Classification model training method and device, traffic classification method and device, electronic equipment, storage medium and computer program product

Abstract

The invention provides a classification model training method and device, a traffic classification method and device, electronic equipment, a storage medium and a computer program product, and relates to the technical field of network security, and the method comprises the steps: obtaining a first neighborhood feature and a first key node in a first traffic graph structure; wherein the first neighborhood feature aggregates neighborhood information of a first node in the first flow graph structure; inputting a first neighborhood feature and an adjacent feature of the first flow graph structure into an initial classification model, determining an embedded feature of each first node for a first key node by using a first network layer of the initial classification model, and inputting the embedded feature and the adjacent feature into a next network layer for processing, the last network layer outputs the classification feature of each first node; and updating the initial classification model based on the loss determined by the classification feature of each first node, and determining a preset classification model.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a classification model training method, a traffic classification method, an apparatus, an electronic device, a storage medium, and a computer program product. Background Technology

[0002] In today's technological landscape, the integration of traffic classification technology and cloud computing is demonstrating profound implications. Traffic classification technology utilizes methods such as Deep Packet Inspection (DPI) and machine learning to accurately identify and classify various types of network traffic. This not only improves the intelligence and precision of network management but also enhances network security defenses, enabling timely responses by identifying malicious traffic. However, these algorithms still have some shortcomings when dealing with complex spatiotemporal data, especially in cloud computing scenarios where massive amounts of traffic are generated every second. Existing algorithms suffer from computational bottlenecks during processing, leading to lower accuracy. Summary of the Invention

[0003] This application provides a classification model training method, apparatus, electronic device, storage medium, and computer program product.

[0004] The technical solution of this application is implemented as follows: This application provides a classification model training method, including: Obtain the first neighborhood feature and the first key node in the first traffic graph structure; wherein, the first neighborhood feature aggregates the neighborhood information of the first node in the first traffic graph structure; The first neighborhood features and adjacency features of the first flow graph structure are input into the initial classification model. The first network layer of the initial classification model is used to determine the embedding features of each first node for the first key node. The embedding features and adjacency features are then input into the next network layer for processing until the last network layer outputs the classification features of each first node. The initial classification model is updated based on the loss determined by the classification features of each of the first nodes, and a preset classification model is determined.

[0005] In the above scheme, determining the embedding features of each first node for the first key node using the first network layer of the initial classification model includes: In the first neighborhood features, determine the sub-neighborhood features corresponding to each of the first key nodes; The embedding feature is determined based on each of the sub-neighborhood features, the first weight matrix of the first network layer, and the adjacency features.

[0006] In the above scheme, the first key node includes: a first influential node and a first important node; wherein, the first influential node is located in a key position in the first traffic graph structure; the first important node is an important node whose similarity to the corresponding first node is greater than a similarity threshold; The step of determining the embedding feature based on each of the sub-neighborhood features, the first weight matrix of the first network layer, and the adjacency features includes: Based on the adjacency features, determine the node distance between each first node and each first influence node; Based on the node distance, the sub-neighborhood features of each first influential node, and the first weight matrix, a first embedding feature of each first node is determined. Based on the sub-neighborhood features of each first important node and the first weight matrix, a second embedding feature of each first node is determined. The embedding feature is determined based on the combination of the first embedding feature and the second embedding feature.

[0007] In the above scheme, before obtaining the first neighborhood feature and the first key node in the first traffic graph structure, the method further includes: Identify the second critical node among multiple second nodes in the second flow graph structure; The second flow graph structure is segmented based on the second key node to determine multiple first flow graph structures; wherein, the first neighborhood feature is extracted from the second neighborhood feature corresponding to the second flow graph structure, and the first key node is extracted from the second key node.

[0008] This application also provides a traffic classification method, including: Get the current node description information corresponding to the current traffic node; Input the current node description information into a preset classification model to determine the corresponding traffic classification result.

[0009] The preset classification model is determined by updating the initial classification model based on the classification features corresponding to each first node in the first flow graph structure. The classification features are obtained by inputting the first neighborhood features and adjacency features into the initial classification model, using the first network layer of the initial classification model to determine the embedding features of each first node for the first key node, and inputting the embedding features and adjacency features into the next network layer for processing, until the output of the last network layer. The first neighborhood features aggregate the neighborhood information of the first node in the first flow graph structure.

[0010] This application embodiment also provides a classification model training device, including: The first information acquisition unit is used to acquire the first neighborhood features and the first key node in the first traffic graph structure; wherein, the first neighborhood features aggregate the neighborhood information of the first node in the first traffic graph structure; The training unit is used to input the first neighborhood features and adjacency features of the first traffic graph structure into the initial classification model, use the first network layer of the initial classification model to determine the embedding features of each first node for the first key node, and input the embedding features and adjacency features into the next network layer for processing, until the last network layer outputs the classification features of each first node. The training unit is used to update the initial classification model based on the loss determined by the classification features of each of the first nodes, and to determine the preset classification model.

[0011] This application also provides a flow classification device, including: The second information acquisition unit is used to acquire the current node description information corresponding to the current traffic node; The second determining unit is used to input the current node description information into a preset classification model to determine the corresponding traffic classification result.

[0012] The preset classification model is determined by updating the initial classification model based on the classification features corresponding to each first node in the first flow graph structure. The classification features are obtained by inputting the first neighborhood features and adjacency features into the initial classification model, using the first network layer of the initial classification model to determine the embedding features of each first node for the first key node, and inputting the embedding features and adjacency features into the next network layer for processing, until the output of the last network layer. The first neighborhood features aggregate the neighborhood information of the first node in the first flow graph structure.

[0013] This application also provides a first electronic device, including a first memory and a first processor. The first memory stores a computer program that can run on the first processor. When the first processor executes the computer program, it implements the steps in the classification model training method.

[0014] This application also provides a second electronic device, including a second memory and a second processor. The second memory stores a computer program that can run on the second processor. When the second processor executes the computer program, it implements the steps in the traffic classification method.

[0015] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a first processor, implements the steps in the classification model training method.

[0016] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a second processor, implements the steps in the traffic classification method.

[0017] This application also provides a computer program product, including a computer program that, when executed by a first processor, implements the steps in a classification model training method.

[0018] This application also provides a computer program product, including a computer program that, when executed by a second processor, implements the steps in the traffic classification method.

[0019] In this embodiment, first neighborhood features and first key nodes are obtained from a first traffic graph structure. The first neighborhood features aggregate the neighborhood information of the first nodes in the first traffic graph structure. The first neighborhood features and adjacency features of the first traffic graph structure are input into an initial classification model. The first network layer of the initial classification model determines the embedding features of each first node relative to the first key node. The embedding features and adjacency features are then input into the next network layer for processing until the last network layer outputs the classification features of each first node. The initial classification model is updated based on the loss determined by the classification features of each first node, thus determining a preset classification model. By training the initial classification model using the first neighborhood features and first key nodes of each first node's neighborhood information, the first key nodes of the first traffic graph structure can be better distinguished, and more homogeneous information in the first traffic graph structure can be integrated. This improves the representation quality of nodes in the network model during training, resulting in better training performance and a higher-performance preset classification model. Therefore, the higher-performance preset classification model leads to higher accuracy in traffic classification. Attached Figure Description

[0020] Figure 1 A flowchart illustrating the classification model training method provided in the embodiments of this application. Figure 1 ; Figure 2 A flowchart illustrating the classification model training method provided in the embodiments of this application. Figure 2 ; Figure 3 A flowchart illustrating the classification model training method provided in the embodiments of this application. Figure 3 ; Figure 4 This application provides an illustration of the effect of the classification model training method in its embodiments. Figure 1 ; Figure 5 Flowchart of the traffic classification method provided in the embodiments of this application Figure 1 ; Figure 6This is a schematic diagram of the structure of the classification model training device provided in the embodiments of this application; Figure 7 A schematic diagram of a hardware entity of the first electronic device provided in an embodiment of this application; Figure 8 This is a schematic diagram of the flow classification device provided in the embodiments of this application; Figure 9 This is a schematic diagram of a hardware entity of a second electronic device provided in an embodiment of this application.

[0021] It should be noted that the terms "first" and "second" mentioned above are only used to distinguish between different options and do not represent the degree of superiority or inferiority of the options or their priority in the implementation process. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application are further described in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] In this embodiment, the carrier for executing the classification model training method may include a server or terminal with corresponding data processing functions.

[0024] This application provides a classification model training method. Please refer to [link / reference]. Figure 1 This is a flowchart illustrating the classification model training method provided in the embodiments of this application. Figure 1 , will combine Figure 1 The steps shown are explained below: S101. Obtain the first neighborhood feature and the first key node in the first flow graph structure; wherein, the first neighborhood feature aggregates the neighborhood information of the first node in the first flow graph structure.

[0025] In this embodiment, a first neighborhood feature can be determined based on the neighborhood information of each node in the first flow graph structure. Furthermore, influential nodes and similar nodes of each first node are identified within the first flow graph structure to determine multiple first key nodes. The first neighborhood feature aggregates the neighborhood information of the first nodes in the first flow graph structure.

[0026] In this embodiment, multiple first flow graph structures can be obtained by segmenting the second flow graph structure. The first neighborhood features of the first flow graph structure are extracted from the second neighborhood features of the second flow graph structure. The first key node can be extracted from the second key node of the second flow graph structure. The method for determining the second neighborhood features of the second flow graph structure is the same as the method for determining the first neighborhood features. The method for determining the second key node of the second flow graph structure is the same as the method for determining the first key node. In this embodiment, the cutting of the second flow graph structure can be performed by any node or by the second key node.

[0027] In this embodiment, the second flow graph structure is similar to the first flow graph structure, where the nodes are network data flows. The second flow graph structure includes the first flow graph structure. A network flow graph can be defined as a mathematical structure G=(V,E,R), where each node represents a flow, and edges are created by connecting flows originating from or pointing to the same user, V={V1,V2,...,V...} N Let} be the set of nodes in the graph, E = {E1, E2, ..., E} M Let R = {R1, R2, ..., R} be the set of edges associated with V. M The attributes of the edges are represented by}. |V| and |E| represent the total number of nodes and the total number of edges, respectively. V can include basic information about the corresponding node (identifier, business type, data size, etc.), E can include basic information about the edges between the corresponding nodes, and R can include topological information about the corresponding connected nodes.

[0028] S102. Input the first neighborhood features and adjacency features of the first flow graph structure into the initial classification model, use the first network layer of the initial classification model to determine the embedding features of each first node for the first key node, and input the embedding features and adjacency features into the next network layer for processing, until the last network layer outputs the classification features of each first node.

[0029] In this embodiment, the first neighborhood features and the adjacency features of the first flow graph can be input into the initial classification model. The first network layer of the initial classification model, combined with the first key node and the first neighborhood features, determines the embedding features of each first node relative to the first key node. Each determined embedding feature and adjacency feature is then input into subsequent network layers for processing until the last network layer outputs the classification features of each first node.

[0030] In this embodiment, the initial classification model may include a Graph Convolution Neural Network (GCN). Other embodiments may include other models with the same functionality, which will not be described in detail here.

[0031] In this embodiment, after the second network layer of the initial classification model, the embedded features and adjacency features corresponding to influential nodes and similar nodes are processed, and the output of the last layer is used as the final representation vector of each first node. In this way, the model can not only aggregate the domain features of nodes, but also perform feature shifting for influential and important nodes, thereby generating more accurate and meaningful node representations. The input features of each next network layer in GCN are as shown in formula (1): Formula (1) in, This represents the adjacency matrix plus self-connections. yes The degree matrix of the diagonal nodes, This indicates that after convolution, the node is at the [missing information]. Layer embedding features, This is the first neighborhood feature. Indicates the first The layer's weight matrix, where σ is the activation function. This represents the input features of the (L+1)th layer.

[0032] S103. Update the initial classification model based on the loss determined by the classification features of each first node, and determine the preset classification model.

[0033] In this embodiment, after determining the classification features of each first node, the loss can be determined using the cross-entropy loss function based on the classification features of each first node. The parameters of the initial classification model are then updated based on the loss until a predetermined number of training iterations are reached or the function converges, at which point training stops, resulting in a preset classification model.

[0034] In this embodiment, the classification features of each node can be used This indicates that the computing node Category tags, represented as . It is calculated using a classification weight matrix, as shown in formula (2): Formula (2) in, Here is the learning matrix used for classification, where c represents the category. In the final result, the value in each column represents the probability that the current node belongs to category ci.

[0035] In this embodiment, the model uses the cross-entropy loss function as the training loss function. Since this embodiment focuses on semi-supervised node classification, we calculate the loss for all nodes, i.e., Equation (3): Formula (3) Where V represents the number of first nodes, and C represents the number of node categories. This represents the category label of the corresponding node i.

[0036] In this embodiment, first neighborhood features and first key nodes are obtained from a first traffic graph structure. The first neighborhood features aggregate the neighborhood information of the first nodes in the first traffic graph structure. The first neighborhood features and adjacency features of the first traffic graph structure are input into an initial classification model. The first network layer of the initial classification model determines the embedding features of each first node relative to the first key node. The embedding features and adjacency features are then input into the next network layer for processing until the last network layer outputs the classification features of each first node. The initial classification model is updated based on the loss determined by the classification features of each first node, thus determining a preset classification model. By training the initial classification model using the first neighborhood features and first key nodes of each first node's neighborhood information, the first key nodes of the first traffic graph structure can be better distinguished, and more homogeneous information in the first traffic graph structure can be integrated. This improves the representation quality of nodes in the network model during training, resulting in better training performance and a higher-performance preset classification model. Therefore, the higher-performance preset classification model leads to higher accuracy in traffic classification.

[0037] Please see Figure 2 This is a flowchart illustrating the classification model training method provided in the embodiments of this application. Figure 2 , Figure 1 S102 in the middle can also be implemented through S201 to S202, which will combine Figure 2 The steps shown are explained below: S201. Determine the sub-neighborhood features corresponding to each of the first key nodes in the first neighborhood features.

[0038] In this embodiment, the first neighborhood feature is a matrix determined based on the combination of the multi-hop neighbor degree sequences corresponding to each first node. Thus, based on the identifier of each first key node, the vector corresponding to the first key node can be extracted from the first neighborhood feature as the corresponding sub-neighborhood feature.

[0039] S202. Determine the embedding feature based on each of the sub-neighborhood features, the first weight matrix of the first network layer, and the adjacency features.

[0040] In this embodiment, the embedding feature can be determined by processing the mean of the sum of the products of each sub-neighborhood feature and the first weight matrix using an activation function. Alternatively, the distance between each first node and the first key node can be determined based on the adjacency feature, then the sum of the ratios of the product of each sub-neighborhood feature and the first weight matrix to that distance can be determined, the mean of that sum can be determined, and then the embedding feature can be determined by processing the mean using an activation function.

[0041] In this embodiment, the first key node includes: a first influential node and a first important node; wherein, the first influential node is located at a key position in the first traffic graph structure; the first important node is an important node whose similarity to the corresponding first node is greater than a similarity threshold. The process of determining the embedded features can also be implemented through the following steps S2021 to S2024: S2021. Based on the adjacency features, determine the node distance between each of the first nodes and each of the first influential nodes.

[0042] In this embodiment, the node distance between each first node and each influential node can be determined based on adjacency characteristics. Node distance represents the number of hops. Node distance can also be determined based on the first flow graph structure.

[0043] S2022. Based on the node distance, the sub-neighborhood features of each first influential node, and the first weight matrix, determine the first embedding feature of each first node.

[0044] In this embodiment, the product of the sub-neighborhood features and the first weight matrix can be determined; the mean of the sum of the ratios of the product to the distance to each node can be determined; and the first embedding feature can be determined based on the mean processed by the activation function.

[0045] For example, the first embedding feature can be calculated using formula (4).

[0046] Formula (4) in, Indicates the number of influential nodes. This represents the activation function (ReLU function). This represents the node distance between the first node i and the first influential node j. This represents the sub-neighborhood characteristics of the first influential node j. Let W = {W1, W2, ..., WL} be the first weight matrix. This represents the first embedding feature.

[0047] S2023. Based on the sub-neighborhood features of each first important node and the first weight matrix, determine the second embedding feature of each first node.

[0048] In this embodiment, the mean of the sum of the products of the sub-neighborhood features and the first weight matrix can be determined; the second embedding feature is determined based on the mean processed by the activation function.

[0049] In this embodiment, the second feature can be calculated using formula (5).

[0050] Formula (5) in, ={vi |sij>ε} represents an important node whose similarity value between node i and node j is greater than ε after calculation by the LRE algorithm. This represents the activation function (ReLU function). Represents the sub-neighborhood features of the first important node j. Let W = {W1, W2, ..., WL} be the first weight matrix. This represents the second embedding feature.

[0051] S2024. Determine the embedding feature based on the combination of the first embedding feature and the second embedding feature.

[0052] In this embodiment, the first embedding feature and the second embedding feature can be combined to determine the embedding feature.

[0053] In this embodiment, a first embedding feature and a second embedding feature are calculated using each sub-neighborhood feature, the first weight matrix of the first network layer, and the adjacency feature, respectively. The first and second embedding features are then combined to determine the final embedding feature. This allows the model to better distinguish the first key nodes of the first traffic graph structure and integrates more homogeneous information from the first traffic graph structure, thereby achieving better training results and obtaining a higher-performance preset classification model. Therefore, the higher-performance preset classification model also results in higher accuracy in traffic classification.

[0054] Please see Figure 3 This is a flowchart illustrating the classification model training method provided in the embodiments of this application. Figure 3 , will combine Figure 3 The steps shown are explained below: S301. Determine the second critical node among multiple second nodes in the first flow graph structure.

[0055] In this embodiment, influential nodes and similar nodes of each second node can be found based on the attribute information of each second node and the attributes of the edges in the second flow graph structure, thereby determining multiple second key nodes.

[0056] In this embodiment, existing research has found that influential nodes are widely distributed and occupy key positions in the graph. Such nodes can convey more global information than other nodes. Since influential nodes possess global invariance, we pre-determine a set of influential nodes using the VoteRank++ method. For convenience, we use the notation VI to represent the identified set of influential nodes.

[0057] In this embodiment, the structurally similar nodes of different nodes are not the same. We need to calculate the structurally similar nodes for each node. To do this, we use the Least Distance Error (LRE) algorithm to calculate the similarity matrix of all nodes. Then, we search for similar nodes for each node in the matrix, thereby generating an important node set Vs.

[0058] S302. Based on the second key node, the second flow graph structure is segmented to determine multiple first flow graph structures; wherein, the first neighborhood feature is extracted from the second neighborhood feature corresponding to the second flow graph structure, and the first key node is extracted from the second key node.

[0059] In this embodiment, multiple first flow graph structures can be determined by randomly walking and cutting through the identified influential nodes and important nodes of each node. Corresponding second neighborhood features can also be determined, and the first neighborhood features can be extracted from the second neighborhood features based on the node identifiers of the first flow graph structures, thus identifying the first key node in the first flow graph structure.

[0060] In this embodiment, existing GCN models are only suitable for testing on small graph datasets; processing large graph datasets is either impossible or inefficient. This is because GNN models are very complex, involving a large number of matrix operations, and their computational load increases exponentially with the size of the graph. Therefore, considering the rapid data generation rate in cloud computing scenarios, this system employs a distributed approach to handle the GCN computation process in order to address the impact of increased data volume on model processing efficiency. Figure 4The diagram illustrates this process. Important and influential nodes in the second flow graph structure 100 can be identified. Using these nodes, random sampling is performed on the graph model. Once a certain number of samples are obtained, the graph is divided into multiple first flow graph structures 200. Distributed training is then performed on the smaller graphs obtained from these divisions. Furthermore, if multiple computing resources are available, these model training processes can be conducted simultaneously.

[0061] In this embodiment, the method for determining the second neighborhood features of the second flow graph structure is as follows: In this embodiment, the multi-hop neighbor degree sequence of each first node can be determined based on the neighborhood information corresponding to each first node in the first traffic graph; and the neighborhood features can be determined based on each neighbor degree sequence.

[0062] In this embodiment, the second flow graph structure is G=(V,E), where V is the second set of nodes. Let be the set of edges, for any , get u Skip Neighbor Degree Sequence As shown in formula (6): Formula (6) in, Indicates the second node of The number of nodes with degree i among the hop neighbors. For vectors The length, or feature dimension, takes the value of the structure. The maximum value for moderate.

[0063] in, express of Jumping neighbors is moderate The number of nodes, For the feature dimension. Next, the node u's Layer sequences are combined as feature vectors As shown in formula (7): Formula (7) Finally, the feature matrix of the graph is obtained as shown in formula (8). This feature matrix can effectively aggregate the neighborhood information of each node in the graph: Formula (8) in, Represents the neighborhood feature matrix, This represents the number of nodes.

[0064] In this embodiment, the second flow graph structure is segmented by the second key node to obtain a first flow graph structure with a smaller data volume. Then, the first flow graph structure with a smaller data volume is used to train the preset classification model, which reduces the consumption of computing resources and thus improves the training efficiency of the preset classification model.

[0065] Please see Figure 5 The following is a flowchart illustrating the traffic classification method provided in the embodiments of this application. Figure 4 , will combine Figure 5 The steps shown are explained below: S401. Obtain the current node description information corresponding to the current traffic node.

[0066] In this embodiment, the node description information of the current traffic node can be obtained, which may include the corresponding attribute information, topology information and neighborhood information.

[0067] In this embodiment, S402. Input the current node description information into the preset classification model to determine the corresponding traffic classification result.

[0068] In this embodiment, the current node description information can be input into a preset classification model to determine the corresponding traffic classification result.

[0069] In this embodiment, the current node can be integrated into the traffic structure graph, and the entire structure graph can be input into the corresponding preset classification model to determine the traffic classification result corresponding to the current traffic node.

[0070] The preset classification model is determined by updating the initial classification model based on the classification features corresponding to each first node in the first flow graph structure. The classification features are obtained by inputting the first neighborhood features and adjacency features into the initial classification model, using the first network layer of the initial classification model to determine the embedding features of each first node for the first key node, and inputting the embedding features and adjacency features into the next network layer for processing, until the output of the last network layer. The first neighborhood features aggregate the neighborhood information of the first node in the first flow graph structure.

[0071] In this embodiment, by training the initial classification model using the first neighborhood features and first key nodes of each first node's neighborhood information, it is possible to better distinguish the first key nodes of the first traffic graph structure and integrate more homogeneous information from the first traffic graph structure. This improves the representation quality of nodes in the network model during training, thereby achieving better training results and obtaining a higher-performance preset classification model. Therefore, the higher-performance preset classification model also results in higher accuracy in traffic classification.

[0072] Please see Figure 6This is a schematic diagram of the structure of the classification model training device provided in the embodiments of this application.

[0073] This application embodiment also provides a classification model training device 600, including: a first information acquisition unit 601 and a training unit 602.

[0074] The first information acquisition unit 601 is used to acquire the first neighborhood features and the first key node in the first traffic graph structure; wherein, the first neighborhood features aggregate the neighborhood information of the first node in the first traffic graph structure; Training unit 602 is used to input the first neighborhood features and adjacency features of the first traffic graph structure into an initial classification model, use the first network layer of the initial classification model to determine the embedding features of each first node for the first key node, and input the embedding features and adjacency features into the next network layer for processing, until the last network layer outputs the classification features of each first node. Training unit 602 is used to update the initial classification model based on the loss determined by the classification features of each first node, and to determine a preset classification model.

[0075] In this embodiment, the training unit 602 in the classification model training device 600 is used to determine the sub-neighborhood features corresponding to each of the first key nodes in the first neighborhood features. The embedding feature is determined based on each of the sub-neighborhood features, the first weight matrix of the first network layer, and the adjacency features.

[0076] In this embodiment, the first key node includes: a first influential node and a first important node; wherein, the first influential node is located at a key position in the first traffic graph structure; the first important node is an important node whose similarity to the corresponding first node is greater than a similarity threshold; The training unit 602 in the classification model training device 600 is used to determine the node distance between each first node and each first influence node based on the adjacency features. Based on the node distance, the sub-neighborhood features of each first influential node, and the first weight matrix, a first embedding feature of each first node is determined. Based on the sub-neighborhood features of each first important node and the first weight matrix, a second embedding feature of each first node is determined. The embedding feature is determined based on the combination of the first embedding feature and the second embedding feature.

[0077] In this embodiment, the training unit 602 in the classification model training device 600 is used to determine the second key node among multiple second nodes in the second flow graph structure; The second flow graph structure is segmented based on the second key node to determine multiple first flow graph structures; wherein, the first neighborhood feature is extracted from the second neighborhood feature corresponding to the second flow graph structure, and the first key node is extracted from the second key node.

[0078] It should be noted that, in the embodiments of this application, if the above-described classification model training method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a classification model training device (which may be a personal computer, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a magnetic disk, or an optical disk. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0079] Correspondingly, embodiments of this application provide a computer-readable storage medium storing a computer program thereon, which, when executed by a first processor, implements the steps in the method of the classification model training device 600.

[0080] It should be noted that the descriptions of the storage medium and device embodiments above are similar to the descriptions of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0081] It should be noted that, Figure 7 A hardware entity schematic diagram of the first electronic device provided in the embodiments of this application, such as... Figure 7 As shown, this application embodiment provides a first electronic device 700, including a first memory 702 and a first processor 701. The first memory 702 stores a computer program that can run on the first processor 701. When the first processor 701 executes the program, it implements the steps in the above-described method, wherein; The first processor 701 typically controls the overall operation of the first electronic device 700.

[0082] The first memory 702 is configured to store instructions and applications executable by the first processor 701, and can also cache data to be processed or already processed by the first processor 701 and the various modules in the first electronic device 700 (e.g., image data, audio data, voice communication data and video communication data), which can be implemented by flash memory or random access memory (RAM).

[0083] Correspondingly, this application embodiment also provides a computer program product, including a computer program that can be executed by a first processor 701 of a first electronic device 700 to complete the steps in the method of the classification model training device 600.

[0084] Please see Figure 8 This is a schematic diagram of the flow classification device provided in the embodiments of this application.

[0085] This application embodiment also provides a traffic classification device 800, including: a second information acquisition unit 801 and a second determination unit 802.

[0086] The second information acquisition unit 801 is used to acquire the current node description information corresponding to the current traffic node; The second determining unit 802 is used to input the current node description information into a preset classification model to determine the corresponding traffic classification result.

[0087] The preset classification model is determined by updating the initial classification model based on the classification features corresponding to each first node in the first flow graph structure. The classification features are obtained by inputting the first neighborhood features and adjacency features into the initial classification model, using the first network layer of the initial classification model to determine the embedding features of each first node for the first key node, and inputting the embedding features and adjacency features into the next network layer for processing, until the output of the last network layer. The first neighborhood features aggregate the neighborhood information of the first node in the first flow graph structure.

[0088] Correspondingly, embodiments of this application provide a computer-readable storage medium storing a computer program thereon, which, when executed by a second processor, implements the steps in the method of the flow classification device 800.

[0089] It should be noted that the descriptions of the storage medium and device embodiments above are similar to the descriptions of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0090] It should be noted that, Figure 9This is a schematic diagram of a hardware entity of the second electronic device provided in an embodiment of this application, such as... Figure 9 As shown, this application embodiment provides a second electronic device 900, including a second memory 902 and a second processor 901. The second memory 902 stores a computer program that can run on the second processor 901. When the second processor 901 executes the program, it implements the steps in the above-described method, wherein; The second processor 901 typically controls the overall operation of the second electronic device 900.

[0091] The second memory 902 is configured to store instructions and applications executable by the second processor 901, and can also cache data to be processed or already processed by the second processor 901 and the various modules in the second electronic device 900 (e.g., image data, audio data, voice communication data and video communication data), which can be implemented by flash memory or random access memory (RAM).

[0092] Correspondingly, this application embodiment also provides a computer program product, including a computer program that can be executed by a second processor 901 of a second electronic device 900 to complete the steps in the method of the traffic classification device 800.

[0093] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A classification model training method, characterized in that, include: Obtain the first neighborhood feature and the first key node in the first traffic graph structure; wherein, the first neighborhood feature aggregates the neighborhood information of the first node in the first traffic graph structure; The first neighborhood features and adjacency features of the first flow graph structure are input into the initial classification model. The first network layer of the initial classification model is used to determine the embedding features of each first node for the first key node. The embedding features and adjacency features are then input into the next network layer for processing until the last network layer outputs the classification features of each first node. The initial classification model is updated based on the loss determined by the classification features of each of the first nodes, and a preset classification model is determined.

2. The classification model training method according to claim 1, characterized in that, The step of determining the embedding features of each first node for the first key node using the first network layer of the initial classification model includes: In the first neighborhood features, determine the sub-neighborhood features corresponding to each of the first key nodes; The embedding feature is determined based on each of the sub-neighborhood features, the first weight matrix of the first network layer, and the adjacency features.

3. The classification model training method according to claim 2, characterized in that, The first key node includes: a first influential node and a first important node; wherein, the first influential node is located in a key position in the first traffic graph structure; the first important node is an important node whose similarity to the corresponding first node is greater than a similarity threshold; The step of determining the embedding feature based on each of the sub-neighborhood features, the first weight matrix of the first network layer, and the adjacency features includes: Based on the adjacency features, determine the node distance between each first node and each first influence node; Based on the node distance, the sub-neighborhood features of each first influential node, and the first weight matrix, a first embedding feature of each first node is determined. Based on the sub-neighborhood features of each first important node and the first weight matrix, a second embedding feature of each first node is determined. The embedding feature is determined based on the combination of the first embedding feature and the second embedding feature.

4. The classification model training method according to any one of claims 1 to 3, characterized in that, Before obtaining the first neighborhood feature and the first key node in the first traffic graph structure, the method further includes: Identify the second critical node among multiple second nodes in the second flow graph structure; The second flow graph structure is segmented based on the second key node to determine multiple first flow graph structures; wherein, the first neighborhood feature is extracted from the second neighborhood feature corresponding to the second flow graph structure, and the first key node is extracted from the second key node.

5. A traffic classification method, characterized in that, include: Get the current node description information corresponding to the current traffic node; Input the current node description information into a preset classification model to determine the corresponding traffic classification result; The preset classification model is determined by updating the initial classification model based on the classification features corresponding to each first node in the first flow graph structure. The classification features are obtained by inputting the first neighborhood features and adjacency features into the initial classification model, using the first network layer of the initial classification model to determine the embedding features of each first node for the first key node, and inputting the embedding features and adjacency features into the next network layer for processing, until the output of the last network layer. The first neighborhood features aggregate the neighborhood information of the first node in the first flow graph structure.

6. A classification model training device, characterized in that, include: The first information acquisition unit is used to acquire the first neighborhood features and the first key node in the first traffic graph structure; wherein, the first neighborhood features aggregate the neighborhood information of the first node in the first traffic graph structure; The training unit is used to input the first neighborhood features and adjacency features of the first traffic graph structure into the initial classification model, use the first network layer of the initial classification model to determine the embedding features of each first node for the first key node, and input the embedding features and adjacency features into the next network layer for processing, until the last network layer outputs the classification features of each first node. The training unit is used to update the initial classification model based on the loss determined by the classification features of each of the first nodes, and to determine the preset classification model.

7. A flow classification device, characterized in that, include: The second information acquisition unit is used to acquire the current node description information corresponding to the current traffic node; The second determining unit is used to input the current node description information into a preset classification model to determine the corresponding traffic classification result; The preset classification model is determined by updating the initial classification model based on the classification features corresponding to each first node in the first flow graph structure. The classification features are obtained by inputting the first neighborhood features and adjacency features into the initial classification model, using the first network layer of the initial classification model to determine the embedding features of each first node for the first key node, and inputting the embedding features and adjacency features into the next network layer for processing, until the output of the last network layer. The first neighborhood features aggregate the neighborhood information of the first node in the first flow graph structure.

8. An electronic device, characterized in that, It includes a memory and a processor, the memory storing a computer program that can run on the processor, the processor executing the computer program to implement the steps of the method of any one of claims 1 to 4, or to implement the steps of the method of claim 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4, or the steps of the method according to claim 5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4, or the steps of the method according to claim 5.

Images