Traffic control method based on neural networks

Abstract

The application is a neural network-based traffic control method, and relates to the technical field of network traffic control.The application collects network traffic metadata, constructs a standardized feature dataset, classifies and predicts traffic data based on a hybrid neural network, generates differentiated traffic control strategies, and implements strategy optimization and dynamic adjustment.Statistical features are extracted from traffic metadata collected in multiple environments, convolutional neural networks and long short-term memory networks are combined for spatiotemporal feature fusion and attention weighting, network state recognition and traffic trend analysis are realized, control strategies adapted to different network environments are generated based on analysis results, and strategy optimization and real-time adjustment are realized through reinforcement learning.The application effectively solves the problems of accurate traffic control and dynamic strategy adjustment in complex network environments, and improves the accuracy, adaptability and system stability of traffic control.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network flow control, in particular to a flow control method based on a neural network. BACKGROUND

[0002] With the rapid development of network communication, cloud computing and the Internet of Things industry, in the field of network flow management, the flow control method based on the neural network as the core technology to ensure the efficient operation of the network directly affects the network resource utilization and the operation stability in the flow classification accuracy, real-time control ability and multi-environment adaptability; with the introduction of machine learning technology, it realizes the technical leap from traditional static rule control to dynamic intelligent decision-making, and by constructing a basic neural network to process flow data, the flow control method preliminarily meets the basic flow control requirements of the network, but the existing technology still has many deficiencies:

[0003] The traditional flow control method based on the neural network is mostly aimed at the dynamic mapping of flow characteristics and control strategies under a single network, lacks real-time flow trend prediction and control strategy dynamic adjustment mechanism for different network architecture adaptation strategies, and does not consider the nonlinear fluctuation of flow characteristics in complex network environment, resulting in low accuracy of flow classification and control, poor control strategy adaptability and low operation stability when facing multiple architecture network.

[0004] In order to solve the above-mentioned defects, the present application provides a technical solution. SUMMARY

[0005] The purpose of the present application is to solve the problems of low accuracy of flow classification and control, poor control strategy adaptability and low operation stability, and to propose a flow control method based on a neural network.

[0006] The purpose of the present application can be realized by the following technical solutions:

[0007] The flow control method based on the neural network comprises:

[0008] S1, standardization feature dataset construction: deploying a data collector in a traditional network, a software defined network and a cloud native environment respectively, continuously capturing flow metadata containing five-tuple information and flow statistical information; slicing the flow metadata according to a fixed time interval, constructing a time series window; extracting four types of features of flow size, connection diversity, protocol behavior and advanced statistics for a single window; combining to form a fixed dimension feature vector in a pre-defined order, adding collection time and network environment type label, and generating a standardized feature dataset;

[0009] S2, flow data classification and prediction: based on the standardized feature dataset constructed in S1, a hybrid neural network architecture combining convolutional neural network and long short-term memory network is used to realize the classification and prediction of network flow data;

[0010] S3, differentiated traffic control strategy generation: based on the traffic classification and prediction results of S2, combined with the architecture characteristics of different network environments, a dynamically adaptive traffic control strategy system is constructed;

[0011] S4, strategy optimization and dynamic adjustment: based on the key feature weights output by the attention mechanism layer, the effectiveness of the issued strategy is evaluated in real time;

[0012] S5, policy implementation and effect evaluation: the control strategy generated by S4 is issued to the control interface of the corresponding network environment, and the implementation effect is monitored.

[0013] Further, the specific implementation steps of the S2 step include:

[0014] A hybrid neural network architecture is constructed, including:

[0015] Input layer processing: receiving a standardized feature dataset, stacking the feature vectors in the time series window into a three-dimensional tensor in chronological order;

[0016] Time series feature extraction: capturing the time dimension correlation of traffic data, based on a bidirectional long short-term memory network, outputting a hidden state sequence containing forward and backward time series correlation;

[0017] Spatial feature fusion: extract spatial correlation between feature dimensions, compress time dimension based on max pooling to get spatial feature matrix, and convert to spatial feature vector combined with flattening processing;

[0018] Attention weighted fusion: concatenate the time series and spatial feature vectors to form a fusion feature matrix, and get similarity scores based on parameterized queries; get attention weights by softmax function normalization, and generate global feature vectors combined with fusion feature matrix;

[0019] Output layer processing: using a softmax activation function to output network state classification results including normal, congestion, attack and abnormal connections;

[0020] Output traffic key indicators including PPS and BPS peak values, TCP connection establishment success rate and packet loss rate through linear regression analysis.

[0021] Further, the specific implementation steps of the S2 step also include:

[0022] Multi-dimensional analysis and cross-dimensional correlation verification are performed on the traffic pattern:

[0023] The trend intensity coefficient is obtained by the formula wherein, is the number of sampling points in the window, , represents the time index of the sampling points in the window, For the first in the window The feature values ​​of each sampling point Representing time indexes respectively The mean and standard deviation, Represents eigenvalues The mean and standard deviation;

[0024] If the trend strength coefficient is positive, it is determined to be an upward trend; if it is negative, it is a downward trend.

[0025] Based on the comparison between the absolute value of the trend strength coefficient and the preset range, it is determined to be a strong trend, a weak trend, or a stable state.

[0026] On a millisecond timescale, if the frequency trend strength coefficient of the SYN flag bit... If the value is consistently greater than the preset range and exceeds 3 windows, it is determined to be a period of intensive session establishment;

[0027] If the frequency trend strength coefficient of the FIN flag bit If the trend strength coefficient of the data packet arrival interval standard deviation exceeds the preset range and the data packet arrival interval standard deviation exceeds the threshold, it is judged as an abnormal trend of concentrated session disconnection.

[0028] On a minute-level timescale, if the PPS trend strength coefficient and BPS trend strength coefficient All values ​​are greater than the preset range, and the fluctuation in traffic rate exceeds twice the historical average, which is judged as a sudden traffic surge;

[0029] If the bandwidth utilization trend strength coefficient The bandwidth exceeds the preset range and lasts for more than 5 consecutive windows, taking into account the maximum capacity of the physical link in the network environment. This yields the probability of a congestion trend forming.

[0030] If the probability of a congestion trend exceeds a preset threshold, it is determined to be a high-probability congestion trend.

[0031] Furthermore, the specific steps for the cross-dimensional association verification are as follows:

[0032] When the trend strength coefficient of the TCP protocol proportion is positive and greater than the preset range (hereinafter referred to as strong positive value), and the trend strength coefficient of the diversity of source IP and destination IP is negative and greater than the preset range, combined with the local interaction characteristics of the TCP flag sequence, it is determined to be a potential TCP connection hijacking attack trend.

[0033] Extract the five-tuple information within the current time window and match it with the historical attack feature database. If the matching degree exceeds the preset threshold, the session tracking mechanism is triggered.

[0034] When the trend strength coefficients of traffic entropy, PPS, and BPS are all strongly positive, combined with cross-dimensional correlation characteristics, it is determined that the traffic coupling mode has changed drastically.

[0035] The time series correlation between abnormal TCP flag combinations and the number of bytes in burst traffic is obtained based on the Pearson coefficient. If the correlation is greater than a preset threshold, it is determined to be a characteristic combination of a distributed denial-of-service attack.

[0036] In traditional networks, when both bandwidth utilization and ICMP protocol proportion trend strength coefficient are greater than a preset range, ICMP flooding attacks can be identified by combining the distribution characteristics of ICMP message length.

[0037] In software-defined networking, when the trend strength coefficient of flow table entry update frequency shows an upward trend and the trend strength coefficient of source port diversity shows a downward trend, it is judged as a precursor to a flow table overflow attack.

[0038] Furthermore, the specific operation steps of step S3 are as follows:

[0039] Based on the network state classification results and traffic key indicator predictions output by S2, four types of general control actions are predefined: traffic shaping, session management, protocol intervention, and resource scheduling.

[0040] For traditional network environments: policy execution is based on the configuration interface of switches or routers, and control actions are translated into specific device command line instructions;

[0041] When the output layer is determined to be in a congested state and the probability of congestion trend is greater than a preset threshold, the generation rate limit and priority queue adjustment strategy are implemented.

[0042] When the output layer determines that it is in an attack state and identifies it as an ICMP flood attack, a protocol intervention strategy is generated.

[0043] For software-defined networking environments: policy enforcement is based on the northbound interface of the SDN controller; control actions are translated into NETCONF protocol messages;

[0044] When the output layer determines that the connection is abnormal and identifies it as a precursor to a flow table overflow attack, it generates a combined session management and resource scheduling strategy:

[0045] When trend analysis identifies a cluster of abnormal session disconnections, a session termination policy is generated.

[0046] Furthermore, the specific operation steps of S4 are as follows:

[0047] Through formula The policy suppression coefficient is obtained, where, These represent the values ​​before and after the strategy execution, respectively. The feature values ​​of each feature Indicates the first The weights of each feature in the attention mechanism The total number of features;

[0048] If the policy suppression coefficient is greater than the preset threshold, the policy is deemed effective; if the policy suppression coefficient is less than the preset threshold, the policy is deemed not to have met expectations, and the policy optimization process is triggered.

[0049] Based on the near-end policy optimization reinforcement learning algorithm, an optimization framework is constructed with the network state as the state space, the control action as the action space, and the policy inhibition coefficient as the reward function, including:

[0050] Construct a policy evaluation matrix: record the changes in feature vectors, attention weights, and policy inhibition coefficients before and after the historical policy execution;

[0051] Build a policy knowledge base: store effective policy combinations and corresponding policy suppression coefficients under different network conditions;

[0052] Strategy optimization decision: When the policy suppression coefficient is less than the preset threshold, the policy with the highest suppression coefficient under the same network state is retrieved from the policy knowledge base as the benchmark policy;

[0053] Dynamic action combination adjustment: When single strategy optimization still cannot achieve the expected results, different types of control actions are combined, and the optimal combination is selected and executed based on the Q-learning algorithm.

[0054] Furthermore, the specific operation steps of S5 are as follows:

[0055] In traditional network environments, control policies are pushed to core switches or border routers through out-of-band management networks, and the policy transmission and execution triggering are completed using the SSH protocol.

[0056] In a software-defined environment, control policies are converted into flow table modification requests, which are sent to the SDN controller and the flow tables of all switches in the network are updated synchronously.

[0057] In a cloud-native environment, policies are injected into the virtual switch configuration file and reloaded to take effect via the container orchestration platform API.

[0058] The data collector collects traffic metadata after the strategy is executed, generates a standardized dataset based on feature extraction, and obtains new classification results and predicted values ​​based on hybrid neural networks. If the predicted value exceeds the policy target deviation tolerance, a real-time alarm is triggered and an anomaly analysis report is generated.

[0059] Simultaneously, the evaluation results are input into the strategy evaluation matrix and knowledge base to update historical strategy execution records.

[0060] Compared with the prior art, the beneficial effects of the present invention are:

[0061] This invention captures traffic metadata from traditional networks, software-defined networks, and cloud-native environments by deploying multi-environment data collectors. It constructs a standardized feature dataset containing time-series windows and environment labels. A hybrid architecture combining convolutional neural networks and bidirectional long short-term memory networks is used to achieve deep fusion of traffic spatiotemporal features. An attention mechanism is introduced to weight key features to enhance the accuracy of anomaly identification and trend analysis. Differentiated traffic control strategies are generated based on the characteristics of different network environment architectures. The strategy parameters and action combinations are dynamically adjusted through a near-end strategy optimization reinforcement learning algorithm. This significantly improves the accuracy of network traffic state classification, the multi-environment adaptability of control strategies, and the stability of system operation. At the same time, it optimizes the response speed to traffic anomalies and the efficiency of network resource utilization. Attached Figure Description

[0062] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings;

[0063] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0064] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0065] It should be understood that the terms “comprising” and “including” used in this disclosure and claims indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0066] It should also be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this disclosure. As used in this disclosure and claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this disclosure and claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations.

[0067] like Figure 1As shown, this invention is a traffic control method based on neural networks, including the construction of a standardized feature dataset, traffic data classification and prediction, generation of differentiated traffic control strategies, strategy optimization and dynamic adjustment, and strategy execution and effect evaluation.

[0068] S1. Construction of Standardized Feature Dataset: By collecting network traffic data and extracting features from it, a standardized feature dataset is generated. The specific implementation process is as follows:

[0069] S101. Multi-environment traffic data collection: To address the architectural differences in different network environments, a unified frequency is used for differentiated data collection.

[0070] In traditional network environments: a copy of the traffic is replicated on the network's core switch or border router via port mirroring or a splitter and sent to the data collector, where:

[0071] Port mirroring: By configuring the device, the traffic of the target service port is copied to a preset monitoring port. The monitoring port is then connected to a dedicated data collector via a network cable to collect traffic data. Service ports include the aggregation ports of the core switch and the egress ports of the border router.

[0072] Optical splitter: A passive optical splitter connected in series in the optical link between a router and a switch, which passively replicates the optical signal traffic and transmits it to a dedicated data acquisition unit that supports optical signal reception to obtain traffic data.

[0073] In a software-defined networking environment: the SDN controller is configured as a data acquisition center; the SDN controller collects flow table statistics reported by all network switches through the southbound interface;

[0074] In a cloud-native environment: traffic data, including PodIP, service ports, and traffic statistics, is obtained from virtual switches through dedicated data collectors deployed on compute nodes or dedicated virtual machines;

[0075] S102. Traffic metadata definition and slicing:

[0076] The data collector continuously captures traffic metadata in different network environments at a preset collection frequency. The traffic metadata includes five-tuple information and traffic statistics. The five-tuple information includes the source IP address, destination IP address, source port number, destination port number, and transport layer protocol. The traffic statistics include packet length, packet arrival timestamp, and TCP flags.

[0077] Traffic metadata is sliced ​​based on fixed time intervals to construct time series windows, each containing 60 sampling points to ensure the continuity of time series features;

[0078] S103, Statistical Feature Extraction and Feature Vector Construction:

[0079] Four types of statistical features are extracted from all traffic metadata within a single time series window, including:

[0080] Traffic scale characteristics include bandwidth utilization, packet count per second (PPS), bytes per second (BPS), traffic rate fluctuation, and number of sessions;

[0081] Connection diversity characteristics include source IP and destination IP diversity, source port and destination port diversity, continuous duration distribution, and continuous state distribution;

[0082] Protocol behavior characteristics, including TCP, UDP, ICMP, and application layer protocols;

[0083] Advanced statistical features, including time series features, distribution features, correlation features, and entropy values;

[0084] The four statistical features are sorted according to a predefined order combination to form a fixed-dimensional feature vector, and data labels are added to generate a standardized feature dataset. The data labels include the collection time and network environment type.

[0085] S2. Traffic Data Classification and Prediction: Based on the standardized feature dataset constructed in S1, a hybrid neural network architecture combining convolutional neural networks and long short-term memory networks is used to classify and predict network traffic data. The specific implementation process is as follows:

[0086] S201. Neural Network Architecture Design: Addressing the differences in traffic characteristics between traditional networks, software-defined networks, and cloud-native environments, a hybrid neural network architecture combining convolutional neural networks and long short-term memory networks is adopted. This architecture includes an input layer, a temporal feature extraction unit, a spatial feature fusion unit, an attention mechanism layer, and an output layer. The functions and parameters of each layer are as follows:

[0087] Input layer: Receives fixed-dimensional feature vectors generated by S1, and stacks the feature vectors within the time series window into a three-dimensional tensor in chronological order. The three-dimensional tensor includes the window length, feature dimension, and number of channels.

[0088] Temporal feature extraction unit: captures the correlation of traffic data in the time dimension, including the periodicity of packet arrival interval and the trend of traffic scale changes; after processing by a 3-layer bidirectional long short-term memory network, the output is a hidden state sequence containing forward and backward temporal correlations;

[0089] Spatial Feature Fusion Unit: A two-layer convolutional neural network is used to extract spatial relationships between feature dimensions. The first layer uses 32 convolutional kernels of size 3 to capture local feature interactions, with an output dimension of 300×32. The second layer uses 64 convolutional kernels of size 5 to capture cross-dimensional relationships, with an output dimension of 300×64. After compressing the time dimension based on max pooling, a spatial feature matrix is ​​obtained, which is then converted into a 9600-dimensional spatial feature vector through flattening.

[0090] Attention mechanism layer: It assigns weights to the fusion results of temporal and spatial features, strengthens the influence weight of key features, and suppresses the interference of noise features; key features include abnormal TCP flag combinations and changes in the number of bytes in burst traffic;

[0091] The hidden state sequence output by the temporal feature extraction unit is compressed into a 128-dimensional temporal feature vector through global average pooling, and then concatenated with the 9600-dimensional spatial feature vector output by the spatial feature fusion unit to form a 9728-dimensional fusion feature matrix.

[0092] Similarity scores are obtained based on parameterized queries and fused feature matrices. Attention weights are obtained by softmax normalization. The global feature vector is obtained by weighted summation of the fused feature matrix and attention weights.

[0093] Output layer: The softmax activation function is used to output the network state classification results and the predicted values ​​of key traffic indicators. The network classification results include normal, congested, attack, and abnormal connections.

[0094] At the same time, key traffic indicators are output through linear regression analysis, including peak PPS, peak BPS, average packet length, TCP connection establishment success rate, and packet loss rate.

[0095] Normalization of the standardized feature dataset is performed based on Min-Max normalization, mapping the feature values ​​to... interval;

[0096] The normalized dataset is divided into a training set and a test set according to a preset ratio. The training set is used for parameter iteration of the hybrid neural network, and the test set is used to evaluate the generalization ability of the hybrid neural network.

[0097] S202. Traffic Trend Analysis: Based on the hidden state sequence output by the bidirectional long short-term memory network, the spatial feature vector output by the convolutional neural network, and the attention weights, a multi-dimensional analysis of traffic patterns is performed. The specific implementation process is as follows:

[0098] S202.1 Trend Intensity Analysis:

[0099] The hidden state sequence output by the temporal feature extraction unit is decomposed along the time dimension. By matching the time-series pattern with a sliding window slice, traffic trend features at different time scales are identified, and then expressed using a formula. The trend strength coefficient is calculated, where, This represents the number of sampling points within the window. This represents the time index of the sampling point within the window. For the first in the window The feature values ​​of each sampling point Representing time indexes respectively The mean and standard deviation, Represents eigenvalues The mean and standard deviation;

[0100] If the trend strength coefficient is positive, the characteristic value shows an upward trend over time; if it is negative, the characteristic value shows a downward trend over time.

[0101] When the absolute value of the trend strength coefficient is greater than the preset range, it is determined to be a strong trend; when the absolute value of the trend strength coefficient is within the preset range, it is determined to be a weak trend; when the absolute value of the trend strength coefficient is less than the preset range, it is determined to be a stable state.

[0102] S202.2, Trend Analysis by Time Scale:

[0103] On a millisecond timescale, with W as the window width and S as the sliding step size, the hidden state of the packet arrival interval and the TCP flag sequence is analyzed:

[0104] The trend strength coefficient is calculated based on the formula for the frequency of occurrence of the SYN flag and the FIN flag within the window. and ,like If the value exceeds the preset range and persists for more than three consecutive windows, it is considered a period of intensive session establishment; if If the trend strength coefficient is greater than the preset range and the standard deviation of the data packet arrival interval is greater than the preset threshold, it is identified as an abnormal trend of concentrated session disconnection.

[0105] On a minute-level timescale, using W as the window width and S as the sliding step size, the trend of traffic volume characteristics is analyzed:

[0106] The trend strength coefficients of PPS, BPS, and bandwidth utilization were calculated based on the trend strength coefficient formula. , and ,like Greater than the preset range and If traffic surges occur simultaneously within a preset range, and the corresponding window's traffic rate fluctuation characteristic value exceeds twice the historical average, it is determined to be a sudden traffic surge; if If the bandwidth exceeds the preset range and persists for more than 5 consecutive windows, combined with the maximum bandwidth of the physical link in the current network environment... Predicting the probability of congestion trends forming using the formula The congestion trend probability is calculated, where, This indicates the actual bandwidth utilization of the current window. express The number of consecutive windows exceeding the preset interval. A threshold representing the number of windows indicating a continuing trend. These represent the ratio of actual bandwidth utilization to maximum carrying bandwidth, the ratio of the number of consecutive windows to the window number threshold, and the influence weighting factor of the trend strength coefficient, respectively.

[0107] When the probability of a congestion trend is greater than a preset threshold, it is determined to be a high probability congestion trend, triggering traffic warning control and simultaneously outputting the expected congestion time window;

[0108] S202.3, Cross-dimensional correlation verification:

[0109] Correlation between protocol behavior and connection diversity features: If the trend strength coefficient of the TCP protocol proportion in the protocol behavior features is positive and greater than the preset range (hereinafter referred to as strong positive value), and at the same time, the trend strength coefficient of the source IP and destination IP diversity in the connection diversity features is negative and greater than the preset range (hereinafter referred to as strong negative value), combined with the local interaction features of the TCP flag sequence extracted by the convolutional neural network, it is determined to be a potential TCP connection hijacking attack trend; extract the five-tuple information in the current window and perform pattern matching with the historical attack feature database. If the matching degree exceeds the preset threshold, the session tracking mechanism is triggered.

[0110] Correlation between advanced statistics and flow scale characteristics: If the trend strength coefficient of flow entropy is strongly positive, and the trend strength coefficients of PPS and BPS are both strongly positive, combined with the cross-dimensional correlation characteristics in the spatial feature matrix, it is determined to be a drastic change in the flow coupling mode.

[0111] Cross-validation of key features based on attention weights: The weight values ​​output by the attention mechanism layer are used as feature importance indicators. Cross-category correlation analysis is performed on the top 20% of features by weight. When abnormal TCP flag combinations and changes in the number of bytes in burst traffic occur simultaneously, and the corresponding trend strength coefficients are both strongly positive, the time series correlation between abnormal TCP flag combinations and the number of bytes in burst traffic is obtained through the Pearson coefficient. If the correlation is greater than a preset threshold, it is determined to be a feature combination of a distributed denial-of-service attack.

[0112] For traditional network environments, the traffic scale characteristics and protocol behavior characteristics of associated port mirroring collection are as follows:

[0113] When both the bandwidth utilization trend strength coefficient and the ICMP protocol proportion trend strength coefficient are greater than the preset range, ICMP flooding attacks are identified by combining the distribution characteristics of ICMP message length in the spatial feature vector.

[0114] In a software-defined networking environment, the flow table statistics collected by the SDN controller are correlated with the trend strength coefficient of the flow table entry update frequency and the connection diversity characteristics. If the flow table entry update frequency shows an upward trend and the source port diversity shows a downward trend, it is judged as a precursor to a flow table overflow attack.

[0115] Based on the results of cross-dimensional correlation analysis, a traffic pattern profile with multi-feature collaboration is generated.

[0116] S3. Generation of Differentiated Traffic Control Policies: Based on the traffic analysis and prediction results of S2, and combined with the architectural characteristics of different network environments, a dynamically adaptable traffic control policy system is constructed. The specific implementation process is as follows:

[0117] S301, Construction of the General Control Action Library: Based on the network state classification results and traffic key indicator predictions output by S2, four types of general control actions are predefined, including:

[0118] Traffic shaping actions include rate limiting, priority queue adjustment, dynamic window size setting, and burst traffic absorption.

[0119] Session management actions include session termination, session rate limiting, session entry aging time adjustment, and blacklist and whitelist updates.

[0120] Protocol intervention actions include protocol traffic filtering, protocol priority adjustment, TCP flag check strengthening, and ICMP request-response strategies.

[0121] Resource scheduling actions include link load redistribution, elastic scaling of virtual network functions, and dynamic adjustment of caches and buffers;

[0122] S302, Environment Differentiation Strategy Mapping:

[0123] For traditional network environments: policy enforcement is based on the configuration interface of core switches or border routers; control actions are translated into specific device command-line instructions or SNMP configuration changes;

[0124] When the output layer determines that it is in a congested state and the probability of congestion trend is greater than the preset threshold, a rate limiting and priority queue adjustment strategy is generated: the limit threshold is calculated based on the peak PPS and peak BPS in the traffic scale characteristics; differentiated priorities are set based on the application layer protocol distribution in the protocol behavior characteristics; and the configuration is distributed to the core switch through an automated script.

[0125] When the output layer determines that the attack is in progress and identifies it as an ICMP flood attack, a protocol intervention strategy is generated: ICMP traffic filtering rules are deployed on the border router, feature matching is performed based on the source IP address and destination IP address in the five-tuple information, and blacklist update actions are triggered.

[0126] For software-defined networking environments: policy enforcement is based on the northbound interface of the SDN controller; control actions are translated into NETCONF protocol messages;

[0127] When the output layer determines that the connection is abnormal and identifies it as a precursor to a flow table overflow attack, it generates a combined session management and resource scheduling strategy:

[0128] The SDN controller issues incremental flow table entry aging policies to shorten the timeout time of inactive flow table entries; at the same time, based on flow table statistics, the switch flow table storage resource allocation is dynamically adjusted, and flow table discard rules are issued for abnormal source IPs.

[0129] When trend analysis identifies a session disconnection anomaly, a session termination policy is generated: the SDN controller sends a Flow-Mod message to the relevant switches to terminate the session that matches the anomaly 5-tuple information.

[0130] For cloud-native environments: policy enforcement is based on container network interfaces or service mesh control planes; control actions are translated into iptables rules, Envoy filter configurations, or custom resource definitions;

[0131] When the output layer determines that the state is abnormal and identifies a TCP connection hijacking attack trend, a combined strategy of protocol intervention and session management is generated: based on PodIP and service port information, TCP flag verification rules are deployed at the virtual switch level; at the same time, abnormal connections are terminated and session context is recorded through the service mesh sidecar proxy.

[0132] When traffic trend analysis identifies a sudden traffic surge, a resource scheduling strategy is generated: based on the virtualization infrastructure interface, the relevant Pod instances are elastically scaled up or down, or the queue cache size of the virtual switch is adjusted.

[0133] S4. Strategy Optimization and Dynamic Adjustment: Based on the key feature weights output by the attention mechanism layer, the effectiveness of the issued strategy is evaluated in real time. The specific operation steps are as follows:

[0134] By continuously monitoring the changes in feature vectors after the strategy is executed, and through the formula The policy suppression coefficient is calculated, where, These represent the values ​​before and after the strategy execution, respectively. The feature values ​​of each feature Indicates the first The weights of each feature in the attention mechanism The total number of features;

[0135] If the policy suppression coefficient is greater than the preset threshold, the policy is deemed effective; if the policy suppression coefficient is less than the preset threshold, the policy is deemed not to have met expectations, and the policy optimization process is triggered.

[0136] Based on the near-end policy optimization reinforcement learning algorithm, an optimization framework is constructed with network state as the state space, control actions as the action space, and policy suppression coefficient as the reward function. By combining historical policy databases and real-time network state, the control action parameters are dynamically adjusted or action combinations are switched. The construction process of the optimization framework is as follows:

[0137] Construct a policy evaluation matrix: record the changes in feature vectors, attention weights, and policy inhibition coefficients before and after the historical policy execution;

[0138] Build a policy knowledge base: store effective policy combinations and corresponding policy suppression coefficients under different network conditions;

[0139] Strategy optimization decision: When the policy inhibition coefficient is less than the preset threshold, the policy with the highest inhibition coefficient under the same network state is retrieved from the policy knowledge base as the benchmark policy. The action parameters are then fine-tuned using the policy gradient algorithm to generate an optimized policy.

[0140] Dynamic action combination adjustment: When single strategy optimization still cannot achieve the expected results, an integrated strategy approach is adopted to combine different types of control actions. The long-term benefits of the action combination are evaluated based on the Q-learning algorithm, and the optimal combination is selected for execution.

[0141] S5. Policy Execution and Effect Evaluation: This step distributes the control policies generated in S4 to the control interfaces of the corresponding network environment and monitors the implementation effect. The specific implementation process is as follows:

[0142] S501, Strategy Issuance and Execution:

[0143] For traditional network environments, control policies are pushed to the management interfaces of core switches or border routers through out-of-band management networks, and the SSH protocol is used to complete policy transmission and execution triggering.

[0144] In a software-defined network environment, control policies are converted into flow table modification requests and sent to the SDN controller via the southbound interface. The SDN controller then performs flow table synchronization updates for all switches in the network.

[0145] In a cloud-native environment, control policies are injected into the configuration file of the virtual switch through the API interface of the container orchestration platform, and configuration reload is triggered to take effect;

[0146] S502, Strategy Effectiveness Evaluation:

[0147] Based on the traffic metadata collected by the data collector after the strategy is executed, the newly collected traffic metadata is input into the feature extraction process to generate a standardized feature dataset after the strategy is executed, and then evaluated based on a hybrid neural network to obtain new classification results and predicted values.

[0148] If the predicted value exceeds the preset deviation tolerance range of the strategy target, a real-time alarm will be triggered and an anomaly analysis report will be generated. The alarm information will be displayed through the visualization interface of the integrated management platform and pushed to network operation and maintenance personnel through the message interface. The anomaly analysis report includes the anomaly strategy ID, trigger timestamp, anomaly prediction indicators and deviation values, as well as the associated network environment type and device information.

[0149] At the same time, the strategy evaluation results are input into the strategy evaluation matrix and strategy knowledge base established by S4 to update the historical strategy execution records.

[0150] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A method of flow control based on neural networks, characterized in that, Comprise: S1, standardized feature dataset construction: deploy data collectors in traditional networks, software-defined networks, and cloud-native environments to continuously capture traffic metadata containing five-tuple information and traffic statistics; slice the traffic metadata at fixed time intervals to construct time series windows; extract four types of features: traffic size, connection diversity, protocol behavior, and advanced statistics, from individual windows; Combine in a predefined order to form a fixed-dimensional feature vector, add collection time and network environment type labels, and generate a standardized feature dataset; S2, traffic data classification and prediction: based on the standardized feature dataset constructed in S1, a hybrid neural network architecture combining convolutional neural networks and long short-term memory networks is used to realize the classification and prediction of network traffic data; S3, differential traffic control strategy generation: based on the traffic classification and prediction results of S2, combined with the architecture characteristics of different network environments, a dynamically adaptive traffic control strategy system is constructed; S4, strategy optimization and dynamic adjustment: based on the key feature weights output by the attention mechanism layer, the effectiveness of the issued strategy is evaluated in real time; When the strategy does not meet expectations, trigger strategy optimization; S5, strategy execution and effect evaluation: the control strategy generated in S4 is issued to the control interface of the corresponding network environment, and the implementation effect is monitored; The specific implementation steps of the S2 step further comprise: Multi-dimensional analysis and cross-dimensional correlation verification of traffic patterns: The trend intensity coefficient is obtained by formula wherein, is the number of sampling points in the window, represents the time index of the sampling points in the window, is the feature value of the sampling point in the window, respectively represents the mean and the standard deviation of the time index , and represents the mean and the standard deviation of the feature value . If the trend intensity coefficient is positive, it is determined to be an upward trend, and if it is negative, it is determined to be a downward trend; Based on the comparison of the absolute value of the trend intensity coefficient and the preset interval, it is determined to be a strong trend, a weak trend, or a stable state; If the frequency trend intensity coefficient of the SYN flag bit is greater than 0.5 on the millisecond time scale If the duration is greater than the preset interval and exceeds 3 windows, it is determined as a session establishment intensive period. If the frequency trend strength coefficient of the FIN flag bit If the trend strength coefficient of the data packet arrival interval standard deviation exceeds the preset range and the data packet arrival interval standard deviation exceeds the threshold, it is judged as an abnormal trend of concentrated session disconnection. If the PPS trend intensity coefficient and the BPS trend intensity coefficient are both greater than a preset interval, and the flow rate fluctuation exceeds twice the historical average, the burst flow impact is determined. Bandwidth utilization trend intensity coefficient The maximum carrying bandwidth of the physical link of the network environment is greater than the preset interval and lasts for more than 5 windows The formation probability of the congestion trend is obtained. If the congestion trend probability exceeds the preset threshold, it is determined to be a high probability of congestion trend.

2. The neural network-based flow control method of claim 1, wherein, The specific implementation steps of the S2 step include: Construct a hybrid neural network architecture, including: Input layer processing: receive the standardized feature dataset, and stack the feature vectors in the time series window into a three-dimensional tensor in time order; Time series feature extraction: capture the time dimension correlation of traffic data, based on bidirectional long short-term memory network, output hidden state sequence containing forward and backward time series correlation; Spatial feature fusion: extract spatial correlation between feature dimensions, compress time dimension based on max pooling to get spatial feature matrix, and convert to spatial feature vector combined with flattening processing; Attention weighted fusion: concatenate the time series and spatial feature vectors to form a fusion feature matrix, and obtain similarity scores based on parameterized queries; get attention weights by softmax function normalization, and generate global feature vector combined with fusion feature matrix; Output layer processing: use softmax activation function to output network state classification results including normal, congestion, attack, and abnormal connection; Output traffic key indicators through linear regression analysis, including PPS and BPS peak values, TCP connection establishment success rate, and packet loss rate.

3. The neural network-based flow control method of claim 1, wherein, The specific operation steps of the cross-dimensional correlation verification are as follows: When the trend intensity coefficient of the TCP protocol proportion is a positive value and greater than a preset interval (hereinafter referred to as a strong positive value), and the trend intensity coefficient of the source IP and destination IP diversity is a negative value and greater than a preset interval, and in combination with the local interaction features of the TCP flag sequence, it is determined that there is a potential TCP connection hijacking attack trend; The quintuple information in the current time window is extracted, and is matched with the historical attack feature library. If the matching degree exceeds a preset threshold, the session tracking mechanism is triggered; When the trend intensity coefficients of the traffic entropy value, PPS and BPS are all strong positive values, in combination with the cross-dimension association features, it is determined that the traffic coupling mode changes dramatically; Based on the Pearson coefficient, the time sequence correlation of the abnormal TCP flag combination and the byte number of the burst traffic is obtained. If the correlation is greater than a preset threshold, it is determined that there is a feature combination of a distributed denial of service attack; In a traditional network, when the trend intensity coefficients of the bandwidth utilization rate and the ICMP protocol proportion are both greater than a preset interval, in combination with the distribution features of the ICMP message length, an ICMP flooding attack is identified. In a software defined network, when the trend intensity coefficient of the flow table item update frequency shows an upward trend and the trend intensity coefficient of the source port diversity shows a downward trend, it is determined that there is a precursor of a flow table overflow attack.

4. The neural network-based flow control method of claim 1, wherein, The specific operation steps of the S3 step are as follows: Based on the network state classification result and the traffic key indicator prediction value output by S2, four general control actions of traffic shaping, session management, protocol intervention and resource scheduling are predefined; For a traditional network environment: policy execution is based on the configuration interface of a switch or a router, and the control action is converted into a specific device command line instruction; When the output layer is determined to be in a congestion state and the congestion trend probability is greater than a preset threshold, a rate limit and a priority queue adjustment strategy is generated; When the output layer is determined to be in an attack state and an ICMP flooding attack is identified, a protocol intervention strategy is generated; For a software defined network environment: policy execution is based on the northbound interface of an SDN controller; and the control action is converted into a NETCONF protocol message; When the output layer is determined to be in an abnormal connection state and a precursor of a flow table overflow attack is identified, a combined strategy of session management and resource scheduling is generated: When the trend analysis identifies a session concentration disconnection anomaly, a session termination strategy is generated.

5. The neural network-based flow control method of claim 1, wherein, The specific operation steps of the S4 are as follows: The policy inhibition coefficient is obtained by formula wherein, respectively represent the feature values of the first characteristics before and after the policy execution, represent the weights of the first characteristics in the attention mechanism, is the total number of characteristics; If the policy suppression coefficient is greater than a preset threshold, it is determined that the policy is effective. If the policy suppression coefficient is less than a preset threshold, it is determined that the policy does not meet the expectation, and a policy optimization process is triggered: Based on the near-end policy optimization reinforcement learning algorithm, an optimization framework is constructed, taking the network state as the state space, the control action as the action space and the policy suppression coefficient as the reward function, including: A policy evaluation matrix is constructed: the feature vector change amount, the attention weight and the policy suppression coefficient before and after the historical policy execution are recorded; A policy knowledge base is constructed: the effective policy combination and the corresponding policy suppression coefficient under different network states are stored; Policy optimization decision: when the policy suppression coefficient is less than a preset threshold, the policy with the highest suppression coefficient under the same network state is retrieved from the policy knowledge base as the benchmark policy. Dynamic action combination adjustment: when single policy optimization still cannot achieve the expected effect, combine different categories of control actions, and select the optimal combination based on the Q learning algorithm.

6. The neural network-based flow control method of claim 1, wherein, The specific operation steps of S5 are as follows: In the traditional network environment, the control policy is pushed to the core switch or border router through the out-of-band management network, and the policy transmission and execution trigger are completed through the SSH protocol; In the software-defined environment, the control policy is converted into a flow table modification request and sent to the SDN controller, and the switch flow table of the whole network is updated synchronously; In the cloud-native environment, through the container orchestration platform API interface, the policy is injected into the virtual switch configuration file and triggered to reload and take effect; The data collector collects the traffic metadata after the policy is executed, generates a standardized dataset based on feature extraction, and evaluates the new classification results and prediction values based on a hybrid neural network; If the prediction value deviates from the policy target by more than the tolerance limit, trigger real-time alarms and generate abnormal analysis reports; At the same time, input the evaluation results into the policy evaluation matrix and knowledge base, and update the historical policy execution records.

Images