potential higher-order features and the business quality level to obtain a score vector; The score vector is normalized using the softmax function to obtain the probability distribution of each of the service quality levels. The business quality level corresponding to the largest probability distribution is selected as the business quality prediction result.

5. A proactive service quality perception device based on network traffic, characterized in that, include: A network traffic feature capture module is used to acquire a first feature sequence of network traffic transmission behavior of service data streams during service operation. Specifically, the network traffic feature capture module is used to: segment the initial network traffic according to a preset time interval to obtain data packets of several time window slices; perform multi-level feature extraction operations on the data packets of the several time window slices respectively to obtain several first feature sequences; wherein, performing multi-level feature extraction operations on the data packets of the several time window slices respectively to obtain several first feature sequences includes: aggregating data packets belonging to the same service data stream based on the source address, source port, destination address, destination port, and protocol of the data packets to generate a first set of session streams; acquiring the first total data volume of each session stream in the corresponding data transmission direction, and based on... A first statistic is obtained based on the first total data volume; the number of first data packets in the corresponding data transmission direction for each session stream is obtained, and a second statistic is obtained based on the number of first data packets; a stream-level feature is obtained based on the first total number of session streams, the first statistic, and the second statistic; data packets belonging to the same server address within the time window slice are aggregated to generate a second set of server sessions; a second total data volume in the corresponding data transmission direction for each server session is obtained, and a third statistic is obtained based on the second total data volume; a second number of second data packets in the corresponding data transmission direction for each server session is obtained, and a fourth statistic is obtained based on the number of second data packets; an address-level feature is obtained based on the second total number of server sessions, the third statistic, and the fourth statistic. A business state estimation module is used to perform time-series modeling on the first feature sequence to generate a business state estimate. Specifically, the business state estimation module is used to: construct a first context window based on the first feature sequence; and obtain forward and backward business states through a bidirectional long short-term memory network based on the first context window, including: selecting the center time point of the first context window as the target time point, dividing the first feature sequence into forward and backward sub-sequences; calculating the forward business state based on the forward sub-sequences; calculating the backward business state based on the backward sub-sequences; and performing a fusion operation on the forward and backward business states to obtain the business state estimate. The forward sub-sequences include the target time point and feature points before the target time point; the backward sub-sequences include the target time point and feature points after the target time point. The business state fusion module is used to obtain a business state sequence based on the business state estimation, perform a weighted fusion operation on the business state sequence, and generate a fused business state vector. The service quality perception module is used to predict the service quality on the terminal side based on the fused service state vector, and obtain the service quality prediction result.

6. An electronic device, characterized in that, Including the processor and memory; The memory is used to store programs; The processor executes the program to implement the method as described in any one of claims 1 to 4.

Images