Traffic identification method and device, equipment, storage medium and product

Abstract

The embodiment of the invention provides a traffic identification method and device, equipment, a storage medium and a product. A plurality of to-be-identified service flows are acquired and clustered; and for the same clustering flow obtained by clustering, extracting core flow characteristics by using a pre-constructed large model, calling a pre-constructed knowledge base recording flow characteristics and known application identifier association information based on the large model, and determining a target application identifier of the clustering flow according to the core flow characteristics. Therefore, according to the embodiment of the invention, unknown traffic identification is realized through cooperation of the large model and the knowledge base, dependence on traditional manual dial testing and off-line analysis is not needed, manual operation dependence is reduced, subsequent maintenance cost is reduced, new APP or APP feature change requirements can be responded in time, and efficiency and accuracy of unknown traffic identification by a core network are improved.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a traffic identification method, apparatus, device, storage medium, and product. Background Technology

[0002] In the field of mobile communication core networks, it is necessary to accurately identify the service traffic of various applications (APPs). However, with the surge in the types of APPs and their frequent feature updates, the identification of unknown traffic has become a technical challenge.

[0003] The current common solution for identifying unknown traffic is to test a specific new app by dialing a mobile phone, capture packet features and match them. First, the designated test phone runs only the new app and completes the business test. Then, the core network captures the mobile phone's business packets and determines that the packets belong to the new app. Finally, the packet features are analyzed offline to establish a mapping relationship between the new app and business features and enter the feature database.

[0004] This solution relies on manual testing and offline analysis, which is cumbersome and has high subsequent maintenance costs. In addition, the feature library has a long update cycle, which cannot respond to the needs of new apps or changes in app features in a timely manner, making it difficult to meet the core network's need for efficient and accurate identification of unknown traffic. Summary of the Invention

[0005] This invention provides a traffic identification method, apparatus, device, storage medium, and product that can extract core traffic features and determine application identifiers by clustering the traffic flows to be identified, using a large model, and calling a knowledge base. This eliminates the need for manual testing and offline analysis, reduces maintenance costs, and improves the efficiency and accuracy of unknown traffic identification.

[0006] In a first aspect, embodiments of the present invention provide a traffic identification method, including: Acquire several business flows to be identified; Cluster the service flows to be identified; For the same clustered flow obtained by clustering, its core flow characteristics are extracted using a pre-built large model; Based on the large model, a pre-built knowledge base is invoked to determine the target application identifier of the clustered flow according to the core traffic characteristics; wherein, the knowledge base records the association information between traffic characteristics and known application identifiers.

[0007] Secondly, embodiments of the present invention also provide a traffic flow identification device, comprising: The traffic acquisition module is used to acquire several business flows to be identified; The traffic clustering module is used to cluster the service flows to be identified; The feature extraction module is used to extract the core traffic features of the same clustered flow obtained by clustering using a pre-built large model; The traffic identification module is used to call a pre-built knowledge base based on the large model and determine the target application identifier of the clustered flow according to the core traffic features; wherein, the knowledge base records the association information between traffic features and known application identifiers.

[0008] Thirdly, embodiments of the present invention also provide a traffic identification device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the traffic identification method as described in any of the above embodiments.

[0009] Fourthly, embodiments of the present invention also provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the traffic identification method as described in any of the above embodiments.

[0010] Fifthly, embodiments of the present invention also provide a computer program product, including a computer program / instructions, which, when executed by a processor, implement the traffic identification method as described in any of the above embodiments.

[0011] Compared with existing technologies, the traffic identification method, apparatus, device, storage medium, and product provided in this invention acquire several traffic flows to be identified and cluster them. For the same clustered flow, a pre-built large model is used to extract core traffic features. Then, based on the large model, a pre-built knowledge base recording the association information between traffic features and known application identifiers is invoked to determine the target application identifier of the clustered flow according to the core traffic features. Therefore, this invention achieves unknown traffic identification through the collaboration of a large model and a knowledge base, eliminating the need for traditional manual testing and offline analysis. This reduces reliance on manual operations, lowers subsequent maintenance costs, and allows for timely response to new applications or changes in application features, thereby improving the efficiency and accuracy of the core network in identifying unknown traffic. Attached Figure Description

[0012] Figure 1 This is a schematic flowchart of a traffic identification method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a flow identification device provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of a traffic identification device provided in an embodiment of the present invention. Detailed Implementation

[0013] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0014] Based on this, one embodiment of the present invention provides a traffic identification method, see [link to relevant documentation]. Figure 1 The flowchart of the traffic identification method shown includes steps S11 to S14: S11. Obtain several service flows to be identified; S12. Cluster the service flows to be identified; S13. For the same clustered flow obtained by clustering, extract its core flow characteristics using a pre-built large model; S14. Based on the large model, call the pre-built knowledge base to determine the target application identifier of the clustered flow according to the core traffic characteristics; wherein, the knowledge base records the association information between traffic characteristics and known application identifiers.

[0015] Specifically, the method is applied to the core network, preferably to the User Plane Function (UPF). A large model is deployed on the UPF. When new service flows are transmitted on the UPF, the UPF uses its deployed large model to identify unknown traffic. For example, scattered unknown service flows are first grouped into clusters based on similar characteristics. This traffic cluster is then passed to the pre-built large model, which extracts core traffic features from the cluster, such as protocol name (e.g., Hypertext Transfer Protocol Secure (HTTPS) QUIC), protocol type (e.g., video streaming protocol, instant messaging protocol), and accessed domain name (e.g., the domain name of a shopping application (APP) is shop.app.com). The large model calls a pre-built knowledge base containing known correspondences, such as "HTTPS protocol + domain name shop.app.com → corresponding to XX shopping APP", "QUIC protocol + domain name chat.app.com → corresponding to XXX chat APP". The large model compares the core traffic features extracted in the previous step with the database to find the matching APP name; this name is the target application identifier. After traffic identification is completed, corresponding policy actions and billing rules are triggered, such as allocating differentiated network resources to different traffic types, or triggering traffic limiting, blocking, or diversion actions by network control devices. If it is identified as "targeted free data APP traffic within the user's package", then the "free data rule" is matched, and this part of the traffic is not included in the general data consumption. If it is identified as "video APP traffic during international roaming", then the "international roaming high price rule" is matched, instead of the domestic ordinary data unit price.

[0016] Understandably, by grouping traffic into clusters (a bunch of similar traffic), the larger model can extract more complete and stable core features, thereby improving the accuracy of traffic identification.

[0017] It is worth noting that the application identifier is not limited to the APP name; it can also be other unique identifiers for the APP, which are not limited here. The method can also be applied to Session Management Function (SMF), edge computing nodes, etc.

[0018] Compared with existing technologies, the embodiments of the present invention achieve unknown traffic identification through the collaboration of large models and knowledge bases, without relying on traditional manual testing and offline analysis. This reduces the dependence on manual operation, lowers subsequent maintenance costs, and can also respond promptly to the needs of new apps or changes in app features, thereby improving the efficiency and accuracy of the core network in identifying unknown traffic.

[0019] In a preferred embodiment, acquiring a plurality of service flows to be identified includes: Collect several new business flows; The application identifier corresponding to the new service flow is identified based on a preset local feature library; The new service flow that fails to identify the application identifier will be designated as the service flow to be identified. The method further includes updating the local feature library based on the target application identifier of the clustered flow and the core traffic features.

[0020] Specifically, this implementation adds a closed-loop logic of "pre-screening" and "post-optimization." First, known traffic is quickly excluded using a local feature library, and only truly unknown traffic is analyzed. After identification, the feature library is updated, allowing for direct recognition of the same traffic in the future, making it more efficient and better suited to real-world scenarios. For example, taking the method applied to UPF, a new business flow (e.g., a user playing a newly launched game) is transmitted through UPF. UPF first checks its local feature library, but because it's a new game, there are no corresponding features, so it cannot identify the traffic. UPF then uses a large model and knowledge base to perform deep identification of the business flow. After identifying the application identifier to which the business flow belongs, it sends the mapping relationship between the core traffic features of the business flow (such as the game's protocol type / access domain name) and the identified application identifier back to UPF's local feature library. The next time another user plays this new game, when the traffic passes through UPF, it can be directly identified by querying the local feature library, without needing to sample it for AI analysis in a large model.

[0021] This implementation first filters out known traffic using a local feature library, and the large model only processes truly unknown traffic, reducing computing power and time consumption; the local feature library is automatically updated once a new traffic is identified, so that subsequent similar traffic can be quickly identified, improving identification efficiency.

[0022] In a preferred embodiment, before clustering the service flows to be identified, the method further includes: Based on preset traffic cleaning rules, non-application-generated traffic in the traffic flow to be identified is extracted.

[0023] Specifically, common traffic scrubbing rules include the following: 1. Filtering by "port number": Many non-APP services have fixed port numbers. The rules list these non-APP exclusive ports. If the port number of the business flow to be identified is in the list, it is judged as non-APP traffic and removed. 2. Filtering by "protocol type": For example, the rules may be set to "only retain traffic of application layer protocols," and traffic of other protocols is directly scrubbed. 3. Filtering by "packet characteristics": Non-APP traffic packets will have specific identifiers. The rules will identify these identifiers, and those with the identifiers are judged as non-APP traffic and removed. After scrubbing away non-APP traffic, the total number of business flows to be identified decreases, and the subsequent large model processes only valid candidate traffic, avoiding wasting computing power on useless data and improving traffic identification efficiency.

[0024] In a preferred embodiment, clustering the service flows to be identified includes: Clustering operations are performed on the business flows to be identified based on string similarity and / or relevance of descriptive information.

[0025] Specifically, the business flows to be identified are grouped based on similarity. Each business flow contains a wealth of string information, such as the accessed domain name, the requested Uniform Resource Locator (URL) fragment, and fixed identifiers in the data payload. If these strings have a high degree of overlap, they are considered similar and have the basis for grouping. Business flows also include descriptive information, such as functional annotations of application layer protocols (e.g., video segmentation transmission, high-definition video stream download) and business type descriptions (e.g., product list loading, shopping cart update). If these descriptions point to the same type of function (e.g., video transmission and high-definition video streaming are both associated with video services, and product loading and shopping cart updates are both associated with e-commerce services), the descriptive information is considered relevant, further supporting grouping. By analyzing string similarity and / or the relevance of descriptive information, similar business flows are grouped into one category.

[0026] In a preferred embodiment, the step of extracting core traffic features from the same clustered flow obtained by clustering using a pre-built large model includes: The core traffic features of each of the business flows to be identified in the same cluster are extracted using the large model. The step of calling a pre-built knowledge base based on the large model and determining the target application identifier of the clustered flow according to the core traffic characteristics includes: Based on the large model, a pre-built knowledge base is invoked to determine the application identifier to be processed for the business flow to be identified according to the core traffic characteristics of the business flow to be identified. For the application identifiers of all the service flows to be identified in the same clustered flow, normalization naming is performed to obtain the target application identifier of the clustered flow.

[0027] For example, the formula for estimating the computing power required for large-scale AI recognition of unknown traffic is: Computing power = 2 * Number of parameters * Input sequence length. Assuming the number of parameters is 7 billion, the input sequence length needs to be determined based on the input sequence length. Currently, in the process of identifying unknown traffic in a single application, there are a total of three interactions with the large model, as detailed below: Traffic information is input into a large model (unidentified traffic is sorted by traffic size), and the following steps are executed: Interaction 1, Clustering and Grouping: The large model is guided to perform clustering and grouping operations based on string similarity, relevance of descriptive information, etc. Interaction 2, List of App Names Query: For each group, taking the domain name as an unknown traffic feature, the large model calls the knowledge base to obtain the corresponding app name, resulting in a list of app names for that group. Interaction 3, App Naming Normalization: The large model is used to normalize the app name list. The prompt word for each interaction (i.e., the pre-trained model-based text-to-target generation, Prompt) is approximately 330 tokens in length (i.e., the smallest unit of text processing, tokens), and the total sequence length of the entire process is approximately 1K tokens. Based on this, the required computing power is 2 × 7 billion × 1000 = 14 TFLOPs, where TFLOPs stands for Floating-point operations per second.

[0028] Based on the update data of the top 100 most popular applications both domestically and internationally over the past year, an average of 10 protocol features change every month, requiring synchronous updates to the local feature library. Furthermore, the applications themselves are diverse and update frequently; the traditional offline update mode of static feature libraries is not only costly and time-consuming, but also struggles to keep pace with dynamic application changes, ultimately leading to a decline in traffic identification rates. Compared to existing technologies, the traffic identification method provided in this invention introduces a large model for identifying unknown traffic: by analyzing business changes and new services online, the feature library is dynamically updated; relying on large models and knowledge base technology, the traffic data analysis process is made more intelligent, while also supporting real-time sampling, analysis, and feature library conversion of business traffic. This solution offers three core benefits: 1. Cost reduction: It eliminates the need for traditional manual testing, reducing manpower investment; and feature updates support automatic loading and verification, saving one person-day of engineering manpower per site per update, significantly reducing subsequent maintenance costs; 2. Shortened cycle: The identification cycle for unknown traffic is reduced from one month in the traditional offline mode to one day, enabling rapid response to application feature change requirements; 3. Full-process automation: It leverages a large model to automate the identification of unknown traffic and simultaneously achieves automatic updates to the feature library, eliminating the need for manual intervention and improving overall identification efficiency.

[0029] See Figure 2 An embodiment of the present invention also provides a traffic flow identification device, comprising: Traffic acquisition module 21 is used to acquire several business flows to be identified; Traffic clustering module 22 is used to cluster the service flows to be identified; Feature extraction module 23 is used to extract the core traffic features of the same clustered flow obtained by clustering using a pre-built large model; Traffic identification module 24 is used to call a pre-built knowledge base based on the large model and determine the target application identifier of the clustered flow according to the core traffic features; wherein, the knowledge base records the association information between traffic features and known application identifiers.

[0030] In one embodiment, the device further includes a user plane arrangement function.

[0031] In one embodiment, the traffic acquisition module 21 is specifically used for: Collect several new business flows; The application identifier corresponding to the new service flow is identified based on a preset local feature library; The new service flow that fails to identify the application identifier will be designated as the service flow to be identified. The device further includes a library update module for updating the local feature library based on the target application identifier of the clustered flow and the core traffic features.

[0032] In one embodiment, the apparatus further includes a traffic scrubbing module, configured to: extract non-application-generated service traffic from the service flow to be identified according to preset traffic scrubbing rules before clustering the service flow to be identified.

[0033] In one implementation, the traffic clustering module 22 is specifically used for: Clustering operations are performed on the business flows to be identified based on string similarity and / or relevance of descriptive information.

[0034] In one implementation, the feature extraction module 23 is specifically used for: The core traffic features of each business flow to be identified in the same cluster flow are extracted using a pre-built large model. The step of calling a pre-built knowledge base based on the large model and determining the target application identifier of the clustered flow according to the core traffic characteristics includes: Based on the large model, a pre-built knowledge base is invoked to determine the application identifier to be processed for the business flow to be identified according to the core traffic characteristics of the business flow to be identified. For the application identifiers of all the service flows to be identified in the same clustered flow, normalization naming is performed to obtain the target application identifier of the clustered flow.

[0035] It is worth noting that the specific working process of the traffic identification device described in the embodiments of the present invention can refer to the working process of the traffic identification method described in any of the above embodiments, and will not be repeated here.

[0036] See Figure 3 This invention also provides a traffic identification device, including a processor 31, a memory 32, and a computer program stored in the memory 32 and configured to be executed by the processor 31. When the processor 31 executes the computer program, it implements the steps described in the traffic identification method embodiments above, for example... Figure 1 The steps S11 to S14 described above; or, when the processor 31 executes the computer program, it implements the functions of each module in the above-described device embodiments.

[0037] For example, the computer program can be divided into one or more modules, which are stored in the memory 32 and executed by the processor 31 to complete the present invention. The one or more modules can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the traffic identification device. For example, the computer program can be divided into multiple modules. The specific working process of each module can be referred to the working process of the traffic identification model described in the above embodiments, and will not be repeated here.

[0038] The traffic identification device can be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. The traffic identification device may include, but is not limited to, a processor 31 and a memory 32. Those skilled in the art will understand that the traffic identification device may also include input / output devices, network access devices, buses, etc.

[0039] The processor 31 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 31 is the control center of the flow identification device, connecting all parts of the flow identification device via various interfaces and lines.

[0040] The memory 32 can be used to store the computer program and / or modules. The processor 31 implements various functions of the traffic identification device by running or executing the computer program and / or modules stored in the memory 32 and calling the data stored in the memory 32. The memory 32 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as image playback function), etc.; the data storage area may store data created based on the use of the mobile phone, etc. In addition, the memory 32 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0041] If the module integrated into the traffic identification device is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 31, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.

[0042] This invention also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the traffic identification method as described in any of the above embodiments.

[0043] Compared with existing technologies, the traffic identification method, apparatus, device, storage medium, and product provided in this invention acquire several traffic flows to be identified and cluster them. For the same clustered flow, a pre-built large model is used to extract core traffic features. Then, based on the large model, a pre-built knowledge base recording the association information between traffic features and known application identifiers is invoked to determine the target application identifier of the clustered flow according to the core traffic features. Therefore, this invention achieves unknown traffic identification through the collaboration of a large model and a knowledge base, eliminating the need for traditional manual testing and offline analysis. This reduces reliance on manual operations, lowers subsequent maintenance costs, and allows for timely response to new applications or changes in application features, thereby improving the efficiency and accuracy of the core network in identifying unknown traffic.

[0044] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A traffic flow identification method, characterized in that, include: Acquire several business flows to be identified; Cluster the service flows to be identified; For the same clustered flow obtained by clustering, its core flow characteristics are extracted using a pre-built large model; Based on the large model, a pre-built knowledge base is invoked to determine the target application identifier of the clustered flow according to the core traffic characteristics; wherein, the knowledge base records the association information between traffic characteristics and known application identifiers.

2. The traffic identification method as described in claim 1, characterized in that, The method is applied to user-facing functions.

3. The traffic identification method as described in claim 1, characterized in that, The acquisition of several service flows to be identified includes: Collect several new business flows; The application identifier corresponding to the new service flow is identified based on a preset local feature library; The new service flow that fails to identify the application identifier will be designated as the service flow to be identified. The method further includes updating the local feature library based on the target application identifier of the clustered flow and the core traffic features.

4. The traffic identification method as described in claim 1, characterized in that, Before clustering the service flows to be identified, the method further includes: Based on preset traffic cleaning rules, non-application-generated traffic in the traffic flow to be identified is extracted.

5. The traffic identification method as described in claim 1, characterized in that, The clustering of the service flows to be identified includes: Clustering operations are performed on the business flows to be identified based on string similarity and / or relevance of descriptive information.

6. The traffic identification method as described in claim 1, characterized in that, For the same clustered flow obtained from clustering, the core flow characteristics are extracted using a pre-built large model, including: The core traffic features of each business flow to be identified in the same cluster flow are extracted using a pre-built large model. The step of calling a pre-built knowledge base based on the large model and determining the target application identifier of the clustered flow according to the core traffic characteristics includes: Based on the large model, a pre-built knowledge base is invoked to determine the application identifier to be processed for the business flow to be identified according to the core traffic characteristics of the business flow to be identified. For the application identifiers of all the service flows to be identified in the same clustered flow, normalization naming is performed to obtain the target application identifier of the clustered flow.

7. A flow rate identification device, characterized in that, include: The traffic acquisition module is used to acquire several business flows to be identified; The traffic clustering module is used to cluster the service flows to be identified; The feature extraction module is used to extract the core traffic features of the same clustered flow obtained by clustering using a pre-built large model; The traffic identification module is used to call a pre-built knowledge base based on the large model and determine the target application identifier of the clustered flow according to the core traffic features; wherein, the knowledge base records the association information between traffic features and known application identifiers.

8. A flow rate identification device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the traffic identification method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the traffic identification method as described in any one of claims 1 to 6.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the traffic identification method as described in any one of claims 1 to 6.

Images