Performance adaptation method and control system based on traffic analysis

Abstract

The application provides a performance self-adaptive method and control system based on traffic analysis, and relates to the technical field of traffic regulation. The method comprises the following steps: S1, monitoring traffic data of a working system to obtain unanalyzed traffic metrics; S2, determining a maximum threshold of cache traffic seconds of the working system and a system processing threshold; S3, determining whether the working system is in an overload state and controlling to reduce the system processing threshold; S4, determining whether the working system is in a normal load state and controlling to start a normal state timer to record the duration of the normal state of the working system; S5, controlling to increase the system processing threshold and reset the duration of the normal state, and adjusting the increase range of the system processing threshold; and S6, repeatedly executing steps S3 to S5 to maintain the traffic metrics within a target range. The method can improve the effectiveness of traffic regulation and improve the resource utilization efficiency of the working system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of flow regulation, in particular to a performance self-adaptive method and control system based on flow analysis. BACKGROUND

[0002] The prior art usually adopts a relatively passive threshold control mechanism when facing the performance bottleneck of a network flow analysis system. The core problem lies in the rigidity and hysteresis of the control strategy. The system often sets a fixed high water line as the trigger condition, and only when the cache is accumulated to the dangerous threshold close to memory exhaustion, the extreme response measures such as discarding all newly collected flows are passively started. This "on-off" type of control method is essentially an emergency brake, which lacks early perception and gradual regulation ability of the load rising trend. Since the intervention action only occurs when the system is deeply overloaded, its response is severely lagging behind the actual load change, resulting in that the system may have been in an unhealthy state of high load and high delay for a long time before triggering flow control, and the efficiency of overall flow control is thus low.

[0003] In addition, when the system reduces the load below the safety line through the discarding strategy, it usually directly restores to the initial maximum processing rate. This recovery strategy is too aggressive and fails to consider the actual recovery of system processing capacity and the smooth acceptance of subsequent flows. Due to the lack of careful control and effect evaluation of the recovery process, the system is prone to quickly fall into overload again due to the instantaneous full load of processing rate, and then trigger flow discarding again. This frequent oscillation between the two extreme states of full-speed processing and complete discarding not only wastes computing resources, but also makes the effective flow processing window period short and unstable, further reducing the overall flow control and processing efficiency. SUMMARY

[0004] Based on this, the present application provides a performance self-adaptive method and control system based on flow analysis, which continuously monitors the flow measure reflecting the system load, and compares it with the upper and lower threshold values set based on the system cache capacity, so as to intelligently judge whether the system is in overload, normal or other state. Based on this state judgment, the system does not simply enable or stop the processing function, but accurately and dynamically adjusts the system processing threshold, which directly controls the rate of system flow analysis. When the system is overloaded, the threshold is actively lowered to quickly reduce the load; when the system load is normal, the threshold is tentatively raised to improve performance. By repeatedly executing the monitoring, judging and adjusting cycle, the system can automatically find and maintain stable operation near its performance limit, so as to maintain the backlog of to-be-processed flows within a reasonable range.

[0005] In a first aspect, the embodiments of the present application provide a performance self-adaptive method based on flow analysis, comprising:

[0006] S1, monitoring traffic data of a working system, obtaining an unprocessed traffic measure based on the traffic data; the traffic measure representing a current load state of the working system;

[0007] S2, determining a maximum threshold of cache traffic seconds of the working system and a system processing threshold; the system processing threshold being used to control a rate of analyzing traffic of the working system;

[0008] S3, determining whether the working system is in an overload state based on the traffic measure and a first preset threshold, and controlling to decrease the system processing threshold in a case that the working system is in the overload state; wherein the first preset threshold is determined based on the maximum threshold of cache traffic seconds;

[0009] S4, determining whether the working system is in a normal load state based on the traffic measure and a second preset threshold, and controlling to start a normal state timer to record a normal state duration of the working system in a case that the working system is in the normal load state; wherein the second preset threshold is determined based on the maximum threshold of cache traffic seconds;

[0010] S5, in a case that the normal state duration reaches a preset duration threshold, controlling to increase the system processing threshold and reset the normal state duration, and in a case that the system processing threshold is increased, monitoring processing traffic of the working system to adjust an increasing range of the system processing threshold according to the processing traffic and the system processing threshold;

[0011] S6, repeatedly executing steps S3 to S5 to maintain the traffic measure within a target range based on dynamically adjusting the system processing threshold.

[0012] In some embodiments, the S3 can comprise:

[0013] recording a traffic peak value processed by the working system in a running state, and determining whether the working system is in an overload state based on the traffic measure and a first preset threshold;

[0014] in a case that the working system is in the overload state, controlling to decrease the system processing threshold based on the traffic peak value.

[0015] In some embodiments, the S3 can further comprise:

[0016] in a case that the working system is in the overload state, controlling to stop analyzing traffic exceeding the system processing threshold to reduce the traffic measure of the working system.

[0017] In some embodiments, the first preset threshold is determined based on a maximum threshold of the cache traffic seconds and a first proportional coefficient.

[0018] In some embodiments, the S4 can include:

[0019] In the case that the traffic metric is lower than the second preset threshold, increasing the count of the normal state duration; in the case that the traffic metric is not lower than the second preset threshold, decreasing the count.

[0020] In some embodiments, the S5 can include:

[0021] Based on a basic growth rate and a proportion of actual processing traffic of the working system to the system processing threshold, determining an increasing amplitude of the system processing threshold.

[0022] In some embodiments, adjusting the formula of the system processing threshold based on the increasing amplitude of the system processing threshold includes:

[0023] L’ = L * (1 + A + (1 – T / L))

[0024] wherein L’ is the system processing threshold after increasing, L is the system processing threshold before increasing, A is the basic growth rate, and T is the actual processing traffic monitored after increasing the system processing threshold.

[0025] In some embodiments, the method can further include:

[0026] In the case that the traffic metric is continuously lower than a high performance threshold for one or more complete cycles, performing a stepwise multiplication adjustment on the system processing threshold; wherein the increasing factor used increases with the number of cycles every time a cycle is completed.

[0027] In some embodiments, the traffic metric is the number of data packets or the number of sessions in the working system to be analyzed, and the system processing threshold is the threshold of the number of data packets or the number of sessions processed per second by the working system.

[0028] In a second aspect, the embodiments of the present application provide a performance self-adaptive control system based on traffic analysis, which can include:

[0029] a monitoring module, configured to monitor traffic data of a working system, and obtain an unanalyzed traffic metric based on the traffic data; the traffic metric representing a current load state of the working system;

[0030] The initialization module is configured to determine a maximum threshold of cache traffic seconds of the working system and a system processing threshold, wherein the system processing threshold is used to control a rate of analyzing traffic of the working system;

[0031] The control module is configured to determine whether the working system is in an overload state based on the traffic metric and a first preset threshold, and control to decrease the system processing threshold when the working system is in the overload state; determine whether the working system is in a normal load state based on the traffic metric and a second preset threshold, and control to start a normal state timer to record a normal state duration of the working system when the working system is in the normal load state; and control to increase the system processing threshold and reset the normal state duration when the normal state duration reaches a preset duration threshold, and monitor processing traffic of the working system to adjust an increasing range of the system processing threshold according to the processing traffic and the system processing threshold when the system processing threshold is increased; repeatedly perform the operations of determining whether the working system is in the overload state, determining whether the working system is in the normal load state, and monitoring the processing traffic of the working system to adjust the increasing range of the system processing threshold according to the processing traffic and the system processing threshold, so as to maintain the traffic metric within a target range based on dynamic adjustment of the system processing threshold; and wherein the first preset threshold and the second preset threshold are determined based on the maximum threshold of the cache traffic seconds.

[0032] Compared with the prior art, the application has the beneficial effects that: by continuously monitoring the traffic metric reflecting the system load and comparing it with the upper and lower threshold values set based on the system cache capacity, the system is intelligently judged to be in an overload state, a normal state or other states. Based on the state judgment, the system does not simply enable or stop processing functions, but accurately dynamically adjusts the system processing threshold, which directly controls the rate of analyzing traffic of the system. When the system is overloaded, the threshold is actively lowered to quickly reduce the load; when the system is normally loaded, the threshold is tentatively increased to improve performance. Through repeated execution of the monitoring, judgment and adjustment cycle, the system can automatically find and maintain stable operation near its performance limit, thereby maintaining the backlog of to-be-processed traffic within a reasonable range. The network traffic analysis system can be changed from passive and rigid overload protection to active and refined performance adaptation, so that the working system can still maintain stable operation when approaching its performance limit, effectively eliminating the jagged fluctuations of the traffic trend graph caused by the traditional rough discard strategy, and improving the effectiveness of traffic regulation and the resource utilization efficiency of the working system. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1A flow analysis based performance self-adaptive method provided by the embodiment of the present application.

[0034] Figure 2 A trend diagram of the working system adjustment process provided by the embodiment of the present application. DETAILED DESCRIPTION

[0035] The present application will be further described in conjunction with test examples and specific embodiments. However, it should not be understood as limiting the scope of the above-mentioned subject matter of the present application to the following examples only, and any technology realized based on the content of the present application falls within the scope of protection of the present application.

[0036] In the description of the specific embodiments of the present application, the orientation or position relationship indicating terms such as "up", "down", "left", "right", "center", "inner", "outer", "side" and the like appear without special indication, which are expressed based on the orientation or position relationship shown in the drawings, or the orientation or position relationship when the product / device / apparatus is usually used. These orientation or position relationship terms are only for the convenience of describing the present application scheme or simplifying the description in the specific embodiments, for the convenience of the technical personnel to quickly understand the scheme, and cannot be understood as indicating or implying that a specific device / component / element must have a specific orientation, or be constructed and operated in a specific position relationship, and therefore cannot be understood as limiting the present application.

[0037] In the description of the specific embodiments of the present application, the technical terms "first", "second" and the like only distinguish one entity or operation from another entity or operation, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the specific embodiments of the present application, the meaning of "multiple" is two and more than two, unless otherwise specifically limited.

[0038] Reference to "an embodiment" in this text means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the present application. The appearance of the phrase in various places in the specification does not necessarily all refer to the same embodiment, nor is it necessarily independent or alternative embodiments to each other. The skilled person in the art explicitly and implicitly understands that the embodiments described herein can be combined with other embodiments.

[0039] Please refer to Figure 1 , Figure 1 A flow analysis based performance self-adaptive method provided by the embodiment of the present application. The method can include the following steps:

[0040] S1, monitoring the flow data of the working system, obtaining the unanalyzed flow measure based on the flow data; the flow measure represents the current load state of the working system;

[0041] S2, determining a maximum threshold of cache traffic seconds of the working system and a system processing threshold; the system processing threshold is used to control a rate of analyzing traffic of the working system;

[0042] S3, determining whether the working system is in an overload state based on the traffic metric and a first preset threshold; the first preset threshold is determined based on the maximum threshold of cache traffic seconds; and in a case that the working system is in the overload state, controlling to reduce the system processing threshold;

[0043] S4, determining whether the working system is in a normal load state based on the traffic metric and a second preset threshold; the second preset threshold is determined based on the maximum threshold of cache traffic seconds; and in a case that the working system is in the normal load state, controlling to start a normal state timer to record a normal state duration of the working system;

[0044] S5, in a case that the normal state duration reaches a preset duration threshold, controlling to increase the system processing threshold and reset the normal state duration; and in a case that the system processing threshold is increased, monitoring a processing traffic of the working system, so as to adjust an increasing range of the system processing threshold according to the processing traffic and the system processing threshold;

[0045] S6, repeatedly executing the step S3 to the step S5, so as to maintain the traffic metric within a target range based on dynamically adjusting the system processing threshold.

[0046] The method provided by the embodiments of the present application can be applied to a performance self-adaptive control system (hereinafter referred to as a control system) based on traffic analysis. The control system maintains stable operation of a working system by dynamically adjusting a processing rate. The working system refers to a system that needs to process continuous data flow, but the processing capacity of the system can be bottlenecked, and thus the system needs to maintain stability by dynamically adjusting the processing rate. Specifically, the working system can be a network traffic analysis system, a network security monitoring system, a log analysis and auditing system, a big data flow processing platform, a video stream intelligent analysis system, a telecommunication signaling analysis system, and the like. Traffic data refers to relevant data reflecting the working state of the network traffic analysis system, and mainly includes relevant information of traffic that has been collected by the system but has not been processed, such as the data size, the cache time, the number of data packets, and the like. The traffic metric M specifically refers to a metric of the amount of traffic data that has not been processed, which can be, for example, the number of seconds, the number of bytes, the number of data packets, or the number of sessions of the traffic to be processed in the cache of the system. The greater the value of the traffic metric M, the heavier the processing load of the system. The maximum threshold N of the cache traffic seconds refers to the maximum time capacity upper limit of the cache of the system for unprocessed traffic that is preset to guarantee stable operation, and is used to determine whether the load of the system is close to the limit. When the traffic metric M approaches or exceeds N, it indicates that the working system needs to take load control measures. The system processing threshold L refers to a dynamic limit value set by the system to actively control the analysis rate of the system. When processing newly collected traffic, the system does not unconditionally process all the traffic, but uses L as the upper limit. When the input traffic rate exceeds L, the system only processes the traffic whose rate does not exceed L, and discards the traffic exceeding L, thereby achieving control of the load of the system.

[0047] The overload state refers to a working state in which the working system is overloaded due to insufficient processing capacity, and the normal load state refers to a working state in which the working system is moderately loaded and can stably operate. The normal state timer refers to a counter used to record the duration of the system continuously being in the normal load state. In the embodiments of the present application, the normal state timer can be a software counter, and the counting rule can be that when the system continuously is in the normal load state, the counter S is incremented, and once the system exits the normal load state, the counter S is decremented or reset. When the value of S reaches a preset duration threshold (for example, 30 counting units), an operation of increasing the working system processing threshold L is triggered.

[0048] Maintaining the traffic metric within a target range refers to expecting to maintain the traffic metric M within a numerical interval. In the embodiments of the present application, the lower limit of the range is usually related to the second preset threshold for determining the normal load state, and the upper limit is usually related to the first preset threshold for determining the overload state. For example, the target range can be that M is between 0.8N and 1.5N.

[0049] In some embodiments, the embodiment of the present application can introduce a historical performance indicator of traffic peak as a benchmark for the system to self-adjust under overload condition, and step S3 can specifically include:

[0050] recording the traffic peak handled by the working system under the running state, determining whether the working system is in an overload state based on the traffic measure and the first preset threshold, and controlling to reduce the system processing threshold based on the traffic peak in the case that the working system is in an overload state.

[0051] The performance adaptive control system based on traffic analysis continuously records the highest rate of successfully handled traffic in actual operation, that is, the traffic peak, which represents the maximum processing capacity that the working system has ever reached under unconstrained condition. When the system determines that it is in an overload state by comparing the real-time monitored traffic measure with the first preset threshold, it enters the second stage, the adjustment stage. At this time, the system does not arbitrarily or by a fixed value reduce its processing threshold, but is based on the traffic peak. For example, the current processing threshold L is adjusted to a proportion (such as 50%) of the previously recorded traffic peak P. The advantage of this approach is that the adjustment range is closely related to the historical performance of the system itself, which can quickly pull the system load from a dangerous high level to a known and relatively safe level, creating conditions for stable operation within the target range, and avoiding the problems of insufficient adjustment or excessive adjustment caused by blind adjustment.

[0052] The first preset threshold is determined based on the maximum threshold of the cache traffic seconds and the first proportion coefficient, that is, the control system does not directly use the maximum threshold N of the cache traffic seconds as the absolute limit of overload judgment, but multiplies it by a configurable first proportion coefficient, thereby obtaining a first preset threshold with more flexibility and fault tolerance space.

[0053] Specifically, the first proportion coefficient can be 1.5, so the control system sets the first preset threshold to 1.5N. The control system does not immediately determine overload when the cache traffic seconds M of the working system just exceeds the maximum threshold N, but allows a certain reasonable excess of the cache amount, and only when M>1.5N, it confirms that the working system is indeed in a persistent state of insufficient processing capacity. The purpose of this threshold setting method based on coefficient adjustment is to establish a buffer area to avoid too frequent state switching and parameter adjustment of the control system between normal load fluctuations and real performance bottlenecks of the working system due to instantaneous fluctuations of traffic, thereby enhancing the stability and robustness of the entire adaptive adjustment process.

[0054] Further, when the working system is determined to be in an overload state, the specific intervention action performed by the control system is to directly and finely manage the data processing behavior of the working system through a precise instruction. S3 can further include:

[0055] In the case where the working system is in an overload state, the control stops analyzing the traffic exceeding the system processing threshold, so as to reduce the traffic measure of the working system.

[0056] In some embodiments, after confirming the overload, the control system sends an instruction to the working system, requiring it to take the dynamically adjusted system processing threshold L as the upper limit when performing traffic analysis. This means that for the newly collected traffic data, the working system only performs deep analysis processing on the part whose rate does not exceed L, and actively controls the part whose instantaneous rate exceeds L not to enter the analysis queue, in essence, discarding it. The direct purpose of this action is to immediately reduce the input load of the analysis engine of the working system, so as to control the backlog of traffic to be processed (i.e., the traffic measure M) to start to decrease, and create conditions for the system to recover from the overload state to the stable state.

[0057] In some embodiments, the control system cautiously evaluates the state stability of the working system through a counting mechanism with hysteresis characteristics, that is, the control system increases the count of the normal state duration when the traffic measure is lower than the second preset threshold, and decreases the count when the traffic measure is not lower than the second preset threshold.

[0058] In some embodiments, the control system dynamically manages this count by comparing the real-time monitored traffic measure M with the second preset threshold (for example, 0.8N). When M is lower than the threshold, the control system increases the count, which indicates that the load reduction trend of the working system is positively confirmed; on the contrary, when M is equal to or higher than the threshold, the control system decreases the count, which is equivalent to questioning or denying the previous positive confirmation trend. This design enables the value of the counter to truly reflect the continuity and stability of the load state of the working system, rather than a snapshot at a certain moment. Only when the accumulated positive confirmation (i.e., the net increase of the count) reaches a certain amount, the control system finally confirms that the working system has truly left the overload risk and entered a sustainable normal load state, thereby triggering the subsequent exploratory operation of increasing the processing threshold L.

[0059] In some embodiments, the control system is configured with a dynamic adjustment strategy, and the increasing amplitude is determined by a preset basic growth rate and a dynamic adjustment factor reflecting the real processing capacity of the working system. S5 specifically includes:

[0060] determining an increasing magnitude of the system processing threshold based on the base growth rate and a proportion of actual processing flow of the working system to the system processing threshold.

[0061] When the control system determines that the threshold L needs to be increased, it monitors the actual processing flow T that the working system can actually handle under the current L value. The dynamic adjustment factor is the proportion of actual processing flow T to system processing threshold L (T / L). If T is much smaller than L, it means that the actual processing capacity of the working system has a large surplus, and the current L value is set too conservatively. The control system will make L increase significantly according to the formula L' = L * (1 + A + (1 - T / L)), so as to quickly improve the performance throughput and avoid the sudden arrival of high flow that cannot be processed in time due to the slow growth of the threshold. On the contrary, if T is very close to or equal to L, it means that the working system is close to full load operation. At this time, the control system will mainly rely on the base growth rate A to make a small amplitude exploratory growth to ensure stability.

[0062] In the formula for adjusting the system processing threshold by the increasing magnitude of the system processing threshold, L' is the system processing threshold after increasing, L is the system processing threshold before increasing, A is the base growth rate, and T is the actual processing flow monitored after increasing the system processing threshold.

[0063] Further, the method provided by the application also introduces an optimization mechanism to solve the problem of slow convergence speed that may occur when the system processing threshold L is adjusted based on the conventional rules under the condition of extremely low system load. The method can also include: under the condition that the flow measure continuously falls below a high performance threshold for one or more complete cycles, performing a stepwise multiplication adjustment on the system processing threshold; wherein the increasing factor used every cycle increases with the number of cycles.

[0064] When the control system monitors that the load of the working system is extremely light, a more aggressive adjustment strategy is started. The control system sets a high performance threshold (for example, cache seconds M ). When the flow measure M continues to be below this threshold for a configurable full cycle (e.g. 30 seconds), the control system determines that the working system is in a high performance processing state. In this state, the control system no longer uses a fixed growth rate to increase L, but instead initiates a stepwise multiplication adjustment strategy. The core feature of this strategy is that the increase factor used each cycle is significantly increased as the cycle number increases. For example, the first cycle increases by 10%, the second cycle increases by 50%, the third cycle increases by 100% (i.e. doubles), and so on. This design allows the system processing threshold L to increase exponentially and rapidly, and the purpose is to quickly increase the upper limit of the processing capacity L of the working system to a level sufficient to cope with when the external input flow (such as TAP access flow) suddenly recovers from a very low level to normal or even peak, so as to avoid a large amount of traffic that can be processed being discarded due to the threshold L being too low, so that the working system can respond to the traffic mutation in time and maintain efficient operation.

[0065] In some optional embodiments, the method provided by the present application can also be applied to network analysis, security audit, log processing and other scenarios that need to process discrete data streams and face performance bottlenecks, as long as the load indicator monitored by the control system and the processing rate indicator controlled by the working system are some countable data processing units, the performance adaptive method based on flow analysis provided by the present application can be used to adaptively control the flow of the working system. The adaptive adjustment mechanism of the method provided in the present application is not limited to environments measured by bandwidth (such as Gbps), but is applicable to any flow processing system with discrete data processing units as load indicators.

[0066] For example, the flow measure can be the number of data packets or the number of sessions cached by the working system for analysis; and the system processing threshold can be the data packet per second processing threshold or the session number threshold of the working system.

[0067] In a network security detection system, the load state can not be directly manifested as the flow bandwidth, but as the number of data packets or network sessions that need to be detected per second. Accordingly, the system processing threshold is defined as the data packet per second processing threshold or the session number threshold of the working system. At this time, the adaptive adjustment logic of the control system is fully applicable: when the number of cached data packets exceeds a certain threshold, the control system will lower the data packet per second processing threshold L to stabilize the system; when the load is reduced, L is gradually increased. As long as the load indicator monitored by the control system and the processing rate indicator controlled by the working system are some countable data processing units, they should be included in the protection scope of the present application.

[0068] In the above implementation process, by continuously monitoring the flow measure reflecting the system load, and comparing it with the upper and lower threshold values set based on the system cache capacity, the system intelligently determines whether the system is in overload, normal or other state. Based on this state determination, the system does not simply enable or stop processing functions, but precisely dynamically adjusts the system processing threshold, which directly controls the rate of system analysis flow. When the system is overloaded, the threshold is actively lowered to quickly reduce the load; when the system load is normal, the threshold is tentatively raised to improve performance. By repeatedly executing this monitoring, judging, and adjusting cycle, the system can automatically find and maintain stable operation near its performance limit, thereby maintaining the backlog of to-be-processed traffic within a reasonable range. The network traffic analysis system can be transformed from passive and rigid overload protection to active and refined performance adaptation, enabling the working system to maintain stable operation near its performance limit, effectively eliminating the jagged fluctuations in traffic trend graphs caused by traditional rough discard strategies, and improving the effectiveness of traffic regulation and the resource utilization efficiency of the working system.

[0069] The above explanations of the claims are provided to more clearly demonstrate how the scheme actually operates in practice. The following will be described in conjunction with a preferred embodiment recorded in the detailed description of the technical scheme of the present application. This embodiment takes the cache flow seconds M and the flow size threshold L as an example to demonstrate how the control system dynamically adjusts the processing performance of the working system through a complete closed-loop control logic including judgment, load reduction, tentative improvement, and rapid recovery, and finally realizes the goal of stable operation near the performance limit. This specific embodiment serves as an instantiation support for the scope of the foregoing claims, which helps those skilled in the art to understand and apply the method provided by the present application to a wider range of scenarios.

[0070] This embodiment includes:

[0071] 1. The flow of the working system is submitted for analysis per second, and the number of seconds of unanalyzed traffic after submission is recorded as M.

[0072] 2. Set a maximum threshold N of the cacheable flow seconds of the working system.

[0073] 3. Set a flow size threshold L to be analyzed and processed by the working system; when the working system is initially running, L can be set to be very large, or L is not judged, i.e., no flow processing limit is made.

[0074] 4. Record the peak P of the flow processed after the working system is running.

[0075] 5. When the cacheable flow seconds M of the working system exceeds the coefficient, such as 1.5 times N, the current flow size is considered to exceed the processing capacity of the working system.

[0076] 6. Reduce L proportionally, for example, to 0.5P, which is half of the peak value. No longer analyze the excess traffic, reduce the load of the working system, and decrease the number of seconds M cached by the working system.

[0077] 7. After L is reduced, if M continues to increase, then continue to reduce L, for example, halve it to 0.25P.

[0078] 8. After L is reduced to a certain value, if M is reduced to a certain coefficient. For example, when it reaches 0.8 times N, it is considered that the working system enters the normal load state. If the normal state lasts for 1 second, then increment the count S by 1; otherwise, decrement it by 1.

[0079] 9. When S exceeds a coefficient, for example, 30 seconds, it means that the working system has entered a continuous working state. At this time, increase L by 50% and reset S to 0.

[0080] 10. If, after L is increased by 50% for the first time, the working system enters step 9 again, record the size of the actually processed traffic T under the current threshold L state, L = L * (1 + 0.1 + (1 – T / L)); if T = L, it means that the collected traffic exceeds the threshold L, and the system only analyzes and processes to obtain T according to the threshold L. At this time, L = L * (1 + 0.1), that is, increase it by 10%; if T < L, it means that the collected traffic becomes smaller, and the actually processed traffic does not reach the threshold L. Assuming T = 0.2L, then L = L * (1 + 0.1 + 0.8), that is, increase it by 90%; the lower the traffic, the smaller the value of T / L, and the faster L grows; increasing L rapidly is to avoid the situation of being unable to process peak traffic (sudden increase in traffic) in a timely manner.

[0081] 11. After L is increased, re - count S and repeat steps 9 and 10.

[0082] 12. If, after L is increased, the working system enters step 5 again, then reduce L by 20%, that is, L = L * 0.8.

[0083] 13. If, after L is reduced, the working system still enters step 5, then repeat step 12 and continue to reduce it by 20%.

[0084] 14. If, after L is reduced, the working system enters step 8, then repeat steps 9 and 10.

[0085] 15. After multiple rounds of increasing and decreasing adjustments like this, a limit value of L will be obtained such that M is between 0.8N and 1.5N.

[0086] 16、If L can only increase by 10% each time, the growth is too slow, and when the collected traffic of the network tap (Test Access Point, TAP) access is adjusted to below the working system bottleneck value, the actual traffic cannot be processed in time. For example, the working system processing limit is 40Gbps, the TAP access traffic is 50Gbps, and the current L is 30Gbps. After adjusting the TAP traffic to 38Gbps, if L grows too slowly, the excess part of 8Gbps cannot be processed in time. An additional algorithm for L to grow quickly: when M<= 3 (configurable), it is considered as a high-performance processing state, and every 30 seconds (configurable) is considered as a period; when it lasts for 1 period, L increases by 10% as in step 10, that is, L1 = L * 1.1; when it lasts for 2 periods, it increases by 50% again on the basis of the previous 10% increase in the first period, that is, L2 = L1 * 1.5; when it lasts for 3 periods, L3 = L2 * 2; when it lasts for 4 periods, L4 = L3 * 3; when it lasts for 5 periods, L5 = L4 * 4; when it exceeds 5 periods, it is considered that the current access traffic is far below the limit performance that the working system can process, and then the traffic is no longer processed for limitation; when the subsequent TAP access traffic becomes large again, the previous steps are repeated for automatic adjustment again.

[0087] Please refer to Figure 2 , Figure 2 The trend diagram of the working system adjustment process provided by the embodiment of the application. Figure 2 In the diagram, the height of the vertical direction represents the high and low of the traffic value, and the horizontal direction represents the adjustment result of the traffic threshold under different adjustment strategies or different stages. Specifically, the dark blue color represents the traffic size collected by the current system, the blue color represents the limit processing capacity of the current system, and when some functions of the system are closed, the processing capacity of the system can be improved, so the blue line after that increases. Red, orange, purple and green represent the adjustment process of L, in which red represents that L greatly exceeds the system processing capacity and needs to be immediately adjusted downward; orange represents that L slightly exceeds the system processing capacity and needs to be adjusted downward according to the state of S; purple represents that L is close to the limit processing capacity of the system and can not be adjusted, and the limit capacity is kept for a long time; and green represents that L or the actual traffic is lower than the system processing capacity and needs to be adjusted upward according to the state of S.

[0088] Based on the same application concept, the embodiment of the application also provides a performance self-adaptive control system based on traffic analysis, which can include:

[0089] A monitoring module is configured to monitor the traffic data of the working system, and obtain an unanalyzed traffic measure based on the traffic data; the traffic measure represents the current load state of the working system;

[0090] The initialization module is configured to determine a maximum threshold of cache traffic seconds of the working system and a system processing threshold; the system processing threshold is used to control a rate of analyzing traffic of the working system;

[0091] The control module is configured to determine whether the working system is in an overload state based on the traffic metric and a first preset threshold, control to decrease the system processing threshold in a case that the working system is in the overload state; determine whether the working system is in a normal load state based on the traffic metric and a second preset threshold, control to start a normal state timer to record a normal state duration of the working system in a case that the working system is in the normal load state; and control to increase the system processing threshold and reset the normal state duration in a case that the normal state duration reaches a preset duration threshold, and monitor processing traffic of the working system in a case that the system processing threshold is increased, to adjust an increasing range of the system processing threshold according to the processing traffic and the system processing threshold; repeatedly perform the operations of determining whether the working system is in the overload state, determining whether the working system is in the normal load state, and monitoring the processing traffic of the working system, to adjust the increasing range of the system processing threshold according to the processing traffic and the system processing threshold, to maintain the traffic metric within a target range based on dynamically adjusting the system processing threshold; wherein the first preset threshold and the second preset threshold are determined based on the maximum threshold of the cache traffic seconds.

[0092] It should be understood that, when the system provided in the above embodiments works, only the division of the functional modules in the above description is taken as an example, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0093] Each functional module in the above embodiments can be integrated in one processing unit, or each unit can exist physically independently, or two or more units can be integrated in one unit, and the integrated unit can be realized in the form of hardware or in the form of a software functional unit. In addition, the specific names of the functional units and modules are only for the convenience of mutual distinction, and are not used to limit the protection scope of the embodiments of the present application.

[0094] The above-described embodiments are only used to illustrate the technical solutions of the present application, but not limit them; although the present application is described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A performance adaptive method based on traffic analysis, characterized in that, include: S1. Monitor the flow data of the working system, and obtain an unanalyzed flow measurement based on the flow data; The flow metric characterizes the current load status of the operating system; S2. Determine the maximum threshold for the number of seconds of traffic cached by the working system and the system processing threshold; The system processing threshold is used to control the rate at which the working system analyzes traffic; S3. Determine whether the working system is in an overload state based on the traffic volume measurement and the first preset threshold. If the working system is in an overload state, control the reduction of the system processing threshold. The first preset threshold is determined based on the maximum threshold of the number of seconds of cached traffic. S4. Determine whether the working system is in a normal load state based on the traffic volume measurement and the second preset threshold. If the working system is in a normal load state, control the start of a normal state timer to record the duration of the normal state of the working system; wherein, the second preset threshold is determined based on the maximum threshold of the number of seconds of cached traffic. S5. When the duration of the normal state reaches a preset duration threshold, control the increase of the system processing threshold and reset the duration of the normal state. When the system processing threshold is increased, monitor the processing traffic of the working system to adjust the increase of the system processing threshold according to the processing traffic and the system processing threshold. S6. Repeat steps S3 to S5 to maintain the flow rate within the target range based on dynamically adjusting the system processing threshold. Wherein, S5 includes: The increase in the system processing threshold is determined based on the base growth rate and the ratio of the actual processing traffic of the working system to the system processing threshold. The formula for adjusting the system processing threshold based on the increase in the system processing threshold includes: L' = L * (1 + A + (1 – T / L)) Where L' is the increased system processing threshold, L is the original system processing threshold, A is the base growth rate, and T is the actual processing flow monitored after increasing the system processing threshold.

2. The performance adaptive method based on traffic analysis according to claim 1, characterized in that, S3 includes: Record the peak traffic volume processed by the working system during operation, and determine whether the working system is in an overload state based on the traffic volume measurement and a first preset threshold. When the operating system is overloaded, the system processing threshold is reduced based on the peak flow rate.

3. The performance adaptive method based on flow analysis according to claim 2, characterized in that, S3 further includes: When the operating system is overloaded, the system stops analyzing traffic exceeding the system's processing threshold to reduce the traffic volume of the operating system.

4. The performance adaptive method based on flow analysis according to claim 2, characterized in that, The first preset threshold is determined based on the maximum threshold of the number of seconds of cached traffic and a first proportional coefficient.

5. The performance adaptive method based on traffic analysis according to claim 1, characterized in that, S4 includes: If the flow rate is lower than the second preset threshold, the count of the normal state duration is increased; if the flow rate is not lower than the second preset threshold, the count is decreased.

6. The performance adaptive method based on flow analysis according to claim 1, characterized in that, The method further includes: If the flow rate remains below a high-performance threshold for one or more complete cycles, the system processing threshold is adjusted in a stepwise multiplication manner; wherein, for each continuous cycle, the increase factor increases with the number of cycles.

7. The performance adaptive method based on flow analysis according to any one of claims 1-6, characterized in that, The traffic metric is the number of data packets or sessions cached by the working system for analysis; the system processing threshold is the threshold for the number of data packets or sessions processed per second by the working system.

8. A performance adaptive control system based on flow analysis, characterized in that, include: The monitoring module is used to monitor the flow data of the working system and obtain an unanalyzed flow measurement based on the flow data; The flow metric characterizes the current load status of the operating system; An initialization module is used to determine the maximum threshold for the number of seconds of traffic cached by the working system and the system processing threshold; The system processing threshold is used to control the rate at which the working system analyzes traffic; The control module is used to determine whether the working system is in an overload state based on the flow rate measurement and a first preset threshold, and if the working system is in an overload state, control to reduce the system processing threshold. Based on the flow rate measurement and the second preset threshold, it is determined whether the working system is in a normal load state. If the working system is in a normal load state, a normal state timer is started to record the duration of the normal state of the working system. And when the duration of the normal state reaches a preset duration threshold, control the increase of the system processing threshold and reset the duration of the normal state. When the system processing threshold is increased, monitor the processing traffic of the working system to adjust the increase of the system processing threshold according to the processing traffic and the system processing threshold. Repeatedly perform operations to determine whether the working system is in an overload state, determine whether the working system is in a normal load state, and monitor the processing traffic of the working system, and adjust the increase of the system processing threshold according to the processing traffic and the system processing threshold, so as to maintain the traffic measurement within the target range based on the dynamic adjustment of the system processing threshold; wherein, the first preset threshold and the second preset threshold are determined based on the maximum threshold of the cached traffic in seconds; Specifically, the control module is used for: The increase in the system processing threshold is determined based on the base growth rate and the ratio of the actual processing traffic of the working system to the system processing threshold. The formula by which the control module adjusts the system processing threshold based on the increase in the system processing threshold includes: L' = L * (1 + A + (1 – T / L)) Where L' is the increased system processing threshold, L is the original system processing threshold, A is the base growth rate, and T is the actual processing flow monitored after increasing the system processing threshold.

Images