A network packet capture analysis method and system for mobile terminals

Abstract

The present application relates to the technical field of network transmission congestion, and particularly relates to a network data packet capturing and analyzing method and system for mobile terminals. The method divides discrete transmission batches based on historical interval characteristics, determines an observation reference rate by time window sampling combined with quantile statistics, and constructs an ideal reference transmission curve. The method determines a time domain lag barycenter parameter by analyzing the cumulative lag distribution in the time dimension, eliminates false congestion interference, and extracts a load congestion index. The method dynamically updates the reference delay baseline through the load congestion index to judge the congestion state and implement a hierarchical early warning mechanism. The present application is based on time domain barycenter analysis of lag distribution characteristics, distinguishes between head lags caused by protocol establishment overhead and real congestion lags caused by bandwidth limitations, significantly reduces false congestion false positive rates, realizes adaptive and accurate monitoring of network congestion states, and improves the accuracy of user experience evaluation.

Description

Technical Field

[0001] This invention relates to the field of network transmission congestion technology, specifically to a method and system for capturing and analyzing network data packets for mobile terminals. Background Technology

[0002] In streaming media services carried by mobile communication networks, video services generally use variable bit rate (VBR) encoding technology, which causes the data transmission rate to fluctuate drastically with the complexity of the video content. When monitoring network quality on the mobile terminal side, it is usually only possible to observe the arrival time and payload size of encrypted data packets, but not to parse their specific content.

[0003] Common network quality analysis methods primarily rely on monitoring average throughput or absolute round-trip time (RTT). However, in mobile network scenarios, terminals need to perform signaling interactions from idle to connected states before transmitting data, resulting in physical layer establishment latency. Furthermore, the transport layer protocol enters a slow start phase during the initial connection phase or after an idle restart, limiting transmission rates due to congestion window ramp-up. This normal overhead caused by protocol mechanisms manifests as a brief delay in packet arrival in the time domain, making it difficult to distinguish from abnormal congestion caused by insufficient network link bandwidth. This easily leads to a large number of false congestion reports, reducing the accuracy of reflecting the user's actual playback experience. Summary of the Invention

[0004] To address the technical problem in existing technologies where normal overhead caused by protocol mechanisms manifests as a brief delay in data packet arrival in the time domain, making it difficult to distinguish from abnormal congestion caused by insufficient network link bandwidth and easily leading to a large number of false congestion reports, the present invention aims to provide a network data packet capture and analysis method and system for mobile terminals. The specific technical solution adopted is as follows:

[0005] This invention provides a method for capturing and analyzing network data packets for mobile terminals, the method comprising:

[0006] The system receives the timestamp information and payload size of encrypted network traffic data packets, and filters the payload packets based on the payload size; it also divides consecutive payload packets into different discrete transmission batches based on historical interval characteristics.

[0007] For each transmission batch, based on time-series window sampling and combined with quantile statistical analysis of the temporal distribution of payload packets, the observation reference rate is determined and an ideal reference transmission curve is constructed. The hysteresis between the actual cumulative load and the corresponding cumulative load of the ideal reference transmission curve is analyzed, and the cumulative hysteresis at the location of each payload packet in the transmission batch is extracted. The distribution of the cumulative hysteresis is analyzed in combination with the time dimension to determine the time-domain hysteresis centroid parameter. The cumulative load hysteresis is suppressed by the time-domain hysteresis centroid parameter to determine the load congestion index of the transmission batch.

[0008] The congestion status of each transmission batch is determined by dynamically updating the baseline delay using load congestion indicators, and graded early warning is given by combining the distribution of congestion status of consecutive transmission batches in the current data stream.

[0009] Furthermore, the division of continuous payload packets into different discrete transmission batches based on historical interval characteristics includes:

[0010] In the historical batch records, if the number of batches meets the preset analysis quantity, calculate the average interval duration between adjacent payload packets within each batch in the historical batch records, and combine the average interval duration of all batches as the packet interval feature value; multiply the packet interval feature value by a preset multiple as the dynamic division threshold.

[0011] In the current data stream, the time interval between the timestamp of each payload packet and the timestamp of the previous payload packet is calculated. When the time interval exceeds the dynamic partitioning threshold, the current batch transmission ends and the current batch is updated in the historical batch record, and then a new transmission batch is generated.

[0012] If the total payload of the payload packets in the current batch exceeds the preset payload limit threshold, or the total duration of the current batch exceeds the preset batch duration threshold, the current batch transmission will be forcibly terminated and a new transmission batch will be generated.

[0013] Furthermore, the method for obtaining the observation reference rate includes:

[0014] For each transmission batch, for any payload packet location, within a preset time window after that location in the timing sequence, the ratio of the sum of the payload packets to the length of the preset time window is used as the aggregate transmission rate for that location.

[0015] After sorting the aggregated transmission rates of all payload packet locations in ascending order, a preset high percentile value is selected as the observation reference rate.

[0016] Furthermore, the method for constructing the ideal reference transmission curve includes:

[0017] Using the observed reference rate as the slope and the start time of the corresponding transmission batch as the zero point, a function curve with time as the independent variable and the total amount of preceding load as the dependent variable is constructed as the ideal reference transmission curve. The ideal reference transmission curve shows a linear increase before the total amount of preceding load reaches the total amount of transmission batch load, and remains horizontal after reaching the total amount of transmission batch load.

[0018] Furthermore, the method for obtaining the cumulative lag at each timestamp in the transmission batch includes:

[0019] For each payload packet location within a transmission batch, calculate the difference between the function value of that location in the ideal reference transmission curve and the actual amount of preceding received payload at that location to obtain the cumulative hysteresis at that location.

[0020] Furthermore, the method for obtaining the time-domain lag centroid parameter includes:

[0021] For each transmission batch, time integration is performed based on the cumulative lag corresponding to the location of all payload packets to obtain the lag integral index of the transmission batch.

[0022] The time difference between the timestamp of each payload packet and the initial time of the batch is used as the relative time of each payload packet; the product of the cumulative lag at the location of each payload packet and the relative time is calculated as the weighted lag at the location of each payload packet; the weighted lag at the location of all payload packets is integrated over time to obtain the time-weighted lag integral index of the transmission batch.

[0023] The ratio of the time-weighted lag integral index to the lag integral index is calculated, and the ratio is divided by the total transmission time of the transmission batch to obtain the time-domain lag centroid parameter.

[0024] Furthermore, the method for obtaining the load congestion metric includes:

[0025] For each transmission batch, if the time-domain lag centroid parameter is less than the preset suppression threshold, the preset retention coefficient is used as the suppression coefficient, and the product of the lag integral index and the suppression coefficient is used as the suppression lag degree; the ratio of the suppression lag degree to the total load of the transmission batch is used as the load congestion index of the transmission batch.

[0026] Otherwise, the ratio of the lag integral index to the total load of the transmission batch is used as the load congestion index of the transmission batch.

[0027] Furthermore, the step of dynamically updating the baseline delay based on load congestion metrics to determine the congestion status of each transmission batch includes:

[0028] The product of the current baseline delay and the preset baseline multiple is used as the judgment threshold.

[0029] If the load congestion index of the current transmission batch is greater than the judgment threshold, the current transmission batch is judged to be in a congested state and the baseline delay is not updated.

[0030] Otherwise, the current transmission batch is determined to be in a non-congested state, and the baseline delay is updated based on the current load congestion index using a weighted average.

[0031] Furthermore, the step of combining the congestion status distribution of consecutive transmission batches in the current data stream for graded early warning includes:

[0032] The system counts the number of consecutive batches in the current data stream that are in a congested state. Based on the frequency and number of consecutive occurrences of congestion in the data stream, the system determines the warning level and outputs the corresponding warning information.

[0033] The present invention also provides a network packet capture and analysis system for mobile terminals, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the network packet capture and analysis method for mobile terminals described above.

[0034] The present invention has the following beneficial effects:

[0035] This invention divides discrete transmission batches based on historical interval characteristics, making traffic analysis more closely aligned with the time-varying characteristics of mobile networks and improving the rationality of batch division. Furthermore, it constructs an ideal transmission curve based on the observed reference rate and introduces a time-domain lag centroid parameter. Utilizing the difference in time-domain distribution between protocol overhead lag, which is mainly concentrated in the transmission header, and bandwidth congestion lag, which persists throughout the entire transmission, it achieves blind separation and suppression of protocol overhead. This effectively eliminates false congestion interference without decrypting the content and extracts load congestion indicators that reflect the true bandwidth bottleneck. Finally, it dynamically updates the baseline delay using the load congestion indicator to determine the congestion status, adapting to the differences in baseline delay in different network environments. Combined with a tiered early warning mechanism, it achieves accurate judgment and real-time feedback on network quality status. This invention, based on time-domain centroid analysis of lag distribution characteristics, distinguishes between header lag caused by protocol establishment overhead and true congestion lag caused by bandwidth limitations, significantly reducing the false congestion false alarm rate, achieving adaptive and accurate monitoring of network congestion status, and improving the accuracy of user experience assessment. Attached Figure Description

[0036] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is a flowchart of a network data packet capture and analysis method for mobile terminals provided in one embodiment of the present invention. Detailed Implementation

[0038] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of a network data packet capture and analysis method and system for mobile terminals proposed according to the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0039] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0040] The following description, in conjunction with the accompanying drawings, details the specific scheme of the network data packet capture and analysis method and system for mobile terminals provided by this invention.

[0041] Please see Figure 1 The diagram illustrates a flowchart of a network packet capture and analysis method for mobile terminals according to an embodiment of the present invention. The method includes the following steps:

[0042] S1: Receive the timestamp information and payload size of encrypted network traffic data packets, and filter the effective payload packets based on the payload size; divide the continuous effective payload packets into different discrete transmission batches based on historical interval characteristics.

[0043] The encrypted network traffic of mobile terminals is captured in real time. The kernel arrival timestamp information and actual payload of each data packet are parsed to obtain the original encrypted network traffic data packet set. The timestamp information and payload size of each data packet are obtained to characterize the transmission timing characteristics and data carrying capacity characteristics of the data packets, providing basic data support for subsequent traffic analysis.

[0044] Because encrypted network traffic contains control packets such as TCP acknowledgments and heartbeats that lack actual business data, these packets have small payloads and no valid business information. Including them in analysis would interfere with the accuracy of subsequent batching and congestion assessment. Therefore, in this embodiment of the invention, packets with payloads greater than or equal to a preset payload threshold are designated as payload packets. Packets carrying actual business data are selected, and their timestamps and payload size information are retained for subsequent analysis. The remaining packets are considered non-payload packets and are directly filtered out, not participating in subsequent batching and congestion analysis. The preset payload threshold can be 100 bytes, and its value can be adjusted by the implementer according to the actual network service type; this invention does not impose any restrictions on this.

[0045] Because mobile network transmission characteristics are time-varying, the transmission interval of encrypted traffic changes dynamically with network status. Fixed threshold division methods cannot adapt to the real-time changes in network characteristics, easily leading to overly coarse or overly fine batch divisions, affecting the accuracy of subsequent congestion analysis. Therefore, this invention considers using historical interval statistics to calculate a dynamic segmentation threshold and performing batch segmentation based on this threshold. In this embodiment, the interval characteristic data of the analyzed discrete transmission batches are stored to form historical batch records.

[0046] In historical batch records, if the batch size meets the preset analysis quantity (i.e., the batch size in the historical batch records reaches a standard that can reflect the normal network transmission status), the average interval duration between adjacent payload packets within each batch in the historical batch records is calculated. This average interval duration reflects the degree of interval between payload packets in a historically formed batch queue, providing a historical reference for calculating the dynamic partitioning threshold. The preset analysis quantity can be set to 5. If the preset analysis quantity cannot be met, the system may be in a cold start phase, and an empirical default threshold, such as 50ms, can be used directly as the dynamic partitioning threshold.

[0047] Furthermore, the average interval duration of all batches is used as the inter-packet interval feature value. In this embodiment of the invention, the arithmetic mean of the average interval duration of all batches is calculated to obtain the inter-packet interval feature value, which reflects the normal transmission interval characteristics of payload packets in the current network environment. The product of the inter-packet interval feature value and a preset multiple is used as a dynamic partitioning threshold, which can adapt to the real-time transmission status of the network. Considering that there is normal transmission jitter in mobile networks, in order to avoid misjudging normal jitter as batch boundaries, the preset multiple can be set to 4 times to cover most normal network fluctuation scenarios. It should be noted that the preset multiple can be adjusted according to the actual network jitter situation, and this invention does not limit it.

[0048] In the current data stream, the filtered payload packets are traversed sequentially. The time interval between the timestamp of each payload packet and the timestamp of the previous payload packet is calculated to obtain real-time inter-packet transmission interval data. When the time interval exceeds the dynamic partitioning threshold, it indicates that the transmission interval between the current data packet and the preceding data packet exceeds the normal range of the network. This is determined to be the boundary of two independent batches. The current batch transmission ends and the current batch is updated in the historical batch record. Then, a new transmission batch is generated, and the current data packet is used as the first payload packet of the new transmission batch. Subsequent payload packets are continuously received and included in the new batch until the batch partitioning condition is triggered.

[0049] In real-world networks, persistent congestion can lead to data streams with no clear intervals and excessively large batch sizes. Such situations reduce the real-time performance of analysis and affect congestion warning efficiency. Therefore, a forced segmentation condition is further defined. In this embodiment, when the total payload of the payload packets in the current batch exceeds a preset payload limit threshold, it indicates that the data volume carried by a single batch has reached the analysis threshold. Continuing to accumulate data will increase computational overhead. At this point, the current batch transmission is forcibly terminated, and a new transmission batch is generated. The current data packet is used as the first data packet of the new batch, and subsequent data packets are included in the new batch for analysis.

[0050] Alternatively, if the total duration of the current batch exceeds a preset batch duration threshold, it indicates that the transmission duration of a single batch has exceeded the time range for real-time analysis. To ensure the real-time nature of congestion determination, the transmission of the current batch is forcibly terminated, and a new transmission batch is generated. In this embodiment of the invention, the preset load limit threshold can be set to 5MB, and the preset batch duration threshold can be set to 2000ms. These can be set based on the limitations of typical mobile terminal memory buffers. Implementers can adjust these settings according to terminal performance and business needs, and no restrictions are imposed here.

[0051] It should be noted that batches subject to mandatory constraint splitting are not recorded as historical batches, ensuring that the queue distribution in the historical batch records is more reliable historical analysis data under normal splitting.

[0052] At this point, the system has completed the discretization of the continuous data stream and output transmission batches with independent time coordinates and statistical characteristics, providing stable observation objects for subsequent congestion pattern analysis.

[0053] S2: For each transmission batch, based on time-series window sampling and combined with quantile statistical analysis of the time-series distribution of payload packets, determine the observation reference rate and construct an ideal reference transmission curve; analyze the lag between the actual cumulative load and the corresponding cumulative load of the ideal reference transmission curve, and extract the cumulative lag at the location of each payload packet in the transmission batch; combine the time dimension to analyze the distribution of the cumulative lag and determine the time-domain lag centroid parameter; suppress the cumulative load lag through the time-domain lag centroid parameter and determine the load congestion index of the transmission batch.

[0054] To analyze whether there are abnormal delays in the transmission process of the current batch, and to distinguish whether the delay is caused by protocol overhead or network congestion, considering that the mobile terminal operating system has an interrupt aggregation mechanism, which can cause the instantaneous rate observation value to far exceed the physical bandwidth, it is first necessary to extract a stable reference rate that can represent the actual transmission capacity of the link.

[0055] In this embodiment of the invention, for each transmission batch, for any payload packet position, within a preset time window after that position in the time sequence, the ratio of the sum of the payload packets to the length of the preset time window is used as the aggregate transmission rate at that position. This aggregate transmission rate reflects the local transmission rate characteristics within the corresponding time window, providing a basis for overall rate analysis. The preset time window can be 200 milliseconds, and its value can be flexibly adjusted by the implementer according to the network transmission rate. This invention does not impose any restrictions on this.

[0056] Considering that the aggregated transmission rate may still contain artificially high values ​​due to the kernel's large receive offloading mechanism, the aggregated transmission rates of all payload packet positions are sorted in ascending order, and a preset high percentile value is selected as the observation reference rate. Extreme outliers are eliminated through percentile statistics, and the observation reference rate reflects the effective transmission capacity of the link under congestion-free conditions. In this embodiment of the invention, the preset high percentile is selected as the 95th percentile, which can filter out 5% of extreme aggregated bursts while retaining the characteristics of the vast majority of normal transmission samples.

[0057] In this embodiment of the invention, to further enhance robustness and prevent the calculated rate from being abnormally high in the local loopback test or simulator environment, when the observed reference rate is greater than the upper limit of the physical interface rate, such as 150Mbps, its value is limited to not exceeding the upper limit, and the upper limit of the physical interface rate is used as the observed reference rate.

[0058] Furthermore, an ideal reference transmission curve is constructed based on the observed reference rate to reflect the ideal load transmission process of the transmission batch under congestion-free conditions. In this embodiment of the invention, the observed reference rate is used as the slope, and the start time of the corresponding transmission batch is taken as the zero point. A function curve with time as the independent variable and the total preceding load as the dependent variable is constructed as the ideal reference transmission curve. This provides a criterion for judging the ideal load accumulation process of the transmission batch. That is, the curve function value corresponding to any time point is the accumulated load that should be achieved under congestion-free conditions at that time point. The trend of the curve function value changing with time conforms to the transmission characteristics of the observed reference rate. The ideal reference transmission curve shows a linear increase before the total preceding load reaches the total load of the transmission batch. That is, the load is continuously accumulated according to the observed reference rate until the total load of the batch is reached. After reaching the total load of the transmission batch, it remains horizontal, and the accumulated load no longer increases with time, maintaining the total load unchanged.

[0059] Since the ideal reference transmission curve characterizes the load accumulation pattern under congestion-free conditions, it can serve as a benchmark for comparison with the actual transmission state. By analyzing the deviation from the actual accumulated load, the load lag in the actual transmission process can be quantified. In this embodiment of the invention, for each payload packet position within a transmission batch, the difference between the function value of that position on the ideal reference transmission curve and the actual preceding received load at that position is calculated to obtain the cumulative lag at that position. The cumulative lag reflects the degree of load lag in the actual transmission at the corresponding position relative to the ideal state. Specifically, the actual preceding received load at that position is the total load of all payload packets at that position and before it. By calculating the difference, the lag in transmission progress is reflected in real time. Furthermore, since actual transmission is usually not faster than the ideal physical upper limit, when the difference is negative, i.e., the actual transmission is faster than the ideal, it may be a statistical error, and the corresponding cumulative lag is set to 0.

[0060] Considering protocol overhead, such as the latency caused by RRC signaling establishment and TCP slow start, which is usually concentrated in the transmission header, while the latency caused by bandwidth congestion persists throughout the entire transmission or is slightly later in the transmission, the distribution of the cumulative latency corresponding to different payload packets on the time axis is used to analyze the centroid position of the latency energy at different points in the time sequence. In this embodiment of the invention, for each transmission batch, a time integration operation is performed based on the cumulative latency corresponding to the positions of all payload packets to obtain the latency integral index of the transmission batch. The latency integral index is the quantified value of the total latency of the transmission batch, reflecting the total latency in the entire batch transmission process. That is, the discrete time integration is performed on all cumulative latency using the time interval between adjacent payload packets as weights.

[0061] Furthermore, the time difference between the timestamp of each payload packet and the initial time of its batch is used as the relative time of each payload packet, characterizing the temporal position of the payload packet in the transmission batch and eliminating the absolute influence of the batch start time. By calculating the product of the cumulative lag at each payload packet position and the relative time, the weighted lag at each payload packet position is obtained. The weighted lag combines the lag scale and temporal position characteristics, characterizing the degree of lag contribution at different temporal positions and amplifying the lag impact in the later stages of transmission.

[0062] Time integration is performed on the weighted lags corresponding to the locations of all payload packets to obtain the time-weighted lag integral index of the transmission batch. The time-weighted lag integral index is the quantized value of the total lag after time-series weighting, reflecting the distribution characteristics of the total lag in the time dimension. That is, the time interval between adjacent payload packets is used as the weight to perform discrete time integration on all weighted lags.

[0063] The time-weighted lag integral index and the lag integral index can be combined to reflect the time-domain centroid position of the lag. The ratio of the time-weighted lag integral index to the lag integral index is then calculated, and divided by the total transmission duration of the transmission batch to obtain the time-domain lag centroid parameter. This normalizes the centroid position and characterizes the concentrated distribution of the lag in the transmission batch's timing. As an example, the expression for the time-domain lag centroid parameter is: In the formula, Represented as the time-domain lag centroid parameter, Represented as a time-weighted lag integral index, Represented as a lagged integral index, This represents the total transmission time of the transmission batch. It should be noted that if there is an ideal zero-lag situation, i.e., the lag integral index is zero, then the time-domain lag centroid parameter can be directly set to zero.

[0064] The magnitude of the time-domain lag centroid parameter indicates the main stage of lag occurrence. When the time-domain lag centroid parameter is small, it indicates that the lag is mainly concentrated at the beginning, consistent with protocol overhead characteristics. When the time-domain lag centroid parameter is large, it indicates that the lag distribution is uniform or biased towards the end, consistent with bandwidth congestion characteristics.

[0065] Therefore, in this embodiment of the invention, for each transmission batch, if the time-domain lag centroid parameter is less than the preset suppression threshold, it is determined that the lag is mainly caused by early factors such as protocol overhead, and not by actual network congestion. The total accumulated lag needs to be suppressed, and a preset retention coefficient is used as the suppression coefficient to strongly suppress the total lag. The product of the lag integral index and the suppression coefficient is used as the suppressed lag degree, significantly reducing the impact of pseudo-congestion. The ratio of the suppressed lag degree to the total load of the transmission batch is used as the load congestion index of the transmission batch, obtaining the normalized average lag time per byte, quantifying the degree of transmission lag caused by actual congestion. In this embodiment of the invention, the preset retention coefficient can be set to 0.1, and the preset suppression threshold can be set to 0.3. These values ​​can be adjusted according to the actual network protocol overhead characteristics, and this invention does not impose any restrictions on them.

[0066] Otherwise, when the time domain lag centroid parameter is greater than or equal to the preset suppression threshold, it indicates that the lag is mainly caused by real network congestion. There is no need to suppress the total cumulative lag. Instead, the ratio of the lag integral index to the total load of the transmission batch is used as the load congestion index of the transmission batch to directly quantify the degree of lag caused by network congestion.

[0067] Thus, by eliminating protocol interference, a load congestion index that more accurately represents the degree of network congestion is obtained.

[0068] S3: Dynamically update the baseline delay based on the load congestion index to determine the congestion status of each transmission batch, and combine it with the distribution of congestion status of consecutive transmission batches in the current data stream to provide graded early warning.

[0069] Due to the significant differences in baseline latency across different network standards (such as 4G and 5G) and signal strengths, and the fact that video applications typically have a playback buffer capable of tolerating latency fluctuations within a certain range, a fixed latency threshold cannot adapt to all scenarios. Congestion assessment and analysis through comparison of load congestion indicators with a dynamic baseline better reflects the real-time state of the network. Therefore, a relative judgment mechanism can be used for congestion assessment. In this embodiment, the product of the current baseline latency and a preset baseline multiple is used as the judgment threshold. The preset baseline multiple can be set to 3.0, a value adjusted based on the maximum tolerance of the upper-layer application buffer to network fluctuations, reflecting the acceptable upper limit of latency under the current network environment.

[0070] If the load congestion index of the current transmission batch is greater than the judgment threshold, it means that the lag of the current transmission batch exceeds the normal range under the current network environment, which is a real bandwidth limitation and real network congestion. In this case, the current transmission batch is judged to be in a congested state. At this time, in order to prevent abnormal high latency samples from polluting the normal reference baseline, the baseline latency baseline is not updated and the baseline is kept stable.

[0071] Otherwise, when the load congestion index of the current transmission batch is less than or equal to the judgment threshold, the current transmission batch is determined to be in a non-congested state. The baseline delay can be updated based on the current load congestion index using a weighted average, so that the baseline can smoothly follow long-term changes in the network environment, such as base station switching or load tidal.

[0072] In one specific embodiment of the present invention, an exponentially weighted moving average algorithm is used to set an environmental forgetting factor, for example, 0.05. Since changes in the basic environment of the mobile communication network, such as base station handover, are low-frequency events compared to data packet transmission, a smaller environmental forgetting factor ensures that the baseline level has strong anti-jitter capabilities and will not drastically change due to occasional fluctuations in a single transmission. The environmental forgetting factor is used to weight the current load congestion index, and the difference between a constant 1 and the environmental forgetting factor is used to weight the current baseline delay. The weighted sum is then used as the updated baseline delay.

[0073] Understandably, if multiple consecutive congestion states occur for an extended period, it may indicate a physical change in the user's network environment, such as switching from low-latency Wi-Fi to a high-latency cellular network. In this case, the old baseline latency is no longer applicable, and continuing to refuse to update the baseline could lead to a system deadlock. Therefore, a forced reset of the baseline latency is necessary. In this embodiment of the invention, if a congestion state is detected consecutively a preset number of times, such as 20 times, a network environment change is determined. A cold start initialization and abnormal rollback are then performed on the baseline latency, reverting it to its initial default value. This ensures that the baseline latency accurately represents the basic network latency state even during sudden changes in the network environment.

[0074] For different business needs, the severity and duration of congestion directly affect user experience. Therefore, tiered early warnings can be implemented based on the temporal distribution characteristics of congestion states. In this embodiment of the invention, the number of consecutive transmission batches in the current data stream that are in a congested state is counted. That is, the transmission batch determination results of the current data stream are traversed, and the cumulative number of batches in a consecutive congested state is accumulated, reflecting the degree of congestion.

[0075] The warning level is then determined based on the frequency and consecutive occurrences of congestion in the data stream, and corresponding warning information is output. In one specific embodiment of the invention, a Level 1 minor congestion warning is triggered when either the consecutive occurrences of congestion exceed a first preset threshold or the congestion frequency exceeds a first preset frequency threshold. A Level 2 severe congestion warning is triggered when either the consecutive occurrences of congestion exceed a second preset threshold or the congestion frequency exceeds a second preset frequency threshold. Different warning levels correspond to different warning information output, including congestion timestamps, congestion intensity, and warning level, for upper-layer applications to execute corresponding network adaptation strategies.

[0076] For example, the first and second preset count thresholds can be set to 3 and 10, respectively, and the first and second preset frequency thresholds can be set to 10% and 30%, respectively. When the number of consecutive occurrences exceeds 3 and the frequency exceeds 10%, a Level 1 mild congestion warning is output. When the number of consecutive occurrences exceeds 10 and the frequency exceeds 30%, a Level 2 severe congestion warning is output, prompting the upper-layer application to trigger a bitrate reduction or line switching strategy.

[0077] In summary, this invention divides discrete transmission batches based on historical interval characteristics, making traffic analysis more closely aligned with the time-varying characteristics of mobile networks and improving the rationality of batch division. Furthermore, it constructs an ideal transmission curve based on the observed reference rate and introduces a time-domain lag centroid parameter. Utilizing the difference in time-domain distribution between protocol overhead lag, which is mainly concentrated in the transmission header, and bandwidth congestion lag, which persists throughout the entire transmission, it achieves blind separation and suppression of protocol overhead. This effectively eliminates false congestion interference without decrypting the content and extracts load congestion indicators that reflect the true bandwidth bottleneck. Finally, it dynamically updates the baseline delay using the load congestion indicator to determine the congestion status, adapting to the differences in baseline delay in different network environments. Combined with a tiered early warning mechanism, it achieves accurate judgment and real-time feedback on network quality status. This invention, based on time-domain centroid analysis of lag distribution characteristics, distinguishes between header lag caused by protocol establishment overhead and true congestion lag caused by bandwidth limitations, significantly reducing the false congestion false alarm rate, achieving adaptive and accurate monitoring of network congestion status, and improving the accuracy of user experience evaluation.

[0078] The present invention also provides a network packet capture and analysis system for mobile terminals, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the network packet capture and analysis method for mobile terminals described above.

[0079] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0080] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

Claims

1. A method for capturing and analyzing network data packets for mobile terminals, characterized in that, The method includes: The system receives the timestamp information and payload size of encrypted network traffic data packets, and filters the payload packets based on the payload size; it also divides consecutive payload packets into different discrete transmission batches based on historical interval characteristics. For each transmission batch, based on time-series window sampling and combined with quantile statistical analysis of the temporal distribution of payload packets, the observation reference rate is determined and an ideal reference transmission curve is constructed. The hysteresis between the actual cumulative load and the corresponding cumulative load of the ideal reference transmission curve is analyzed, and the cumulative hysteresis at the location of each payload packet in the transmission batch is extracted. The distribution of the cumulative hysteresis is analyzed in combination with the time dimension to determine the time-domain hysteresis centroid parameter. The cumulative load hysteresis is suppressed by the time-domain hysteresis centroid parameter to determine the load congestion index of the transmission batch. The congestion status of each transmission batch is determined by dynamically updating the baseline delay based on the load congestion index, and graded early warning is given by combining the distribution of congestion status of consecutive transmission batches in the current data stream. The method for obtaining the time-domain lag centroid parameter includes: For each transmission batch, time integration is performed based on the cumulative lag corresponding to the location of all payload packets to obtain the lag integral index of the transmission batch. The time difference between the timestamp of each payload packet and the initial time of the batch is used as the relative time of each payload packet; the product of the cumulative lag at the location of each payload packet and the relative time is calculated as the weighted lag at the location of each payload packet; the weighted lag at the location of all payload packets is integrated over time to obtain the time-weighted lag integral index of the transmission batch. The ratio of the time-weighted lag integral index to the lag integral index is calculated, and the ratio is divided by the total transmission time of the transmission batch to obtain the time-domain lag centroid parameter.

2. The network data packet capture and analysis method for mobile terminals according to claim 1, characterized in that, The method of dividing continuous payload packets into different discrete transmission batches based on historical interval characteristics includes: In the historical batch records, if the number of batches meets the preset analysis quantity, calculate the average interval duration between adjacent payload packets within each batch in the historical batch records, and combine the average interval duration of all batches as the packet interval feature value; multiply the packet interval feature value by a preset multiple as the dynamic division threshold. In the current data stream, the time interval between the timestamp of each payload packet and the timestamp of the previous payload packet is calculated. When the time interval exceeds the dynamic partitioning threshold, the current batch transmission ends and the current batch is updated in the historical batch record, and then a new transmission batch is generated. If the total payload of the payload packets in the current batch exceeds the preset payload limit threshold, or the total duration of the current batch exceeds the preset batch duration threshold, the current batch transmission will be forcibly terminated and a new transmission batch will be generated.

3. The network data packet capture and analysis method for mobile terminals according to claim 1, characterized in that, The method for obtaining the observation reference rate includes: For each transmission batch, for any payload packet location, within a preset time window after that location in the timing sequence, the ratio of the sum of the payload packets to the length of the preset time window is used as the aggregate transmission rate for that location. After sorting the aggregated transmission rates of all payload packet locations in ascending order, a preset high percentile value is selected as the observation reference rate.

4. The network data packet capture and analysis method for mobile terminals according to claim 1, characterized in that, The method for constructing the ideal reference transmission curve includes: Using the observed reference rate as the slope and the start time of the corresponding transmission batch as the zero point, a function curve with time as the independent variable and the total amount of preceding load as the dependent variable is constructed as the ideal reference transmission curve. The ideal reference transmission curve shows a linear increase before the total amount of preceding load reaches the total amount of transmission batch load, and remains horizontal after reaching the total amount of transmission batch load.

5. The network data packet capture and analysis method for mobile terminals according to claim 1, characterized in that, The method for obtaining the cumulative lag at each timestamp in the transmission batch includes: For each payload packet location within a transmission batch, calculate the difference between the function value of that location in the ideal reference transmission curve and the actual amount of preceding received payload at that location to obtain the cumulative hysteresis at that location.

6. The network data packet capture and analysis method for mobile terminals according to claim 1, characterized in that, The method for obtaining the load congestion metric includes: For each transmission batch, if the time-domain lag centroid parameter is less than the preset suppression threshold, the preset retention coefficient is used as the suppression coefficient, and the product of the lag integral index and the suppression coefficient is used as the suppression lag degree; the ratio of the suppression lag degree to the total load of the transmission batch is used as the load congestion index of the transmission batch. Otherwise, the ratio of the lag integral index to the total load of the transmission batch is used as the load congestion index of the transmission batch.

7. The network data packet capture and analysis method for mobile terminals according to claim 1, characterized in that, The method of dynamically updating the baseline delay based on load congestion metrics to determine the congestion status of each transmission batch includes: The product of the current baseline delay and the preset baseline multiple is used as the judgment threshold. If the load congestion index of the current transmission batch is greater than the judgment threshold, the current transmission batch is judged to be in a congested state and the baseline delay is not updated. Otherwise, the current transmission batch is determined to be in a non-congested state, and the baseline delay is updated based on the current load congestion index using a weighted average.

8. The network data packet capture and analysis method for mobile terminals according to claim 1, characterized in that, The tiered early warning system, which combines the congestion status distribution of consecutive transmission batches in the current data stream, includes: The system counts the number of consecutive batches in the current data stream that are in a congested state. Based on the frequency and number of consecutive occurrences of congestion in the data stream, the system determines the warning level and outputs the corresponding warning information.

9. A network packet capture and analysis system for mobile terminals, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the network data packet capture and analysis method for mobile terminals as described in any one of claims 1 to 8.

Images