PCDN traffic identification method and device, equipment, storage medium and program product
By using flow embedding models and cluster analysis, combined with cross-regional references and dynamic parameter adjustments, the problems of high misjudgment rate and poor adaptability of traditional PCDN traffic identification methods are solved, achieving efficient and accurate PCDN traffic identification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-17
- Publication Date
- 2026-03-13
AI Technical Summary
Traditional PCDN traffic identification methods cannot accurately distinguish PCDN traffic from other high uplink bandwidth traffic behaviors, resulting in a high false positive rate. Furthermore, they are difficult to adapt to rapid changes in traffic characteristics and encrypted traffic, leading to low identification accuracy.
A pre-trained flow embedding model is used to perform feature dimensionality reduction on the time series data flow of network objects. PCDN traffic is identified through cluster analysis. The model parameters are dynamically adjusted to improve the identification accuracy by combining group behavior differences and cross-regional references.
It improves the accuracy and efficiency of PCDN traffic identification, is suitable for real-time traffic management in large-scale operator network environments, reduces the false judgment rate, and adapts to rapid changes in traffic characteristics.
Smart Images
Figure CN121664754A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network traffic analysis technology, and in particular to a PCDN traffic identification method, apparatus, device, storage medium, and program product. Background Technology
[0002] With the rapid growth of network traffic, Content Delivery Networks (CDNs) play a crucial role in improving user experience and reducing network congestion. To further improve content delivery efficiency and reduce costs, Peer-to-Peer (P2P) CDN technology has been widely adopted. PCDN significantly reduces costs for CDN service providers by utilizing the idle bandwidth of user devices as content delivery nodes. However, some users have been misusing PCDN services, impacting the normal operations of telecommunications operators.
[0003] Traditional PCDN traffic identification methods mainly rely on comparing and analyzing a user's bandwidth traffic performance with the high uplink traffic performance of PCDN services. They lack analysis of control signaling and cannot accurately distinguish PCDN traffic from other high uplink bandwidth traffic behaviors (such as watching live streams and cloud backups). Therefore, they suffer from a high false positive rate. Summary of the Invention
[0004] Therefore, it is necessary to provide a PCDN traffic identification method, device, computer equipment, computer-readable storage medium, and computer program product to address the above-mentioned technical problems and improve the accuracy of PCDN traffic identification.
[0005] Firstly, this application provides a PCDN traffic identification method, including:
[0006] If the uplink traffic of any network object in a preset area exceeds a preset traffic threshold and continues for a preset duration, the original packet data of multiple network objects in the preset area cached within a preset time period is obtained.
[0007] For each network object, the original message data of the corresponding network object is aggregated into multiple data stream time series according to the network flow parameters; a pre-trained flow embedding model is used to perform feature dimensionality reduction processing on the multiple data stream time series of the corresponding network object to obtain multiple low-dimensional feature vectors of the corresponding network object.
[0008] Clustering is performed on multiple low-dimensional feature vectors of multiple network objects in a preset area, and the network objects with PCDN traffic in the preset area are determined based on the clustering results.
[0009] In one embodiment, determining network objects with PCDN traffic in a preset area based on clustering results includes:
[0010] If the clustering results indicate that any low-dimensional feature vector is located at the edge of a cluster or is a noise point, the reconstruction error is determined based on the low-dimensional feature vector and the corresponding data stream time series.
[0011] If the reconstruction error is less than the reconstruction error threshold, the network object corresponding to the low-dimensional feature vector is determined to be the network object with PCDN traffic.
[0012] In one embodiment, a pre-trained stream embedding model is used to perform feature dimensionality reduction on multiple data stream time series of the corresponding network object, respectively, to obtain multiple low-dimensional feature vectors of the corresponding network object, including:
[0013] Extract the multi-dimensional features of each of the multiple data stream time series to obtain the multi-dimensional feature matrix of each of the multiple data stream time series;
[0014] A pre-trained stream embedding model is used to perform feature dimensionality reduction on the multi-dimensional feature matrices of multiple data stream time series respectively, resulting in multiple low-dimensional feature vectors of the corresponding network objects.
[0015] In one embodiment, a pre-trained stream embedding model is used to perform feature dimensionality reduction on the multi-dimensional feature matrices of multiple data stream time series respectively, to obtain multiple low-dimensional feature vectors of the corresponding network object, including:
[0016] The encoder of the pre-trained stream embedding model performs dimensionality reduction on each multi-dimensional feature matrix of the corresponding network object to obtain the dimensionality-reduced feature vector.
[0017] The decoder of the pre-trained stream embedding model performs feature restoration processing on each dimensionality-reduced feature vector of the corresponding network object to obtain multiple low-dimensional feature vectors of the corresponding network object.
[0018] In one embodiment, the PCDN traffic identification method further includes:
[0019] If PCDN traffic exists on any target network object in a preset area, determine at least one reference network object that also has PCDN traffic in other areas;
[0020] The group PCDN traffic identification result is determined based on the total number, distribution density, and average distance of feature vectors of at least one reference network object.
[0021] In one embodiment, the PCDN traffic identification method further includes:
[0022] Obtain PCDN traffic and normal traffic samples of network objects at different time periods;
[0023] Positive sample pairs are constructed based on PCDN traffic within different time periods, and negative sample pairs are constructed based on the PCDN traffic and the normal traffic.
[0024] Based on the positive sample pairs and the negative sample pairs, the parameters of the stream embedding model are adjusted to obtain the adjusted stream embedding model.
[0025] Secondly, this application also provides a PCDN traffic identification device, comprising:
[0026] The acquisition module is used to acquire the original packet data of multiple network objects in the preset area that have been cached within a preset time period when the uplink traffic of any network object in the preset area exceeds the preset traffic threshold and continues for a preset duration.
[0027] The processing module is used to aggregate the original message data of each network object into multiple data stream time series based on the network flow parameters; and to perform feature dimensionality reduction processing on the multiple data stream time series of the corresponding network object using a pre-trained flow embedding model to obtain multiple low-dimensional feature vectors of the corresponding network object.
[0028] The determination module is used to perform clustering processing on multiple low-dimensional feature vectors of multiple network objects in a preset area, and determine the network objects in the preset area that have PCDN traffic based on the clustering results.
[0029] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:
[0030] If the uplink traffic of any network object in a preset area exceeds a preset traffic threshold and continues for a preset duration, the original packet data of multiple network objects in the preset area cached within a preset time period is obtained.
[0031] For each network object, the original message data of the corresponding network object is aggregated into multiple data stream time series according to the network flow parameters; a pre-trained flow embedding model is used to perform feature dimensionality reduction processing on the multiple data stream time series of the corresponding network object to obtain multiple low-dimensional feature vectors of the corresponding network object.
[0032] Clustering is performed on multiple low-dimensional feature vectors of multiple network objects in a preset area, and the network objects with PCDN traffic in the preset area are determined based on the clustering results.
[0033] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:
[0034] If the uplink traffic of any network object in a preset area exceeds a preset traffic threshold and continues for a preset duration, the original packet data of multiple network objects in the preset area cached within a preset time period is obtained.
[0035] For each network object, the original message data of the corresponding network object is aggregated into multiple data stream time series according to the network flow parameters; a pre-trained flow embedding model is used to perform feature dimensionality reduction processing on the multiple data stream time series of the corresponding network object to obtain multiple low-dimensional feature vectors of the corresponding network object.
[0036] Clustering is performed on multiple low-dimensional feature vectors of multiple network objects in a preset area, and the network objects with PCDN traffic in the preset area are determined based on the clustering results.
[0037] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:
[0038] If the uplink traffic of any network object in a preset area exceeds a preset traffic threshold and continues for a preset duration, the original packet data of multiple network objects in the preset area cached within a preset time period is obtained.
[0039] For each network object, the original message data of the corresponding network object is aggregated into multiple data stream time series according to the network flow parameters; a pre-trained flow embedding model is used to perform feature dimensionality reduction processing on the multiple data stream time series of the corresponding network object to obtain multiple low-dimensional feature vectors of the corresponding network object.
[0040] Clustering is performed on multiple low-dimensional feature vectors of multiple network objects in a preset area, and the network objects with PCDN traffic in the preset area are determined based on the clustering results.
[0041] The aforementioned PCDN traffic identification method, apparatus, computer equipment, computer-readable storage medium, and computer program product identify PCDN traffic based on the original packet data of multiple network objects in the preset area cached within a preset time period when the uplink traffic of any network object in the preset area exceeds a preset traffic threshold and continues for a preset duration. Since the preset time period contains many key features for identifying PCDN traffic, this improves the accuracy of PCDN traffic identification. Furthermore, by performing feature dimensionality reduction on multiple data stream time series using a pre-trained flow embedding model, key temporal patterns in traffic behavior can be effectively extracted, providing support for accurate PCDN traffic identification. By clustering multiple low-dimensional feature vectors of multiple network objects in the preset area, PCDN traffic can be located through differences in group behavior, improving identification accuracy and efficiency. This method is suitable for real-time traffic management in large-scale operator network environments. Attached Figure Description
[0042] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0043] Figure 1 This is a diagram illustrating the application environment of the PCDN traffic identification method in one embodiment.
[0044] Figure 2 This is a flowchart illustrating a PCDN traffic identification method in one embodiment;
[0045] Figure 3 This is a schematic diagram of the overall process of the PCDN traffic identification method in one embodiment;
[0046] Figure 4 This is a structural block diagram of a PCDN flow identification device in one embodiment;
[0047] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation
[0048] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.
[0049] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.
[0050] With the rapid growth of network traffic, Content Delivery Networks (CDNs) play a crucial role in improving user experience and reducing network congestion. To further improve content delivery efficiency and reduce costs, P2P CDN technology has been widely adopted. PCDN significantly reduces the costs for CDN service providers by utilizing the idle bandwidth of user devices as content delivery nodes. However, some users are misusing PCDN services, impacting the normal operations of telecommunications operators.
[0051] Traditional PCDN traffic identification methods face the following problems:
[0052] 1. The method of comparing and analyzing the user's bandwidth traffic performance with the traffic performance of PCDN service lacks the analysis of control signaling and cannot accurately distinguish PCDN traffic from other high uplink bandwidth traffic behaviors (such as watching live broadcasts, cloud backups, etc.). Therefore, there is a problem of high misjudgment rate.
[0053] 2. Although the DPI deep packet inspection technology of operators can identify some PCDN traffic, the accuracy of identification drops significantly when facing encrypted traffic or PCDN services with dynamic port switching, and it is easy for PCDN service providers to circumvent it through technical means.
[0054] 3. Traditional methods mostly rely on static rules or supervised learning models, which cannot adapt to the rapid changes in PCDN traffic characteristics and require frequent manual intervention and rule updates.
[0055] 4. Traditional methods lack effective model iteration mechanisms and feature library update strategies after identifying PCDN traffic, making it difficult to continuously improve identification accuracy.
[0056] Based on this, this application proposes a PCDN traffic identification method, which can be applied to, for example... Figure 1In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated on server 104 or placed on the cloud or other network servers. This embodiment uses the method applied to a server as an example; it is understood that this method can also be applied to terminals, and can also be applied to systems including terminals and servers, and implemented through the interaction between the terminal and the server. When server 104 detects that the uplink traffic of any network object in a preset area exceeds a preset traffic threshold and continues for a preset duration, it acquires the original packet data of multiple network objects cached within a preset time period. For each network object, based on network flow parameters, the original packet data of the corresponding network object is aggregated into multiple data flow time series. A pre-trained flow embedding model is used to perform feature dimensionality reduction processing on the multiple data flow time series of the corresponding network object, obtaining multiple low-dimensional feature vectors of the corresponding network object. Clustering processing is performed on the multiple low-dimensional feature vectors of each of the multiple network objects in the preset area, and the network objects with PCDN traffic in the preset area are determined based on the clustering results. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, and projection equipment. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted displays. Head-mounted displays can be virtual reality (VR) devices, augmented reality (AR) devices, and smart glasses. Server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.
[0057] In one exemplary embodiment, such as Figure 2 As shown, a PCDN traffic identification method is provided, which can be applied to... Figure 1 Taking server 104 as an example, the explanation includes the following steps 202 to 206. Wherein:
[0058] Step 202: If the uplink traffic of any network object in the preset area exceeds the preset traffic threshold and continues for a preset duration, the original packet data of multiple network objects in the preset area cached within the preset time period is obtained.
[0059] The preset area refers to a specific network range that is designated in advance for centralized monitoring of network traffic, and can be divided according to physical location or network level according to actual needs.
[0060] A network object refers to a terminal device or network node that generates network traffic within a preset area; it is the basic unit for traffic detection. For example, a network object can be a broadband network user. A preset area may include at least one network object, and each network object may include at least one terminal device.
[0061] Uplink traffic refers to the traffic from a network object to the Internet (or its upstream network). Uplink traffic exceeding a preset threshold for a preset duration indicates a sudden surge in uplink traffic from the current network object within a short period. For example, the preset duration could be 5 seconds.
[0062] The preset time period refers to a preset time period prior to the current time, for example, 30 seconds prior to the current time. Raw packet data refers to the unprocessed data packets actually transmitted in the network, containing complete network communication information and serving as the raw material for subsequent traffic analysis. In some embodiments, network devices within the preset area need to be connected to at least one cache service device. This cache service device runs continuously and is responsible for caching all raw packet data and part of the payload of network objects (such as broadband users) within a specified range. When the uplink traffic of any network object exceeds a preset traffic threshold, the previous raw packet data is retrieved.
[0063] Step 204: For each network object, the original message data of the corresponding network object is aggregated into multiple data stream time series according to the network flow parameters; a pre-trained flow embedding model is used to perform feature dimensionality reduction processing on the multiple data stream time series of the corresponding network object to obtain multiple low-dimensional feature vectors of the corresponding network object.
[0064] In cases of sudden surges in upstream traffic, the traffic may be PCDN traffic, or it may be other high-upstream-bandwidth traffic activities such as watching live streams or cloud backups. This application proposes processing the raw packet data of multiple network objects cached within a preset time period in a preset area to accurately identify PCDN traffic.
[0065] Network flow parameters are core parameters that uniquely identify a complete network communication link, primarily used to distinguish communication traffic from different devices and applications. For example, a network flow parameter can be a network flow quintuple, including source IP, destination IP, source port, destination port, and transport layer protocol. The raw packet data of each network object is aggregated according to the network flow parameters, resulting in multiple data flows. A time series is constructed for each data flow, yielding multiple data flow time series. In some embodiments, these multiple data flows can be data flows from multiple terminal devices under the same broadband user, or multiple network data flows within the same terminal device.
[0066] A stream embedding model refers to a neural network model that has been pre-trained using time series data streams of a large amount of PCDN traffic and normal traffic. For example, a stream embedding model can be an embedding model based on LSTM (Long Short-Term Memory Neural Network).
[0067] Feature dimensionality reduction refers to using a stream embedding model to compress high-dimensional data stream time series into features with lower dimensionality. The purpose is to remove redundant information, retain core distinguishing features, and effectively extract key time series patterns in traffic behavior.
[0068] Low-dimensional feature vectors refer to feature vectors with lower dimensions obtained after feature dimensionality reduction. Each low-dimensional feature vector corresponds to a data stream time series, and each dimension in the low-dimensional feature vector represents a core feature of the data stream.
[0069] In some embodiments, the original packet data of the corresponding network object is aggregated into multiple data stream time series according to network flow parameters. This includes: performing preliminary screening on the original packet data of each network object to obtain pre-screened data, and aggregating the original packet data of the corresponding network object into multiple data stream time series according to network flow parameters. The preliminary screening is used to perform initial filtering operations on the received original packets to reduce the overhead of invalid data processing. The preliminary screening includes filtering protocol packets used to establish peer-to-peer connections, excluding known legitimate application traffic (such as video-on-demand and cloud storage services), and removing traffic behaviors with typical non-PCDN patterns. Specifically, protocol packets used to establish P2P peer-to-peer connections (such as DHT and BitTorrent handshake packets) are identified and filtered; based on a pre-set application traffic feature library, legitimate high-bandwidth application traffic such as mainstream video-on-demand and cloud disk synchronization is excluded; and traffic segments that clearly do not conform to PCDN behavior characteristics are removed based on known non-PCDN traffic patterns (such as short connection bursts and periodic heartbeat packets). After the preliminary screening, only suspected abnormal traffic data, i.e., the pre-screened data, is retained and enters the next stage of processing.
[0070] Step 206: Perform clustering on the multiple low-dimensional feature vectors of multiple network objects in the preset area, and determine the network objects in the preset area that have PCDN traffic based on the clustering results.
[0071] Clustering refers to the process of grouping the low-dimensional feature vectors of all network objects within a predefined region using clustering algorithms. Vectors with more similar features are grouped into the same cluster. For example, clustering algorithms include the DBSCAN algorithm.
[0072] Clustering results refer to the cluster partitioning results output after clustering processing. In some embodiments, the network objects corresponding to the low-dimensional feature vectors that are located at the cluster edges or marked as noise points may be network objects with PCDN traffic.
[0073] In the aforementioned PCDN traffic identification method, when the uplink traffic of any network object in a preset area exceeds a preset traffic threshold and continues for a preset duration, PCDN traffic identification is performed based on the original packet data of multiple network objects in the preset area cached within a preset time period. Since there are many key features for identifying PCDN traffic within the preset time period, it is beneficial to improve the accuracy of PCDN traffic identification. By performing feature dimensionality reduction processing on multiple data stream time series through a pre-trained flow embedding model, key temporal patterns in traffic behavior can be effectively extracted, providing support for accurate PCDN traffic identification. Clustering processing is performed on multiple low-dimensional feature vectors of multiple network objects in the preset area, and PCDN traffic is located through group behavior differences, improving identification accuracy and efficiency, and making it suitable for real-time traffic management in large-scale operator network environments.
[0074] In an exemplary embodiment, determining network objects with PCDN traffic in a preset area based on clustering results includes: if the clustering results indicate that any low-dimensional feature vector is located at the edge of a cluster or is a noise point, determining a reconstruction error based on the low-dimensional feature vector and the corresponding data stream time series; if the reconstruction error is less than a reconstruction error threshold, determining the network object corresponding to the low-dimensional feature vector as a network object with PCDN traffic.
[0075] In this context, cluster edges refer to low-dimensional feature vectors in the clustering results that are not located in the core region of a cluster but are near the cluster boundary. Noise points refer to isolated low-dimensional feature vectors in the clustering results that cannot be assigned to any cluster. Reconstruction error refers to the difference between the low-dimensional feature vector and the corresponding data stream time series. A reconstruction error less than the reconstruction error threshold indicates that the features learned by the pre-trained flow embedding model are closer to the input data stream time series, and the accuracy of identifying PCDN traffic based on this low-dimensional feature vector is higher.
[0076] If the clustering results indicate that any low-dimensional feature vector is located at the cluster edge or is a noise point, and the reconstruction error is less than the reconstruction error threshold, the network object corresponding to the low-dimensional feature vector is determined to be a network object with PCDN traffic.
[0077] In this embodiment, the clustering results can identify low-dimensional feature vectors that are at the edge of the cluster or isolated noise, and the reconstruction error can be used to further accurately identify PCDN traffic.
[0078] In an exemplary embodiment, a pre-trained stream embedding model is used to perform feature dimensionality reduction processing on multiple data stream time series of the corresponding network object to obtain multiple low-dimensional feature vectors of the corresponding network object. This includes: extracting multi-dimensional features of each of the multiple data stream time series to obtain multi-dimensional feature matrices of each of the multiple data stream time series; and using a pre-trained stream embedding model to perform feature dimensionality reduction processing on the multi-dimensional feature matrices of each of the multiple data stream time series to obtain multiple low-dimensional feature vectors of the corresponding network object.
[0079] Among them, multi-dimensional features refer to multiple quantitative indicators extracted from a single data stream time series that can reflect the core attributes of the data stream. For example, multi-dimensional features include packet size, packet arrival timestamp, transmission interval between adjacent packets, and statistical features that reflect the burstiness, stability and periodicity of traffic.
[0080] A multidimensional feature matrix refers to a feature matrix composed of the multidimensional features of each data stream time series. The multidimensional feature matrix provides standardized input for subsequent model processing.
[0081] The multi-dimensional feature matrix of each data stream time series is input into the pre-trained stream embedding model to obtain the low-dimensional feature vector of the corresponding data stream time series.
[0082] In this embodiment, by extracting the multi-dimensional features of each of the multiple data stream time series, a multi-dimensional feature matrix is obtained, which covers multiple dimensions and can more comprehensively reflect the data stream behavior. By performing feature dimensionality reduction processing on the multi-dimensional feature matrix, key time-series patterns in traffic behavior can be effectively extracted, which is beneficial for accurately identifying PCDN traffic.
[0083] In an exemplary embodiment, a pre-trained stream embedding model is used to perform dimensionality reduction on the multi-dimensional feature matrices of multiple data stream time series to obtain multiple low-dimensional feature vectors of the corresponding network object. This includes: using the encoder of the pre-trained stream embedding model to perform dimensionality reduction on each multi-dimensional feature matrix of the corresponding network object to obtain dimensionality-reduced feature vectors; and using the decoder of the pre-trained stream embedding model to perform feature restoration on each dimensionality-reduced feature vector of the corresponding network object to obtain multiple low-dimensional feature vectors of the corresponding network object.
[0084] The stream embedding model includes an encoder and a decoder. The encoder compresses the multi-dimensional feature matrix of the input into a lower-dimensional feature vector while retaining key information that distinguishes different flow types. For example, the encoder uses a three-layer convolutional structure, with each layer using a 3×3 convolutional kernel and a stride of 2, and employs the ReLU activation function to progressively compress the input sequence, ultimately outputting a 16-dimensional feature vector.
[0085] The decoder is used to restore the dimensionality-reduced feature vectors output by the encoder to a reconstructed matrix that approximates the original multi-dimensional feature matrix, i.e., a low-dimensional feature vector. For example, the decoder attempts to reconstruct the original input sequence using a deconvolution structure. In some embodiments, the model training process can calculate the reconstruction error between the restored result (i.e., the low-dimensional feature vectors) and the encoder input (i.e., the multi-dimensional feature matrix). With the goal of minimizing the L1 reconstruction error, the Adam optimizer is used to update the parameters of the streaming embedding model, resulting in an optimized streaming embedding model.
[0086] In this embodiment, the encoder performs dimensionality reduction on the input multi-dimensional feature matrix to accurately identify key patterns in the original feature matrix and avoid the loss of core features. Through the feature restoration process of the decoder, redundant or noisy dimensions in the intermediate vector are weakened, core features are strengthened, key temporal patterns in traffic behavior are effectively extracted, and similar behaviors are mapped to similar positions in the feature space.
[0087] In an exemplary embodiment, the PCDN traffic identification method further includes: when PCDN traffic exists in any target network object in a preset area, identifying at least one reference network object that also has PCDN traffic in other areas; and determining the group PCDN traffic identification result based on the total number, distribution density, and average distance of the feature vectors of the at least one reference network object.
[0088] In order to improve the reliability of PCDN traffic identification, this application proposes to identify group PCDN traffic by referencing the network traffic of cross-regional network objects, so as to reduce the false positive rate.
[0089] The target network object refers to the network object in the preset area that has PCDN traffic, as determined by the method in the embodiments of this application.
[0090] Other areas refer to detection areas other than the preset areas. Reference network objects refer to network objects in other areas identified using the method in this application embodiment that also exhibit PCDN traffic within the same time period.
[0091] The total number refers to the number of at least one reference network object in other regions. Distribution density refers to the density of reference network objects distributed in other regions. The average feature vector distance refers to the average Euclidean distance between the low-dimensional feature vectors of at least one reference network object and the low-dimensional feature vector of the target network object, reflecting the feature similarity between the target and reference network objects.
[0092] In some embodiments, when the total number of at least one reference network object exceeds a preset number, the distribution density exceeds a preset density, and the average distance of the feature vectors is less than a preset distance, it is determined that there is group PCDN traffic.
[0093] In this embodiment, by referencing the network traffic of cross-regional reference network objects, group PCDN traffic is identified. Some legitimate behaviors of individual users are mistakenly identified as PCDN traffic. When the total number of reference network objects is large, the distribution density is high, and the feature similarity is high, it is determined that there is group PCDN traffic. By judging the group, the false judgment rate is reduced, which makes it easier for operators to take targeted control measures.
[0094] In an exemplary embodiment, the PCDN traffic identification method further includes: acquiring PCDN traffic and normal traffic of network object samples in different time periods; constructing positive sample pairs based on PCDN traffic in different time periods, and constructing negative sample pairs based on PCDN traffic and normal traffic; adjusting the parameters of the flow embedding model based on the positive sample pairs and negative sample pairs to obtain the adjusted flow embedding model.
[0095] Positive sample pairs refer to sample pairs constructed from PCDN traffic of the same network object within different time periods. The PCDN traffic in positive sample pairs has certain characteristic similarities.
[0096] Negative sample pairs refer to sample pairs constructed from PCDN traffic and normal traffic. The traffic in negative sample pairs has significant characteristic differences.
[0097] Positive and negative sample pairs are input into the flow embedding model. The loss value is calculated by comparing the loss function. The higher the similarity between the low-dimensional feature vectors corresponding to each flow in the positive sample pair, the smaller the loss, i.e., maximizing the similarity of positive samples; the lower the similarity between the low-dimensional feature vectors corresponding to each flow in the negative sample pair, the smaller the loss. The parameters of the flow embedding model are adjusted inversely using the loss value to obtain the adjusted flow embedding model.
[0098] In this embodiment, the mechanism of comparative learning using positive and negative samples optimizes the feature space distribution by maximizing the similarity of positive samples and minimizing the similarity of negative samples, which helps to improve the model's recognition ability.
[0099] In some embodiments, the PCDN traffic identification method further includes dynamically adjusting the neighborhood radius and reconstruction error threshold of the clustering algorithm based on the changing trends of group behavior. For example, if the number of network objects with PCDN traffic in the target area exceeds a preset value, the neighborhood radius and reconstruction error threshold are reduced. In this way, when PCDN traffic has a significant impact, more PCDN traffic can be identified through the clustering algorithm; simultaneously, by reducing the reconstruction error threshold when PCDN traffic has a significant impact, more PCDN traffic can be filtered out based on the clustering results, improving the detection efficiency and reliability of PCDN traffic.
[0100] To illustrate the PCDN traffic identification method and its effectiveness in this solution in detail, the following is a detailed implementation example:
[0101] This paper illustrates the application of PCDN traffic identification methods in a carrier broadband network environment, specifically in the automated detection and management of abnormal uplink behavior. The system is deployed on the bypass link of a BRAS-U device in a metropolitan area network, combining a high-speed cache server and a real-time computing platform to achieve low-latency, high-precision identification and adaptive model updates for PCDN traffic.
[0102] like Figure 3 The diagram illustrates the overall flow of the PCDN traffic identification method in some embodiments. First, when the BRAS-U device continuously detects that the uplink traffic of any network object exceeds a preset traffic threshold for a preset duration (e.g., exceeding its historical average by 200% for more than 5 seconds), the data acquisition and caching module immediately extracts the original packet data of that network object from a bypass-connected high-speed cache server within the 30 seconds prior to the traffic surge and persistently stores it as the data source for subsequent analysis. This caching mechanism ensures that complete traffic context information is obtained without interrupting services.
[0103] Subsequently, the initial screening module performs initial screening on the received raw message data to reduce the overhead of processing invalid data. Specifically, this includes: identifying and filtering protocol messages used to establish P2P peer-to-peer connections (such as DHT and BitTorrent handshake packets); excluding legitimate high-bandwidth application traffic such as mainstream video-on-demand and cloud storage synchronization based on a pre-built application traffic feature library; and removing traffic segments that clearly do not conform to PCDN behavior characteristics based on known non-PCDN traffic patterns (such as short connection bursts and periodic heartbeat packets). After this step, only suspected abnormal traffic data is retained for the next stage of processing.
[0104] Next, the time-series construction module aggregates the initially screened packets according to network flow parameters, such as network flow quintuples, and constructs a data flow time series for each independent data flow. For each flow, multiple dimensions of time-series features are extracted, including: a sequence of packet sizes arranged in chronological order, a sequence of packet arrival timestamps, a sequence of transmission intervals between adjacent packets, and statistical features (such as mean, variance, kurtosis, etc.) calculated through a sliding window, thereby forming a structured multi-dimensional feature matrix to provide standardized input for subsequent model processing.
[0105] Subsequently, the stream embedding module inputs the aforementioned multi-dimensional feature matrix into a pre-trained stream embedding model, such as a convolutional autoencoder (CAE) model, for non-linear dimensionality reduction. This CAE model consists of an encoder and a decoder: the encoder employs a three-layer convolutional structure, with each layer using a 3×3 convolutional kernel and a stride of 2, coupled with the ReLU activation function, progressively compressing the input sequence to ultimately output a 16-dimensional low-dimensional feature vector; the decoder then attempts to reconstruct the original input sequence using a deconvolutional structure. During model training, the goal is to minimize the L1 reconstruction error, and the Adam optimizer is used for parameter updates. This process effectively extracts key temporal patterns in traffic behavior and maps similar behaviors to similar locations in the feature space.
[0106] After obtaining the low-dimensional feature vectors of multiple network objects in a preset region, the unsupervised classification module performs classification judgment. First, the DBSCAN density clustering algorithm is used to perform cluster analysis on the multiple low-dimensional feature vectors of each network object in the preset region, setting the neighborhood radius ε=0.5 and the minimum number of samples min_samples=5 to identify high-density clustered regions and isolated points. At the same time, the autoencoder reconstruction error of each low-dimensional feature vector is calculated. If the reconstruction error exceeds the reconstruction error threshold, for example, 0.8, it is determined to deviate from the normal pattern. The decision is made by combining the two indicators: if any low-dimensional feature vector is located at the cluster edge or marked as a noise point, and its reconstruction error is less than the reconstruction error threshold, the system determines it as suspected PCDN traffic, identifies the network object corresponding to the low-dimensional feature vector as the network object with PCDN traffic, and outputs the identification result and confidence score.
[0107] To further enhance the reliability of the judgment, after detecting any network object identified as having PCDN traffic, the group feature analysis module automatically searches for reference network objects in other areas within the same time period (e.g., ±5 minutes before and after). The system calculates the average distance, distribution density, and total number of low-dimensional feature vectors of the reference network objects. When preset conditions are met, for example, if the total number of reference network objects exceeds 100 and the average distance of their feature vectors is less than 0.3 compared to the average distance of historical PCDN clusters, then group PCDN traffic is considered to exist, triggering model iteration and feature library update processes.
[0108] Finally, the model management module responds to the aforementioned trigger signal and initiates the model self-evolution mechanism. On one hand, it uses newly identified PCDN traffic samples to fine-tune the CAE model online, employing an incremental learning strategy to update network parameters and avoid catastrophic forgetting. On the other hand, it incorporates confirmed PCDN traffic samples into the local feature library, using a sliding window mechanism to retain only valid data from the most recent preset time (e.g., 30 days) to ensure the freshness of the feature library. Furthermore, the system can dynamically adjust the ε parameter and reconstruction error threshold of DBSCAN based on the changing trends of group behavior, adapting the classification boundary to the evolving characteristics of novel PCDN traffic.
[0109] To further enhance feature representation capabilities, a contrastive learning mechanism is introduced into the stream embedding module. During training, positive sample pairs (PCDN traffic from the same user at different times) and negative sample pairs (PCDN and normal traffic) are constructed. The feature space distribution is optimized by maximizing the similarity of positive samples and minimizing the similarity of negative samples. This approach enhances the model's sensitivity to subtle behavioral differences, making it particularly suitable for identifying highly disguised lightweight PCDN traffic. By integrating high-speed caching, stream feature extraction, deep embedding, unsupervised classification, and group triggering mechanisms, a complete closed-loop system for PCDN traffic identification is constructed, achieving high accuracy and strong adaptability while ensuring real-time performance.
[0110] The aforementioned PCDN traffic identification method identifies PCDN traffic based on the original packet data of multiple network objects in the preset area cached within a preset time period when the uplink traffic of any network object in the preset area exceeds a preset traffic threshold for a preset duration. Since the preset time period contains many key features for identifying PCDN traffic, it helps improve the accuracy of PCDN traffic identification. By performing feature dimensionality reduction processing on multiple data stream time series through a pre-trained flow embedding model, key temporal patterns in traffic behavior can be effectively extracted, providing support for accurate PCDN traffic identification. Clustering multiple low-dimensional feature vectors of multiple network objects in the preset area and locating PCDN traffic through group behavior differences improves identification accuracy and efficiency, making it suitable for real-time traffic management in large-scale operator network environments. Furthermore, through a dual mechanism of individual identification and group verification, the final judgment is triggered only when multiple network objects exhibit consistent abnormal behavior, effectively avoiding misclassification of legitimate high-uplink behaviors such as NAS backup and live streaming as PCDN traffic. The entire process employs an unsupervised learning strategy, eliminating reliance on labeled data and significantly reducing operational costs, making it suitable for large-scale deployment in scenarios with massive user bases. The group feature triggering mechanism drives online model updates, enabling rapid response to the behavioral evolution of new PCDN tools and maintaining long-term identification effectiveness. A single-point centralized processing architecture eliminates the need for complex collaborative mechanisms such as federated learning, ensuring compatibility with traditional BRAS-U and probe systems and facilitating integration. By fusing temporal dynamic features with deep embedding representations, it captures the unique behavioral patterns of PCDN traffic, such as periodic uploads, multi-target connections, and dense small-packet transmission, achieving a higher identification accuracy than traditional rule-based or shallow model methods.
[0111] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.
[0112] Based on the same inventive concept, this application also provides a PCDN traffic identification device for implementing the PCDN traffic identification method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more PCDN traffic identification device embodiments provided below can be found in the limitations of the PCDN traffic identification method described above, and will not be repeated here.
[0113] In one exemplary embodiment, such as Figure 4 As shown, a PCDN traffic identification device 400 is provided, including: an acquisition module 420, a processing module 440, and a determination module 460, wherein:
[0114] The acquisition module 420 is used to acquire the original packet data of multiple network objects in the preset area that are cached within a preset time period when the uplink traffic of any network object in the preset area exceeds the preset traffic threshold and continues for a preset duration.
[0115] The processing module 440 is used to aggregate the original message data of each network object into multiple data stream time series according to the network flow parameters; and to perform feature dimensionality reduction processing on the multiple data stream time series of the corresponding network object using a pre-trained flow embedding model to obtain multiple low-dimensional feature vectors of the corresponding network object.
[0116] The determination module 460 is used to perform clustering processing on multiple low-dimensional feature vectors of multiple network objects in a preset area, and determine the network objects in the preset area that have PCDN traffic based on the clustering results.
[0117] The aforementioned PCDN traffic identification device identifies PCDN traffic based on the original packet data of multiple network objects in the preset area cached within a preset time period when the uplink traffic of any network object in the preset area exceeds a preset traffic threshold for a preset duration. Since the preset time period contains many key features for identifying PCDN traffic, it helps improve the accuracy of PCDN traffic identification. By performing feature dimensionality reduction processing on multiple data stream time series through a pre-trained flow embedding model, key temporal patterns in traffic behavior can be effectively extracted, providing support for accurate PCDN traffic identification. By clustering multiple low-dimensional feature vectors of multiple network objects in the preset area, PCDN traffic can be located through differences in group behavior, improving identification accuracy and efficiency. It is suitable for real-time traffic management in large-scale operator network environments.
[0118] In some embodiments, the network objects with PCDN traffic in the preset area are determined based on the clustering results. The determining module 460 is further configured to: determine the reconstruction error based on the low-dimensional feature vector and the corresponding data stream time series when the clustering results indicate that any low-dimensional feature vector is located at the edge of the cluster or is a noise point; and determine the network object corresponding to the low-dimensional feature vector as a network object with PCDN traffic when the reconstruction error is less than the reconstruction error threshold.
[0119] In some embodiments, a pre-trained stream embedding model is used to perform feature dimensionality reduction processing on multiple data stream time series of the corresponding network object to obtain multiple low-dimensional feature vectors of the corresponding network object. The processing module 440 is further used to: extract the multi-dimensional features of each of the multiple data stream time series to obtain the multi-dimensional feature matrix of each of the multiple data stream time series; and perform feature dimensionality reduction processing on the multi-dimensional feature matrix of each of the multiple data stream time series using a pre-trained stream embedding model to obtain multiple low-dimensional feature vectors of the corresponding network object.
[0120] In some embodiments, a pre-trained stream embedding model is used to perform feature dimensionality reduction processing on the multi-dimensional feature matrices of each of the multiple data stream time series to obtain multiple low-dimensional feature vectors of the corresponding network object. The processing module 440 is further configured to: use the encoder of the pre-trained stream embedding model to perform dimensionality reduction processing on each multi-dimensional feature matrix of the corresponding network object to obtain the dimensionality-reduced feature vector; and use the decoder of the pre-trained stream embedding model to perform feature restoration processing on each dimensionality-reduced feature vector of the corresponding network object to obtain multiple low-dimensional feature vectors of the corresponding network object.
[0121] In some embodiments, the determining module 460 is further configured to: determine at least one reference network object in other areas where PCDN traffic also exists when PCDN traffic exists in any target network object in a preset area; and determine the group PCDN traffic identification result based on the total number, distribution density and average distance of the feature vectors of the at least one reference network object.
[0122] In some embodiments, the processing module 440 is further configured to: acquire PCDN traffic and normal traffic of network object samples in different time periods; construct positive sample pairs based on PCDN traffic in different time periods, and construct negative sample pairs based on PCDN traffic and normal traffic; adjust the parameters of the flow embedding model based on the positive sample pairs and the negative sample pairs to obtain the adjusted flow embedding model.
[0123] Each module in the aforementioned PCDN traffic identification device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.
[0124] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores raw message data, network flow parameters, low-dimensional feature vectors, and clustering results. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When executed by the processor, the computer program implements a PCDN traffic identification method.
[0125] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.
[0126] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.
[0127] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.
[0128] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.
[0129] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.
[0130] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.
[0131] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.
[0132] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.
Claims
1. A PCDN traffic identification method, characterized in that, The method includes: If the uplink traffic of any network object in a preset area exceeds a preset traffic threshold and continues for a preset duration, the original packet data of multiple network objects in the preset area cached within a preset time period is obtained. For each network object, the original message data of the corresponding network object is aggregated into multiple data stream time series according to the network flow parameters; a pre-trained flow embedding model is used to perform feature dimensionality reduction processing on the multiple data stream time series of the corresponding network object to obtain multiple low-dimensional feature vectors of the corresponding network object. Clustering is performed on the multiple low-dimensional feature vectors of multiple network objects in the preset region, and the network objects with PCDN traffic in the preset region are determined based on the clustering results.
2. The method according to claim 1, characterized in that, The step of determining the network objects with PCDN traffic in the preset area based on the clustering results includes: If the clustering results indicate that any low-dimensional feature vector is located at the edge of a cluster or is a noise point, the reconstruction error is determined based on the low-dimensional feature vector and the corresponding data stream time series. If the reconstruction error is less than the reconstruction error threshold, the network object corresponding to the low-dimensional feature vector is determined to be a network object with PCDN traffic.
3. The method according to claim 1, characterized in that, The pre-trained stream embedding model is used to perform feature dimensionality reduction on multiple data stream time series of the corresponding network object, respectively, to obtain multiple low-dimensional feature vectors of the corresponding network object, including: Extract the multi-dimensional features of each of the multiple data stream time series to obtain the multi-dimensional feature matrix of each of the multiple data stream time series; A pre-trained stream embedding model is used to perform feature dimensionality reduction on the multi-dimensional feature matrices of multiple data stream time series respectively, resulting in multiple low-dimensional feature vectors of the corresponding network objects.
4. The method according to claim 3, characterized in that, The pre-trained stream embedding model performs feature dimensionality reduction on the multi-dimensional feature matrices of multiple data stream time series respectively, obtaining multiple low-dimensional feature vectors of the corresponding network objects, including: The encoder of the pre-trained stream embedding model performs dimensionality reduction on each multi-dimensional feature matrix of the corresponding network object to obtain the dimensionality-reduced feature vector. The decoder of the pre-trained stream embedding model performs feature restoration processing on each dimensionality-reduced feature vector of the corresponding network object to obtain multiple low-dimensional feature vectors of the corresponding network object.
5. The method according to claim 1, characterized in that, The method further includes: If PCDN traffic exists for any target network object in the preset area, determine at least one reference network object that also has PCDN traffic in other areas; The group PCDN traffic identification result is determined based on the total number, distribution density, and average distance of feature vectors of at least one reference network object.
6. The method according to claim 1, characterized in that, The method further includes: Obtain PCDN traffic and normal traffic samples of network objects at different time periods; Positive sample pairs are constructed based on PCDN traffic within different time periods, and negative sample pairs are constructed based on the PCDN traffic and the normal traffic. Based on the positive sample pairs and the negative sample pairs, the parameters of the stream embedding model are adjusted to obtain the adjusted stream embedding model.
7. A PCDN flow identification device, characterized in that, The device includes: The acquisition module is used to acquire the original packet data of multiple network objects in the preset area within a preset time period when the uplink traffic of any network object in the preset area exceeds a preset traffic threshold and continues for a preset duration. The processing module is used to aggregate the original message data of each network object into multiple data stream time series based on the network flow parameters; and to perform feature dimensionality reduction processing on the multiple data stream time series of the corresponding network object using a pre-trained flow embedding model to obtain multiple low-dimensional feature vectors of the corresponding network object. The determination module is used to perform clustering processing on multiple low-dimensional feature vectors of multiple network objects in the preset area, and determine the network objects in the preset area that have PCDN traffic based on the clustering results.
8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.