Microscopic timing data measurement and detection method and system based on programmable switch

Abstract

This invention discloses a method and system for measuring and detecting micro-time-series data based on a programmable switch. The method specifically includes: determining whether a new time period has begun based on the arrival time of the data packet and the truncation timestamp within the bucket; triggering an asynchronous update operation when a new time period is determined, extracting statistical values ​​from the previous period, updating the truncation timestamp within the bucket, and resetting the counter; storing statistical values ​​in a sliding window slot of a two-dimensional circular queue based on the modulo operation result of the flow key hash and the current timestamp in a storage module to construct a time-series data sequence for each flow; obtaining the time-series data sequence from the storage module and calculating time-series statistical features within the data plane; inputting the time-series statistical features and packet-level features into a machine learning model deployed on the data plane for inference, and outputting anomaly detection results. This invention overcomes hardware constraints, completing the generation, storage, and analysis of time-series data in a closed loop within the data plane, improving the real-time performance and accuracy of network anomaly detection.

Description

Technical Field

[0001] This invention relates to the field of computer network and network security technology, and in particular to a method and system for measuring and detecting micro-time-series data based on programmable switches. Background Technology

[0002] With the rapid development of cloud computing and data center networks, network traffic is characterized by high throughput, low latency, and dynamic changes. To ensure network reliability and security, real-time network telemetry and anomaly detection have become crucial. In recent years, programmable data plane technologies, represented by the P4 language and the Reconfigurable Matching Action Table (RMT) architecture, have enabled researchers to offload some measurement and detection tasks from the control plane to the data plane, achieving nanosecond-level packet processing speeds and higher detection throughput. Existing data plane-based detection schemes typically employ a "data plane measurement + data plane detection" architecture, and some even attempt to deploy machine learning models directly on switch chips to address increasingly complex network threats.

[0003] However, despite significant advancements in programmable data plane technology, existing data plane anomaly detection methods still suffer from fundamental limitations in feature representation and detection accuracy. Current detection schemes primarily rely on simple packet-level features (such as packet length, port number, protocol type, TTL, etc.) or coarse-grained flow-level statistics (such as the total number of bytes in a flow). These simple features struggle to capture the dynamic changes in network traffic over time, such as periodic fluctuations, sudden traffic surges (micro-bursts), or abrupt shifts in traffic patterns. Due to the lack of temporal context information, existing methods often exhibit low detection accuracy and high false positive rates when facing complex attacks or anomalies with strong temporal correlations.

[0004] The fundamental reason for these limitations is that existing data plane measurement mechanisms cannot provide accurate, real-time per-stream timing data for downstream detection tasks under conditions of limited hardware resources. Specifically, existing technologies face the following main challenges:

[0005] First, there's the lack of data accessibility. Mainstream traffic measurement algorithms (such as Count-Min Sketch and its variants) typically use compact hash structures to store statistics. To obtain statistics for a specific flow, traditional methods rely on the control plane periodically reading the entire data structure and traversing all flow keys to recover the data. However, modern programmable switch architectures (such as Intel Tofino) strictly limit instruction sets to ensure line-speed forwarding, do not support loop operations, and impose strict constraints on access to stateful registers (e.g., access can only be made once per phase). This prevents data plane logic from traversing data structures to extract flow statistics as the control plane can, resulting in measurement data that is "writeable but not readable," making it unsuitable for direct real-time detection by the data plane.

[0006] Secondly, there is the limitation of flow coverage. Network anomalies can occur on any flow, and the timing of their occurrence is unpredictable. Existing measurement methods often use hash tables or register arrays to obtain flow-level characteristics, but this usually requires pre-defining the target flow to be monitored, which cannot handle the real-time monitoring needs of massive concurrent flows. Although some full-flow measurement solutions (such as FlowLiDAR) attempt to cover all flows, they still rely on control plane intervention to extract effective information, failing to meet the millisecond or even microsecond-level real-time response requirements of the data plane.

[0007] Furthermore, hardware constraints limit the implementation of complex timing logic. An intuitive approach to constructing timing data within the data plane is to create multiple Sketch instances for each time period and poll them for recording. However, this consumes enormous SRAM resources, exceeding the switch's hardware budget. Simultaneously, the switch's arithmetic logic unit (ALU) only supports simple integer operations and not complex floating-point calculations, which also presents challenges for extracting timing features and deploying machine learning models.

[0008] In summary, existing technologies struggle to simultaneously achieve full flow coverage, microsecond-level granularity timing data measurement, and real-time anomaly detection based on this timing data within the data plane of a programmable switch. Summary of the Invention

[0009] The purpose of this invention is to provide a method and system for measuring and detecting micro-time series data based on a programmable switch, which can overcome hardware constraints and complete the generation, storage and analysis of time series data in a closed loop within the data plane, thereby improving the real-time performance and accuracy of network anomaly detection and solving at least one of the aforementioned problems in the prior art.

[0010] In a first aspect, the present invention provides a method for measuring and detecting micro-time series data based on a programmable switch, the method specifically comprising:

[0011] Deploy a measurement module on the data plane to determine whether a new time period has been reached based on the arrival time of the data packet and the truncation timestamp within the bucket.

[0012] When a new time period is determined, an asynchronous update operation is triggered to extract the statistical value of the previous period, update the truncated timestamp in the bucket and reset the counter, and at the same time send the statistical value to the storage module.

[0013] In the storage module, the statistical values ​​based on the modulo operation results of the stream key hash and the current timestamp are stored in the sliding window slots of the two-dimensional circular queue to construct the time-series data sequence of each stream;

[0014] Based on the detection module, time series data sequences are obtained from the storage module, and time series statistical features are calculated within the data plane;

[0015] Based on the detection module, temporal statistical features and packet-level features are input into the machine learning model deployed on the data plane for inference, and anomaly detection results are output.

[0016] Secondly, the present invention provides a micro-time series data measurement and detection system based on a programmable switch, the system specifically comprising:

[0017] The measurement deployment unit is used to deploy measurement modules on the data plane and determine whether a new time period has been reached based on the arrival time of the data packet and the truncation timestamp within the bucket.

[0018] The asynchronous update unit is used to trigger an asynchronous update operation when a new time period is determined, extract the statistical value of the previous period, update the truncated timestamp in the bucket and reset the counter, and send the statistical value to the storage module at the same time.

[0019] The sequence construction unit is used in the storage module to store statistical values ​​into the sliding window slots of a two-dimensional circular queue based on the modulo operation result of the stream key hash and the current timestamp, thereby constructing the time-series data sequence for each stream.

[0020] The time series statistics unit is used to obtain time series data sequences from the storage module based on the detection module, and calculate time series statistical features within the data plane;

[0021] The anomaly detection unit is used to input time-series statistical features and packet-level features into the machine learning model deployed on the data plane based on the detection module, perform inference, and output anomaly detection results.

[0022] Thirdly, the present invention provides a computer device, comprising: a memory and a processor, and a computer program stored in the memory, wherein when the computer program is executed on the processor, it implements the micro-time data measurement and detection method based on a programmable switch as described in any of the above methods.

[0023] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the micro-time data measurement and detection method based on a programmable switch as described in any of the above methods.

[0024] Compared with the prior art, the present invention has at least one of the following technical effects:

[0025] 1. This invention can overcome hardware constraints and complete the generation, storage and analysis of time-series data in a closed loop within the data plane, thereby improving the real-time performance and accuracy of network anomaly detection;

[0026] 2. The TsSketch proposed in this invention achieves asynchronous updates at the stream level by introducing a timestamp mechanism within the bucket, breaking the limitation of traditional Sketch requiring global synchronous reset. It can perform continuous, microsecond-level granular traffic measurement on all active streams in the network without storing the stream state, solving the problem that existing technologies cannot simultaneously achieve full stream coverage and fine-grained measurement.

[0027] 3. This invention cleverly circumvents the hardware constraints of single-state access of programmable switches by utilizing a resubmission mechanism, enabling direct extraction and reset of the counter within the data plane. This allows the measurement results to flow to subsequent detection modules in real time without the need for control plane intervention, greatly reducing detection latency.

[0028] 4. The TsQueues proposed in this invention adopts a two-dimensional circular queue structure based on hash and timestamp index, which can efficiently maintain the sliding window data of all streams under line speed conditions, avoiding the huge memory overhead caused by creating an independent Sketch for each period, and successfully building a complete time-series data view within a resource-constrained data plane.

[0029] 5. This invention calculates higher-order temporal features such as mean, variance, and range within the data plane, significantly improving the feature representation capability of machine learning models compared to traditional methods that rely solely on packet-level features. Experimental results show that introducing temporal features improves the F1 score of anomaly detection by up to 15%, and effectively identifies complex traffic anomalies such as micro-bursts.

[0030] 6. All modules of this invention are optimized for the pipelined architecture of programmable switches, avoiding complex calculations and loop operations. Experiments show that the system ensures full-flow measurement and real-time detection while having almost no impact on the switch's forwarding throughput, and has low resource utilization, demonstrating good engineering practicality and scalability. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 This is a flowchart illustrating a method for measuring and detecting micro-time data based on a programmable switch, according to an embodiment of the present invention.

[0033] Figure 2 This is an overall architecture diagram of a micro-time data measurement and detection method based on a programmable switch provided in an embodiment of the present invention;

[0034] Figure 3 This is a schematic diagram of the asynchronous update mechanism and bucket structure of the measurement module TsSketch provided in an embodiment of the present invention;

[0035] Figure 4 This is a schematic diagram comparing the zeroing reset and minimum value subtraction reset strategies of the measurement module TsSketch provided in an embodiment of the present invention.

[0036] Figure 5 This is a schematic diagram of a two-dimensional circular queue structure of the storage module TsQueues provided in an embodiment of the present invention;

[0037] Figure 6 This is a schematic diagram of the temporal feature extraction and detection workflow of the detection module TsAnomaly provided in an embodiment of the present invention;

[0038] Figure 7 This is a comparison chart of the measurement accuracy of the measurement module TsSketch provided in an embodiment of the present invention with that of existing technologies under different memory overheads;

[0039] Figure 8 This is a schematic diagram of throughput test results deployed on a Tofino switch according to an embodiment of the present invention;

[0040] Figure 9 This is a schematic diagram of a micro-time data measurement and detection system based on a programmable switch, provided in an embodiment of the present invention.

[0041] Figure 10 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0042] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0043] In this application embodiment, the entity executing the process includes a terminal device. This terminal device includes, but is not limited to, devices capable of executing the methods disclosed in this application, such as servers, computers, smartphones, and tablets. Figure 1 A flowchart illustrating a micro-time series data measurement and detection method based on a programmable switch, according to an embodiment of the present invention, is shown below in detail:

[0044] S101, deploy a measurement module on the data plane to determine whether it belongs to a new time period based on the arrival time of the data packet and the truncation timestamp in the bucket.

[0045] In this embodiment, a measurement module TsSketch is deployed on the data plane. When a data packet arrives, a hash function is used to calculate the bucket index corresponding to the stream key, and the truncation timestamp maintained in the bucket is used to determine whether the current data packet belongs to a new time period.

[0046] The measurement module TsSketch includes Bucket array, It represents the number of hash functions (i.e., the number of rows). It represents the number of buckets per row, with each bucket maintaining a truncation timestamp. and a counter For arrival times of Size is If the data packet ( If the period length is specified, then it is determined to be the current period, and execution is performed. Otherwise, it will be considered a new cycle. Updated to the start time of the current period.

[0047] S102, when a new time period is determined, an asynchronous update operation is triggered to extract the statistical value of the previous period, update the truncated timestamp in the bucket and reset the counter, and at the same time send the statistical value to the storage module.

[0048] In this embodiment, if the current time period is determined, the measurement module directly accumulates the traffic statistics value in the bucket; if the new time period is determined, the measurement module performs an asynchronous update operation: extracts the statistics value of the previous period, updates the timestamp in the bucket, resets the counter in the bucket through the resubmit mechanism, and sends the extracted statistics value to the storage module.

[0049] The asynchronous update operation utilizes a recommit mechanism to address the single-time state access limitation, specifically comprising two phases:

[0050] Phase 1: When a periodic switch is detected, extract... Minimum value among hash buckets As a flow estimate, Write the packet header metadata and set the resubmit flag to resend the packet into the ingress pipeline;

[0051] Phase Two: After the resubmitted data packet re-enters the pipeline, the header information is parsed. and will The counter value in each hash bucket minus This eliminates the contribution from the previous cycle, thus achieving a logical reset of the counter.

[0052] S103, in the storage module, the statistical value based on the modulo operation result of the stream key hash and the current timestamp is stored in the sliding window slot of the two-dimensional circular queue to construct the time-series data sequence of each stream.

[0053] In this embodiment, the storage module TsQueues receives statistical values ​​and stores them in the sliding window slots corresponding to the two-dimensional circular queue based on the modulo operation result of the stream key hash and the current timestamp, thus constructing the time-series data sequence of the stream.

[0054] The storage module TsQueues adopts A two-dimensional structure, in which For the number of rows, The length is the sliding window length; each row contains a fingerprint field for stream key verification. and a length of Data queue When writing statistics, if the fingerprint corresponding to the row index matches the fingerprint of the current stream, the column index is calculated based on the low-order bits of the timestamp, and the value is written to the queue. If the fingerprint does not match, it is determined to be a hash collision or a new flow. The row eviction policy is executed, the fingerprint is reset and the queue is cleared before the new value is written.

[0055] S104, based on the detection module, obtains the time series data sequence from the storage module and calculates the time series statistical features in the data plane.

[0056] In this embodiment, the detection module TsAnomaly obtains the time-series data sequence of the stream from the storage module and calculates the time-series statistical features within the data plane.

[0057] The method for calculating the time series statistical features includes: using a divide-and-conquer addition strategy to calculate the sum and mean of the time series data within a limited pipeline stage; using a preset lookup table to map the values ​​to their squared values, and then calculating the variance; the feature calculation process is entirely based on integer operations and table lookup operations, and does not involve floating-point operations.

[0058] S105, based on the detection module, inputs temporal statistical features and packet-level features into the machine learning model deployed on the data plane for inference and outputs anomaly detection results.

[0059] In this embodiment, the detection module combines the calculated temporal statistical features with packet-level features, inputs them into the machine learning model deployed in the data plane pipeline for inference, and outputs the detection result of whether the flow is abnormal.

[0060] The machine learning model is a decision tree, random forest, or Naive Bayes classifier. Its deployment on the data surface is as follows: the logic after model training is converted into match-action tables; first, continuous feature values ​​are discretized into Boolean codes or interval codes through a feature encoding table; then, the encoded feature vectors are used as keys to match in the classification table to obtain the final classification decision.

[0061] As a brief summary of steps S101 to S105 above, the basic idea of ​​this invention is to address the problems of existing programmable data planes lacking temporal context information and being limited by hardware resources in anomaly detection, by designing a measurement and detection closed-loop system that runs entirely within the data plane. Specifically, firstly, an innovative Sketch structure called TsSketch is used to achieve full-stream asynchronous measurement with microsecond-level granularity through an in-bucket timestamp mechanism, and a resubmission mechanism is used to circumvent hardware state access restrictions, ensuring continuous output of periodic statistical data; secondly, a storage module TsQueues based on a two-dimensional circular queue is designed, which uses stream key hashing and timestamp modulo indexing to efficiently maintain the sliding window temporal data of all streams; finally, high-order temporal features (such as mean, variance, etc.) are extracted from the data plane and combined with packet-level features and input into a lightweight machine learning model (such as decision tree, random forest, etc.) to achieve real-time, high-precision detection of complex anomalies such as micro-bursts. This method has advantages such as full-flow coverage, microsecond-level accuracy, low resource consumption, and high detection accuracy. It is applicable to various scenarios such as data center network monitoring, intrusion detection, and traffic analysis, and has significant engineering application value.

[0062] This invention proposes a novel data plane full-flow timing measurement and anomaly detection framework, called TsMon. This framework takes network traffic data packets as input, requires no control plane intervention, and directly outputs anomaly detection results at the data plane. The overall framework is as follows: Figure 2 As shown, it consists of the following three main functional modules, and all modules are deployed in the programmable data plane pipeline:

[0063] First, the full-flow asynchronous measurement module (TsSketch). This module is responsible for measuring flow-level statistics for each time period. To achieve full flow coverage, TsSketch does not store or predefine flow keys, but instead triggers updates using the data packets themselves: Statistical data of the period in the first Settlement is completed when the next data packet arrives in the same period. To address data accessibility issues, TsSketch introduces an in-bucket timestamp mechanism, transforming the unified global period into independent periods at the stream level. Each bucket independently determines whether a new period has started and resets or updates accordingly. This decentralized asynchronous update logic eliminates dependence on loops or external coordination, ensures compatibility with switch pipeline constraints, and enables measurement results to be directly used for real-time anomaly detection in a streaming manner.

[0064] Second, the sliding window time-series storage module (TsQueues). While TsSketch provides single-period statistics, anomaly detection requires a series of statistical sequences that change over time. TsQueues bridges this gap by maintaining a compact and efficient sliding window to construct time-series data for each stream. TsQueues is implemented as a two-dimensional circular buffer based on stream key hashes and the current period's modulo index. Each row corresponds to a stream's time series, and each column represents a period slot. When new statistics arrive from TsSketch, TsQueues inserts them into the corresponding slot in the buffer. Once new data is inserted or a hash collision is detected, TsQueues forwards the corresponding time-series data row to the anomaly detection module. This allows TsMon to make detection decisions quickly without waiting for control plane intervention. Importantly, TsQueues maintains only a single instance on the data plane, avoiding excessive memory overhead caused by simply instantiating a Sketch for each period, thus meeting the need for efficient maintenance of time-series data for each stream in resource-constrained environments.

[0065] Third, the temporal anomaly detection module (TsAnomaly). This module extends existing data surface detection methods by incorporating temporal dynamics into the feature set. Unlike existing works that rely solely on packet-level or single-period features, TsAnomaly processes rich temporal vectors in real time. After receiving the time series of the stream from TsQueues, TsAnomaly first extracts raw values ​​(such as the number of bytes or packets per period) and then calculates statistical features, including mean, maximum, minimum, variance, and jitter—all calculated using optimized arithmetic operations and table lookup operations. These derived features significantly improve the model's expressive power and detection accuracy. TsAnomaly supports various lightweight machine learning models, including decision trees, Naive Bayes, and random forests. These models are implemented using P4 tables and actions, and can be executed entirely within the match-action pipeline.

[0066] In summary, this invention achieves a complete closed loop within the data plane, from microscopic measurement to time series construction and then to intelligent detection, through the collaborative work of three modules: TsSketch, TsQueues, and TsAnomaly.

[0067] In some embodiments, step S101 above, which involves determining whether a new time period exists based on the arrival time of the data packet and the truncation timestamp within the bucket, specifically includes:

[0068] The arrival time of the data packet and the corresponding truncation timestamp maintained in the bucket are extracted by the measurement module.

[0069] Calculate the difference between the arrival time and the truncation timestamp, and compare the difference with the preset period length;

[0070] If the difference is less than the period length, the data packet is determined to belong to the current time period; otherwise, the data packet is determined to belong to the new time period.

[0071] This embodiment demonstrates the specific implementation of the full-stream asynchronous measurement module TsSketch, as shown in the attached figure. Figure 3 As shown, to achieve microsecond-level granular measurement of network traffic and overcome hardware limitations, TsSketch employs a Sketch structure that supports asynchronous updates. Traditional Sketch relies on control plane polling to read data, which cannot meet the real-time detection requirements of the data plane. TsSketch solves this problem through the following mechanism:

[0072] Basic structural design: TsSketch consists of one Composed of bucket arrays, in which It represents the number of hash functions (i.e., the number of rows). This is the number of buckets per row. Each bucket maintains two core fields:

[0073] Truncation timestamp : Indicates the start time of the current period for this bucket. To save memory, a truncated version of the global timestamp is used.

[0074] counter Stores the aggregated value for the current period (such as the number of packets or bytes).

[0075] Processing flow: Assume a size of Data packets at time Arrival, and a fixed period length of (In this embodiment, it is set to 10) TsSketch performs the following steps:

[0076] Hash mapping: Extract the stream key k and compute Each hash function maps to a bucket index. , ..., .

[0077] Periodic checks: For each bucket, compare and .like This indicates that the data packet belongs to the current period, so it can be directly... Increase .

[0078] In some embodiments, step S102 above, which involves triggering an asynchronous update operation when a new time period is determined, extracting the statistical value of the previous period, updating the truncated timestamp in the bucket and resetting the counter, and simultaneously sending the statistical value to the storage module, specifically includes:

[0079] When it is determined that the data packet belongs to a new time period, the asynchronous update operation is triggered to extract the minimum value of the counter from multiple hash buckets corresponding to the current stream key, and use it as the statistical value of the previous period.

[0080] Update the truncation timestamp in the bucket to the start time of the current time period;

[0081] Write the statistics to the header metadata of the data packet and set the resubmit flag to make the data packet re-enter the processing pipeline to reset the counter;

[0082] When a packet carrying a resubmit flag is processed again, the statistics are parsed from the packet header metadata and subtracted from the counters of multiple hash buckets to complete the logical reset of the counters.

[0083] The statistical values ​​are sent to the storage module.

[0084] In this embodiment, the steps of period switching and asynchronous update include: if the data packet belongs to a new period (i.e. If ), then the update logic is triggered:

[0085] (a) Timestamp update: Set This marks the beginning of a new cycle;

[0086] (b) Statistical Extraction: Obtaining Minimum value among all related counters This is used as an estimated statistic for the previous cycle of the flow and forwarded to TsQueues;

[0087] (c) Reset and Re-aggregate: from each counter Subtract To eliminate the contribution from the previous cycle, and then add The accumulation of a new cycle begins.

[0088] Bypassing hardware constraints using a resubmit mechanism: The aforementioned reset and re-aggregation steps involve multiple state memory accesses, violating the "single state memory access" limitation of programmable switches (such as Tofino). To address this issue, this embodiment utilizes the Resubmit feature provided by Tofino to split the update logic into two pipeline stages:

[0089] Phase 1: Update when a period switch is detected. Extract the minimum value .Will Write a custom header field and set the Resubmit flag, while also... Send to TsQueues. Only packets with the Resubmit flag will re-enter the ingress pipeline.

[0090] Phase Two: After data packet re-entry, parse the custom packet header to obtain... and from Subtract from the counter Complete the clearing of contributions from the previous cycle.

[0091] This two-phase approach enables safe multi-register operations under hardware constraints. Crucially, updates for each stream are independent, enabling full-stream measurement without requiring explicit maintenance of each stream's state.

[0092] As attached Figure 4 As shown, this embodiment does not simply zero out the bucket. Since multiple flows may share a single bucket (hash collision), directly zeroing it out would incorrectly erase the contributions of other flows. TsSketch employs a "minimum subtraction" strategy: subtracting the estimated value of the flow from the relevant bucket. This preserves the statistics of other flows while effectively resetting the count of the current flow, thus maintaining high measurement accuracy even in the presence of hash collisions.

[0093] In some embodiments, in step S103 above, the statistical value of the modulo operation result based on the stream key hash and the current timestamp is stored in the sliding window slot of the two-dimensional circular queue to construct the time-series data sequence of each stream, specifically including:

[0094] The row index is obtained based on the stream key hash calculation, and the corresponding row is located in the two-dimensional circular queue.

[0095] Read the fingerprint field stored in this row and compare the fingerprint field with the fingerprint of the current stream;

[0096] If the fingerprint matches, the column index is calculated based on the low-order bits of the current timestamp, and the statistical value is written to the corresponding slot in the data queue of that row.

[0097] If the fingerprint does not match, perform a row initialization operation, update the fingerprint field to the fingerprint of the current stream, clear the data queue of the row, and write the statistical value to the initialized queue slot according to the column index;

[0098] By writing to multiple slots in a sliding window of a two-dimensional circular queue, a continuous sequence of time-series data is constructed and maintained for each stream.

[0099] This embodiment illustrates the specific implementation of the sliding window timing storage module TsQueues, as shown in the attached figure. Figure 5 As shown, based on TsSketch's implementation of single-cycle measurements, TsQueues is responsible for constructing the timing data for each stream. In this embodiment, TsQueues is designed as a lightweight data plane sliding window buffer, capable of storing the most recent l cycles (the default in this embodiment). =8) Statistical data.

[0100] Basic structure: TsQueues is implemented as a A bucket array, in which For the number of rows, This represents the length of the sliding window. Each line represents the storage space for a stream, containing:

[0101] fingerprint The truncated hash value of the stream key is used to verify row ownership and resolve hash collision issues.

[0102] Data queue : Length is A circular buffer that stores the most recently accessed stream. Statistical values ​​for each period. To reduce hardware costs, the low-order bits of the timestamp are used as an index for direct addressing. The slot in the middle. For example, when =8= At that time, the lowest 3 bits of the timestamp determine the position where the new value is inserted.

[0103] Workflow: When TsSketch outputs periodic statistics for a certain stream... When this happens, perform the following steps:

[0104] Index location: Hash the stream key to obtain the row index. Read the fingerprint of this row And compare it with the truncation key of the current stream;

[0105] Data writing: If the fingerprint matches, it will be written according to the current timestamp. Write to data queue The corresponding slot in the [database name]. At this point, the row stores the latest time-series data sequence of the stream. If the fingerprint does not match, it indicates a hash collision or that the position is occupied by an older stream. At this point, row initialization is performed: clear existing data and [database name] is added. Update the fingerprint to the new stream, and Initialize to include A new queue;

[0106] Data Output: After each write or eviction operation, TsQueues can output the complete time-series data of the current row (e.g., ... , ..., This indicates that the complete time-series data has been divided into data blocks and then forwarded to the downstream TsAnomaly module.

[0107] Extended Functionality: In addition to the basic flow curve, TsQueues independently collects features across other dimensions by adding extra buckets to each row. For example, to detect micro-bursts, packet arrival intervals are crucial. TsQueues uses these extra buckets to record the arrival time of the previous packet and calculates the time difference between the current packet and the previous packet, thus obtaining the packet interval. This multi-dimensional feature collection capability further enhances the input information for subsequent detection models.

[0108] In some embodiments, step S104 above, which involves obtaining the time-series data sequence from the storage module based on the detection module and calculating the time-series statistical features within the data plane, specifically includes:

[0109] The detection module receives a time-series data sequence from the storage module, the time-series data sequence including the statistical values ​​of the current stream for each time period within the sliding window;

[0110] Based on time series data sequences, the sum and mean of the time series data sequences are calculated using a divide-and-conquer addition strategy within the data plane;

[0111] The squared values ​​of each statistical value in the time series are mapped to their squared values ​​using a pre-set squared lookup table, and the variance of the time series is calculated by combining the mean.

[0112] The maximum and minimum values ​​are extracted from the time-series data sequence through parallel comparison operations, and the range is calculated based on the maximum and minimum values;

[0113] The sum, mean, variance, maximum, minimum, and range are output as time series statistical features.

[0114] Furthermore, the step of calculating the sum and mean of the time-series data sequence using a divide-and-conquer addition strategy within the data plane, based on the time-series data sequence, specifically includes:

[0115] Extract the periodic statistical values ​​from the time-series data sequence;

[0116] In the first pipeline stage, the statistical values ​​of each cycle are grouped and calculated in parallel to obtain multiple partial sums of the first stage;

[0117] In at least one subsequent pipeline stage, the partial sum of the output of the previous stage is used as input to continue grouping and parallel addition operations to obtain the partial sum of the next stage, until the sum of the time-series data sequence is obtained after a preset number of stages.

[0118] The mean of the time series data sequence is calculated using arithmetic shift operations based on the sum and the sliding window length.

[0119] This embodiment demonstrates the specific implementation of the timing anomaly detection module TsAnomaly, as shown in the attached figure. Figure 6 As shown, TsAnomaly is the decision-making core of the TsMon system, responsible for performing real-time inference using time-series data provided by TsQueues. This embodiment demonstrates how to deploy feature engineering and machine learning models within the data plane.

[0120] Time-series feature engineering: TsQueues outputs the original flow curve (e.g., , , ..., (This represents the various parts of the original traffic curve after data segmentation). To improve the model's detection capability, TsAnomaly first calculates higher-order statistical features within the data plane. Since the switch hardware does not support complex loops and floating-point operations, this embodiment employs the following optimization strategy:

[0121] Divide and Conquer: When calculating the sum and mean, a divide-and-conquer approach is used to avoid excessively long series (exceeding hardware limitations) caused by linear accumulation. For example, in the first stage of parallel computation... = , = ...in the next stage of calculation ...and so on. This only requires... The summation can be completed in one stage. This represents the partial sum calculated in the i-th stage. , and These represent the partial sums calculated in stages 1, 2, and 12, respectively. This indicates the number of stages required to complete all stages. Indicates the length of the sliding window.

[0122] Calculating squares and variances using a lookup table: Variance calculation requires squaring, but switches do not support multiplication. TsAnomaly provides a built-in square lookup table, using numerical... The key is used to directly look up the table. Combining the aforementioned mean, using the formula... Calculate the variance. Where the numerical values ​​are... Used as a key (index) in a square lookup table. Representing numerical values The square of, The variance of a random variable X is used to measure the dispersion of a data set. Represents random variables The expected value is the average of the squares of the values ​​in the dataset. Let x represent the expected value of the random variable x, and let y represent the average value of the data set.

[0123] Extreme values ​​and range: The maximum value (Max) and minimum value (Min) within the window are obtained in parallel through a multi-level comparison tree, and the range (Delta = Max - Min) is calculated, where Delta represents the range.

[0124] In some embodiments, in step S105 above, the step of inputting temporal statistical features and packet-level features into a machine learning model deployed on the data plane for inference based on the detection module, and outputting anomaly detection results, specifically includes:

[0125] The temporal statistical features are combined with the packet-level features extracted from the packet header to form a joint feature vector;

[0126] The continuous eigenvalues ​​in the joint eigenvector are discretized into corresponding interval codes or Boolean codes using the feature encoding table in the data plane pipeline.

[0127] The discretized interval codes or Boolean codes are concatenated into feature keys, and the feature keys are used as query inputs to the matching-action classification table corresponding to the machine learning model;

[0128] Based on the match-action classification table, precise matching is performed according to the feature key, and the corresponding classification action is output. The classification action is used to indicate whether the current data packet belongs to an abnormal flow.

[0129] In this embodiment, the feature vector constructed by TsAnomaly not only includes packet-level features (such as TTL, TCPFlags), but also rich stream-level temporal features (such as Sum, Mean, Variance, Min, Max, Jitter, etc.), as shown in Table 1.

[0130] Table 1

[0131]

[0132] Data deployment for machine learning models: This embodiment supports lightweight models such as decision trees, random forests, and Naive Bayes. These models are trained offline and then compiled into a matching-action table supported by the P4 language.

[0133] Feature encoding: First, the continuous feature values ​​are converted into discrete codes through a range matching table (e.g., "feature A belongs to interval 3" corresponds to code "10").

[0134] Decision execution: The encoding of all features is concatenated into a long bit string, which is used as a key for precise matching in the classification table. The matching result is the classification decision (such as "normal" or "abnormal").

[0135] Furthermore, the pre-training step of the machine learning model includes:

[0136] Collect a training dataset containing both normal and abnormal traffic, and extract training features from the training dataset that correspond to the joint feature vector;

[0137] The selected classification model is trained offline using training features to obtain the trained model parameters and decision logic. The classification model is a decision tree model, a random forest model, or a Naive Bayes model.

[0138] The trained model parameters and decision logic are converted into matching-action table logic supported by the data plane pipeline;

[0139] The matching-action table logic is compiled and loaded into the data plane of the programmable switch to form a feature encoding table and a matching-action classification table.

[0140] In this embodiment, a training dataset containing normal traffic and abnormal traffic is constructed. The data source may include traffic samples collected from the actual network environment or simulated network attack traffic, wherein the abnormal traffic needs to cover a variety of typical attack types (such as DDoS, port scanning, traffic surge, etc.). Training features corresponding to the joint feature vector are extracted from the training dataset, specifically including two types of features: (1) Temporal statistical features: For the statistical values ​​of each time period within the sliding window of each flow, the sum, mean, variance, range, maximum and minimum values ​​are calculated; (2) Packet-level features: Fields directly extracted from the packet header, such as packet length, port number, protocol type, TTL value, etc. The above two types of features are combined into a training feature vector according to a preset format to ensure that its structure is consistent with the joint feature vector input in the subsequent inference stage.

[0141] Based on the extracted training features, a classification model is selected for offline training. Available models include decision tree models, random forest models, or Naive Bayes models; the specific choice depends on the size of the training data and the complexity of the features. For example, if the amount of training data is small and the feature dimensionality is low, a decision tree model can be preferred; if high-dimensional features or non-linear relationships need to be handled, a random forest model is used to improve generalization ability.

[0142] The training process iteratively optimizes model parameters (such as the splitting threshold of the decision tree and the number of trees in the random forest) to achieve a preset threshold (such as above 95%) in classifying normal and abnormal traffic. After training, the model parameters (such as weights and splitting node values) and decision logic (such as the classification rule tree structure or probability calculation logic) are saved as the basis for subsequent logical transformations.

[0143] The model parameters and decision logic obtained from offline training are converted into matching-action table logic supported by the data surface pipeline. Specifically, if the classification model is a decision tree model or a random forest model, the splitting rules of each decision tree or random forest are decomposed into multi-level matching-action tables. For example, if a splitting node branches based on "variance > threshold", it is converted into a first-level matching table, with the rule key being "variance interval" and the action value being the index of the next-level matching table; the classification result (normal / abnormal) of the terminal leaf node is converted into the final action, such as setting the action flag to 0 or 1.

[0144] If the classification model is a Naive Bayes model, the prior and conditional probabilities of each feature are converted into lookup tables. For example, for the "mean" feature, the anomaly probabilities corresponding to its different value ranges are pre-calculated and stored as a probability lookup table; during inference, the posterior probabilities are calculated by querying each feature table and jointly calculating them, and finally, the classification action is output by comparing thresholds.

[0145] The converted match-action table logic is compiled into a configuration file recognizable by the programmable switch data plane. The compilation process needs to check whether the logic meets hardware constraints (such as SRAM capacity, ALU operation type). If it exceeds the constraints, the table structure needs to be optimized (such as merging multi-level tables, reducing the number of rules). After compilation, the configuration file is loaded into the programmable switch data plane to form two types of key tables: (1) Feature encoding table: used to discretize continuous feature values ​​into interval encoding or Boolean encoding. (2) Match-action classification table: stores the correspondence between classification rules and actions.

[0146] In this embodiment, the machine learning model is successfully deployed to the data plane of the programmable switch. Subsequently, it can be combined with the time-series data sequence and packet-level features output by the measurement module and storage module to achieve real-time anomaly detection.

[0147] Furthermore, the step of performing precise matching based on the feature key according to the matching-action classification table and outputting the corresponding classification action specifically includes:

[0148] Perform precise matching between the feature keys and the rule keys pre-stored in the matching-action classification table;

[0149] When a match is successful, a classification action associated with the corresponding rule key is executed. This classification action is used to indicate whether the current data packet belongs to an abnormal flow.

[0150] The results of the classification action are written to the metadata of the current data packet, and the corresponding control plane alarm is triggered to complete the indication of the abnormal status of the flow to which the current data packet belongs.

[0151] In this embodiment, the programmable switch has completed the deployment and configuration of related modules, including measurement modules, storage modules, detection modules, etc., and the matching-action classification table corresponding to the machine learning model has been pre-stored in the data plane.

[0152] During the data packet processing in the data plane, the detection module combines temporal statistical features with packet-level features extracted from the packet header to form a joint feature vector. Then, through the feature encoding table in the data plane pipeline, the continuous feature values ​​in the joint feature vector are discretized into corresponding interval codes or Boolean codes, and these discretized interval codes or Boolean codes are concatenated to form the feature key.

[0153] The data plane performs an exact match between the concatenated feature keys and the pre-stored rule keys in the match-action classification table. The match-action classification table pre-stores various rule keys, each associated with a specific classification action. These actions indicate whether the current data packet belongs to an abnormal flow. For example, a rule key might be an encoded form of a specific combination of traffic characteristics. A match is considered successful when the feature key exactly matches a rule key.

[0154] When a feature key matches exactly with a rule key in the match-action classification table, the data plane executes the classification action associated with that rule key. For example, if the classification action associated with a successfully matched rule key is "abnormal," it indicates that the current data packet belongs to a flow with an abnormal condition; if the associated classification action is "normal," it indicates that the current data packet belongs to a flow in a normal state.

[0155] After performing the classification action, the data plane writes the classification result into the metadata of the current data packet. Metadata is the part of the data packet used to store additional information. By writing the classification result into the metadata, the abnormal status information of the data packet can be easily obtained in subsequent processing.

[0156] Simultaneously, the data plane will trigger corresponding control plane alarms. The control plane is responsible for the overall management and control of the network. When the data plane detects abnormal traffic, it can promptly transmit the abnormal information to network administrators or relevant control programs by triggering control plane alarms. After receiving the alarm, the control plane can take further processing measures according to preset policies, such as isolating abnormal flows and logging abnormalities, thereby indicating the abnormal status of the current data packet's flow and ensuring the secure and stable operation of the network.

[0157] This embodiment implements a matching-action classification table, performs precise matching based on feature keys, and outputs the corresponding classification action, thereby accurately indicating the abnormal state of the flow to which the data packet belongs.

[0158] To verify the effectiveness, accuracy, and hardware feasibility of the micro-time data measurement and detection system (TsMon) based on a programmable switch proposed in this invention, this embodiment underwent extensive experimental evaluation in a real hardware testbed and simulation environment.

[0159] 1. Experimental Environment and Dataset Setup

[0160] In one embodiment of the invention, experimental evaluation is conducted using a real hardware testbed. The testbed consists of two high-performance servers (serving as traffic senders and receivers) and a programmable switch based on the Intel Tofino 1 chip, interconnected via a 100 Gbps high-speed link. The servers are configured to run Ubuntu 20.04, equipped with Intel Xeon Gold processors and 64GB of memory. The core logic of the TsMon system (including the TsSketch, TsQueues, and TsAnomaly modules) is written in P4 and compiled and deployed in the data plane pipeline of the Tofino switch.

[0161] To comprehensively evaluate system performance, this invention uses three representative datasets:

[0162] (1) WIDE MAWI dataset: This dataset is derived from real backbone network traffic from the WIDE project in Japan. It includes a 15-minute packet tracking record from October 5, 2024, containing approximately 3 million IPv4 packets. This dataset is primarily used to evaluate the measurement accuracy of TsSketch in real-world traffic environments.

[0163] (2) UNSW-NB15 dataset: A comprehensive cybersecurity benchmark dataset constructed by the University of New South Wales, containing real benign traffic (such as Web, Email, VoIP) and nine types of synthetic attack traffic (such as DoS, Backdoor, Exploits, etc.). This experiment extracted approximately 3 million IPv4 packets, covering eight attack types, to evaluate the detection accuracy of TsAnomaly before and after the introduction of time-series features;

[0164] (3) Burst_1GE and Burst_2GE datasets: These are real microburst traffic data collected from large enterprise network environments. We sampled data packets for one hour on gateway links with port rates of 1 Gbps and 2 Gbps, respectively, obtaining approximately 4K and 15K data packets. The characteristic of this dataset is that all data packets have the same length, making it difficult to distinguish anomalies based solely on packet-level features. It is mainly used to verify the coverage capability of time-series features in detecting hidden anomalies such as microbursts.

[0165] 2. Accuracy evaluation of the TsSketch measurement module

[0166] To verify the performance of TsSketch in full-stream asynchronous measurement, this embodiment compares it with existing mainstream measurement algorithms, including the classic Count-Min Sketch (CMS), Persist-CMS, and the latest OmniWindow and WaveSketch algorithms. All algorithms have a time period of 10 microseconds.

[0167] To quantify measurement accuracy, three evaluation metrics were introduced:

[0168] Cosine Similarity: Measures the degree of alignment between the estimated time series vector and the true time series vector in terms of direction. The closer the value is to 1, the higher the waveform reproduction accuracy.

[0169] Energy Similarity: Measures the recovery rate of total flow energy (sum of squares), reflecting the ability to capture large flow fluctuations.

[0170] Mean Relative Error (ARE): Measures the average level of the estimation error per flow across all cycles.

[0171] like Figure 7 As shown, the experimental results indicate that:

[0172] (1) In terms of cosine similarity: TsSketch consistently outperforms all baseline methods. Especially in memory-constrained scenarios (e.g., 5KB to 50KB), TsSketch achieves approximately 20% higher cosine similarity than the state-of-the-art WaveSketch algorithm;

[0173] (2) In terms of energy similarity: TsSketch showed a significant advantage, nearly 50% higher than the baseline method. This indicates that TsSketch can capture the dramatic fluctuations in flow and energy distribution more accurately;

[0174] (3) In terms of mean relative error (ARE): TsSketch maintained an extremely low error level.

[0175] The above advantages are mainly due to TsSketch's unique asynchronous update mechanism, which avoids the data staleness and discontinuity problems caused by the periodic global reset of traditional Sketch, and ensures that high-fidelity time-series data can still be obtained with low memory overhead.

[0176] 3. Accuracy assessment of the TsAnomaly detection module

[0177] To demonstrate the enhancing effect of time-series data on anomaly detection, this embodiment deployed three machine learning models—Decision Tree (DT), Random Forest (RF), and Naive Bayes (NB)—on a Tofino switch and conducted comparative tests under two feature configurations:

[0178] Configuration P: Use only packet-level features (such as packet length, TTL, TCP flags);

[0179] Configure TS+P: Combine packet-level features with the time-series statistical features extracted by this invention (such as mean, variance, range, etc.).

[0180] The experiment used accuracy, recall, and F1 score as evaluation metrics.

[0181] Table 2

[0182] ;

[0183] Table 3

[0184]

[0185] (1) Performance on the UNSW-NB15 dataset

[0186] As shown in Table 2, in multi-class anomaly detection tasks, the model incorporating temporal features (TS+P) significantly outperforms the model using only bag-level features (P) across all metrics. Specifically, the performance difference after incorporating temporal features is typically between 10% and 15%. The Random Forest model RF (TS+P) performs best, achieving an accuracy of 0.91 and an F1 score of 0.79 in the six-class anomaly classification task, demonstrating the crucial role of temporal features in capturing complex attack patterns.

[0187] (2) Performance on the Burst microburst dataset

[0188] As shown in Table 3, the advantages of temporal features are particularly evident in the specific scenario of micro-burst detection: the model (P) relying solely on packet-level features is completely unable to detect micro-burst anomalies, achieving an F1 score of 0 for the Burst category. This is because all packets in this dataset have the same length, lacking discriminative power. The model combining temporal features (TS+P) can effectively identify micro-bursts, with the decision tree DT (TS+P) and random forest RF (TS+P) achieving an F1 score as high as 0.96. This fully demonstrates that the temporal feature extraction method proposed in this invention significantly expands the coverage of data surface anomaly detection, enabling it to identify hidden anomalies that traditional methods cannot detect.

[0189] 4. Hardware resource overhead and throughput assessment

[0190] To evaluate the feasibility of TsMon in a real production environment, this embodiment statistically analyzes its resource consumption and impact on forwarding performance on an Intel Tofino 1 switch.

[0191] (1) Throughput test

[0192] This embodiment uses DPDK to generate a 100 Gbps line-rate flow rate for a stress test lasting up to 15 seconds. For example... Figure 8 As shown, a switch with TsMon deployed is compared to a baseline program that only performs MAC forwarding (DMAC). The results show that the throughput curve of TsMon almost overlaps with that of the baseline program, without causing any significant degradation in forwarding performance. This indicates that although TsMon introduces a resubmit mechanism, its impact on overall forwarding efficiency is negligible because it is only triggered at the moment of periodic switching, fully meeting the line-rate processing requirements.

[0193] Table 4

[0194]

[0195] (2) Resource occupancy analysis

[0196] As shown in Table 4, TsMon's utilization rate of various hardware resources on the switch is within a reasonable range:

[0197] SRAM: Occupies approximately 12.68%, mainly used to store TsSketch bucket arrays and TsQueues sliding windows;

[0198] TCAM: occupies approximately 17.86%, mainly used for stream classification and wildcard matching;

[0199] VLIW instructions: account for approximately 15.62%, indicating moderate logical complexity;

[0200] Logical table ID: Consumes the most resources at 50.00%, but this still leaves ample room for other network functions (such as routing tables and ACLs). Furthermore, experiments revealed that the overall system resource consumption is not simply the sum of the individual submodules; thanks to resource reuse between modules, the overall overhead is further reduced.

[0201] In summary, the experimental results strongly demonstrate the superiority of the TsMon system in terms of measurement accuracy, detection accuracy, and hardware efficiency, and verify that the technical approach of realizing full-flow micro-time series analysis and real-time anomaly detection on a programmable data plane is feasible.

[0202] Reference Figure 9 An embodiment of the present invention provides a micro-time series data measurement and detection system 9 based on a programmable switch. The micro-time series data measurement and detection system 9 based on a programmable switch specifically includes:

[0203] Measurement deployment unit 901 is used to deploy measurement modules on the data plane and determine whether it belongs to a new time period based on the arrival time of the data packet and the truncation timestamp in the bucket.

[0204] The asynchronous update unit 902 is used to trigger an asynchronous update operation when a new time period is determined, extract the statistical value of the previous period, update the truncated timestamp in the bucket and reset the counter, and send the statistical value to the storage module at the same time.

[0205] The sequence construction unit 903 is used in the storage module to store statistical values ​​into the sliding window slot of a two-dimensional circular queue based on the modulo operation result of the stream key hash and the current timestamp, thereby constructing the time-series data sequence of each stream.

[0206] The time series statistics unit 904 is used to obtain time series data sequences from the storage module based on the detection module and calculate time series statistical features in the data plane;

[0207] The anomaly detection unit 905 is used to input time-series statistical features and packet-level features into the machine learning model deployed on the data plane for inference based on the detection module, and output anomaly detection results.

[0208] It is understandable that, such as Figure 1 The content of the micro-time series data measurement and detection method embodiments based on programmable switches shown herein is applicable to the micro-time series data measurement and detection system embodiments based on programmable switches. The specific functions implemented in the micro-time series data measurement and detection system embodiments based on programmable switches are as follows: Figure 1 The embodiment of the micro-time series data measurement and detection method based on a programmable switch shown is the same, and the beneficial effects achieved are the same as those described above. Figure 1 The beneficial effects achieved by the embodiment of the micro-time data measurement and detection method based on programmable switches shown are also the same.

[0209] It should be noted that the information interaction and execution process between the above systems are based on the same concept as the method embodiments of the present invention. For details on their specific functions and technical effects, please refer to the method embodiments section, which will not be repeated here.

[0210] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0211] Reference Figure 10 The present invention also provides a computer device 10, including a memory 1002 and a processor 1001, and a computer program 1003 stored in the memory 1002. When the computer program 1003 is executed on the processor 1001, it implements the micro-time data measurement and detection method based on a programmable switch as described in any of the above methods.

[0212] The computer device 10 may be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device 10 may include, but is not limited to, a processor 1001 and a memory 1002. Those skilled in the art will understand that... Figure 10 The computer device 10 is merely an example and does not constitute a limitation on the computer device 10. It may include more or fewer components than shown, or combine certain components, or different components, such as input / output devices, network access devices, etc.

[0213] The processor 1001 may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0214] In some embodiments, the memory 1002 may be an internal storage unit of the computer device 10, such as a hard disk or memory of the computer device 10. In other embodiments, the memory 1002 may be an external storage device of the computer device 10, such as a plug-in hard disk, SmartMedia Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the computer device 10. Further, the memory 1002 may include both internal and external storage units of the computer device 10. The memory 1002 is used to store the operating system, applications, boot loader, data, and other programs, such as the program code of the computer program. The memory 1002 can also be used to temporarily store data that has been output or will be output.

[0215] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the micro-time data measurement and detection method based on a programmable switch as described in any of the above methods.

[0216] In this embodiment, if the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a photographing device / terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0217] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0218] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0219] In the embodiments disclosed in this application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0220] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

Claims

1. A programmable switch-based micro-chronological data measurement and detection method, characterized in that, The method specifically includes: Deploy a measurement module on the data plane to determine whether a new time period has been reached based on the arrival time of the data packet and the truncation timestamp within the bucket. When a new time period is determined, an asynchronous update operation is triggered to extract the statistical value of the previous period, update the truncated timestamp in the bucket and reset the counter, and at the same time send the statistical value to the storage module. In the storage module, the statistical values ​​based on the modulo operation results of the stream key hash and the current timestamp are stored in the sliding window slots of the two-dimensional circular queue to construct the time-series data sequence of each stream; Based on the detection module, time series data sequences are obtained from the storage module, and time series statistical features are calculated within the data plane; Based on the detection module, temporal statistical features and packet-level features are input into the machine learning model deployed on the data plane for inference, and anomaly detection results are output. The step of obtaining time-series data sequences from the storage module based on the detection module and calculating time-series statistical features within the data plane specifically includes: The detection module receives a time-series data sequence from the storage module, the time-series data sequence including the statistical values ​​of the current stream for each time period within the sliding window; Based on time series data sequences, the sum and mean of the time series data sequences are calculated using a divide-and-conquer addition strategy within the data plane; The squared values ​​of each statistical value in the time series are mapped to their squared values ​​using a pre-set squared lookup table, and the variance of the time series is calculated by combining the mean. The maximum and minimum values ​​are extracted from the time-series data sequence through parallel comparison operations, and the range is calculated based on the maximum and minimum values; The sum, mean, variance, maximum, minimum and range are output as time series statistical features; The detection module inputs temporal statistical features and packet-level features into a machine learning model deployed on the data plane for inference and outputs anomaly detection results, specifically including: The temporal statistical features are combined with the packet-level features extracted from the packet header to form a joint feature vector; The continuous eigenvalues ​​in the joint eigenvector are discretized into corresponding interval codes or Boolean codes using the feature encoding table in the data plane pipeline. The discretized interval codes or Boolean codes are concatenated into feature keys, and the feature keys are used as query inputs to the matching-action classification table corresponding to the machine learning model; Based on the match-action classification table, precise matching is performed according to the feature key, and the corresponding classification action is output. The classification action is used to indicate whether the current data packet belongs to an abnormal flow.

2. The method of claim 1, wherein, The method of determining whether a new time period belongs to a new time period based on the arrival time of the data packet and the truncation timestamp within the bucket specifically includes: The arrival time of the data packet and the corresponding truncation timestamp maintained in the bucket are extracted by the measurement module. Calculate the difference between the arrival time and the truncation timestamp, and compare the difference with the preset period length; If the difference is less than the period length, the data packet is determined to belong to the current time period; otherwise, the data packet is determined to belong to the new time period.

3. The method according to claim 1, characterized in that, The process of triggering an asynchronous update operation when a new time period is determined to be in effect includes extracting the statistical values ​​from the previous period, updating the truncated timestamps in the bucket and resetting the counter, and simultaneously sending the statistical values ​​to the storage module. Specifically, this includes: When it is determined that the data packet belongs to a new time period, the asynchronous update operation is triggered to extract the minimum value of the counter from multiple hash buckets corresponding to the current stream key, and use it as the statistical value of the previous period. Update the truncation timestamp in the bucket to the start time of the current time period; Write the statistics to the header metadata of the data packet and set the resubmit flag to make the data packet re-enter the processing pipeline to reset the counter; When a packet carrying a resubmit flag is processed again, the statistics are parsed from the packet header metadata and subtracted from the counters of multiple hash buckets to complete the logical reset of the counters. The statistical values ​​are sent to the storage module.

4. The method according to claim 1, characterized in that, The modulo operation result based on the stream key hash and the current timestamp is stored in the sliding window slot of the two-dimensional circular queue to construct the time-series data sequence for each stream, specifically including: The row index is obtained based on the stream key hash calculation, and the corresponding row is located in the two-dimensional circular queue. Read the fingerprint field stored in this row and compare the fingerprint field with the fingerprint of the current stream; If the fingerprint matches, the column index is calculated based on the low-order bits of the current timestamp, and the statistical value is written to the corresponding slot in the data queue of that row. If the fingerprint does not match, perform a row initialization operation, update the fingerprint field to the fingerprint of the current stream, clear the data queue of the row, and write the statistical value to the initialized queue slot according to the column index; By writing to multiple slots in a sliding window of a two-dimensional circular queue, a continuous sequence of time-series data is constructed and maintained for each stream.

5. The method according to claim 1, characterized in that, The method of calculating the sum and mean of time-series data sequences using a divide-and-conquer addition strategy within the data plane specifically includes: Extract the periodic statistics from the time-series data sequence; In the first pipeline stage, the statistical values ​​of each cycle are grouped and calculated in parallel to obtain multiple partial sums of the first stage; In at least one subsequent pipeline stage, the partial sum of the output of the previous stage is used as input to continue grouping and parallel addition operations to obtain the partial sum of the next stage, until the sum of the time-series data sequence is obtained after a preset number of stages. The mean of the time series data sequence is calculated using arithmetic shift operations based on the sum and the sliding window length.

6. The method according to claim 1, characterized in that, The pre-training steps of the machine learning model include: Collect a training dataset containing both normal and abnormal traffic, and extract training features corresponding to the joint feature vector from the training dataset; The selected classification model is trained offline using training features to obtain the trained model parameters and decision logic. The classification model is a decision tree model, a random forest model, or a Naive Bayes model. The trained model parameters and decision logic are converted into matching-action table logic supported by the data surface pipeline; The matching-action table logic is compiled and loaded into the data plane of the programmable switch to form a feature encoding table and a matching-action classification table.

7. The method according to claim 1, characterized in that, The matching-action classification table, which performs precise matching based on feature keys and outputs the corresponding classification action, specifically includes: Perform precise matching between the feature keys and the rule keys pre-stored in the matching-action classification table; When a match is successful, a classification action associated with the corresponding rule key is executed. This classification action is used to indicate whether the current data packet belongs to an abnormal flow. The results of the classification action are written to the metadata of the current data packet, and the corresponding control plane alarm is triggered to complete the indication of the abnormal status of the flow to which the current data packet belongs.

8. A microscopic timing data measurement and detection system based on a programmable switch, characterized in that, The system specifically includes: The measurement deployment unit is used to deploy measurement modules on the data plane and determine whether a new time period has been reached based on the arrival time of the data packet and the truncation timestamp within the bucket. The asynchronous update unit is used to trigger an asynchronous update operation when a new time period is determined, extract the statistical value of the previous period, update the truncated timestamp in the bucket and reset the counter, and send the statistical value to the storage module at the same time. The sequence construction unit is used in the storage module to store statistical values ​​into the sliding window slots of a two-dimensional circular queue based on the modulo operation result of the stream key hash and the current timestamp, thereby constructing the time-series data sequence for each stream. The time series statistics unit is used to obtain time series data sequences from the storage module based on the detection module, and calculate time series statistical features within the data plane; The anomaly detection unit is used to input temporal statistical features and packet-level features into the machine learning model deployed on the data plane based on the detection module, perform inference, and output anomaly detection results. The step of obtaining time-series data sequences from the storage module based on the detection module and calculating time-series statistical features within the data plane specifically includes: The detection module receives a time-series data sequence from the storage module, the time-series data sequence including the statistical values ​​of the current stream for each time period within the sliding window; Based on time series data sequences, the sum and mean of the time series data sequences are calculated using a divide-and-conquer addition strategy within the data plane; The squared values ​​of each statistical value in the time series are mapped to their squared values ​​using a pre-set squared lookup table, and the variance of the time series is calculated by combining the mean. The maximum and minimum values ​​are extracted from the time-series data sequence through parallel comparison operations, and the range is calculated based on the maximum and minimum values; The sum, mean, variance, maximum, minimum and range are output as time series statistical features; The detection module inputs temporal statistical features and packet-level features into a machine learning model deployed on the data plane for inference and outputs anomaly detection results, specifically including: The temporal statistical features are combined with the packet-level features extracted from the packet header to form a joint feature vector; The continuous eigenvalues ​​in the joint eigenvector are discretized into corresponding interval codes or Boolean codes using the feature encoding table in the data plane pipeline. The discretized interval codes or Boolean codes are concatenated into feature keys, and the feature keys are used as query inputs to the matching-action classification table corresponding to the machine learning model; Based on the match-action classification table, precise matching is performed according to the feature key, and the corresponding classification action is output. The classification action is used to indicate whether the current data packet belongs to an abnormal flow.

Images