Dynamic self-adaptive flow table neural index optimization method, device and equipment

Abstract

The invention discloses a dynamic self-adaptive flow table neural index optimization method, device and equipment. Comprising the steps of obtaining a change rule of a flow table, calculating an offset corresponding to the change rule, and updating an affected weight subset of a neural indexer based on the offset; calculating the space-time access popularity of each rule in the flow table, constructing a decision tree based on the space-time access popularity, and executing rule classification or new sub-domain creation operation according to the newly added rule; and when the flow table rule matching fails, obtaining a failure feedback signal, and optimizing the neural indexer based on the failure feedback signal. By updating the affected weight subsets of the neural indexers, full-amount retraining of the model can be avoided, the adjustment time delay is reduced, and model failure caused by rule addition and deletion is prevented. By executing the operation of classifying or establishing the new sub-domain according to the newly added rule, the sub-domain can fit the rule access characteristic, and the number of the new sub-domain and the redundancy calculation are reduced. And in case of failure, the neural indexer is optimized through feedback signals, prediction errors can be corrected, and the prediction accuracy is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network communication, in particular to a dynamic adaptive flow table neural index optimization method, device and equipment. BACKGROUND

[0002] With the rapid development of cloud computing, edge computing and 5G / 6G networks, network traffic is showing explosive growth and highly dynamic characteristics, which puts high performance requirements on the core function of network devices, i.e. fast matching in massive flow table rules according to the five-tuple of data packets.

[0003] In the prior art, the EffiMatch flow table matching scheme is a representative achievement in this field: first, a light neural network is used to learn the five-tuple of the input data packet, output an index vector to predict the possible rule partition where the data packet is located, and realize fuzzy positioning; then, a candidate selector activates limited rule blocks according to the prediction result, and applies a field pruning strategy to shrink the matching range and reduce the subsequent calculation amount. Finally, an accurate matcher checks each candidate rule to ensure the accuracy of the matching result.

[0004] However, the neural index model of the existing matching scheme has a static characteristic, and any addition or deletion operation of the flow table rules requires full retraining of the model, resulting in high model adjustment delay and difficulty in adapting to dynamically changing rule sets. In addition, the pre-divided rule partitions are fixed and cannot be adjusted following the data flow distribution after the dynamic change of the rule set, which easily causes the prediction accuracy of the neural index to the rule partition to decrease, and at the same time causes redundant calculation and reduces the overall flow table matching efficiency. SUMMARY

[0005] The present application provides a dynamic adaptive flow table neural index optimization method, device and equipment, which solves the problems of high delay caused by full retraining of the static neural index in the existing scheme, fixed rule partitions that cannot adapt to dynamic data distribution, and high error rate of pruning strategy after matching failure by proposing the processes of neural index incremental updating, elastic subdomain division adjustment and matching failure feedback optimization.

[0006] According to an aspect of the present application, a dynamic adaptive flow table neural index optimization method is provided, which comprises:

[0007] Obtaining the changed rules of the flow table, calculating the offset corresponding to the changed rules, and updating the affected weight subset of the neural index based on the offset, wherein the changed rules include new rules and deleted rules;

[0008] Calculating the spatiotemporal access heat of each rule in the flow table, constructing a decision tree based on the spatiotemporal access heat, and performing rule grouping or new subdomain creation operation according to the new rules;

[0009] When the flow table rule matching fails, a failure feedback signal is obtained, and the neural indexer is optimized based on the failure feedback signal, wherein the failure feedback signal includes a failure query feature vector, a correct rule and a candidate rule set.

[0010] Optionally, the offset corresponding to the changed rule is calculated, including: converting the changed rule into a five-tuple feature vector; inputting the feature vector into the input layer of the neural indexer to obtain a predicted index vector output by the output layer; when the changed rule is a new rule, obtaining a target rule partition allocated to the new rule by the sorting module, determining a target index vector corresponding to the target rule partition, and taking the difference between the target index vector and the predicted index vector as the offset; when the changed rule is a deletion rule, taking the negative value of the predicted index vector as the offset.

[0011] Optionally, the affected weight subset of the neural indexer is updated based on the offset, including: obtaining a forward propagation path of the feature vector in the neural indexer, generating an affected neuron whose activation value exceeds a preset threshold and a corresponding affected weight subset; obtaining the old weight of the affected weight subset, substituting the old weight and the offset into a preset weight update formula to generate an updated affected weight subset; and replacing the old weight with the updated affected weight subset.

[0012] Optionally, the spatio-temporal access heat of each rule in the flow table is calculated, and a decision tree is constructed based on the spatio-temporal access heat, including: determining the historical access times of each rule to generate access frequency data of each rule; calculating the time difference between the last access time of each rule and the current time, and combining a preset decay coefficient to generate a recent access decay value corresponding to each rule; substituting the access frequency data and the recent access decay value into a preset heat calculation formula to obtain the spatio-temporal access heat of each rule; and generating a dynamic decision tree based on the spatio-temporal access heat of each rule and the five-tuple feature vector according to the principle of maximum information gain.

[0013] Optionally, the rule is classified or a new sub-domain is created according to the new rule, including: inputting the feature vector corresponding to the new rule as a new vector into the decision tree to generate a candidate sub-domain; calculating the mean of the feature vectors of all rules in the candidate sub-domain as a center vector of the candidate sub-domain; calculating the cosine similarity between the new vector and the center vector; when the cosine similarity is greater than or equal to a preset similarity, obtaining an existing rule set of the candidate sub-domain, classifying the new rule into the existing rule set, and updating the center vector of the candidate sub-domain to generate an updated sub-domain; and when the cosine similarity is less than the preset similarity, creating a new sub-domain containing only the new rule.

[0014] Optionally, the optimization of the neural indexer based on the failure feedback signal comprises: locating a correct sub-domain based on a correct rule; when the correct sub-domain is not in the candidate rule set, obtaining a feature vector of the correct rule and a correct index vector corresponding to the correct sub-domain, and updating an affected weight subset of the neural indexer based on the feature vector of the correct rule and the correct index vector.

[0015] Optionally, the method further comprises: when the correct sub-domain is in the candidate rule set, obtaining a matching condition of each field of the correct rule, calculating a matching specificity score of each field; substituting the matching specificity score into a preset field weight formula to calculate an updated weight of each field; and adjusting a pruning strategy of the candidate selector using the updated weight of each field.

[0016] According to another aspect of the present application, there is provided a dynamic adaptive flow table neural indexer optimization device, which comprises:

[0017] a rule incremental update module configured to obtain a changed rule of the flow table, calculate an offset corresponding to the changed rule, and update an affected weight subset of the neural indexer based on the offset, wherein the changed rule comprises an added rule and a deleted rule;

[0018] a sub-domain division adjustment module configured to calculate a spatiotemporal access heat of each rule in the flow table, construct a decision tree based on the spatiotemporal access heat, and perform rule grouping or new sub-domain creation operation according to the added rule;

[0019] a neural indexer optimization module configured to obtain a failure feedback signal when a rule matching of the flow table fails, and optimize the neural indexer based on the failure feedback signal, wherein the failure feedback signal comprises a failure query feature vector, a correct rule and a candidate rule set.

[0020] According to another aspect of the present application, there is provided an electronic device, which comprises:

[0021] at least one processor;

[0022] and a memory connected to the at least one processor in communication;

[0023] wherein the memory stores a computer program capable of being executed by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute a dynamic adaptive flow table neural indexer optimization method according to any one of the embodiments of the present application.

[0024] According to another aspect of the present application, there is provided a computer readable storage medium storing computer instructions for enabling a processor to implement a dynamic adaptive flow table neural indexer optimization method according to any one of the embodiments of the present application when executed by the processor.

[0025] The technical solution of the embodiment of the application can avoid full model retraining, reduce adjustment delay, and prevent model failure caused by rule addition and deletion by obtaining flow table change rules and calculating offset according to the rules and updating the affected weight subset of the neural indexer; calculating rule spatiotemporal access hotness, constructing a decision tree, and performing subdomain operation according to the newly added rules can make the subdomain fit the rule access characteristics, reduce the number of new subdomains and redundant calculation; obtaining a feedback signal to optimize the neural indexer when the flow table rule matching fails can accurately correct prediction errors and improve prediction accuracy to reduce subsequent matching failures.

[0026] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the application, nor is it intended to limit the scope of the application. Other features of the application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0028] Figure 1 is a flow chart of a dynamic adaptive flow table neural indexer optimization method according to an embodiment of the application;

[0029] Figure 2 is a flow chart of another dynamic adaptive flow table neural indexer optimization method according to an embodiment of the application;

[0030] Figure 3 is a structural schematic diagram of a dynamic adaptive flow table neural indexer optimization device according to an embodiment of the application;

[0031] Figure 4 is a structural schematic diagram of an electronic device for implementing a dynamic adaptive flow table neural indexer optimization method according to an embodiment of the application. DETAILED DESCRIPTION

[0032] In order to make those skilled in the art better understand the application scheme, the technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only some embodiments of the application, not all embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the application.

[0033] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and in the above drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0034] Embodiment one

[0035] Figure 1 A flowchart of a dynamic adaptive flow table neural index optimization method is provided for the first embodiment of the present application. The present embodiment can be applicable to the flow table matching scene of a network device. The method can be executed by a dynamic adaptive flow table neural index optimization device. The dynamic adaptive flow table neural index optimization device can be realized in the form of hardware and / or software, and can be configured in a computer controller. As shown in the figure, the method comprises the following steps. Figure 1

[0036] S110, obtaining a change rule of a flow table, calculating an offset corresponding to the change rule, and updating an affected weight subset of a neural indexer based on the offset, wherein the change rule includes an added rule and a deleted rule.

[0037] The change rule of the flow table refers to the rule change occurring in the flow table, which is divided into two categories: added rules and deleted rules. The offset refers to the deviation vector of the expected output of the neural indexer due to the addition and deletion of flow table rules. The dimension is consistent with the output vector of the indexer, and is used to quantify the magnitude of the adjustment required by the model. The neural indexer is a lightweight neural network model that receives a five-tuple feature vector of a data packet and outputs an index vector to predict the sub-domain to which the rule belongs. The affected weight subset refers to the weight set corresponding to the neurons that are significantly activated in the neural indexer when the rule is changed. Only updating this subset can avoid full retraining.

[0038] Specifically, when the flow table has an added or deleted rule operation, the operation event is captured by the CPU. The CPU extracts the added or deleted rule and converts it into a corresponding five-tuple feature vector, denoted as added rule feature vector and deleted rule feature vector , and the encoding method of the feature vector is exactly the same as that during the training of the neural indexer, ensuring the accuracy of subsequent calculations. ​

[0039] Optionally, the offset corresponding to the change rule is calculated, including: converting the change rule into a five-tuple feature vector; inputting the feature vector into an input layer of a neural indexer to obtain a predicted index vector output by an output layer; when the change rule is an added rule, obtaining a target rule partition allocated to the added rule by the sorting module, determining a target index vector corresponding to the target rule partition, and taking a difference value between the target index vector and the predicted index vector as the offset; when the change rule is a deleted rule, taking a negative value of the predicted index vector as the offset.

[0040] Specifically, the CPU inputs the five-tuple feature vector converted above into the input layer of the neural indexer. As a lightweight neural network model, the neural indexer processes the input feature vector through forward propagation calculation of internal neurons, and finally outputs a predicted index vector from the output layer. The vector is used to preliminarily predict the rule partition or rule sub-domain to which the change rule may belong in the flow table rule set. For an added rule, the output predicted index vector is denoted as ; for a deleted rule, the output predicted index vector is denoted as .

[0041] In a specific embodiment, when the change rule is an added rule, the sorting module working according to the structure-aware sorting principle allocates a most suitable target rule partition to the added rule according to the features of the added rule, i.e., the rule sub-domain to which the added rule should belong. Since each rule partition corresponds to a preset target index vector expected to be output by the neural indexer , the corresponding can be determined after the target rule partition is obtained. Finally, the difference between the target index vector and the predicted index vector is calculated to obtain the offset corresponding to the added rule, i.e. . The difference value quantifies the deviation between the current output and the expected output of the neural indexer, providing a basis for subsequent weight adjustment.

[0042] In a specific embodiment, when the change rule is a deleted rule, the neural indexer should not output a predicted vector strongly related to the rule in an ideal state since the rule has been removed from the flow table. Therefore, a negative adjustment is needed for the model output. At this time, the predicted index vector output by the neural indexer corresponding to the deleted rule is directly taken as a negative value, i.e., the offset corresponding to the deleted rule is obtained, i.e. . Through the negative offset, the neural indexer can weaken the activation strength of neurons related to the deleted rule in subsequent weight update, avoiding invalid prediction.

[0043] Optionally, the affected weight subset of the neural indexer is updated based on the offset, including: obtaining a forward propagation path of the feature vector in the neural indexer, generating an affected neuron and a corresponding affected weight subset whose activation value exceeds a preset threshold; obtaining the old weight of the affected weight subset, substituting the old weight and the offset into a preset weight update formula to generate an updated affected weight subset; and replacing the old weight with the updated affected weight subset.

[0044] Specifically, after inputting the five-tuple feature vector corresponding to the change rule into the neural indexer, the forward propagation path of the feature vector in the neural indexer is traced back, that is, each neuron node activated in the process of the vector passing through the input layer, the hidden layer to the output layer in turn. Then, based on a preset activation threshold, the neurons in the propagation path whose activation value exceeds the threshold, that is, the affected neurons, are screened out. The affected neurons respond more significantly to the feature vector of the change rule, and the change of the weights of the affected neurons directly affects the prediction result of the model for similar rules. Only the affected weight subset corresponding to the affected neurons in the model is updated, which can greatly reduce the calculation amount and avoid the high latency of full retraining.

[0045] Further, when calculating the updated affected weight subset, the current weight data of the affected weight subset needs to be extracted from the neural indexer, denoted as old weight . In the second step, the online learning weight update formula based on gradient descent preset in the scheme is called: . Wherein, represents the updated affected weight subset, represents a decay factor, represents an offset, represents a transpose matrix of the change rule feature vector. By substituting the old weight, the offset and the corresponding feature vector transpose matrix into the formula, the updated affected weight subset can be generated through matrix operation. After generating the updated affected weight subset , the old weight of the affected weight subset in the neural indexer is immediately replaced with the new subset , and the new weight takes effect immediately after replacement. When a new flow table query request arrives subsequently, the neural indexer directly uses the updated weight for operation, outputs a more accurate index vector, realizes dynamic adaptation of the model to the change of the flow table rule, and at the same time avoids the high latency problem caused by full retraining.

[0046] S120, calculate the space-time access heat of each rule in the flow table, construct a decision tree based on the space-time access heat, and perform rule grouping or new sub-domain creation operation according to the new rule.

[0047] The space-time access heat is an index for measuring the access frequency and timeliness of the flow table rule. The decision tree refers to splitting nodes according to the information gain maximization principle with the space-time access heat and the five-tuple feature of the rule as inputs, and the leaf nodes correspond to the dynamic sub-domain, which is used to define the sub-domain boundary. The rule is classified into the sub-domain, and the sub-domain center vector is updated. The new sub-domain is created, and the sub-domain exclusive multi-layer perceptron (MLP) model is initialized and trained.

[0048] Optionally, the space-time access heat of each rule in the flow table is calculated, and the decision tree is constructed based on the space-time access heat, including: determining the historical access times of each rule, generating the access frequency data of each rule; calculating the time difference value between the last access time of each rule and the current time, and combining the preset decay coefficient to generate the recent access decay value corresponding to each rule; the access frequency data and the recent access decay value are substituted into the preset heat calculation formula to obtain the space-time access heat of each rule; and the dynamic decision tree is generated based on the space-time access heat of each rule and the five-tuple feature vector according to the information gain maximization principle.

[0049] Specifically, the control plane server periodically or at the rule change event trigger, pulls the historical access records of all rules in the flow table from the data plane node. By counting the total number of times each rule is queried and matched within a preset time window, the access frequency data corresponding to each rule is generated. The access frequency data directly reflects the access frequency of the rule. The more the access times, the greater the frequency data, and the higher the heat base value calculated subsequently. Then, the controller extracts the last access timestamp of each rule, calculates the difference value with the current system time, and obtains the time difference value. Then, combined with the preset decay coefficient, the recent access decay value = decay coefficient x time difference value inverse vector value is generated to generate the decay value, so that the rules accessed recently can obtain a higher decay value, reflecting the timeliness of the access.

[0050] The preset space-time access heat calculation formula is: , wherein, represents the space-time access heat, is the access times, is the decay factor from the current time, represents the balance coefficient.

[0051] Specifically, the controller combines the spatiotemporal access hotness and the five-tuple feature vector of all rules in the flow table to form a raw data set for building the decision tree, and takes the data set as the initial root node of the decision tree. Then, for the data set of the current node, all five-tuple features are traversed to determine possible split thresholds for each feature, such as whether the destination port is greater than 1024, whether a bit of the source IP is 1, and the like, to form split combinations of features and thresholds. Then, the information gain of each split combination after splitting is calculated by the information gain formula, first according to the formula: wherein H (P) is the entropy of the parent node before splitting, and H (C) is the entropy of each child node after splitting. is the data set of the node, and is the proportion of data of a certain hotness category in the node, and n is a preset number of hotness categories, such as high, medium, and low. is the entropy of the parent node, and and are the numbers of rules in the parent node and the child node, respectively. is the entropy of the child node. The controller selects the split combination with the maximum information gain to split the current node into two child nodes, one of which contains rules whose features satisfy the threshold, and the other contains rules whose features do not satisfy the threshold. Finally, the second to fourth steps are repeated recursively for the split child nodes until the node meets the stopping condition, such as the number of rules in the child node being less than a preset threshold, the node information entropy being lower than a preset value, or the height of the tree reaching a maximum limit. The tree structure finally formed is the dynamic decision tree, and each leaf node of the tree corresponds to an initial dynamic rule subdomain, which provides a basis for subsequent rule attribution judgment.

[0052] Optionally, the rule attribution or new subdomain creation operation according to the new rule is performed, including: inputting the feature vector corresponding to the new rule as a new vector into the decision tree to generate a candidate subdomain; calculating the mean of the feature vectors of all rules in the candidate subdomain as a center vector of the candidate subdomain; calculating the cosine similarity between the new vector and the center vector; when the cosine similarity is greater than or equal to a preset similarity, obtaining an existing rule set of the candidate subdomain, attributing the new rule to the existing rule set, and updating the center vector of the candidate subdomain to generate an updated subdomain; and when the cosine similarity is less than the preset similarity, creating a new subdomain containing only the new rule.

[0053] ​​​Specifically, when there is a new rule, the corresponding new vector can be input into the dynamic decision tree previously constructed based on the spatio-temporal access heat, and by traversing the node splitting logic of the decision tree, the new vector is gradually matched from the root node downward, and finally falls into a leaf node of the decision tree. The rule set corresponding to the leaf node is the candidate sub-domain of the new rule, representing the existing sub-domain to which the new rule is most likely to belong in terms of feature and heat distribution. The controller extracts the five-tuple feature vector corresponding to all existing rules in the sub-domain, and obtains a vector representing the overall feature distribution of the sub-domain by calculating the mean value of the corresponding dimensions of all feature vectors, that is, the center vector of the candidate sub-domain. Then, the cosine similarity formula is used to calculate the similarity between the new vector and the center vector of the candidate sub-domain. The cosine similarity has a value range of [-1, 1], and the closer the value is to 1, the more consistent the directions of the two vectors, that is, the higher the feature matching degree between the new rule and the existing rules in the candidate sub-domain; the closer the value is to -1 or the smaller the value is, the lower the matching degree.

[0054] Further, when the cosine similarity is greater than or equal to the similarity threshold preset by the scheme, it indicates that the new rule is highly matched with the candidate sub-domain, and there is no need to create a new sub-domain. At this time, the new rule is directly added to the existing rule set of the candidate sub-domain, and the mean value of the feature vectors of all rules in the sub-domain is recalculated to update the center vector of the candidate sub-domain, and an updated sub-domain is generated to ensure that the matching judgment of subsequent new rules can be based on the latest feature distribution of the sub-domain. When the cosine similarity is less than the preset similarity threshold, it indicates that the new rule is an outlier, and its feature is quite different from the features of any existing sub-domain. If it is included in an existing sub-domain, the consistency of the features in the sub-domain will be destroyed, resulting in a decrease in subsequent matching accuracy. At this time, a new sub-domain needs to be created, and the new sub-domain initially only includes the new rule; at the same time, a dedicated lightweight MLP model is initialized as a sub-domain indexer for the new sub-domain, and is adapted to the rule features of the new sub-domain through fast online training, and finally the new sub-domain information, the new rule and the trained sub-domain indexer are synchronized to each data plane server to complete the deployment of the new sub-domain.

[0055] S130, when the flow table rule matching fails, a failure feedback signal is obtained, and the neural indexer is optimized based on the failure feedback signal, wherein the failure feedback signal includes a failed query feature vector, a correct rule and a candidate rule set.

[0056] The flow table rule matching failure refers to that the exact matcher does not find a rule completely matching the query data packet in the rule set provided by the candidate selector. The failure feedback signal refers to a signal generated by the exact matcher when the matching fails, and includes a five-tuple feature vector of the failed query, a correct rule finally confirmed, and an initial candidate rule set. The failed query feature vector refers to a five-tuple feature vector corresponding to the query data packet that fails to match, and the encoding mode is consistent with that during training of the neural indexer. The correct rule refers to a flow table rule that is actually matched with the failed query data packet and is verified by the control plane. The candidate rule set refers to a rule set to be exactly matched provided by the candidate selector for the query data packet according to the prediction result of the neural indexer.

[0057] The technical scheme of the embodiment of the application can avoid full-model retraining, reduce adjustment latency, and prevent model failure caused by rule addition and deletion by obtaining a flow table change rule, calculating an offset based on the flow table change rule, and updating an affected weight subset of the neural indexer. The rule space-time access hotness is calculated, a decision tree is constructed, and a sub-domain operation of being classified into or newly created is performed according to a newly added rule, so that the sub-domain can be adapted to rule access characteristics, the number of new sub-domains and redundant calculation can be reduced, and the feedback signal is obtained when the flow table rule matching fails to optimize the neural indexer, so that prediction errors can be accurately corrected, the prediction accuracy of the neural indexer can be improved, and subsequent matching failures can be reduced.

[0058] Embodiment Two

[0059] Figure 2 A flowchart of a dynamic and adaptive flow table neural indexer optimization method provided by the second embodiment of the application is shown in the figure. The embodiment adds a specific process of optimizing the neural indexer based on the failure feedback signal on the basis of the first embodiment. The specific content of steps S210-S220 is substantially the same as that of steps S110-S120 in the first embodiment, and therefore will not be described again in the embodiment. As shown in the figure, the method comprises the following steps. Figure 2

[0060] S210, obtaining a change rule of a flow table, calculating an offset corresponding to the change rule, and updating an affected weight subset of the neural indexer based on the offset, wherein the change rule includes a newly added rule and a deleted rule.

[0061] Optionally, calculating the offset corresponding to the change rule comprises: converting the change rule into a feature vector of a five-tuple; inputting the feature vector into an input layer of the neural indexer to obtain a prediction index vector output by an output layer; when the change rule is a newly added rule, obtaining a target rule partition allocated to the newly added rule by a sorting module, determining a target index vector corresponding to the target rule partition, and taking a difference between the target index vector and the prediction index vector as the offset; and when the change rule is a deleted rule, taking a negative value of the prediction index vector as the offset.

[0062] ​Optionally, the affected weight subset of the neural indexer is updated based on the offset, including: obtaining a forward propagation path of the feature vector in the neural indexer, generating an affected neuron whose activation value exceeds a preset threshold and a corresponding affected weight subset; obtaining an old weight of the affected weight subset, substituting the old weight and the offset into a preset weight update formula to generate an updated affected weight subset; and replacing the old weight with the updated affected weight subset.

[0063] S220, calculate the space-time access heat of each rule in the flow table, construct a decision tree based on the space-time access heat, and perform rule grouping or new sub-domain creation operation according to the new rule.

[0064] Optionally, the space-time access heat of each rule in the flow table is calculated, and a decision tree is constructed based on the space-time access heat, including: determining the historical access times of each rule to generate the access frequency data of each rule; calculating the time difference value between the last access time of each rule and the current time, and combining a preset decay coefficient to generate the recent access decay value corresponding to each rule; substituting the access frequency data and the recent access decay value into a preset heat calculation formula to obtain the space-time access heat of each rule; and generating a dynamic decision tree based on the space-time access heat of each rule and the five-tuple feature vector according to the principle of maximum information gain.

[0065] Optionally, the rule grouping or new sub-domain creation operation is performed according to the new rule, including: inputting the feature vector corresponding to the new rule as a new vector into the decision tree to generate a candidate sub-domain; calculating the mean of the feature vectors of all rules in the candidate sub-domain as the center vector of the candidate sub-domain; calculating the cosine similarity between the new vector and the center vector; when the cosine similarity is greater than or equal to a preset similarity, obtaining an existing rule set of the candidate sub-domain, grouping the new rule into the existing rule set, updating the center vector of the candidate sub-domain, and generating an updated sub-domain; and when the cosine similarity is less than the preset similarity, creating a new sub-domain containing only the new rule.

[0066] S230, when the flow table rule matching fails, a failure feedback signal is obtained.

[0067] S240, positioning the correct sub-domain based on the correct rule.

[0068] Specifically, after the flow table rule matching fails and generates a failure feedback signal, the feedback processing unit inside the candidate selector will first extract the correct rule in the signal, that is, the flow table rule actually matched with the failure query data packet after being verified by the control plane. Subsequently, according to the logic of the sub-domain division in the flow table, the correct sub-domain to which the correct rule originally belongs is determined. The correct sub-domain is the target sub-domain that the neural indexer should output when predicting the feature vector of the failure query data packet in an ideal state, and is also the reference for the subsequent optimization model.

[0069] S250, when the correct sub-domain is not in the candidate rule set, obtaining a feature vector of the correct rule and a correct index vector corresponding to the correct sub-domain, and updating an affected weight subset of the neural indexer based on the feature vector of the correct rule and the correct index vector.

[0070] Specifically, the feedback processing unit will further check whether the correct sub-domain is included in the candidate rule set in the failure feedback signal. When the correct sub-domain is not in the candidate rule set, it indicates that the root cause of the matching failure is that the neural indexer prediction is wrong, that is, the processing result of the indexer for the failure query feature vector does not include the correct sub-domain in the prediction range, resulting in that the candidate selector cannot obtain the rule of the correct sub-domain. At this time, the neural indexer needs to be updated, first, the five tuple feature vector corresponding to the correct rule is extracted, which is used as the input feature causing the model bias, similar to the feature vector when adding a new rule in the flow table; at the same time, the correct index vector corresponding to the correct sub-domain is determined, that is, the target index vector that the neural indexer should output for similar queries, which is directly related to the belonging logic of the correct sub-domain. Then, the feature vector of the correct rule is input into the neural indexer to obtain the initial predicted index vector output by the current model, and the offset is calculated. Finally, the forward propagation path of the correct rule feature vector in the neural indexer is traced back, and the affected neurons with activation values exceeding a preset threshold are screened to determine the corresponding affected weight subset; the preset weight update formula is called to calculate the updated affected weight subset, and the old weight in the neural indexer is replaced with the updated affected weight subset.

[0071] S260, when the correct sub-domain is in the candidate rule set, obtaining the matching conditions of each field of the correct rule, calculating the matching specificity scores of each field; substituting the matching specificity scores into a preset field weight formula to calculate the updated weights of each field; and adjusting the pruning strategy of the candidate selector using the updated weights of each field.

[0072] Specifically, when the correct sub-domain is in the candidate rule set, the correct rule can be extracted from the failure feedback signal, and the matching conditions corresponding to the five tuple of the correct rule and possible other extended fields, such as the mask length of the source IP, the value range of the destination port, the protocol type, etc. are disassembled. Then, the matching specificity scores of each field are calculated, and the more specific and restrictive the matching conditions are, the higher the score is. For example, in the port field, the port range width is inversely proportional to the specificity score, such as the destination port = 80, the width is 1, and the score is the highest; the destination port = any, the width = 65536, and the score is the lowest; in the IP address field, the mask length is inversely proportional to the specificity score, such as the mask 32 bits corresponding to a single IP, the score is higher than the mask 16 bits network segment; in the protocol field, the more specific the protocol points to, such as only HTTP, the score is higher than the wildcard protocol, such as any. Through the score, it can be determined which field contributes more to the correct matching.

[0073] It can be known that the candidate selector maintains an initial importance weight for each field, which can be set to be equal or configured based on prior knowledge, for guiding the field priority of the pruning strategy. The preset field weight updating formula is: wherein, represents the updated weight of the field, represents the weight of the field before updating, represents a learning rate factor, and the value range is (0, 1), represents a matching specificity score. By substituting the initial weight of each field and the corresponding specificity score into the formula, the updated weight of each field can be obtained, and the weight corresponding to the field with a high specificity score will be significantly improved, ensuring that the matching condition of the field is preferentially respected during subsequent pruning, thereby reducing false filtering.

[0074] Further, the pruning strategy of the candidate selector directly depends on the field weight. The higher the weight of the field, the higher the judgment priority of the field in the pruning process, and the filter threshold of the matching condition of the field will be more relaxed, that is, rules meeting the matching condition of the field will not be easily eliminated. Therefore, after obtaining the updated weight of each field, the candidate selector updates the internal pruning logic. For example, if the updated weight of the destination port field is significantly improved, the rules meeting the accurate matching condition of the destination port will be preferentially screened during subsequent pruning, and the rules meeting the accurate matching condition of the destination port will not be eliminated due to the fuzzy matching of other low-weight fields. The adjustment process is completely completed in an asynchronous mode, which does not interfere with the normal synchronous query processing flow of the candidate selector, can repair the current matching failure problem, avoid increasing the query delay, and improve the accuracy of subsequent matching.

[0075] The technical scheme of the embodiment of the application can avoid full model retraining, reduce adjustment delay, and prevent model failure caused by rule addition and deletion by acquiring flow table change rules and calculating offset based on the flow table change rules and updating the affected weight subset of the neural indexer. The calculation of rule space-time access frequency, the construction of a decision tree, and the execution of the sub-domain operation of the newly added rule can make the sub-domain fit the rule access characteristics, reduce the number of new sub-domains and redundant calculation. The feedback signal is acquired to optimize the neural indexer when the flow table rule matching fails, which can accurately correct prediction errors and improve the prediction accuracy of the neural indexer to reduce subsequent matching failures.

[0076] Embodiment three

[0077] Figure 3 A structure diagram of a dynamic adaptive flow table neural indexer optimization device provided by the third embodiment of the application is shown in FIG. 3. Figure 3 As shown in FIG. 3, the device comprises a rule incremental updating module 310 configured to acquire a change rule of a flow table, calculate an offset corresponding to the change rule, and update an affected weight subset of a neural indexer based on the offset, wherein the change rule comprises a newly added rule and a deleted rule.

[0078] The sub-domain division adjustment module 320 is configured to calculate the space-time access heat of each rule in the flow table, construct a decision tree based on the space-time access heat, and perform rule grouping or new sub-domain creation operation according to the new rule.

[0079] The neural indexer optimization module 330 is configured to obtain a failure feedback signal when the flow table rule matching fails, and optimize the neural indexer based on the failure feedback signal, wherein the failure feedback signal includes a failed query feature vector, a correct rule and a candidate rule set.

[0080] Optionally, the rule incremental update module 310 specifically includes: an offset calculation unit configured to: convert the changed rule into a feature vector of a five tuple; input the feature vector into an input layer of the neural indexer to obtain a predicted index vector output by an output layer; when the changed rule is a new rule, obtain a target rule partition allocated to the new rule by the sorting module, determine a target index vector corresponding to the target rule partition, and take a difference between the target index vector and the predicted index vector as an offset; when the changed rule is a deleted rule, take a negative value of the predicted index vector as the offset.

[0081] Optionally, the rule incremental update module 310 specifically includes: a weight update unit configured to: obtain a forward propagation path of the feature vector in the neural indexer, generate an affected neuron and a corresponding affected weight subset whose activation value exceeds a preset threshold; obtain an old weight of the affected weight subset, substitute the old weight and the offset into a preset weight update formula to generate an updated affected weight subset; and replace the old weight with the updated affected weight subset.

[0082] Optionally, the sub-domain division adjustment module 320 specifically includes: a decision tree construction unit configured to: determine a historical access frequency of each rule to generate access frequency data of each rule; calculate a time difference value between a last access time of each rule and a current time, and generate a recent access decay value corresponding to each rule in combination with a preset decay coefficient; substitute the access frequency data and the recent access decay value into a preset heat calculation formula to obtain the space-time access heat of each rule; and generate a dynamic decision tree based on the space-time access heat of each rule and the five tuple feature vector according to the principle of maximum information gain.

[0083] Optionally, the sub-domain division adjustment module 320 specifically comprises a sub-domain creation unit, configured to: input the feature vector corresponding to the new rule as a new vector into the decision tree to generate a candidate sub-domain; calculate the mean of the feature vectors of all rules in the candidate sub-domain as a center vector of the candidate sub-domain; calculate the cosine similarity between the new vector and the center vector; when the cosine similarity is greater than or equal to a preset similarity, obtain an existing rule set of the candidate sub-domain, and add the new rule into the existing rule set, and update the center vector of the candidate sub-domain to generate an updated sub-domain; when the cosine similarity is less than the preset similarity, create a new sub-domain containing only the new rule.

[0084] Optionally, the neural indexer optimization module 330 is specifically configured to: locate a correct sub-domain based on a correct rule; when the correct sub-domain is not in the candidate rule set, obtain the feature vector of the correct rule and the correct index vector corresponding to the correct sub-domain, and update the affected weight subset of the neural indexer based on the feature vector of the correct rule and the correct index vector.

[0085] Optionally, the device further comprises a pruning strategy selection unit, configured to: when the correct sub-domain is in the candidate rule set, obtain the matching conditions of each field of the correct rule, and calculate the matching specificity scores of the fields; substitute the matching specificity scores into a preset field weight formula to calculate the updated weights of the fields; and adjust the pruning strategy of the candidate selector by using the updated weights of the fields.

[0086] The technical scheme of the embodiment of the application can avoid full model retraining, reduce adjustment delay, and prevent model failure caused by rule addition and deletion by obtaining a flow table change rule and calculating an offset based on the flow table change rule and updating the affected weight subset of the neural indexer; the calculation of rule space-time access hotness, the construction of a decision tree, and the execution of sub-domain inclusion or new sub-domain creation operation according to a new rule can make the sub-domain fit the rule access characteristics, reduce the number of new sub-domains and redundant calculation; the feedback signal is obtained when the flow table rule matching fails to optimize the neural indexer, which can accurately correct prediction errors and improve the prediction accuracy to reduce subsequent matching failures.

[0087] The dynamic adaptive flow table neural indexer optimization device provided in the embodiment of the application can execute the dynamic adaptive flow table neural indexer optimization method provided in any embodiment of the application, and has the corresponding function modules and beneficial effects of the execution method.

[0088] Embodiment Four

[0089] Figure 4A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0090] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded into the RAM 13 from storage unit 18. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0091] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0092] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as a dynamically adaptive flow table neural index optimization method.

[0093] In some embodiments, a dynamically adaptive flow table neural index optimization method can be implemented as a computer program tangibly embodied in a computer readable storage medium, e.g., storage unit 18. In some embodiments, parts or all of the computer program can be loaded and / or installed onto electronic device 10 via, e.g., ROM 12 and / or communication unit 19. When the computer program is loaded onto RAM 13 and executed by processor 11, one or more steps of a dynamically adaptive flow table neural index optimization method as described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform a dynamically adaptive flow table neural index optimization method by way of other any suitable means, e.g., by way of firmware.

[0094] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, specially designed application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0095] Computer programs implementing methods of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program, when executed, implements the functions / acts specified in the flowcharts and / or block diagrams. The computer program can be executed entirely on a machine, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0096] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of a machine-readable storage medium will include one or more lines of a program of instructions in a transitory signal, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0097] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0098] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0099] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0100] It should be understood that the various forms of flow shown above can be used to reorder, add or delete steps. For example, each step described in the present application can be executed in parallel, sequentially or in a different order, as long as the desired results of the technical solutions of the present application can be achieved, which is not limited herein.

[0101] The above detailed description does not constitute a limitation on the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for dynamic adaptive flow table neural index optimization, the method comprising: The method comprises the following steps: acquiring a change rule of a flow table, calculating an offset corresponding to the change rule, and updating an affected weight subset of a neural indexer based on the offset, wherein the change rule comprises an addition rule and a deletion rule; calculating the spatio-temporal access heat of each rule in the flow table, constructing a decision tree based on the spatio-temporal access heat, and performing rule grouping or new sub-domain creation operation according to the addition rule; when the flow table rule matching fails, acquiring a failure feedback signal, and optimizing the neural indexer based on the failure feedback signal, wherein the failure feedback signal comprises a failure query feature vector, a correct rule and a candidate rule set.

2. The method of claim 1, wherein, The calculation of the offset corresponding to the change rule comprises: converting the change rule into a five-tuple feature vector; inputting the feature vector into the input layer of the neural indexer to obtain a predicted index vector output by the output layer; when the change rule is an addition rule, acquiring a target rule partition allocated to the addition rule by the sorting module, determining a target index vector corresponding to the target rule partition, and taking the difference between the target index vector and the predicted index vector as the offset; when the change rule is a deletion rule, taking the negative value of the predicted index vector as the offset.

3. The method of claim 2, wherein, The updating of the affected weight subset of the neural indexer based on the offset comprises: acquiring a forward propagation path of the feature vector in the neural indexer, generating an affected neuron and a corresponding affected weight subset whose activation value exceeds a preset threshold; acquiring the old weight of the affected weight subset, substituting the old weight and the offset into a preset weight update formula to generate an updated affected weight subset; replacing the old weight with the updated affected weight subset.

4. The method of claim 1, wherein, The calculation of the spatio-temporal access heat of each rule in the flow table and the construction of the decision tree based on the spatio-temporal access heat comprise: determining the historical access times of each rule to generate the access frequency data of each rule; calculating the time difference between the last access time of each rule and the current time, and combining a preset decay coefficient to generate a recent access decay value corresponding to each rule; substituting the access frequency data and the recent access decay value into a preset heat calculation formula to obtain the spatio-temporal access heat of each rule; based on the spatio-temporal access heat of each rule and the five-tuple feature vector, generating a dynamic decision tree according to the principle of maximum information gain.

5. The method of claim 2, wherein, The rule grouping or new sub-domain creation operation according to the addition rule comprises: inputting the feature vector corresponding to the addition rule into the decision tree as a new vector to generate a candidate sub-domain; calculating the mean value of the feature vectors of all rules in the candidate sub-domain as the center vector of the candidate sub-domain; calculating the cosine similarity between the new vector and the center vector; when the cosine similarity is greater than or equal to a preset similarity, acquiring the existing rule set of the candidate sub-domain, grouping the addition rule into the existing rule set, updating the center vector of the candidate sub-domain, and generating an updated sub-domain; when the cosine similarity is less than the preset similarity, creating a new sub-domain containing only the addition rule.

6. The method of claim 3, wherein, The optimization of the neural indexer based on the failure feedback signal comprises: locating the correct sub-domain based on the correct rule; When the correct sub-domain is not in the candidate rule set, obtaining a feature vector of a correct rule and a correct index vector corresponding to the correct sub-domain, updating an affected weight subset of the neural index based on the feature vector of the correct rule and the correct index vector.

7. The method of claim 6, wherein, The method further comprises: When the correct sub-domain is in the candidate rule set, obtaining a matching condition of each field of the correct rule, and calculating a matching specificity score of each field; substituting the matching specificity score into a preset field weight formula to calculate an updated weight of each field; adjusting a pruning strategy of the candidate selector using the updated weight of each field.

8. A dynamic adaptive flow table neural indexing optimization apparatus, characterized in that, comprises: a rule incremental update module configured to obtain a changed rule of a flow table, calculate an offset corresponding to the changed rule, and update an affected weight subset of a neural index based on the offset, wherein the changed rule comprises an added rule and a deleted rule; a sub-domain division adjustment module configured to calculate a spatiotemporal access heat of each rule in the flow table, construct a decision tree based on the spatiotemporal access heat, and perform rule grouping or new sub-domain creation according to the added rule; a neural index optimization module configured to obtain a failure feedback signal when a flow table rule fails to match, and optimize the neural index based on the failure feedback signal, wherein the failure feedback signal comprises a failed query feature vector, a correct rule, and a candidate rule set.

9. An electronic device, comprising: The electronic device comprises: at least one processor; and a memory connected in communication with the at least one processor; wherein the memory stores a computer program capable of being executed by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the method of any one of claims 1-7.

10. A computer storage medium, characterized in that, The computer storage medium stores computer instructions for causing a processor to implement the method of any one of claims 1-7 when executed. The computer storage medium stores computer instructions for causing a processor to implement the method of any one of claims 1-7 when executed.

Images