Network packet classification method and device, electronic device, and program product
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA TOWER CO LTD
- Filing Date
- 2026-01-29
- Publication Date
- 2026-06-26
Smart Images
Figure CN121585618B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of artificial intelligence technology, and more specifically, to a method, apparatus, electronic device, and program product for classifying network packets. Background Technology
[0002] Currently, the main methods for classifying network traffic are: (1) rule-based methods, which classify traffic by packet header information and preset rules; (2) correlation-based methods, which combine statistical flow features with machine learning to classify network traffic; and (3) load-based methods, which utilize application layer load information to get rid of dependence on IP and port, and are used in conjunction with deep packet inspection technology.
[0003] However, the above methods have low accuracy in classifying network traffic. Therefore, deep learning methods are adopted. Deep learning models have better classification accuracy, but they are more complex, consume more computation and resources, and are not suitable for deployment in resource-constrained conditions such as edge nodes, resulting in low classification efficiency.
[0004] There is currently no effective solution to the above problems. Summary of the Invention
[0005] This invention provides a method, apparatus, electronic device, and program product for classifying network packets, to at least solve the technical problem in related technologies where high model complexity leads to low classification efficiency under limited computing resources.
[0006] According to one aspect of the embodiments of this application, a method for classifying network packets is provided, comprising: sampling network packets to obtain multiple sampled data, and preprocessing each sampled data to obtain processed data; adding multiple feature vectors to each processed data to obtain a combined feature vector; inputting all combined feature vectors into a target perceptron model to obtain a classification result of the network packets, wherein the target perceptron model includes at least an input layer, multiple hidden layers and an output layer, the target perceptron model is deployed on an edge computing device, the hidden layers are used to extract multiple features from all combined feature vectors received by the input layer and add all features to the combined feature vector to obtain a target combined feature vector, matrix calculation is performed on all target combined feature vectors, and the feature representation obtained by matrix calculation is normalized through the output layer to output a classification result.
[0007] Furthermore, the steps of preprocessing each sampled data to obtain processed data include: cleaning the sampled data to obtain cleaned network packets; and standardizing the cleaned network packets to obtain processed data.
[0008] Furthermore, the steps of standardizing the cleaned network packets to obtain processed data include: determining the number of bytes in the cleaned network packets and comparing the number of bytes with a preset byte threshold to obtain a comparison result; and determining the processed data based on the comparison result.
[0009] Further, based on the comparison results, the steps for processing the data are determined, including: if the comparison result indicates that the number of bytes is greater than a preset byte threshold, deleting bytes outside a preset range in the cleaned network packets to obtain processed data, wherein the preset range is determined based on the preset byte threshold; or, if the comparison result indicates that the number of bytes is less than or equal to the preset byte threshold, padding the bytes of the cleaned network packets until the number of bytes is equal to the preset byte threshold to obtain processed data.
[0010] Furthermore, before inputting all the combined feature vectors into the target perceptron model to obtain the classification result of the network packets, the method further includes: obtaining a historical sampling data set and preprocessing the historical sampling data set to obtain a historical processing data set; adding multiple feature vectors to each historical processing data in the historical processing data set to obtain historical combined feature vectors; and constructing a historical combined feature vector matrix based on all historical combined feature vectors, wherein each historical combined feature vector corresponds to a preset label.
[0011] Furthermore, before inputting all combined feature vectors into the target perceptron model to obtain the classification result of the network packets, the process includes: determining the number of hidden layers, and constructing an initial perceptron model based on the input layer, all hidden layers, and the input layer; and training the initial perceptron model based on the historical combined feature vector matrix to obtain the target perceptron model.
[0012] Furthermore, the steps of training the initial perceptron model based on the historical combined feature vector matrix to obtain the target perceptron model include: calculating the loss value between the detection value of the initial perceptron model and the label value corresponding to the preset label, wherein the loss value is calculated by a pre-constructed cross-entropy loss function; and adjusting the parameters of the initial perceptron model using a preset gradient descent algorithm until the loss value is less than a preset threshold to obtain the target perceptron model.
[0013] According to another aspect of the embodiments of this application, a network packet classification apparatus is also provided, comprising: a sampling unit for sampling network packets to obtain multiple sampled data, and preprocessing each sampled data to obtain processed data; an adding unit for adding multiple feature vectors to each processed data to obtain a combined feature vector; and an input unit for inputting all combined feature vectors into a target perceptron model to obtain a classification result of the network packets, wherein the target perceptron model includes at least an input layer, multiple hidden layers, and an output layer, the target perceptron model is deployed on an edge computing device, the hidden layers are used to extract multiple features from all combined feature vectors received by the input layer, and add all features to the combined feature vector to obtain a target combined feature vector, matrix calculation is performed on all target combined feature vectors, and the feature representation obtained by matrix calculation is normalized by the output layer to output a classification result.
[0014] Furthermore, the sampling unit includes: a first cleaning module for cleaning the sampled data to obtain cleaned network packets; and a first standardization processing module for standardizing the cleaned network packets to obtain processed data.
[0015] Furthermore, the first standardization processing module includes: a first comparison submodule, used to determine the number of bytes in the cleaned network packets and compare the number of bytes with a preset byte threshold to obtain a comparison result; and a first determination submodule, used to determine the processing data based on the comparison result.
[0016] Further, the first determining submodule includes: a first deletion submodule, used to delete bytes outside a preset range in the cleaned network packet when the comparison result indicates that the number of bytes is greater than a preset byte threshold, to obtain processed data, wherein the preset range is determined based on the preset byte threshold; and a first filling submodule, used to fill the bytes of the cleaned network packet until the number of bytes is equal to the preset byte threshold when the comparison result indicates that the number of bytes is less than or equal to the preset byte threshold, to obtain processed data.
[0017] Furthermore, the network packet classification device also includes: a first preprocessing module, used to acquire a historical sampling data set and preprocess the historical sampling data set to obtain a historical processed data set before inputting all combined feature vectors into the target perceptron model to obtain the classification result of the network packets; a first adding module, used to add multiple feature vectors to each historical processed data in the historical processed data set to obtain a historical combined feature vector; and a first construction module, used to construct a historical combined feature vector matrix based on all historical combined feature vectors, wherein each historical combined feature vector corresponds to a preset label.
[0018] Furthermore, the network packet classification device also includes: a second construction module, used to determine the number of hidden layers and construct an initial perceptron model based on the input layer, all hidden layers, and the input layer before inputting all combined feature vectors into the target perceptron model to obtain the classification result of the network packets; and a first training module, used to train the initial perceptron model based on the historical combined feature vector matrix to obtain the target perceptron model.
[0019] Furthermore, the first training module includes: a first calculation submodule, used to calculate the loss value between the detection value of the initial perceptron model and the label value corresponding to the preset label, wherein the loss value is calculated by a pre-constructed cross-entropy loss function; and a first adjustment submodule, used to adjust the parameters of the initial perceptron model using a preset gradient descent algorithm until the loss value is less than a preset threshold, thereby obtaining the target perceptron model.
[0020] According to another aspect of the embodiments of this application, a computer program product is also provided, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the above-described methods for classifying network packets.
[0021] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors cause the one or more processors to implement any of the above-described network packet classification methods.
[0022] In this invention, network packets are sampled to obtain multiple sampled data. Each sampled data is preprocessed to obtain processed data. Multiple feature vectors are added to each processed data to obtain a combined feature vector. All combined feature vectors are input into a target perceptron model to obtain the classification result of the network packets. The target perceptron model includes at least an input layer, multiple hidden layers, and an output layer. The target perceptron model is deployed on an edge computing device. The hidden layers are used to extract multiple features from all combined feature vectors received by the input layer and add all features to the combined feature vector to obtain the target combined feature vector. Matrix calculation is performed on all target combined feature vectors. The feature representation obtained by the matrix calculation is normalized by the output layer to output the classification result. This invention solves the technical problem in related technologies where high model complexity leads to low classification efficiency under limited computing resources.
[0023] In this invention, network packets are sampled to obtain multiple sample data. Each sample data is preprocessed, including data cleaning, standardization and length adjustment, and the addition of enhanced feature vectors such as session identifiers, timestamps, and byte entropy, thereby constructing information-rich combined feature vectors. Then, all combined feature vectors are input into a target perceptron model deployed on edge nodes to obtain the classification result of network packets. This model receives all combined feature vectors through the input layer and extracts multiple features from all combined feature vectors through the first hidden layer. The extracted features are added to the combined feature vectors to obtain the target combined feature vectors. Matrix calculations are performed on all target combined feature vectors to obtain feature representations. Matrix calculations can be further performed through multiple hidden layers. The feature representations obtained from matrix calculations are normalized through the output layer to obtain the classification result, achieving accurate identification of packet service types. This target perceptron model is lightweight and efficient, and can run quickly in resource-constrained edge computing environments, not only improving classification speed but also effectively saving resource costs. Attached Figure Description
[0024] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:
[0025] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for classifying network packets is shown.
[0026] Figure 2 This is a flowchart of a network packet classification method according to Embodiment 1 of this application;
[0027] Figure 3 This is a flowchart of an optional training target perceptron model according to an embodiment of this application;
[0028] Figure 4 This is a schematic diagram of an optional network packet classification device according to an embodiment of this application;
[0029] Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation
[0030] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.
[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.
[0032] It should be noted that all related information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) collected and involved in this invention are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data comply with the relevant laws, regulations, and standards of the relevant regions, necessary confidentiality measures have been taken, and it does not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse. For example, this system has an interface with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface, and the relevant information is obtained only after receiving consent from the aforementioned user or organization.
[0033] In this invention, high-order features can be automatically learned directly from raw message data using deep learning technology of multilayer perceptrons. Both plaintext and encrypted messages can be identified without the need for manually defined rules. Multilayer perceptrons have a simple structure, and the training process primarily uses matrix multiplication, requiring low computational resources. They can converge quickly on ordinary hardware, making them suitable for deployment in resource-constrained environments such as edge nodes. For extensions to new protocols, only the corresponding training samples need to be added for identification.
[0034] The present invention will now be described in detail with reference to various embodiments.
[0035] Example 1
[0036] According to an embodiment of this application, an embodiment of a method for classifying network packets is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.
[0037] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a network packet classification method is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1 The processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions may also be included. In addition, it may include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera, wherein the network interface can be connected to wired and / or wireless networks. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.
[0038] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).
[0039] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the network packet classification method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the aforementioned network packet classification method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
[0040] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.
[0041] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).
[0042] Under the aforementioned operating environment, this application provides the following: Figure 2 The network message classification method shown. Figure 2 This is a flowchart of the network packet classification method according to Embodiment 1 of this application, as follows: Figure 2 As shown, the method includes the following steps:
[0043] Step S201: Sample the network packets to obtain multiple sample data, and preprocess each sample data to obtain processed data.
[0044] Optionally, SD-WAN (Software-Defined Wide Area Network) network packets are data packets transmitted in an SD-WAN network environment, carrying various types of service and application information, ranging from internal enterprise communication, Internet access, cloud service usage to video conferencing, etc.
[0045] In this embodiment of the invention, network packets can be sampled according to a preset time interval to obtain multiple sampled data. Each sampled data is then preprocessed, including but not limited to cleaning, stripping network frame headers, and standardizing packet length, to obtain processed data. The types of sampled data can include received packets and transmitted packets.
[0046] Step S202: Add multiple feature vectors to each processed data to obtain a combined feature vector.
[0047] In this embodiment of the invention, multiple feature vectors are added to each processed data, such as session identifier, timestamp, and byte entropy. The session identifier is a five-tuple (source IP (Internet Protocol), destination IP, protocol number, source port number, and destination port number). Byte entropy H is an indicator of the randomness of the packet payload and can be calculated using the following formula: , This represents the probability of the i-th byte appearing in the message. Since a byte can be represented as a value between 0 and 255, the value of i ranges from 0 to 255. The session identifier, timestamp, byte entropy, and sampled messages (i.e., processed data) can be combined to form a feature vector, thus obtaining a combined feature vector. Adding feature vectors enriches the model's input data, increases the basis for message classification, and improves the accuracy and comprehensiveness of the classification.
[0048] Step S203: Input all combined feature vectors into the target perceptron model to obtain the classification result of the network packet. The target perceptron model includes at least an input layer, multiple hidden layers, and an output layer. The target perceptron model is deployed on an edge computing device. The hidden layer is used to extract multiple features from all combined feature vectors received by the input layer and add all features to the combined feature vector to obtain the target combined feature vector. Matrix calculation is performed on all target combined feature vectors. The feature representation obtained by matrix calculation is normalized through the output layer to output the classification result.
[0049] Optionally, the target perceptron model is a neural network model consisting of at least an input layer, multiple hidden layers, and an output layer, used to learn and recognize message features. Edge computing devices are computing nodes at the edge of the network, and the target perceptron model is deployed on edge computing devices.
[0050] In this embodiment of the invention, all combined feature vectors are input into the target perceptron model deployed on the edge computing device. The first hidden layer can extract multiple features from all combined feature vectors and add the extracted features to the combined feature vectors. For example, the sent and received messages of the same session are merged into one vector to obtain a composite vector, which is used as a feature dimension. The ratio of the number of sent and received messages in the same time interval is also used as a feature dimension. By adding the above two features to the corresponding combined feature vector, the target combined feature vector can be obtained, which improves the accuracy of model recognition.
[0051] For example, based on the session identifier in the combined feature vector, sampled packets belonging to the same session can be identified. For instance, when a packet is sent from source IP address 1 and source port 1 to destination IP address 1 and destination port 1, or vice versa, when a packet is sent from destination IP address 1 and destination port 1 to source IP address 1 and source port 1, both cases are identified as the same session. However, when a packet is sent from source IP address 1 and source port 1 to destination IP address 1 and destination port 1, or when a packet is sent from destination IP address 2 and destination port 2 to source IP address 1 and source port 1, the two cases are not the same session.
[0052] The system can determine whether a packet is being sent or received based on the source IP address, destination IP address, source port number, and destination port number. For example, for a local host (such as a mobile phone, computer, or server), if the source IP address and source port number correspond to the local host's address and port, then the packet is a sent packet. Conversely, if the destination IP address and destination port number correspond to the local host's address and port, then the packet is a received packet. It can also calculate the ratio of sent to received packets within the same time interval.
[0053] The synthesized vector and its proportion are added to the combined feature vector. For example, if there are 20 combined feature vectors, and the 20 sampled packets belong to the same session, the synthesized vector and its proportion can be added to each combined feature vector to obtain the target combined feature vector. If there are two sessions (e.g., 18 combined feature vectors belong to session 1 and 2 combined feature vectors belong to session 2), the features (synthetic vector and proportion) obtained by feature extraction from the 18 combined feature vectors can be added to the 18 combined feature vectors respectively. Similarly, the features (synthetic vector and proportion) obtained by feature extraction from the 2 combined feature vectors can be added to the 2 combined feature vectors respectively to obtain the target combined feature vector corresponding to each combined feature vector.
[0054] Matrix calculations can be performed on all target combination feature vectors in this hidden layer, or multiple matrix calculations can be performed through multiple hidden layers. The feature representations obtained from the matrix calculations are normalized through the output layer, and the classification results are output (e.g., the category of these 20 sampled packets is online video viewing, and the number of received and sent packets in this category is relatively high). There is no need to transmit data to a central server, which reduces network latency, enhances network response speed and security, and achieves real-time classification of network packets without sacrificing model recognition accuracy.
[0055] Optionally, the changes in message length, message transmission and reception frequency, and the frequency of occurrence of specific bytes can also be extracted in the hidden layer and added to the combined feature vector.
[0056] In summary, firstly, network packets are sampled and preprocessed to remove useless header information and standardize packet length, ensuring the consistency and quality of input data. Then, multiple feature vectors, such as session identifiers, timestamps, and byte entropy, are added to the preprocessed packets to form combined feature vectors, enriching the model's learning basis. Subsequently, a target perceptron model, consisting of at least an input layer, multiple hidden layers, and an output layer, deployed on edge computing devices, is used to perform deep feature extraction and classification decisions on the combined feature vectors, accurately identifying the service type of the packet. This reduces the requirements for computing resources and enables application recognition in resource-constrained environments. Thus, it solves the technical problem in related technologies where high model complexity leads to low classification efficiency under limited computing resources.
[0057] To improve the clarity and consistency of message features, in the network message classification method provided in Embodiment 1 of this application, the sampled data is cleaned to obtain cleaned network messages; the cleaned network messages are then standardized to obtain processed data.
[0058] In this embodiment of the invention, the sampled data undergoes data cleaning to remove or strip irrelevant or redundant information from the packets, such as Ethernet frame headers, IP headers, and TCP / UDP (Transmission Control Protocol / User Datagram Protocol) headers, in order to extract the payload (i.e., obtain the cleaned network packets). Then, the packet length can be standardized to obtain processed data, the length of which can be set to 1500 bytes. This method preserves the complete headers and content of most application protocols while ensuring consistency across all samples in terms of feature dimensions.
[0059] In order to accurately determine the data to be processed, in the network packet classification method provided in Embodiment 1 of this application, the number of bytes of the cleaned network packet is determined, and the number of bytes is compared with a preset byte threshold to obtain a comparison result; based on the comparison result, the data to be processed is determined.
[0060] In this embodiment of the invention, the number of bytes in the cleaned network packet is determined and compared with a preset byte threshold (a predefined length standard, such as 1500 bytes). By comparing with the preset byte threshold, it is determined whether the packet needs to be truncated or padded, so as to determine the data to be processed and meet the consistency requirements of the model input.
[0061] To improve the accuracy of data processing, in the network packet classification method provided in Embodiment 1 of this application, if the comparison result indicates that the number of bytes is greater than a preset byte threshold, bytes outside the preset range in the cleaned network packet are deleted to obtain processed data, wherein the preset range is determined based on the preset byte threshold; or, if the comparison result indicates that the number of bytes is less than or equal to the preset byte threshold, the bytes of the cleaned network packet are padded until the number of bytes is equal to the preset byte threshold to obtain processed data.
[0062] In this embodiment of the invention, if the number of bytes exceeds a preset byte threshold, bytes exceeding a preset range (e.g., the preset byte threshold is 1500, and the preset range can be 0-1500) need to be deleted. That is, bytes outside the preset range in the cleaned network packet are deleted to obtain processed data. If the number of bytes is less than or equal to the preset byte threshold, the packet can be padded to make its byte count equal to the preset byte threshold to obtain processed data. By truncating or padding the byte count, not only is the negative impact of packet length differences on the model eliminated, but the consistency and efficiency of the model in processing data are also improved.
[0063] In order to accurately construct the historical combined feature vector matrix, in the network packet classification method provided in Embodiment 1 of this application, a historical sampling data set is obtained, and the historical sampling data set is preprocessed to obtain a historical processing data set; multiple feature vectors are added to each historical processing data in the historical processing data set to obtain a historical combined feature vector; based on all historical combined feature vectors, a historical combined feature vector matrix is constructed, wherein each historical combined feature vector corresponds to a preset label.
[0064] In this embodiment of the invention, the historical sampling data set is a series of network packet samples captured in the past. The historical sampling data set is preprocessed (i.e., data cleaning, payload extraction, and length normalization) to obtain a historical processed data set. Multiple feature vectors (i.e., session identifier, timestamp, byte entropy, etc.) are added to each historical processed data in the historical processed data set to obtain historical combined feature vectors. Each historical combined feature vector is assigned a corresponding preset label (e.g., one is labeled as a website video service). All labeled historical combined feature vectors are stacked column-wise to construct the matrix required for model training (i.e., the historical combined feature vector matrix). The original packet data is transformed into a structured tensor that meets the model input requirements. Based on all historical combined feature vectors, the historical combined feature vector matrix is constructed. Each packet-group-based vector Xi is associated with a label Li, i=1,…,m. After preprocessing, the original dataset consists of a group-based matrix and a label vector, with the following structure: .
[0065] In order to accurately obtain the target perceptron model, in the network packet classification method provided in Embodiment 1 of this application, the number of hidden layers is determined, and an initial perceptron model is constructed based on the input layer, all hidden layers, and the input layer; the initial perceptron model is trained based on the historical combined feature vector matrix to obtain the target perceptron model.
[0066] In this embodiment of the invention, a multilayer perceptron with three or more layers can be constructed to form a neural network. This network adopts an end-to-end learning paradigm, using hierarchical feature transformation to map from original message features to category labels. The initial perceptron model's network architecture adopts a classic deep feedforward structure: the first layer is the input layer, receiving input data (i.e., the message-based vector Xi); multiple hidden layers are set in the middle to progressively extract and abstract features, mapping the original features to a high-dimensional feature space through nonlinear transformation; the last layer is the output layer, outputting the classification result. The hidden layers consist of multiple neurons, the core of which is a nonlinear activation function as follows: , where σ( ) is an activation function that provides a non-linear transition when the input value changes, breaking the constraints of linear models and increasing the complexity of the algorithm. It no longer analyzes a single field value or characteristic parameter of the message, but rather analyzes the relationships and patterns between them, enabling the model to fit arbitrarily complex decision boundaries. W(i) is the weight matrix, and b(i) is the bias vector. Each hidden layer x is calculated using the same function, only the weight matrix and bias vector differ. Based on the historical combined feature vector matrix, the initial perceptron model is trained to obtain the target perceptron model.
[0067] After the message vector Xi is input into the first hidden layer to extract features, the first feature transformation is performed, and the calculation formula is as follows: Here, σ is the activation function, specifically the Rectified Linear Unit (ReLU) activation function. This function linearly rectifies the output vector of the hidden layer, exhibiting sparse activation properties. It effectively alleviates the vanishing gradient problem in deep networks while maintaining high computational efficiency, making it suitable for deployment under resource-constrained conditions such as edge nodes. Deep features achieve hierarchical abstraction through iterative computation. The output of the previous hidden layer is no longer a set of scalars, but a set of vectors, which serve as the input to the next hidden layer. This process continues, with each layer building upon the features extracted by the previous layer to perform a higher level of abstraction, gradually capturing the high-dimensional feature information contained in the data. The feature reuse mechanism brought by the deep structure allows the model to express more complex functional relationships with fewer parameters. Finally, the classification decision is output by a fully connected layer with a softmax classifier. ,in, Y is the output of the j-th neuron, where Y = {y1, y2, y3, ..., yN} is the complete set of categories, and N represents the number of categories. The model can use the maximum probability criterion for classification decisions, that is, select the category with the highest probability as the prediction result for the input sample.
[0068] To improve the accuracy of the target perceptron model, in the network packet classification method provided in Embodiment 1 of this application, the loss value between the detection value of the initial perceptron model and the label value corresponding to the preset label is calculated. The loss value is obtained by calculating the cross-entropy loss function that is pre-constructed. The parameters of the initial perceptron model are adjusted by a preset gradient descent algorithm until the loss value is less than a preset threshold, thereby obtaining the target perceptron model.
[0069] In this embodiment of the invention, in order to optimize the network parameters, the cross-entropy loss function can be used to measure the difference between the predicted distribution and the true label. The cross-entropy loss can effectively quantify the distance between two probability distributions, that is, to calculate the loss value between the detection value of the initial perceptron model and the label value corresponding to the preset label. The parameter optimization of the initial perceptron model can be carried out by using the mini-batch stochastic gradient descent algorithm (i.e. the preset gradient descent algorithm) until the loss value is less than the preset threshold, and the target perceptron model is obtained.
[0070] Optionally, before the training process begins, the training parameters need to be set to {N_e, M, η}, where N_e represents the maximum number of training epochs, defined as the number of times the training dataset is fully traversed, M is the mini-batch size used in stochastic gradient descent, which balances the accuracy and computational efficiency of gradient estimation, and η is the learning rate, which controls the step size of parameter updates, optimizes the model convergence speed and final performance, and forms the pattern matching rules for message classification.
[0071] Figure 3 This is a flowchart of an optional training target perceptron model according to an embodiment of this application, such as... Figure 3 As shown, firstly, network packets are sampled and preprocessed: cleaning (stripping Ethernet frame headers), length standardization (unifying feature dimensions), and labeling. These are then stacked into a matrix for model training. Next, a perceptron with three or more layers is constructed. The input layer receives packet vectors (i.e., the packet vectors in the matrix), and features are extracted through hidden layers containing multiple neurons. Activation functions are used to achieve non-linear transitions, increasing algorithm complexity. The packet-based vectors are input into the calculation formulas of the first, second, and third hidden layers, and so on, until the last hidden layer. Finally, the final result is output through a fully connected layer of a classifier with activation functions. To optimize network parameters, mini-batch stochastic gradient descent and cross-entropy loss functions are used. Through multiple rounds of learning and backpropagation, pattern accuracy is improved, ultimately achieving packet classification.
[0072] The network packet classification method provided in this application can achieve consistency and purity of all input data by cleaning and standardizing the packet data. It can also add multi-dimensional feature vectors such as session identifiers, timestamps, and byte entropy to each standardized packet to construct a historical combined feature vector matrix, which serves as input for model training. An initial perceptron model is then constructed, and the model parameters are optimized using a mini-batch stochastic gradient descent algorithm and a cross-entropy loss function until the cross-entropy loss value is less than a preset threshold, thus obtaining the target perceptron model. This achieves automatic classification and intelligent identification of service packets in SD-WAN networks.
[0073] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.
[0074] Example 2
[0075] This application also provides a network packet classification device. It should be noted that the network packet classification device of this application can be used to execute the network packet classification method provided in this application. The network packet classification device provided in this application is described below.
[0076] According to an embodiment of this application, an apparatus for implementing the above-described network packet classification method is also provided. Figure 4 This is a schematic diagram of an optional network packet classification device according to an embodiment of this application, such as... Figure 4As shown, the network packet classification device may include: a sampling unit 40, an adding unit 41, and an input unit 42.
[0077] The sampling unit 40 is used to sample network packets to obtain multiple sampled data, and to preprocess each sampled data to obtain processed data.
[0078] Add unit 41 to add multiple feature vectors to each processed data to obtain a combined feature vector;
[0079] Input unit 42 is used to input all combined feature vectors into the target perceptron model to obtain the classification result of the network packet. The target perceptron model includes at least an input layer, multiple hidden layers and an output layer. The target perceptron model is deployed on an edge computing device. The hidden layer is used to extract multiple features from all combined feature vectors received by the input layer and add all features to the combined feature vector to obtain the target combined feature vector. Matrix calculation is performed on all target combined feature vectors. The output layer normalizes the feature representation obtained by matrix calculation and outputs the classification result.
[0080] The network packet classification device provided in this application embodiment can sample network packets through sampling unit 40 to obtain multiple sampled data, and preprocess each sampled data to obtain processed data. Multiple feature vectors can be added to each processed data through adding unit 41 to obtain combined feature vectors. All combined feature vectors can be input to the target perceptron model through input unit 42 to obtain the classification result of the network packets.
[0081] Optionally, the sampling unit 40 includes: a first cleaning module for cleaning the sampled data to obtain cleaned network packets; and a first standardization processing module for standardizing the cleaned network packets to obtain processed data.
[0082] Optionally, the first standardization processing module includes: a first comparison submodule, used to determine the number of bytes in the cleaned network packets and compare the number of bytes with a preset byte threshold to obtain a comparison result; and a first determination submodule, used to determine the processing data based on the comparison result.
[0083] Optionally, the first determining submodule includes: a first deletion submodule, used to delete bytes outside a preset range in the cleaned network packet when the comparison result indicates that the number of bytes is greater than a preset byte threshold, to obtain processed data, wherein the preset range is determined based on the preset byte threshold; and a first filling submodule, used to fill the bytes of the cleaned network packet until the number of bytes is equal to the preset byte threshold when the comparison result indicates that the number of bytes is less than or equal to the preset byte threshold, to obtain processed data.
[0084] Optionally, the network packet classification device further includes: a first preprocessing module, used to acquire a historical sampling data set and preprocess the historical sampling data set to obtain a historical processed data set before inputting all combined feature vectors into the target perceptron model to obtain the classification result of the network packets; a first adding module, used to add multiple feature vectors to each historical processed data in the historical processed data set to obtain a historical combined feature vector; and a first construction module, used to construct a historical combined feature vector matrix based on all historical combined feature vectors, wherein each historical combined feature vector corresponds to a preset label.
[0085] Optionally, the network packet classification device further includes: a second construction module, used to determine the number of hidden layers and construct an initial perceptron model based on the input layer, all hidden layers, and the input layer before inputting all combined feature vectors into the target perceptron model to obtain the classification result of the network packets; and a first training module, used to train the initial perceptron model based on the historical combined feature vector matrix to obtain the target perceptron model.
[0086] Optionally, the first training module includes: a first calculation submodule, used to calculate the loss value between the detection value of the initial perceptron model and the label value corresponding to the preset label, wherein the loss value is calculated by a pre-constructed cross-entropy loss function; and a first adjustment submodule, used to adjust the parameters of the initial perceptron model using a preset gradient descent algorithm until the loss value is less than a preset threshold, thereby obtaining the target perceptron model.
[0087] The aforementioned network packet classification device may also include a processor and a memory. The aforementioned sampling unit 40, adding unit 41, input unit 42, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.
[0088] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and by adjusting the kernel parameters, all combined feature vectors are input into the target perceptron model to obtain the classification results of network packets.
[0089] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.
[0090] It should be noted that the sampling unit 40, the adding unit 41, and the input unit 42 mentioned above correspond to steps S201 to S203 in Embodiment 1. The instances and application scenarios implemented by the above units and the corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above units can be hardware components or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above units can also be part of the device and run in the computer terminal 10 provided in Embodiment 1.
[0091] Example 3
[0092] Embodiments of this application may provide a computer terminal, which may be any computer terminal device in a group of computer terminals. Optionally, in this embodiment, the aforementioned computer terminal may also be replaced with a mobile terminal or an electronic device, etc.
[0093] Optionally, in this embodiment, the computer terminal may be located in at least one of a plurality of network devices in a computer network.
[0094] In this embodiment, the computer terminal described above can execute the program code for the following steps in the network packet classification method: sampling network packets to obtain multiple sampled data, and preprocessing each sampled data to obtain processed data; adding multiple feature vectors to each processed data to obtain a combined feature vector; inputting all combined feature vectors into a target perceptron model to obtain the network packet classification result, wherein the target perceptron model includes at least an input layer, multiple hidden layers, and an output layer, the target perceptron model is deployed on an edge computing device, the hidden layer is used to extract multiple features from all combined feature vectors received by the input layer, and add all features to the combined feature vector to obtain a target combined feature vector, perform matrix calculation on all target combined feature vectors, and normalize the feature representation obtained by matrix calculation through the output layer to output the classification result.
[0095] Optionally, the aforementioned computer terminal may execute program code for the following steps in the network packet classification method: cleaning the sampled data to obtain cleaned network packets; and standardizing the cleaned network packets to obtain processed data.
[0096] Optionally, the computer terminal described above can execute program code for the following steps in the network packet classification method: determining the number of bytes in the cleaned network packet, comparing the number of bytes with a preset byte threshold to obtain a comparison result; and determining the data to be processed based on the comparison result.
[0097] Optionally, the aforementioned computer terminal may execute the program code for the following steps in the network packet classification method: if the comparison result indicates that the number of bytes is greater than a preset byte threshold, delete bytes outside the preset range in the cleaned network packet to obtain processed data, wherein the preset range is determined based on the preset byte threshold; or, if the comparison result indicates that the number of bytes is less than or equal to the preset byte threshold, fill the bytes in the cleaned network packet until the number of bytes is equal to the preset byte threshold to obtain processed data.
[0098] Optionally, the computer terminal described above can execute the program code for the following steps in the network packet classification method: obtaining a historical sampling data set and preprocessing the historical sampling data set to obtain a historical processing data set; adding multiple feature vectors to each historical processing data in the historical processing data set to obtain a historical combined feature vector; and constructing a historical combined feature vector matrix based on all historical combined feature vectors, wherein each historical combined feature vector corresponds to a preset label.
[0099] Optionally, the aforementioned computer terminal may execute program code for the following steps in the network packet classification method: determining the number of hidden layers, and constructing an initial perceptron model based on the input layer, all hidden layers, and the input layer; training the initial perceptron model based on the historical combined feature vector matrix to obtain the target perceptron model.
[0100] Optionally, the aforementioned computer terminal can execute program code for the following steps in the network packet classification method: calculating the loss value between the detection value of the initial perceptron model and the label value corresponding to the preset label, wherein the loss value is calculated by a pre-constructed cross-entropy loss function; and using a preset gradient descent algorithm to adjust the parameters of the initial perceptron model until the loss value is less than a preset threshold, thereby obtaining the target perceptron model.
[0101] Optionally, Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (Only one is shown) processor 502, memory 504, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.
[0102] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the network packet classification method and apparatus in this embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the aforementioned network packet classification method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
[0103] The processor can access the information and application programs stored in the memory via the transmission device to execute the steps described above in the network packet classification method.
[0104] The embodiments of this application provide a scheme for classifying network packets. By constructing and training a deep learning model based on a multilayer perceptron and deploying it on edge nodes, it can automatically learn and extract high-order features from the original packet data, reducing the dependence on high-performance computing resources such as GPUs. This achieves efficient and accurate classification of service packets in the SD-WAN environment, thereby solving the technical problem in related technologies where the model complexity is high and the classification efficiency is low under the condition of limited computing resources.
[0105] Those skilled in the art will understand that Figure 5 The structure shown is for illustrative purposes only. Electronic devices can also be terminal devices such as smartphones, tablets, PDAs, and mobile internet devices (MIDs). Figure 5 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 5 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 5 The different configurations shown.
[0106] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.
[0107] Example 4
[0108] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the network packet classification method provided in Embodiment 1.
[0109] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.
[0110] This application also provides a computer program product, which, when executed on a data processing device, is suitable for performing steps of a method for classifying network packets.
[0111] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.
[0112] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.
[0113] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.
[0114] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0115] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.
[0116] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.
[0117] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.
Claims
1. A method for classifying network packets, characterized in that, include: Network packets are sampled to obtain multiple sampled data, and each sampled data is preprocessed to obtain processed data; Multiple feature vectors are added to each of the processed data to obtain a combined feature vector; The The combined feature vector includes: session identifier, timestamp, byte entropy, and sampled message. The session identifier includes: source Internet Protocol, destination Internet Protocol, protocol number, source port number, and destination port number. All the combined feature vectors are input into a target perceptron model to obtain the classification result of the network packet. The target perceptron model includes at least an input layer, multiple hidden layers, and an output layer. The target perceptron model is deployed on an edge computing device. The hidden layers extract multiple features from all the combined feature vectors received by the input layer and add all the features to the combined feature vectors to obtain a target combined feature vector. Matrix calculations are performed on all the target combined feature vectors. The output layer normalizes the feature representation obtained from the matrix calculations and outputs the classification result. The classification result is then output based on... The session identifier identifies sampled messages belonging to the same session. The types of sampled messages include received messages and sent messages. The sent messages and received messages belonging to the same session are merged into a single vector to obtain a composite vector. The ratio of the number of sent messages and received messages in the same time interval is calculated. The composite vector and the ratio are added to the combined feature vector to obtain the target combined feature vector. Matrix calculations are performed on all target combined feature vectors through the first hidden layer, or the target combined feature vector is obtained through the first hidden layer and matrix calculations are performed through other hidden layers.
2. The method for classifying network packets according to claim 1, characterized in that, The steps of preprocessing each sampled data to obtain processed data include: The sampled data is cleaned to obtain cleaned network packets; The cleaned network packets are standardized to obtain the processed data.
3. The method for classifying network packets according to claim 2, characterized in that, The step of standardizing the cleaned network packets to obtain the processed data includes: The number of bytes in the cleaned network packets is determined, and the number of bytes is compared with a preset byte threshold to obtain a comparison result; Based on the comparison results, the processed data is determined.
4. The network packet classification method according to claim 3, characterized in that, Based on the comparison results, the steps for determining the processed data include: If the comparison result indicates that the number of bytes is greater than the preset byte threshold, bytes outside the preset range in the cleaned network packets are deleted to obtain the processed data, wherein the preset range is determined based on the preset byte threshold; or, If the comparison result indicates that the number of bytes is less than or equal to the preset byte threshold, the bytes of the cleaned network packet are padded until the number of bytes equals the preset byte threshold to obtain the processed data.
5. The method for classifying network packets according to claim 1, characterized in that, Before inputting all the combined feature vectors into the target perceptron model to obtain the classification result of the network packet, the following steps are also included: Obtain a set of historical sampling data and preprocess the set of historical sampling data to obtain a set of historical processed data; Add multiple feature vectors to each historical processed data in the historical processed data set to obtain a historical combined feature vector; Based on all the historical combination feature vectors, a historical combination feature vector matrix is constructed, wherein each historical combination feature vector corresponds to a preset label.
6. The method for classifying network packets according to claim 1, characterized in that, Before inputting all the combined feature vectors into the target perceptron model to obtain the classification result of the network packet, the following steps are also included: Determine the number of hidden layers, and construct an initial perceptron model based on the input layer, all the hidden layers, and the input layer; The initial perceptron model is trained based on the historical combined feature vector matrix to obtain the target perceptron model.
7. The method for classifying network packets according to claim 6, characterized in that, The steps for training the initial perceptron model based on the historical combined feature vector matrix to obtain the target perceptron model include: Calculate the loss value between the detection value of the initial perceptron model and the label value corresponding to the preset label, wherein the loss value is calculated by a pre-constructed cross-entropy loss function; The parameters of the initial perceptron model are adjusted using a preset gradient descent algorithm until the loss value is less than a preset threshold, thereby obtaining the target perceptron model.
8. A network packet classification device, characterized in that, include: A sampling unit is used to sample network packets to obtain multiple sampled data, and to preprocess each sampled data to obtain processed data; An adding unit is used to add multiple feature vectors to each of the processed data to obtain a combined feature vector; The The combined feature vector includes: session identifier, timestamp, byte entropy, and sampled message. The session identifier includes: source Internet Protocol, destination Internet Protocol, protocol number, source port number, and destination port number. An input unit is used to input all the combined feature vectors into a target perceptron model to obtain the classification result of the network packet. The target perceptron model includes at least an input layer, multiple hidden layers, and an output layer. The target perceptron model is deployed on an edge computing device. The hidden layers extract multiple features from all the combined feature vectors received by the input layer and add all the features to the combined feature vectors to obtain a target combined feature vector. Matrix calculations are performed on all the target combined feature vectors. The output layer normalizes the feature representation obtained from the matrix calculations and outputs the classification result. In this process, based on the session identifier, sampled messages belonging to the same session are identified. The types of sampled messages include: received messages and sent messages. The sent messages and received messages belonging to the same session are merged into a vector to obtain a composite vector. The ratio of the number of sent messages and received messages in the same time interval is calculated. The composite vector and the ratio are added to the combined feature vector to obtain the target combined feature vector. Matrix calculation is performed on all target combined feature vectors through the first hidden layer, or the target combined feature vector is obtained through the first hidden layer and matrix calculation is performed through other hidden layers.
9. A computer program product, characterized in that, The method includes a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the network packet classification method according to any one of claims 1 to 7.
10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the network packet classification method according to any one of claims 1 to 7.