Programmable data plane high-intensity traffic response method and system based on feature distribution
By extracting multi-dimensional traffic features from edge network devices and performing lightweight rule updates, the problem of poor adaptability under high-intensity traffic is solved, achieving efficient and adaptive traffic response and improving the response accuracy and efficiency of network security defense.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- UNIV OF JINAN
- Filing Date
- 2026-06-02
- Publication Date
- 2026-07-10
AI Technical Summary
Existing technologies struggle to achieve efficient and adaptive traffic response on edge network devices under high-intensity, high-volume attacks. Traditional defense systems suffer from performance bottlenecks, and deep learning models face difficulties in deployment on resource-constrained hardware.
A high-intensity flow response method based on feature distribution is adopted. By extracting multidimensional features of the flow and matching them with existing rules, outliers are marked, and clustering is performed by sampling at regular intervals to generate lightweight new rules to handle high-intensity flow. Combined with the collaborative architecture of data plane and control plane, linear speed processing and dynamic adaptation are achieved.
It effectively reduces the computational resource requirements for high-intensity traffic processing on programmable edge network devices, achieves line-speed response and intelligent adaptation, improves the response accuracy and efficiency of network security defense systems, has a certain degree of interpretability, and helps in the establishment of threat intelligence.
Smart Images
Figure CN122372332A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network traffic classification technology, specifically relating to a programmable data plane high-intensity traffic response method and system based on feature distribution. Background Technology
[0002] The statements herein provide only background information in relation to this invention and do not necessarily constitute prior art.
[0003] With the rapid development of network technology, the principle of "quantitative change leading to qualitative change" is becoming increasingly evident in the field of network security. Currently, the explosive growth of network traffic and the increasing complexity of attack methods pose significant challenges to the prevention of high-intensity, high-volume attacks (such as DDoS). In particular, when this massive traffic requires real-time management and response at the edge network, the performance bottlenecks of traditional defense systems become increasingly apparent.
[0004] In recent years, programmable network hardware, represented by P4 switches and DPDK accelerators, has emerged as a powerful force, providing the hardware foundation for high-performance network security. Researchers have begun exploring the decentralization of complex protection logic to edge programmable devices to reduce the burden on backend servers. However, in high-traffic environments, balancing hardware processing efficiency with the adaptability of defense solutions remains a common challenge that urgently needs to be addressed.
[0005] Currently, existing technologies mainly fall into two categories: one is based on static rules, such as traditional firewalls and ACLs. These can utilize the line-rate performance of the programmable data plane, but due to the static nature of the rules, they are difficult to perceive the dynamic evolution of traffic distribution and exhibit significant lag when facing feature drift or variable attacks. The other category is based on machine learning, which achieves some degree of adaptability, but still has the following shortcomings: First, the "centroid" model formed by algorithms such as K-Means relies on the distance to the centroid to judge new traffic. This single-point distance judgment is difficult to accurately depict the complex distribution of traffic, especially when the traffic cluster is non-spherical, resulting in a high false positive rate. Second, model updates usually lack an effective triggering mechanism, which may lead to frequent and ineffective computational overhead or failure to respond to traffic mutations in a timely manner. Third, the rules generated by the model are often "black boxes" (such as the weights of a neural network) or abstract centroids, lacking interpretability and hindering the establishment of threat intelligence. More importantly, these complex algorithms are difficult to deploy directly on resource-constrained programmable data plane hardware, usually requiring all traffic to be sent to backend servers for processing, making it impossible to achieve line-rate response.
[0006] Therefore, how to build a lightweight modeling and response framework that can maintain hardware line-speed throughput and adapt to traffic distribution is a technical problem that urgently needs to be solved in the field of high-performance network security. Summary of the Invention
[0007] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method and system for responding to high-intensity traffic based on feature distribution of programmable data plane. This method can capture the current traffic distribution pattern on programmable edge network devices and process high-intensity traffic accordingly, effectively reducing the computing resource requirements for high-intensity traffic processing to the range that programmable edge network devices can handle, and achieving an organic combination of line-rate processing and dynamic adaptation.
[0008] To achieve the above objectives, the present invention is implemented through the following technical solution: In a first aspect, the technical solution of the present invention provides a programmable data surface high-intensity flow response method based on feature distribution, including: Extract multidimensional features from a predetermined number of data packets in the stream; The multidimensional features are matched with existing rules in the data surface. If the multidimensional features match an existing rule, the flow is processed according to the processing measures corresponding to the matched rule. If the multidimensional features do not match an existing rule, the flow is marked as an outlier and recorded. The system periodically samples the processed stream. If the proportion of outliers in the sampled points exceeds a preset threshold, it sends an update request to the control plane and uploads the sampled point data. Based on the update request, a density-based clustering algorithm is used to cluster the uploaded sampling point data, and the boundary of each cluster is extracted based on the clustering results as a new rule; Based on the spatial characteristics of the new rules and the meta-features of the sampling points contained therein, the corresponding processing measures are determined comprehensively. Issue new rules and corresponding processing measures, and update the data surface rule set.
[0009] In at least one embodiment, the matching rule for matching multidimensional features with existing rules of the data surface is specifically as follows:
[0010] In the formula, Representing the multidimensional features of a flow; Representing high-dimensional rectangle rules; This indicates an indicator function, which is 1 if the condition is true and 0 otherwise. The number of dimensions representing a multidimensional feature; and This represents the boundary of each cluster in multidimensional space.
[0011] In at least one embodiment, the processing measures are specifically one or more of service, rate limiting, and dropping.
[0012] In at least one embodiment, a density-based clustering algorithm is used to cluster the uploaded sampling point data, specifically as follows:
[0013] In the formula, Represents the set of sampling points; This represents the neighborhood radius of each point in the DBSCAN algorithm; This represents the minimum number of samples in the neighborhood of a point that becomes a core point in the DBSCAN algorithm. This represents the clustering results. , Indicates the number of clusters. , This represents all elements partitioned by the density-based clustering algorithm. Flow feature points of cluster number 1.
[0014] In at least one embodiment, the rule update formula is specifically expressed as:
[0015] In the formula, Indicates clustering results The dimensions of all features in the dataset; and This represents the boundary of each cluster in multidimensional space. , .
[0016] In at least one embodiment, the processing measures corresponding to the new rule are comprehensively determined, specifically as follows:
[0017] In the formula, This represents the meta-feature evaluation algorithm; Representation spatial feature evaluation algorithm; Representation of high-dimensional rectangle rules Meta-features; Representation of high-dimensional rectangle rules Spatial characteristics.
[0018] In at least one embodiment, the meta-feature is specifically a statistic within a high-dimensional rectangular rule, including one or more of quantity, density, and transformation rate.
[0019] In at least one embodiment, extracting multidimensional features of a predetermined number of data packets from a flow specifically includes: defining multiple data packets with the same source, destination IP, and port and the same protocol as a flow; statistically analyzing the data packets of the flow under normal conditions, and taking a predetermined number of data packets from the flow to extract multidimensional features of the flow.
[0020] In at least one embodiment, new rules and their corresponding processing measures are issued to update the data plane rule set. Specifically, this includes: converting the high-dimensional rectangle with the formulated processing measures into new rules, and sending the new rules and their corresponding processing measures together with the update completion signal to the data plane. The data plane responds to the collected streams according to the new rule set.
[0021] Secondly, the technical solution of the present invention also provides a programmable data plane high-intensity flow response system based on feature distribution, including a data plane module and a control plane module; The data plane module is configured to: extract multidimensional features from a predetermined number of data packets in the stream; match the multidimensional features with existing rules in the data plane; if the multidimensional features match an existing rule, process the stream according to the corresponding processing measures; if the multidimensional features do not match an existing rule, mark the stream as an outlier and record it; periodically sample the processed stream; if the proportion of outliers in the sampled points exceeds a preset threshold, send an update request to the control plane and upload the sampled point data. The control plane module is configured to: cluster the uploaded sampling point data using a density-based clustering algorithm based on update requests; extract the boundary of each cluster based on the clustering results as a new rule; comprehensively determine the processing measures corresponding to the new rule based on the spatial features of the new rule and the meta-features of the sampling points contained within it; issue the new rule and its corresponding processing measures, and update the data plane rule set.
[0022] The beneficial effects of the above-described technical solution of the present invention are as follows: 1) The high-intensity traffic response method based on feature distribution of the present invention adopts an architecture that coordinates the programmable data plane and the control plane. It can capture the current traffic distribution pattern on the programmable edge network device and process high-intensity traffic accordingly. It effectively reduces the computing resource requirements for high-intensity traffic processing to the range that the programmable edge network device can bear. It solves the contradiction that traditional defense schemes have poor adaptability under high-intensity traffic and that deep learning models are difficult to deploy on resource-constrained hardware.
[0023] 2) This invention achieves a clear division of labor between the data plane and the control plane. The data plane performs only extremely lightweight matching to determine whether the sampling points are within the rectangle, perfectly matching the line-speed processing capabilities of programmable hardware. Complex clustering, analysis, and decision-making tasks are handled by the control plane, ensuring both response speed and intelligent adaptation. Furthermore, the method possesses a degree of interpretability, which is helpful for establishing threat intelligence.
[0024] 3) This invention uses an outlier ratio-triggered update mechanism to initiate control plane re-clustering only when the flow distribution changes significantly, avoiding frequent and invalid calculations, reducing system overhead, and ensuring timely response. Attached Figure Description
[0025] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.
[0026] Figure 1 This is a schematic flowchart of the high-intensity flow response method based on feature distribution for programmable data planes disclosed in Embodiment 1 of the present invention; Figure 2 This is a schematic diagram of the visualization results of the high-dimensional rectangular rules obtained by clustering traffic sampling points as disclosed in Embodiment 1 of the present invention; Figure 3 This is a visualization diagram of the high-dimensional rectangular rule generated in Embodiment 1 of the present invention in response to subsequent traffic; wherein, (a) is a visualization diagram of the performance of the high-dimensional rectangular rule in the clustering time slice, (b) is a visualization diagram of the performance of the high-dimensional rectangular rule in one time slice after clustering, (c) is a visualization diagram of the performance of the high-dimensional rectangular rule in two time slices after clustering, and (d) is a visualization diagram of the performance of the high-dimensional rectangular rule in three time slices after clustering. Figure 4 This is a schematic diagram of the arrival and service curves of attack traffic and benign traffic within multiple time slices disclosed in Embodiment 1 of the present invention; wherein, (a) is a schematic diagram of the arrival and service curves of attack traffic and benign traffic when the DrDoS attack type is DNS, (b) is a schematic diagram of the arrival and service curves of attack traffic and benign traffic when the DrDoS attack type is NTP, and (c) is a schematic diagram of the arrival and service curves of attack traffic and benign traffic when the attack type is Syn. Detailed Implementation
[0027] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.
[0028] As described in the background section, the purpose of this invention is to overcome the shortcomings of the prior art and provide a programmable data plane high-intensity traffic response method and system based on feature distribution. This method can capture the current traffic distribution pattern on a programmable edge network device and process high-intensity traffic accordingly, effectively reducing the computational resource requirements for high-intensity traffic processing to the acceptable range of the programmable edge network device, and achieving an organic combination of line-rate processing and dynamic adaptation.
[0029] Example 1 In a typical embodiment of the present invention, this embodiment discloses a programmable data plane high-intensity flow response method based on feature distribution, specifically including the following steps: S1. Extract multidimensional features of a predetermined number of data packets from the stream; S2. Match the multidimensional features with the existing rules of the data surface. If the multidimensional features match the existing rules, process the flow according to the processing measures corresponding to the matched rules. If the multidimensional features do not match the existing rules, mark the flow as an outlier and record it. S3. Periodically sample the processed stream. If the proportion of outliers in the sampled points exceeds a preset threshold, send an update request to the control plane and upload the sampled point data. S4. Based on the update request, a density-based clustering algorithm is used to cluster the uploaded sampling point data, and the boundary of each cluster is extracted based on the clustering results as a new rule; S5. Based on the spatial characteristics of the new rules and the meta-features of the sampling points contained therein, comprehensively determine the processing measures corresponding to the new rules; S6. Issue new rules and their corresponding processing measures, and update the data surface rule set.
[0030] The above-mentioned high-intensity flow response method based on feature distribution programmable data plane will be described in detail below with reference to specific implementation methods.
[0031] S1. Extract multidimensional features of a predetermined number of data packets from the stream.
[0032] In this step, we define that the current source and destination IPs and ports are the same and that the protocols are the same. Each data packet constitutes a stream, represented as follows: .
[0033] Data plane convection under normal conditions The data packets are statistically analyzed, and the data before the flow is retrieved is taken. One data packet is used to extract the stream. 3D features, represented as: ,in, and and Dimensional features can be set by the user according to the task.
[0034] S2. Match the multidimensional features with the existing rules of the data surface. If the multidimensional features match the existing rules, process the flow according to the processing measures corresponding to the matched rules. If the multidimensional features do not match the existing rules, mark the flow as an outlier and record it.
[0035] In this step, the extracted stream is used as the basis for... Using dimensional features as feature points, the data surface extracts the stream according to a preset matching formula. of The dimensional features and rural areas are matched with the rule set currently stored in the data plane to check the flow. of Whether the feature matches an existing rule.
[0036] Specifically, rule set It is a set of high-dimensional rectangles, including one or more high-dimensional rectangle rules, specifically represented as:
[0037] In the formula, Indicates the cluster number; This indicates the number of clusters in the previous round of clustering; The high-dimensional rectangle rule is represented as:
[0038] In the formula, and This represents the boundary of each cluster in multidimensional space. Each high-dimensional rectangular rule... A corresponding handling measure Among them, the handling measures This includes, but is not limited to, service restrictions, rate limiting, or data loss.
[0039] The preset matching formula is specifically expressed as follows:
[0040] In the formula, This indicates an indicator function that returns 1 if the condition is true, and 0 otherwise.
[0041] According to the matching formula above, if the feature point matches any high-dimensional rectangle rule... Then, according to the high-dimensional rectangle rule Corresponding handling measures Process the stream If the feature points do not match any high-dimensional rectangle rules, then the flow will be blocked. Mark them as outliers and record them.
[0042] S3. Periodically sample the processed stream. If the proportion of outliers in the sampled points exceeds a preset threshold, send an update request to the control plane and upload the sampled point data.
[0043] In this step, the data plane quantitatively and periodically samples the processed streams based on demand and computing resources, and calculates the proportion of streams marked as outliers in the sampled points. If this proportion does not reach a set threshold, the stream judgment continues (i.e., steps S1 to S3 are executed again). The set threshold can be set according to the scenario.
[0044] If the proportion of flows marked as outliers in the sampled points exceeds a preset threshold, the rule update mechanism is triggered. At this time, the data plane sends an update request signal to the control plane and uploads the sampled point data of this sampling to the control plane.
[0045] S4. Based on the update request, a density-based clustering algorithm is used to cluster the uploaded sampling point data, and the boundary of each cluster is extracted based on the clustering results as a new rule.
[0046] In this step, after receiving the update request signal, the control plane uses a density-based clustering algorithm (i.e., the DBSCAN algorithm) to efficiently cluster the sampled points.
[0047] Specifically, let's set Given a set of sampling points, a density-based clustering algorithm is used to cluster the samples, specifically as follows:
[0048] In the formula, This represents the neighborhood radius of each point in the DBSCAN algorithm; This represents the minimum number of samples in the neighborhood of a point that becomes a core point in the DBSCAN algorithm. This represents the clustering results. , Indicates the number of clusters. , This represents all data partitioned by the density-based clustering algorithm (DBSCAN algorithm) into... Flow feature points of cluster number.
[0049] Take clustering results All features Dimension, represented as;
[0050] The rule update formula is specifically expressed as follows:
[0051] In the formula, Indicates clustering results The dimensions of all features in the dataset; and This represents the boundary of each cluster in multidimensional space. , .
[0052] The boundaries of each cluster are extracted based on the clustering results to obtain high-dimensional rectangular rules, which are then used as new rules for matching flow feature points. The visualization results of the high-dimensional rectangular rules obtained from clustering flow sampling points are shown below. Figure 2 As shown.
[0053] S5. Based on the spatial characteristics of the new rules and the meta-features of the sampling points contained therein, comprehensively determine the processing measures corresponding to the new rules.
[0054] In this step, the control surface, based on the spatial feature classification of the high-dimensional rectangle rule in the feature space and the meta-feature scores of the sampling points contained within the high-dimensional rectangle, formulates corresponding processing measures for the high-dimensional rectangle rule, specifically as follows:
[0055] In the formula, This represents the meta-feature evaluation algorithm. The two represent spatial feature evaluation algorithms, which can be set by the user according to the specific task. Representation of high-dimensional rectangle rules The meta-features are high-dimensional rectangular rules. Internal statistics, such as quantity, density, and transformation rate, can be selected and set by the user according to the specific task. Representation of high-dimensional rectangle rules Spatial characteristics, namely high-dimensional rectangular rules itself.
[0056] S6. Issue new rules and their corresponding processing measures, and update the data surface rule set.
[0057] In this step, the control plane converts the high-dimensional rectangles with predefined processing measures into new rules, and sends the new rules and their corresponding processing measures, along with an update completion signal, to the data plane. The data plane then responds to the collected flow according to the new rule set (i.e., executes step S1). The new high-dimensional rectangle rules should correspond to the visualization results of subsequent traffic, such as... Figure 3 As shown, Figure 3 (a) is a visualization of the high-dimensional rectangle rule in the clustering time slice; (b) is a visualization of the high-dimensional rectangle rule in the one time slice after clustering; (c) is a visualization of the high-dimensional rectangle rule in the two time slices after clustering; and (d) is a visualization of the high-dimensional rectangle rule in the three time slices after clustering.
[0058] Traditional methods, when dealing with high-intensity malicious traffic, often suffer from lagging defense rules or excessive computational costs leading to response delays in deep learning models due to the difficulty in perceiving the dynamic evolution of traffic distribution. This embodiment addresses this issue by employing a feature-distribution-based programmable data plane high-intensity traffic response method. This method utilizes a programmable data plane to extract multi-dimensional traffic features in real time and combines this with adaptive distribution modeling to generate lightweight response rules. This ensures accurate decoupling of malicious features from normal traffic in high-intensity traffic environments, enabling edge devices to maintain line-rate throughput while adaptively controlling variant attacks, thus improving the response accuracy of the network security defense system.
[0059] To demonstrate the feasibility of this method, this embodiment uses the CICDDoS2019 attack dataset as an example for verification. The CICDDoS2019 attack dataset covers 12 common DDoS attack types (such as NTP, DNS, LDAP reflection attacks, etc.) that reflect the modern network environment. It includes benign traffic in the attack traffic and provides complete traffic data based on PCAP files.
[0060] The experimental objective was to classify DDoS attack traffic into benign traffic. In the experiment, a Python script was used to extract the first two lines of each flow from the original PCAP file. The characteristics of each data packet are set up in this experiment based on a real-world scenario. The Pkt Len Max (maximum packet length) and IAT Max (maximum intra-terminal arrival time) after processing by the mapping function are selected as features. The mapping function for the maximum packet length is as follows: The mapping function for the maximum IAT is: .
[0061] The experiment has now yielded usable results. Characteristics of DDoS attack flows and benign flows in data packets. This experiment sets up: ; in, For the present The percentage of interior points in the total number of points. For the present The high-dimensional volume, For the present The rate of change of the number of interior points.
[0062]
[0063] in This is a decision tree with a height of 4.
[0064] The dataset is classified according to simulated real-world attack traffic using this method. Figure 4The curves for benign attack flows (TP), benign attack flows (FP), total benign attack flows (TP+FN), and total attack flows (TN+FP) are shown for several attacks. Figure 4 In the diagram, (a) shows the arrival and service curves of attack traffic and benign traffic when the DrDoS attack type is DNS; (b) shows the arrival and service curves of attack traffic and benign traffic when the DrDoS attack type is NTP; and (c) shows the arrival and service curves of attack traffic and benign traffic when the attack type is Syn. The traffic classification results are evaluated using four metrics: accuracy, precision, recall, and F1 score. The calculation methods for these four metrics are as follows:
[0065]
[0066]
[0067]
[0068] Wherein, TP is the number of benign flows classified as benign flows, TN is the number of attack flows classified as attack flows, FP is the number of attack flows classified as benign flows, and FN is the number of benign flows classified as attack flows.
[0069] The segmentation accuracy, precision, recall, and F1 score of this method in different land features are shown in Table 1.
[0070] Table 1. Segmentation accuracy, precision, recall, and F1 score for different land cover types.
[0071] As shown in Table 1, this method achieves good results on various DDoS attack traffic datasets. In particular, the recall rate, which represents the rate at which benign traffic is allowed to pass, indicates that this method can minimize packet loss in the network environment under attack, effectively reducing the packet loss rate.
[0072] Example 2 In a typical embodiment of the present invention, this embodiment discloses a programmable data plane high-intensity flow response system based on feature distribution, including a data plane module and a control plane module; The data plane module is configured to: extract multidimensional features from a predetermined number of data packets in the stream; match the multidimensional features with existing rules in the data plane; if the multidimensional features match an existing rule, process the stream according to the corresponding processing measures; if the multidimensional features do not match an existing rule, mark the stream as an outlier and record it; periodically sample the processed stream; if the proportion of outliers in the sampled points exceeds a preset threshold, send an update request to the control plane and upload the sampled point data. The control plane module is configured to: cluster the uploaded sampling point data using a density-based clustering algorithm based on update requests; extract the boundary of each cluster based on the clustering results as a new rule; comprehensively determine the processing measures corresponding to the new rule based on the spatial features of the new rule and the meta-features of the sampling points contained within it; issue the new rule and its corresponding processing measures, and update the data plane rule set.
[0073] Specifically, in the data plane module, define the current source and destination IPs and ports as having the same IP and protocol. Each data packet constitutes a stream, represented as follows: .
[0074] Data plane convection under normal conditions The data packets are statistically analyzed, and the data before the flow is retrieved is taken. One data packet is used to extract the stream. 3D features, represented as: ,in, and and Dimensional features can be set by the user according to the task.
[0075] With the extracted stream Using dimensional features as feature points, the data surface extracts the stream according to a preset matching formula. of The dimensional features and rural areas are matched with the rule set currently stored in the data plane to check the flow. of Whether the feature matches an existing rule.
[0076] Specifically, rule set It is a set of high-dimensional rectangles, including one or more high-dimensional rectangle rules, specifically represented as:
[0077] In the formula, Indicates the cluster number; This indicates the number of clusters in the previous round of clustering; The high-dimensional rectangle rule is represented as:
[0078] In the formula, and This represents the boundary of each cluster in multidimensional space. Each high-dimensional rectangular rule... A corresponding handling measure Among them, the handling measures This includes, but is not limited to, service restrictions, rate limiting, or data loss.
[0079] The preset matching formula is specifically expressed as follows:
[0080] In the formula, This indicates an indicator function that returns 1 if the condition is true, and 0 otherwise.
[0081] According to the matching formula above, if the feature point matches any high-dimensional rectangle rule... Then, according to the high-dimensional rectangle rule Corresponding handling measures Process the stream If the feature points do not match any high-dimensional rectangle rules, then the flow will be blocked. Mark them as outliers and record them.
[0082] The data plane samples processed streams quantitatively and periodically based on demand and computing resources, and calculates the proportion of streams marked as outliers in the sampled points. If the proportion does not reach the set threshold, the stream judgment continues (i.e., steps S1 to S3 are continued).
[0083] If the proportion of flows marked as outliers in the sampled points exceeds a preset threshold, the rule update mechanism is triggered. At this time, the data plane sends an update request signal to the control plane and uploads the sampled point data of this sampling to the control plane.
[0084] In the control plane module, after receiving the update request signal, a density-based clustering algorithm (i.e., the DBSCAN algorithm) is used to efficiently cluster the sampled points.
[0085] Specifically, let's set Given a set of sampling points, a density-based clustering algorithm is used to cluster the samples, specifically as follows:
[0086] In the formula, This represents the neighborhood radius of each point in the DBSCAN algorithm; This represents the minimum number of samples in the neighborhood of a point that becomes a core point in the DBSCAN algorithm. This represents the clustering results. , Indicates the number of clusters. , This represents all data partitioned by the density-based clustering algorithm (DBSCAN algorithm) into... Flow feature points of cluster number 1.
[0087] Take clustering results All features Dimension, represented as;
[0088] The rule update formula is specifically expressed as follows:
[0089] In the formula, Indicates clustering results The dimensions of all features in the dataset; and This represents the boundary of each cluster in multidimensional space. , .
[0090] Based on the clustering results, the boundary of each cluster is extracted to obtain a high-dimensional rectangle rule, which is then used as a new rule for matching flow feature points.
[0091] Based on the spatial feature classification of the high-dimensional rectangle rule in the feature space and the meta-feature scores of the sampling points contained within the high-dimensional rectangle, a corresponding processing measure is formulated for the high-dimensional rectangle rule, specifically expressed as follows:
[0092] In the formula, This represents the meta-feature evaluation algorithm. The two represent spatial feature evaluation algorithms, which can be set by the user according to the specific task. Representation of high-dimensional rectangle rules The meta-features are high-dimensional rectangular rules. Internal statistics, such as quantity, density, and transformation rate, can be selected and set by the user according to the specific task. Representation of high-dimensional rectangle rules Spatial characteristics, namely high-dimensional rectangular rules itself.
[0093] The high-dimensional rectangle with the established processing measures is converted into new rules, and the new rules and their corresponding processing measures are sent to the data plane along with the update completion signal. The data plane responds to the collected streams according to the new rule set.
[0094] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A high-intensity flow response method based on a programmable data surface with characteristic distribution, characterized in that, include: Extract multidimensional features from a predetermined number of data packets in the stream; The multidimensional features are matched with existing rules in the data surface. If the multidimensional features match an existing rule, the flow is processed according to the processing measures corresponding to the matched rule. If the multidimensional features do not match an existing rule, the flow is marked as an outlier and recorded. The system periodically samples the processed stream. If the proportion of outliers in the sampled points exceeds a preset threshold, it sends an update request to the control plane and uploads the sampled point data. Based on the update request, a density-based clustering algorithm is used to cluster the uploaded sampling point data, and the boundary of each cluster is extracted based on the clustering results as a new rule; Based on the spatial characteristics of the new rules and the meta-features of the sampling points contained therein, the corresponding processing measures are determined comprehensively. Issue new rules and corresponding processing measures, and update the data surface rule set.
2. The high-intensity flow response method based on feature distribution of programmable data surface as described in claim 1, characterized in that, The specific matching rules for matching multidimensional features with existing rules in the data surface are as follows: In the formula, Representing the multidimensional features of a flow; Representing high-dimensional rectangle rules; This indicates an indicator function, which is 1 if the condition is true and 0 otherwise. The number of dimensions representing a multidimensional feature; and This represents the boundary of each cluster in multidimensional space.
3. The high-intensity flow response method based on feature distribution of programmable data surface as described in claim 1, characterized in that, The specific handling measures include one or more of the following: service, traffic restriction, and discarding.
4. The high-intensity flow response method based on feature distribution programmable data surface as described in claim 1, characterized in that, A density-based clustering algorithm is used to cluster the uploaded sampling point data, specifically as follows: In the formula, Represents the set of sampling points; This represents the neighborhood radius of each point in the DBSCAN algorithm; This represents the minimum number of samples in the neighborhood of a point that becomes a core point in the DBSCAN algorithm. This represents the clustering results. , Indicates the number of clusters. , This represents all elements partitioned by the density-based clustering algorithm. Flow feature points of cluster number 1.
5. The high-intensity flow response method based on feature distribution of programmable data surface as described in claim 4, characterized in that, The rule update formula is specifically expressed as follows: In the formula, Indicates clustering results The dimensions of all features in the dataset; and This represents the boundary of each cluster in multidimensional space. , .
6. The high-intensity flow response method based on feature distribution of programmable data surface as described in claim 1, characterized in that, The corresponding handling measures for the new rules are determined comprehensively and are specifically expressed as follows: In the formula, This represents the meta-feature evaluation algorithm; Representation spatial feature evaluation algorithm; Representation of high-dimensional rectangle rules Meta-features; Representation of high-dimensional rectangle rules Spatial characteristics.
7. The high-intensity flow response method based on feature distribution of programmable data surface as described in claim 6, characterized in that, Meta-features are specifically statistical quantities within high-dimensional rectangular rules, including one or more of quantity, density, and transformation rate.
8. The high-intensity flow response method based on feature distribution of programmable data surface as described in claim 1, characterized in that, Extracting multidimensional features from a predetermined number of packets in a flow specifically includes: defining multiple packets with the same source, destination IP, port, and protocol as a flow; statistically analyzing the packets in the flow under normal conditions, and taking a predetermined number of packets from the flow to extract multidimensional features.
9. The programmable data surface high-intensity flow response method based on feature distribution as described in claim 1, characterized in that, The new rules and their corresponding processing measures are issued to update the data plane rule set. Specifically, this includes converting the high-dimensional rectangles with the established processing measures into new rules, and sending the new rules and their corresponding processing measures along with the update completion signal to the data plane. The data plane then responds to the collected streams according to the new rule set.
10. A programmable data surface high-intensity flow response system based on feature distribution, characterized in that, Includes a data plane module and a control plane module; The data plane module is configured to extract multidimensional features from a predetermined number of packets in the stream; The multidimensional features are matched with existing rules in the data plane. If the multidimensional features match an existing rule, the flow is processed according to the corresponding processing measures of the matched rule. If the multidimensional features do not match an existing rule, the flow is marked as an outlier and recorded. The processed flow is sampled periodically. If the proportion of outliers in the sampled points exceeds a preset threshold, an update request is sent to the control plane and the sampled point data is uploaded. The control plane module is configured to: cluster the uploaded sampling point data using a density-based clustering algorithm based on update requests; extract the boundary of each cluster based on the clustering results as a new rule; and comprehensively determine the processing measures corresponding to the new rule based on the spatial features of the new rule and the meta-features of the sampling points contained within it. Issue new rules and corresponding processing measures, and update the data surface rule set.