A method for in-line detection based on dynamic policy tuning and intelligent distribution

Abstract

This invention relates to the field of flow detection technology, specifically a flow detection method based on dynamic policy tuning and intelligent traffic splitting, comprising the following steps: collecting network latency, packet loss, and other indicators; dividing the detection dimensions; generating and deploying a five-tuple template cluster; establishing a template pool; collecting link and service data and normalizing it to generate feature vectors; matching templates and selecting the optimal configuration; extracting traffic features and encapsulating intent packets; pushing and generating traffic splitting instructions; executing traffic splitting and recording the trajectory and node indicators. In this invention, a reusable detection policy template pool is constructed to achieve sharing of similar traffic policies, significantly reducing the consumption of hardware resources such as ACLs, avoiding resource exhaustion leading to detection interruption under high-density services. Relying on dynamic policy tuning and intelligent traffic splitting, it can adapt to network status, service requirements, and device load in real time, while decoupling from deep QoS, improving cross-vendor device compatibility and deployment flexibility, and significantly improving the timeliness, accuracy, and resource utilization efficiency of flow detection.

Description

Technical Field

[0001] This invention relates to the field of flow detection technology, and in particular to a flow detection method based on dynamic strategy tuning and intelligent flow splitting. Background Technology

[0002] As a core technology for high-precision quality monitoring and fault location in the field of communication networks, in-stream detection can directly capture the actual transmission path of services by synchronously injecting detection packets and embedding special tags into real service traffic. It can accurately measure key network performance indicators such as latency, packet loss, and jitter, effectively solving the problem of inconsistency between traditional active detection technology and real traffic path. With its advantages of strong real-time performance, high measurement accuracy, and low intrusion into services, this technology has become the mainstream solution for network operation and maintenance and quality assurance in scenarios such as 5G, cloud-network convergence, and industrial internet. It is widely used in complex network environments such as multi-vendor equipment hybrid networking and cross-domain service transmission.

[0003] Patent CN119996249A describes a flow-following detection (IFIT) technology. This technology has the following drawbacks: First, hardware resources are a bottleneck. ACL resources are limited hardware resources with typically restricted capacity. ACL rules need to be configured individually for each detection flow, making it impossible to reduce resource consumption through reuse. This results in high ACL entry resource consumption. During peak periods of high-density business, ACL resources are quickly exhausted due to overload, causing new traffic monitoring to be interrupted. Second, the IFIT detection process uses the QoS module to complete policy generation and distribution, deeply binding the traffic detection function with the QoS control framework. The strong coupling between QoS and IFIT increases the complexity of the system. Incorrect QoS configuration may affect the normal operation of detection, and the deployment flexibility is insufficient, making it difficult to support adaptation to multiple vendors and device models, significantly limiting portability. Third, the process adopts a fixed mode of pre-configuration, policy generation, and finally policy distribution and execution. This is a static closed loop, lacking the ability to dynamically detect and respond to real-time indicators such as network congestion and sudden increases in packet loss rate, and cannot intelligently adapt to dynamic network environments. Summary of the Invention

[0004] To address the technical problems existing in the prior art, embodiments of the present invention provide a flow detection method based on dynamic strategy tuning and intelligent flow splitting, comprising the following steps: S1: Collect network latency, packet loss, congestion and security atomic-level measurement indicators, divide the detection dimensions, generate an initial template cluster of five-tuple structure, deploy the template cluster to the controller and network nodes, and establish a detection strategy template pool; S2: Obtain network device data flow priority, service type and traffic identifier, collect link bandwidth utilization, node CPU load and end-to-end latency, normalize heterogeneous data and generate context feature vectors. S3: Based on the context feature vector, match the template scene label in the detection strategy template pool, calculate the application matching degree, SLA matching degree, network state matching degree, hardware matching degree and resource cost value, and sum them by weight to obtain the template matching degree score. Filter the template with the highest score to obtain the optimal detection template configuration. S4: Parse the optimal detection template configuration to extract traffic features, orchestrate detection action parameters, encapsulate standardized execution intent packets, push intent packets to network devices through multiple channels, and generate intelligent traffic offloading execution instructions; S5: Call the intelligent traffic splitting execution command to parse the traffic intent ID, match traffic characteristics to execute the splitting action, bind the detection path session ID, record node execution indicators, and obtain detection execution trajectory data.

[0005] As a further aspect of the present invention, the specific steps of S1 are as follows: S101: Collect network latency, packet loss, congestion and security atomic-level measurement indicators, divide the detection dimensions, assign measurement indicator identifiers and coding rules, and generate a set of measurement indicator codes; S102: Based on the set of measurement index codes, match typical application scenarios, combine template identifiers, index subsets, priority weights, coding methods and scenario labels to generate five-tuple template cluster data; S103: Distribute the five-tuple template cluster data to the controller and network nodes, complete the template deployment and resource mapping, and establish a detection strategy template pool.

[0006] As a further aspect of the present invention, the initial template cluster of the five-tuple structure includes a template identifier, an indicator subset, a priority weight, an encoding method, and an applicable business scenario label.

[0007] As a further aspect of the present invention, the specific steps of S2 are as follows: S201: Obtain network device data flow priority, service type and traffic identifier, extract core feature fields of service flow, and generate basic traffic feature set; S202: Collect link bandwidth utilization, node CPU load and end-to-end latency, count node memory usage and queue depth, and generate a set of network status parameters. S203: Perform dimensionless transformation on the traffic basic feature set and the network state parameter set to unify the data dimensions and numerical ranges, and generate context feature vectors.

[0008] As a further aspect of the present invention, the specific steps of S3 are as follows: S301: Based on the context feature vector, match the scene labels in the detection strategy template pool, calculate the application matching degree and SLA matching degree, and generate the template adaptation basic score. S302: Calculate the network state matching degree, hardware matching degree and resource cost value corresponding to the template adaptation base score, perform a weighted summation operation, and generate a comprehensive template matching score; S303: Sort the template comprehensive matching scores in descending order of numerical value, select the detection configuration corresponding to the first score, and obtain the optimal detection template configuration.

[0009] As a further aspect of the present invention, the template matching score is obtained by weighted calculation of application matching score, SLA matching score, network status matching score, hardware matching score and resource overhead value, and the sum of all weight coefficients is 1.

[0010] As a further aspect of the present invention, the specific steps of S4 are as follows: S401: Parse the optimal detection template configuration, extract the protocol type, port range, and service quality tag fields, and generate a traffic classification feature set; S402: Adjust the detection granularity, sampling ratio and priority parameters based on the traffic classification feature set to complete the detection action orchestration and generate a set of detection action parameters; S403: Encapsulates the set of detected action parameters into an execution intent packet, pushes it to the network device through the control, data and event channels, and generates intelligent routing execution instructions.

[0011] As a further aspect of the present invention, the standardized execution intent package adopts a modular structure, including intent identity identifier, traffic feature matching set, atomic action topology graph, capability requirement declaration, lifecycle controller and security authentication module.

[0012] As a further aspect of the present invention, the specific steps of S5 are as follows: S501: Call the intelligent traffic splitting execution command, parse the traffic header intent ID, match the corresponding fields of the traffic classification feature set, and generate the traffic matching judgment result; S502: Based on the traffic matching judgment result, perform traffic splitting action, use distributed hash algorithm to generate path session identifier, and generate detection path binding identifier; S503: Collects data on processing time, output characteristics, and resource usage of each node, binds the detection path to the identifier for storage, and obtains the detection execution trajectory data.

[0013] As a further aspect of the present invention, the traffic redirection action includes full redirection, in-band telemetry, and intelligent mirroring.

[0014] Compared with the prior art, the advantages and positive effects of the present invention are as follows: In this invention, a reusable detection strategy template pool is constructed to achieve sharing of similar traffic strategies, significantly reducing the consumption of hardware resources such as ACLs, avoiding detection interruption caused by resource exhaustion under high-density business, and relying on dynamic strategy tuning and intelligent traffic splitting, it can adapt to network status, business needs and device load in real time, while decoupling from deep QoS, improving cross-vendor device compatibility and deployment flexibility, and significantly improving the timeliness, accuracy and resource utilization efficiency of flow detection. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a schematic diagram of the steps of the present invention. Detailed Implementation

[0017] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0018] In embodiments of the present invention, words such as "exemplarily," "for example," etc., are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0019] In the embodiments of this invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning. Similarly, the terms "of," "corresponding (relevant)," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning.

[0020] In this embodiment of the invention, sometimes a subscript such as W1 may be written in a non-subscript form such as W1. When the difference is not emphasized, the meaning they express is the same.

[0021] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0022] Please see Figure 1This invention provides a flow detection method based on dynamic strategy tuning and intelligent flow splitting, comprising the following steps: S1: Collect network latency, packet loss, congestion and security atomic-level measurement indicators, divide the detection dimensions, generate an initial template cluster of five-tuple structure, deploy the template cluster to the controller and network nodes, and establish a detection strategy template pool; The specific steps of S1 are as follows: S101: Collect network latency, packet loss, congestion and security atomic-level measurement indicators, divide the detection dimensions, assign measurement indicator identifiers and coding rules, and generate a set of measurement indicator codes; S102: Based on the set of measurement index codes, match typical application scenarios, combine template identifiers, index subsets, priority weights, coding methods and scenario labels to generate five-tuple template cluster data; S103: Distribute the five-tuple template cluster data to the controller and network nodes, complete template deployment and resource mapping, and establish a detection strategy template pool; The initial template cluster of the quintuple structure includes template identifier, indicator subset, priority weight, encoding method, and applicable business scenario label; Based on network observability requirements, latency, packet loss, congestion, and security-related measurement items are determined. The packet transmission time difference is obtained from network forwarding nodes to determine latency-related parameters. The ratio of the number of undelivered packets to the total number of packets within a unit time period is used to determine packet loss-related parameters. The link bandwidth utilization and queue backlog status are monitored to determine congestion-related parameters. The frequency of abnormal packet characteristics and unauthorized access behavior is identified to determine security-related parameters. The detection dimensions are divided into latency, packet loss, congestion, and security. Each type of atomic-level measurement indicator is assigned an independent identifier. The coding method is set according to the combination rule of fixed number of bits. All identifiers and corresponding codes are organized and collected to form a complete set of measurement indicator codes. Based on the set of measurement indicator codes, and in accordance with typical application scenarios such as video interaction, batch transmission, real-time control, and regular access, a corresponding combination of measurement indicators is matched for each scenario. A unique identifier is assigned to each template, and indicator codes suitable for the scenario are selected to form an indicator subset. Priority weights are determined according to the importance of the scenario and monitoring needs. The coding method is set according to a unified format, and each template is labeled with a tag corresponding to the business scenario. The template identifier, indicator subset, priority weight, coding method, and scenario tag are combined in a fixed structure to generate multiple sets of template data with a five-tuple structure. The multiple sets of template data are then aggregated to form an initial template cluster. All five-tuple template data in the initial template cluster are pushed to the network controller through the control channel, and then distributed to each network forwarding node by the controller. A dedicated storage area is set up inside the controller to classify and store the template data. The correspondence between template identifiers and local hardware resources is established in each network node to complete the loading and resource binding of template data at the node level. All templates deployed in the controller and each node are managed in a unified manner to form a detection strategy template pool that can be dynamically invoked.

[0023] S2: Obtain network device data flow priority, service type and traffic identifier, collect link bandwidth utilization, node CPU load and end-to-end latency, normalize heterogeneous data and generate context feature vectors. The specific steps of S2 are as follows: S201: Obtain network device data flow priority, service type and traffic identifier, extract core feature fields of service flow, and generate basic traffic feature set; S202: Collect link bandwidth utilization, node CPU load and end-to-end latency, count node memory usage and queue depth, and generate a set of network status parameters. S203: Perform a dimensionless transformation on the traffic basic feature set and the network state parameter set to unify the data dimensions and numerical ranges, and generate a context feature vector; The network device forwards the data stream, identifies the data stream objects flowing through nodes such as routers and switches, reads the priority marker field carried in the data stream header, identifies the business application type corresponding to the data stream, extracts the data stream-specific identification information, compares the priority marker field value with the preset level range, associates and matches the business application type with the scenario feature library, indexes the traffic identifier with the flow table entry, extracts the core feature fields related to priority, business type, and traffic identifier, and combines and arranges the above fields in a fixed format to form a structured traffic basic feature set; Network operation status parameters are obtained by collecting the ratio of the current transmission rate of the link to the total bandwidth of the link through the node's built-in monitoring components to obtain the bandwidth utilization value, reading the processor core occupancy ratio through the node's operating system interface to obtain the CPU load value, calculating the end-to-end transmission latency value through the difference of packet timestamps to obtain the memory usage value, calculating the ratio of the node's used memory space to the total space to obtain the memory usage value, and calculating the number of packets waiting to be processed in the forwarding queue to obtain the queue depth value. The bandwidth utilization, CPU load, end-to-end latency, memory usage, and queue depth are organized and collected according to parameter categories to form a complete set of network status parameters. The traffic basic feature set and network state parameter set are used to convert non-numerical feature fields in the feature set into corresponding values ​​through mapping rules. The different dimensional values ​​in the parameter set are linearly scaled according to the maximum and minimum values. All converted and scaled values ​​are uniformly adjusted to the same numerical range to eliminate the impact of dimensional and numerical magnitude differences on subsequent calculations. All data after dimensionless conversion are arranged and combined in a fixed-dimensional order to form a structured context feature vector that can be directly used for policy tuning.

[0024] S3: Based on the context feature vector, match the template scene label in the detection strategy template pool, calculate the application matching degree, SLA matching degree, network state matching degree, hardware matching degree and resource cost value, and sum them by weight to obtain the template matching degree score. Filter the template with the highest score to obtain the optimal detection template configuration. The specific steps for S3 are as follows: S301: Based on the context feature vector, match the scene labels in the detection strategy template pool, calculate the application matching degree and SLA matching degree, and generate the template adaptation basic score. S302: Calculate the network state matching degree, hardware matching degree and resource cost value corresponding to the template adaptation base score, perform a weighted summation operation, and generate a comprehensive template matching score; S303: Sort the template comprehensive matching scores in descending order of numerical value, select the detection configuration corresponding to the first score, and obtain the optimal detection template configuration; The template matching score is obtained by weighting the application matching score, SLA matching score, network status matching score, hardware matching score and resource cost value, and the sum of all weight coefficients is 1; Extract the business application type and service level information carried in the context feature vector, traverse the scene labels of all templates in the detection strategy template pool, compare the application type in the feature vector with the template scene label item by item to determine the correspondence between the two, read the content of the measurement indicator set contained in the template, retrieve the content of the predefined key performance indicators required for the current application type, calculate the number of intersection elements between the template indicator set and the key performance indicators, divide the number of intersection elements by the total number of key performance indicators to obtain the application matching degree value, read the service level parameter corresponding to the current business, retrieve the core network performance indicator set that needs to be continuously monitored under this level, traverse each indicator in the indicator set, determine whether the template supports the corresponding indicator, assign a specified value to the supported indicator, multiply each indicator value with the corresponding importance weight and sum them to obtain the SLA matching degree value, integrate the application matching degree value and the SLA matching degree value according to a fixed rule to generate the template adaptation base score; The current network operating state is transformed into a fixed-dimensional binary state vector. The capability vector parameters corresponding to the template are read, and the dot product of the capability vector and the state vector is calculated. The dot product result is divided by the sum of the total number of dimensions of the capability vector and the minimum compensation value to obtain the network state matching degree value. The functional support status, resource availability status, pipeline table entry matching status and configuration conflict status parameters of the target device are read. Each status parameter is multiplied by its corresponding weight and then added or subtracted to obtain the hardware matching degree value. The parameters of the amount of new resources required to enable the current template, the amount of resources already occupied by the device, and the upper limit of the total resource are read. The sum of the amount of new resources and the amount of resources already occupied is calculated and divided by the upper limit of the total resource. The smaller value between the calculated result and the specified value is taken and multiplied by the corresponding weight and then accumulated to obtain the resource cost value. The application matching degree, SLA matching degree, network state matching degree, and hardware matching degree are multiplied by their corresponding weights respectively. The multiplication results are added and then the product of resource cost and corresponding weight is subtracted. All weights are adjusted according to the operation and maintenance status and the sum is 1. The weighted summation operation is completed to generate the template comprehensive matching score. Collect the comprehensive matching scores of all templates into a score set, compare and sort the values ​​in the score set from largest to smallest, determine the score value at the top of the sort, locate the template object corresponding to the score value, read all detection-related parameters and execution rules carried by the template, organize the above parameters and rules into standardized configuration content, and obtain the optimal detection template configuration.

[0025] S4: Parse the optimal detection template configuration to extract traffic features, orchestrate detection action parameters, encapsulate standardized execution intent packets, push intent packets to network devices through multiple channels, and generate intelligent traffic offloading execution instructions; The specific steps of S4 are as follows: S401: Parse the optimal detection template configuration, extract the protocol type, port range, and service quality tag fields, and generate a traffic classification feature set; S402: Adjust the detection granularity, sampling ratio and priority parameters based on the traffic classification feature set to complete the detection action orchestration and generate a set of detection action parameters; S403: Encapsulates the set of detected action parameters into an execution intent packet, pushes it to the network device through the control, data and event channels, and generates intelligent routing execution instructions; The standardized execution intent package adopts a modular structure, including intent identity identifier, traffic feature matching set, atomic action topology graph, capability requirement declaration, lifecycle controller and security authentication module; Read the traffic characteristic-related parameters carried in the configuration, disassemble the protocol type field in the parameters, identify the network transmission protocol category corresponding to the field, extract the port range field recorded in the configuration, determine the start port and end port boundary corresponding to the field, retrieve the service quality mark field contained in the configuration, determine the service transmission level corresponding to the mark, organize the protocol type field, port range field, and service quality mark field in a unified format, remove redundant fields and invalid parameters, and combine the organized fields into a structured feature set to form a traffic classification feature set that can be used for flow matching; By combining real-time link bandwidth occupancy status and node resource load status, the transmission demand level of the corresponding service in the feature set is read. The detection granularity parameter is associated and matched with the service level. The detection granularity value of high-level services is increased, and the detection granularity value of low-level services is decreased. The sampling ratio parameter is adjusted according to the network load range. The sampling ratio value is reduced in high-load scenarios and the baseline sampling ratio value is maintained in normal-load scenarios. Priority parameters are set according to service importance and SLA level. The priority parameters are divided into multiple levels and assigned values. The adjusted detection granularity, sampling ratio, and priority parameters are collected in order. Conflicting parameters and abnormal parameters are removed to form a set of detection action parameters that can be directly issued and executed. A unique intent identifier is assigned to the parameter set, the traffic classification feature set is transformed into a standardized traffic feature matching set, the detection action is broken down into basic operations and an atomic action topology graph is constructed, a capability requirement declaration is generated according to the detection requirements, the effective duration and maximum forwarding hops of the intent packet are set to form a lifecycle controller, digital signatures and permission level information are added to form a security authentication module, the above modular content is combined and encapsulated into an execution intent packet according to a fixed structure, the intent packet is sent to the core network device for preloading through the southbound control channel, the intent packet digest is injected into the message extension header at the first hop access device, the intent packet notification is broadcast to the detection node through the message bus, the edge device is granted local traffic splitting decision authority, the network device parses the features and action parameters in the intent packet, generates a traffic splitting control command that can be directly executed, and completes the generation of intelligent traffic splitting execution command.

[0026] S5: Call the intelligent traffic splitting execution command to parse the traffic intent ID, match traffic characteristics to execute the splitting action, bind the detection path session ID, record node execution indicators, and obtain detection execution trajectory data; The specific steps of S5 are as follows: S501: Call the intelligent traffic splitting execution command, parse the traffic header intent ID, match the corresponding fields of the traffic classification feature set, and generate the traffic matching judgment result; S502: Based on the traffic matching judgment result, perform traffic splitting action, use distributed hash algorithm to generate path session identifier, and generate detection path binding identifier; S503: Collects data on processing time, output characteristics, and resource usage of each node, binds the detection path to the identifier for storage, and obtains detection execution trajectory data; The traffic redirection actions include full redirection, in-band telemetry, and intelligent mirroring; After invoking the intelligent traffic splitting execution command, the identification field is extracted from the traffic packet header. The identification field is then format-validated and its legality is determined. The protocol type, port range, and service quality mark related fields in the traffic classification feature set are read. The parsed intent ID is compared with the locally cached metadata. The actual features carried by the traffic are compared with the matching fields in the feature set one by one for equality determination. The protocol type field is compared for consistency, the port range field is compared for range attribution, and the service quality mark field is compared for level. All feature comparison results are then logically ANDed. Based on the result, a matching determination is output, generating a traffic matching determination result. Based on the traffic matching judgment result, the corresponding traffic splitting execution method is selected. When the judgment result is a match, the corresponding operation is executed according to the traffic splitting type. When executing full redirection, the traffic is forwarded to the specified detection service chain. When executing in-band telemetry, path performance data is collected through the protocol. When executing smart mirroring, a copy of the packet is copied and metadata is attached and sent to the detection node. A distributed hash algorithm is used to calculate the combination information of intent ID and traffic source address to generate a unique path session identifier. A two-way correspondence is established between the path session identifier and intent ID. The correspondence is written into the node's local mapping table to form a detection path binding identifier that can be identified across nodes. At the traffic processing node, the processing time data of a single action is collected, the feature parameter data obtained from traffic detection is extracted, and the processor, memory, and table entry resource usage data during the node's execution of traffic splitting and detection are statistically analyzed. The collected processing time, output features, and resource usage data are associated and bound with the detection path binding identifier. The bound data is written to the local storage area in chronological order and uploaded to the centralized storage repository through an encrypted channel. The same path binding identifier data uploaded by multiple nodes are aggregated and organized to form complete and traceable detection execution trajectory data.

[0027] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A flow detection method based on dynamic strategy tuning and intelligent flow splitting, characterized in that, Includes the following steps: S1: Collect network latency, packet loss, congestion and security atomic-level measurement indicators, divide the detection dimensions, generate an initial template cluster of five-tuple structure, deploy the template cluster to the controller and network nodes, and establish a detection strategy template pool; S2: Obtain network device data flow priority, service type and traffic identifier, collect link bandwidth utilization, node CPU load and end-to-end latency, normalize heterogeneous data and generate context feature vectors. S3: Based on the context feature vector, match the template scene label in the detection strategy template pool, calculate the application matching degree, SLA matching degree, network state matching degree, hardware matching degree and resource cost value, and sum them by weight to obtain the template matching degree score. Filter the template with the highest score to obtain the optimal detection template configuration. S4: Parse the optimal detection template configuration to extract traffic features, orchestrate detection action parameters, encapsulate standardized execution intent packets, push intent packets to network devices through multiple channels, and generate intelligent traffic offloading execution instructions; S5: Call the intelligent traffic splitting execution command to parse the traffic intent ID, match traffic characteristics to execute the splitting action, bind the detection path session ID, record node execution indicators, and obtain detection execution trajectory data.

2. The flow detection method based on dynamic strategy tuning and intelligent flow splitting according to claim 1, characterized in that, The specific steps of S1 are as follows: S101: Collect network latency, packet loss, congestion and security atomic-level measurement indicators, divide the detection dimensions, assign measurement indicator identifiers and coding rules, and generate a set of measurement indicator codes; S102: Based on the set of measurement index codes, match typical application scenarios, combine template identifiers, index subsets, priority weights, coding methods and scenario labels to generate five-tuple template cluster data; S103: Distribute the five-tuple template cluster data to the controller and network nodes, complete the template deployment and resource mapping, and establish a detection strategy template pool.

3. The flow detection method based on dynamic strategy tuning and intelligent flow splitting according to claim 2, characterized in that, The initial template cluster of the five-tuple structure includes template identifier, indicator subset, priority weight, encoding method, and applicable business scenario label.

4. The flow detection method based on dynamic strategy tuning and intelligent flow splitting according to claim 3, characterized in that, The specific steps of S2 are as follows: S201: Obtain network device data flow priority, service type and traffic identifier, extract core feature fields of service flow, and generate basic traffic feature set; S202: Collect link bandwidth utilization, node CPU load and end-to-end latency, count node memory usage and queue depth, and generate a set of network status parameters. S203: Perform dimensionless transformation on the traffic basic feature set and the network state parameter set to unify the data dimensions and numerical ranges, and generate context feature vectors.

5. The flow detection method based on dynamic strategy tuning and intelligent flow splitting according to claim 4, characterized in that, The specific steps of S3 are as follows: S301: Based on the context feature vector, match the scene labels in the detection strategy template pool, calculate the application matching degree and SLA matching degree, and generate the template adaptation basic score. S302: Calculate the network state matching degree, hardware matching degree and resource cost value corresponding to the template adaptation base score, perform a weighted summation operation, and generate a comprehensive template matching score; S303: Sort the template comprehensive matching scores in descending order of numerical value, select the detection configuration corresponding to the first score, and obtain the optimal detection template configuration.

6. The flow detection method based on dynamic strategy tuning and intelligent flow splitting according to claim 5, characterized in that, The template matching score is obtained by weighted calculation of application matching, SLA matching, network status matching, hardware matching and resource overhead value, and the sum of all weight coefficients is 1.

7. The flow detection method based on dynamic strategy tuning and intelligent flow splitting according to claim 6, characterized in that, The specific steps of S4 are as follows: S401: Parse the optimal detection template configuration, extract the protocol type, port range, and service quality tag fields, and generate a traffic classification feature set; S402: Adjust the detection granularity, sampling ratio and priority parameters based on the traffic classification feature set to complete the detection action orchestration and generate a set of detection action parameters; S403: Encapsulates the set of detected action parameters into an execution intent packet, pushes it to the network device through the control, data and event channels, and generates intelligent routing execution instructions.

8. The flow detection method based on dynamic strategy tuning and intelligent flow splitting according to claim 7, characterized in that, The standardized execution intent package adopts a modular structure, including intent identity identifier, traffic feature matching set, atomic action topology graph, capability requirement declaration, lifecycle controller and security authentication module.

9. The flow detection method based on dynamic strategy tuning and intelligent flow splitting according to claim 8, characterized in that, The specific steps of S5 are as follows: S501: Call the intelligent traffic splitting execution command, parse the traffic header intent ID, match the corresponding fields of the traffic classification feature set, and generate the traffic matching judgment result; S502: Based on the traffic matching judgment result, perform traffic splitting action, use distributed hash algorithm to generate path session identifier, and generate detection path binding identifier; S503: Collects data on processing time, output characteristics, and resource usage of each node, binds the detection path to the identifier for storage, and obtains the detection execution trajectory data.

10. The flow detection method based on dynamic strategy tuning and intelligent flow splitting according to claim 9, characterized in that, The traffic redirection actions include full redirection, in-band telemetry, and intelligent mirroring.

Images