SDN traffic classification method based on hybrid model

Abstract

The invention discloses an SDN (Software Defined Network) traffic classification method based on a hybrid model, which comprises the following steps of: firstly, periodically acquiring flow table statistical information from a switch by an SDN controller, then extracting a key attribute of each network flow of the flow table statistical information in a statistical period, and preprocessing to obtain traffic characteristic data; converting the traffic characteristic data into a time sequence sample through a sliding window method; and obtaining a global correlation feature sequence of the time sequence sample by using an improved Transform, and obtaining a final time sequence feature representation of the global correlation feature sequence by using an enhanced GRU. And a classifier is used to calculate category probability distribution represented by the final time sequence features, and a flow classification result is obtained. According to the method, through an intelligent flow classification method which fuses Transform and GRU models and is combined with software defined network (SDN) architecture characteristics, online classification and strategy linkage of network flow are realized through a processing link of global correlation modeling, time sequence dependence enhancement and online feedback control.

Description

Technical Field

[0001] This invention relates to the field of network traffic classification technology, and specifically to an SDN traffic classification method based on a hybrid model. Background Technology

[0002] Software-defined networking (SDN), as an emerging network architecture, achieves centralized management and programmability by separating the control plane and data plane, providing new technical support for traffic classification. However, existing traffic classification methods in SDN environments do not fully utilize SDN's global view and real-time data acquisition capabilities, resulting in high traffic acquisition latency. Some deep learning models, using RNNs, LSTMs, or Transformers alone, struggle to simultaneously capture global dependencies and process long-term temporal features, making it difficult to balance classification accuracy and real-time performance in complex traffic scenarios. Therefore, there is an urgent need for a traffic classification method that can fully combine the advantages of SDN architecture with the characteristics of deep learning models to address the shortcomings of existing technologies. Summary of the Invention

[0003] The present invention addresses the problems of insufficient real-time performance, unstable classification accuracy, and delayed response to sudden attacks in existing traffic classification methods when classifying complex, mixed, and sudden attack traffic in SDN network environments. It provides an SDN traffic classification method based on a hybrid model.

[0004] To solve the above problems, the present invention is achieved through the following technical solution:

[0005] An SDN traffic classification method based on a hybrid model includes the following steps:

[0006] Step 1: The SDN controller first periodically obtains flow table statistics from the switch, then extracts the key attributes of each network flow within the statistical period from the flow table statistics, and obtains traffic feature data after preprocessing; then, the traffic feature data is converted into time-series samples using the sliding window method.

[0007] Step 2: Use the improved Transformer to obtain the global correlation feature sequence of time series samples;

[0008] Step 3: Use the enhanced GRU to obtain the final temporal feature representation of the globally correlated feature sequence;

[0009] Step 4: Use a classifier to calculate the category probability distribution of the final time-series feature representation to obtain the traffic classification result.

[0010] In step 1, key attributes include the communication port, protocol type, and statistical information reflecting the intensity and persistence of traffic.

[0011] The specific process of step 2 is as follows:

[0012] Step 2.1: Input the time series samples into the embedding mapping module of the improved Transformer to perform a linear mapping on the original feature space, so that the time series samples are mapped from the original feature dimension to the high-dimensional embedding space, and the embedding mapping sequence is obtained.

[0013] Step 2.2: Input the embedded mapping sequence into the multi-head self-attention module of the improved Transformer. Through self-attention calculation, establish the correlation between the flow features of each time slice within the time window range to obtain the global dependency feature sequence.

[0014] Step 2.3: Adjust the attention allocation result of the global dependency feature sequence through the time-aware weight guidance module of the improved Transformer, so that the flow features with shorter time intervals occupy a higher proportion in the attention weight, while the association of flow features with longer time intervals is appropriately attenuated, to obtain the attention-weighted feature sequence after time-aware adjustment.

[0015] Step 2.4: Apply feature stability constraints to the attention-weighted feature sequence using the feature stability constraint module of the improved Transformer to obtain the globally associated feature sequence.

[0016] In step 2.3, time-aware weights for:

[0017]

[0018] In the formula, It's about adjusting parameters. For time intervals.

[0019] The specific process of step 3 is as follows:

[0020] Step 3.1: Input the global association feature sequence into the enhanced GRU in chronological order. The gating mechanism module of the enhanced GRU calculates the update gate and the reset gate.

[0021] Update Gate for:

[0022]

[0023] Reset door for:

[0024]

[0025] Step 3.2: The update mechanism module of the enhanced GRU first uses the reset gate to calculate the candidate hidden state, and then uses the update gate to update the final hidden state;

[0026] Candidate hidden state for:

[0027]

[0028] Final hidden state for:

[0029]

[0030] Step 3.3: The output module of the enhanced GRU uses the final hidden state of the last time slice as the final temporal feature representation of the global associated feature sequence;

[0031] In the formula, Represents the first globally correlated feature sequence Global correlation feature vectors for each time slice; This is the hidden state from the previous moment; This is the weight matrix of the gating mechanism module. For the gating mechanism module bias term; To update the weight matrix of the mechanism module, To update the bias terms of the mechanism module; It is the Sigmoid activation function. This represents element-wise multiplication. It is the hyperbolic tangent activation function.

[0032] Step 4 further includes triggering policy linkage based on the traffic classification results of the SDN controller, namely: when the traffic is determined to be abnormal or attack traffic, the SDN controller will execute the triggering of rate limiting, rerouting or blocking policies; when the traffic is determined to be normal service traffic, the SDN controller will execute path optimization and resource scheduling policies.

[0033] Compared with the prior art, the present invention has the following characteristics:

[0034] 1. Fully leveraging the advantages of SDN architecture to achieve closed-loop collaboration between traffic classification and network control: This invention utilizes the centralized control and global view features of SDN to achieve close collaboration between traffic classification and policy enforcement. Through the combined application of an improved Transformer and an enhanced GRU, changes in traffic behavior are captured in real time, and network control policies are adjusted promptly based on classification results.

[0035] 2. Compared to traditional single attention mechanisms, this invention introduces a time-aware weight adjustment mechanism into the improved Transformer. This allows for the allocation of higher weights to features at different time intervals within the same time slice, thereby enhancing sensitivity to short-term bursty behavior and providing a deeper model of long-term dependencies. This improves the ability to express traffic behavior and classification accuracy in complex and mixed traffic scenarios. Furthermore, the feature stability constraint mechanism effectively suppresses interference from noisy features and short-term abnormal fluctuations, improving the model's robustness and enabling efficient and accurate classification and anomaly detection in complex traffic scenarios.

[0036] 3. This invention further enhances the model's temporal dependency modeling capability through an enhanced GRU. In the gating mechanism of the enhanced GRU, the update gate and reset gate dynamically adjust the degree of integration between historical states and current input features, enabling the model to quickly respond and adjust its state when traffic changes suddenly, while maintaining the ability to remember historical information in stable communication scenarios. Attached Figure Description

[0037] Figure 1 This is a general framework diagram of an SDN traffic classification method based on a hybrid model.

[0038] Figure 2 This is a flowchart of the data processing for the improved Transformer.

[0039] Figure 3 This is a flowchart of the data processing for the enhanced GRU. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific examples and the accompanying drawings.

[0041] This invention uses a typical SDN network as the application environment. This SDN network includes a control plane and a data plane. The control plane is an SDN controller (implemented based on Ryu), and the data plane includes multiple Open Flow switches and several hosts. Leveraging the centralized control and global visibility architecture of the SDN controller, traffic statistics from the data plane are periodically collected. The controller periodically obtains flow table statistics from the switches via the southbound interface (Open Flow protocol) and inputs the resulting time-series samples into a hybrid model of "improved Transformer + enhanced GRU" to output traffic categories, thereby triggering SDN control policies and achieving online classification and policy linkage.

[0042] A hybrid model-based SDN traffic classification method, such as Figure 1 As shown, it includes the following steps:

[0043] (1) Construction of time series samples

[0044] Step 1.1: Periodically collect flow table statistics: The SDN controller periodically obtains flow table statistics from the switch through the southbound interface;

[0045] The controller uses a sampling cycle. Poll each switch and read the flow table statistics fields (matching domain 5-tuple, number of bytes, number of packets, duration). In this embodiment, the collection period is used. (Preferred time: 0.5s to 2s); the time obtained from each acquisition. The stream statistics set:

[0046]

[0047] in For a moment The number of active flows observed.

[0048] Step 1.2, Traffic Feature Extraction and Preprocessing: Extract the key attributes of each network flow in the statistical period from the flow table statistics, and obtain the traffic feature data after preprocessing.

[0049] Key attributes include communication port, protocol type, and statistical information reflecting traffic intensity and persistence. In this embodiment, key attributes include source / destination port, protocol type (discrete), packet count increment, byte count increment, average packet length, duration, packet rate, and byte rate.

[0050] Preprocessing of the collected traffic characteristic data includes: handling missing data. Interpolation is used for filling in the gaps; one-hot encoding is used for discrete features (such as protocol type and port). Standardization is used for numerical features (such as traffic intensity and duration).

[0051] time Traffic characteristic data Represented as:

[0052]

[0053] Step 1.3: Constructing time series samples using a sliding window. Transforming traffic feature data into time series samples using the sliding window method. .

[0054] Using the sliding window method to analyze continuous flow characteristic data Reassemble into fixed-length time series samples. Let the window length be... (Preferred) ), step size is (Preferred) ), then the first The time series samples are:

[0055]

[0056] The time interval between adjacent time slices The time interval is determined by the collection period of traffic statistics. Each time series sample should contain both information on changes in adjacent time slices and cross-time slice correlation information, so that the model can jointly represent short-term burst behaviors and long-term communication patterns.

[0057] It should be noted that during the inference phase of the classification model, only the time-series samples at the current moment need to be constructed. However, during the training phase, time-series samples from historical moments need to be constructed, and a sample set is built based on these historical time-series samples. The classification model is then trained using these time-series samples to obtain a pre-trained classification model that can then be used to infer (predict and classify) the time-series samples at the current moment.

[0058] Historical time series sample set constructed based on historical time series samples for:

[0059]

[0060] To address the class imbalance issue caused by the low proportion of attack / anomaly class samples, in the historical time series sample set... Based on this, the SMOTE (Synthetic Minority Over-sampling Technique) algorithm is introduced for data balancing. The SMOTE algorithm balances the time-series sample set. The SMOTE algorithm is suitable for historical time series sample sets. minority class sample set SMOTE generates synthetic samples:

[0061]

[0062] In this embodiment, the nearest neighbor number is used. The oversampling factor is set to 0.8, which makes the number of samples in each category nearly balanced.

[0063] Balanced time series sample set Used for preparing training data for the model; during training, the model uses a balanced time-series sample set. A single time-series sample Used as input to train the classification model.

[0064] (2) Use the improved Transformer to obtain the global correlation feature sequence, such as Figure 2 As shown.

[0065] Step 2.1: Obtain the embedding mapping : Time series samples The input is fed into the embedding mapping module of the improved Transformer, which performs a linear mapping on the original feature space. While preserving the original semantic information of the traffic features, the time-series samples are mapped from the original feature dimension to a high-dimensional embedding space, resulting in an embedding mapping sequence. This enhances the ability to represent features.

[0066] Embedded mapping sequence Represented as:

[0067]

[0068] in , Time series samples Mid-moment Traffic characteristic data. For the mapping matrix, this embodiment takes the embedding dimension. ;but , This represents the feature dimensions after preprocessing.

[0069] Step 2.2: Obtain global dependency features through multi-head self-attention. : Embedded mapping sequence The input is fed into the multi-head self-attention module of the improved Transformer, which establishes the correlation between the flow features of each time slice within the time window through self-attention calculation, and outputs the global dependency feature sequence calculated by the self-attention mechanism. Globally dependent feature sequences It characterizes the correlation strength between different time-series flow characteristics, providing a basic input for subsequent introduction of time-aware weight adjustment and stability constraints.

[0070] First, the embedded mapping sequences are mapped using three sets of linear mapping matrices respectively. Perform mapping to generate a query matrix. Key matrix and value matrix The calculation process is as follows:

[0071]

[0072] Then, based on the query matrix AND key matrix The dot product similarity between the data points calculates the correlation between traffic features in different time slices within the time window, and the result is normalized to obtain the attention weight matrix. :

[0073]

[0074] Finally, the attention weight matrix is ​​re-evaluated. Log-value matrix By performing a weighted summation, we obtain a feature sequence reflecting global dependencies within the time window. :

[0075]

[0076] In this embodiment, the number of attention heads can be taken. Single-head dimension Transformer encoder layer number Position coding can employ learnable position coding.

[0077] Step 2.3: Obtain the attention-weighted feature sequence by adjusting the time-aware weights. : Feature sequences of global dependencies Further processing is performed by adjusting the attention allocation results through the improved Transformer's time-aware weight guidance module. This ensures that flow features with shorter time intervals occupy a higher proportion of the attention weights, enhancing the model's sensitivity to sudden changes in behavior. Simultaneously, feature associations with longer time intervals are appropriately attenuated to avoid excessive interference from distant time slices in the current judgment. After processing, the output is a time-aware adjusted attention-weighted feature sequence. .

[0078] To enhance sensitivity to short-term sudden changes, a time-aware weight adjustment is introduced. This is based on time intervals. This is achieved by adjusting the attention weights at each moment to make short-term, spontaneous behaviors more pronounced. Time-aware weights are defined. for

[0079]

[0080] in It's about adjusting parameters. This is a time interval. In this example... The value is 0.3. .

[0081] It can be used to adjust attention output or attention weights (in practice, it can be used to adjust attention output or attention weights). (After scaling by time slice), we get:

[0082] when When it increases, The size is reduced, thereby suppressing the interference of distant time slices on the current judgment.

[0083] Step 2.4: Obtain the globally associated feature sequence by constraining feature stability. After completing the time-aware attention conditioning, the attention-weighted feature sequence is processed using the feature stabilization constraint module of the improved Transformer. Feature stabilization constraints are applied to reduce the impact of noisy features or short-term abnormal fluctuations on the global feature modeling results, ensuring that the output features remain continuous and smooth under stable business scenarios, and outputting a globally correlated feature sequence. By using feature stability constraints, the model is prevented from over-responding to non-critical perturbations, thereby improving the robustness of the global feature representation.

[0084] Attention-weighted feature sequences Apply characteristic stability constraint operator The global correlation feature sequence is obtained. :

[0085]

[0086] in This can achieve smooth fusion or stability adjustment of adjacent time slices to suppress noise characteristics or short-term abnormal fluctuations. The characteristic stability constraint can be implemented using exponential moving average, weighted smoothing, or other time continuity constraints; this embodiment uses exponential moving average (EMA) as an example. That is:

[0087]

[0088] Pick initial value .

[0089] (3) Use the enhanced GRU to obtain the final temporal feature representation, such as Figure 3 As shown.

[0090] Step 3.1: Calculate the Update Gate. With ResetGate : Globally correlated feature sequences The enhanced GRU is input sequentially over time. The gating mechanism module of the enhanced GRU calculates the update gate and the reset gate to achieve a dynamic trade-off between historical states and current input features.

[0091] Will Input the enhanced GRU in chronological order, where Indicates the first A time slice (moment) The corresponding global associated feature vector. In the enhanced GRU, a gating mechanism is used to fuse temporal features, enabling the model to adaptively weight and update the feature representation based on the current input features and the hidden state of the previous time step, outputting a weighted vector sequence combining the input features and the hidden state. The gating state calculation process is as follows:

[0092]

[0093] in, This is an update gate used to control the fusion ratio of current input information and historical state information; This is a reset gate, used to adjust the degree of influence of historical states on the current candidate state calculation; This is the hidden state from the previous moment; This is a trainable weight matrix; For bias terms; This is the sigmoid activation function. Through this gating mechanism, the model can enhance its response to the current input features when traffic behavior changes abruptly, while retaining more historical state information when traffic behavior is relatively stable.

[0094] Through this gating mechanism, the model can strengthen its reliance on current input information when traffic characteristics change abruptly, while retaining more historical state information under stable traffic conditions.

[0095] Step 3.2: Calculate candidate hidden states And update to get the final hidden state. The enhanced GRU's update mechanism module first uses the reset gate to calculate the candidate hidden state, and then uses the update gate to update the final hidden state, thereby controlling the state update magnitude at the current moment.

[0096] An update gate and a reset gate are used to weight the current input with the previous state, thereby controlling the magnitude of the current state update. If there is a sudden change in traffic, the enhanced GRU can adjust to the magnitude of the traffic change, allowing the model to quickly adjust the state when abnormal behavior is detected, while updating the state less frequently during stable traffic to avoid overreaction. Update gate Control the degree to which the current state is combined with the historical state, and reset the gate. The model controls the fusion ratio of current state and historical information. By dynamically adjusting these gating parameters, the model can flexibly update its state according to changes in time-series traffic characteristics, ensuring accurate modeling of traffic behavior.

[0097] After obtaining the update gate and reset gate, the enhanced GRU utilizes the reset gate. Further calculate the candidate hidden state at the current time step. The calculation process is as follows:

[0098]

[0099] in, Indicates the candidate hidden state; This is the weight matrix; For bias terms; This represents element-wise multiplication; It is the hyperbolic tangent activation function.

[0100] Subsequently, using the update gate By weighted fusion of the candidate states and historical states, the final hidden state at the current moment is obtained:

[0101]

[0102] Through the aforementioned state update method, the enhanced GRU network can adaptively adjust the state update intensity based on the magnitude of changes in traffic characteristics over time. Specifically, when a significant change in traffic characteristics is detected, the weight of historical states is reduced, while the weight of current input information is strengthened; when traffic characteristics change smoothly, the ability to retain historical states is enhanced, thereby preventing the model from over-responding to short-term noise. A gating mechanism enables rapid updates during sudden changes and memory retention during stable scenarios.

[0103] Step 3.3: Output the final time series feature representation The output module of the enhanced GRU will display the final hidden state of the last time slice. The final output, which comprehensively represents the temporal evolution of the entire window, is the final temporal feature representation. .

[0104]

[0105] in, It integrates global correlation features and temporal dependency information from the initial time slice to the current time slice, and fully depicts the evolution trend of network traffic in the time dimension.

[0106] By using the hidden state at the last time step as the final temporal output, the enhanced GRU network can provide a feature sequence containing information about the entire traffic evolution from start to finish, i.e., the final temporal feature representation. It is used as input for subsequent classification and feedback control.

[0107] (4) The classifier determines the flow classification result.

[0108] Step 4.1: Use a classifier to calculate the category probability distribution of the final time-series feature representation to obtain the traffic classification result.

[0109] Final temporal feature representation Calculate class probabilities using a classifier (fully connected layer + Softmax):

[0110]

[0111] in This is the classification weight matrix. The bias term is used to output the probability vectors for each class. In this embodiment, the number of categories (Normal, Scan, DoS, DDoS, Brute Force Attack, Data Leakage); , This represents the feature dimension of the hidden layer.

[0112] The decision rule is: choose the category with the highest probability. This is the classification result.

[0113] Step 4.2: Based on the traffic classification results, the SDN controller triggers policy linkage, namely:

[0114] when When traffic is identified as abnormal or attacking, the SDN controller will execute a rate-limiting, rerouting, or blocking policy. Rate limiting involves issuing rate-limiting rules to the meter for the corresponding flow; rerouting involves modifying the flow table to redirect traffic to a cleaning node / honeypot; and blocking involves issuing a drop flow table entry to intercept the flow.

[0115] when When traffic is determined to be normal business traffic, the SDN controller executes path optimization and resource scheduling strategies to improve the SDN network's responsiveness and operational stability in complex traffic scenarios.

[0116] This invention presents an intelligent traffic classification method that integrates the Transformer and GRU models and incorporates the characteristics of the Software-Defined Networking (SDN) architecture. This method achieves online classification and policy linkage of network traffic through a processing link of global correlation modeling, temporal dependency reinforcement, and online feedback control.

[0117] It should be noted that although the embodiments described above are illustrative, they are not intended to limit the invention. Therefore, the invention is not limited to the specific embodiments described above. Any other embodiments obtained by those skilled in the art under the guidance of this invention without departing from its principles are considered to be within the protection scope of this invention.

Claims

1. An SDN traffic classification method based on a hybrid model, characterized in that, The steps include the following: Step 1: The SDN controller first periodically obtains flow table statistics from the switch, then extracts the key attributes of each network flow within the statistical period from the flow table statistics, and obtains traffic feature data after preprocessing; then, the traffic feature data is converted into time-series samples using the sliding window method. Step 2: Use the improved Transformer to obtain the global correlation feature sequence of time series samples; Step 3: Use the enhanced GRU to obtain the final temporal feature representation of the globally correlated feature sequence; Step 4: Use a classifier to calculate the category probability distribution of the final time-series feature representation to obtain the traffic classification result.

2. The SDN traffic classification method based on a hybrid model according to claim 1, characterized in that, In step 1, key attributes include communication port, protocol type, and statistical information reflecting traffic intensity and persistence.

3. The SDN traffic classification method based on a hybrid model according to claim 1, characterized in that, The specific process of step 2 is as follows: Step 2.1: Input the time series samples into the embedding mapping module of the improved Transformer to perform a linear mapping on the original feature space, so that the time series samples are mapped from the original feature dimension to the high-dimensional embedding space, and the embedding mapping sequence is obtained. Step 2.2: Input the embedded mapping sequence into the multi-head self-attention module of the improved Transformer. Through self-attention calculation, establish the correlation between the flow features of each time slice within the time window range to obtain the global dependency feature sequence. Step 2.3: Adjust the attention allocation result of the global dependency feature sequence through the time-aware weight guidance module of the improved Transformer, so that the flow features with shorter time intervals occupy a higher proportion in the attention weight, while the association of flow features with longer time intervals is appropriately attenuated, to obtain the attention-weighted feature sequence after time-aware adjustment. Step 2.4: Apply feature stability constraints to the attention-weighted feature sequence using the feature stability constraint module of the improved Transformer to obtain the globally associated feature sequence.

4. The SDN traffic classification method based on a hybrid model according to claim 3, characterized in that, In step 2.3, time-aware weights for: In the formula, It's about adjusting parameters. For time intervals.

5. The SDN traffic classification method based on a hybrid model according to claim 1, characterized in that, The specific process of step 3 is as follows: Step 3.1: Input the global association feature sequence into the enhanced GRU in chronological order. The gating mechanism module of the enhanced GRU calculates the update gate and the reset gate. Update Gate for: Reset door for: Step 3.2: The update mechanism module of the enhanced GRU first uses the reset gate to calculate the candidate hidden state, and then uses the update gate to update the final hidden state; Candidate hidden state for: Final hidden state for: Step 3.3: The output module of the enhanced GRU uses the final hidden state of the last time slice as the final temporal feature representation of the global association feature sequence; In the formula, Represents the first globally correlated feature sequence Global correlation feature vectors for each time slice; This is the hidden state from the previous moment; This is the weight matrix of the gating mechanism module. For the gating mechanism module bias term; To update the weight matrix of the mechanism module, To update the bias terms of the mechanism module; It is the Sigmoid activation function. This represents element-wise multiplication. It is the hyperbolic tangent activation function.

6. The SDN traffic classification method based on a hybrid model according to claim 1, characterized in that, Step 4 further includes triggering policy linkage based on traffic classification results by the SDN controller, that is: when the traffic is determined to be abnormal or attack traffic, the SDN controller will execute and trigger rate limiting, rerouting or blocking policies accordingly. When the traffic is determined to be normal business traffic, the SDN controller executes path optimization and resource scheduling strategies.

Images