UDP (User Datagram Protocol) service lagging detection method and device, electronic equipment and storage medium

Abstract

The invention relates to the field of network communication, and provides a UDP service lagging detection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a real-time mixed UDP flow based on quintuple recombination; based on a current service mode, the similarity between the number of packets of the current UDP flow and the average value of the number of historical packets or the proportion of the number of packets of the current UDP flow to the number of all flow packets is applied, a to-be-tested core UDP flow is identified from the real-time mixed UDP flow; key features of the to-be-tested core UDP flow in the current service mode are calculated in a self-adaptive mode based on a double-sliding-window algorithm; and inputting the key features into a trained jamming detection model to perform service jamming detection to obtain a detection result, the jamming detection model being obtained based on sample core UDP flow and corresponding label training. According to the method, the device, the electronic equipment and the storage medium provided by the invention, the problem of lack of universality caused by protocol dependence in a traditional scheme is solved.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and in particular to a method, apparatus, electronic device, and storage medium for detecting UDP service lag. Background Technology

[0002] With the rapid development of low-latency real-time interactive applications, the User Datagram Protocol (UDP), with its connectionless and low-overhead characteristics, has become the mainstream transmission protocol for scenarios such as online games, real-time audio and video communication, video conferencing, and live streaming. Industry forecasts indicate that future emerging application areas such as cloud gaming, VR / AR collaborative interaction, and the Industrial Internet of Things, which have even higher real-time requirements, will further expand the application scope of the UDP protocol.

[0003] However, the widespread adoption of the UDP protocol has also highlighted its service quality assurance issues, with user-perceptible stuttering severely impacting the quality of experience (QoE). To optimize user experience, an effective stuttering detection mechanism is needed first. However, the UDP protocol itself lacks the packet loss detection, retransmission, and congestion control mechanisms found in the Transmission Control Protocol (TCP), making it difficult to directly assess stuttering using traditional network quality metrics such as packet loss rate and end-to-end latency.

[0004] Some application-layer protocols (such as QUIC and RTP / RTCP) implement custom reliability mechanisms on top of UDP, providing transmission quality monitoring functions similar to TCP. However, from the perspective of operating systems and hardware vendors, the specific implementations of these upper-layer protocols are opaque, making it difficult to form a unified cross-application solution. Therefore, there is an urgent need to develop a universally applicable UDP service congestion assessment method that is independent of specific upper-layer protocols. Summary of the Invention

[0005] This invention provides a method, apparatus, electronic device, and storage medium for detecting UDP service stuttering, in order to address the deficiencies in the universality and adaptability of existing UDP service stuttering assessment technologies.

[0006] This invention provides a method for detecting UDP service stuttering, comprising: Acquire real-time hybrid UDP streams based on quintuple recombination; Based on the current business model, the core UDP stream to be tested is identified from the real-time mixed UDP stream by using the similarity between the number of packets in the current UDP stream and the average number of packets in the historical stream, or by using the proportion of the number of packets in the current UDP stream to the total number of packets in all streams. The key features of the core UDP stream under test in the current business mode are adaptively calculated based on the dual sliding window algorithm. The key features are input into the trained lag detection model to detect service lag, and the detection results output by the lag detection model are obtained. The lag detection model is trained based on the core UDP stream of the sample and its corresponding label.

[0007] According to the UDP service stuttering detection method provided by the present invention, the step of obtaining a real-time hybrid UDP stream based on five-tuple reassembly includes: Based on the protocol type of the original network traffic, the original network traffic is filtered to obtain the original UDP traffic; The original UDP traffic is reassembled using a sliding time window based on the five-tuple to obtain the real-time hybrid UDP stream.

[0008] According to the UDP service stuttering detection method provided by the present invention, after identifying the core UDP stream to be tested from the real-time mixed UDP stream, the method further includes: Monitor the number of data packets received per second in the core UDP stream under test; If the duration of the packet count not meeting the core UDP flow determination criteria exceeds a preset duration threshold, the core UDP flow to be tested will be re-identified.

[0009] According to the UDP service stuttering detection method provided by the present invention, the step of adaptively calculating the key features of the core UDP stream under test in the current service mode based on the dual sliding window algorithm includes: The current business mode is identified by using a long sliding window, and the feature mean under the stable state of the current business mode is calculated. Based on the feature mean, feature standardization and feature calculation are performed to obtain the key features. The average difference in the number of packets received per second within the long sliding window and the short sliding window is calculated. When the average difference is greater than a preset threshold, change detection is performed. When a service mode switch is detected, the characteristic average of the service mode is determined in real time.

[0010] According to the UDP service stuttering detection method provided by the present invention, the step of determining the real-time updated characteristic mean of the service mode when a service mode switch is detected includes: When a business mode switch is detected, the long sliding window is reset to short sliding window data, and the feature mean is updated to the median of the current long sliding window. After the data stabilizes, the updated feature mean of the business mode is calculated.

[0011] According to the UDP service stuttering detection method provided by the present invention, the training steps of the stuttering detection model include: Obtain the core UDP stream of the sample and the corresponding labels at each time point; Key features of the core UDP stream of the sample were extracted based on feature engineering. The key features are input into the initial model to obtain the prediction results output by the initial model; When the prediction result is stuttering, determine the difference between the prediction result and the corresponding label at the current time and adjacent time; when the prediction result is smooth, determine the difference between the prediction result and the prediction results of the consecutive forward time steps of the current time. Based on the aforementioned differences, the initial model is trained to obtain the stuttering detection model.

[0012] According to the UDP service stuttering detection method provided by the present invention, the step of extracting key features of the core UDP stream of the sample based on feature engineering includes: Extract the data stream features of the core UDP stream of the sample, and perform feature cleaning and standardization on the data stream features in sequence; Feature construction is performed based on the standardized data stream features to obtain constructed features; Based on the importance of each feature, key features are selected from the data stream features and the construction features. The key features include the length of the abnormal interval of received packets, the number of packets received per second, the proportion of active time periods of the stream, the kurtosis of the packet size distribution, and the proportion of target data packets.

[0013] The present invention also provides a UDP service stuttering detection device, comprising: The UDP stream acquisition unit is used to acquire real-time hybrid UDP streams based on five-tuple reassembly. The UDP stream identification unit is used to identify the core UDP stream to be tested from the real-time mixed UDP stream based on the current business mode, the similarity between the number of packets in the current UDP stream and the average number of packets in the historical stream, or the proportion of the number of packets in the current UDP stream to the total number of packets in all streams. The feature calculation unit is used to adaptively calculate the key features of the core UDP stream under test in the current business mode based on the dual sliding window algorithm. The stuttering detection unit is used to input the key features into the trained stuttering detection model to perform service stuttering detection and obtain the detection result output by the stuttering detection model. The stuttering detection model is trained based on the core UDP stream of the sample and its corresponding label.

[0014] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the UDP service stuttering detection methods described above.

[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the UDP service stuttering detection method as described above.

[0016] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the UDP service stuttering detection methods described above.

[0017] The UDP service stuttering detection method, apparatus, electronic device, and storage medium provided by this invention reconstruct UDP data streams in mixed traffic based on five-tuples. Specifically, it dynamically determines the core flow by comparing the current number of packets with the historical average packet count similarity or the packet count ratio, rather than through protocol parsing. This overcomes the limitations of existing technologies and can natively support UDP services without encapsulated custom protocols (such as raw traffic in online games), solving the problem of lack of universality caused by protocol dependence in traditional solutions. Furthermore, the stuttering detection method, which integrates multi-dimensional key features through a machine learning model, significantly improves the accuracy of stuttering identification compared to threshold rule methods. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 This is one of the flowcharts of the UDP service stuttering detection method provided by the present invention.

[0020] Figure 2 This is a schematic diagram of the real-time hybrid UDP stream acquisition process provided by the present invention.

[0021] Figure 3 This is a flowchart of the dual sliding window algorithm provided by the present invention.

[0022] Figure 4 This is a flowchart of the change detection process provided by the present invention.

[0023] Figure 5 This is the second flowchart of the UDP service lag detection method provided by the present invention.

[0024] Figure 6 This is a schematic diagram of the UDP service stuttering detection device provided by the present invention.

[0025] Figure 7 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0027] With the rapid development of internet technology and the widespread adoption of real-time interactive applications, users' demands for network service quality (QoS) are constantly increasing, especially in application scenarios with high real-time requirements, such as video conferencing, online games, and real-time audio and video communication. These applications mostly use User Datagram Protocol (UDP) as the transport layer protocol, primarily because UDP's connectionless and low-latency characteristics can meet the stringent timeliness requirements of real-time services. However, the UDP protocol itself lacks reliability guarantees and does not provide services such as packet loss retransmission or congestion control. This causes UDP services to face numerous transmission quality problems in real-world network environments, the most prominent of which is the user-perceptible "lag" or "stuttering" phenomenon.

[0028] Lag issues manifest differently across various UDP services: in video calls and live streaming, it presents as frozen video or interrupted audio; in pure audio communication, it only manifests as intermittent audio; while in online gaming, it may simultaneously cause video stuttering, abnormal audio, and delayed action feedback. These stuttering phenomena severely impact user experience and may even prevent services from functioning properly. Therefore, how to detect UDP service stuttering in real time and accurately has become a key technical issue for improving the quality of real-time service.

[0029] Current mainstream UDP stuttering detection methods mainly fall into two categories: network layer traffic feature analysis and user layer video frame analysis. One approach is network layer traffic feature analysis: this method determines network congestion by extracting transport layer characteristic parameters. In a TCP environment, this method effectively assesses network status using rich protocol features such as sequence numbers, acknowledgment mechanisms, and round-trip time (RTT). For UDP, existing research primarily enhances feature extraction capabilities by parsing specific upper-layer protocols (such as QUIC's negative acknowledgment frames and UDT's reliability control mechanisms). The detection effectiveness of these methods highly depends on the completeness of the upper-layer protocol design; their applicability is significantly limited when protocol information is unavailable or protocol mechanisms are missing.

[0030] For example, in the first related technology: monitoring packet loss based on UDT / QUIC traffic features, this solution designs a hash table-like data structure to quickly extract UDP traffic features. Through this structure, various traffic features of UDP services are extracted, including packet size, throughput, control frame ratio, etc. This solution assumes that the upper-layer protocol of UDP is UDT / QUIC, and then selects the four most relevant features to train the machine learning model. Finally, the trained model is used in the real-time monitoring system.

[0031] The drawbacks of this scheme are that it defaults to UDT / QUIC as the upper-layer UDP protocol, which makes it lack universality and cannot be used for a wider range of UDP services; at the same time, it lacks the recording and utilization of timing characteristics. The data structure used in this scheme only records the size and number of data packets, but does not record the time interval between data packets, and does not make use of timing characteristics; finally, this scheme is based on router design and does not consider specialization for each type of UDP service, but only monitors whether there is packet loss in the entire UDP stream passing through the router.

[0032] Second, there is the user-layer video frame analysis method: based on computer vision technology, this method detects stuttering by decoding the video stream and performing temporal analysis on the continuous frame sequence. By calculating features such as inter-frame differences and motion vectors, this method can accurately identify user-perceptible stuttering events such as video frame freezes. Although this QoE-based direct measurement method is not affected by the underlying transmission protocol, its application has significant limitations: First, the method is only applicable to video services and cannot detect operational latency in purely audio services (such as voice calls) or interactive applications (such as cloud gaming); second, the video decoding and frame analysis process is computationally complex, making real-time processing difficult in resource-constrained environments such as mobile terminals.

[0033] For example, related technology two: a stuttering perception intelligent recognition scheme based on screen recording frame segmentation during video testing. This scheme uses an automated computer program to segment screen recording files into frames, extracts stuttering features using the HSV color model combined with gradient calculations, and performs recognition and testing using a convolutional neural network, ultimately achieving intelligent recognition of the segmented images. This scheme also incorporates an anti-false judgment algorithm for continuously sampled frames, determining the final result based on the stuttering probability of consecutive frames, thus improving recognition accuracy. This scheme successfully solves the stuttering perception recognition problem in online video services and also has reference value for video live streaming and remote conferencing services.

[0034] The drawback of this solution is that it is limited to video or live streaming services and cannot be applied to audio calls and online games. For example, audio calls cannot be assessed for stuttering based on video footage, and stuttering in online games, such as when user interaction is abnormal, cannot be determined from the visuals. Furthermore, the solution's model is relatively complex, consuming significant memory and computing resources during detection, which is not conducive to real-time detection on mobile devices.

[0035] To address the aforementioned issues, this invention proposes a UDP service stuttering detection method. This method first acquires a real-time hybrid UDP stream based on five-tuple reassembly. Then, based on the current service mode, it identifies the core UDP stream to be tested from the real-time hybrid UDP stream by applying the similarity between the number of packets in the current UDP stream and the average number of packets in historical streams, or by applying the proportion of packets in the current UDP stream to the total number of packets in all streams. Next, it adaptively calculates the key features of the core UDP stream to be tested under the current service mode using a dual sliding window algorithm. Finally, it inputs the key features into a trained stuttering detection model to perform service stuttering detection, obtaining the detection result output by the stuttering detection model. The stuttering detection model is trained based on the sample core UDP streams and their corresponding labels.

[0036] The method provided in this invention does not rely on specific upper-layer protocol extensions, but only on observable features of the UDP transport layer to achieve universal detection across applications, realizing a protocol-independent detection mechanism; it has multimodal stuttering recognition capabilities, breaking through the limitations of traditional video analysis, and also supports the evaluation of multi-dimensional user experience indicators such as audio stuttering and interaction latency; in addition, it designs low-complexity feature extraction and classification algorithms to ensure that the execution efficiency on terminal devices meets real-time requirements.

[0037] This invention is particularly applicable to the following typical scenarios: (1) operating system-level network service quality monitoring, where upper-layer protocol information is unavailable; (2) stuttering detection for non-video UDP services (such as voice communication and real-time games); and (3) real-time quality assessment requirements under resource-constrained environments. By establishing a standardized UDP service stuttering detection framework, this invention will provide fundamental technical support for improving the user experience of real-time interactive applications.

[0038] The subject executing this method can be an electronic device such as a terminal device, computer, server, server cluster, or specially designed UDP service lag detection device, or a UDP service lag detection device installed in the electronic device. This device can be implemented through software, hardware, or a combination of both.

[0039] Figure 1 This is one of the flowcharts of the UDP service stuttering detection method provided by the present invention, such as... Figure 1 As shown, the method includes the following steps: Step 110: Obtain the real-time hybrid UDP stream based on 5-tuple reassembly; Step 120: Based on the current business model, the core UDP stream to be tested is identified from the real-time mixed UDP stream by applying the similarity between the number of packets in the current UDP stream and the average number of packets in the historical stream, or by applying the proportion of the number of packets in the current UDP stream to the total number of packets in all streams.

[0040] Specifically, considering the wide range of UDP services, especially when a single terminal runs multiple UDP services simultaneously, existing technologies often struggle to distinguish the traffic characteristics of different services, leading to a decrease in detection accuracy.

[0041] In this embodiment, the core UDP service flow is first accurately identified from the mixed traffic of the terminal application, enabling continuous tracking of the core service flow. Core UDP flow identification is achieved through multi-level traffic feature analysis and contextual association. Specifically, this involves first acquiring the real-time mixed UDP flow, and then identifying the core UDP flow to be tested from the real-time mixed UDP flow.

[0042] In some embodiments, obtaining a real-time hybrid UDP stream based on 5-tuple reassembly includes: Step 111: Filter the original network traffic based on its protocol type to obtain the original UDP traffic; Step 112: Using a sliding time window, the original UDP traffic is reassembled according to the five-tuple to obtain a real-time hybrid UDP stream.

[0043] Specifically, please see Figure 2 , Figure 2 This is a schematic diagram of the real-time hybrid UDP stream acquisition process provided by the present invention. Here, raw network traffic refers to the set of unprocessed binary data packets directly captured from a network interface (such as a network card or router), containing all protocol types (such as TCP, UDP, ICMP, etc.). The raw network traffic is filtered by protocol type, separating all UDP traffic, and then known secondary service ports are filtered out, retaining only UDP protocol data packets, thus obtaining the raw UDP traffic.

[0044] Subsequently, a sliding time window is used to reassemble network packets into a logical flow, merging packet sequences with the same 5-tuple. The 5-tuple is a unique identifier for network traffic, used to distinguish different network connections. The 5-tuple includes the source IP address, destination IP address, source port number, destination port number, and transport layer protocol type.

[0045] The structured streaming data output after 5-tuple reassembly is the real-time hybrid UDP stream. A real-time hybrid UDP stream refers to a standardized set of UDP stream records generated after protocol filtering and session reassembly. Each record contains complete session metadata, such as the 5-tuple, packet sequence characteristics, time window markers, and a pointer index to the original payload. A real-time hybrid UDP stream may contain multiple concurrent UDP service streams, such as video, voice, and games.

[0046] Then, step 120 is executed: based on the current business model, the similarity between the number of packets in the current UDP stream and the average number of packets in the historical stream is applied, or the proportion of the number of packets in the current UDP stream to the total number of packets in all streams is applied, to identify the core UDP stream to be tested from the real-time mixed UDP stream.

[0047] Specifically, the core UDP stream under test is the target service stream selected from the mixed streams, with the aim of eliminating background traffic interference and focusing on core services. The core UDP stream under test must meet one of the following conditions: Packet quantity similarity: The similarity between the current number of packets and the historical average is within a preset range; Traffic percentage: The current number of packets exceeds the preset percentage threshold for the total traffic. It should be noted that the preset range and preset percentage threshold can be adjusted flexibly according to actual conditions.

[0048] During the core flow identification phase, different identification methods are used for different business models. For example, different models are used for gaming services and other non-gaming services (audio and video calls, multi-person conferencing, and live streaming, etc.).

[0049] In gaming operations, voice communication packets constitute a significant portion of the data stream, but are not the core stream. Therefore, it's necessary to identify the core stream by comparing its number to the historical average packet count. This is achieved by calculating the average number of historical packets for each time unit using offline data. Then, establish a sliding window with a time width of e to calculate the number of packets within the window at the current time t in real time. Based on the similarity formula, if the result is negative or between 0 and 0.9, it can be determined that it is not a core business flow; if the result is between 0.9 and 1, it can be determined that it is a core business flow. The similarity formula is shown below: (1)

[0050] In non-gaming services such as audio and video calls, multi-person conferencing, and live streaming, the proportion of core service flow packets to all flow packets is relatively high. Core flows can be identified directly by calculating this proportion. If this proportion is greater than 90%, the service flow is considered a core service flow.

[0051] In other embodiments, after identifying the core UDP stream to be tested from the real-time mixed UDP stream, the method further includes: Monitor the number of data packets received per second in the core UDP stream under test; If the number of packets does not meet the core UDP flow determination criteria for a duration longer than the preset duration threshold, the core UDP flow to be tested will be re-identified.

[0052] Specifically, in order to further improve the accuracy of core UDP stream identification, this embodiment continuously monitors the stability of identified stream characteristics. When it is detected that the number of data packets received per second N does not meet the core stream UDP judgment criteria for several seconds, the system will automatically trigger a re-evaluation process.

[0053] After identifying the core UDP stream to be tested, its key features can be further extracted. Considering that during real-time detection of buffering, data is real-time and future data is unpredictable, and the business model may be changing and unknown, it is necessary to adaptively measure the mean of data features under the current business model. This embodiment uses a dual sliding window algorithm to adaptively calculate the key features of the core UDP stream to be tested under the current business model.

[0054] Step 130: Adaptively calculate the key features of the core UDP stream under test in the current business mode based on the dual sliding window algorithm.

[0055] Specifically, the dual sliding window algorithm is an adaptive algorithm composed of a long sliding window and a short sliding window. The long sliding window is used to calculate the mean of features in a steady state, such as the average packet interval. The short sliding window is used to detect sudden anomalies, such as a sudden drop in the number of packets. The key features here can be features selected during the model training phase, and specifically include: the length of the abnormal interval of received packets, the number of packets received per second, the proportion of active flow periods, the kurtosis of the packet size distribution, and the proportion of target data packets.

[0056] In some embodiments, step 130 specifically includes: Step 131: Use a long sliding window to identify the current business mode and calculate the feature mean under the stable state of the current business mode. Based on the feature mean, perform feature standardization and feature calculation to obtain key features; Step 132: Calculate the average difference in the number of packets received per second within the long sliding window and the short sliding window. When the average difference is greater than a preset threshold, perform change detection. When a service mode switch is detected, determine the characteristic average of the service mode that is updated in real time.

[0057] Specifically, please see Figure 3 , Figure 3This is a flowchart of the dual sliding window algorithm provided by this invention. The long sliding window identifies the current business mode and calculates the mean feature value under stable conditions. The short sliding window distinguishes between business mode switching and network congestion events, outputting the real-time updated mean feature value of the business mode for further standardization and key feature calculation. It should be noted that the network congestion judgment here is only a rough assessment, used only to distinguish it from business mode switching, and does not represent the final output result.

[0058] When the algorithm runs, it first initializes the parameters. There are five initial parameters in total, as shown in Table 1 below: Table 1 Initialization Parameter Table

[0059] The dual sliding window algorithm needs to calculate two feature means: the average number of packets received per second. and average package size The number of packets received per second It is more stable, therefore it was selected as the detection feature.

[0060] When performing change detection using a short sliding window, continuous detection is performed. Changes, when Mean within the short window The mean within the long window There is a significant difference, and the judgment criteria are as follows: (2)

[0061] This triggers the change detection process; please refer to [link / reference]. Figure 4 , Figure 4 This is a flowchart of the change detection process provided by the present invention.

[0062] When a business mode switch is detected, the long sliding window is reset to short sliding window data, and the median is used instead of the mean, and the absolute deviation of the median is used instead of the variance. The background mean is updated to the median of the long sliding window, because there is less data at this time, and the median is less affected by outliers. When the data in the long sliding window exceeds half its length, it is restored to the mean and variance.

[0063] When new data arrives normally and no business model switch occurs, the background mean update strategy is as follows: (3)

[0064] in The learning rate can be set as needed, such as 0.05.

[0065] Step 140: Input the key features into the trained lag detection model to perform business lag detection, and obtain the detection results output by the lag detection model. The lag detection model is trained based on the core UDP stream of the sample and its corresponding label.

[0066] Specifically, after identifying the core UDP stream to be tested and calculating key features, the key features are input into the trained lag detection model to detect service lag and output whether there is lag (output 1 represents lag, 0 represents smooth). When the output is 1, a lag alarm is issued. If it is 0 for three consecutive seconds, it means that the lag has ended. If the lag lasts for three seconds or more, it is marked as a serious lag.

[0067] Understandably, a stuttering detection model can be trained before performing stuttering detection on real-time UDP streams. The stuttering detection model is trained based on the core UDP stream of the sample and its corresponding labels.

[0068] The core UDP stream of the sample can be an offline, non-real-time data stream. The core UDP stream is selected from the captured data packet files and used as the core UDP stream of the sample. Its corresponding tags can be manually annotated based on the screen recording file, such as marking the locations of visual, audio, or interactive stutters in the screen recording file.

[0069] In some embodiments, the training steps of the stuttering detection model include: Obtain the core UDP stream of the sample and the corresponding labels at each time point; Key features of the core UDP stream of the sample were extracted based on feature engineering. The key features are input into the initial model to obtain the prediction results output by the initial model; When the prediction result is stuttering, determine the difference between the prediction result and the corresponding label at the current time and the adjacent time; when the prediction result is smooth, determine the difference between the prediction result and the prediction results of the consecutive forward time steps of the current time. Based on the differences, the initial model is trained to obtain the stuttering detection model.

[0070] In this embodiment, after obtaining the core UDP stream of the sample and the corresponding labels at each time point, key features of the core UDP stream of the sample are extracted based on feature engineering. Feature engineering is a crucial part of the machine learning process, referring to the process of transforming raw data into features (i.e., model input variables) that better represent the essence of the problem through data analysis and transformation. Its goal is to improve the performance (such as accuracy and generalization ability) and efficiency of the model.

[0071] In some embodiments, the extraction of key features specifically includes: Extract the data flow features of the core UDP stream of the sample, and perform feature cleaning and standardization on the data flow features in sequence; Feature construction is performed based on the standardized data stream features to obtain constructed features; Based on the importance of each feature, key features are selected from data flow features and construction features. Key features include the length of abnormal intervals of received packets, the number of packets received per second, the proportion of active time periods of the flow, the kurtosis of packet size distribution, and the proportion of target data packets.

[0072] Specifically, the data flow characteristics of the core UDP stream in the sample can include packet quantity characteristics, packet size characteristics, packet timing characteristics, and extreme value characteristics. Each characteristic is divided into two directions: receiving and sending, and the characteristics are statistically analyzed in units of one second. Table 2 shows the data flow characteristic table.

[0073] Table 2 UDP Data Stream Characteristics Table

[0074] Then, the data stream features are sequentially cleaned and standardized.

[0075] Feature cleaning The features are statistically calculated from the captured data packet files, therefore there are no missing values, while outliers are the target of this invention's detection. However, some services have a business preparation phase with traffic characteristics that differ significantly from those during normal business operations. These two phases are easily misjudged as anomalies, such as waiting for maps, characters, and other models to load before the game starts, or waiting for other players to load. Therefore, this part of the data needs to be removed before model training to avoid affecting the training results and improve model accuracy.

[0076] There is no universal and accurate method for identifying the business preparation stage. Therefore, this invention employs a combination of methods in its embodiments: (1) For cases where there are obvious handshake data packets in the upper layer protocol, specific data packets, such as the Initial packet of QUIC, can be identified; (2) For services with relatively stable preparation time, the preparation time of a few seconds before the official start of the service can be directly removed; (3) If neither of the above two conditions is met, the key characteristics of the core UDP stream can be compared to see if they are close to the historical average. The confidence interval is used to make the judgment.

[0077] Feature standardization The main purpose of feature standardization in this embodiment is to eliminate dimensions. Mean normalization is used, primarily to normalize the average number of packets sent and received per second, the average number of bytes sent and received per second, and the average packet size per second, in order to preserve the proportional relationships of the original data. The formula for mean normalization is as follows: This represents the mean. This represents the characteristics of the data flow before standardization. Representing the characteristics of the standardized data stream: (4)

[0078] Subsequently, feature construction is performed based on the standardized data stream characteristics to obtain the constructed features. To further reflect the correlation between the features and the lag, the embodiments of the present invention construct the following features, as shown in Table 3: Table 3. Construction Features and Calculation Methods

[0079] In the formula, The length of the abnormal interval. for The interval between sending and receiving packets at any given time. for The interval between sending and receiving packets at any given time. This represents the average interval between sending and receiving packets. For the number of packages, The percentage of peak activity periods. For the kurtosis of the package size distribution, The sequence is the package size. For average package size, The ratio of the number of packets sent and received. For the number of packets sent, For the number of packets received, The ratio of sent and received packets in bytes. The number of bytes sent. For the number of bytes received, The percentage of packets with a length of less than 64 bytes. This refers to the number of small packets with a length of less than 64 bytes.

[0080] Then, based on the importance of each feature, key features are selected from the data stream features and constructed features. The purpose of feature selection is to screen the features most useful for predicting the target variable, reducing overfitting and noise. The importance of each feature is calculated using a tree model, and the five most important features are selected, as shown in Table 4 below. The number of packets received per second needs to be normalized to the mean, while the other features do not. Table 4 Key Characteristics of UDP Data Streams

[0081] After obtaining the key features, the model is trained based on these features. This invention uses manual annotation of screen recording files through comparison and employs binary classification machine learning models (random forest, XGBoost, etc.) for supervised training.

[0082] Because the labels for stuttering / smoothness have a certain continuity and local consistency—meaning adjacent samples often have the same label rather than changing completely randomly—this is partly because the data is continuous in time, and each stutter often lasts for more than a second. On the other hand, during manual annotation, annotators tend to assign the same label to consecutive samples. For example, if the network state is actually poor for the first two and last two seconds within a six-second timeframe, but good for the middle two seconds, manual annotation often considers all six seconds as stuttering.

[0083] When data labels possess the aforementioned characteristics, a "relaxed accuracy" approach can be used for evaluation and training. "Relaxed accuracy" means that the model's prediction results are compared not only with the current sample label, but also with the corresponding labels at adjacent time points. These adjacent time points can be the previous and next few adjacent time points; this embodiment of the invention does not specifically limit this. For example, comparing with labels from the last three seconds would be done as follows: When the prediction result is 1, it means that the evaluation is correct as long as the label is 1 for any one second out of the three seconds [t-1, t+1]. This means that a one-second deviation in the evaluation lag time is allowed. The results are as follows: (5)

[0084] When the prediction result is 0, it is considered an evaluation error only if the preceding n consecutive seconds of stuttering are all evaluated as 0, meaning the entire stuttering event was completely undetected. All other cases are considered as correct evaluations, as shown below, where n represents the number of consecutive values ​​with a label of 1: (6)

[0085] The advantage of using a "relaxed accuracy" approach in evaluation is that it focuses more on whether the model can capture overall pattern changes, rather than demanding precise evaluation at every single time point. That is, it focuses more on whether stuttering events occur, rather than precisely determining whether stuttering occurs at every single time point. This preserves the characteristic that network layer UDP stream anomalies occur earlier than the user perceives stuttering, allowing for more timely detection of stuttering events. On the other hand, since the network layer and the user layer are not perfectly synchronized in time, demanding precise evaluation at every single time point would lead to model overfitting.

[0086] It is understood that the stuttering detection model trained according to the method described in the above embodiments can be used for UDP service stuttering detection.

[0087] Based on any of the above embodiments, the applicant has found through long-term research that current technical solutions for UDP service stuttering detection mainly face the following challenges and limitations: 1. The complexity of detection brought about by the diversity of business types UDP services cover a wide range, including but not limited to video calls, audio conferencing, live streaming, and online games. These services differ significantly in data transmission modes, traffic characteristics, and stuttering behaviors. Traditional detection methods based on fixed thresholds are ill-suited to this diversity, while detection solutions customized for specific service types lack universality and cannot form a unified solution. In particular, when a single terminal runs multiple UDP services simultaneously, existing technologies often struggle to distinguish the traffic characteristics of different services, leading to a decrease in detection accuracy.

[0088] 2. The contradiction between real-time requirements and computing resource limitations Most UDP services are extremely sensitive to latency. For example, video calls typically require end-to-end latency of no more than 400ms, while online games require even stricter latency limits of 100-200ms. This necessitates that stuttering detection algorithms complete analysis and judgment within a very short time, while also considering the computational resource limitations of terminal devices. Existing detection methods based on video frame analysis can provide relatively accurate results, but their high computational complexity and large memory consumption make them difficult to implement in real-time on ordinary terminal devices, and are especially unsuitable for resource-constrained environments such as mobile terminals.

[0089] 3. Difficulty in detection due to the characteristics of the UDP protocol Unlike TCP, UDP does not provide network quality metrics such as packet loss, retransmission, and latency, making it difficult to directly apply detection methods based on the protocol's inherent characteristics. UDP data streams have relatively scarce feature information, and traditional network quality assessment methods, such as those based on packet loss rate and round-trip time (RTT), are often unavailable or inaccurate in UDP environments. Furthermore, the burstiness and irregularity of UDP traffic increase the difficulty of feature extraction and analysis.

[0090] 4. Challenges to detection models posed by dynamic changes in business operations Modern UDP applications are typically highly dynamic, with business models changing significantly as application states evolve. For example, audio and video calls may switch between video and pure audio modes; participants may join or leave during multi-person conferences; players in games may enable or disable voice functionality at any time; and software updates may alter data transmission patterns. These changes cause abrupt shifts in traffic characteristics, leading to a sharp decline in the accuracy of detection models trained on static features, resulting in a large number of false positives or false negatives.

[0091] To address the aforementioned technical challenges, the embodiments of the present invention aim to solve the following core problems: (1) How to build a unified lag detection framework applicable to multiple UDP services: Research detection methods that can span different service types and extract common features to solve the problem of detection model generalization caused by service diversity.

[0092] (2) How to achieve accurate lag judgment under limited feature conditions: In view of the sparse features of UDP data stream, we study deep feature extraction technology to mine potential features related to lag from limited network layer and transport layer information.

[0093] (3) How to achieve a low-overhead real-time detection algorithm: Design a lightweight feature extraction and model inference architecture to ensure that the real-time requirements can still be met under the limited computing resources of the terminal device, and resolve the contradiction between detection latency and computational complexity.

[0094] (4) How to adapt to the dynamic changes in the business model: Research model adaptation technology to enable the detection system to adapt to sudden changes in business traffic characteristics without interrupting service and maintain detection accuracy.

[0095] Therefore, this embodiment provides a stuttering detection method that makes full use of the traffic characteristics of UDP services, discovers general-purpose features under different services and modes, trains a binary classification model, and finally applies it to real-time detection.

[0096] Please see Figure 5 , Figure 5 This is the second flowchart of the UDP service stuttering detection method provided by the present invention, as follows: Figure 5 As shown, this embodiment of the invention is divided into two parts: offline training and online detection. The upper part of the figure represents the offline training stage, where the core UDP streams are manually selected from the captured data packet files, and then feature engineering is performed, including feature extraction, data cleaning, feature transformation, feature construction, and key feature selection. Next, manual labeling is performed on the screen recording files (marking the locations of screen, sound, or interactive stutters). Finally, a classification model is obtained through model training (separating stuttering and non-stuttering data).

[0097] Feature engineering specifically includes: First, extracting raw features, including bidirectional features such as the number of packets sent and received per second, byte size, number of small packets, packet size sequence, and packet interval sequence. Then, feature cleaning is performed. For the business preparation stage (such as game loading), abnormal data is removed using three methods: (1) detecting upper-layer protocol handshake packets (such as QUIC's Initial packet); (2) directly removing the data from the first N seconds for stable businesses; (3) comparing key features with historical averages using a 95% confidence interval. Next, feature transformation is performed: the number of packets sent and received, byte size, and average packet size are normalized to their mean. Then, new features are constructed, including abnormal packet interval length, stream activity ratio, and packet size kurtosis. Finally, key features are selected through a tree model, and the five most important features are selected for model training.

[0098] During the training phase, the data was first labeled: based on synchronized screen recording files, the core UDP stream data per second was manually labeled as either stuttering (1) or smooth (0). A labeled key feature dataset was generated. A random forest model was selected, and the training / test sets were divided in a 7:3 ratio to optimize the parameters. A "relaxed accuracy" evaluation strategy was adopted: when the prediction was stuttering, if there was at least one second of actual stuttering within the three seconds [t-1, t+1], it was judged as correct; when the prediction was smooth, it was judged as wrong only if a series of stuttering events were completely missed. The test showed an overall relaxed accuracy of 94.5% and a recall of 97.7%. Finally, the model was solidified and deployed to the real-time detection process, and the stuttering status was output in real time from the normalized 5-dimensional feature vector.

[0099] Figure 5 The real-time detection and training process in the second half is slightly different, with the addition of a core UDP stream identification module and a dual sliding window algorithm module. The core UDP stream identification module is used to automatically identify a core UDP stream based on the real-time mixed UDP stream.

[0100] First, traffic preprocessing is performed: After capturing raw network traffic, the system filters non-UDP packets and removes known secondary service ports (such as DNS port 53). A sliding time window is then used to reassemble packets according to a five-tuple (source IP, source port, destination IP, destination port, protocol) to generate structured stream data containing session metadata and the original payload index.

[0101] Next, core flow identification is performed: For non-game services (such as audio and video calls), the proportion of the number of target UDP stream packets to the total number of stream packets is calculated. If it exceeds 90%, it is determined to be a core service flow; for game services, the historical average similarity is calculated using the packet quantity similarity formula. When the matching value is between 0.9 and 1, it is determined to be a core flow.

[0102] Finally, dynamic verification is initiated: continuously monitor the characteristic indicators of the core flow (such as the number of packets received per second). If the judgment criteria are not met for 3 consecutive seconds (such as the packet ratio <80%), the re-identification process is triggered.

[0103] The dual sliding window algorithm module is used to identify the transformation of business mode (such as switching from a WeChat video call to an audio call) and calculate the mean of the data features in the current window in real time, which is used to normalize the data features.

[0104] Initialization parameters: Long window (default 300 seconds), short window (default 5 seconds), mode switching threshold m (switching confirmed after 3 consecutive short windows), lag threshold (decreased by 60%). Packet reception per second is selected as the detection feature (due to its highest stability). During normal operation, the long and short windows synchronously slide to update data and calculate the mean, while the background mean is smoothly updated using a learning rate α=0.05. When a significant deviation of the short window mean from the long window mean is detected, change detection is triggered: if the fluctuation lasts for three short windows and does not exceed the lag threshold, it is determined to be a service mode switch; otherwise, it is determined to be network lag. If a service mode switch is determined (e.g., video to audio conversion), the long window is reset to short window data, and the switching statistics are the median and median absolute deviation (MAD). Mean calculation resumes after half of the long window data has been received. The background mean is synchronously updated to the current long window median.

[0105] The real-time detection process only needs to calculate the key features selected during training, input them into the classification model, and output whether there is a current lag (output 1 represents lag, 0 represents smoothness). When the output is 1, a lag alarm is issued. If the output is 0 for three consecutive seconds, it means that the current lag has ended. If the lag lasts for three seconds or more, it is marked as a severe lag.

[0106] The above solution was used to test various business applications, and the results are shown in Table 5 below: Table 5 Test Results

[0107] As can be seen from the test on a small dataset, the present invention achieves a precision of 94.5% and a recall of 97.7%, with an average recognition speed of only -0.07 seconds. The negative value is because network layer anomalies occur earlier than user layer anomalies; that is, the UDP stream anomaly occurs before the user perceives the lag. Therefore, the present invention can accurately assess lag in real time. Compared to existing technologies, the beneficial effects of the embodiments of the present invention include: 1. Protocol-independent core flow identification mechanism This invention proposes a core UDP service flow identification method that does not rely on specific upper-layer protocols (such as QUIC / UDT). Its core technology lies in reconstructing UDP data flows from mixed traffic based on a five-tuple (source IP, source port, destination IP, destination port, protocol), and distinguishing core service flows through packet count similarity calculation (rather than protocol parsing). Specifically, the core flow is dynamically determined by comparing the current traffic packet count with the historical average similarity. This mechanism overcomes the limitations of existing technologies, natively supporting UDP services without custom protocol encapsulation (such as raw traffic from online games), and solving the problem of lack of universality caused by protocol dependence in traditional solutions.

[0108] 2. Dual sliding window adaptive algorithm To address the sudden changes in traffic characteristics caused by dynamic business switching (such as switching from video calls to pure audio), this invention designs a dual sliding window adaptive algorithm. Its innovation is reflected in: (1) the long window continuously tracks the steady-state business mode and calculates the feature benchmark mean; (2) the short window detects feature fluctuations in real time, and when the short window mean deviates significantly from the long window mean, the business mode switching judgment process is triggered; (3) an anti-interference mechanism is adopted: when switching, the median is used instead of the mean as the normalization benchmark to avoid interference from outliers, and the mean calculation is restored after the data stabilizes.

[0109] 3. Lightweight real-time detection architecture To achieve low-overhead real-time detection of terminal devices, this invention constructs a lightweight real-time detection architecture: after screening by a tree model, only 5 key features are retained as model inputs to reduce feature dimensionality; "relaxed accuracy" is used for evaluation, which retains the characteristic that the network layer UDP flow anomaly occurs earlier than the user's perceived lag time, which can capture lag events more promptly and avoid model overfitting.

[0110] The UDP service stuttering detection device provided by the present invention is described below. The UDP service stuttering detection device described below and the UDP service stuttering detection method described above can be referred to in correspondence.

[0111] Based on any of the above embodiments Figure 6 This is a schematic diagram of the UDP service stuttering detection device provided by the present invention, as shown below. Figure 6 As shown, the device includes: UDP stream acquisition unit 610 is used to acquire real-time hybrid UDP streams based on five-tuple reassembly; The UDP stream identification unit 620 is used to identify the core UDP stream to be tested from the real-time mixed UDP stream based on the current business mode, the similarity between the number of packets in the current UDP stream and the average number of packets in the historical stream, or the proportion of the number of packets in the current UDP stream to the total number of packets in all streams. Feature calculation unit 630 is used to adaptively calculate the key features of the core UDP stream under test in the current business mode based on the dual sliding window algorithm; The stuttering detection unit 640 is used to input the key features into the trained stuttering detection model to perform service stuttering detection and obtain the detection result output by the stuttering detection model. The stuttering detection model is trained based on the sample core UDP stream and its corresponding label.

[0112] Based on any of the above embodiments, the UDP stream acquisition unit is specifically used for: Based on the protocol type of the original network traffic, the original network traffic is filtered to obtain the original UDP traffic; The original UDP traffic is reassembled using a sliding time window based on the five-tuple to obtain the real-time hybrid UDP stream.

[0113] Based on any of the above embodiments, a monitoring unit is further included, for: Monitor the number of data packets received per second in the core UDP stream under test; If the duration of the packet count not meeting the core UDP flow determination criteria exceeds a preset duration threshold, the core UDP flow to be tested will be re-identified.

[0114] Based on any of the above embodiments, the feature calculation unit is specifically used for: The current business mode is identified by using a long sliding window, and the feature mean under the stable state of the current business mode is calculated. Based on the feature mean, feature standardization and feature calculation are performed to obtain the key features. The average difference in the number of packets received per second within the long sliding window and the short sliding window is calculated. When the average difference is greater than a preset threshold, change detection is performed. When a service mode switch is detected, the characteristic average of the service mode is determined in real time.

[0115] Based on any of the above embodiments, the feature calculation unit is specifically used for: When a business mode switch is detected, the long sliding window is reset to short sliding window data, and the feature mean is updated to the median of the current long sliding window. After the data stabilizes, the updated feature mean of the business mode is calculated.

[0116] Based on any of the above embodiments, a model training unit is further included, for: Obtain the core UDP stream of the sample and the corresponding labels at each time point; Key features of the core UDP stream of the sample were extracted based on feature engineering. The key features are input into the initial model to obtain the prediction results output by the initial model; When the prediction result is stuttering, determine the difference between the prediction result and the corresponding label at the current time and adjacent time; when the prediction result is smooth, determine the difference between the prediction result and the prediction results of the consecutive forward time steps of the current time. Based on the aforementioned differences, the initial model is trained to obtain the stuttering detection model.

[0117] Based on any of the above embodiments, the model training unit is specifically used for: Extract the data stream features of the core UDP stream of the sample, and perform feature cleaning and standardization on the data stream features in sequence; Feature construction is performed based on the standardized data stream features to obtain constructed features; Based on the importance of each feature, key features are selected from the data stream features and the construction features. The key features include the length of the abnormal interval of received packets, the number of packets received per second, the proportion of active time periods of the stream, the kurtosis of the packet size distribution, and the proportion of target data packets.

[0118] Figure 7 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 7 As shown, the electronic device may include: a processor 710, a communications interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communications interface 720, and the memory 730 communicate with each other through the communication bus 740. The processor 710 can call logical instructions in the memory 730 to execute a UDP service stuttering detection method. This method includes: acquiring a real-time hybrid UDP stream based on five-tuple reassembly; identifying the core UDP stream to be tested from the real-time hybrid UDP stream based on the similarity between the number of packets in the current UDP stream and the average number of packets in historical streams, or based on the proportion of the number of packets in the current UDP stream to the total number of packets in all streams, according to the current service mode; adaptively calculating the key features of the core UDP stream to be tested under the current service mode based on a dual sliding window algorithm; inputting the key features into a trained stuttering detection model to perform service stuttering detection, and obtaining the detection result output by the stuttering detection model, wherein the stuttering detection model is trained based on sample core UDP streams and their corresponding labels.

[0119] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0120] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the UDP service stuttering detection method provided by the above methods. The method includes: acquiring a real-time hybrid UDP stream based on five-tuple reassembly; identifying the core UDP stream to be tested from the real-time hybrid UDP stream based on the current service mode, by applying the similarity between the number of packets in the current UDP stream and the average number of packets in historical streams, or by applying the proportion of the number of packets in the current UDP stream to the total number of packets in all streams; adaptively calculating the key features of the core UDP stream to be tested under the current service mode based on a dual sliding window algorithm; inputting the key features into a trained stuttering detection model to perform service stuttering detection, and obtaining the detection result output by the stuttering detection model, wherein the stuttering detection model is trained based on sample core UDP streams and their corresponding labels.

[0121] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the UDP service stuttering detection method provided by the above methods. This method includes: acquiring a real-time hybrid UDP stream based on 5-tuple reassembly; identifying a core UDP stream to be tested from the real-time hybrid UDP stream based on the current service mode, applying the similarity between the number of packets in the current UDP stream and the average number of packets in historical streams, or applying the proportion of the number of packets in the current UDP stream to the total number of packets in all streams; adaptively calculating key features of the core UDP stream to be tested under the current service mode based on a dual sliding window algorithm; inputting the key features into a trained stuttering detection model for service stuttering detection, and obtaining the detection result output by the stuttering detection model, wherein the stuttering detection model is trained based on sample core UDP streams and their corresponding labels.

[0122] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0123] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0124] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting UDP service stuttering, characterized in that, include: Acquire real-time hybrid UDP streams based on quintuple recombination; Based on the current business model, the core UDP stream to be tested is identified from the real-time mixed UDP stream by using the similarity between the number of packets in the current UDP stream and the average number of packets in the historical stream, or by using the proportion of the number of packets in the current UDP stream to the total number of packets in all streams. The key features of the core UDP stream under test in the current business mode are adaptively calculated based on the dual sliding window algorithm. The key features are input into the trained lag detection model to detect service lag, and the detection results output by the lag detection model are obtained. The lag detection model is trained based on the core UDP stream of the sample and its corresponding label.

2. The UDP service stuttering detection method according to claim 1, characterized in that, The acquisition of the real-time hybrid UDP stream based on 5-tuple reassembly includes: Based on the protocol type of the original network traffic, the original network traffic is filtered to obtain the original UDP traffic; The original UDP traffic is reassembled using a sliding time window based on the five-tuple to obtain the real-time hybrid UDP stream.

3. The UDP service stuttering detection method according to claim 2, characterized in that, After identifying the core UDP stream to be tested from the real-time hybrid UDP stream, the method further includes: Monitor the number of data packets received per second in the core UDP stream under test; If the duration of the packet count not meeting the core UDP flow determination criteria exceeds a preset duration threshold, the core UDP flow to be tested will be re-identified.

4. The UDP service stuttering detection method according to claim 1, characterized in that, The key features of the core UDP stream under test, adaptively calculated based on the dual sliding window algorithm under the current business mode, include: The current business mode is identified by using a long sliding window, and the feature mean under the stable state of the current business mode is calculated. Based on the feature mean, feature standardization and feature calculation are performed to obtain the key features. The average difference in the number of packets received per second within the long sliding window and the short sliding window is calculated. When the average difference is greater than a preset threshold, change detection is performed. When a service mode switch is detected, the characteristic average of the service mode is determined in real time.

5. The UDP service stuttering detection method according to claim 4, characterized in that, The step of determining the real-time updated characteristic mean of the business mode when a business mode switch is detected includes: When a business mode switch is detected, the long sliding window is reset to short sliding window data, and the feature mean is updated to the median of the current long sliding window. After the data stabilizes, the updated feature mean of the business mode is calculated.

6. The UDP service stuttering detection method according to any one of claims 1 to 5, characterized in that, The training steps of the stuttering detection model include: Obtain the core UDP stream of the sample and the corresponding labels at each time point; Key features of the core UDP stream of the sample were extracted based on feature engineering. The key features are input into the initial model to obtain the prediction results output by the initial model; When the prediction result is stuttering, determine the difference between the prediction result and the corresponding label at the current time and adjacent time; when the prediction result is smooth, determine the difference between the prediction result and the prediction results of the consecutive forward time steps of the current time. Based on the aforementioned differences, the initial model is trained to obtain the stuttering detection model.

7. The UDP service stuttering detection method according to claim 6, characterized in that, The key features extracted from the core UDP stream of the sample based on feature engineering include: Extract the data stream features of the core UDP stream of the sample, and perform feature cleaning and standardization on the data stream features in sequence; Feature construction is performed based on the standardized data stream features to obtain constructed features; Based on the importance of each feature, key features are selected from the data stream features and the construction features. The key features include the length of the abnormal interval of received packets, the number of packets received per second, the proportion of active time periods of the stream, the kurtosis of the packet size distribution, and the proportion of target data packets.

8. A UDP service stuttering detection device, characterized in that, include: The UDP stream acquisition unit is used to acquire real-time hybrid UDP streams based on five-tuple reassembly. The UDP stream identification unit is used to identify the core UDP stream to be tested from the real-time mixed UDP stream based on the current business mode, the similarity between the number of packets in the current UDP stream and the average number of packets in the historical stream, or the proportion of the number of packets in the current UDP stream to the total number of packets in all streams. The feature calculation unit is used to adaptively calculate the key features of the core UDP stream under test in the current business mode based on the dual sliding window algorithm. The stuttering detection unit is used to input the key features into the trained stuttering detection model to perform service stuttering detection and obtain the detection result output by the stuttering detection model. The stuttering detection model is trained based on the core UDP stream of the sample and its corresponding label.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the UDP service lag detection method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the UDP service stuttering detection method as described in any one of claims 1 to 7.

Images