Network traffic real-time identification method, device and equipment and storage medium

Abstract

The application discloses a network traffic real-time identification method and device, equipment and a storage medium, and relates to the field of network security. In the kernel state, the network data frame of a physical network card is called and the header information of the data frame is extracted, a structure body data is encapsulated, and is pushed to the user state through AF_XDP. A five-tuple logical flow identifier is constructed by using the obtained structure body data, a plurality of sets of behavior index features are generated by context aggregation on the header information of the data frame. The index vector is compressed and transformed by using a PCA compression mode, and a principal component vector is constructed. The principal component vector is input into a knowledge distillation MLP inference model, a risk rating is determined according to the size of the model output confidence value, and a corresponding strategy is executed. The scheme constructs a full-blind detection link based on a structure agent, and fuses multiple mechanisms such as high-speed acquisition, index modeling, semantic distillation and strategy linkage, so that high-precision full-scene discrimination is realized without relying on complete protocol analysis or high-cost hardware.

Description

Technical Field

[0001] This application relates to the field of network security, and in particular to a method, apparatus, device and storage medium for real-time identification of network traffic. Background Technology

[0002] With the rapid growth of network communication traffic and the widespread application of encryption protocols, traditional data stream identification methods relying on deep parsing are facing the dual challenges of performance bottlenecks and blind spots. Mainstream network traffic identification and filtering technologies can be broadly categorized into the following three types:

[0003] I. Software detection solutions based on Netfilter and DPI are widely used in host protection and middleware security systems. These methods rely on the Netfilter framework within the operating system kernel to capture packets and distribute policies. Through Deep Packet Inspection (DPI), they perform protocol reconstruction, field extraction, and content matching on reconstructed network packets, thereby identifying and judging application layer protocols such as HTTP, TLS, and DNS. However, this solution relies on complete data stream buffering and multi-layer protocol decoding, resulting in significant resource overhead and processing latency. Furthermore, its effectiveness drops significantly when dealing with encrypted traffic (such as TLS 1.3), making it difficult to meet the real-time protection requirements of sub-millisecond high-frequency channels.

[0004] II. Bypass-based hardware acceleration solutions such as TAP / FPGA have been deployed in data centers and core gateways in recent years. These solutions capture network traffic through physical link mirroring (Mirror / TAP) and use dedicated hardware (such as FPGA accelerator cards) to perform feature extraction, pattern matching, and protocol identification in parallel. However, these solutions have high deployment barriers and are limited by their bypass architecture, making it difficult to achieve closed-loop control and dynamic interaction at the source. Complex protocol adaptation and functional expansion are also limited, hindering rapid updates and the loading of intelligent identification strategies.

[0005] Third, the asynchronous traffic analysis architecture based on cloud-based large-scale models, as an intelligent solution that has emerged in recent years, mainly relies on the centralized deployment of large-scale models (such as Transformer-type neural networks) on cloud platforms, combined with edge node sampling data reporting mechanisms, to achieve deep protocol behavior reconstruction and cross-flow behavior attribution. However, due to its strong dependence on off-site computing power, it faces multiple problems such as high response latency, poor real-time performance, and the risk of sensitive data leaving the domain, making it difficult to apply to network access scenarios that require real-time prevention and control. Summary of the Invention

[0006] This application provides a method, apparatus, device, and storage medium for real-time network traffic identification, which has the advantages of high real-time performance, low processing latency, low resource consumption, and the ability to effectively handle encrypted traffic.

[0007] On one hand, this application provides a real-time network traffic identification method for use in the kernel mode and user mode of an operating system, wherein the operating system runs on a network card driver that supports the high-speed data path address family AF_XDP; the method includes:

[0008] In the kernel mode, network data frames of the physical network card are retrieved based on the XDP node and the header information of the data frames is extracted. The data frame header information is then used to encapsulate structure data and push it to the user mode.

[0009] In the user space, the acquired structure data is used to construct a five-tuple logical flow identifier, the state structure is maintained according to the flow dimension, and the logical flows in multiple time slices and the data frame header information are aggregated in context to generate several sets of behavioral indicator features.

[0010] The index vector composed of the behavioral index features is subjected to dimensionality reduction transformation using principal component analysis (PCA) compression to construct principal component vectors.

[0011] The principal component vectors are input into the multilayer perceptron (MLP) inference model. The risk rating is determined based on the confidence value output by the model, and data is discarded, allowed, or restricted.

[0012] On the other hand, this application provides a network traffic real-time identification device, the device comprising:

[0013] The data processing module is used in the kernel mode to retrieve network data frames from the physical network card based on the XDP node and extract the data frame header information, encapsulate structure data with the data frame header information and push it to the user mode.

[0014] The indicator calculation module is used in the user state to construct a five-tuple logical flow identifier from the obtained structure data, maintain the state structure according to the flow dimension, and perform context aggregation on the logical flows in multiple time slices and the data frame header information to generate several sets of behavioral indicator features.

[0015] The vector generation module is used to perform dimensionality reduction transformation on the index vector composed of the behavioral index features using principal component analysis (PCA) compression to construct principal component vectors.

[0016] The strategy reasoning module is used to input the principal component vector into the multilayer perceptron (MLP) reasoning model, determine the risk rating based on the confidence value output by the model, and execute data discard, release, or restriction policies.

[0017] In another aspect, this application provides a computer device including a processor and a memory, wherein the memory stores at least one instruction, at least one program, code set, or instruction set, and the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by the processor to implement the network traffic real-time identification method described above.

[0018] In another aspect, this application provides a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement the network traffic real-time identification method described above.

[0019] By employing a kernel-mode and user-mode collaborative processing mechanism and constructing a fully blind detection link based on structural proxies, multi-dimensional features across protocol layers are directly extracted in the kernel mode and pushed to the user mode for aggregation analysis. Combined with dimensionality reduction and lightweight inference models, real-time risk discrimination is achieved. Without relying on complete protocol parsing or high-cost hardware, a full-scenario discrimination system that balances detection accuracy, response efficiency, and engineering feasibility has been realized. This solves the problems of high processing latency and difficulty in identifying encrypted traffic in traditional solutions. It has the advantages of high real-time performance, low processing latency, low resource consumption, and effective handling of encrypted traffic, demonstrating significant technological advancement and industrial application value. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the real-time network traffic identification method provided in the embodiments of this application;

[0021] Figure 2 The system flowchart of the real-time network traffic identification method is shown;

[0022] Figure 3 This is a flowchart illustrating the algorithm for implementing the complete real-time network traffic identification method of this application;

[0023] Figure 4 This is a timing diagram for network data frame processing based on embodiments of this application;

[0024] Figure 5 It is a delay histogram of packet processing using the embodiments of this application and other existing deployment schemes;

[0025] Figure 6 This paper shows a structural block diagram of the network traffic real-time identification device provided in an embodiment of this application;

[0026] Figure 7 A structural block diagram of a computer device provided in an exemplary embodiment of this application is shown. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0028] In this article, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0029] The three strategies commonly used in conventional techniques generally suffer from the following problems:

[0030] (1) Limited ability to parse protocol semantics and encrypted payloads makes it difficult to adapt to the current trend of increasingly ambiguous and distorted traffic.

[0031] (2) In resource-constrained environments, there is a lack of lightweight and deployable real-time discrimination paths, making it difficult to meet the performance requirements of edge nodes and high-concurrency scenarios.

[0032] (3) The system architecture relies heavily on the caching and reorganization of the complete data stream, making it impossible to achieve a truly “blind discrimination” strategy.

[0033] Therefore, there is an urgent need to propose a lightweight recognition method that does not rely on complete stream reconstruction and can achieve fast feature extraction and semantic proxy reasoning through shallow information of the data surface. It should also have the ability to compress structure, transfer training and deployment, and be suitable for high-speed network devices with AF_XDP capability.

[0034] To address the aforementioned challenges, this application leverages the low-latency access path and zero-copy transmission channel provided by the AF_XDP (Address Family eXpress Data Path) data plane to perform structured parsing and feature encoding on the arriving raw network packets. Combined with principal component compression and a lightweight neural discriminant structure, this forms a closed-loop inference system capable of performing intrusion detection and behavior classification without protocol decoding. The core features of this system lie not only in its deep mining of structural features and temporal attributes but also in its distilled imitation of high-semantic DPI (Deep Packet Inspection) discriminant logic during the inference phase, thereby achieving high accuracy and response efficiency even under extreme resource conditions.

[0035] Figure 1 This is a schematic diagram of a real-time network traffic identification method provided in an embodiment of this application, which includes the following steps:

[0036] Step 101: In kernel mode, based on the XDP node, retrieve network data frames from the physical network card and extract data frame header information, encapsulate structure data with data frame header information and push it to user mode.

[0037] At the software level, this solution is primarily used in the operating system's kernel and user modes. The operating system runs on a network card driver that supports AF_XDP (Address Family eXpress Data Path) and interacts with the network card for data exchange. An XDP node is a data processing unit running in the operating system kernel mode, capable of directly accessing network data frames received by the physical network card. Specifically, it can be implemented using the AF_XDP address family and eBPF virtual machine technology provided by the Linux kernel. By bypassing the kernel protocol stack, data frame processing is performed directly in kernel mode, reducing data copying and context switching overhead.

[0038] Kernel mode and user mode are two permission modes for operating systems to manage hardware resources. Kernel mode has the highest privileges, allowing direct access to all hardware resources, execution of the operating system kernel code, and handling core functions such as process scheduling, memory management, and device drivers. User mode, on the other hand, has limited privileges and can only indirectly access hardware resources and execute non-privileged instructions through system calls. This solution establishes a switching mechanism between user mode and kernel mode to perform targeted analysis and processing of network traffic.

[0039] During the data acquisition phase, the XDP (eXpress Data Path) hook is used to extract stateless, low-latency, shallow data frame header information from each data frame entering the network interface card. This parsing process does not involve TCP stream reassembly, complete payload caching, or application layer protocol reconstruction. Instead, it directly constructs a multi-dimensional field vector spanning L3 / L4 / L7 layers from the data frame by reading the frame header structure and fixed offset positions.

[0040] The shallow data frame header information represents some basic field information of data collection, covering plaintext perceptible areas in the protocol layer, connection layer, and some application protocols. Specifically, it can include precise timestamp, packet length, protocol type, source / destination IP address, TTL, IP fragmentation flag, source port, destination port, TCP flags (such as SYN / ACK / RST), TCP sequence number, window size, UDP packet length, ICMP type, ARP opcode, etc., as well as twenty-three types of fields visible in the L7 layer, such as HTTP method, HTTP status code, DNS query type and response code, TLS handshake type, etc.

[0041] After collecting the necessary data frame header information, the data frame header information can be encapsulated into structured data and pushed to user space.

[0042] Step 102: In user space, construct a five-tuple logical flow identifier from the obtained structure data, maintain the state structure according to the flow dimension, and perform context aggregation on the logical flow and data frame header information in multiple time slices to generate several sets of behavioral indicator features.

[0043] A 5-tuple logical flow identifier is a unique flow identifier formed by combining the source IP address, destination IP address, source port, destination port, and transport layer protocol type. Specifically, a hash algorithm can be used to perform hash calculation on the 5-tuple fields to generate a unique key value, which is used to maintain flow-level state tracking and context aggregation in user space.

[0044] During the aggregation phase, the system derives a set of behavioral indicator features with deep semantics in real time from the data frame header information (such as twenty-three basic fields). These features can exist as matrix data and are preprocessed feature indicators before traffic data inference. For example, at least one of the following can be statistically analyzed: connection behavior indicators, load content indicators, time series feature indicators, symmetry structure indicators, and anomaly modeling indicators. The statistical results are the corresponding behavioral indicator features.

[0045] In one possible implementation, the statistical connection behavior may include stream duration and request-response ratio; the payload content may include payload segment entropy and content-type distribution entropy; the timing characteristics may include idle time fluctuation and ACK jitter; the protocol structure characteristics may include TCP state entropy, TLS SNI suffix distribution and DNS NXDOMAIN ratio; the symmetry structure may include stream symmetry index and small packet burst density; and the anomaly modeling may include TCP window scaling anomalies, TCP retransmission rate, TTL jump rate, and ICMP type distribution, etc.

[0046] Specifically, stream duration reflects the lifespan of a logical stream and can be obtained by calculating the difference between the stream's start and end times. The request-response ratio is calculated by comparing the number of requests sent by the client to the number of responses returned by the server, measuring the symmetry of communication. Payload segment entropy is calculated by applying information entropy to the payload byte distribution, reflecting the degree of data randomness. Content type distribution entropy is based on statistics from the HTTP header's Content-Type field, quantifying the diversity of content types. Idle time fluctuation is measured by calculating the standard deviation of the time interval between adjacent data packets. ACK jitter is assessed by measuring the degree of change in the time difference between a request and its corresponding response. TCP state entropy is calculated by statistically analyzing the probability distribution of various flags (such as SYN, ACK, RST, etc.) in a TCP connection. TLS SNI suffix distribution is based on statistics of the suffixes in the Server Name Indication (SNI) field during the TLS handshake. The DNS NXDOMAIN ratio is obtained by calculating the proportion of DNS queries that return NXDOMAIN (domain name not found) responses.

[0047] The flow symmetry index measures the degree of symmetry in bidirectional traffic by comparing the number of packets and bytes. Small packet burst density counts the frequency of concentrated occurrences of small packets (e.g., less than 64 bytes) per unit time. TCP window scaling anomalies are identified by detecting abrupt changes in window size. TCP retransmission rate is the proportion of retransmitted TCP packets to the total number of packets. TTL hopping rate calculates the frequency of changes in the TTL value. ICMP type distribution shows the proportional distribution of different ICMP packet types.

[0048] These metrics are calculated using methods such as dynamic histograms, window aggregation, and entropy functions. The entropy metrics are calculated using the Shannon entropy formula.

[0049]

[0050] in Represents the variable space (such as payload byte distribution, direction sequence, content-type statistics set). Let represent the probability of occurrence for each item. For binary time features such as directional sequences, the same entropy function is used to measure their interaction complexity. For time-series behavioral indicators (such as idle time jitter and TCP ISN predictability), the modeling and statistics are performed using windowed standard deviation and sequence difference variability.

[0051] Step 103: The index vector composed of behavioral index features is subjected to dimensionality reduction transformation by principal component analysis (PCA) compression to construct the principal component vector.

[0052] The aforementioned sets of behavioral indicator feature matrices are combined to form a complete indicator vector. This indicator vector has a high dimension (depending on the number of statistical features). For example, in this embodiment, the indicator vector has at least 44 dimensions. Such a high-dimensional vector is not conducive to rapid reasoning and analysis. Therefore, this application chooses to compress it to reduce its dimension, compressing the original high-dimensional vector into a low-dimensional principal component vector.

[0053] This application uses PCA (Principal Component Analysis) compression to compress the index vector. PCA compression is a mathematical method for linearly reducing the dimensionality of high-dimensional behavioral index features. Specifically, it can be achieved by calculating the covariance matrix of the feature matrix and extracting the principal component vectors in the direction of maximum variance, thereby eliminating redundant information between features and retaining the main discriminant information.

[0054] Step 104: Input the principal component vector into the multilayer perceptron (MLP) inference model, determine the risk rating based on the confidence value output by the model, and implement data discard, release, or restriction policies.

[0055] The MLP (Multilayer Perceptron) inference model needs to be pre-trained and deployed in the system for this solution. It achieves a non-linear mapping through activation functions and weight matrices, transforming the dimensionality-reduced principal component vectors into risk confidence values. This solution can analyze various data detected in historical network attacks and can be applied to the system after training. The confidence value output by the MLP inference model represents the risk level of the network data traffic. A low risk level indicates normal data interaction, and no interception or restriction is performed. A relatively high risk level allows for rate limiting and focused monitoring. When the risk level reaches a certain threshold, it indicates a network attack, and data interception strategies are implemented.

[0056] In summary, this application achieves real-time network traffic identification and risk assessment through shallow feature extraction and lightweight model inference without relying on complete data stream reconstruction and deep protocol parsing. This method significantly reduces processing latency and resource consumption while maintaining effective identification capabilities for encrypted traffic. By employing XDP technology to process data packets directly at the network interface card (NIC) driver layer, the system can handle high-throughput network traffic with near-line-speed performance. The lightweight MLP model allows this solution to be deployed on resource-constrained edge devices, enabling localized real-time traffic analysis and control. Furthermore, through dimensionality reduction using principal component analysis, the system can effectively handle high-dimensional feature spaces, improving the model's generalization ability and adaptability to new attack patterns. Overall, this solution significantly improves processing efficiency and deployment flexibility while ensuring identification accuracy, providing an efficient and feasible technical path for network security protection.

[0057] In some embodiments, encrypted message data may be sent and received in special working scenarios. When the network data frame is an encrypted message, the application layer fields cannot be directly parsed because the payload is encrypted. This results in insufficient capture of key information during shallow feature extraction, failing to effectively support the generation of subsequent behavioral indicator features and risk assessment. Feature extraction of the payload data can be pattern-matched with the learned DPI deep parsing during subsequent inference, achieving an attack type identification rate of up to 97% of the DPI for encrypted messages. This embodiment uses 23-dimensional shallow feature data as an example. Calling the XDP node's shallow layer acquisition can directly obtain 22 identifiable feature data. During the identification process, the message header information is used to synchronously confirm whether the message is encrypted, and then feature extraction is performed on the 23rd dimension plaintext payload content or encrypted payload content. For plaintext payloads, the payload content can be directly acquired. For encrypted payloads, this application provides a method for obtaining data frame header information from encrypted messages, including the following steps:

[0058] A. Determine the effective encrypted payload length, the number of segments, and the maximum sampling length of the sliding window;

[0059] B. Calculate the starting offset and the number of sampled bytes for each segment based on the total length of the current message, and extract the valid fields from the target position of the payload to form the spliced ​​shallow structure view data;

[0060] C. Obtain the header information of the data frame based on valid fields.

[0061] The effective encrypted payload length is determined by parsing the protocol header fields of the network data frame, for example, by subtracting the header length from the total length field in the TCP protocol. The number of segments can be set based on preset empirical values ​​or dynamically adjusted algorithms; a fixed three-segment sampling structure is typically used in the configuration. The sliding window is dynamically set according to the network packet length, with a maximum of 128 bytes. When calculating the starting offset, the dynamic segmentation algorithm uses the ratio of the payload length to the number of segments as the reference offset. The truncation operation of the effective fields is performed directly on the XDP data plane, extracting the byte sequence from the specified memory location through pointer operations. This application uses dynamic sampling of three segments as an example because the header, middle, and tail segments of the data payload can cover the original data segment as much as possible, improving the identification accuracy of inference matching.

[0062] The maximum sampling length of the sliding window constrains the amount of data captured in a single truncation operation. The sampling length is adapted to the network packet length using an algorithm, with a maximum of 3x128 bytes. For example, when the payload is only 200 bytes, three 32-byte segments of data are dynamically collected; when the payload exceeds 3x128 bytes, only 384 bytes of data are collected. The captured valid fields are concatenated in memory to form a structured view, which contains local features of different regions of the encrypted payload. These features, together with the original protocol header information, form a complete-dimensional data frame header. During inference, pattern matching is performed with the learned DPI deep parsing, achieving an attack type identification rate of up to 97% for encrypted messages.

[0063] In one specific embodiment, the data packet payload length is set to... The number of segments is The maximum sampling length for each segment is Then the first The starting position and length of segment sampling can be defined as:

[0064]

[0065]

[0066]

[0067] in Indicates the first Segment sampling start offset, The system determines the sampling length for this segment based on location. Start extraction The bytes formed three spliced ​​samples. In a typical configuration, the packet payload is 800 bytes. Each sampling segment has a length of no more than 128 bytes, which is a sliding window.

[0068] This method can cover typical locations of different protocol content without complete reassembly, effectively improving the model's ability to identify structural deformation, protocol encapsulation, and spoofing behavior.

[0069] After obtaining the encapsulated structure data, batch buffering can be performed based on a time-sliding window aggregation method, and then pushed to user-space shared memory via the AF_XDP zero-copy mechanism. This process reduces unnecessary data interaction frequency, improves overall processing throughput, and ensures that the data processing path does not pass through the protocol stack cache. Figure 2 The system flowchart of the real-time network traffic identification method shown is as follows: The system runs on the network card driver and interacts with the physical network card. The XDP node extracts data from the data frame buffer queue through the eBPF node. After data identification and data frame header information collection and encapsulation, the data is sent to the UMEM shared memory through AF_XDF zero-copy transmission.

[0070] UMEM shared memory settings can reduce the frequency of data interaction between kernel mode and user mode. The time-sliding window aggregation method can be set to a fixed duration window or a dynamically adjusted window, shortening to 5 microseconds during peak traffic periods and extending to 20 microseconds during low load periods. The number of structure data packets accumulated within each window can be set to 32, triggering batch transmission when a quantity threshold or time threshold is reached. The AF_XDP zero-copy mechanism is implemented through a pre-allocated circular buffer, with kernel mode and user mode sharing the same physical memory area. After data is written to the circular buffer, the user-mode process is notified via a lock-free queue.

[0071] After switching to user mode, the first step is to extract the encapsulated structure data from the UMEM shared memory, and then construct the 5-tuple logical flow identifier. This process can be implemented through hash operations, including:

[0072] The data frame header information is hashed based on a hash algorithm. The data type of the feature is matched according to the logical flow corresponding to the hash value and stored in the feature cache table. Then, the structure data is extracted from the cache table and a 5-tuple logical flow identifier is constructed.

[0073] By calculating the characteristic information of data packets (such as source / destination IP addresses, port numbers, protocol types, etc.) using a hash algorithm, data packets can be quickly mapped to a hash value. This hash value can represent a logical flow, thus helping the system quickly identify which logical flow the data packet belongs to. The result of hash matching can be used to classify and store data packets in different cache tables according to their characteristic information. In the zero-copy mode of AF_XDP, hash matching can serve as a means of fast lookup and classification, helping the system complete the classification and processing of data packets in a very short time, thereby meeting the requirements of high throughput and low latency.

[0074] In some embodiments, the process of constructing principal component vectors from high-dimensional behavioral indicator feature vector inference can be specifically described as follows:

[0075] A. Obtain the feature matrix of the training set indicators and perform decentralization processing. Calculate the covariance matrix and eigenvalue decomposition of the decentralized data to obtain the projection matrix. ;

[0076] First, the training data is centered by subtracting the mean from each sample, making the mean zero. This step ensures that the covariance matrix accurately reflects the variance and correlation of the data. After data centering, the covariance matrix is ​​calculated. The covariance matrix is ​​a symmetric matrix whose elements represent the covariance between different features. For a dataset with n features, the covariance matrix is ​​n×n, where each element σij represents the covariance between the i-th and j-th features.

[0077] Eigenvalue decomposition results in the covariance matrix being decomposed into the product of eigenvalues ​​and eigenvectors. Eigenvalues ​​represent the magnitude of the variance of the data along the direction of the corresponding eigenvector, while eigenvectors represent the principal directions of change in the data (i.e., the directions of the principal components). The selected eigenvectors are combined into a matrix W, where each column of this matrix is ​​an eigenvector. This matrix W is the projection matrix, used to project the original data into a lower-dimensional space.

[0078] B. Transform the behavioral indicator features into indicator vectors, and construct the principal component vectors according to the following formula. :

[0079]

[0080] Among them, For index vectors, This is the original index mean vector. This indicates the matrix transpose.

[0081] This application uses 44 preprocessing feature indicators as an example for illustration, and the indicator vector... Perform linear dimensionality reduction transformation, typically the value is This ensures that over 95% of the cumulative variance information is retained. This compression improves inference speed, reduces the risk of overfitting, and allows the model to maintain discriminative ability even when features are missing or fields are limited.

[0082] In encrypted traffic scenarios, traditional MLP models rely on complete protocol parsing and plaintext fields to achieve high semantic attack detection. This prevents the models from effectively handling encrypted, circumvented, or nested protocol traffic without decoding the protocol semantics. Furthermore, conventional model training methods struggle to balance inference speed and semantic discrimination accuracy. Therefore, this application adopts a lightweight three-layer structure, using a Deep Packet Inspection (DPI) system as the teacher model. The DPI system's fine-grained annotation output constructs soft labels to guide the lightweight model through distillation learning to obtain the MLP inference model, formally expressed as follows:

[0083]

[0084] in To predict the output confidence value; The number of categories; and Represents the weight matrix. and Indicates the corresponding bias term; Represents the principal component vector; For activation function, This is the normalization function;

[0085] The optimization objective function of the MLP inference model It is expressed as follows:

[0086]

[0087] in and These represent the calculation of cross-entropy loss and divergence, respectively. and These represent the corresponding weight values; This represents the actual confidence level value. This indicates the distillation label output by the DPI system;

[0088] Distillation learning, without explicitly decoding protocol semantics, establishes a mapping between data frame header information and high-semantic tags, effectively improving the model's blind detection performance in scenarios such as encryption, evasion, and nested protocols. Through the distillation process described above, the model can fit high-semantic attack tags without being aware of the plaintext fields at layer 7 or calling the protocol parser, achieving semantic discrimination proxying in the structural domain. This is the core implementation mechanism of the fully blind inference structure.

[0089] Inference latency can be controlled to sub-millisecond levels under principal component projection and MLP computation paths. Combined with the acquisition throughput of AF_XDP, it can guarantee a packet processing capacity of millions of PPS under 10 Gigabit network conditions.

[0090] The aforementioned approach, which determines risk rating and executes strategies based on model output confidence values, is prone to misjudgment, cannot distinguish between transient anomalies and sustained attacks, and lacks differentiated response strategies for different risk levels, resulting in a lack of flexibility and continuity in the defense strategy. Therefore, this application provides a clear method for determining risk rating and executing strategies based on model output confidence values, as described below:

[0091] When outputting attack prediction confidence value When a network attack risk is identified, the drop policy sharing extended Berkeley packet filter eBPF Map is mapped back to the XDP node, and the target policy is executed through the XDP node.

[0092] When outputting attack prediction confidence value When the rate limiting policy is shared with the eBPF Map, it is continuously monitored and counted within each preset period; when N consecutive lifecycle windows are hit, the drop policy is shared with the eBPF Map; when no hit is achieved within a preset period, the rate limiting policy is lifted and shared with the eBPF Map.

[0093] When outputting attack prediction confidence value At that time, the allowance policy will be shared in the eBPF Map.

[0094] Specifically, when the attack prediction confidence value exceeds Q1, the system immediately writes the drop policy into the eBPF Map, triggering the XDP node to perform real-time blocking operations on the current data frame. This mechanism utilizes the kernel-mode execution characteristics of eBPF programs to ensure that high-confidence attacks are quickly intercepted at the data link layer, preventing malicious traffic from entering the protocol stack and consuming resources. For medium-confidence judgment results in the Q2 to Q1 range, the system rate-limits them and starts a counter to count, monitoring the hit status within each preset period; when a hit occurs within the lifecycle window within a preset period, the hit count is incremented. That is, under the condition of N consecutive hits, it is judged as a persistent attack and upgraded to a drop policy. If the consecutive hit condition is not met, that is, no hit occurs within a complete preset period, the rate limit is lifted and the counter is reset to zero.

[0095] In one possible implementation, when the confidence level of any class label in the predicted category exceeds 90%, the system determines that the connection is highly abnormal, immediately writes the corresponding five-tuple into the blacklist control table and binds the blocking policy, and directly performs Drop processing on the matched traffic to ensure that the malicious traffic path is blocked.

[0096] When the predicted value is between 70% and 90%, the system determines it as a suspicious connection, marks it as an object of observation, and implements a rate-limiting response strategy. Without being interrupted immediately, the bandwidth resources, packet rate, or connection frequency of this type of traffic will be dynamically compressed. At the same time, the system performs sliding window frequency counting for this connection and accumulates confidence weight values. Once its frequency reaches a specified threshold (such as 5 consecutive rate-limiting hits), it is automatically upgraded to a high-risk connection and transferred to the Drop path, forming a progressive handling path of "flexible constraints → threshold penalties → strong isolation".

[0097] In the above embodiments, there are issues such as resource waste caused by repeated detection of traffic after authentication, and feature drift caused by the continuous participation of known attack sources in model training. Specifically, authenticated secure connections still need to go through a complete discrimination process, making low-cost bypass processing impossible; confirmed severe attack sources still participate in the model distillation process, which may pollute the model feature space.

[0098] To address this, this application further proposes a whitelist and blacklist linkage control mechanism. Connections to the whitelist are never entered into the discrimination path, achieving post-authentication path acceleration and low-cost bypass; if a connection to the blacklist is marked as a severe attack source, it will be permanently blocked and excluded from the distillation retraining process to prevent attack feature drift from contaminating the model.

[0099] The whitelist mechanism establishes a bypass channel based on the trusted connection authentication result, allowing authentication traffic to bypass feature extraction, indicator aggregation, and model inference. Trusted connection authentication can be implemented based on two-way TLS certificate verification or a pre-shared key mechanism. Upon successful authentication, a five-tuple hash value is generated and stored in a memory-mapped table. When the five-tuple of a data frame matches the whitelist, the bypass processing logic is triggered, and the allow policy is directly executed through the XDP node.

[0100] The blacklist mechanism employs a strategy of solidifying attack source characteristics, permanently blocking heavy attack sources such as C2 control nodes and lateral movement attacks. Attack source marking can be triggered based on historical attack confidence thresholds. For example, if a source IP address's attack confidence value exceeds 0.95 for three consecutive detection periods, its 5-tuple information will be written to immutable storage. During model training, the training data preprocessing module filters attack source-related samples by querying the blacklist hash table, ensuring that confirmed malicious data is not included during distillation and retraining.

[0101] In summary, the whitelist mechanism can achieve traffic sorting, while the blacklist mechanism achieves attack blocking and model protection through dual isolation.

[0102] In summary, this solution constructs a complete closed-loop structure encompassing data acquisition, indicator construction, compression mapping, distillation inference, and hierarchical response. Without relying on protocol decoding, caching complete connections, or parsing plaintext fields, it builds a fully blind discrimination chain through multi-dimensional acquisition of shallow-structure data, combined modeling of behavioral indicators, principal component compression, and knowledge distillation model inference. This provides a low-power, high-efficiency general solution for edge network flow control, high-concurrency intrusion detection, protocol identification, and abnormal behavior analysis. It exhibits significant technical advantages in algorithm efficiency, engineering deployability, and model generalization ability.

[0103] The following example illustrates how this solution can be deployed on an IoT platform.

[0104] The platform uses two Intel XL710 dual-port 10 Gigabit Ethernet cards, bound to the Intel i40e driver and enabled in AF_XDP mode. The XDP program in this solution is injected during the driver loading stage to achieve a zero-copy structured acquisition path.

[0105] Each network interface card (NIC) is configured with multiple receive queues, each bound to a different physical CPU core, enabling multi-core concurrent traffic distribution for packet processing tasks. User-space programs deploy independent polling receive threads on each bound core, corresponding to each AF_XDP channel. Inference service threads are also distributed across cores, using a shared model structure to perform feature compression and category discrimination operations in parallel, thus supporting million-PPS-level traffic identification tasks in high-concurrency scenarios.

[0106] Figure 3 This is a flowchart illustrating the algorithm of the complete real-time network traffic identification method implemented in this application. Attack packets first enter the network interface card (NIC) receive queue. At the XDP Hook layer, a field extraction action is triggered, calling the XDP node to extract the data and determine its encrypted state. For unencrypted packets, the eBPF program extracts 23-dimensional feature data, including timestamp, IP address, port number, TTL, TCP flags, TCP sequence number, window size, protocol type, ICMP type, and ARP type, within approximately 80ns.

[0107] For encrypted packet payloads, up to 22 dimensions of feature data are first acquired. For payload-related feature data, the system dynamically extracts three payload bytes (each segment up to 128 bytes long) according to the packet length, constructs them into three concatenated segments, and then acquires all feature data. After acquisition is complete, the data is redirected to the AF_XDP queue, and the transmission delay is controlled within [specific parameters]. .

[0108] Once the collected feature data reaches the statistical standard of 32 sets (at least 32 sets of 23 dimensions are required), it is encapsulated and sent to EMEM shared memory using the AF_XDP zero-copy method; for data collection that does not reach the statistical standard of 32 sets, it is necessary to continue to extract data from the network card buffer queue and perform the above process.

[0109] The user-space program polls the AF_XDP queue in busy-poll mode, and upon receiving the structure, it then... Internally, logical flow hash matching is completed and the data is stored in the feature cache table.

[0110] During inference, all corresponding feature data are retrieved, and a feature index matrix related to 44 behavioral indicators is calculated. Then, a distilled three-layer MLP model is used in the model layer to assemble these feature index matrices into index vectors, which are then mapped to 16-dimensional principal component vectors through PCA dimensionality reduction and compression. The total number of parameters in the inference model is 12K. After system deployment, it runs stably in a real business environment, with CPU utilization consistently remaining below 35%.

[0111] Figure 4 This is a network data frame processing timing diagram based on the embodiments of this application. Each process is divided into the starting physical network card, XDP node, UMEM node, feature cache table, PCA layer, MLP layer, and eBPF Map node.

[0112] After the physical network interface card (NIC) caches the data queue, the XDP node is triggered to collect 23-dimensional feature data, a process that takes approximately 60-120 ns in total. The XDP node then performs a zero-copy transfer to the UMEM node via AF_XDP, a stage that takes approximately 70-90 ns in total. The UMEM node caches the feature cache table node, a stage that takes approximately [time missing]. The 44-dimensional feature matrix is ​​calculated using a cached feature table and then sent to the PCA layer. This stage takes approximately 330-460 seconds in total. The PCA layer performs dimensionality reduction and compression mapping, which is then input into the MLP layer. This stage takes approximately [time missing]. The MLP layer performs model inference and outputs the inference results; this stage takes approximately 80-150 seconds in total. The finalized execution strategy is shared back to the XDP node via the eBPF Map node; this stage takes approximately 50-80 seconds. The XDP node then executes specific policies in the physical network interface card (NIC) buffer queue, such as dropping, rate limiting, and allowing traffic. This stage takes approximately 30-50 seconds. .

[0113] After deploying the scheme and running it for several days, a complex multi-source hybrid attack test was conducted on it. The attack consisted of the following three parts:

[0114] One type is source address forgery-based TCP SYN Flood, where the attacking group constructs approximately 600,000 new connection attempts per second. The attack is characterized by initiating SYN connection packets without subsequent three-way handshakes, randomizing the source port, and exhibiting high flow rate surges.

[0115] The second is a UDP amplification attack based on multiple open DNS reflection nodes. The server receives 4 million response frames extended by NTP and DNS within a few seconds, with an average frame length of 512 bytes.

[0116] The third is a suspected command and control channel, hidden in high-entropy QUIC encrypted frames. Multiple connections are established under UDP port 443, and the payload is in an undecodeable form. It is low-frequency but structurally stable and difficult to distinguish from regular traffic.

[0117] During the attack, the peak total inbound traffic reached 15.4Gbps. However, thanks to the structural proxy inference mechanism and millisecond-level response strategy provided by this solution, the system was able to quickly intercept and dynamically suppress malicious connections, ensuring that critical business channels were not interrupted, core TCP services remained stable and available, and the attack did not cause any business-level failures.

[0118] For the large number of SYN packets at the beginning of the attack, the system sends out responses every 500... The window can receive hundreds of connection attempts from the same IP segment. The request frames all have the characteristics of no response, unidirectional direction, abnormal window size, and high ISN autocorrelation. Preliminary statistics are as follows:

[0119] (1). The TCP state sequence entropy is 0.97, which tends to be a random state jump.

[0120] (2). The initial window mean was 388, which is much lower than the normal flow mean of 1024.

[0121] (3). The SYN packet rate exceeds 2000 PPS per different IP address.

[0122] (4) The TCP Flags combination anomaly rate reached 72%.

[0123] (5) Packet retransmission rate is greater than 60%.

[0124] The indicator calculation module extracts data from the feature cache table after updating the indicators in each frame, and then calculates and generates a complete vector of 44 indicators. The processing time is approximately The vector then enters the PCA mapping stage to perform principal component compression.

[0125] Principal component compression retains 16 principal components for subsequent discrimination; matrix operations take 40 seconds. The system will The input is a local MLP inference model, using a 16 → 64 → 16 → C classifier. The standard inference process takes a stable amount of time. Within the range.

[0126] In the inference output, for SYN Flood type connections, the attack class output label confidence score is... The strategy module is based on the threshold strategy. Execute the Drop operation.

[0127] This strategy is written to the eBPF Map in real time, with a transmission latency of [missing information]. In between, the Drop action will take effect directly when it enters the XDP layer in the next frame, and the blocking reaction path only takes 700 seconds. This greatly alleviated the pressure of connection backlog, preventing the overall SYN backlog of the platform from overflowing out of control and keeping network service windows stable and open.

[0128] In contrast, if a traditional Netfilter + DPI software filtering solution is used, under the same attack conditions, the system will encounter a state synchronization bottleneck due to the need to complete TCP stream reassembly and context three-way handshake state management. At the same time, the DPI engine needs to parse HTTP or QUIC request header fields. If the payload is a non-plaintext stream or an incomplete stream, a valid context cannot be constructed, and the failure rate of discrimination will increase significantly.

[0129] In actual testing, the average response latency of this solution is... There are issues of strategy lag and memory bloat. During the processing of UDP reflection frames, the system identifies the following combination of metrics after receiving each data packet:

[0130] (1) Small packets account for less than 128 bytes, exceeding 90% of the target IP data packets;

[0131] (2) The aggregation entropy value reaches 0.12, indicating a high degree of concentration;

[0132] (3) The TTL transition frequency is more than 2.8 times higher than the baseline;

[0133] (4) The ratio of ICMP to UDP merging exceeds 75%;

[0134] (5) The proportion of segmented packages has increased to 18%.

[0135] Average confidence level of this type of data stream The strategy module is based on the threshold strategy. It is marked as a suspicious flow, and its rate is limited to 250kbps of connection bandwidth. If it continues to hit within the next five window periods, the cumulative confidence value gradually converges to 0.91, triggering an automatic switch to the Drop policy. The entire rate limiting decision and response cycle is controlled within... This allowed the platform to promptly reduce UDP channel occupancy without blocking a large number of false alarms.

[0136] Under low PPS throughput conditions, the TAP / FPGA bypass solution, due to its hardware-level traffic parsing capabilities, exhibits significantly better packet processing latency than this solution, with measured average latency as low as [missing value]. However, when the system throughput increases to over 10 M PPS, this solution suffers from significant efficiency drops due to bandwidth and cycle time bottlenecks in the software write-back path, and the average packet processing latency rises to [missing value]. It is difficult to continuously meet the real-time discrimination requirements in high-concurrency scenarios.

[0137] Compared to the TAP / FPGA bypass solution, this solution does not rely on external physical mirror links or high-cost dedicated hardware devices, does not involve complex link deployment and synchronous back-injection operations, and completes the entire link identification and control within the main device. It also eliminates intermediate forwarding risks such as mirror packet loss rate. In high-speed point-based attacks and pseudo-fragmentation detection behaviors, the structural proxy feature can achieve millisecond-level rate limiting closed-loop response without upstream and downstream interaction.

[0138] For QUIC encrypted streams carried by UDP port 443, the system cannot rely on field matching because it does not perform decryption, but it still constructs the following structure to proxy metrics:

[0139] (1) The load entropy values ​​of all three segments are higher than 7.8;

[0140] (2) The proportion of unidirectional data flow is greater than 95%;

[0141] (3) The duration of each data stream is greater than 60 seconds;

[0142] (4) The anomaly rate of TCP Flags is close to 0, indicating that they have not been obfuscated;

[0143] (5). The TTL jump value is 107, and the value fluctuates smoothly, but it is much higher than the baseline average of 64.

[0144] Average confidence level of this type of data stream The strategy module is based on the threshold strategy. It is marked as a suspicious flow and its rate is limited to 250kbps of connection bandwidth. If it continues to hit within the next five window periods, the cumulative confidence value gradually converges to 0.903, triggering an automatic switch to the Drop policy. The entire rate-limiting decision response cycle is also controlled within... Within this range, for suspicious traffic carried by high-entropy encryption protocols, this solution achieves an average hit rate of over 95%, enabling effective filtering and coordinated response without relying on complex deep model structures.

[0145] Cloud-based traffic identification solutions, limited by uplink bandwidth on the access side, generally employ asynchronous traffic backhaul analysis mechanisms. While they offer some policy response capability in low-concurrency scenarios, their overall processing latency is more than an order of magnitude higher than that of local discrimination paths. Especially at throughputs of 10M PPS and above, the measured average processing latency increases significantly. This is no longer sufficient to meet the real-time identification and linkage requirements under high-frequency network attacks.

[0146] Figure 5 This is a latency histogram of packet processing using the schemes described in this application and other existing deployment schemes, including the PCA-MLP scheme, Netfilter+DPl scheme, TAP / FPGA bypass scheme, and cloud-based large-scale asynchronous scheme. The comparison shows that the latency values ​​of this scheme at 1M PPS, 5M PPS, and 10M PPS are relatively smaller than the others, especially at 1M PPS and above.

[0147] Compared to cloud-based traffic analysis platforms that require uploading data to remote models and incurring processing delays of hundreds of milliseconds or even seconds, this solution is deployed locally, achieving nanosecond-level structure assessment and responding without exposing encrypted content or plaintext fields. This provides greater privacy adaptability and deployment autonomy. During the entire attack window of approximately 10 minutes, the system processed over 54 million packets, maintaining an average processing latency of [missing information]. Under load testing conditions, a single core can stably handle 1.2M-1.5M PPS, with a total throughput exceeding 10M PPS. Over 90% of CPU processing tasks are completed within the local core, eliminating the need for frequent cross-core context scheduling. Memory usage did not exceed 1.5GB, and all system performance indicators remained within preset security thresholds, demonstrating stable operation. Throughout the entire attack cycle, the platform's core HTTP and HTTPS connections remained normal, service availability was maintained above 99.97%, and no significant abnormal connections or page loading failures occurred, proving that this solution has significant protection and business assurance capabilities in real-world scenarios.

[0148] In summary, the network traffic real-time identification method and system based on AF_XDP high-speed data plane acquisition and PCA-MLP distillation inference structure proposed in this application have comprehensive advantages such as lightweight structure, high efficiency in discrimination, flexible deployment, and timely response. Compared with existing user-space software solutions based on deep packet inspection, bypass hardware acceleration solutions, and large-scale asynchronous analysis architectures based on cloud models, it has significant improvements in multiple key dimensions such as identification accuracy, system load, processing latency, and engineering adaptability.

[0149] First, compared to traditional software detection solutions based on Netfilter hooks and the DPI engine, this solution runs entirely within the XDP data plane path, avoiding kernel copying, context switching, and traffic reassembly operations required for user-space protocol parsing. System data collection is limited to perceptible fields and lightweight sampling fragments. After feature structuring and index construction, semantic discrimination is completed by principal component compression and knowledge distillation models, without explicitly relying on TCP reassembly, payload reordering, or field token parsing. Therefore, it boasts lower resource consumption and higher discrimination throughput efficiency in the processing path. According to tests, under typical conditions with equivalent hardware resources, the overall system recognition latency is 1ms lower, and CPU utilization is reduced by more than 60%, allowing deployment on the online main link without interrupting business operations.

[0150] Secondly, compared to the bypass hardware acceleration architecture based on TAP / FPGA, this solution does not rely on dedicated probes, mirroring, or physical cutting equipment. It can complete high-speed, full-link coverage real-time acquisition and semantic-level discrimination without the data leaving the host. The system is supported by the AF_XDP zero-copy mechanism and can run on standard Ethernet devices, avoiding the deployment of expensive custom NICs or dedicated hardware coprocessing modules, significantly reducing deployment costs and interface adaptation complexity. At the same time, since the data never leaves the main link list, the discrimination results can directly participate in the linkage of online rate limiting, blocking, mirroring and other control strategies. There is no synchronization lag problem caused by the "observation-back-injection" process in the bypass solution, which greatly improves the timeliness and consistency of detection loop closure.

[0151] Furthermore, compared to asynchronous traffic analysis platforms based on large cloud models (such as remote log collection and central training and discrimination), this solution offers edge deployment and high-frequency inference capabilities. The distilled MLP model is small in size and has high parameter sparsity, supporting operation on embedded SoCs, IoT edge devices, or low-power platforms, significantly reducing network bandwidth consumption and backend storage costs. Moreover, since this solution does not require uploading raw packets or deep fields, it also provides excellent data privacy protection. In addition, model inference time can be controlled within the hundreds of microseconds, making it suitable for complex network environments that are latency-sensitive or require real-time policy switching.

[0152] From the perspectives of user experience and system maintenance, this solution features flexible structure, easy deployment, and strong composability. The data collection fields are customizable, the indicator system is scalable, and the model structure supports on-demand hot replacement and iterative updates. Through modular design and an automatic feature alignment mechanism, it can quickly adapt to multiple network protocols, encrypted encapsulations, or heterogeneous hardware platforms, meeting diverse detection strategies and rapid response needs in practical applications, significantly saving deployment time and maintenance manpower costs.

[0153] Figure 6 This paper shows a structural block diagram of a real-time network traffic identification device provided in an embodiment of this application. The device includes:

[0154] Data processing module 610 is used in the kernel mode to retrieve network data frames from the physical network card based on the XDP node and extract data frame header information, encapsulate structure data with the data frame header information and push it to the user mode.

[0155] Indicator calculation module 620 is used in the user state to construct a five-tuple logical flow identifier from the obtained structure data, maintain the state structure according to the flow dimension, and perform context aggregation on the logical flows in multiple time slices and the data frame header information to generate several sets of behavioral indicator features.

[0156] The vector generation module 630 is used to perform dimensionality reduction transformation on the index vector composed of the behavioral index features using principal component analysis (PCA) compression to construct the principal component vector.

[0157] The strategy reasoning module 640 is used to input the principal component vector into the multilayer perceptron (MLP) reasoning model, determine the risk rating based on the confidence value output by the model, and execute data discarding, release, or restriction strategies.

[0158] Figure 7This illustration shows a structural block diagram of a computer device provided in an exemplary embodiment of this application. The device can be a desktop computer, laptop computer, handheld computer, or cloud server, among other computer devices. The computer device may include, but is not limited to, a processor and a memory. The memory stores at least one instruction, at least one program, code set, or instruction set. The processor loads and executes the at least one instruction, at least one program, code set, or instruction set to implement the real-time network traffic identification method described above. The processor and memory can be connected via a bus or other means. The processor can be a Central Processing Unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, graphics processing units (GPUs), embedded neural network processing units (NPUs) or other dedicated deep learning coprocessors, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0159] The processor may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor may be implemented using at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), or PLA (Programmable Logic Array). The processor may also include a main processor and coprocessors. The main processor, also known as the CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content required to be displayed on the screen. In some embodiments, the processor may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0160] In some embodiments, the computer device may also optionally include: a peripheral device interface and at least one peripheral device. The processor, memory, and peripheral device interface can be connected via a bus or signal lines. Each peripheral device can be connected to the peripheral device interface via a bus, signal lines, or a circuit board. Specifically, the peripheral device includes: a physical network interface card (NIC), and at least one of a radio frequency circuit, a display screen, and a keyboard.

[0161] The physical network card has AF_XDP support capability and a network card driver that runs XDP programs. It can complete the pre-action of field extraction and policy response in kernel mode to form an end-to-end low-latency path.

[0162] Peripheral device interfaces can be used to connect at least one I / O (Input / Output) related peripheral device to the processor and memory. In some embodiments, the processor, memory, and peripheral device interface are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor, memory, and peripheral device interface can be implemented on separate chips or circuit boards, which is not limited in this embodiment.

[0163] The display screen is used to display the UI (User Interface). This UI can include graphics, text, icons, videos, and any combination thereof. When the display screen is a touch screen, it also has the ability to collect touch signals on or above the surface of the display. These touch signals can be input as control signals to a processor for processing. In this case, the display screen can also be used to provide virtual buttons and / or a virtual keyboard, also known as soft buttons and / or a soft keyboard. In some embodiments, there may be one display screen, located on the front panel of the computer device; in other embodiments, there may be at least two display screens, respectively located on different surfaces of the computer device or in a folded design; in still other embodiments, the display screen may be a flexible display screen, located on a curved or folded surface of the computer device. Furthermore, the display screen can be configured as a non-rectangular, irregular shape, i.e., a non-rectangular screen. The display screen can be made of materials such as LCD (Liquid Crystal Display) and OLED (Organic Light-Emitting Diode).

[0164] This application also discloses a computer-readable storage medium. Specifically, the computer-readable storage medium is used to store a computer program, which, when executed by a processor, implements the methods described in the above-described method embodiments. Those skilled in the art will understand that implementing all or part of the processes in the methods described in the above-described embodiments of this application can be accomplished by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium can also include combinations of the above types of memory.

[0165] This specific embodiment is merely an explanation of the present invention and is not intended to limit the invention. After reading this specification, those skilled in the art can make modifications to this embodiment without contributing any inventive step, but such modifications are protected by patent law as long as they fall within the scope of the claims of the present invention.

Claims

1. A real-time network traffic identification method, used in the kernel mode and user mode of an operating system, wherein the operating system runs on a network card driver that supports the high-speed data path address family AF_XDP; characterized in that, The method includes: In the kernel mode, network data frames of the physical network card are retrieved based on the XDP node and the header information of the data frames is extracted. The data frame header information is then used to encapsulate structure data and push it to the user mode. In the user space, the acquired structure data is used to construct a five-tuple logical flow identifier, the state structure is maintained according to the flow dimension, and the logical flows in multiple time slices and the data frame header information are aggregated in context to generate several sets of behavioral indicator features. The index vector composed of the behavioral index features is subjected to dimensionality reduction transformation using principal component analysis (PCA) compression to construct principal component vectors. The principal component vectors are input into a multilayer perceptron (MLP) inference model. Risk ratings are determined based on the model's output confidence values, and data discarding, allowing, or restricting policies are implemented. The MLP inference model employs a lightweight three-layer structure, obtained through distillation learning using a deep packet inspection (DPI) system as the teacher model to construct soft labels. Its formal expression is as follows: in To predict the output confidence value; The number of categories; and Represents the weight matrix. and Indicates the corresponding bias term; Represents the principal component vector; For activation function, This is the normalization function; The optimization objective function of the MLP inference model It is expressed as follows: in and These represent the calculation of cross-entropy loss and divergence, respectively. and These represent the corresponding weight values; This represents the actual confidence level value. This indicates the distillation label output by the DPI system.

2. The real-time network traffic identification method according to claim 1, characterized in that, When the network data frame is an encrypted message, determine the effective encrypted payload length, the number of segments, and the maximum sampling length of the sliding window; Calculate the starting offset and the number of sampled bytes for each segment based on the total length of the current message, and extract the valid fields from the target position of the payload respectively; The header information of the data frame is obtained based on the valid fields.

3. The real-time network traffic identification method according to claim 2, characterized in that, After encapsulating and obtaining the structure data, batch buffering is performed based on the aggregation method of time sliding window, and then pushed to the shared memory of the user space via the AF_XDP zero-copy mechanism. The process of constructing a 5-tuple logical flow identifier from the acquired structure data includes: The data frame header information contained therein is hashed based on a hash algorithm, and the feature data type is matched according to the logical stream corresponding to the hash value and stored in the feature cache table. Extract the structure data from the cache table and construct the 5-tuple logical flow identifier.

4. The real-time network traffic identification method according to claim 1, characterized in that, The context aggregation generates several sets of behavioral indicator features, including: Based on the logical flow, extract the header information of the data frame within the time slice, and statistically analyze at least one of the following: connection behavior indicators, load content indicators, timing characteristic indicators, symmetric structure indicators, and anomaly modeling indicators, to obtain the behavior indicator features. The connection behavior includes stream duration and request-response ratio; the load content includes load segment entropy and content type distribution entropy; the timing characteristics include idle time fluctuation and response jitter; the protocol structure characteristics include TCP state entropy, TLS SNI suffix distribution and DNS NXDOMAIN ratio; the symmetry structure includes stream symmetry index and small packet burst density; the anomaly modeling includes TCP window scaling anomaly, TCP retransmission rate, TTL jump rate, and ICMP type distribution.

5. The real-time network traffic identification method according to claim 1, characterized in that, The construction of the principal component vector includes: Obtain the feature matrix of the training set and perform decentralization. Calculate the covariance matrix and eigenvalue decomposition of the decentralized data to obtain the projection matrix. ; The behavioral indicator features are transformed into indicator vectors, and the principal component vectors are constructed according to the following formula. : Among them, For index vectors, This is the original index mean vector. This indicates the matrix transpose.

6. The real-time network traffic identification method according to claim 1, characterized in that, The process of determining the risk rating based on the confidence level output by the model includes: When outputting attack prediction confidence value When a network attack risk is identified, the dropping policy is shared to the extended Berkeley packet filter eBPF Map and mapped back to the XDP node, and the target policy is executed through the XDP node. When outputting attack prediction confidence value When the rate limiting policy is shared with the eBPF Map, it is continuously monitored within each preset period; when N consecutive lifecycle windows are hit, the drop policy is shared with the eBPF Map; when no hit is found within a preset period, the rate limiting policy is lifted and shared with the eBPF Map. When outputting attack prediction confidence value At that time, the allowance policy will be shared with the eBPF Map.

7. A real-time network traffic identification device, characterized in that, The device is used in both kernel mode and user mode of the operating system, and the operating system runs on a network card driver that supports the high-speed data path address family AF_XDP; the device includes: The data processing module is used in the kernel mode to retrieve network data frames from the physical network card based on the XDP node and extract the data frame header information, encapsulate structure data with the data frame header information and push it to the user mode. The indicator calculation module is used in the user state to construct a five-tuple logical flow identifier from the obtained structure data, maintain the state structure according to the flow dimension, and perform context aggregation on the logical flows in multiple time slices and the data frame header information to generate several sets of behavioral indicator features. The vector generation module is used to perform dimensionality reduction transformation on the index vector composed of the behavioral index features using principal component analysis (PCA) compression to construct principal component vectors. The strategy inference module is used to input the principal component vectors into the multilayer perceptron (MLP) inference model, determine the risk rating based on the confidence value output by the model, and execute data discard, release, or restriction policies. The MLP inference model adopts a lightweight three-layer structure and is obtained by distillation learning through the construction of soft labels using a deep packet inspection (DPI) system as the teacher model. Its formal expression is as follows: in To predict the output confidence value; The number of categories; and Represents the weight matrix. and Indicates the corresponding bias term; Represents the principal component vector; For activation function, This is the normalization function; The optimization objective function of the MLP inference model It is expressed as follows: in and These represent the calculation of cross-entropy loss and divergence, respectively. and These represent the corresponding weight values; This represents the actual confidence level value. This indicates the distillation label output by the DPI system.

8. A computer device, characterized in that, The computer device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set, or an instruction set, and the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by the processor to implement the real-time network traffic identification method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The readable storage medium stores at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement the real-time network traffic identification method as described in any one of claims 1 to 6.

Images