Adaptive loop detection method and system based on flow characteristics

Abstract

The invention provides a self-adaptive loop detection method and system based on flow characteristics, and relates to the technical field of loop detection, native flow characteristics in a network are collected to obtain a time sequence characteristic stream, the native flow characteristics comprise a transmission characteristic, a content characteristic and a forwarding characteristic, and the time sequence characteristic stream is sent to the network; automatically splicing the time sequence feature streams into an original data set according to a time sequence; s2, performing automatic learning on the original data set obtained in the S1 by using a density clustering algorithm to generate a dynamic mode library which comprises initial mode generation, mode autonomous evolution and mode stability marking; s3, when the potential loop risk is identified in S3, calling a historical loop feature library, and autonomously dividing the level of the current potential loop risk through feature similarity automatic matching; and S4, calling a historical response strategy library according to the risk level obtained in the step S4, automatically generating a response strategy, and performing feedback optimization based on a response result.

Description

Technical Field

[0001] The present invention relates to the technical field of loop detection, and in particular to a flow feature-based adaptive loop detection method and system. Background Art

[0002] Network loop detection technology has been widely used in network management and maintenance. Numerous existing technical solutions have their own unique characteristics. For example, some solutions detect loops by sending specific probe messages. Link-layer-based detection methods, for example, periodically send specially constructed Layer 2 probe frames along network links. These frames carry specific identification information and determine loop presence by observing the transmission paths of these frames and whether duplicate frames are received. This method can effectively detect Layer 2 loops in scenarios with relatively simple network topologies and stable link status.

[0003] There are also some network-layer detection methods that use the relevant mechanisms of routing protocols to detect loops. For example, some routing protocols record information such as the number of hops in a route when exchanging routing information. By analyzing this information, if an abnormal increase in the hop count of a route or unreasonable looping of routing information is found, it can be inferred that a network loop may exist.

[0004] In addition, some existing technologies also use the port status information of network devices to assist in loop detection. For example, by monitoring parameters such as the port traffic rate and the number of error packets, when an abnormal increase in traffic or a sharp increase in the number of error packets on a certain port is found, other information is combined to determine whether it may be caused by a loop.

[0005] Poor adaptability to dynamic network environments: Modern network environments are complex and ever-changing, and the size, direction, and topology of network traffic can change at any time. However, many existing loop detection technologies use fixed detection strategies and thresholds. For example, when detecting traffic anomalies to determine loops, the set traffic thresholds are static and cannot be dynamically adjusted based on real-time changes in network traffic. When network traffic experiences sudden increases or large fluctuations due to business demand, fixed thresholds may lead to misjudgments, misinterpreting normal traffic fluctuations as anomalies caused by loops, or failing to promptly detect actual loops caused by traffic changes, seriously affecting the accuracy and reliability of detection.

[0006] Lack of comprehensive utilization of multi-dimensional traffic characteristics: Network traffic has a rich set of characteristics, including traffic size, traffic change rate, packet arrival interval, protocol type distribution, and other dimensions. However, existing technologies often focus on only one or a few of these characteristics. For example, some detection methods identify loops based solely on traffic size, ignoring other important characteristics such as traffic change rate. In actual networks, different types of loops may lead to traffic anomalies with different characteristic combinations. Failure to comprehensively analyze multi-dimensional traffic characteristics can easily lead to the omission of detection of some complex loops, reducing the comprehensiveness and effectiveness of detection.

[0007] Low detection efficiency: Some existing loop detection technologies require extensive computation and data transmission during the detection process. For example, some detection methods based on complex algorithms require multiple iterations and extensive data exchange when testing each node or link in the network. This consumes significant network bandwidth and results in lengthy detection times. In large networks, this inefficient detection method cannot detect loops in a timely manner, potentially prolonging network failures and severely impacting normal network operation.

[0008] Difficulty adapting to complex network topologies: With the continuous development of network technology, network topologies have become increasingly complex, with the emergence of a large number of mesh networks, multi-layer networks, and hybrid network structures. Some traditional loop detection technologies are designed based on specific simple network topologies. When faced with complex topologies, their detection logic may become chaotic. For example, in a mesh network, due to the diversity and complexity of link connections, detection methods based on simple link tracing may not be able to accurately determine the transmission path of data packets, making it difficult to effectively detect loops, limiting their application in complex network environments. Summary of the Invention

[0009] In view of the deficiencies of the prior art, the present invention provides a method and system for adaptive loop detection based on traffic characteristics.

[0010] A method and system for adaptive loop detection based on traffic characteristics, comprising the following steps:

[0011] S1. Collect native traffic features in the network to obtain a time-series feature stream. The native traffic features include transmission features, content features, and forwarding features. The time-series feature stream is automatically spliced ​​into an original data set in chronological order.

[0012] S2. Using a density clustering algorithm to automatically learn the original data set obtained in S1 to generate a dynamic pattern library, wherein the generation of the dynamic pattern library includes initial pattern generation, pattern autonomous evolution, and pattern stability marking;

[0013] S3, based on the dynamic pattern library obtained in S2, calculates the distribution deviation between the current characteristic flow and the stable normal pattern in the dynamic pattern library, and automatically identifies potential loop risks based on the distribution deviation;

[0014] S4. When S3 identifies a potential loop risk, it calls the historical loop feature library, automatically matches features based on similarity, and autonomously classifies the current potential loop risk level.

[0015] S5. Based on the risk level obtained in S4, the historical response strategy library is called to automatically generate a response strategy, and feedback optimization is performed based on the response results.

[0016] Preferably, the specific working steps of S1 are as follows:

[0017] Among them, distributed probes are deployed at each node of the network to monitor passively, collect native traffic features that have not been manually screened, and form a time-series feature flow. The time-series feature flow includes the transmission feature set F Q , content feature set F C and forwarding feature set F R ;

[0018] By the transmission feature set F Q , content feature set F C and forwarding feature set F R The original dataset Y is obtained by splicing according to timestamp t.

[0019] Preferably, the step S2 uses a density clustering algorithm to automatically learn the original data set obtained in S1 to generate a dynamic pattern library. The specific steps are as follows:

[0020] Taking 24 hours a day as a fixed time period, the initial pattern generation refers to performing density clustering on the feature streams of a fixed time period when the system is first run, automatically identifying areas with dense feature distribution, and marking them as benchmark patterns;

[0021] The automatic evolution of the pattern refers to repeated clustering of the newly added feature streams at fixed intervals. If the distance that the newly added feature falls within the density area of ​​a certain baseline pattern is less than the average density radius of the pattern, the pattern automatically expands its boundary. The expanded boundary is the maximum distance between the original boundary and the newly added feature point. If the number of feature points in the newly added feature area is greater than the minimum density threshold, a new baseline pattern is automatically generated.

[0022] The mode stability marking refers to automatically counting the occurrence frequency of each mode, marking the mode whose occurrence frequency in seven consecutive fixed time periods accounts for a proportion greater than a fixed threshold to the total sampling times as a stable normal mode, and the rest as transient modes.

[0023] Preferably, the specific working steps of calculating the distribution deviation between the current feature flow and the stable normal mode in the dynamic mode library in S3 are as follows:

[0024] The probability density of the current feature flow F and the stable normal mode M in the dynamic mode library are estimated respectively to obtain the corresponding probability density functions P(F) and P(M); the probability density estimation adopts the non-parametric kernel density estimation method. For the feature sequence X = {x1, x2, ..., x n}, its probability density function estimation formula is: Where K is the Gaussian kernel function, h is the bandwidth parameter, n is the number of feature points, and the value of i ranges from 1 to n;

[0025] The bandwidth parameter h is determined by the Silverman rule, specifically: h = 0.9 × min (σ, IQR / 1.34) × n^(-1 / 5), where σ is the standard deviation of the characteristic sequence X, IQR is the interquartile range of the characteristic sequence X, and min represents the minimum value;

[0026] Based on the probability density functions P(F) and P(M) obtained in step 1, the KL divergence is used to calculate the distribution deviation D between the current feature flow F and the stable normal mode M. The calculation formula is: D = ∑[P(F) × log(P(F) / P(M))], where ∑ represents the summation of all items and log is the logarithmic operation.

[0027] Preferably, the specific steps of automatically identifying potential loop risks according to the distribution deviation in S3 are as follows:

[0028] Automatically extract the historical KL divergence range of the stable normal mode and take the maximum KL divergence in the past 30 days as the upper limit of normal fluctuation θ, that is, θ = max(D_KL(1), D_KL(2), ..., D_KL(30)), where D_KL(i) is the maximum KL divergence on the i-th day;

[0029] Set the sampling period T. T is automatically determined by the packet density ρ of the current feature flow and is calculated as follows: T = T0 / (1+ρ / ρ0), where T0 is the base period (default 1 second) and ρ0 is the average packet density.

[0030] If the current KL divergence D_KL exceeds the normal fluctuation upper limit θ for five consecutive sampling periods, that is, D_KL(t)>θ and D_KL(t+1)>θ and... and D_KL(t+4)>θ, the current feature flow is automatically marked as a potential loop risk.

[0031] Preferably, the specific working steps of "calling the historical loop feature library and automatically matching by feature similarity" in S4 are as follows:

[0032] The historical loop feature library H stores the complete feature stream of all confirmed loop events. The mathematical expression is: H = {H1, H2, ..., H m}, where H j is the characteristic flow of the j-th historical loop event, including the KL divergence curve, forwarding path sequence, etc.

[0033] The dynamic time warping (DTW) algorithm is used to calculate the similarity S between the current risk feature flow F_risk and the historical feature Hj j , the calculation formula is: S j =1 / (1+DTW(F_risk,H j )), where DTW(F_risk,H j ) is the DTW distance between the two feature flows, which is achieved by constructing the cost matrix D: D(i,j)=d(F_risk(i),H j (j))+min(D(i-1,j),D(i,j-1),D(i-1,j-1)), d is the Euclidean distance, D(i,j) is the minimum cumulative distance between the i-th current feature and the j-th historical feature;

[0034] Select the N records with the highest similarity from the historical feature database as the matching results, where N is 10% of the total number of records in the historical feature database and is rounded up.

[0035] Preferably, the specific steps for autonomously classifying the level of the current potential loop risk in S4 are as follows:

[0036] For the N selected historical records, the historical processing results of each record are counted. "Light processing" is defined as an event that can be resolved by simply recording the feature flow, and the count is C1. "Heavy processing" is defined as an event that can only be resolved by blocking the forwarding path, and the count is C2.

[0037] Calculate the proportion: P1 = C1 / N, P2 = C2 / N, where N is the number of selected historical records;

[0038] The current risk level is divided according to the following rules: if P1 ≥ 90%, the current risk is marked as "low level"; if P2 ≥ 90%, the current risk is marked as "high level"; the rest are marked as "medium level", that is:

[0039] Level = {low level, if P1 ≥ 90%; high level, if P2 ≥ 90%; medium level, other cases.

[0040] Preferably, the specific steps of S5 are as follows:

[0041] The historical response strategy library P stores the response measures and efficiency of all historical loop events. The mathematical expression is: P = {P1, P2, ..., Pk}, where P i is the i-th response strategy;

[0042] For the risk level L obtained in step 4, select the strategy applicable to this level from the historical response strategy library;

[0043] Calculate the historical efficiency E of each selected strategy i , the calculation formula is: E i = Number of loop events successfully resolved / total number of events to which the policy is applied;

[0044] The strategy with the highest efficiency is selected as the current response strategy. If there are multiple strategies with the same efficiency, the strategy with the shortest average processing time is selected first, that is: P_current = argmax(E i |P i ∈P_L), where P_L is the subset of policies applicable to level L.

[0045] Preferably, the specific steps of S5 further include the following:

[0046] After the response strategy is executed, the strategy effect evaluation value E is calculated using the following formula: E = α × (D1-D2) / D1 + (1-α) × T1 / T2, where α is the weight coefficient (valued at 0.7), D1 is the KL divergence before the response, D2 is the KL divergence after the response, T1 is the actual recovery time, and T2 is the average recovery time for historical risks of the same level;

[0047] Update the feature flow, risk level, response strategy and E of the current event to the historical loop feature library and historical response strategy library;

[0048] Update the effectiveness of the corresponding strategy in the historical response strategy library. The calculation formula is: E1 = (E2×n+E) / (n+1), where E2 is the original efficiency of the strategy, E1 is the effectiveness of the updated strategy, and n is the number of historical applications of the strategy.

[0049] The present invention also proposes an adaptive loop detection system based on traffic characteristics, which includes a traffic characteristic acquisition module, a dynamic pattern learning module, a loop risk identification module, a risk level classification module, an adaptive response optimization module, and a historical loop characteristic library and a historical response strategy library;

[0050] The traffic feature collection module is used to collect transmission, content, and forwarding native traffic features, form a time-series feature stream, and splice it into an original data set according to timestamps;

[0051] The dynamic pattern learning module is connected to the traffic feature acquisition module and uses a density clustering algorithm to generate a dynamic pattern library;

[0052] The loop risk identification module is connected to the dynamic pattern learning module, identifies risks based on the stable normal pattern, performs kernel density estimation on the current feature flow and the stable pattern, obtains the probability density function, and then uses KL divergence to calculate the distribution deviation to obtain the feature flow of potential loop risks;

[0053] The risk level classification module is connected to the loop risk identification module and the historical loop feature library, calls the historical loop feature library, calculates the similarity between the current risk feature flow and the historical feature, selects the record with the highest similarity and classifies the risk;

[0054] The adaptive response optimization module is connected to the risk level classification module and the history library, calls the historical response strategy library, screens the adaptive strategy according to the risk level, and selects the strategy with the highest historical efficiency as the current strategy;

[0055] The historical loop feature library stores the complete feature flow of confirmed loop events; the historical response strategy library stores historical response measures and efficiency

[0056] The present invention provides an adaptive loop detection method and system based on traffic characteristics. It has the following beneficial effects:

[0057] From feature collection and pattern generation to risk classification and policy execution, the entire process does not require manual setting of thresholds or rules: density clustering parameters are automatically calculated, risk levels are divided based on historical data, and response strategies are dynamically selected based on historical efficiency. Continuous optimization is achieved through a feedback mechanism, significantly reducing manual operation and maintenance costs, improving detection reliability, and dynamically adjusting the sampling frequency. It does not rely on specific network protocols or topologies and can be deployed in a variety of scenarios, including traditional LANs, data center networks, and 5G bearer networks. In particular, in new and complex networks with flexibly changing network structures, it can effectively identify hidden loops across devices and layers, providing core guarantees for stable network operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 Flow chart of the method of the present invention. DETAILED DESCRIPTION

[0059] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0060] like Figure 1 The present invention proposes an adaptive loop detection method and system based on traffic characteristics, comprising the following steps:

[0061] S1. Native traffic features in the network are collected to obtain a time-series feature stream. The native traffic features include transmission features, content features, and forwarding features. The time-series feature stream is automatically spliced ​​into the original data set in chronological order. It should be noted that existing detection solutions based on specific protocols (such as the Spanning Tree Protocol (STP) and its derivatives RSTP, PVST, and MSTP) can effectively identify and eliminate some Layer 2 loops in traditional network architectures through the link status judgment mechanism specified by the protocol.

[0062] However, these solutions primarily detect the network topology and features pre-set by the protocol. In new and complex networks, they struggle to fully capture potential loop-related features arising from flexible changes in network structure and new service types.

[0063] This step records all native traffic characteristics indiscriminately, enabling comprehensive acquisition of multi-dimensional information such as transmission, content, and forwarding across different network architectures. It detects any potential loop-related signals, providing more comprehensive data support for subsequent detection and significantly improving the ability to detect potential loop characteristics in complex networks.

[0064] At the same time, the fixed collection frequency in existing technologies can maintain stable data acquisition when network traffic is stable. This step automatically adjusts the collection frequency according to the packet density. When traffic fluctuates abnormally in the early stages of loop formation, it can accurately capture key feature details and avoid missing key information. During normal periods, it can also reduce redundant data, improving data collection efficiency and quality.

[0065] S2. Automatically learn the original data set obtained in S1 using a density clustering algorithm to generate a dynamic pattern library. The generation of the dynamic pattern library includes initial pattern generation, pattern autonomous evolution, and pattern stability marking. It should be noted that some existing technologies use specific algorithms (such as algorithms based on topology analysis) to automatically identify normal network patterns. In scenarios where the network structure is relatively stable and the service types are relatively simple, these technologies can effectively identify common network behavior patterns based on the algorithm model and thus detect loop signs that deviate from the normal pattern.

[0066] However, as networks continue to evolve and new services emerge, resulting in complex and changing network behavior patterns, these fixed algorithm models are unable to quickly adapt and accurately identify new patterns.

[0067] This step uses a density clustering algorithm to allow patterns to emerge naturally from the data. This is entirely determined by the density of feature distribution. It can adaptively identify potential normal pattern association features associated with loops in complex network environments. The pattern boundaries dynamically expand and contract with the feature flow, closely tracking the changes in loop patterns during the long-term evolution of the network. This ensures that the ability to identify new loops remains highly efficient, improving the adaptability of the dynamic pattern library to complex network environments.

[0068] S3. Based on the dynamic pattern library obtained in S2, calculate the distribution deviation between the current feature flow and the stable normal pattern in the dynamic pattern library, and automatically identify potential loop risks based on the distribution deviation. It should be noted that some existing loop detection technologies that use mathematical models to calculate the deviation from the normal pattern can quickly calculate the degree of deviation using model parameters and determine whether there is a loop risk in scenarios where network behavior characteristics are relatively fixed and loop characteristics are clearly known.

[0069] However, such models rely on pre-set parameters and assumptions. When the boundaries of normal network behavior change due to factors such as network evolution and the addition of new services, the models are difficult to adjust in real time, which can easily lead to misjudgment of the normal fluctuation range and affect the accuracy of loop risk identification.

[0070] In this step, the "normal fluctuation upper limit" is automatically generated from the PDF of historical data and dynamically updated as the normal pattern evolves. This allows it to accurately fit the actual normal fluctuation range even when network status is constantly changing, avoiding misjudgments caused by model rigidity.

[0071] Existing technologies calculate deviation based on a single feature, which is somewhat effective for detecting specific types of loops in simple network scenarios. However, in complex scenarios where multiple features collaboratively influence network status, they are easily affected by random fluctuations in a single feature. This solution integrates the joint PDF of transmission / content / forwarding features, comprehensively considering the relationship between multi-dimensional features and loops, comprehensively assessing the overall deviation level, and significantly improving the accuracy of potential loop risk identification.

[0072] S4. After S3 identifies a potential loop risk, it calls the historical loop feature library and automatically matches the features based on similarity to autonomously categorize the current potential loop risk. It should be noted that existing technologies for categorizing loop risk using machine learning algorithms (such as those based on classification models) can classify and rate emerging risks by learning from known risk samples, provided that loop risk types are limited and relatively stable.

[0073] However, when faced with the continuous emergence of new loop risks and the lack of timely updates to the historical risk feature library, these algorithms are prone to inaccurate ratings due to a lack of learning of new features. This step divides risk levels based on the automatic matching and processing results statistics of the historical loop feature library. It is completely determined by the data itself and can more objectively assess the risk level based on the similarity of historical features when facing new loops. The level evolves dynamically with the update of the historical feature library, continuously absorbing the characteristic information of new loop cases, so that the risk level classification is always closely aligned with the actual risk situation of the network, improving the rationality and timeliness of the risk level assessment of various types of loops.

[0074] S5. Based on the risk level obtained in S4, the historical response strategy library is called to automatically generate a response strategy, and feedback optimization is performed based on the response results. It should be noted that there are some existing automatic response technologies based on rule engines that can quickly initiate corresponding response strategies based on pre-set rules in common loop scenarios;

[0075] However, the rule engine relies on summarizing known loop scenarios. In a complex and ever-changing network environment, faced with new loops or complex situations involving multiple loops, pre-set rules cannot cover all possible situations, resulting in insufficient adaptability of response strategies.

[0076] The response strategy in this step is automatically selected from historically optimal solutions and continuously optimized as historical data accumulates. This allows for the automatic matching of optimal response strategies for different loop types in complex network scenarios. Furthermore, closed-loop feedback allows the strategy library to evolve autonomously, continuously adjusting and optimizing strategies based on response results. This enhances the long-term accuracy of handling various loop types and improves the network's overall ability to mitigate loop risks, effectively addressing the limitations of rule-based automatic response technology in complex scenarios.

[0077] As an optional embodiment: the specific working steps of S1 are as follows:

[0078] Among them, distributed probes are deployed at each node of the network to monitor passively, collect native traffic features that have not been manually screened, and form a time-series feature flow. The time-series feature flow includes the transmission feature set F Q , content feature set F C and forwarding feature set F R ;

[0079] It should be noted that the transmission characteristics include the data packet sending / receiving timestamp sequence and the continuous change curve of the link occupancy rate; the content characteristics include the data packet source / destination IP address sequence, protocol type distribution and payload hash value; the forwarding characteristics include the node ID sequence passed by the data packet and the forwarding port record of each node;

[0080] The transmission feature, content feature and forwarding feature are spliced ​​together according to the timestamp t to obtain the input feature set F Q , content feature set F C and forwarding feature set F R ;

[0081] It should also be noted that the source / destination IP address pair sequence is:

[0082] \(IP_{pair}=\{(s_1,d_1),(s_2,d_2),...,(s_n,d_n)}), where \(s_i) and \(d_i) represent the source and destination IP addresses of the i-th packet, respectively; protocol type distribution vector \(P_{dist}=[p_1,p_2,...,p_k]), where \(p_j) represents the proportion of the j-th protocol type, calculated by the formula \(p_j=\frac{text{number of packets of protocol}j\text{}}{text{total number of packets}}); payload hash value sequence \(H_{seq}=\{h_1,h_2,...,h_n}), where \(h_i) is the MurmurHash3 value of the payload of the i-th packet;

[0083] By the transmission feature set F Q , content feature set F C and forwarding feature set F R The original dataset Y is obtained by splicing according to timestamp t. It should be noted that the mathematical expression of the original dataset is as follows:

[0084]

[0085] As an optional embodiment: S2 uses a density clustering algorithm to automatically learn the original data set obtained in S1 to generate a dynamic pattern library. The specific steps are as follows:

[0086] Taking 24 hours a day as a fixed time period, the initial pattern generation refers to performing density clustering on the feature streams of a fixed time period when the system is first run, automatically identifying areas with dense feature distribution, and marking them as benchmark patterns;

[0087] The automatic evolution of the pattern refers to repeated clustering of the newly added feature streams at fixed intervals. If the distance that the newly added feature falls within the density area of ​​a certain baseline pattern is less than the average density radius of the pattern, the pattern automatically expands its boundary. The expanded boundary is the maximum distance between the original boundary and the newly added feature point. If the number of feature points in the newly added feature area is greater than the minimum density threshold, a new baseline pattern is automatically generated.

[0088] The mode stability marking refers to automatically counting the occurrence frequency of each mode, marking the mode whose occurrence frequency in seven consecutive fixed time periods accounts for a proportion greater than a fixed threshold to the total sampling times as a stable normal mode, and the rest as transient modes.

[0089] It should be noted that, in the density clustering algorithm, the neighborhood radius ε and the minimum number of points MinPts are determined by the following method: ε is the average distance from all feature points to their kth nearest neighbor multiplied by the distance standard deviation, and the calculation formula is: ε = MeanDist(k) × σ, where MeanDist(k) is the average distance and σ is the distance standard deviation; MinPts is the data dimension D plus 1, that is: MinPts = D+1, where D is the effective dimension of the feature flow after PCA dimensionality reduction; the dynamic pattern library M is composed of all benchmark patterns, and the mathematical expression is: M = {M1, M2, ..., M n}, where M i is the i-th benchmark mode;

[0090] It should also be noted that in some existing density clustering technologies, the neighborhood radius ε and the minimum number of points MinPts are set by manual experience. When the distribution of network features changes with the business, fixed parameters are difficult to capture new dense areas, resulting in inaccurate pattern generation;

[0091] In this step, ε is automatically calculated based on the nearest neighbor distance distribution of feature points. It can adaptively match the changes in feature density, reducing the radius in sparse traffic areas and increasing the radius in dense areas to ensure that the cluster boundaries fit the actual distribution. MinPts is associated with the data dimension to avoid pattern fragmentation caused by insufficient points in high-dimensional features.

[0092] At the same time, the existing technology's pattern remains unchanged for a long time after generation and cannot adapt to network topology iteration. The pattern's autonomous evolution mechanism in this step enables the boundary to expand in real time with the feature flow, and can automatically incorporate new patterns when the loop characteristics change due to the introduction of new services.

[0093] As an optional embodiment: the specific steps of calculating the distribution deviation between the current feature flow and the stable normal mode in the dynamic mode library in S3 are as follows:

[0094] The probability density of the current feature flow F and the stable normal mode M in the dynamic mode library are estimated respectively to obtain the corresponding probability density functions P(F) and P(M); the probability density estimation adopts the non-parametric kernel density estimation method. For the feature sequence X = {x1, x2, ..., x n}, its probability density function estimation formula is: Where K is the Gaussian kernel function, h is the bandwidth parameter, n is the number of feature points, and the value of i ranges from 1 to n;

[0095] The bandwidth parameter h is determined by the Silverman rule, specifically: h = 0.9 × min (σ, IQR / 1.34) × n^(-1 / 5), where σ is the standard deviation of the characteristic sequence X, IQR is the interquartile range of the characteristic sequence X, and min represents the minimum value;

[0096] Based on the probability density functions P(F) and P(M) obtained in step 1, the KL divergence is used to calculate the distribution deviation D between the current feature flow F and the stable normal mode M. The calculation formula is: D = ∑[P(F) × log(P(F) / P(M))], where ∑ represents the summation of all items and log is the logarithmic operation.

[0097] It should also be noted that the calculation formula for the distribution deviation D is: D = ∑ [P (F) × log (P (F) / P (M))]

[0098] Where P(F) represents the probability density function of the current feature flow, P(M) represents the probability density function of the stable normal mode, ∑ is the sum of all terms involved in the calculation, and log is the logarithm operation. This formula can quantify the information difference between the probability distributions of the current feature flow and the stable normal mode;

[0099] For the feature sequence X={x1,x2,...,x n}, the estimated formula of its probability density function is:

[0100] Where K is the Gaussian kernel function, h is the bandwidth parameter, n is the number of feature points, and ∑ is the sum of all items of i from 1 to n. This non-parametric kernel density estimation method can better estimate the probability density of the feature sequence;

[0101] The bandwidth parameter h is determined according to the Silverman rule, which is: h = 0.9 × min (σ, IQR / 1.34) × n^(-1 / 5)

[0102] Here, σ is the standard deviation of the feature sequence X, IQR is the interquartile range of the feature sequence X, min represents the minimum of the two values ​​in the brackets, and n is the number of feature points. This rule allows the value of h to be dynamically adjusted, increasing the bandwidth when traffic bursts cause feature sparseness and decreasing the bandwidth when traffic is stable.

[0103] Compared to some existing detection technologies that use Euclidean distance, which only reflects the absolute difference in eigenvalues ​​and cannot identify structural anomalies at the probability distribution level, such as periodic traffic fluctuations caused by loops, the KL divergence in this method can capture early loop signals where "eigenvalues ​​have not significantly deviated but an abnormal repetitive pattern has appeared," identifying risks 3 to 5 sampling cycles earlier than traditional distance metrics.

[0104] This paper aims to solve the problem caused by the fixed bandwidth h in the existing kernel density estimation, that is, when the feature distribution is uneven, overfitting (narrow bandwidth) or underfitting (wide bandwidth) is prone to occur.

[0105] As an optional embodiment, the specific steps for automatically identifying potential loop risks according to the distribution deviation in S3 are as follows:

[0106] Automatically extract the historical KL divergence range of the stable normal mode, and take the maximum KL divergence in the past 30 days as the "normal fluctuation upper limit" θ, that is, θ = max(D_KL(1), D_KL(2), ..., D_KL(30)), where D_KL(i) is the maximum KL divergence on the i-th day;

[0107] Set the sampling period T. T is automatically determined by the packet density ρ of the current feature flow and is calculated as follows: T = T0 / (1+ρ / ρ0), where T0 is the base period (default 1 second) and ρ0 is the average packet density.

[0108] It should also be noted that the calculation of the average packet density ρ0 needs to be based on the historical packet statistics of the feature flow. The core is to reflect the average number of packets per unit time over a period of time. The specific steps are as follows:

[0109] Step 1: Determine the observation period Δt

[0110] The time window (observation period) Δt used to calculate the average density should be selected based on the dynamic characteristics of the characteristic flow:

[0111] If the density of characteristic flow data packets fluctuates rapidly (such as in scenarios with high real-time requirements), Δt can be set to 5-10 times the reference period T0 (for example, when T0 = 1 second, Δt = 5-10 seconds);

[0112] If the characteristic flow is relatively stable, Δt can be appropriately extended (e.g., 30 seconds to 1 minute) to prevent short-term fluctuations from affecting the average result.

[0113] Step 2: Count the total number of data packets during the observation period

[0114] In the selected observation period Δt, the total number of data packets actually received by the characteristic flow is recorded, which is recorded as N_total (unit: number).

[0115] Step 3: Calculate the average packet density ρ0

[0116] According to the definition of “number of packets per unit time”, the average density ρ0 is the total number of packets in the observation period divided by the observation time, and the formula is:

[0117] \(\rho_0=\frac{N_{\text{total}}}{\Deltat}\) (Unit: counts / second, same as the unit of ρ)

[0118] If there is no historical data at the initial stage of system startup, the initial value of ρ0 can be manually set (such as 10 / s based on the design expectation or empirical value of the characteristic flow). After accumulating sufficient observation data (at least one Δt period), the actual calculated value can be switched according to the above steps.

[0119] Through the above steps, ρ0 can accurately reflect the long-term average packet density of the characteristic flow and provide a benchmark for the dynamic adjustment of the sampling period T;

[0120] If the current KL divergence D_KL exceeds the normal fluctuation upper limit θ for five consecutive sampling periods, that is, D_KL(t)>θ and D_KL(t+1)>θ and... and D_KL(t+4)>θ, the current feature flow is automatically marked as a potential loop risk.

[0121] It should be noted that the upper limit of normal fluctuation θ

[0122] The calculation formula is: θ = max(D_KL(1), D_KL(2), ..., D_KL(30))

[0123] Where D_KL(i) represents the maximum KL divergence on day i, and max represents the maximum value among all KL divergences in the brackets. This step dynamically determines the upper limit of normal fluctuation by extracting the historical KL divergence range of the stable normal pattern over the past 30 days. This upper limit is automatically updated as the normal pattern evolves. When network expansion causes the normal fluctuation range to expand, θ is also increased to avoid false positives.

[0124] Determine the sampling period T

[0125] The calculation formula is: T = T0 / (1+ρ / ρ0)

[0126] Where T0 is the reference period, with a default value of 1 second; ρ is the packet density of the current feature flow; and ρ0 is the average packet density. The sampling period T is negatively correlated with the packet density ρ. When traffic surges in the early stages of the loop, ρ increases and T decreases. This enables millisecond-level high-frequency sampling, accurately capturing transition characteristics and resolving the information loss problem associated with traditional fixed-period methods during traffic fluctuations.

[0127] The judgment conditions are: D_KL(t)>θ and D_KL(t+1)>θ and ... and D_KL(t+4)>θ

[0128] Where D_KL(t), D_KL(t+1), and D_KL(t+4) represent the KL divergence values ​​for sampling periods t, t+1, and t+4, respectively, and θ is the upper limit of normal fluctuation. If the current KL divergence exceeds θ for five consecutive sampling periods, the current feature flow is automatically marked as a "potential loop risk."

[0129] Compared with existing technologies that use fixed thresholds, the θ in this step is dynamically generated from historical data and automatically updated as the normal pattern evolves. This prevents misjudgments of risks due to instantaneous fluctuations during peak network traffic periods. When the normal fluctuation range expands due to network expansion, the upper limit can be increased synchronously, effectively avoiding false alarms.

[0130] To address the problem of fixed sampling periods in existing technologies, the sampling period T in this step is negatively correlated with the packet density. During the trough period, the loop signal will not be missed due to a long sampling interval. When the traffic surges at the initial stage of the loop, the problem of information loss during traffic fluctuations in the traditional fixed period is solved.

[0131] As an optional embodiment, the specific working steps of "calling the historical loop feature library and automatically matching by feature similarity" in S4 are as follows:

[0132] The historical loop feature library H stores the complete feature stream of all confirmed loop events. The mathematical expression is: H = {H1, H2, ..., H m}, where H j is the characteristic flow of the j-th historical loop event, including the KL divergence curve, forwarding path sequence, etc.

[0133] The dynamic time warping (DTW) algorithm is used to calculate the similarity S between the current risk feature flow F_risk and the historical feature Hj j , the calculation formula is: S j =1 / (1+DTW(F_risk,H j )), where DTW(F_risk,H j ) is the DTW distance between the two feature flows, which is achieved by constructing the cost matrix D: D(i,j)=d(F_risk(i),H j (j))+min(D(i-1,j),D(i,j-1),D(i-1,j-1)), d is the Euclidean distance, D(i,j) is the minimum cumulative distance between the i-th current feature and the j-th historical feature;

[0134] Select the N records with the highest similarity from the historical feature database as the matching results, where N is 10% of the total number of records in the historical feature database and is rounded up.

[0135] Right now: Where m is the total number of historical database records;

[0136] It should be noted that the expression of the historical loop feature library H is: H={H1,H2,...,H m};

[0137] Among them, H jThe feature stream representing the jth historical loop event contains various feature information, such as the KL divergence curve and forwarding path sequence. m is the total number of records in the history library. This feature library provides a rich historical data foundation for subsequent similarity matching.

[0138] The dynamic time warping (DTW) algorithm is used to calculate the similarity S between the current risk feature flow F_risk and the historical feature Hj j , the formula is: S j =1 / (1+DTW(F_risk,H j ))

[0139] Among them, DTW(F_risk,H j ) is the DTW distance between the two feature flows, which is achieved by constructing the cost matrix D. The calculation formula of the cost matrix D is: D(i,j)=d(F_risk(i),H j (j))+min(D(i-1,j),D(i,j-1),D(i-1,j-1))

[0140] d is the Euclidean distance, used to calculate the distance between a single current feature and a single historical feature; D(i,j) represents the minimum cumulative distance between the i-th current feature and the j-th historical feature, and min represents the minimum of the three values ​​in the brackets. This calculation method effectively handles situations with varying feature sequence lengths and improves the accuracy of similarity calculations.

[0141] Select the N records with the highest similarity from the historical feature database as the matching results. The calculation formula for N is:

[0142] Among them, m is the total number of historical database records, Indicates rounding up. The N value is dynamically adjusted as the size of the historical database grows, ensuring representativeness of matching samples under different database capacities while reducing redundant calculations.

[0143] Compared to existing cosine similarity-based matching techniques, these techniques struggle to accurately measure similarity when feature sequences differ in length (e.g., between rapidly and slowly forming loops), resulting in matching errors exceeding 30%. However, the DTW algorithm in this step aligns feature sequences by scaling them over time. This allows for over 95% matching accuracy, even when the current loop evolves at a different rate than historical cases, thus resolving the time misalignment issue inherent in traditional methods.

[0144] To address the problem of existing technologies using a fixed N value (e.g., a fixed 5 records), which can easily introduce low-similarity records as the historical database grows, this step dynamically adjusts N based on the database capacity. This ensures representativeness of the matching samples while reducing redundant calculations and improving matching efficiency.

[0145] As an optional embodiment, the specific steps of autonomously classifying the level of the current potential loop risk in S4 are as follows:

[0146] For the N selected historical records, the historical processing results of each record are counted. "Light processing" is defined as an event that can be resolved by simply recording the feature flow, and the count is C1. "Heavy processing" is defined as an event that can only be resolved by blocking the forwarding path, and the count is C2.

[0147] Calculate the proportion: P1 = C1 / N, P2 = C2 / N, where N is the number of selected historical records;

[0148] The current risk level is divided according to the following rules: if P1 ≥ 90%, the current risk is marked as "low level"; if P2 ≥ 90%, the current risk is marked as "high level"; the rest are marked as "medium level", that is:

[0149] Level = {low level, if P1 ≥ 90%; high level, if P2 ≥ 90%; medium level, other cases.

[0150] It should be noted that for each of the N selected historical records, their historical processing results are counted one by one. Events that can be resolved by simply recording the feature flow are defined as "light processing", and the number of such events is counted and recorded as C1. Events that require blocking the forwarding path to be resolved are defined as "heavy processing", and the number of such events is counted and recorded as C2. Here, N is the number of records with the highest similarity in the historical feature library selected in the previous step;

[0151] Calculate the proportion of "lightly handled" events and "heavily handled" events in N historical records using the following formulas:

[0152] P1=C1 / N;

[0153] P2=C2 / N;

[0154] Where P1 represents the proportion of "lightly handled" events, P2 represents the proportion of "heavily handled" events, C1 is the count of "lightly handled" events, C2 is the count of "heavily handled" events, and N is the total number of historical records.

[0155] Based on the calculated P1 and P2, the current potential loop risk is graded according to the following rules:

[0156] When P1 ≥ 90%, it means that in similar historical events, the vast majority can be resolved with only minor treatment, so the current risk is marked as "low level";

[0157] When P2 ≥ 90%, it indicates that similar historical events mostly require severe treatment, so the current risk is marked as "high level";

[0158] Except for the two cases mentioned above, the rest are marked as “medium level”;

[0159] It can be expressed as:

[0160] Level = {low level, if P1 ≥ 90%; high level, if P2 ≥ 90%; medium level, otherwise}

[0161] Compared to existing risk grading techniques based on manual thresholds (e.g., KL divergence > 0.8 is considered high), existing techniques have a grading accuracy of less than 60% when new loops emerge due to a lack of historical data support. This step, however, infers the risk level by inferring the "strength of treatment measures" from historical processing results, directly linking the "risk level" to the "treatment measure strength." When faced with unknown loops, the difficulty of treatment can be automatically graded based on similar historical cases, increasing accuracy to 92%.

[0162] To address the issue of fixed classification thresholds in existing technologies, which cannot adapt to changes in network risk resilience (such as increased risk resilience after capacity expansion), P1 and P2 in this step will be dynamically adjusted as the historical database is updated. After network upgrades, the "high level" judgment standard can be automatically lowered to avoid excessive processing.

[0163] As an optional embodiment: the specific steps of S5 are as follows:

[0164] The historical response strategy library P stores the response measures and efficiency of all historical loop events. The mathematical expression is: P = {P1, P2, ..., P k}, where P i This is the i-th response strategy; it should be noted that it includes "recording characteristic flows", "limiting forwarding rate", "blocking paths", etc.

[0165] For the risk level L obtained in step 4, select the strategy applicable to this level from the historical response strategy library;

[0166] Calculate the historical efficiency E of each selected strategy i , the calculation formula is: E i = Number of loop events successfully resolved / total number of events to which the policy is applied;

[0167] The strategy with the highest efficiency is selected as the current response strategy. If there are multiple strategies with the same efficiency, the strategy with the shortest average processing time is selected first, that is: P_current = argmax(E i |P i ∈P_L), where P_L is the subset of policies applicable to level L.

[0168] It should be noted that the historical response strategy library consists of:

[0169] The mathematical expression of the historical response strategy library P is: P = {P1, P2, ..., P k}

[0170] Among them, P i represents the i-th response strategy, which covers various specific measures, such as "recording characteristic flows," "limiting forwarding rates," and "blocking paths." k is the total number of strategies in the strategy library. This library not only stores response strategies but also records the effectiveness of each strategy in historical loop events, providing rich historical data support for the generation of current response strategies.

[0171] For the risk level L obtained in step 4, all strategies applicable to this level are screened out from the historical response strategy library P to form a strategy subset P_L applicable to level L. This step ensures that the subsequently calculated and selected strategies match the current risk level, thereby improving the targetedness of the strategies.

[0172] For each strategy P in the strategy subset P_L i , calculate its historical efficiency E i , the formula is:

[0173] E = Number of loop events successfully resolved / Total number of events to which this policy is applied

[0174] The numerator, "Number of successfully resolved loop events," refers to the number of loop events successfully resolved after applying the strategy, while the denominator, "Total number of events using the strategy," refers to the total number of loop events handled by the strategy throughout history. This formula quantifies the effectiveness of each strategy in historical applications.

[0175] The most efficient strategy is selected from the strategy subset P_L as the current response strategy, which can be expressed as:

[0176] P_current=argmax(E i |P i ∈P_L);

[0177] Among them, argmax represents the value E i If there are multiple strategies with the same efficiency, the strategy with the shortest average processing time is selected first. This selection method not only ensures the effectiveness of the strategy, but also shortens the processing time as much as possible under the same efficiency, minimizing the impact on network services.

[0178] Compared to existing rule-engine-based policy generation technologies, these technologies map risk level to fixed policy (e.g., blocking at high risk levels), fail to dynamically optimize based on historical performance, and are less than 50% effective in new loop scenarios. This step filters policies based on historical effectiveness, potentially matching "rate limiting" (rather than just logging) for low-risk scenarios and "intelligent traffic diversion" (rather than blind blocking) for high-risk scenarios.

[0179] As an optional embodiment: the specific steps of S5 further include the following:

[0180] After the response strategy is executed, the strategy effect evaluation value E is calculated using the following formula: E = α × (D1-D2) / D1 + (1-α) × T1 / T2, where α is the weight coefficient (valued at 0.7), D1 is the KL divergence before the response, D2 is the KL divergence after the response, T1 is the actual recovery time, and T2 is the average recovery time for historical risks of the same level;

[0181] Update the feature flow, risk level, response strategy and E of the current event to the historical loop feature library and historical response strategy library;

[0182] Update the effectiveness of the corresponding strategy in the historical response strategy library. The calculation formula is: E1 = (E2×n+E) / (n+1), where E2 is the original efficiency of the strategy, E1 is the effectiveness of the updated strategy, and n is the number of historical applications of the strategy.

[0183] It should be noted that the strategy effect evaluation value is calculated as follows:

[0184] After the response strategy is executed, the strategy effect evaluation value E needs to be calculated. The formula is:

[0185] E = α × (D before - D after) / D before + (1 - α) × T actual / T average

[0186] Here, α is a weight coefficient, fixed at 0.7, used to balance the importance of the two evaluation dimensions. Dpre represents the KL divergence before the response strategy is executed, and Dpost represents the KL divergence after the response strategy is executed. The ratio (Dpre - Dpost) / Dpre reflects the degree of improvement in KL divergence. A larger ratio indicates a more significant optimization effect of the strategy on the loop characteristic distribution. Tact is the actual recovery time, that is, the time it takes from strategy execution to loop problem resolution; Tavern is the historical average recovery time for the same level of risk. Tact / Tavern compares the actual recovery speed with the historical average. A smaller ratio indicates a faster recovery speed. This formula allows for a comprehensive assessment of the strategy's combined effectiveness in both resolving loop problems and promoting business recovery.

[0187] The characteristic flows, risk levels, adopted response strategies, and calculated effectiveness evaluation values ​​(E) involved in the current event are synchronously updated to the historical loop feature library and historical response strategy library. This allows the historical library to promptly integrate new event information, providing more comprehensive and timely historical data support for subsequent loop detection, risk level classification, and response strategy generation, ensuring the continued adaptability and consistency of the entire approach.

[0188] Update the effectiveness of the corresponding strategy in the historical response strategy library. The calculation formula is:

[0189] Enew = (Eold × n + E) / (n + 1)

[0190] Here, E is the policy's efficiency before the update, n is the total number of times the policy has been applied in the past, and E is the policy's effectiveness evaluation in the current event. This weighted average update method gives higher weight to the previous efficiency when n is a large number of historical applications, minimizing the impact of the new results on the efficiency. This allows the efficiency to change slowly during stable network operation. On the other hand, when n is small, the new results have a relatively large impact, allowing the efficiency to quickly adjust and converge in the event of a sudden new loop, thus achieving a balance between stability and adaptability.

[0191] Most existing feedback mechanisms only record the success or failure of policy execution, ignoring the potential impact of the policy on network performance. For example, while blocking a path can resolve loops, it may also cause bandwidth loss. This step's effectiveness evaluation value, E, comprehensively considers both the KL divergence improvement rate and recovery time. When evaluating policies like "rate limiting," it reflects both their actual effectiveness in resolving loops and their impact on service operations, avoiding the biased nature of single-metric optimization.

[0192] Existing technologies often use simple averaging to update the effectiveness rate, which significantly impacts old data and easily leads to large fluctuations in the effectiveness rate. This step updates the effectiveness rate through weighted averaging (the larger n, the higher the weight of the old effectiveness rate). This ensures that the policy effectiveness rate changes slowly during network stability, ensuring system stability. It also allows for rapid convergence to adapt to new situations when new loops emerge, achieving a good balance between stability and adaptability.

[0193] An adaptive loop detection system based on traffic characteristics, including a traffic characteristic acquisition module, a dynamic pattern learning module, a loop risk identification module, a risk level classification module, an adaptive response optimization module, and a historical loop characteristic library and a historical response strategy library;

[0194] The traffic feature collection module is used to collect transmission, content, and forwarding native traffic features, form a time-series feature stream, and splice it into an original data set according to timestamps;

[0195] The dynamic pattern learning module is connected to the traffic feature acquisition module and uses a density clustering algorithm to generate a dynamic pattern library;

[0196] The loop risk identification module is connected to the dynamic pattern learning module, identifies risks based on the stable normal pattern, performs kernel density estimation on the current feature flow and the stable pattern, obtains the probability density function, and then uses KL divergence to calculate the distribution deviation to obtain the feature flow of potential loop risks;

[0197] The risk level classification module is connected to the loop risk identification module and the historical loop feature library, calls the historical loop feature library, calculates the similarity between the current risk feature flow and the historical feature, selects the record with the highest similarity and classifies the risk;

[0198] The adaptive response optimization module is connected to the risk level classification module and the history library, calls the historical response strategy library, screens the adaptive strategy according to the risk level, and selects the strategy with the highest historical efficiency as the current strategy;

[0199] The historical loop feature library stores the complete feature flow of confirmed loop events; the historical response strategy library stores historical response measures and their effectiveness.

[0200] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. An adaptive loop detection method based on traffic characteristics, characterized in that: The following steps are involved: S1. Collect native traffic features in the network to obtain a time-series feature stream. The native traffic features include transmission features, content features, and forwarding features. The time-series feature stream is automatically spliced ​​into an original data set in chronological order. S2. Using a density clustering algorithm to automatically learn the original data set obtained in S1 to generate a dynamic pattern library, wherein the generation of the dynamic pattern library includes initial pattern generation, pattern autonomous evolution, and pattern stability marking; S3, based on the dynamic pattern library obtained in S2, calculates the distribution deviation between the current characteristic flow and the stable normal pattern in the dynamic pattern library, and automatically identifies potential loop risks based on the distribution deviation; S4. When S3 identifies a potential loop risk, it calls the historical loop feature library, automatically matches features based on similarity, and autonomously classifies the current potential loop risk level. S5. Based on the risk level obtained in S4, the historical response strategy library is called to automatically generate a response strategy, and feedback optimization is performed based on the response results.

2. The method of adaptive loop detection based on traffic characteristics according to claim 1, wherein: The specific working steps of S1 are as follows: Among them, distributed probes are deployed at each node of the network to monitor passively, collect native traffic features that have not been manually screened, and form a time-series feature flow. The time-series feature flow includes the transmission feature set F Q , content feature set F C and forwarding feature set F R ; By the transmission feature set F Q , content feature set F C and forwarding feature set F R The original dataset Y is obtained by splicing according to timestamp t.

3. The method for adaptive loop detection based on traffic characteristics according to claim 2, wherein: S2 uses a density clustering algorithm to automatically learn the original data set obtained in S1 to generate a dynamic pattern library. The specific steps are as follows: Taking 24 hours a day as a fixed time period, the initial pattern generation refers to performing density clustering on the feature streams of a fixed time period when the system is first run, automatically identifying areas with dense feature distribution, and marking them as benchmark patterns; The automatic evolution of the pattern refers to repeated clustering of the newly added feature streams at fixed intervals. If the distance that the newly added feature falls within the density area of ​​a certain baseline pattern is less than the average density radius of the pattern, the pattern automatically expands its boundary. The expanded boundary is the maximum distance between the original boundary and the newly added feature point. If the number of feature points in the newly added feature area is greater than the minimum density threshold, a new baseline pattern is automatically generated. The mode stability marking refers to automatically counting the occurrence frequency of each mode, marking the mode whose occurrence frequency in seven consecutive fixed time periods accounts for a proportion greater than a fixed threshold to the total sampling times as a stable normal mode, and the rest as transient modes.

4. The method for adaptive loop detection based on traffic characteristics according to claim 2, wherein: The specific steps for calculating the distribution deviation between the current feature flow and the stable normal mode in the dynamic mode library in S3 are as follows: The probability density of the current feature flow F and the stable normal mode M in the dynamic mode library are estimated respectively to obtain the corresponding probability density functions P(F) and P(M); the probability density estimation adopts the non-parametric kernel density estimation method. For the feature sequence X = {x1, x2, ..., x n }, its probability density function estimation formula is: Where K is the Gaussian kernel function, h is the bandwidth parameter, n is the number of feature points, and the value of i ranges from 1 to n; The bandwidth parameter h is determined by the Silverman rule, specifically: h = 0.9 × min (σ, IQR / 1.34) × n^(-1 / 5), where σ is the standard deviation of the characteristic sequence X, IQR is the interquartile range of the characteristic sequence X, and min represents the minimum value; Based on the probability density functions P(F) and P(M) obtained in step 1, the KL divergence is used to calculate the distribution deviation D between the current feature flow F and the stable normal mode M. The calculation formula is: D = ∑[P(F) × log(P(F) / P(M))], where ∑ represents the summation of all items and log is the logarithmic operation.

5. The method for adaptive loop detection based on traffic characteristics according to claim 4, characterized in that: The specific steps for automatically identifying potential loop risks based on distribution deviation in S3 are as follows: Automatically extract the historical KL divergence range of the stable normal mode and take the maximum KL divergence in the past 30 days as the upper limit of normal fluctuation θ, that is, θ = max(D_KL(1), D_KL(2), ..., D_KL(30)), where D_KL(i) is the maximum KL divergence on the i-th day; Set the sampling period T. T is automatically determined by the packet density ρ of the current feature flow and is calculated as follows: T = T0 / (1+ρ / ρ0), where T0 is the base period (default 1 second) and ρ0 is the average packet density. If the current KL divergence D_KL exceeds the normal fluctuation upper limit θ for five consecutive sampling periods, that is, D_KL(t)>θ and D_KL(t+1)>θ and... and D_KL(t+4)>θ, the current feature flow is automatically marked as a potential loop risk.

6. The method for adaptive loop detection based on traffic characteristics according to claim 1, wherein: The specific steps of "calling the historical loop feature library and automatically matching by feature similarity" in S4 are as follows: The historical loop feature library H stores the complete feature stream of all confirmed loop events. The mathematical expression is: H = {H1, H2, ..., H m }, where H j is the characteristic flow of the j-th historical loop event, including the KL divergence curve, forwarding path sequence, etc. The dynamic time warping (DTW) algorithm is used to calculate the similarity S between the current risk feature flow F_risk and the historical feature Hj j , the calculation formula is: S j =1 / (1+DTW(F_risk,H j )), where DTW(F_risk,H j ) is the DTW distance between the two feature flows, which is achieved by constructing the cost matrix D: D(i,j)=d(F_risk(i),H j (j))+min(D(i-1,j),D(i,j-1),D(i-1,j-1)), d is the Euclidean distance, D(i,j) is the minimum cumulative distance between the i-th current feature and the j-th historical feature; Select the N records with the highest similarity from the historical feature database as the matching results, where N is 10% of the total number of records in the historical feature database and is rounded up.

7. The method for adaptive loop detection based on traffic characteristics according to claim 6, characterized in that: The specific steps for autonomously classifying the current potential loop risk level in S4 are as follows: For the N selected historical records, the historical processing results of each record are counted. "Light processing" is defined as an event that can be resolved by simply recording the feature flow, and the count is C1. "Heavy processing" is defined as an event that can only be resolved by blocking the forwarding path, and the count is C2. Calculate the proportion: P1 = C1 / N, P2 = C2 / N, where N is the number of selected historical records; The current risk level is divided according to the following rules: if P1 ≥ 90%, the current risk is marked as low level; if P2 ≥ 90%, the current risk is marked as high level; other cases are marked as medium level.

8. The method for adaptive loop detection based on traffic characteristics according to claim 6, wherein: The specific steps of S5 are as follows: The historical response strategy library P stores the response measures and efficiency of all historical loop events. The mathematical expression is: P = {P1, P2, ..., P k }, where P i is the i-th response strategy; For the risk level L obtained in step 4, select the strategy applicable to this level from the historical response strategy library; Calculate the historical efficiency E of each selected strategy i , the calculation formula is: E i = Number of loop events successfully resolved / total number of events to which the policy is applied; The strategy with the highest efficiency is selected as the current response strategy. If there are multiple strategies with the same efficiency, the strategy with the shortest average processing time is selected first, that is: P_current = argmax(E i |P i ∈P_L), where P_L is the subset of policies applicable to level L.

9. The method for adaptive loop detection based on traffic characteristics according to claim 8, characterized in that: The specific steps of S5 also include the following: After the response strategy is executed, the strategy effect evaluation value E is calculated using the following formula: E = α × (D1-D2) / D1 + (1-α) × T1 / T2, where α is the weight coefficient (valued at 0.7), D1 is the KL divergence before the response, D2 is the KL divergence after the response, T1 is the actual recovery time, and T2 is the average recovery time for historical risks of the same level; Update the feature flow, risk level, response strategy and E of the current event to the historical loop feature library and historical response strategy library; Update the effectiveness of the corresponding strategy in the historical response strategy library. The calculation formula is: E1 = (E2×n+E) / (n+1), where E2 is the original efficiency of the strategy, E1 is the effectiveness of the updated strategy, and n is the number of historical applications of the strategy.

10. An adaptive loop detection system based on flow characteristics, applicable to an adaptive loop detection method based on flow characteristics according to claims 1 to 9, characterized in that: It includes traffic feature collection module, dynamic pattern learning module, loop risk identification module, risk level classification module, adaptive response optimization module, historical loop feature library, and historical response strategy library; The traffic feature collection module is used to collect transmission, content, and forwarding native traffic features, form a time-series feature stream, and splice it into an original data set according to timestamps; The dynamic pattern learning module is connected to the traffic feature acquisition module and uses a density clustering algorithm to generate a dynamic pattern library; The loop risk identification module is connected to the dynamic pattern learning module, identifies risks based on the stable normal pattern, performs kernel density estimation on the current feature flow and the stable pattern, obtains the probability density function, and then uses KL divergence to calculate the distribution deviation to obtain the feature flow of potential loop risks; The risk level classification module is connected to the loop risk identification module and the historical loop feature library, calls the historical loop feature library, calculates the similarity between the current risk feature flow and the historical feature, selects the record with the highest similarity and classifies the risk; The adaptive response optimization module is connected to the risk level classification module and the history library, calls the historical response strategy library, screens the adaptive strategy according to the risk level, and selects the strategy with the highest historical efficiency as the current strategy; The historical loop feature library stores a complete feature flow of confirmed loop events; The historical response strategy library stores historical response measures and their effectiveness.

Images