Software-defined network and network protocol identification method and system

Abstract

This invention relates to the field of network security technology, and provides a method and system for identifying network protocols based on software-defined networks (SDN). By employing SDN network traffic offloading technology and a distributed computing power network architecture, different service traffic can be offloaded to the distributed computing power network. Classification and identification are performed using a machine learning algorithm model selected based on feature vectors, thus improving the accuracy and efficiency of application protocol identification.

Description

Technical Field

[0001] This application relates to the field of network security, and more specifically, to a method and system for identifying software-defined networks and network protocols. Background Technology

[0002] With the continuous increase in network users, network coverage, network traffic, shared data, and types of network applications, these complex and massive systems cannot be managed manually in the long run. This makes the efficient identification of network traffic and protocols particularly important. This involves two levels: identifying the different characteristics exhibited by network traffic; identifying the application layer protocol used by the traffic; and identifying the specific application that generated the traffic. Furthermore, the ability to intelligently identify the specific application is the most refined and complex identification result.

[0003] Existing port mapping-based traffic identification technologies have both significant advantages and disadvantages. In traditional network environments, identifying network traffic is not particularly complex because various protocols and network applications follow established rules and use specific, well-known ports. For example, HTTP-based web applications use port 80, FTP-based file transfer applications use ports 20 and 21, and telnet remote terminals use port 23. However, with the development of internet applications, especially P2P applications, most applications have adopted dynamic port technology due to practical requirements, meaning they no longer use well-known standard ports to provide network services. For instance, many mainstream web server and FTP server software allow users to set up web servers and FTP servers instead of using fixed ports 80 (web) and 20 and 21 (FTP), rendering port-based traffic identification technologies increasingly ineffective.

[0004] To address the aforementioned issues, existing technologies urgently need improvement. Summary of the Invention

[0005] The purpose of this application is to provide a method and system for identifying software-defined networks and network protocols. By using SDN network traffic splitting technology, different service traffic can be split to different computing power nodes. By using a distributed machine learning algorithm model for classification and identification, the accuracy and efficiency of application protocol identification can be improved.

[0006] Firstly, this application provides a method for identifying software-defined networks and network protocols, including:

[0007] The network data stream is acquired, and the network data stream is distributed to multiple distributed computing nodes in the form of traffic packets according to the SDN switch.

[0008] Based on the distributed computing node receiving traffic packets, the network protocol of the traffic packets is identified according to a preset machine learning model to obtain the protocol identification result; wherein, the preset machine learning model processes traffic packets based on a feature selection algorithm; the feature selection algorithm includes weighted symmetric uncertainty, Pearson correlation measure and tabu search;

[0009] The protocol identification results of each distributed computing node are aggregated to the management node, which then stores or reports them.

[0010] Furthermore, network protocol identification is performed on the traffic packets according to a preset machine learning model to obtain protocol identification results, including: using a multi-stage feature selection algorithm to select features from the network traffic data to obtain an optimal low-dimensional feature subset; and training a preset machine learning model for network traffic identification and classification based on the optimal low-dimensional feature subset; wherein, using a multi-stage feature selection algorithm to select features from the network traffic data includes: using weighted symmetric uncertainty to filter features that are irrelevant to the category, deleting redundant features based on Pearson correlation measure; and performing a global optimization search based on a tabu search strategy, using an evaluation function constructed with classification accuracy and feature information gain to obtain the final feature subset.

[0011] Furthermore, the SDN switch distributes the network data flow to multiple distributed computing nodes in the form of traffic packets, including: real-time monitoring of network data traffic of the entire network services based on the management and control node; when the network data traffic is lower than a preset lower limit, controlling the SDN switch to divert traffic to only some computing nodes, so that the remaining computing nodes enter an idle state; when the network data traffic is higher than a preset upper limit, the management and control node calculates the required number of computing nodes and triggers a capacity expansion mechanism or generates an alarm.

[0012] Furthermore, based on the distributed computing node receiving traffic packets, and according to a preset machine learning model, the traffic packets are used to identify network protocols and obtain protocol identification results. This also includes: calling an application protocol parsing library to perform parsing and matching based on the default port of the traffic packets; if the matching fails, calling an application protocol specified port configuration library to perform secondary parsing and matching; if the secondary parsing and matching fails, it is determined to be an unknown protocol, and triggering network protocol identification of the traffic packets according to the preset machine learning model.

[0013] Furthermore, the step of using weighted symmetric uncertainty to filter features unrelated to the category includes: calculating the weighted symmetric uncertainty between each feature and the category attribute; wherein the weighted symmetric uncertainty is obtained by weighting the traditional symmetric uncertainty by introducing category weights; removing features whose weighted symmetric uncertainty value is lower than a first threshold to complete the filtering of unrelated features and obtain a first feature subset.

[0014] Furthermore, the redundant feature deletion based on Pearson correlation measurement includes: calculating the Pearson correlation coefficient between any two features in the first feature subset; if the Pearson correlation coefficient between the two features is higher than a second threshold, they are determined to be a redundant feature pair, and one of the features is deleted to obtain a second feature subset.

[0015] Furthermore, the global optimization search based on the tabu search strategy, using an evaluation function constructed with classification accuracy and feature information gain to obtain the final feature subset, includes: using the second feature subset as the initial solution for the tabu search; defining a neighborhood operation to generate a candidate solution set for the current solution; selecting the optimal solution from the candidate solution set based on the evaluation function as the current solution for the next round; wherein the evaluation function is constructed to simultaneously maximize classification accuracy and maximize the information gain of the feature subset, and the function value of the evaluation function is proportional to the sum of the classification accuracy and the information gain values ​​of all selected features; storing the searched local optimum information in the tabu table to avoid getting trapped in local optima in subsequent searches; repeating the above steps until the termination condition is met, and outputting the final feature subset.

[0016] Secondly, this application also proposes a software-defined network and network protocol identification system, comprising:

[0017] The acquisition and distribution module is used to acquire network data streams and distribute the network data streams to multiple distributed computing nodes in the form of traffic packets according to the SDN switch.

[0018] The protocol identification module is used to receive traffic packets based on the distributed computing node, identify the network protocol of the traffic packets according to a preset machine learning model, and obtain the protocol identification result; wherein, the preset machine learning model processes traffic packets based on a feature selection algorithm; the feature selection algorithm includes weighted symmetric uncertainty, Pearson correlation measure, and tabu search;

[0019] The aggregation module is used to aggregate the protocol identification results of each distributed computing node to the management node, which then stores or reports them.

[0020] Thirdly, this application also proposes an electronic device comprising: one or more processors, and a memory for storing one or more computer programs; the computer programs are configured to be executed by the one or more processors, and the programs include steps for performing the software-defined network and network protocol identification method described in the first aspect.

[0021] Fourthly, this application also proposes a storage medium storing a computer program; the program is loaded and executed by a processor to implement the steps of the software-defined network and network protocol identification method as described in the first aspect.

[0022] As can be seen from the above, the software-defined network and network protocol identification method and system provided in this application, through SDN network traffic offloading technology, can offload different service traffic to a distributed computing network, and perform classification and identification through a distributed machine learning algorithm model, which can solve the problems of application protocol identification accuracy and efficiency. Specifically, the distributed computing network architecture ensures that the time for a single computing node to identify a packet is almost equal to the time for the entire distributed system to identify the application protocol, shortening the packet application protocol identification time and achieving high real-time performance. Users can freely choose the number of computing nodes according to business needs, supporting flexible expansion. The combination of the efficient network traffic driving engine and SDN traffic offloading technology can eliminate the dependence on dedicated hardware for high-traffic application protocol identification. The feature vector selection-based machine learning algorithm model, based on a multi-stage feature selection algorithm with weighted symmetric uncertainty, filters features in multiple stages, continuously reducing the feature set, which facilitates the accuracy of classification and identification by the distributed machine learning algorithm model. Attached Figure Description

[0023] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart illustrating the steps of the software-defined network and network protocol identification method disclosed in an embodiment of the present invention.

[0025] Figure 2 This is a schematic diagram of the overall structure of the SDN traffic offloading technology disclosed in an embodiment of the present invention;

[0026] Figure 3 This is a schematic diagram of the traffic identification method based on machine learning (AI) disclosed in an embodiment of the present invention;

[0027] Figure 4 This is a flowchart of the execution of the multi-stage traffic feature selection algorithm disclosed in an embodiment of the present invention;

[0028] Figure 5 This is a schematic diagram of the structure of a software-defined network and network protocol identification system disclosed in an embodiment of the present invention. Detailed Implementation

[0029] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which these embodiments belong; the terminology used herein and in the specification of the application is for the purpose of describing particular embodiments only and is not intended to limit these embodiments; the terms "comprising" and "having," and any variations thereof, in the specification of these embodiments and the foregoing description of the accompanying drawings, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification of these embodiments and the foregoing description of the accompanying drawings are used to distinguish different objects, not to describe a particular order.

[0030] The implementation details of the technical solution in this embodiment are described in detail below:

[0031] This application proposes a method for identifying software-defined networks and network protocols, such as... Figure 1 As shown, the method includes:

[0032] S101, Obtain the network data stream, and distribute the network data stream to multiple distributed computing nodes in the form of traffic packets according to the SDN switch.

[0033] Furthermore, the SDN switch distributes the network data flow to multiple distributed computing nodes in the form of traffic packets, including: real-time monitoring of network data traffic of the entire network services based on the management and control node; when the network data traffic is lower than a preset lower limit, controlling the SDN switch to divert traffic to only some computing nodes, so that the remaining computing nodes enter an idle state; when the network data traffic is higher than a preset upper limit, the management and control node calculates the required number of computing nodes and triggers a capacity expansion mechanism or generates an alarm.

[0034] Specifically, in this embodiment, as Figure 2 The diagram shown is a schematic representation of the overall structure of the SDN offloading technology in this embodiment. This embodiment, as... Figure 2 As shown, the SDN traffic offloading technology in the scenario includes a distributed architecture, a traffic engine and a traffic analysis engine, and an application protocol parsing library.

[0035] First, a distributed parallel computing architecture is adopted to perform protocol parsing and identification of network data streams. This is achieved by using SDN mirroring for traffic splitting and introducing a distributed traffic analysis engine to perform protocol parsing and identification, thus meeting the requirements for identifying high-traffic network application protocols.

[0036] Second, the distributed traffic analysis engine deployment allows for the flexible addition and removal of protocol identification computing nodes based on the size of the traffic to be analyzed.

[0037] Based on SND switch traffic offloading technology, mirrored data traffic is distributed to various distributed computing nodes, enabling parallel distribution of data traffic. These distributed computing nodes form a computing power network that can dynamically adjust computing power allocation. This includes receiving traffic packets, quickly identifying the application protocol of the traffic, and executing network traffic application protocol grouping and identification.

[0038] In this embodiment, the computing power network is scheduled on demand to achieve efficient traffic analysis.

[0039] 1. Computing nodes in the computing network can be dynamically scheduled on demand. Nodes can be added or removed elastically based on service data traffic. When the overall service data traffic is too low, significantly less than the load capacity of a single computing node, the management node, through monitoring, makes a decision. It re-links the SDN switch to distribute service data traffic to computing nodes. At this point, the number of nodes receiving traffic packets is less than the total number of computing nodes (some computing nodes are not assigned protocol identification tasks and do not participate in protocol identification). When the management node detects that the overall service data traffic is too high, it calculates the number of computing nodes required for the current service traffic based on service traffic calculations (the management node knows the detection capabilities of each detection node), and then makes a computing identification decision.

[0040] 2. If the total number of computing nodes in the computing power network is within the current service traffic range, the SDN switch will be coordinated to distribute traffic across all existing computing nodes. The protocol identification task will restart on the computing nodes, and the computing nodes with newly added protocol identification tasks will be added to the protocol identification workgroup. If the number of existing computing nodes is still less than the current service traffic, traffic will be distributed across all existing computing nodes, and an alarm will be generated to notify the administrator that the current computing nodes are overloaded and new computing nodes need to be added to complete the application protocol identification for the current service traffic.

[0041] S102, based on the distributed computing node receiving traffic packets, the network protocol of the traffic packets is identified according to a preset machine learning model to obtain the protocol identification result; wherein, the preset machine learning model processes traffic packets based on a feature selection algorithm; the feature selection algorithm includes weighted symmetric uncertainty, Pearson correlation measure and tabu search;

[0042] Furthermore, network protocol identification is performed on the traffic packets according to a preset machine learning model to obtain protocol identification results, including: using a multi-stage feature selection algorithm to select features from the network traffic data to obtain an optimal low-dimensional feature subset; and training a preset machine learning model for network traffic identification and classification based on the optimal low-dimensional feature subset; wherein, using a multi-stage feature selection algorithm to select features from the network traffic data includes: using weighted symmetric uncertainty to filter features that are irrelevant to the category, deleting redundant features based on Pearson correlation measure; and performing a global optimization search based on a tabu search strategy, using an evaluation function constructed with classification accuracy and feature information gain to obtain the final feature subset.

[0043] Specifically, in this embodiment, the traffic identification method based on machine learning (AI) is as follows: Figure 3 As shown, the process includes preprocessing network traffic data to extract the most useful features for network identification and classification; training a network traffic identification model using machine learning algorithms based on the selected feature subset; and identifying and classifying network traffic based on the trained traffic identification model. Furthermore, the machine learning-based traffic identification method is not limited by port numbers, does not require deep inspection of application payloads, and can identify even encrypted traffic.

[0044] S103, the protocol identification results of each distributed computing node are aggregated to the management node, and the management node stores or reports them.

[0045] Specifically, in this embodiment, the traffic service and application protocol identification results are finally aggregated to the management and control node, which then aggregates and reports them.

[0046] In addition, network traffic data is massive in scale and has numerous characteristic attributes. If network traffic identification is performed on high-dimensional feature datasets, the real-time performance and accuracy of classification are difficult to guarantee. Therefore, feature selection is required to transform the original problem from high-dimensional space to low-dimensional space, while removing irrelevant and redundant features to improve the effectiveness of traffic identification.

[0047] First, feature selection is primarily aimed at choosing the most effective features to improve the learner's performance. This embodiment proposes a multi-stage feature selection machine learning model algorithm based on weighted symmetric uncertainty. This algorithm performs staged feature selection, gradually removing irrelevant and redundant features, ultimately obtaining the optimal low-dimensional feature subset.

[0048] A multi-stage traffic feature selection algorithm uses a feature selection metric for symmetric uncertainty. It proposes a weighted symmetric uncertainty to address the class imbalance problem, effectively removing features irrelevant to the class. Then, a Pearson correlation metric is introduced to further reduce redundant features and simplify the feature subset. Finally, a heuristic tabu search strategy is used to obtain the final feature subset. Figure 4 The following is a flowchart of the multi-stage traffic feature selection algorithm in this embodiment.

[0049] Furthermore, the step of using weighted symmetric uncertainty to filter features unrelated to the category includes: calculating the weighted symmetric uncertainty between each feature and the category attribute; wherein the weighted symmetric uncertainty is obtained by weighting the traditional symmetric uncertainty by introducing category weights; removing features whose weighted symmetric uncertainty value is lower than a first threshold to complete the filtering of unrelated features and obtain a first feature subset.

[0050] Furthermore, the redundant feature deletion based on Pearson correlation measurement includes: calculating the Pearson correlation coefficient between any two features in the first feature subset; if the Pearson correlation coefficient between the two features is higher than a second threshold, they are determined to be a redundant feature pair, and one of the features is deleted to obtain a second feature subset.

[0051] Furthermore, the global optimization search based on the tabu search strategy, using an evaluation function constructed with classification accuracy and feature information gain to obtain the final feature subset, includes: using the second feature subset as the initial solution for the tabu search; defining a neighborhood operation to generate a candidate solution set for the current solution; selecting the optimal solution from the candidate solution set based on the evaluation function as the current solution for the next round; wherein the evaluation function is constructed to simultaneously maximize classification accuracy and maximize the information gain of the feature subset, and the function value of the evaluation function is proportional to the sum of the classification accuracy and the information gain values ​​of all selected features; storing the searched local optimum information in the tabu table to avoid getting trapped in local optima in subsequent searches; repeating the above steps until the termination condition is met, and outputting the final feature subset.

[0052] Specifically, this embodiment describes weighted symmetric uncertainty, Pearson correlation measure, and tabu search in sequence.

[0053] 1. Weighted symmetric uncertainty

[0054] There are two different types of evaluation strategies for the correlation between arbitrary random variables: linear and nonlinear. In the nonlinear evaluation strategy, information entropy is used. The information entropy of a random variable X is:

[0055] (1.1)

[0056] The conditional entropy H(X|Y) and joint entropy H(X,Y) of two random variables X and Y are defined as follows:

[0057] (1.2)

[0058] (1.3)

[0059] Where p(x) is the prior probability of x, and p(x,y) is the joint probability of x and y, the information gain can be obtained from formulas (1.2) and (1.3) as follows:

[0060] (1.4)

[0061] The symmetric uncertainty SU(X,Y) of variables X and Y:

[0062] (1.5)

[0063] The value of SU(X,Y) ranges from [0,1]. A larger value indicates a stronger correlation between X and Y. When SU(X,Y) is 0, it means the two variables are completely independent; when SU(X,Y) is 1, it means the two variables are strongly interdependent, meaning that knowing either variable can predict the other. If SU(X,Y) > SU(X,Z), then the correlation between variables X and Y is stronger than the correlation between variables X and Z.

[0064] Therefore, network traffic datasets exhibit class imbalance. Assuming that features X1 and X2 are used to identify the majority and minority classes respectively, since the majority class has a large number of samples, H(Y|X1) will be smaller than H(Y|X2). Therefore, SU(Y,X1) is greater than SU(Y,X2), which means that the value of symmetric uncertainty will be biased towards the majority class features.

[0065] The magnitude of information entropy is determined by the prior probability of the information source and is unrelated to the specific meaning of the event. However, weighted information entropy can be used to evaluate information using the basic probability of the event and the properties of the event in the event set. Generally speaking, the larger the weight of an event, the more important the event is in the event set.

[0066] Given the category attribute C and the total number of samples N in the dataset, the category weights are calculated as follows:

[0067] (1.6)

[0068] Where ni is the number of samples in a certain category Ci, the weighted entropy of feature F can be defined as:

[0069] (1.7)

[0070] Given feature attribute F, the weighted conditional entropy of category C is defined as:

[0071] (1.8)

[0072] Therefore, the weighted information gain is:

[0073] (1.9)

[0074] Based on the above derivation, the weighted symmetric uncertainty is defined as follows:

[0075] (1.10)

[0076] The weighted symmetric uncertainty utilizes information about the class distribution in the original dataset, effectively mitigating class imbalance and ensuring that features identifying both the majority and minority classes are selected. Simultaneously, weighted symmetric uncertainty filters out irrelevant features from the feature set, effectively reducing feature dimensionality.

[0077] 2. Pearson correlation measure

[0078] The Pearson correlation coefficient, as a measure of linear correlation, is mainly used to describe the degree of correlation between two features. Its value ranges from -1 to 1, with a higher value indicating a stronger correlation. The Pearson coefficient can be obtained by calculating the sample's covariance and standard deviation.

[0079] (1.11)

[0080] If the Pearson coefficient between two features in a feature subset is greater than a certain threshold, it indicates that there is redundancy, and one of the features should be deleted to ensure the effectiveness of the feature subset.

[0081] 3. Forbidden Searches

[0082] To avoid getting trapped in local optima and achieve global optimum, various methods such as simulated annealing, tabu search, and evolutionary computation have been proposed for local neighborhood search. Tabu search is a subheuristic global optimization search strategy that primarily avoids repeated searches by marking previously searched local solutions, thereby obtaining the global optimum. The main idea of ​​tabu search is to first determine an initial solution as the current best solution, then define a neighborhood, search within the neighborhood to determine a set of candidate solutions, and select the best solution from this set as the current best solution for the next round. Simultaneously, tabu search introduces a tabu table to cache information about already searched local optima, thus avoiding local extrema to some extent.

[0083] Tabu search, in its initial solution set, is built upon a subset of features after removing irrelevant and redundant features, thus guaranteeing the quality of the initial solution. Feature selection based on the tabu search strategy is essentially an optimization problem under a given evaluation function, which determines the search speed and the quality of the final features. A larger information gain for the feature subset means that the subset contains more information helpful for classification. The evaluation function, based on information gain, is defined as follows:

[0084] (1.12)

[0085] Where m represents the number of samples, Pi is 1 if the i-th sample is correctly classified, and 0 otherwise; n represents the number of features to be selected, and IGj is the information gain value of the j-th selected feature. The algorithm comprehensively considers both classification accuracy and the contribution of features to classification, thus ensuring the effectiveness of the feature subset selected by the algorithm.

[0086] Based on this, the feature selection algorithm WPTS in this embodiment is a hybrid multi-stage feature selection algorithm. First, it uses a weighted symmetric uncertainty measure to filter out features that are irrelevant to classification in the high-dimensional feature attribute set, while effectively alleviating the class imbalance phenomenon in the dataset. Then, it introduces the Pearson coefficient to filter out redundant features in the feature subset, which greatly reduces the dimensionality of the feature attribute set. Finally, it adopts a tabu search strategy, using classification accuracy and the contribution of features to classification as evaluation functions, to perform a global search within a limited feature set, and finally obtain the optimal feature subset.

[0087] Furthermore, based on the distributed computing node receiving traffic packets, and according to a preset machine learning model, the traffic packets are used to identify network protocols and obtain protocol identification results. This also includes: calling an application protocol parsing library to perform parsing and matching based on the default port of the traffic packets; if the matching fails, calling an application protocol specified port configuration library to perform secondary parsing and matching; if the secondary parsing and matching fails, it is determined to be an unknown protocol, and triggering network protocol identification of the traffic packets according to the preset machine learning model.

[0088] Specifically, the system processing workflow in this embodiment is as follows:

[0089] After initialization, the distributed computing network and protocol identification system report their node information to the management node to complete node registration and online status.

[0090] Based on SDN switch traffic offloading technology, the mirrored traffic of service data is offloaded to the computing nodes of different distributed computing power networks, realizing the parallel distribution of traffic to be identified, and the computing nodes of each computing power network receive the packets to be identified almost simultaneously.

[0091] After receiving a data packet, the computing nodes of each computing power network cache the packet in the receiving packet cache queue. The recognition engine driver reads the packet to be recognized from the receiving packet cache and calls the application protocol parsing library to parse and match according to the default application protocol port.

[0092] If the match is successful, it means that the protocol is in the application protocol library. The protocol identification result information is returned, the identification of the message ends, and the identification result is summarized and stored or reported to the control node.

[0093] If the application protocol parsing library fails to parse and match successfully, it will retrieve the configuration from the application protocol's specified port configuration library and parse and match again.

[0094] Furthermore, if a match is successful, it indicates that the protocol is a known application protocol for the specified port, and the protocol identification result information is returned to end the identification of the message.

[0095] If the match fails, the application protocol is considered to be an unknown protocol and cannot be parsed. The parsing result status is then returned to the management node.

[0096] Based on this, the packet parsing and recognition time of a single computing node involved in the embodiment is almost equal to the packet recognition time of the entire distributed system. This improves data packet recognition performance and shortens recognition time, thereby enhancing the efficiency of protocol recognition in this method and meeting the current demand for high-volume network data protocol recognition.

[0097] Secondly, this embodiment also proposes a software-defined network and network protocol identification system, such as... Figure 5 ,include:

[0098] The acquisition and distribution module 501 is used to acquire network data streams and distribute the network data streams to multiple distributed computing nodes in the form of traffic packets according to the SDN switch.

[0099] The protocol identification module 502 is used to receive traffic packets based on the distributed computing node, identify the network protocol of the traffic packets according to a preset machine learning model, and obtain the protocol identification result; wherein, the preset machine learning model processes traffic packets based on a feature selection algorithm; the feature selection algorithm includes weighted symmetric uncertainty, Pearson correlation measure, and tabu search;

[0100] The aggregation module 503 is used to aggregate the protocol identification results of each distributed computing node to the management node, and the management node stores or reports them.

[0101] Thirdly, this embodiment also proposes an electronic device, the electronic device comprising: one or more processors, and a memory for storing one or more computer programs; the computer programs are configured to be executed by the one or more processors, the programs comprising steps for performing the software-defined network and network protocol identification method described in the first aspect.

[0102] Fourthly, this embodiment also proposes a storage medium storing a computer program; the program is loaded and executed by a processor to implement the steps of the software-defined network and network protocol identification method as described in the first aspect.

[0103] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, or may be electrical, mechanical or other forms of connection.

[0104] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0105] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a grid device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0106] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for identifying software-defined networks and network protocols, characterized in that, include: The network data stream is acquired, and the network data stream is distributed to multiple distributed computing nodes in the form of traffic packets according to the SDN switch. Based on the distributed computing node receiving traffic packets, network protocol identification is performed on the traffic packets according to a preset machine learning model to obtain the protocol identification result; The protocol identification results of each distributed computing node are aggregated to the management node, which then stores or reports them. The network protocol of the traffic packets is identified according to a preset machine learning model, and the protocol identification result is obtained, including: A multi-stage feature selection algorithm is used to select features from network traffic data to obtain the optimal low-dimensional feature subset; Based on the optimal low-dimensional feature subset, a preset machine learning model is trained for network traffic identification and classification. Among them, a multi-stage feature selection algorithm is used to select features from network traffic data, including: We use weighted symmetric uncertainty to filter out features that are irrelevant to the category and remove redundant features based on Pearson correlation measure. Furthermore, a global optimization search is performed based on a tabu search strategy, using an evaluation function constructed from classification accuracy and feature information gain, to obtain the final feature subset.

2. The method for identifying software-defined networks and network protocols according to claim 1, characterized in that, The SDN switch distributes the network data stream as traffic packets to multiple distributed computing nodes, including: Based on the real-time monitoring of network data traffic of the entire network services by the control node; when the network data traffic is lower than the preset lower limit, the SDN switch is controlled to divert the traffic to only some computing nodes, so that the remaining computing nodes enter an idle state; When the network data traffic exceeds a preset upper limit, the control node calculates the required number of computing nodes and triggers an expansion mechanism or generates an alarm.

3. The method for identifying software-defined networks and network protocols according to claim 2, characterized in that, Based on the distributed computing node receiving traffic packets, performing network protocol identification on the traffic packets according to a preset machine learning model, and obtaining the protocol identification result, the method further includes: The application protocol parsing library is invoked to perform parsing and matching based on the default port of the traffic packet; if the matching fails, the application protocol specified port configuration library is invoked for secondary parsing and matching. If the secondary parsing and matching fails, it is determined to be an unknown protocol, and a network protocol identification is triggered based on a preset machine learning model for the traffic packet.

4. The method for identifying software-defined networks and network protocols according to claim 1, characterized in that, The method of using weighted symmetric uncertainty to filter features that are irrelevant to the category includes: Calculate the weighted symmetric uncertainty between each feature and the category attribute; wherein, the weighted symmetric uncertainty is obtained by weighting the traditional symmetric uncertainty by introducing category weights; Remove features whose weighted symmetric uncertainty value is below the first threshold to filter irrelevant features and obtain the first feature subset.

5. The method for identifying software-defined networks and network protocols according to claim 4, characterized in that, The redundant feature removal based on Pearson correlation measurement includes: Calculate the Pearson correlation coefficient between any two features in the first feature subset; If the Pearson correlation coefficient between two features is higher than the second threshold, they are identified as a redundant feature pair, and one of the features is deleted to obtain the second feature subset.

6. The method for identifying software-defined networks and network protocols according to claim 5, characterized in that, The tabu search strategy, using an evaluation function constructed from classification accuracy and feature information gain, performs a global optimization search to obtain the final feature subset, including: Use the second feature subset as the initial solution for the tabu search; Define a neighborhood operation to generate a set of candidate solutions for the current solution; The optimal solution is selected from the candidate solution set based on the evaluation function as the current solution for the next round; wherein the evaluation function is constructed to simultaneously maximize the classification accuracy and the information gain of the feature subset, and the function value of the evaluation function is proportional to the sum of the classification accuracy and the information gain values ​​of all selected features; Information on locally optimal solutions that have been searched is stored in a tabu list to avoid getting trapped in local optima in subsequent searches; Repeat the above steps until the termination condition is met, and output the final feature subset.

7. A software-defined network and network protocol identification system, characterized in that, include: The acquisition and distribution module is used to acquire network data streams and distribute the network data streams to multiple distributed computing nodes in the form of traffic packets according to the SDN switch. The protocol identification module is used to receive traffic packets based on the distributed computing node, identify the network protocol of the traffic packets according to a preset machine learning model, and obtain the protocol identification result. Specifically, a multi-stage feature selection algorithm is used to select features from the network traffic data to obtain an optimal low-dimensional feature subset. Based on the optimal low-dimensional feature subset, a preset machine learning model is trained for network traffic identification and classification. The multi-stage feature selection algorithm for network traffic data includes: filtering features irrelevant to the category using weighted symmetric uncertainty, deleting redundant features based on Pearson correlation measurement, and performing a global optimization search based on a tabu search strategy, using an evaluation function constructed from classification accuracy and feature information gain, to obtain the final feature subset. The aggregation module is used to aggregate the protocol identification results of each distributed computing node to the management node, which then stores or reports them.

8. An electronic device, the electronic device comprising: One or more processors, a memory for storing one or more computer programs; characterized in that the computer programs are configured to be executed by the one or more processors, the programs including steps for performing the software-defined network and network protocol identification method as described in any one of claims 1-6.

9. A storage medium storing a computer program; characterized in that, The program is loaded and executed by a processor to implement the steps of the software-defined network and network protocol identification method as described in any one of claims 1-6.

Images