Method and device for identifying and controlling PCDN terminal, equipment and medium

Abstract

The invention provides a PCDN terminal identification and control method and device, equipment and a medium, and the method comprises the steps: obtaining a multi-dimensional behavior feature based on the communication behavior data of a target terminal, and constructing a multi-dimensional behavior feature vector based on the multi-dimensional behavior feature; inputting the multi-dimensional behavior feature vector into a pre-trained classification model to obtain an identification result of whether the target terminal is a suspicious terminal; in response to the identification result that the target terminal is a suspicious terminal, analyzing each communication flow of the target terminal in the global flow table one by one, and judging whether each communication flow is a P2P uplink flow with a content distribution intention; a bandwidth limiting measure is applied in the upstream direction of a communication flow with respect to a P2P upstream stream having a content distribution intention. According to the embodiment of the invention, the method can achieve the high-accuracy recognition of the PCDN terminal and the corresponding P2P uplink flow, and achieves the flow control with the minimum intrusiveness.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of network, in particular to a PCDN terminal identification and control method, device, equipment and medium. BACKGROUND

[0002] With the popularity of large-flow services such as video on demand, live streaming acceleration, and game resource synchronization, PCDN (P2P Content Delivery Network) has become an important content transmission optimization technology. PCDN terminals share content among network edge nodes, reducing the pressure on the central server and improving transmission efficiency. However, this mechanism also introduces new network management challenges, especially in operator networks, where the surge in uplink traffic of PCDN can significantly burden core network resources and even affect normal user experience.

[0003] The existing PCDN terminal identification and control methods have the following defects:

[0004] 1. Static identification method based on port or protocol features: This method relies on specific P2P protocol markers (such as BitTorrent, eMule features) or fixed port ranges to identify PCDN terminals. However, with the widespread use of protocol obfuscation and dynamic port mechanisms, the identification accuracy of this method has decreased significantly, with serious misidentification and missed identification problems.

[0005] 2. Coarse-grained determination method based on uplink and downlink traffic ratio: This method determines whether there is a significant uplink behavior tilt by counting the uplink and downlink traffic ratio of the terminal. However, relying solely on a single traffic ratio feature lacks support for the context semantics and multi-dimensional behavior model of terminal communication behavior, and is prone to misidentifying normal uplink services such as cloud synchronization and backup as PCDN behavior, with poor generalization ability.

[0006] 3. Protocol analysis method based on DPI (Deep Packet Inspection): This method uses deep packet inspection technology to analyze and identify traffic content. However, the DPI method has the problems of high processing overhead and high privacy compliance risk, and its recognition ability is limited in the presence of widespread encrypted traffic.

[0007] 4. The above methods have single control means when limiting bandwidth, which can easily interfere with normal services: Once the above methods determine that a terminal is suspected of being a PCDN terminal, they limit the overall bandwidth, which can easily affect the user's normal communication, synchronization, video call, and other legitimate services. SUMMARY

[0008] This disclosure provides a method, apparatus, device, and medium for identifying and controlling PCDN terminals, in order to at least solve the problems of low identification accuracy, poor generalization ability, high processing overhead, and single control means that easily interfere with normal business in existing PCDN terminal identification and control methods.

[0009] In a first aspect, this disclosure provides a method for identifying and controlling a PCDN terminal, the method comprising:

[0010] Based on the communication behavior data of the target terminal, multi-dimensional behavioral features are obtained, and a multi-dimensional behavioral feature vector is constructed based on the multi-dimensional behavioral features. The multi-dimensional behavioral features include at least three of the following: uplink data packet size and downlink data packet size, number and direction distribution of session connections, duration of each connection, Internet Protocol IP type and distribution of uplink connection targets, and trend of connection activity over time.

[0011] The multi-dimensional behavioral feature vector is input into a pre-trained classification model to obtain the identification result of whether the target terminal is a suspicious terminal, wherein the suspicious terminal refers to a terminal with potential PCDN content distribution intention;

[0012] In response to the identification result that the target terminal is a suspicious terminal, each communication flow of the target terminal in the global flow table is analyzed one by one to determine whether each communication flow is a peer-to-peer P2P uplink flow with the intention of content distribution;

[0013] For P2P uplink streams with content distribution intent, bandwidth limiting measures are implemented in the uplink direction of the communication stream.

[0014] Furthermore, before obtaining multi-dimensional behavioral features based on the communication behavior data of the target terminal, the method further includes:

[0015] The system performs state tracking and behavior management on all communication flows passing through network devices, and records the terminal identifier and communication behavior data corresponding to each communication flow in the global flow table.

[0016] Each communication flow in the global flow table is uniquely identified by a Virtual Network Identifier (VNI), QinQ double-layer tag encapsulation technology, and a 5-tuple. The recorded communication behavior data includes flow direction, total uplink cumulative transmitted bytes, total downlink cumulative transmitted bytes, flow creation time, and flow update time.

[0017] Furthermore, the acquisition of multi-dimensional behavioral features based on the communication behavior data of the target terminal specifically includes at least three of the following:

[0018] The total number of uplink and downlink data packets in bytes is obtained by summing the total number of uplink and downlink data packets for all communication flows corresponding to the target terminal in the global flow table.

[0019] The number of all communication flows corresponding to the target terminal in the global flow table is counted and used as the number of session connections. The corresponding directional distribution is obtained based on the number of communication flows corresponding to different flow directions.

[0020] The duration of each connection is obtained by calculating the difference between the creation time and the update time of each communication flow corresponding to the target terminal in the global flow table;

[0021] Based on the network attributes of the uplink connection target IP of each communication flow corresponding to the target terminal, the IP type of the uplink connection target corresponding to each communication flow is obtained, and the corresponding distribution is obtained according to the proportion of communication flows of different IP types;

[0022] Based on all communication flows corresponding to the target terminal in the global flow table, the new increment of the total number of uplink cumulative transmitted bytes in each time window is calculated in a preset time window to form a traffic activity time series, and / or the number of newly established flows in each time window is counted to form a new connection rate time series. Based on the time series, the trend of connection activity over time is obtained.

[0023] Furthermore, the step of analyzing each communication flow of the target terminal in the global flow table one by one to determine whether each communication flow is a peer-to-peer (P2P) uplink flow with content distribution intent specifically includes:

[0024] For each communication flow of the target terminal in the global flow table, the following judgments are made: whether the total number of uplink cumulative transmitted bytes of the communication flow exceeds a preset total threshold, whether the communication flow has significant uplink skew characteristics, and whether the communication flow exhibits point-to-point transmission behavior characteristics.

[0025] Communication flows that exceed a preset total threshold for the total number of bytes transmitted uplink in the global flow table, exhibit significant uplink skew characteristics, and show point-to-point transmission behavior characteristics are identified as P2P uplink flows with content distribution intent.

[0026] Furthermore, determining whether the communication stream exhibits a significant uplink skew characteristic specifically includes:

[0027] The uplink skew ratio is obtained by calculating the ratio of the total uplink cumulative transmitted bytes to the total downlink cumulative transmitted bytes corresponding to the communication flow in the global flow table.

[0028] If the uplink skew ratio is greater than a preset skew ratio threshold, then the communication stream is determined to have a significant uplink skew characteristic.

[0029] The determination of whether the communication stream exhibits point-to-point transmission behavior characteristics specifically includes:

[0030] Based on the application layer characteristics of the communication flow, it is determined whether the communication flow exhibits point-to-point transmission behavior characteristics, wherein the application layer characteristics include destination port, transmission protocol, and target address attributes.

[0031] Furthermore, the bandwidth limiting measures implemented in the uplink direction of the communication stream specifically include:

[0032] The token bucket algorithm is used to allocate an independent token bucket for the communication flow and continuously add tokens to the token bucket at a preset uplink rate. When the communication flow sends an uplink data packet, it needs to consume a token from the token bucket that matches the size of the data packet. If there are not enough tokens, the uplink data packet is discarded or the transmission is delayed, thereby achieving bandwidth limitation on the uplink direction of the communication flow.

[0033] Furthermore, after implementing bandwidth limiting measures on the uplink direction of the communication stream, the method further includes:

[0034] For the communication flow after bandwidth limiting measures are implemented, when the limitation continues for a preset period of time or the traffic activity decreases, the lifting evaluation process is triggered; wherein, the decrease in traffic activity means that the difference between the flow update time of the communication flow in the global flow table and the current time is greater than a preset time threshold.

[0035] According to the triggered release evaluation process, it is determined whether the communication flow meets the preset bandwidth restriction release conditions. If the preset bandwidth restriction release conditions are met, the bandwidth restriction on the uplink direction of the communication flow is released.

[0036] Secondly, this disclosure provides a PCDN terminal identification and control device, the device comprising:

[0037] The feature vector construction module is used to obtain multi-dimensional behavioral features based on the communication behavior data of the target terminal, and construct a multi-dimensional behavioral feature vector based on the multi-dimensional behavioral features. The multi-dimensional behavioral features include at least three of the following: uplink data packet size and downlink data packet size, number and direction distribution of session connections, duration of each connection, Internet Protocol IP type and distribution of uplink connection targets, and trend of connection activity over time.

[0038] The suspicious terminal identification module is connected to the feature vector construction module and is used to input the multi-dimensional behavioral feature vector into a pre-trained classification model to obtain the identification result of whether the target terminal is a suspicious terminal. The suspicious terminal refers to a terminal with potential PCDN content distribution intention.

[0039] The communication flow analysis module, connected to the suspicious terminal identification module, is used to analyze each communication flow of the target terminal in the global flow table in response to the identification result that the target terminal is a suspicious terminal, and to determine whether each communication flow is a peer-to-peer P2P uplink flow with the intention of content distribution;

[0040] An uplink bandwidth limiting module, connected to the communication flow analysis module, is used to implement bandwidth limiting measures on the uplink direction of a P2P uplink flow that has the intention of content distribution.

[0041] Thirdly, this disclosure provides an electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores one or more computer programs executable by the at least one processor, the one or more computer programs being executed by the at least one processor to enable the at least one processor to perform the PCDN terminal identification and control method described in the first aspect above.

[0042] Fourthly, this disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the PCDN terminal identification and control method described in the first aspect.

[0043] The PCDN terminal identification and control method, apparatus, device, and medium disclosed herein extract at least three multi-dimensional communication behavior features—uplink and downlink data packet byte size, session connection number and direction distribution, duration of each connection, and IP type and distribution of uplink connection targets—and construct feature vectors. These features are then combined with a classification model to identify suspicious terminals with potential PCDN content distribution intentions. Furthermore, stream-by-stream analysis and verification accurately locate P2P uplink flows with content distribution intentions, achieving high-accuracy identification of PCDN terminals and corresponding P2P uplink flows. This significantly enhances generalization and adaptability while substantially reducing system processing overhead. Moreover, since uplink bandwidth limiting is only applied to confirmed P2P uplink flows, it ensures that the bandwidth of other normal terminal services remains unaffected, achieving minimally intrusive traffic control. This solves the problems of low identification accuracy, poor generalization ability, high processing overhead, and limited control methods that easily interfere with normal services in existing PCDN terminal identification and control methods. Attached Figure Description

[0044] The accompanying drawings are provided to further illustrate the present disclosure and form part of the specification. They are used together with the embodiments of the present disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings:

[0045] Figure 1 A flowchart illustrating a PCDN terminal identification and control method provided in this embodiment of the disclosure;

[0046] Figure 2 A flowchart for identifying the terminal to be reviewed provided in this embodiment of the disclosure;

[0047] Figure 3 A flowchart for identifying P2P uplink streams with content distribution intent provided in this embodiment of the disclosure;

[0048] Figure 4 A block diagram of a PCDN terminal identification and control device provided in this disclosure embodiment;

[0049] Figure 5 This is a block diagram of an electronic device provided in an embodiment of the present disclosure. Detailed Implementation

[0050] To enable those skilled in the art to better understand the technical solutions of this disclosure, exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments of this disclosure to aid understanding. These should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0051] Where there is no conflict, the various embodiments of this disclosure and the features thereof in the embodiments may be combined with each other.

[0052] As used herein, the term “and / or” includes any and all combinations of one or more related enumerated entries.

[0053] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. As used herein, the singular forms “a” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that when the terms “comprising” and / or “made of” are used in this specification, the presence of the stated feature, integral, step, operation, element, and / or component is specified, but the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof is not excluded. Words such as “connected” or “linked” are not limited to physical or mechanical connections but can include electrical connections, whether direct or indirect.

[0054] Unless otherwise specified, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and this disclosure, and will not be interpreted as having an idealized or overly formal meaning, unless expressly so defined herein.

[0055] Figure 1 A flowchart illustrating a PCDN terminal identification and control method provided in this disclosure. (Refer to...) Figure 1 The method includes:

[0056] Step S101: Based on the communication behavior data of the target terminal, obtain multi-dimensional behavioral features, and construct a multi-dimensional behavioral feature vector based on the multi-dimensional behavioral features. The multi-dimensional behavioral features include at least three of the following: uplink data packet size and downlink data packet size, number and direction distribution of session connections, duration of each connection, IP (Internet Protocol) type and distribution of uplink connection target, and trend of connection activity over time.

[0057] Specifically, since PCDN terminals typically exhibit characteristics such as large and continuous uplink data volume, large and asymmetrical distribution of session connections, long-term continuous upload behavior, upload connection targets mostly being various IPs, and continuous high activity or regular periodic activity, the multi-dimensional behavioral characteristics preferably include: uplink data packet size and downlink data packet size, number and direction distribution of session connections, duration of each connection, IP type and distribution of uplink connection targets, and trend of connection activity over time.

[0058] In some embodiments, before obtaining multi-dimensional behavioral features based on the communication behavior data of the target terminal, the method further includes:

[0059] The system performs state tracking and behavior management on all communication flows passing through network devices, and records the terminal identifier and communication behavior data corresponding to each communication flow in the global flow table.

[0060] Each communication flow in the global flow table is uniquely identified by a combination of VNI (Virtual Network Identifier), QinQ (802.1Q-in-802.1Q, a dual-layer tag encapsulation technology), and a 5-tuple. The recorded communication behavior data includes flow direction, total uplink cumulative transmitted bytes, total downlink cumulative transmitted bytes, flow creation time, and flow update time.

[0061] Specifically, the system maintains a global flow table for status tracking and behavior management of all communication flows passing through network devices. These network devices can be any network device requiring PCDN terminal identification and uplink bandwidth control, such as edge gateways (BRAS / BNG), carrier traffic probe / mirror acquisition systems, SDN control platforms, and cloud-based traffic analysis platforms. The flow table uniquely identifies each communication flow using a combination of VNI, QinQ, and a five-tuple (source IP, destination IP, source port, destination port, protocol). Each communication flow (i.e., a flow table entry) has a corresponding terminal identifier and communication behavior data. The terminal identifier may be a MAC (Media Access Control) address, and the communication behavior data includes at least the flow direction (DIR), total uplink bytes transmitted (UP_BYTS), total downlink bytes transmitted (DOWN_BYTS), flow creation time (CREATE_TIME), and flow update time (UPDATE_TIME). Additionally, it may include, for example, a PCDN suspicious flow flag (PCDN_FLAG).

[0062] Specifically, upon receiving a message, the system searches for the corresponding communication flow in the global flow table based on the VNI+QinQ+ 5-tuple. If not found, a new communication flow is created and added to the global flow table. The flow creation time (CREATE_TIME) is set to the current time, the flow direction (DIR) is set to the direction corresponding to the flow (uplink or downlink), the MAC is set to the source MAC, and the cumulative uplink transmitted bytes (UP_BYTS) and cumulative downlink transmitted bytes (DOWN_BYTS) are initialized to 0. If the corresponding communication flow is found, the flow update time (UPDATE_TIME) is set to the current time, and the cumulative uplink transmitted bytes (UP_BYTS) or cumulative downlink transmitted bytes (DOWN_BYTS) is accumulated according to the direction.

[0063] Specifically, the target terminal is any terminal identified by any terminal identifier in the global flow table. The global flow table supports real-time updates and automatic recycling mechanisms for flow table entries. It can automatically clear corresponding entries when a flow is inactive for a long time or reaches its lifecycle limit, thereby controlling memory consumption and maintaining system processing efficiency.

[0064] In some embodiments, obtaining multi-dimensional behavioral characteristics based on the communication behavior data of the target terminal specifically includes at least three of the following:

[0065] The total number of uplink and downlink data packets in bytes is obtained by summing the total number of uplink and downlink data packets for all communication flows corresponding to the target terminal in the global flow table.

[0066] The number of all communication flows corresponding to the target terminal in the global flow table is counted and used as the number of session connections. The corresponding directional distribution is obtained based on the number of communication flows corresponding to different flow directions.

[0067] The duration of each connection is obtained by calculating the difference between the creation time and the update time of each communication flow corresponding to the target terminal in the global flow table;

[0068] Based on the network attributes of the uplink connection target IP of each communication flow corresponding to the target terminal, the IP type of the uplink connection target corresponding to each communication flow is obtained, and the corresponding distribution is obtained according to the proportion of communication flows of different IP types;

[0069] Based on all communication flows corresponding to the target terminal in the global flow table, the new increment of the total number of uplink cumulative transmitted bytes in each time window is calculated in a preset time window to form a traffic activity time series, and / or the number of newly established flows in each time window is counted to form a new connection rate time series. Based on the time series, the trend of connection activity over time is obtained.

[0070] Specifically, the communication behavior data of the target terminal originates from the raw flow data in the global flow table or derived calculated data based on the raw flow data. The uplink and downlink packet byte counts are obtained by accumulating the total uplink and downlink bytes for all flow table entries corresponding to the target terminal (MAC) in the global flow table. The number and direction distribution of session connections are obtained by counting the number of flow entries for the target terminal and the number of flows with different DIR values ​​in the global flow table. The duration of each connection is equal to the time from the flow's creation to its most recent active time. The IP type and distribution of uplink connection targets are obtained based on the network attributes of the uplink connection target IPs for all flow table entries of the target terminal, combined with the proportion of communication flows of different IP types. The trend of connection activity over time is obtained by statistically analyzing the new increment of the total uplink transmitted bytes and / or the number of newly created flows within preset time windows (e.g., 1 minute, 5 minutes, etc.) to form a corresponding time series.

[0071] Step S102: Input the multi-dimensional behavioral feature vector into the pre-trained classification model to obtain the identification result of whether the target terminal is a suspicious terminal, wherein the suspicious terminal refers to a terminal with potential PCDN content distribution intention.

[0072] Specifically, the classification model is one or more combinations of random forest model, gradient boosting tree model, support vector machine (SVM) or neural network model. Since random forest has strong anti-overfitting ability and adaptability to high-dimensional sparse features, it can effectively identify terminals with potential PCDN content distribution intentions in complex network environments. Therefore, the classification model is preferably a random forest model.

[0073] Specifically, communication behavior data of known PCDN terminals (positive samples) and non-PCDN terminals (negative samples) are collected, cleaned, and labeled to construct multi-dimensional behavior feature vectors. These feature vectors are then used to train a classification model, which is then optimized to obtain a well-trained classification model.

[0074] Step S103: In response to the identification result that the target terminal is a suspicious terminal, analyze each communication flow of the target terminal in the global flow table one by one to determine whether each communication flow is a P2P (Peer-to-Peer) uplink flow with content distribution intent.

[0075] Specifically, if the target terminal is identified as a suspicious terminal, further analysis is conducted at the session level to identify whether it exhibits suspicious upload behavior with content distribution characteristics.

[0076] In some embodiments, the step of analyzing each communication flow of the target terminal in the global flow table one by one to determine whether each communication flow is a peer-to-peer (P2P) uplink flow with content distribution intent specifically includes:

[0077] For each communication flow of the target terminal in the global flow table, the following judgments are made: whether the total number of uplink cumulative transmitted bytes of the communication flow exceeds a preset total threshold, whether the communication flow has significant uplink skew characteristics, and whether the communication flow exhibits point-to-point transmission behavior characteristics.

[0078] Communication flows that exceed a preset total threshold for the total number of bytes transmitted uplink in the global flow table, exhibit significant uplink skew characteristics, and show point-to-point transmission behavior characteristics are identified as P2P uplink flows with content distribution intent.

[0079] Specifically, it can be first determined whether the total number of bytes transmitted uplink exceeds a preset total threshold (e.g., 100M). If so, it can be further determined whether the communication flow has a significant uplink skew characteristic, that is, whether the ratio of the total number of bytes transmitted uplink to the total number of bytes transmitted downlink is greater than a preset skew ratio threshold. If so, it can be further determined whether the communication flow exhibits point-to-point transmission behavior characteristics. If so, it can be determined that the communication flow is a P2P uplink flow with content distribution intent.

[0080] In some embodiments, determining whether the communication stream has a significant uplink skew feature specifically includes:

[0081] The uplink skew ratio is obtained by calculating the ratio of the total uplink cumulative transmitted bytes to the total downlink cumulative transmitted bytes corresponding to the communication flow in the global flow table.

[0082] If the uplink skew ratio is greater than a preset skew ratio threshold, then the communication stream is determined to have a significant uplink skew characteristic.

[0083] The determination of whether the communication stream exhibits point-to-point transmission behavior characteristics specifically includes:

[0084] Based on the application layer characteristics of the communication flow, it is determined whether the communication flow exhibits point-to-point transmission behavior characteristics, wherein the application layer characteristics include destination port, transmission protocol, and target address attributes.

[0085] Specifically, if the uplink skew ratio is significantly greater than the downlink skew ratio, there may be continuous content uploading. Therefore, when the uplink skew ratio exceeds a preset skew ratio threshold, it is determined that the communication flow has a significant uplink skew, which may indicate PCDN or P2P content distribution behavior. This skew ratio threshold can be obtained through historical traffic statistics and feature learning from a random forest model.

[0086] Specifically, based on the application layer characteristics of the communication flow, it is analyzed whether it meets the preset point-to-point transmission behavior judgment conditions. Specifically, the judgment can be made by matching application layer feature combinations. The feature combination includes at least one of the following: a combination of multiple target public IPs, continuous high uplink traffic and long duration, a combination of P2P / content distribution specific ports or protocols, uplink skew and multi-target distribution, a combination of edge node / CDN (Content Delivery Network) edge device target address, uplink skew and long duration, and a combination of multi-session concurrency, uplink skew and high activity. If the communication flow matches any of the above feature combinations, it is determined that it exhibits point-to-point transmission behavior.

[0087] Step S104: For P2P uplink streams with content distribution intent, implement bandwidth limiting measures in the uplink direction of the communication stream.

[0088] Specifically, for P2P uplink flows intended for content distribution, the system only applies bandwidth restrictions to their uplink direction, without uniformly limiting the rate of the entire terminal or all traffic. This control strategy has minimal intrusion, accurately targeting suspicious traffic while maximizing the normal business experience of the terminal and network fairness.

[0089] In some embodiments, the bandwidth limiting measures implemented on the uplink direction of the communication stream specifically include:

[0090] The token bucket algorithm is used to allocate an independent token bucket for the communication flow and continuously add tokens to the token bucket at a preset uplink rate. When the communication flow sends an uplink data packet, it needs to consume a token from the token bucket that matches the size of the data packet. If there are not enough tokens, the uplink data packet is discarded or the transmission is delayed, thereby achieving bandwidth limitation on the uplink direction of the communication flow.

[0091] Specifically, a token bucket algorithm can be used. For communication flows that need to be rate-limited, a token bucket is maintained, and a certain number of "tokens" are added every second. Uplink traffic consumes tokens, and packets exceeding the rate are dropped to achieve rate limiting.

[0092] In some embodiments, after implementing bandwidth limiting measures on the uplink direction of the communication stream, the method further includes:

[0093] For the communication flow after bandwidth limiting measures are implemented, when the limitation continues for a preset period of time or the traffic activity decreases, the lifting evaluation process is triggered; wherein, the decrease in traffic activity means that the difference between the flow update time of the communication flow in the global flow table and the current time is greater than a preset time threshold.

[0094] According to the triggered release evaluation process, it is determined whether the communication flow meets the preset bandwidth restriction release conditions. If the preset bandwidth restriction release conditions are met, the bandwidth restriction on the uplink direction of the communication flow is released.

[0095] Specifically, for specific communication flows that have been subject to uplink rate limiting, the system continuously monitors their behavior. When the restriction persists for a preset period or traffic activity decreases, a release evaluation process is triggered to determine whether the communication flow meets preset bandwidth limit release conditions. These conditions include: the uplink / downlink traffic ratio tends to be balanced, the number of target addresses decreases and is concentrated in non-P2P high-risk segments, the uplink rate remains below the interference threshold, and the flow's activity level weakens. When multiple conditions are met simultaneously, the uplink bandwidth limit on the communication flow is released. Furthermore, to avoid policy oscillations caused by frequent rate limiting and release, the system sets an observation period for newly released communication flows. If abnormal behavior recurs during this period, the flow re-enters the rate limiting state.

[0096] In one specific embodiment, the PCDN terminal identification and control method may include the following steps:

[0097] S1. The system maintains a global flow table for status tracking and behavior management of all communication flows passing through network devices. This flow table uniquely identifies each communication flow using a combination of VNI (Virtual Network Identifier), QinQ (Dual-Tagged VLAN), and a five-tuple (source IP, destination IP, source port, destination port, protocol).

[0098] Each flow table entry contains the following field information:

[0099] VNI: Identifies the virtual network instance to which the flow belongs;

[0100] QinQ: Identifies the physical or logical link layer label to which the flow belongs, used to isolate different tenants or services;

[0101] The 5-tuple includes the source IP, destination IP, source port, destination port, and transport layer protocol number, used to accurately identify network flows;

[0102] DIR: Indicates whether the stream is uplink (terminal → external) or downlink (external → terminal).

[0103] MAC: The physical address of the source device, used to identify the terminal;

[0104] PCDN_FLAG: Indicates whether the stream is judged to be a suspicious P2P stream with content distribution intent;

[0105] UP_BYTS: The total number of bytes transmitted in the uplink direction since the stream was created;

[0106] DOWN_BYTS: The total number of downlink bytes transmitted since the stream was created.

[0107] CREATE_TIME: Records the time when the flow is first detected and entered into the flow table, used to determine the creation of a new flow;

[0108] UPDATE_TIME: Records the time when the stream was last matched or updated, used to determine whether the stream is active.

[0109] This global flow table supports real-time updates and automatic recycling of flow table entries. It can automatically clear corresponding entries when a flow is inactive for a long time or reaches its lifecycle limit, thereby controlling memory consumption and maintaining system processing efficiency.

[0110] For example, the global flow table can be as shown in Table 1:

[0111] Table 1: Global Flow Table

[0112]

[0113] Upon receiving a message, the system searches for a flow based on the VNI+QinQ+5-tuple. If no flow is found, a new flow is created and added to the flow table.

[0114] Write the VNI+QinQ and the quintuple from the message;

[0115] CREATE_TIME = Current time;

[0116] DIR = Upward or Downward;

[0117] MAC = Source MAC;

[0118] PCDN_FLAG=FALSE;

[0119] UP_BYTS / DOWN_BYTS are initialized to 0;

[0120] If a flow is found:

[0121] UPDATE_TIME = current time;

[0122] UP_BYTS or DOWN_BYTS are accumulated based on the direction.

[0123] S2. Based on the collected terminal network communication behavior data, the system constructs a multi-dimensional behavior feature vector, which includes, but is not limited to:

[0124] (a) Uplink and downlink data packet size in bytes (or the number and size of uplink and downlink data packets).

[0125] Meaning: This refers to the scale of network traffic sent and received by a terminal within a certain time window. A large and continuous volume of uplink data is often characteristic of PCDN or P2P content distribution.

[0126] Acquisition method: For all flow table entries corresponding to the same terminal (MAC) in the global flow table, accumulate the total number of bytes for both upstream and downstream traffic.

[0127] (b) Number and direction distribution of session connections;

[0128] Meaning: Session connection count represents the number of independent streams that exist simultaneously on a terminal; directional distribution represents the ratio of uplink / downlink streams, used to determine whether the traffic is symmetrical;

[0129] Acquisition method: Count the number of flow entries with the same MAC address in the global flow table, which is the number of session connections. Count the number of flows with different DIR values ​​to obtain the uplink / downlink distribution.

[0130] (c) Duration of each connection;

[0131] Meaning: Connection duration = the length of time from the creation of the stream to the most recent active time. Long-term continuous uploads are a characteristic of PCDN, while short-term burst uploads may be normal business.

[0132] How to obtain: duration (connection duration) = UPDATE_TIME - CREATE_TIME.

[0133] (d) IP type and distribution of uplink connection targets;

[0134] Meaning: IP type refers to the network attribute of the target IP of the uplink connection (such as public IP / internal IP, edge node IP or CDN edge device IP, cloud service IP); distribution refers to the proportion of flows connecting to different types of IPs, used to judge the breadth of terminal connections (PCDN terminals usually connect to multiple types of IPs, while ordinary users mostly connect to a few fixed types of IPs).

[0135] Acquisition method: Filter all uplink flows with the same MAC address in the global flow table (DIR is used to identify uplink) to obtain the target IP address of each flow; Query external IP information databases (such as IP geo databases, ASN autonomous system databases) to label the type of each target IP, and count the number of IPs of each type and the proportion of flow, which is the IP type and distribution of the uplink connection target.

[0136] (e) Trend of connection activity over time.

[0137] Meaning: The trend of connection activity over time refers to the fluctuation pattern of terminal traffic throughput or new connection rate within a preset time window. PCDN terminals, due to the need to continuously distribute content to multiple terminals, typically exhibit a trend of "continuous high activity" or "regular periodic activity," while the network behavior of ordinary user terminals is more related to personal usage habits, typically exhibiting an activity pattern of "occasional sudden activity" or "strong correlation with work and rest time."

[0138] Acquisition method: In the global flow table, aggregate and analyze all flow records of the specified terminal (MAC) in fixed time windows (e.g., 5 minutes, 1 hour, etc.):

[0139] Activity calculation based on traffic throughput intensity: The sum of the uplink byte increments of all streams of the terminal within each time window is counted. Specifically, the amount of new bytes in the window can be obtained by recording the cumulative value of UP_BYTS of each stream at the beginning and end of the window and calculating the difference.

[0140] Activity calculation based on new connection rate (optional): Count the number of new flows for the terminal in each time window (based on the criterion that CREATE_TIME falls within the current window), and use it as the connection rate activity value for that window;

[0141] Trend generation: Arrange the activity indicators (traffic throughput intensity or new connection rate) of each time window in chronological order to form a time series, and then analyze its changing trends (such as calculating the daily average curve, identifying outlier windows, and detecting periodic patterns).

[0142] After feature extraction, the system uses a Random Forest model as the behavior recognition algorithm. This model automatically learns the correspondence between features and labels by introducing a large number of known PCDN and non-PCDN behavior samples during the training phase, and performs inference and judgment on the real-time feature vectors of each terminal after deployment.

[0143] Random forests possess strong resistance to overfitting and adaptability to high-dimensional sparse features, enabling them to effectively identify terminals with potential content distribution intentions in complex network environments. Once a terminal is identified as suspicious, the system internally marks it as pending review. For example, the identification process for terminals pending review is as follows: Figure 2 As shown: After the user terminal traffic is analyzed by the random forest model, terminals suspected of PCDN are marked as suspicious terminals. If there is no PCDN suspicion, the process ends.

[0144] S3. For terminals already marked as "pending review," this step delves deeper into session-level flow analysis to identify any suspicious upload behavior exhibiting content distribution characteristics. The P2P uplink flow identification process with content distribution intent is as follows: Figure 3 As shown, the specific steps include:

[0145] 1) Determine if the uplink traffic of a single stream exceeds 100M;

[0146] 2) Analyze the communication streams of the terminal one by one, count the number of uplink and downlink bytes for each stream, and identify streams with significant uplink skewed characteristics (i.e., uplink is much greater than downlink, which may indicate continuous content uploading behavior);

[0147] The calculation of the uplink and downlink data bytes for each stream is used to determine the uplink / downlink ratio (or upload skew ratio). This ratio is used to identify streams with significant upload skew, which could indicate PCDN or P2P content distribution behavior. The system sets an empirical threshold Rth, learned through historical traffic statistics and features from a random forest model. If the uplink / downlink ratio is greater than or equal to this threshold, the stream is identified as having significant upload skew characteristics. For example, with a threshold of 3, if UP_BYTS=3 and DOWN_BYTS=1, the upload skew ratio is 3, thus identifying the stream as having significant upload skew characteristics.

[0148] 3) Combining the application layer characteristics of the flow (such as destination port, transmission protocol, target address attributes), further determine whether the flow exhibits peer-to-peer (P2P) transmission behavior, such as the target being multiple public IPs or edge devices, or the flow duration being long; finally, identify these flows as "P2P uplink flows with content distribution intent" and set the PCDN_FLAG of the flow in the flow table to TRUE.

[0149] For example, when a stream has the following combination of application layer characteristics, it can be determined that the stream exhibits peer-to-peer (P2P) transmission behavior:

[0150] (a) Multi-target public network + continuous high uplink traffic + long duration:

[0151] Uplink bytes / downlink bytes consistently > Rth;

[0152] The number of uplink target IPs is greater than or equal to the threshold (initially 10, and will be dynamically adjusted based on the random forest model).

[0153] The flow duration is relatively long (initially 10 minutes, which will be dynamically adjusted based on the random forest model).

[0154] (b) Specific port / protocol + uplink skew + multi-target distribution:

[0155] The destination port belongs to the P2P / content distribution port range (e.g., BitTorrent 6881-6889, or a custom port pool).

[0156] The protocol is TCP (Transmission Control Protocol), UDP (User Datagram Protocol), or a combination of TCP and UDP;

[0157] The upside / downside ratio is high;

[0158] The target IPs are widely distributed (not a single server).

[0159] (c) Edge device distribution + uplink tilt + uplink continuity

[0160] The target IP belongs to the list of edge nodes or CDN edge devices;

[0161] A large up / down ratio;

[0162] The flow duration is relatively long (initially 10 minutes, which will be dynamically adjusted based on the random forest model).

[0163] (d) High activity level + multiple concurrent sessions + uplink skew

[0164] Multiple streams are active simultaneously on the same terminal;

[0165] The number of streams with high uplink ratios exceeds the threshold;

[0166] The duration of each stream is greater than the minimum threshold.

[0167] 4) For specific communication flows identified in this manner, the system only applies bandwidth restrictions to their upstream direction, without uniformly limiting the rate of the entire terminal or all traffic. This control strategy minimizes intrusion, accurately targeting suspicious traffic while maximizing the normal service experience of the terminal and network fairness.

[0168] Specifically, a token bucket algorithm can be used. For communication flows that need to be rate-limited, a token bucket is maintained, and a certain number of "tokens" are added every second. Uplink traffic consumes tokens, and packets exceeding the rate are dropped to achieve rate limiting.

[0169] S4. For specific communication flows that have implemented uplink rate limiting, the system continuously monitors their behavior and dynamically lifts the rate limiting when certain conditions are met, ensuring the control strategy has timeliness and adaptability. The core logic for lifting the strategy is as follows:

[0170] 1) Timing of lifting the assessment

[0171] The system will periodically trigger the de-evaluation process after the rate limit has been in place for a period of time, or when traffic activity decreases (for example, when the difference between the UPDATE_TIME of the flow in the flow table and the current time is greater than 10 minutes).

[0172] 2) Evaluation and judgment indicators

[0173] The system determines whether the flow has returned to normal behavior based on the following factors:

[0174] (a) The ratio of uplink to downlink traffic tends to be balanced, and the uplink skewness is significantly weakened; for example, the uplink skewness ratio of the current flow is less than the threshold.

[0175] (b) The number of target addresses for the flow decreases and is concentrated in non-P2P high-risk segments; where non-P2P high-risk segments refer to segments where the terminal's uplink flow targets are mainly located in trusted public network segments, enterprise service segments, or cloud service segments, rather than typical P2P widely distributed target segments. Rate limiting will only be lifted when the number of high-risk address segments decreases and other conditions are met.

[0176] (c) The uplink rate remains at a low level and does not reach the interference threshold;

[0177] (d) The activity of the stream decreases, and the connection duration is reasonable or about to end.

[0178] 3) Cancel action

[0179] When multiple indicators indicate that the stream no longer has the intention to distribute content, the system automatically removes the uplink rate limit from the stream and marks it as "behavior restored" (that is, sets the PCDN_FLAG of the stream in the stream table to FALSE), and switches to the regular monitoring process.

[0180] 4) Jitter suppression mechanism

[0181] To avoid policy oscillations caused by frequent rate limiting and lifting, the system sets an observation period for communication flows that have just been lifted. If the behavior becomes abnormal again during this period, the system will re-enter the rate limiting state.

[0182] It should be noted that the PCDN terminal identification and control method provided in this disclosure has the following characteristics:

[0183] a) Behavioral feature-driven terminal identification mechanism: Utilize multi-dimensional behavioral features such as uplink and downlink data packet byte size, number and direction distribution of session connections, duration of each connection, IP type and distribution of uplink connection targets, and trend of connection activity over time to construct terminal feature vectors, and identify potential PCDN content distribution intention terminals based on behavioral patterns, which is different from traditional identification methods based on port, protocol fields or total traffic.

[0184] b) Connection-level Upload Tilt Behavior Determination Mechanism: After a terminal is identified as a suspicious terminal, the traffic direction of its individual connections is further analyzed in detail to accurately identify session flows with significant uplink skew. This mechanism is the first to reduce the identification granularity to the "session level" and combine it with data directionality to improve identification accuracy.

[0185] c) Minimal Intrusive One-Way Rate Limiting Strategy: For identified peer-to-peer P2P uplink flows with content distribution intent, rate limiting is implemented only in the uplink direction without affecting downlink and other normal terminal connections, thus achieving a traffic governance strategy that minimizes the impact on user service experience.

[0186] d) Dynamic feedback and state recovery mechanism: By introducing a periodic behavior evaluation model, the terminal can automatically remove or restore restrictions based on behavior evolution, avoiding long-term misjudgment interference caused by static strategies.

[0187] The PCDN terminal identification and control method provided in this disclosure extracts at least three multi-dimensional communication behavior features, including uplink and downlink data packet byte size, session connection number and direction distribution, duration of each connection, and IP type and distribution of uplink connection targets, and constructs feature vectors. These features are then combined with a classification model to identify suspicious terminals with potential PCDN content distribution intentions. Furthermore, stream-by-stream analysis and verification accurately locate P2P uplink flows with content distribution intentions, achieving high-accuracy identification of PCDN terminals and corresponding P2P uplink flows. This significantly enhances generalization and adaptability while substantially reducing system processing overhead. In addition, since uplink bandwidth limiting is only applied to confirmed P2P uplink flows, it ensures that the bandwidth of other normal terminal services is not affected, achieving minimally intrusive traffic control. This solves the problems of low identification accuracy, poor generalization ability, high processing overhead, and single control methods that easily interfere with normal services in existing PCDN terminal identification and control methods.

[0188] It is understood that the various method embodiments mentioned above in this disclosure can be combined with each other to form combined embodiments without violating the principle and logic. Due to space limitations, this disclosure will not elaborate further. Those skilled in the art will understand that in the above methods of specific implementation, the specific execution order of each step should be determined by its function and possible internal logic.

[0189] Figure 4 This is a block diagram of a PCDN terminal identification and control device provided in an embodiment of the present disclosure.

[0190] Reference Figure 4 This disclosure provides a PCDN terminal identification and control device for executing the aforementioned PCDN terminal identification and control method. The device includes:

[0191] The feature vector construction module 11 is used to obtain multi-dimensional behavioral features based on the communication behavior data of the target terminal, and construct a multi-dimensional behavioral feature vector based on the multi-dimensional behavioral features. The multi-dimensional behavioral features include at least three of the following: uplink data packet byte size and downlink data packet byte size, number and direction distribution of session connections, duration of each connection, Internet Protocol IP type and distribution of uplink connection targets, and trend of connection activity over time.

[0192] The suspicious terminal identification module 12 is connected to the feature vector construction module 11 and is used to input the multi-dimensional behavioral feature vector into a pre-trained classification model to obtain the identification result of whether the target terminal is a suspicious terminal. The suspicious terminal refers to a terminal with potential PCDN content distribution intention.

[0193] The communication flow analysis module 13 is connected to the suspicious terminal identification module 12. In response to the identification result that the target terminal is a suspicious terminal, it analyzes each communication flow of the target terminal in the global flow table one by one to determine whether each communication flow is a peer-to-peer P2P uplink flow with the intention of content distribution.

[0194] The uplink bandwidth limiting module 14 is connected to the communication flow analysis module 13 and is used to implement bandwidth limiting measures on the uplink direction of the communication flow for P2P uplink flows with content distribution intentions.

[0195] Optionally, the device further includes:

[0196] The communication flow status and behavior recording module is used to track the status and manage the behavior of all communication flows passing through network devices, and records the terminal identifier and communication behavior data corresponding to each communication flow in the global flow table;

[0197] Each communication flow in the global flow table is uniquely identified by a Virtual Network Identifier (VNI), QinQ double-layer tag encapsulation technology, and a 5-tuple. The recorded communication behavior data includes flow direction, total uplink cumulative transmitted bytes, total downlink cumulative transmitted bytes, flow creation time, and flow update time.

[0198] Optionally, the feature vector construction module 11 includes at least three of the following:

[0199] The first row is a feature acquisition unit, used to accumulate the total uplink and downlink cumulative transmission bytes of all communication flows corresponding to the target terminal in the global flow table, respectively, to obtain the uplink data packet byte size and the downlink data packet byte size;

[0200] The second behavior feature acquisition unit is used to count the number of all communication flows corresponding to the target terminal in the global flow table and use it as the number of session connections, and to obtain the corresponding directional distribution based on the number of communication flows corresponding to different flow directions.

[0201] The third feature acquisition unit is used to obtain the duration of each connection by calculating the difference between the flow creation time and the update time of each communication flow corresponding to the target terminal in the global flow table;

[0202] The fourth behavior feature acquisition unit is used to obtain the IP type of the uplink connection target corresponding to each communication flow based on the network attribute of the uplink connection target IP of each communication flow corresponding to the target terminal, and obtain the corresponding distribution based on the proportion of communication flows of different IP types;

[0203] The fifth row is a feature acquisition unit, which is used to calculate the new increment of the total number of uplink cumulative transmitted bytes in each time window based on all communication flows corresponding to the target terminal in the global flow table, with a preset time window as the unit, to form a traffic activity time series, and / or count the number of newly established flows in each time window to form a new connection rate time series, and obtain the trend of connection activity over time based on the time series.

[0204] Optionally, the communication flow analysis module 13 includes:

[0205] The communication flow judgment unit is used to make the following judgments for each communication flow of the target terminal in the global flow table: judging whether the total number of uplink cumulative transmitted bytes of the communication flow exceeds a preset total threshold, judging whether the communication flow has significant uplink tilt characteristics, and judging whether the communication flow exhibits point-to-point transmission behavior characteristics.

[0206] The identification unit is used to identify communication flows in the global flow table that have an uplink cumulative transmission byte total exceeding a preset total threshold, exhibit significant uplink skew characteristics, and show point-to-point transmission behavior characteristics as P2P uplink flows with content distribution intent.

[0207] Optionally, the communication flow determination unit includes:

[0208] The uplink tilt ratio calculation unit is used to calculate the ratio of the total number of uplink cumulative transmitted bytes to the total number of downlink cumulative transmitted bytes corresponding to the communication flow in the global flow table, so as to obtain the uplink tilt ratio;

[0209] An uplink tilt ratio comparison unit is used to determine that the communication stream has a significant uplink tilt feature if the uplink tilt ratio is greater than a preset tilt ratio threshold.

[0210] The point-to-point feature determination unit is used to determine whether the communication flow exhibits point-to-point transmission behavior characteristics based on the application layer characteristics of the communication flow, wherein the application layer characteristics include destination port, transmission protocol, and target address attribute.

[0211] Optionally, the uplink bandwidth limiting module 14 is specifically used for:

[0212] For P2P uplink streams with content distribution intent, a token bucket algorithm is used to allocate an independent token bucket to the communication stream and continuously add tokens to the token bucket at a preset uplink rate. When the communication stream sends uplink data packets, it needs to consume tokens from the token bucket that match the size of the data packets. If there are not enough tokens, the uplink data packets are discarded or the transmission is delayed, thereby achieving bandwidth limitation on the uplink direction of the communication stream.

[0213] Optionally, the device further includes:

[0214] The evaluation trigger judgment module is used to trigger the de-evaluation process for the communication flow after the implementation of bandwidth limiting measures when the limitation continues for a preset time period or the traffic activity decreases; wherein, the decrease in traffic activity means that the difference between the flow update time of the communication flow in the global flow table and the current time is greater than a preset time threshold.

[0215] The release evaluation module is used to determine whether the communication flow meets the preset bandwidth restriction release conditions according to the triggered release evaluation process. If the preset bandwidth restriction release conditions are met, the bandwidth restriction on the uplink direction of the communication flow is released.

[0216] Figure 5 This is a block diagram of an electronic device provided in an embodiment of the present disclosure.

[0217] Reference Figure 5 This disclosure provides an electronic device, which includes: at least one processor 701; at least one memory 702; and one or more I / O interfaces 703 connected between the processor 701 and the memory 702; wherein the memory 702 stores one or more computer programs that can be executed by the at least one processor 701, and the one or more computer programs are executed by the at least one processor 701 to enable the at least one processor 701 to perform the above-described PCDN terminal identification and control method.

[0218] This disclosure also provides a computer-readable storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, implements the aforementioned PCDN terminal identification and control method. The computer-readable storage medium may be volatile or non-volatile.

[0219] In summary, the PCDN terminal identification and control method, apparatus, device, and medium provided in this disclosure extract at least three multi-dimensional communication behavior features, such as uplink and downlink data packet byte size, session connection number and direction distribution, duration of each connection, and IP type and distribution of uplink connection targets, and construct feature vectors. These features are then combined with a classification model to identify suspicious terminals with potential PCDN content distribution intentions. Furthermore, stream-by-stream analysis and verification accurately locate P2P uplink flows with content distribution intentions, achieving high-accuracy identification of PCDN terminals and corresponding P2P uplink flows. This significantly enhances generalization and adaptability while substantially reducing system processing overhead. Moreover, since uplink bandwidth limiting is only applied to confirmed P2P uplink flows, it ensures that the bandwidth of other normal terminal services remains unaffected, achieving minimally intrusive traffic control. This solves the problems of low identification accuracy, poor generalization ability, high processing overhead, and single control methods that easily interfere with normal services in existing PCDN terminal identification and control methods.

[0220] Those skilled in the art will understand that all or some of the steps, systems, and apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software can be distributed on a computer-readable storage medium, which may include computer storage media (or non-transitory media) and communication media (or transient media).

[0221] As is known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable program instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), static random access memory (SRAM), flash memory or other memory technologies, portable compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, it is known to those skilled in the art that communication media typically contain computer-readable program instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0222] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0223] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0224] This disclosure has disclosed exemplary embodiments, and although specific terminology has been used, it is for general illustrative purposes only and should not be construed as limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in conjunction with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in conjunction with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of this disclosure as set forth by the appended claims.

Claims

1. A method of identification and control of a peer-to-peer content distribution network, PCDN, terminal, characterized in that, The method comprises: Based on the communication behavior data of the target terminal, a multi-dimensional behavior feature is obtained, and a multi-dimensional behavior feature vector is constructed based on the multi-dimensional behavior feature, wherein the multi-dimensional behavior feature comprises at least three of the following: uplink data packet byte amount and downlink data packet byte amount, session connection number and direction distribution, duration of each connection, IP type and distribution of uplink connection target of each communication flow, and change trend of connection activity over time; The multi-dimensional behavior feature vector is input into a pre-trained classification model to obtain an identification result of whether the target terminal is a suspicious terminal, wherein the suspicious terminal refers to a terminal with potential PCDN content distribution intention; In response to the identification result being that the target terminal is a suspicious terminal, each communication flow of the target terminal in the global flow table is analyzed to determine whether each communication flow is a P2P uplink flow with content distribution intention. For the P2P uplink flow with content distribution intention, bandwidth limiting measures are implemented in the uplink direction of the communication flow.

2. The method of claim 1, wherein, Before the multi-dimensional behavior feature is obtained based on the communication behavior data of the target terminal, the method further comprises: Tracking and managing the state of all communication flows passing through the network device, and recording the terminal identifier and communication behavior data corresponding to each communication flow in the global flow table; Each communication flow in the global flow table is uniquely identified by a virtual network identifier (VNI), a double-layer label encapsulation technology (QinQ), and a five-tuple, and the recorded communication behavior data includes flow direction, uplink cumulative transmission byte total amount, downlink cumulative transmission byte total amount, flow creation time, and flow update time.

3. The method of claim 2, wherein, The multi-dimensional behavior feature obtained based on the communication behavior data of the target terminal specifically comprises at least three of the following: The uplink cumulative transmission byte total amount and the downlink cumulative transmission byte total amount of all communication flows corresponding to the target terminal in the global flow table are respectively accumulated to obtain the uplink data packet byte amount and the downlink data packet byte amount; The number of all communication flows corresponding to the target terminal in the global flow table is counted as the session connection number, and the corresponding direction distribution is obtained according to the number of communication flows corresponding to different flow directions; The duration of each connection is obtained by calculating the difference between the flow creation time and the update time of each communication flow corresponding to the target terminal in the global flow table; The IP type of the uplink connection target of each communication flow corresponding to the target terminal is obtained according to the network attribute to which the uplink connection target IP belongs, and the corresponding distribution is obtained according to the proportion of the number of communication flows of different IP types; Based on all communication flows corresponding to the target terminal in the global flow table, the increase in uplink cumulative transmission byte total amount in each time window is calculated based on a preset time window to form a traffic activity time series, and / or the number of newly created flows in each time window is counted to form a newly created connection rate time series, and the change trend of connection activity over time is obtained based on the time series.

4. The method of claim 2, wherein, The analyzing each communication flow of the target terminal in the global flow table in a piece-by-piece manner to determine whether each communication flow is a P2P uplink flow with content distribution intention specifically includes: For each communication flow of the target terminal in the global flow table, the following determinations are made: whether the total amount of uplink cumulative transmission bytes of the communication flow exceeds a preset total amount threshold, whether the communication flow has a significant uplink tilt feature, and whether the communication flow exhibits a point-to-point transmission behavior feature; The communication flow in the global flow table that has a total amount of uplink cumulative transmission bytes exceeding a preset total amount threshold, has a significant uplink tilt feature, and exhibits a point-to-point transmission behavior feature is identified as a P2P uplink flow with content distribution intention.

5. The method of claim 4, wherein, The determining whether the communication flow has a significant uplink tilt feature specifically includes: A ratio of the total amount of uplink cumulative transmission bytes to the total amount of downlink cumulative transmission bytes corresponding to the communication flow in the global flow table is calculated to obtain an uplink tilt ratio; If the uplink tilt ratio is greater than a preset tilt ratio threshold, it is determined that the communication flow has a significant uplink tilt feature. The determining whether the communication flow exhibits a point-to-point transmission behavior feature specifically includes: Whether the communication flow exhibits a point-to-point transmission behavior feature is determined according to an application layer feature of the communication flow, wherein the application layer feature includes a destination port, a transmission protocol, and a target address attribute.

6. The method of claim 1, wherein, The implementing bandwidth limiting measures on the uplink direction of the communication flow specifically includes: A token bucket algorithm is used to allocate an independent token bucket for the communication flow, and tokens are continuously added to the token bucket at a preset uplink rate. When the communication flow sends an uplink data packet, tokens matching the size of the data packet need to be consumed from the token bucket. If the tokens are insufficient, the uplink data packet is discarded or delayed, thereby achieving bandwidth limitation on the uplink direction of the communication flow.

7. The method of claim 2, wherein, After the bandwidth limiting measures are implemented on the uplink direction of the communication flow, the method further includes: For the communication flow after the bandwidth limiting measures are implemented, when the limitation lasts for a preset time period or the traffic activity decreases, an evaluation release process is triggered; wherein the traffic activity decrease means that the difference between the flow update time of the communication flow in the global flow table and the current time is greater than a preset time threshold; According to the triggered evaluation release process, it is determined whether the communication flow satisfies a preset bandwidth limitation release condition. If the preset bandwidth limitation release condition is satisfied, the bandwidth limitation on the uplink direction of the communication flow is released.

8. A device for identifying and controlling a PCDN (Peer-to-Peer Content Delivery Network) terminal, characterized in that, The device includes: A feature vector construction module configured to obtain multi-dimensional behavior features based on communication behavior data of a target terminal, and construct a multi-dimensional behavior feature vector based on the multi-dimensional behavior features, wherein the multi-dimensional behavior features include at least three of the following: uplink data packet byte amount and downlink data packet byte amount, session connection number and direction distribution, duration of each connection, Internet Protocol (IP) type and distribution of uplink connection targets, and connection activity trend over time. A suspicious terminal identification module, connected with the feature vector construction module, configured to input the multi-dimensional behavior feature vector into a pre-trained classification model to obtain an identification result of whether the target terminal is a suspicious terminal, wherein the suspicious terminal refers to a terminal with a potential PCDN content distribution intention; A communication flow analysis module, connected with the suspicious terminal identification module, configured to, in response to the identification result being that the target terminal is a suspicious terminal, analyze each communication flow of the target terminal in a global flow table in a piece-by-piece manner to determine whether each communication flow is a point-to-point P2P uplink flow with a content distribution intention; An uplink bandwidth limitation module, connected with the communication flow analysis module, configured to implement a bandwidth limitation measure on an uplink direction of the communication flow for the P2P uplink flow with the content distribution intention.

9. An electronic device, comprising: The electronic device comprises: at least one processor; and a memory connected with the at least one processor in communication; wherein the memory stores one or more computer programs executable by the at least one processor, and the one or more computer programs are executed by the at least one processor to enable the at least one processor to perform the identification and control method of the P2P content distribution network PCDN terminal according to any one of claims 1-7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by the processor, implements the identification and control method of the P2P content distribution network PCDN terminal according to any one of claims 1-7.

Images