Pull flow behavior processing method and device, computer program product and electronic equipment

Abstract

The invention discloses a pull flow behavior processing method and device, a computer program product and electronic equipment. The method comprises the following steps: acquiring flow data generated when a plurality of users execute a plurality of file transmission events in a preset time period; determining a first impurity of the number of sending times of the content request packets among the source and destination IP addresses of the plurality of users and a second impurity of the size of the pulled file according to the plurality of traffic data; traversing each user, determining a total traffic power law distribution parameter and a head traffic power law distribution parameter of the current user based on the first impurity and the second impurity, and determining a pull flow behavior type of the current user based on the total traffic power law distribution parameter and the head traffic power law distribution parameter, and executing a corresponding pull stream processing operation on the current user according to the pull stream behavior type. According to the method and the device, the technical problem of relatively low accuracy of identifying complex abnormal pulling behavior in related technologies is solved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a method and apparatus for handling traffic-pushing behavior, a computer program product, and an electronic device. Background Technology

[0002] In the telecommunications industry, criminals fabricate cross-provincial traffic by repeatedly fetching and transferring large files between nodes in their own resource pools, thus recording it as revenue. To analyze this abnormal traffic-fetching behavior, relevant personnel typically use the following two methods:

[0003] (1) Identify users with abnormal traffic pulling behavior by comparing thresholds of a single indicator, such as the concentration of traffic between IP addresses or the bitrate of file transfer sizes. However, this method fails to deeply analyze the multi-dimensional correlation of file transfer behavior and is difficult to accurately determine the root cause of abnormal traffic, especially when data is concentrated in the repeated transmission of a few large files.

[0004] (2) Identifying users with abnormal traffic-pushing behavior by using the power-law distribution characteristics of user data, such as the power-law distribution characteristics of uplink traffic data and downlink traffic data. However, this method does not reflect the degree of difference between the head traffic data and the tail traffic data at the user granularity, resulting in a lack of sensitivity when identifying behaviors that forge traffic by repeatedly transmitting large files. It is easy to misjudge such abnormal traffic as normal traffic, thereby weakening the effectiveness of fraudulent traffic identification.

[0005] There is currently no effective solution to the above problems. Summary of the Invention

[0006] This application provides a method and apparatus for handling pull-up behavior, a computer program product, and an electronic device, to at least solve the technical problem of low accuracy in identifying complex abnormal pull-up behavior in related technologies.

[0007] According to one aspect of the embodiments of this application, a method for handling pull traffic behavior is provided, comprising: acquiring traffic data generated by multiple users when each performs multiple file transfer events within a preset time period, wherein the traffic data includes at least: the number of times the corresponding user sends content request packets from the source Internet Protocol IP address to the destination IP address, the file size of the target type file pulled from the content response packet corresponding to the content request packet returned by the corresponding user from the destination IP address, and the file size of the target type file is greater than a first threshold value; determining a first impurity of the number of times content request packets are sent between the source and destination IP addresses of the multiple users and a second impurity of the pulled file size based on the multiple traffic data; traversing each user, determining the full traffic power-law distribution parameters and the header traffic power-law distribution parameters of the current user based on the first impurity and the second impurity, determining the pull traffic behavior type of the current user based on the full traffic power-law distribution parameters and the header traffic power-law distribution parameters, and performing corresponding pull traffic handling operations on the current user according to the pull traffic behavior type.

[0008] Optionally, determining the first impurity of the number of content request packets sent between the source and destination IP addresses of multiple users and the second impurity of the file size retrieved based on multiple traffic data includes: parsing each traffic data to obtain the number of content request packets sent and the file size retrieved when each user executes a corresponding file transfer event; determining a first probability value for the number of content request packets sent based on the number of content request packets sent for each file transfer event, and determining the first impurity of the number of content request packets sent between the source and destination IP addresses of multiple users based on the first probability value; determining a second probability value for the file size retrieved based on the file size retrieved for each file transfer event, and determining the second impurity of the file size retrieved between the source and destination IP addresses of multiple users based on the second probability value.

[0009] Optionally, after determining the first impurity of the number of content request packets sent between the source and destination IP addresses of multiple users and the second impurity of the file size retrieved based on multiple traffic data, the method further includes: determining the comprehensive impurity of the traffic data between the source and destination IP addresses of multiple users based on the first probability value of the number of content request packets sent and the second probability value of the file size retrieved.

[0010] Optionally, the full traffic power-law distribution parameters and header traffic power-law distribution parameters of the current user are determined based on the first impurity and the second impurity, including: determining the first total quantity of traffic data generated by the current user executing multiple file transfer events within a preset time period, and determining the minimum number of content request packets sent and the minimum file size pulled among all traffic data of the current user within the preset time period; and determining the full traffic power-law distribution parameters of the current user according to the following formula based on the minimum number of content request packets sent, the minimum file size pulled, the first total quantity, the first impurity, the second impurity, and the combined impurity:

[0011]

[0012] In the formula, αw 全 Let G represent the power-law distribution parameters of the current user's total traffic, where n1 represents the first total number, and G represents the total number of users. w G represents the overall impurity. r G represents the first degree of impurity. f Indicates the second degree of impurity, r i N represents the number of content request packets sent by the current user in the i-th traffic data within a preset time period. i This represents the file size retrieved by the current user in the i-th data stream within a preset time period, r. m N represents the minimum number of content request packets to send. m This represents the minimum file size to be fetched. The number of content request packets sent and the file size to be fetched from multiple traffic data points within a preset time period for the current user are sorted in descending order. The first number of header content request packets sent and the first number of header file sizes to be fetched from the sorted results are then determined. Based on the minimum number of content request packets sent, the minimum file size to be fetched, the first number, the first impurity, the second impurity, and the overall impurity, the power-law distribution parameters of the current user's header traffic are determined according to the following formula:

[0013]

[0014] In the formula, αw 头 n represents the power-law distribution parameter of the current user's header traffic. ′ 1 represents the first quantity, r i ′ N represents the number of times the header content request packet is sent in the i-th header traffic data of the current user within a preset time period. i ′ This indicates the size of the header file retrieved by the current user in the i-th header traffic data within the preset time period.

[0015] Optionally, the pull-up behavior type includes: normal pull-up behavior and abnormal pull-up behavior. Determining the current user's pull-up behavior type based on the full traffic power-law distribution parameters and the head traffic power-law distribution parameters includes: calculating the difference between the full traffic power-law distribution parameters and the head traffic power-law distribution parameters, using this difference as the current user's tail traffic power-law distribution parameters; calculating the ratio between the tail traffic power-law distribution parameters and the head traffic power-law distribution parameters; determining the current user's pull-up behavior type as abnormal pull-up behavior when the ratio is greater than a second threshold; and determining the current user's pull-up behavior type as normal pull-up behavior when the ratio is not greater than the second threshold.

[0016] Optionally, the pull-stream processing operation includes at least: adjusting the cache hit rate of the content request packet, wherein the corresponding pull-stream processing operation is performed on the current user according to the pull-stream behavior type, including: determining the cache hit rate of the content request packet sent by the current user; when the current user's pull-stream behavior type is normal pull-stream behavior, adjusting the cache hit rate with the result obtained by taking the logarithm of the quotient of the tail traffic power-law distribution parameter obtained by the difference between the full traffic power-law distribution parameter and the header traffic power-law distribution parameter, with base 2; when the current user's pull-stream behavior type is abnormal pull-stream behavior, adjusting the cache hit rate with the result obtained by taking the logarithm of the quotient of the tail traffic power-law distribution parameter obtained by the difference between the header traffic power-law distribution parameter and the full traffic power-law distribution parameter, with base 2.

[0017] Optionally, the pull-stream processing operation further includes: adjusting the file size of repeatedly pulling the same target type file in the content response packet. Specifically, performing the corresponding pull-stream processing operation for the current user based on the pull-stream behavior type further includes: determining the file size of repeatedly pulling the same target type file from the content response packet returned by the destination IP address after the current user performs cache hit rate adjustment on the content request packet; when the current user's pull-stream behavior type is normal, adjusting the file size using the quotient of the tail traffic power-law distribution parameter obtained by the difference between the full traffic power-law distribution parameter and the header traffic power-law distribution parameter; when the current user's pull-stream behavior type is abnormal, adjusting the file size using the quotient of the header traffic power-law distribution parameter and the full traffic power-law distribution parameter.

[0018] According to another aspect of the embodiments of this application, a pull-stream behavior processing device is also provided, comprising: an acquisition module, configured to acquire traffic data generated by multiple users when each performs multiple file transfer events within a preset time period, wherein the traffic data includes at least: the number of times the corresponding user sends content request packets from the source Internet Protocol IP address to the destination IP address, and the file size of the target type file pulled from the content response packet corresponding to the content request packet returned by the corresponding user from the destination IP address, and the file size of the target type file is greater than a first threshold value; a first determination module, configured to determine a first impurity of the number of times the content request packets are sent between the source and destination IP addresses of the multiple users and a second impurity of the pulled file size based on the multiple traffic data; and a second determination module, configured to traverse each user, determine the full traffic power-law distribution parameters and the header traffic power-law distribution parameters of the current user based on the first impurity and the second impurity, determine the pull-stream behavior type of the current user based on the full traffic power-law distribution parameters and the header traffic power-law distribution parameters, and perform corresponding pull-stream processing operations on the current user according to the pull-stream behavior type.

[0019] According to another aspect of the embodiments of this application, a computer program product is also provided, the computer program product comprising: a computer program, wherein the computer program, when executed by a processor, implements the above-described pull-flow behavior processing method.

[0020] According to another aspect of the embodiments of this application, an electronic device is also provided, the electronic device including: a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-described pull-flow behavior processing method through the computer program.

[0021] In this embodiment, by analyzing the traffic data generated when multiple users execute multiple file transfer events within a preset time period, a first impurity of the number of content request packets sent between the source and destination IP addresses of the multiple users and a second impurity of the file size pulled are obtained. For each user, the power-law distribution parameters of the current user's total traffic and the power-law distribution parameters of the header traffic are determined based on the first and second impurities, and the nature of the current user's pull behavior is determined accordingly, so as to perform appropriate handling operations on the user. This precise identification and handling method not only improves the effectiveness of traffic management but also reduces interference with normal user services and ensures the healthy operation of the network environment. It thus solves the technical problem of low accuracy in identifying complex abnormal pull behaviors in related technologies. Attached Figure Description

[0022] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0023] Figure 1 This is a flowchart illustrating an optional pull-flow behavior handling method according to an embodiment of this application;

[0024] Figure 2 This is a schematic diagram of traffic data of an optional user 1 within a preset time period according to an embodiment of this application;

[0025] Figure 3 This is a schematic diagram of traffic data of an optional user A within a preset time period according to an embodiment of this application;

[0026] Figure 4 This is a schematic diagram of traffic data of an optional user B within a preset time period according to an embodiment of this application;

[0027] Figure 5 This is a schematic diagram of traffic data of an optional user C within a preset time period according to an embodiment of this application;

[0028] Figure 6 This is a schematic diagram of traffic data of an optional user A within a preset time period according to an embodiment of this application;

[0029] Figure 7 This is a schematic diagram of traffic data of an optional user B within a preset time period according to an embodiment of this application;

[0030] Figure 8 This is a schematic diagram of traffic data of an optional user C within a preset time period according to an embodiment of this application;

[0031] Figure 9 This is a schematic diagram of an optional pull-flow behavior disposal device according to an embodiment of this application;

[0032] Figure 10 This is a schematic diagram of the hardware structure of a computer terminal for implementing a pull-stream behavior processing method according to an embodiment of this application. Detailed Implementation

[0033] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0034] It should be noted that the terms "first," "second," etc., used in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0035] Example 1

[0036] According to an embodiment of this application, a method for handling pull-up behavior is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0037] Figure 1 This is a flowchart illustrating a method for handling pull-flow behavior according to an embodiment of this application, as shown below. Figure 1 As shown, the method includes the following steps:

[0038] Step S102: Obtain traffic data generated by multiple users when they execute multiple file transfer events within a preset time period. The traffic data includes at least: the number of times the corresponding user sends a content request packet from the source Internet Protocol IP address to the destination IP address, the file size of the target type file pulled by the corresponding user from the content response packet corresponding to the content request packet fed back by the destination IP address, and the file size of the target type file is greater than the first threshold value.

[0039] Step S104: Determine the first impurity of the number of content request packets sent between the source and destination IP addresses of multiple users and the second impurity of the file size to be pulled based on multiple traffic data.

[0040] Step S106: Traverse each user, determine the full traffic power-law distribution parameters and header traffic power-law distribution parameters of the current user based on the first impurity and the second impurity, and determine the current user's pull traffic behavior type based on the full traffic power-law distribution parameters and the header traffic power-law distribution parameters, and perform corresponding pull traffic processing operations on the current user according to the pull traffic behavior type.

[0041] Based on the solutions defined in steps S102 to S106 above, it can be understood that in this embodiment of the application,

[0042] By analyzing the traffic data generated by multiple users executing multiple file transfer events within a preset time period, the first impurity of the number of content request packets sent between the source and destination IP addresses of multiple users and the second impurity of the file size pulled are obtained. For each user, the power-law distribution parameters of the current user's total traffic and header traffic are determined based on the first and second impurities. This information is then used to determine the nature of the current user's traffic pulling behavior, allowing for appropriate actions to be taken, such as limiting bandwidth, adjusting caching strategies, or implementing other security measures. This precise identification and handling method not only improves the effectiveness of traffic management but also reduces interference with normal user services, ensuring the healthy operation of the network environment.

[0043] The following section explains each step of the method for handling traffic violations, using a specific implementation process as an example.

[0044] In the technical solution provided in step S102 above, the system can first collect multiple traffic data generated when multiple users each execute file transfer events within a preset time period. Each traffic data includes: the source IP address of the corresponding user (denoted as IP). src Destination IP address (denoted as IP) det The system includes the following information: the record of sending Content Request Packets (CRPs) (including at least the number of times they were sent), and the file information (including at least the file size) of the target type file retrieved from the Content Response Packet (CRP_response) corresponding to the Content Request Packet returned by the user from the destination IP address. The file size of the target type file is greater than the first threshold value, that is, the target type file is a large file.

[0045] In the technical solution provided in step S104 above, the system can determine the first impurity of the number of content request packets sent between the source and destination IP addresses of multiple users and the second impurity of the file size retrieved between the source and destination IP addresses of multiple users based on multiple traffic data.

[0046] Alternatively, the first and second impurities mentioned above can be determined as follows:

[0047] Step 1: Analyze each traffic data point to obtain the number of content request packets sent and the size of the files pulled when each user executes the corresponding file transfer event.

[0048] The technical solution provided in the first step above can be understood as follows: the system parses the collected traffic data and counts the traffic data within a preset time period to obtain the number of times each user sends a content request packet from the source IP address to the destination IP address when executing a file transfer event, and the file size of the target type file pulled from the content response packet returned by the destination IP address.

[0049] Step 2: Based on the number of content request packets sent corresponding to each file transfer event, determine the first probability value of the number of times each content request packet is sent, and based on the first probability value, determine the first impurity of the number of times content request packets are sent between the source and destination IP addresses of multiple users. Its expression can be written as:

[0050]

[0051] In the formula, n2 represents the second total amount of traffic data generated by multiple users performing multiple file transfer events, P(r i ) represents the first probability value of the number of times the content request packet is sent in the i-th traffic data, and r i r represents the number of times the content request packet in the i-th traffic data is sent. 总 This represents the total number of times content request packets for n2 data streams were sent.

[0052] Therefore, the first impurity of the number of content request packets sent between the source and destination IP addresses is used to measure the uniformity or concentration of the data by calculating the impurity of the probability distribution of the number of different content request packets sent in the total number of content request packets sent. A higher first impurity indicates a lower concentration (i.e., more dispersed) in the number of traffic transmissions between the source and destination IP addresses of multiple users; conversely, a lower first impurity indicates a higher concentration (i.e., more concentrated) in the number of traffic transmissions between the source and destination IP addresses of multiple users.

[0053] Step 3: Based on the file size retrieved for each file transfer event, determine the second probability value for each retrieved file size, and based on the second probability value, determine the second impurity of file size retrieval between multiple users' source and destination IP addresses. The expression can be written as:

[0054]

[0055] In the formula, n2 represents the second total amount of traffic data generated by multiple users performing multiple file transfer events, N i denoted as the file size of the target type file retrieved from the content response packet corresponding to the content request packet in the i-th traffic data (i.e., the size of the retrieved file in the i-th traffic data), and N represents the total size of the retrieved files for n2 traffic data.

[0056] Therefore, the second impurity measures the uniformity or concentration of data by calculating the impurity of the probability distribution of different file sizes in the population. A higher second impurity indicates a lower concentration (i.e., more dispersed) of file sizes among the source and destination IP addresses of multiple users; conversely, a lower second impurity indicates a higher concentration (i.e., more concentrated) of file sizes among the source and destination IP addresses of multiple users.

[0057] Furthermore, the system can also determine the overall impurity of traffic data between the source and destination IP addresses of multiple users based on the first probability value of the number of times each content request packet is sent and the second probability value of the size of each fetched file. Therefore, the expression for overall impurity can be written as:

[0058]

[0059] It is easy to see from the above formula that the overall impurity is... As a weight, the size of the file transfer directly affects the impurity analysis of the number of sends.

[0060] The following will be Figure 2 Taking the traffic data of users A to C within a preset time period as an example, the calculation of the first impurity of the number of content request packets sent between the source and destination IP addresses of these users, the second impurity of the file size pulled, and the overall impurity are explained as follows.

[0061] like Figure 2 As shown, users A through C performed a total of 20 file transfer events within a preset time period (i.e., n² = 20), and the number of content request packets sent in the 20 data streams totaled 29 (i.e., r). 总 =29), and the total file size of the target type files is 23040Mb (i.e., N = 23040Mb). Therefore, the first probability of the number of times the content request packet is sent in each traffic data is r. i / r 总 (r i (where N is the number of content request packets sent in the i-th traffic data), and the second probability of fetching the file size in each traffic data is N. i / N(N i (where the size of the file retrieved is the i-th data stream).

[0062] Therefore, the expression for the first impurity of the number of content request packets sent between the source and destination IP addresses of users A to C can be written as:

[0063]

[0064] G r =1-[(0.034) 2+(0.034) 2 +(0.103) 2 +…+(0.069) 2 +(0.034) 2 ]≈0.942

[0065] The expression for the second impurity of the file size retrieved between the source and destination IP addresses of users A to C can be written as:

[0066]

[0067] G f =1-[(0.054) 2 +(0.054) 2 +(0.379) 2 +…+(0.108) 2 +(0.005) 2 ]≈0.771

[0068] The expression for the overall impurity of traffic data between multiple users' source and destination IP addresses can be written as:

[0069]

[0070] G w =1-[0.054·(0.034)] 2 +0.054·(0.034) 2 +0.379·(0.103) 2 +…+0.108·(0.069)2+0.005·(0.034)2]≈0.993

[0072] It should be noted that the system can also determine the strength of the association between the source and destination IP addresses of multiple users based on the first impurity, the second impurity, and the combined impurity. Specifically, the expression for the strength of the association can be written as:

[0073]

[0074] If R is less than 1, it means that there is a negative correlation between the two dimensions; if R is close to 1, it means that the concentration of the two dimensions is relatively independent; and if R is greater than 1, it means that there is a positive correlation between the two dimensions, that is, the transmission of large files accounts for a significant proportion of the traffic concentration. Therefore, the system can determine that there is false traffic data caused by the retransmission of large files in multiple traffic data within a preset time period.

[0075] In the technical solution provided in step S106 above, by iterating through each of the multiple users, the system can first determine the full traffic power-law distribution parameters and header traffic power-law distribution parameters of the current user based on the first impurity and the second impurity. The full traffic power-law distribution parameters reflect the distribution characteristics of file size or traffic size in all traffic data of the current user; while the header traffic power-law distribution parameters are the power-law distribution parameters followed by traffic records with particularly large file sizes or particularly frequent transmissions among multiple network traffic data. These represent the most influential large traffic events in the network, and therefore can reflect the distribution characteristics of the TOP-N largest file transfer records or the highest frequency transmission events, as well as their concentration in the overall traffic.

[0076] As an optional implementation, in the technical solution provided in step S104 above, the system can obtain the full traffic power-law distribution parameters and header traffic power-law distribution parameters of the source IP address according to the following method:

[0077] Step 1: Determine the first total number n1 of traffic data generated by the current user executing multiple file transfer events within the preset time period, and determine the minimum number of content request packets r sent by the current user among all traffic data within the preset time period. m and minimum file size N m .

[0078] Step 2: Send the minimum content request packet a certain number of times r m Minimum file size N to fetch m First total quantity n1, first impurity G r Second impurity G f and overall impurity G w The power-law distribution parameter αw of the current user's total traffic is determined according to the following formula. 全 :

[0079]

[0080] Therefore, the power-law distribution parameter αw of the total flow rate 全 It encompasses the power-law properties of all traffic data for the current user (whether it's head traffic or tail traffic).

[0081] Step 3: Sort the number of content request packets sent and the file size retrieved from multiple traffic data sets of the current user within a preset time period in descending order, and determine the first number n in the sorted results of the number of sent packets. ′ The first number n in the result of the number of times a content request packet is sent and the file size. ′ One file size to pull.

[0082] Step 5: Send the minimum content request packet a certain number of times r m Minimum file size N to fetch m First quantity n ′ 1. First impurity G r Second impurity G f and overall impurity G w The power-law distribution parameter αw of the current user's head traffic is determined according to the following formula. 头 :

[0083]

[0084] In the formula, r i ′ N represents the number of times the header content request packet is sent in the i-th header traffic data of the current user within a preset time period. i ′ This represents the size of the header file fetched by the current user in the i-th header traffic data within a preset time period. Therefore, the header traffic power-law distribution parameter αw... 头 It encompasses the power-law characteristics of the current user's header traffic transmission records, reflecting the distribution of frequent or large file transfer events.

[0085] Furthermore, in the technical solution provided in step S106 above, the system can also determine the current user's pull-up behavior type based on the full traffic power-law distribution parameters and the header traffic power-law distribution parameters. The pull-up behavior type includes: normal pull-up behavior and abnormal pull-up behavior.

[0086] As an optional implementation, in the technical solution provided in step S106 above, the system can determine the current user's pull behavior type according to the following method:

[0087] First, calculate the difference between the power-law distribution parameters of the total traffic and the head traffic, and use this difference as the tail traffic power-law distribution parameter for the current user. Therefore, the expression for the tail traffic power-law distribution parameter can be written as:

[0088] αw 尾 =αw 全 -αw 头

[0089] In the formula, αw 尾 This represents the power-law distribution parameter of the tail traffic for the current user. Therefore, the power-law distribution parameter of the tail traffic encompasses the power-law characteristics of all traffic transmission records for the current user, excluding the head traffic transmission records.

[0090] Next, the ratio of the power-law distribution parameters of the tail flow to those of the head flow is calculated. This ratio reflects the degree of anomaly in the head flow. Theoretically, if the head and tail flows follow the same power-law distribution, the ratio should be close to 2; however, when the head flow exhibits a more significant anomalous concentration, the ratio will be much greater than 2.

[0091] When the ratio is greater than the second threshold, the current user's streaming behavior is determined to be abnormal streaming behavior, that is, the current user artificially increases the traffic by repeatedly pulling large files in order to achieve an illegal purpose.

[0092] When the ratio is not greater than the second threshold, the traffic distribution is close to the normal power law distribution, so it can be determined that the current user's pull traffic behavior is a normal pull traffic behavior.

[0093] In the above embodiments, the system quantifies the degree of abnormality of the power-law feature of the header traffic at the user granularity compared to the power-law feature of the tail traffic. This reflects the degree of abnormality of the header traffic caused by the retransmission of large files between the source and destination IPs of the current user compared to the tail traffic corresponding to other normal files. Therefore, it will not misjudge normal large file transmissions between different source and destination IPs, nor will it misjudge small and medium file transmissions between different source and destination IPs.

[0094] In the above Figure 2 Based on the example shown, the determination of the above user pull behavior type will be explained through the following example. Specifically, the first impurity G is determined by the number of content request packets sent by users A to C between their source and destination IP addresses within a preset time period. r =0.942, the second impurity G for fetching file size between source and destination IP addresses f =0.771, the overall impurity is G w =0.994, and assume the second threshold value above is 2.

[0095] Example 1: For Figure 3 Regarding the traffic data of user A within the preset time period, user A performed a total of 7 file transfer events (i.e., n1 = 7) within the preset time period, and the file records pulled were {file A, file 1, file 2, file 3, file A, file 4, file D}. The number of content request packets sent each time was r. i ={3, 1, 2, 2, 2, 2, 1}, and the file size N is retrieved. i = {8733Mb, 160Mb, 205Mb, 250Mb, 5822Mb, 245Mb, 1240Mb}. Therefore, the total number of content request packets sent in the 7 file transfer events is 13 (i.e., r). 总 =13), minimum number of content request packets sent r m=1, and the total file size of the target type files to be pulled is 16655Mb (i.e., N = 16655Mb), the minimum file size to be pulled is N. m =160Mb.

[0096] Therefore, by substituting the above parameters into the formula for calculating the power-law distribution parameter of the total traffic flow, we can obtain the power-law distribution parameter αw of user A's total traffic flow. 全 =3.22. If the first quantity n ′ If 1 = 2 (i.e.), then by substituting the above parameters into the formula for calculating the power-law distribution parameters of the top 2 head traffic, we can obtain the power-law distribution parameters αw of user A's top 2 head traffic. 头 = 2.26. Therefore, the power-law distribution parameter αw of user A's tail flow can be determined. 尾 =0.96.

[0097] Due to αw 头 / αw 尾 =2.37>2, therefore it can be determined that user A's streaming behavior is an abnormal streaming behavior, that is, user A artificially increases traffic by repeatedly pulling large files in order to achieve an illegal purpose.

[0098] Example 2: For Figure 4 Regarding the traffic data of user B within the preset time period, user B performed a total of 6 file transfer events (i.e., n1 = 6) within the preset time period, and the file records pulled were {file D, file 5, file 6, file 7, file D, file D}. The number of times r was sent for each content request packet was... i = {1, 1, 1, 2, 1, 2}, and the file size N is retrieved. i = {1240Mb, 140Mb, 145Mb, 255Mb, 1240Mb, 2480Mb}. Therefore, the number of times content request packets are sent in the 6 file transfer events is a total of 8 (i.e., r). 总 =8), minimum number of content request packets sent r m =1, and the total file size of the target type files to be pulled is 5500Mb (i.e., N = 5500Mb), the minimum file size to be pulled is N. m =140Mb.

[0099] Therefore, by substituting the above parameters into the formula for calculating the power-law distribution parameter of the total traffic, we can obtain the power-law distribution parameter αw of user B's total traffic. 全 = 5.96. If the first quantity n ′ If 1 = 2 (i.e.), then by substituting the above parameters into the formula for calculating the power-law distribution parameters of the top 2 head traffic, we can obtain the power-law distribution parameters αw of user B's top 2 head traffic. 头= 2.67. Therefore, the power-law distribution parameter αw of user B's tail flow can be determined. 尾 =3.02.

[0100] Due to αw 头 / αw 尾 =0.89<2, therefore it can be determined that user B's pull behavior type is normal pull behavior.

[0101] Example 3: For Figure 5 Regarding the traffic data of user C within the preset time period, user C performed a total of 7 file transfer events (i.e., n1 = 7) within the preset time period, and the file records pulled were {file K, file 8, file 9, file 10, file F, file 11, file G}. The number of content request packets sent each time was r. i ={1, 1, 1, 1, 2, 1, 1}, and the file size N is retrieved. i = {75Mb, 110Mb, 105Mb, 70Mb, 305Mb, 85Mb, 135Mb}. Therefore, the number of times content request packets are sent in the 7 file transfer events is a total of 8 (i.e., r). 总 =8), minimum number of content request packets sent r m =1, and the total file size of the target type files to be pulled is 885Mb (i.e., N = 885Mb), the minimum file size to be pulled is N. m =70Mb.

[0102] Therefore, by substituting the above parameters into the formula for calculating the power-law distribution parameter of the total traffic, we can obtain the power-law distribution parameter αw of user C's total traffic. 全 =12.24. If the first quantity n ′ If 1 = 2 (i.e.), then by substituting the above parameters into the formula for calculating the power-law distribution parameters of the top 2 head traffic, we can obtain the power-law distribution parameters αw of user C's top 2 head traffic. 头 =4.46. Therefore, the power-law distribution parameter αw of user C's tail flow can be determined. 尾 =7.78.

[0103] Due to αw 头 / αw 尾 =0.57<2, therefore it can be determined that user C's pull behavior type is normal pull behavior.

[0104] Furthermore, in the technical solution provided in step S106 above, the system can finally perform corresponding pull-stream processing operations on the current user based on the pull-stream behavior type. These pull-stream processing operations include, but are not limited to: updating the cache hit rate of the user's content request packet in the uplink (i.e., the edge cache hit rate dimension of the uplink), and updating the file pull size of the content response packet corresponding to the user's content request packet in the downlink (i.e., the single file transfer size dimension of the downlink).

[0105] Alternatively, if the operation involves updating the cache hit rate of the current user's content request packets in the uplink, the system can implement it as follows:

[0106] Step 1: Determine the cache hit rate of the content request packets sent by the current user, denoted as Hn2n.

[0107] Step 2: When the current user's pull traffic behavior type is normal pull traffic behavior, adjust the cache hit rate using the logarithm of the difference between the power-law distribution parameters of the full traffic and the head traffic (calculated as base 2) and the power-law distribution parameters of the tail traffic. Therefore, in this case, the expression for the adjusted cache hit rate can be written as:

[0108]

[0109] Step 3: When the current user's pull traffic behavior type is abnormal pull traffic behavior, adjust the cache hit rate using the logarithm of the tail traffic power-law distribution parameter (obtained by the difference between the head traffic power-law distribution parameter and the full traffic power-law distribution parameter and the head traffic power-law distribution parameter), with base 2. Therefore, in this case, the expression for the adjusted cache hit rate can be written as:

[0110]

[0111] Alternatively, if the system adopts a method of updating the file fetch size in the downlink of the content response packet corresponding to the current user's content request packet, then it can be implemented as follows:

[0112] Step 1: Determine the file size of the same target type file repeatedly fetched from the content response packet returned by the destination IP address after the current user executes the cache hit rate adjustment of the content request packet. This size is denoted as Cn2n.

[0113] Step 2: When the current user's pull behavior type is normal pull behavior, adjust the file size using the quotient of the tail flow power-law distribution parameter obtained by subtracting the full flow power-law distribution parameter from the head flow power-law distribution parameter. Therefore, in this case, the expression for the adjusted file size can be written as:

[0114]

[0115] Step 3: When the current user's pull flow behavior type is abnormal pull flow behavior, adjust the file size using the quotient of the header flow power-law distribution parameter and the full flow power-law distribution parameter. Therefore, in this case, the expression for the adjusted file size can be written as:

[0116]

[0117] Therefore, if the current user's pull behavior is normal, the cache hit rate of their content request packets in the uplink and the file size of repeatedly pulled files in the downlink will not be significantly affected. However, if the current user's pull behavior is abnormal, the cache hit rate of their content request packets in the uplink and the file size of repeatedly pulled files in the downlink will be significantly reduced.

[0118] The system reduces the cache hit rate of content request packets for users with abnormal streaming in the uplink, and also limits the file pull size of the content response packets corresponding to the content request packets of historically retransmitted large files in the downlink. Compared with limiting only the user's content request packets, the protection scope is broader.

[0119] The following three examples will further illustrate the pull-stream handling operation.

[0120] Example 1: For user A, who exhibits the aforementioned abnormal traffic pulling behavior, in terms of uplink edge cache hit rate, if the cache hit rate H of the content request packet sent by user A is... A If n2n = 0.7, then the updated cache hit rate H A n2n ′ The expression can be written as:

[0121]

[0122] according to Figure 6The comparison results show that a cache hit rate of 0.64 only responded to 6 content request packets for fetching file A and file B between 102.168.2.100 and 114.33.100.3, and between 102.168.1.100 and 93.117.23.101. The Flowspec priority and route weight values ​​of the remaining 4 request packets have been lowered, and none of them were hit.

[0123] Furthermore, because the real-time content request packet related to user A includes three repeated pull requests for file A between 114.33.100.3 and 102.168.2.100, the file size is 2911Mb (i.e., C). A (n2n = 2911 Mb). Combining the above... Figure 3 As we know, this file fetch is a historical duplicate, so file size limits need to be implemented on the downlink. The specific size adjustment can be determined using the following formula:

[0124]

[0125] pass Figure 6 It is not difficult to see that in C A n2n ′ Under the restrictions, the content response packets of the three content request packets related to file A were not allowed to pass by lowering the MTU (Maximum Transmission Unit, which is the maximum data packet size that the network can transmit) value and the packet transmission quantity value, thus avoiding the abnormal pull traffic caused by the historical retransmission of the file.

[0126] It should be noted that because user A repeatedly requested the content of file B five times between 102.168.1.100 and 93.117.23.101, the file size was 1433Mb, which did not exceed the file size limit C. A n2n' represents a new duplicate file retrieval request. Therefore, after the processing operation, the four content response packets related to file B were also allowed to proceed.

[0127] Therefore, with the original cache hit rate HAn2n = 0.7, the expected retransmission file traffic of 14465Mb corresponding to the 7 content request packets that were hit was suppressed to 5732Mb under the restriction measures, reducing abnormal pull traffic behavior by 60% at the forwarding node.

[0128] Example 2: For user B with normal traffic pulling behavior, in terms of uplink edge cache hit rate, if the cache hit rate H of user B's content request packet is... B If n2n = 0.63, then the updated cache hit rate H B n2n ′The expression can be written as:

[0129]

[0130] according to Figure 7 The comparison results show that the cache hit rate of 0.93 resulted in responding to 4 more content request packets for fetching file E between 203.45.67.89 and 198.51.100.22 than the cache hit rate of 0.63. However, the Flowspec priority and route weight values ​​of the content request packets for fetching file H between 203.45.67.89 and 101.22.71.81 have been lowered, resulting in no hits as before.

[0131] Furthermore, since the real-time content request packet data related to user B also includes one pull request each for files D, C, E, and H initiated between non-fixed source and destination IP addresses, with file sizes of 1240Mb, 577Mb, 85Mb, and 620Mb respectively, combined with... Figure 4 It can be seen that all of these are normal file retrievals, and although user B's newly retrieved files include historically retransmitted file D (i.e., C), B (n2n = 1240Mb), but only one fetch was performed, which is normal fetch behavior. Therefore, the expression for adjusting the downlink single file transfer size can be written as:

[0132]

[0133] pass Figure 7 It is not difficult to see that in C B n2n ′ Under these restrictions, the MTU value and packet transmission quantity of the response packets for the four request packets related to file D, file C, file E, and file E are not limited, thus avoiding misjudgment of normal flow pulling behavior between different source and destination IP combinations.

[0134] Therefore, in the original cache hit rate H B With n2n=0.63, the estimated file traffic for the three hit content request packets is 1902Mb, which is unaffected after the update and even increases to 1987Mb because the number of content request packet responses increases to 4.

[0135] Example 3: For user C with normal traffic pulling behavior, in terms of uplink edge cache hit rate, if the cache hit rate H of the content request packet sent by user C is... C If n2n = 0.67, then the updated cache hit rate H C n2n ′ The expression can be written as:

[0136]

[0137] according to Figure 8 The comparison results show that the cache hit rate of 0.73 resulted in responding to 6 more content request packets for fetching file F between 114.33.100.3 and 121.45.67.18 than the cache hit rate of 0.67. Meanwhile, the Flowspec priority and route weight values ​​of the request packets for fetching files M and G have been lowered, and they were still not hit as before.

[0138] Furthermore, because the real-time content request packet related to user C included one fetch request each for files K, I, J, L, F, M, and G initiated between non-fixed source and destination IP addresses, with file sizes of 75Mb, 230Mb, 305Mb, 170Mb, 152.50Mb, 152.50Mb, 201Mb, and 135Mb respectively, and combined with... Figure 5 It can be seen that although user C's current file retrieval includes historical retransmissions of files K, F, and G, it does not constitute a large file transfer, and the retrieval occurs between non-fixed source and destination IPs, which is a normal file transfer behavior. Therefore, the expression for adjusting the size of a single downlink file transfer can be written as:

[0139]

[0140] pass Figure 8 It is not difficult to see that in C C n2n ′ Under the restrictions, the MTU value and packet transmission quantity of the content response packets corresponding to the six content request packets related to file K, file I, file J, file L, file F, and file F are not restricted, thus avoiding misjudgment of normal flow pulling behavior between different source and destination IP combinations.

[0141] Therefore, in the original cache hit rate H C With n2n=0.67, the estimated file traffic for the 6 hit content request packets is 932.5Mb, but it is unaffected after the update and even rises to 1085Mb due to the increase in the number of content request packet responses.

[0142] Example 2

[0143] According to an embodiment of this application, a pull-flow behavior handling device for implementing the pull-flow behavior handling method in Embodiment 1 is also provided, such as... Figure 9 As shown, the device for handling the pull-out behavior includes at least: an acquisition module 92, a first determination module 94, and a second determination module 96, wherein:

[0144] The acquisition module 92 is used to acquire traffic data generated by multiple users when they execute multiple file transfer events within a preset time period. The traffic data includes at least: the number of times the corresponding user sends content request packets from the source Internet Protocol IP address to the destination IP address, the file size of the target type file pulled from the content response packet corresponding to the content request packet returned by the corresponding user from the destination IP address, and the file size of the target type file is greater than the first threshold value.

[0145] The first determining module 94 is used to determine the first impurity of the number of times content request packets are sent between the source and destination IP addresses of multiple users and the second impurity of the size of the file to be pulled, based on multiple traffic data.

[0146] The second determining module 96 is used to traverse each user, determine the full traffic power law distribution parameters and the header traffic power law distribution parameters of the current user based on the first impurity and the second impurity, determine the current user's pull traffic behavior type based on the full traffic power law distribution parameters and the header traffic power law distribution parameters, and perform corresponding pull traffic processing operations on the current user according to the pull traffic behavior type.

[0147] The following section explains the functions of each module of the drain discharge device in conjunction with the specific implementation process.

[0148] Optionally, the first determining module 94 can determine the first impurity of the number of content request packet transmissions between the source and destination IP addresses of multiple users and the second impurity of the file size to be retrieved, as follows:

[0149] Step 1: Analyze the traffic data to obtain the number of content request packets sent and the size of the files pulled when each user executes the corresponding file transfer event;

[0150] Step 2: Based on the number of times the content request packets are sent for each file transfer event, determine the first probability value of the number of times each content request packet is sent, and based on the first probability value, determine the first impurity of the number of times the content request packets are sent between the source and destination IP addresses of multiple users.

[0151] Step 3: Based on the file size corresponding to each file transfer event, determine the second probability value of each file size, and based on the second probability value, determine the second impurity of the file size between the source and destination IP addresses of multiple users.

[0152] Furthermore, the first determining module 94 can also determine the overall impurity of traffic data between the source and destination IP addresses of multiple users based on the first probability value of the number of times each content request packet is sent and the second probability value of the size of each fetched file.

[0153] By iterating through each of the multiple users, the second determining module 94 can determine the full traffic power-law distribution parameters and the header traffic power-law distribution parameters of the current user based on the first impurity and the second impurity, including:

[0154] Step 1: Determine the first total amount of traffic data generated by the current user executing multiple file transfer events within a preset time period, and determine the minimum number of content request packets sent and the minimum file size pulled among all traffic data of the current user within the preset time period;

[0155] Step 2: Based on the minimum number of content request packets sent, the minimum file size to be fetched, the first total number, the first impurity, the second impurity, and the combined impurity, determine the power-law distribution parameters of the current user's total traffic using the following formula:

[0156]

[0157] In the formula, αw 全 Let G represent the power-law distribution parameters of the current user's total traffic, where n1 represents the first total number, and G represents the total number of users. w G represents the overall impurity. r G represents the first degree of impurity. f Indicates the second degree of impurity, r i N represents the number of content request packets sent by the current user in the i-th traffic data within a preset time period. i This represents the file size retrieved by the current user in the i-th data stream within a preset time period, r. m N represents the minimum number of content request packets to send. m Indicates the minimum file size to fetch;

[0158] Step 3: Sort the number of content request packets sent and the file size retrieved from multiple traffic data within the preset time period for the current user in descending order, and determine the first number of header content request packets sent and the first number of header file sizes retrieved from the sorted results.

[0159] Step 4: Based on the minimum number of content request packets sent, the minimum file size to be fetched, the first quantity, the first impurity, the second impurity, and the combined impurity, determine the power-law distribution parameters of the current user's header traffic according to the following formula:

[0160]

[0161] In the formula, αw 头 n represents the power-law distribution parameter of the current user's header traffic. ′ 1 represents the first quantity, r i ′N represents the number of times the header content request packet is sent in the i-th header traffic data of the current user within a preset time period. i ′ This indicates the size of the header file retrieved by the current user in the i-th header traffic data within the preset time period.

[0162] Furthermore, the second determining module 96 can determine the current user's pull behavior type based on the full traffic power-law distribution parameters and the header traffic power-law distribution parameters, including:

[0163] First, calculate the difference between the power-law distribution parameters of the total traffic and the power-law distribution parameters of the head traffic, and use the difference as the power-law distribution parameters of the tail traffic for the current user.

[0164] Next, the ratio of the power-law distribution parameters of the tail flow to the power-law distribution parameters of the head flow is calculated;

[0165] When the ratio is greater than the second threshold, the current user's pull request behavior is determined to be an abnormal pull request behavior;

[0166] If the ratio is not greater than the second threshold, the current user's pull flow behavior type is determined to be normal pull flow behavior.

[0167] Finally, the second determining module 96 can perform corresponding pull-stream processing operations on the current user based on the pull-stream behavior type. The pull-stream processing operations include, but are not limited to: updating the cache hit rate of the user's content request packet in the uplink (i.e., the edge cache hit rate dimension of the uplink) and updating the file pull size of the content response packet corresponding to the user's content request packet in the downlink (i.e., the single file transfer size dimension of the downlink).

[0168] Alternatively, if the processing operation involves updating the cache hit rate of the user's content request packets in the uplink, then the second determining module 96 can be implemented as follows:

[0169] Step 1: Determine the cache hit rate of the content request packets sent by the current user.

[0170] Step 2: When the current user's pull traffic behavior type is normal pull traffic behavior, adjust the cache hit rate using the logarithm of the tail traffic power-law distribution parameter obtained by the difference between the full traffic power-law distribution parameter and the head traffic power-law distribution parameter, with 2 as the base.

[0171] Step 3: When the current user's pull flow behavior type is abnormal pull flow behavior, adjust the cache hit rate using the logarithm of the tail flow power law distribution parameter obtained by taking 2 as the base and the difference between the head flow power law distribution parameter and the full flow power law distribution parameter and the head flow power law distribution parameter.

[0172] Optionally, if the processing operation involves updating the file fetch size in the downlink of the content response packet corresponding to the user's content request packet, then the second determining module 96 can be implemented as follows:

[0173] Step 1: Determine the file size of the same target type file repeatedly fetched from the content response packet returned by the destination IP address after the current user performs the cache hit rate adjustment of the content request packet.

[0174] Step 2: When the current user's pull behavior type is normal pull behavior, adjust the file size using the quotient of the tail flow power law distribution parameter obtained by the difference between the full flow power law distribution parameter and the head flow power law distribution parameter.

[0175] Step 3: When the current user's pull flow behavior type is abnormal pull flow behavior, adjust the file size using the quotient of the header traffic power law distribution parameter and the full traffic power law distribution parameter.

[0176] It should be noted that each module in the pull-flow behavior disposal device in this application embodiment corresponds one-to-one with each implementation step of the pull-flow behavior disposal method in Embodiment 1. Since Embodiment 1 has been described in detail, some details not shown in this embodiment can be referred to Embodiment 1, and will not be elaborated further here.

[0177] Example 3

[0178] According to an embodiment of this application, a computer program product is also provided, which includes a computer program, wherein when the computer program is executed by a processor, it implements the pull-flow behavior handling method in Embodiment 1.

[0179] According to an embodiment of this application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device containing the non-volatile storage medium executes the pull-flow behavior processing method in Embodiment 1 by running the computer program.

[0180] According to an embodiment of this application, a processor is also provided for running a computer program, wherein the computer program executes the pull-stream behavior handling method in Embodiment 1 during runtime.

[0181] According to an embodiment of this application, an electronic device is also provided, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the pull-stream behavior processing method of Embodiment 1 through the computer program.

[0182] Specifically, the computer program executes the following steps during runtime: acquiring traffic data generated by multiple users performing multiple file transfer events within a preset time period, wherein the traffic data includes at least: the number of times the corresponding user sends content request packets from the source IP address to the destination IP address, the file size of the target type file pulled from the content response packet corresponding to the content request packet returned by the corresponding user from the destination IP address, and the file size of the target type file is greater than a first threshold value; determining the first impurity of the number of content request packets sent between the source and destination IP addresses of the multiple users and the second impurity of the pulled file size based on the multiple traffic data; traversing each user, determining the full traffic power-law distribution parameters and header traffic power-law distribution parameters of the current user based on the first impurity and the second impurity, determining the current user's pull behavior type based on the full traffic power-law distribution parameters and header traffic power-law distribution parameters, and performing corresponding pull processing operations on the current user according to the pull behavior type.

[0183] As an alternative implementation, the above-mentioned electronic device may exist in the form of a mobile terminal, a computer terminal, or a similar computing device. Figure 10 A hardware block diagram of a computer terminal for implementing a pull-stream behavior handling method is shown. Figure 10 As shown, the computer terminal 100 may include one or more processors 1002 (shown as 1002a, 1002b, ..., 1002n in the figure) 1002 (processor 1002 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 1004 for storing data, and a transmission device 1006 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 10 The structure shown is for illustrative purposes only and does not limit the structure of the computer terminal described above. For example, computer terminal 100 may also include... Figure 10 The more or fewer components shown, or having the same Figure 10 The different configurations shown.

[0184] It should be noted that the aforementioned one or more processors 1002 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 100. As involved in the embodiments of this application, the data processing circuits serve as processor control (e.g., selection of a variable resistor termination path connected to an interface).

[0185] The memory 1004 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the pull-flow behavior handling method in this embodiment. The processor 1002 executes various functional applications and data processing by running the software programs and modules stored in the memory 1004, thereby implementing the above-mentioned application vulnerability detection method. The memory 1004 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 1004 may further include memory remotely located relative to the processor 1002, and these remote memories can be connected to the computer terminal 100 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0186] The transmission device 1006 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 100. In one example, the transmission device 1006 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 1006 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0187] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 100.

[0188] The sequence numbers of the above embodiments are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0189] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0190] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0191] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0192] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0193] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0194] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method of handling a pull stream behavior, the method comprising: The method comprises: obtaining traffic data generated by a plurality of users respectively when performing a plurality of file transmission events within a preset time period, wherein the traffic data at least includes: a sending number of content request packets sent by a corresponding user from a source Internet Protocol (IP) address to a destination IP address, and a file size of a target type file pulled by the corresponding user from a content response packet corresponding to the content request packet fed back by the destination IP address, and the file size of the target type file is greater than a first threshold value; determining a first impurity of content request packet sending number and a second impurity of pulled file size between source and destination IP addresses of the plurality of users according to a plurality of the traffic data; traversing each of the users, determining a full-amount traffic power law distribution parameter and a head traffic power law distribution parameter of a current user based on the first impurity and the second impurity, and determining a file pulling behavior type of the current user based on the full-amount traffic power law distribution parameter and the head traffic power law distribution parameter, and performing a corresponding file pulling processing operation on the current user according to the file pulling behavior type.

2. The method of claim 1, wherein, The method comprises: parsing each of the traffic data to obtain a content request packet sending number and a pulled file size of each of the plurality of users when performing a corresponding file transmission event; determining a first probability value of each of the content request packet sending numbers according to the content request packet sending number corresponding to each of the file transmission events, and determining the first impurity of content request packet sending number between source and destination IP addresses of the plurality of users according to the first probability value; determining a second probability value of each of the pulled file sizes according to the pulled file size corresponding to each of the file transmission events, and determining the second impurity of pulled file size between source and destination IP addresses of the plurality of users according to the second probability value.

3. The method of claim 2, wherein, After determining the first impurity of content request packet sending number and the second impurity of pulled file size between source and destination IP addresses of the plurality of users according to a plurality of the traffic data, the method further comprises: determining a comprehensive impurity of traffic data between source and destination IP addresses of the plurality of users according to the first probability value of each of the content request packet sending numbers and the second probability value of each of the pulled file sizes.

4. The method of claim 3, wherein, The method comprises: determining a first total number of traffic data generated by the current user when performing a plurality of file transmission events within a preset time period, and determining a minimum content request packet sending number and a minimum pulled file size in all traffic data of the current user within a preset time period; determining the full-amount traffic power law distribution parameter of the current user according to the minimum content request packet sending number, the minimum pulled file size, the first total number, the first impurity, the second impurity, and the comprehensive impurity according to the following formula: In the formula, αw 全 represents the full flow power-law distribution parameter of the current user, n1 represents the first total number, G w represents the comprehensive impurity, G r represents the first impurity, G f represents the second impurity, r i represents the content request packet sending times in the i-th flow data of the current user in a preset time period, N i represents the pull file size in the i-th flow data of the current user in a preset time period, r m represents the minimum content request packet sending times, N m represents the minimum pull file size; The content request packet sending times and the pull file sizes in the plurality of the traffic data of the current user within a preset time period are sequentially sorted in descending order, and a first number of head content request packet sending times in the sorting result and a first number of head pull file sizes are determined; According to the minimum content request packet sending times, the minimum pull file size, the first number, the first impurity, the second impurity, and the comprehensive impurity, the head traffic power-law distribution parameter of the current user is determined according to the following formula: In the formula, αw 头 represents the head flow power-law distribution parameter of the current user, n'1 represents the first number, r' i represents the number of head content request packet transmissions in the i-th head flow data of the current user in a preset time period, N' i represents the head pull file size in the i-th head flow data of the current user in a preset time period.

5. The method of claim 1, wherein, The stream pulling behavior type includes: normal stream pulling behavior and abnormal stream pulling behavior, wherein the stream pulling behavior type of the current user is determined based on the total traffic power-law distribution parameter and the head traffic power-law distribution parameter, and includes: The difference between the total traffic power-law distribution parameter and the head traffic power-law distribution parameter is calculated, and the difference is taken as the tail traffic power-law distribution parameter of the current user; The ratio of the tail traffic power-law distribution parameter to the head traffic power-law distribution parameter is calculated; When the ratio is greater than a second threshold value, it is determined that the stream pulling behavior type of the current user is abnormal stream pulling behavior; When the ratio is not greater than the second threshold value, it is determined that the stream pulling behavior type of the current user is normal stream pulling behavior.

6. The method of claim 5, wherein, The stream pulling treatment operation at least includes: adjusting the cache hit rate of the content request packet, wherein the current user is executed according to the corresponding stream pulling treatment operation according to the stream pulling behavior type, and includes: The cache hit rate of the content request packet sent by the current user is determined; When the stream pulling behavior type of the current user is normal stream pulling behavior, the tail traffic power-law distribution parameter obtained by the difference between the total traffic power-law distribution parameter and the head traffic power-law distribution parameter is taken as the logarithm of the quotient of the head traffic power-law distribution parameter, and the cache hit rate is adjusted; When the stream pulling behavior type of the current user is abnormal stream pulling behavior, the tail traffic power-law distribution parameter obtained by the difference between the total traffic power-law distribution parameter and the head traffic power-law distribution parameter is taken as the logarithm of the quotient of the head traffic power-law distribution parameter, and the cache hit rate is adjusted.

7. The method of claim 5, wherein, The stream pulling treatment operation also includes: adjusting the file size of repeatedly pulling the same target type file in the content response packet, wherein the current user is executed according to the corresponding stream pulling treatment operation according to the stream pulling behavior type, and also includes: The file size of repeatedly pulling the same target type file in the content response packet fed back from the host IP address by the current user after adjusting the cache hit rate of the content request packet is determined; When the stream pulling behavior type of the current user is normal stream pulling behavior, the quotient of the total traffic power-law distribution parameter and the tail traffic power-law distribution parameter obtained by the difference between the total traffic power-law distribution parameter and the head traffic power-law distribution parameter is used to adjust the file size; When the current user's pull stream behavior type is abnormal pull stream behavior, the file size is adjusted by using a quotient value of the head flow power law distribution parameter and the total flow power law distribution parameter.

8. A flow pulling behavior handling apparatus, characterized by, The method comprises the steps of: An acquisition module is configured to acquire flow data generated by a plurality of users when performing a plurality of file transmission events within a preset time period, wherein the flow data at least includes a sending frequency of a content request packet sent by a corresponding user from a source Internet Protocol (IP) address to a destination IP address, and a file size of a target type file pulled by the corresponding user from a content response packet corresponding to the content request packet and fed back from the destination IP address, and the file size of the target type file is greater than a first threshold value. A first determination module is configured to determine a first impurity of a content request packet sending frequency and a second impurity of a pulled file size between source and destination IP addresses of the plurality of users according to a plurality of flow data. A second determination module is configured to traverse each of the users, determine a total flow power law distribution parameter and a head flow power law distribution parameter of a current user based on the first impurity and the second impurity, and determine a pull stream behavior type of the current user based on the total flow power law distribution parameter and the head flow power law distribution parameter, and perform a corresponding pull stream disposal operation on the current user according to the pull stream behavior type.

9. A computer program product, characterised in that, The computer program is executed by a processor to implement the pull stream behavior disposal method of any one of claims 1 to 7. The memory and the processor, wherein the memory has a computer program stored therein, and the processor is configured to execute the pull stream behavior disposal method of any one of claims 1 to 7 by using the computer program.

10. An electronic device, comprising: The memory and the processor, wherein the memory has a computer program stored therein, and the processor is configured to execute the pull stream behavior disposal method of any one of claims 1 to 7 by using the computer program. ​

Images