Traffic classification method and device based on fog cloud intelligent cooperation, equipment and storage medium

Abstract

The application belongs to the technical field of Internet of Things, and discloses a traffic classification method and device based on fog cloud intelligent cooperation, equipment and storage medium. The application firstly classifies the original traffic through a preset fog end model, then inputs the obtained initial traffic classification result into a preset fog cloud cooperation model, the preset fog cloud cooperation model is trained based on the variance driving coefficient between the preset cloud end model and the preset fog end model, can guide the preset fog cloud cooperation model to focus on the high-variance-class traffic based on the variance driving coefficient, thereby screening the recheck traffic from the original traffic, can accurately perform recheck traffic screening, realize high-risk traffic priority recheck, low-risk traffic local processing, and classify the recheck traffic through the preset cloud end model, thereby improving the accuracy of traffic classification.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) technology, and in particular to a traffic classification method, apparatus, device, and storage medium based on fog cloud intelligent collaboration. Background Technology

[0002] Currently, in the field of IoT intrusion detection, distributed decision-making techniques for re-inspection traffic screening mainly fall into three categories. Fixed threshold decision-making sets a uniform confidence threshold; all traffic with a confidence level below the threshold from the fog-end model is uploaded to the cloud for re-inspection, without distinguishing between category differences or the risk of false positives. Attack type decision-making only uploads traffic identified as an attack by the fog-end model to the cloud, allowing benign traffic directly; it relies entirely on the classification results of the fog-end model for decision-making, ignoring the issue of insufficient fog-end model accuracy. Random sampling decision-making randomly selects a portion of the fog-end model's output results for cloud re-inspection to calibrate the fog-end model; it lacks targeted screening logic and cannot focus on high-risk, falsely identified traffic. These re-inspection traffic screening methods suffer from high risks of false positives and false negatives, leading to low accuracy in IoT intrusion detection. Summary of the Invention

[0003] The main purpose of this application is to provide a traffic classification method, device, equipment and storage medium based on fog cloud intelligent collaboration, which aims to solve the technical problem of how to accurately perform traffic screening and thus improve the accuracy of traffic classification.

[0004] To achieve the above objectives, this application provides a traffic classification method based on fog-cloud intelligent collaboration, which includes the following steps: Obtain the raw traffic corresponding to the IoT terminal; The original traffic is classified by a preset fog terminal model to obtain the initial traffic classification result; The initial traffic classification results are input into the preset fog-cloud collaborative model to obtain the re-inspection traffic in the original traffic. The preset fog-cloud collaborative model is trained based on the variance driving coefficient between the preset cloud model and the preset fog terminal model. The re-inspection traffic is classified using a preset cloud model to obtain the target traffic classification result.

[0005] Optionally, before inputting the initial traffic classification result into a preset fog-cloud collaborative model to obtain the re-examined traffic in the original traffic, the method further includes: Determine the variance driving coefficients between the preset cloud model and the preset fog model based on traffic samples; The sample-level coefficients are determined based on the variance driving coefficients and the sample category labels corresponding to the traffic samples; A loss function is constructed based on the sample-level coefficients, and the initial fog-cloud collaborative model is trained based on the loss function to obtain the pre-trained fog-cloud collaborative model.

[0006] Optionally, determining the variance driving coefficients between the preset cloud model and the preset fog model based on traffic samples includes: Determine the sample classification result corresponding to the traffic sample; For any category in the sample classification results, determine the cloud accuracy of that category on the preset cloud model and the fog accuracy on the preset fog model; The variance driving coefficients between the preset cloud model and the preset fog model are determined based on the cloud accuracy and the fog accuracy.

[0007] Optionally, determining the variance driving coefficients between the preset cloud model and the preset fog model based on the cloud accuracy and the fog accuracy includes: Calculate the accuracy difference between the cloud-based accuracy and the fog-based accuracy; The variance driving coefficients between the preset cloud model and the preset fog model are calculated based on the accuracy difference and the calibration isolation factor.

[0008] Optionally, constructing the loss function based on the sample-level coefficients includes: Determine the re-inspection decision label and re-inspection prediction probability corresponding to the traffic sample; A loss function is constructed based on the sample-level coefficients, the re-inspection decision label, and the re-inspection prediction probability.

[0009] Optionally, determining the re-inspection decision label corresponding to the traffic sample includes: An isolation interval is established based on the calibration isolation factor, and a retest interval is determined based on the isolation interval and the confidence threshold. Determine the confidence level corresponding to the sample classification result; The re-inspection decision label corresponding to the traffic sample is determined based on the confidence level, the variance driving coefficient, and the re-inspection interval.

[0010] Optionally, determining the re-inspection decision label corresponding to the traffic sample includes: An isolation interval is established based on the calibration isolation factor, and a retest interval is determined based on the isolation interval and the confidence threshold. Determine the confidence level corresponding to the sample classification result; The re-inspection decision label corresponding to the traffic sample is determined based on the confidence level, the variance driving coefficient, and the re-inspection interval.

[0011] Optionally, determining the re-inspection decision label corresponding to the traffic sample based on the confidence level, the variance driving coefficient, and the re-inspection interval includes: Determine the maximum and minimum values ​​corresponding to the re-inspection interval; If the confidence level is greater than or equal to the maximum value and the variance driving coefficient is greater than or equal to the maximum value, the re-inspection decision label corresponding to the traffic sample is determined to be the non-re-inspection label; If the confidence level is less than or equal to the minimum value and the variance driving coefficient is less than or equal to the minimum value, the re-examination decision label corresponding to the traffic sample is determined as the re-examination label; If the confidence level is within the re-examination interval and the variance driving coefficient is within the re-examination interval, and the sample-level coefficient is less than a preset threshold, then the re-examination decision label corresponding to the traffic sample is determined as the re-examination label.

[0012] Furthermore, to achieve the above objectives, this application also provides a traffic classification device based on fog-cloud intelligent collaboration, the traffic classification device based on fog-cloud intelligent collaboration comprising: The traffic acquisition module is used to acquire the raw traffic corresponding to the IoT terminal; The traffic classification module is used to classify the original traffic using a preset fog terminal model to obtain an initial traffic classification result. The traffic filtering module is used to input the initial traffic classification results into the preset fog cloud collaborative model to obtain the re-examination traffic in the original traffic. The preset fog cloud collaborative model is trained based on the variance driving coefficient between the preset cloud model and the preset fog terminal model. The traffic classification module is also used to classify the re-inspection traffic using a preset cloud model to obtain the target traffic classification result.

[0013] Furthermore, to achieve the above objectives, this application also proposes a traffic classification device based on fog-cloud intelligent collaboration. The traffic classification device based on fog-cloud intelligent collaboration includes: a memory, a processor, and a computer program stored in the memory and executable on the processor. The computer program is configured to implement the steps of the traffic classification method based on fog-cloud intelligent collaboration as described above.

[0014] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the traffic classification method based on fog cloud intelligent collaboration as described above.

[0015] This application obtains the raw traffic corresponding to IoT terminals, then classifies the raw traffic using a preset fog-end model to obtain initial traffic classification results. These initial classification results are then input into a preset fog-cloud collaborative model to obtain re-inspection traffic from the raw traffic. The preset fog-cloud collaborative model is trained based on the variance driving coefficients between a preset cloud model and a preset fog-end model. Finally, the preset cloud model classifies the re-inspection traffic to obtain the target traffic classification results. This application first classifies the raw traffic using a preset fog-end model, then inputs the obtained initial traffic classification results into the preset fog-cloud collaborative model. The preset fog-cloud collaborative model, trained based on the variance driving coefficients between the preset cloud model and the preset fog-end model, guides the preset fog-cloud collaborative model to focus on traffic of high variance categories based on the variance driving coefficients, thereby filtering re-inspection traffic from the raw traffic. This enables accurate re-inspection traffic filtering, prioritizing high-risk traffic for re-inspection and processing low-risk traffic locally. Furthermore, the preset cloud model classifies the re-inspection traffic, thus improving the accuracy of traffic classification. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the first embodiment of the traffic classification method based on fog cloud intelligent collaboration in this application; Figure 2 This is a flowchart illustrating the second embodiment of the traffic classification method based on fog cloud intelligent collaboration in this application; Figure 3 This is a structural block diagram of the first embodiment of the traffic classification device based on fog cloud intelligent collaboration of this application; Figure 4 This is a schematic diagram of the structure of a traffic classification device based on fog cloud intelligent collaboration in the hardware operating environment involved in the embodiments of this application.

[0019] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0021] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0022] The main solution of this application embodiment is: to obtain the original traffic corresponding to the IoT terminal; to classify the original traffic using a preset fog terminal model to obtain an initial traffic classification result; to input the initial traffic classification result into a preset fog cloud collaborative model to obtain the re-inspection traffic in the original traffic, wherein the preset fog cloud collaborative model is trained based on the variance driving coefficient between the preset cloud model and the preset fog terminal model; and to classify the re-inspection traffic using the preset cloud model to obtain a target traffic classification result.

[0023] Currently, in the field of IoT intrusion detection, distributed decision-making techniques for re-inspection traffic screening mainly fall into three categories. Fixed threshold decision-making sets a uniform confidence threshold; all traffic with a confidence level below the threshold from the fog-end model is uploaded to the cloud for re-inspection, without distinguishing between category differences or the risk of false positives. Attack type decision-making only uploads traffic identified as an attack by the fog-end model to the cloud, allowing benign traffic directly; it relies entirely on the classification results of the fog-end model for decision-making, ignoring the issue of insufficient fog-end model accuracy. Random sampling decision-making randomly selects a portion of the fog-end model's output results for cloud re-inspection to calibrate the fog-end model; it lacks targeted screening logic and cannot focus on high-risk, falsely identified traffic. These re-inspection traffic screening methods suffer from high risks of false positives and false negatives, leading to low accuracy in IoT intrusion detection.

[0024] This application obtains the raw traffic corresponding to IoT terminals, then classifies the raw traffic using a preset fog-end model to obtain initial traffic classification results. These initial classification results are then input into a preset fog-cloud collaborative model to obtain re-inspection traffic from the raw traffic. The preset fog-cloud collaborative model is trained based on the variance driving coefficients between a preset cloud model and a preset fog-end model. Finally, the preset cloud model classifies the re-inspection traffic to obtain the target traffic classification results. This application first classifies the raw traffic using a preset fog-end model, then inputs the obtained initial traffic classification results into the preset fog-cloud collaborative model. The preset fog-cloud collaborative model, trained based on the variance driving coefficients between the preset cloud model and the preset fog-end model, guides the preset fog-cloud collaborative model to focus on traffic of high variance categories based on the variance driving coefficients, thereby filtering re-inspection traffic from the raw traffic. This enables accurate re-inspection traffic filtering, prioritizing high-risk traffic for re-inspection and processing low-risk traffic locally. Furthermore, the preset cloud model classifies the re-inspection traffic, thus improving the accuracy of traffic classification.

[0025] It should be noted that the executing entity of this application can be a computing service device with data processing, network communication, and program execution functions, such as a computer, or an electronic device capable of performing the above functions, such as a traffic classification device based on fog-cloud intelligent collaboration. The following description uses a traffic classification device based on fog-cloud intelligent collaboration as an example to illustrate this embodiment and the following embodiments.

[0026] Based on this, embodiments of this application provide a traffic classification method based on fog cloud intelligent collaboration, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the traffic classification method based on fog cloud intelligent collaboration in this application.

[0027] In this embodiment, the traffic classification method based on fog cloud intelligent collaboration includes the following steps: Step S10: Obtain the raw traffic corresponding to the IoT terminal.

[0028] Understandably, Fog Cloud Intelligent Collaboration is a distributed computing paradigm that achieves an optimal balance between low latency, low bandwidth consumption, and high detection accuracy by deploying lightweight models (FM) on fog nodes for rapid initial classification, deploying high-precision models (CM) on the cloud for complex sample re-examination, and introducing intelligent decision gateways (FCM) to dynamically determine whether traffic should be processed locally or uploaded to the cloud.

[0029] It should be understood that IoT terminals may include smart cameras, smart home devices, etc. Raw traffic refers to unprocessed, complete network data packets sent by IoT terminals. It includes not only the actual data content (payload) sent by the IoT terminal, but also header information of the data link layer, network layer, and transport layer (such as source / destination IP, MAC address, port number, protocol type, etc.).

[0030] Step S20: Classify the original traffic using a preset fog terminal model to obtain the initial traffic classification result.

[0031] In practical implementation, the pre-trained fog model (FM) refers to a pre-trained fog model. The fog model is a lightweight model deployed on fog computing nodes, such as edge gateways, routers, or local servers, like MobileNetV3, TinyBERT, or EfficientNet-Lite. Using the pre-trained fog model, raw traffic can be classified to obtain initial traffic classification results, which may include normal categories, attack categories, etc.

[0032] Step S30: Input the initial traffic classification result into the preset fog-cloud collaborative model to obtain the re-inspection traffic in the original traffic. The preset fog-cloud collaborative model is trained based on the variance driving coefficient between the preset cloud model and the preset fog terminal model.

[0033] Understandably, the preset fog-cloud collaborative model refers to a pre-trained fog-cloud collaborative model. The initial traffic classification results are input into the preset fog-cloud collaborative model, and the output results can be traffic re-inspection labels in the original traffic, i.e. whether re-inspection is required. If so, the corresponding re-inspection traffic is filtered out from the original traffic.

[0034] In this implementation, the preset fog-cloud collaborative model is trained based on the variance-driven coefficients between the preset cloud model and the preset fog terminal model. The variance-driven coefficients characterize the degree of misjudgment risk; a high misjudgment risk, such as from niche attacks, results in a large variance-driven coefficient, while a low misjudgment risk, such as from normal traffic, results in a small variance-driven coefficient. The variance-driven coefficients can be obtained based on the classification accuracy of the preset cloud model and the preset fog terminal model. A loss function can be constructed based on these coefficients to train the initial fog-cloud collaborative model, which can be an XGBoost model, a lightweight MLP model, etc. By introducing the preset fog-cloud collaborative model, the re-detection rate for high-variance categories is increased to over 95%, the re-detection rate for low-variance categories is reduced to below 5%, the proportion of re-detected traffic decreases from 25% to 15%, and bandwidth consumption is reduced by 50%.

[0035] Step S40: Classify the re-inspection traffic using a preset cloud model to obtain the target traffic classification result.

[0036] It should be understood that the preset cloud model refers to a pre-trained cloud model. A cloud model is a large-scale, high-performance machine learning model deployed on a central cloud server, such as ResNet-50, BERT-Base, or VGG-16. Inputting the re-inspection traffic into the preset cloud model allows for further classification of the re-inspection traffic, yielding accurate target traffic classification results.

[0037] This embodiment acquires the raw traffic corresponding to IoT terminals, then classifies the raw traffic using a preset fog-end model to obtain initial traffic classification results. These initial classification results are then input into a preset fog-cloud collaborative model to obtain re-inspection traffic from the raw traffic. The preset fog-cloud collaborative model is trained based on the variance driving coefficients between a preset cloud model and a preset fog-end model. Finally, the preset cloud model classifies the re-inspection traffic to obtain the target traffic classification results. This embodiment first classifies the raw traffic using a preset fog-end model, then inputs the initial traffic classification results into the preset fog-cloud collaborative model. The preset fog-cloud collaborative model, trained based on the variance driving coefficients between the preset cloud model and the preset fog-end model, guides the preset fog-cloud collaborative model to focus on traffic of high variance categories based on the variance driving coefficients, thereby filtering re-inspection traffic from the raw traffic. This allows for accurate re-inspection traffic filtering, prioritizing high-risk traffic for re-inspection and processing low-risk traffic locally. Furthermore, the preset cloud model classifies the re-inspection traffic, thus improving the accuracy of traffic classification.

[0038] refer to Figure 2 , Figure 2 This is a flowchart illustrating the second embodiment of the traffic classification method based on fog cloud intelligent collaboration in this application.

[0039] Based on the first embodiment described above, in this embodiment, before step S30, the method further includes: Step S01: Determine the variance driving coefficients between the preset cloud model and the preset fog model based on the traffic samples.

[0040] Understandably, the traffic samples can be from the CICIDS-2017 dataset. For all traffic samples in this dataset, corresponding categories can be labeled as the sample classification results. Then, based on the sample classification results, the variance driving coefficients between the preset cloud model and the preset fog model are determined. The variance driving coefficients can quantify the class detection variance of the preset cloud model and the preset fog model, i.e., the accuracy difference.

[0041] Furthermore, in order to accurately calculate the equation driving coefficients, in this embodiment, step S01 includes: determining the sample classification result corresponding to the traffic sample; for any category in the sample classification result, determining the cloud accuracy of the category on the preset cloud model and the fog accuracy on the preset fog model; and determining the variance driving coefficient between the preset cloud model and the preset fog model based on the cloud accuracy and the fog accuracy.

[0042] It should be understood that the sample classification results may include several categories, for example, Category A: Normal Traffic; Category B: DDoS Attack; Category C: Brute Force Attack; Category D: Web Attack; Category E: Botnet. For any category, the cloud accuracy of that category on a preset cloud model can be determined. Fog tip accuracy on the preset fog tip model Precision refers to the number of samples correctly predicted as positive / the total number of samples that are actually positive. For example, if the actual class is B, the preset cloud model predicts 95 samples as class B and 5 samples as other classes, then the cloud precision is 95 / 100 = 95%. Similarly, the fog precision of each class on the preset fog model can be calculated in the same way.

[0043] Understandably, the variance driving coefficients between the preset cloud model and the preset fog model can be determined based on the cloud accuracy and fog accuracy. The variance driving coefficients can quantify the accuracy difference between the preset cloud model and the preset fog model.

[0044] Further, in this embodiment, determining the variance driving coefficient between the preset cloud model and the preset fog model based on the cloud accuracy and the fog accuracy includes: calculating the accuracy difference between the cloud accuracy and the fog accuracy; and calculating the variance driving coefficient between the preset cloud model and the preset fog model based on the accuracy difference and the calibration isolation factor.

[0045] It should be understood that the accuracy difference between cloud-based accuracy and fog-based accuracy can be calculated, i.e. Then, calculate the variance driving coefficients based on the accuracy difference and the calibration isolation factor, and then calculate the calibration isolation factor. In this embodiment The preferred value is 0.4.

[0046] In practical implementation, the variance driving coefficients can be calculated using the following formula. :

[0047] In the formula, when When >=0, Fog-end accuracy is higher than or equal to cloud-end accuracy, detection variance Small, marked as low risk, reducing the need for retesting; conversely, when... hour, The accuracy at the fog end is lower than that at the cloud end, and the detection variance is large. It is marked as high-risk and given priority for re-inspection, while maintaining monotonicity. β establishes a width of isolation zone This is to better distinguish between returned and retained traffic.

[0048] This embodiment breaks through the limitations of traditional unified rule-based decision-making and designs a variance driving coefficient D=[ , ,…, This coefficient quantifies the category detection variance (precision difference) between FM and CM to achieve accurate screening of re-inspected traffic. The coefficient is designed because the detection variances of different categories in the fog-end model and the cloud model differ. High-variance categories, such as niche attacks, have a high risk of misjudgment and require focused re-inspection, while low-variance categories, such as normal traffic, have a low risk of misjudgment and can reduce re-inspection. By quantifying the difference through the coefficient, intelligent screening is achieved.

[0049] Step S02: Determine the sample-level coefficients based on the variance driving coefficients and the sample category labels corresponding to the flow samples.

[0050] Understandably, the sample category label can be the category label corresponding to the traffic sample, and can be carried on the traffic sample, such as normal category, attack category, etc.

[0051] It should be understood that in this embodiment, sample-level coefficients can be determined based on variance driving coefficients and sample class labels. δ_i is the sample-level coefficient, y_i is the sample class label, and D is the variance driving coefficient.

[0052] Step S03: Construct a loss function based on the sample-level coefficients, and train the initial fog-cloud collaborative model based on the loss function to obtain the trained preset fog-cloud collaborative model.

[0053] Understandably, a loss function can be constructed using sample-level coefficients δ_i as weights. This, combined with cross-entropy loss, is then used to train the initial fog-cloud collaborative model, optimizing its confidence assessment and decision-making capabilities. It can be iterated 40 times until convergence, allowing the trained fog-cloud collaborative model to intelligently select re-inspection traffic based on variance. The FCM iteration count is set to 40. This value is chosen because 30 iterations do not result in sufficient convergence, 50 iterations lead to overfitting, and 40 iterations stabilize the FCM decision accuracy, achieving optimal training efficiency. The expected result is that the FCM achieves a decision accuracy of over 90% for high-variance categories.

[0054] Furthermore, in order to effectively construct the loss function, in this embodiment, constructing the loss function based on the sample-level coefficients includes: determining the re-inspection decision label and re-inspection prediction probability corresponding to the traffic sample; and constructing the loss function based on the sample-level coefficients, the re-inspection decision label, and the re-inspection prediction probability.

[0055] It should be understood that the re-inspection decision label y_i,Ψ and the re-inspection prediction probability P_i,Ψ corresponding to the traffic sample can be determined. The re-inspection decision label refers to the label indicating whether the traffic sample needs to be re-inspected, and the re-inspection prediction probability refers to the probability of being correctly predicted by FCM.

[0056] In practical implementation, a loss function can be constructed based on sample-level coefficients, re-examination decision labels, and re-examination prediction probabilities. Let L_FV represent the loss function, δ_i represent the sample-level coefficients, y_i,Ψ represent the re-examination decision label, and P_i,Ψ represent the re-examination prediction probability. By constructing this loss function and training the initial fog-cloud collaborative model based on it, the trained preset fog-cloud collaborative model improves the decision accuracy for high-variance categories to over 90%, reduces the overall false positive rate by 29%, and controls the false negative rate to within 1%.

[0057] This embodiment introduces the hard sample mining concept into Fog Cloud Collaborative Decision Making, constructs a loss function, and guides FCM to focus on learning the confidence assessment ability of high-variance categories, thereby improving decision accuracy. This loss function is needed because traditional loss functions treat all categories equally, resulting in low confidence judgment accuracy of FCM in high-variance categories, only above 60%, which cannot effectively identify high-risk misjudged traffic. The loss function allows FCM to focus on high-variance categories (hard samples) and optimize decision-making capabilities in a targeted manner.

[0058] Furthermore, in order to accurately obtain the re-inspection decision label, in this embodiment, determining the re-inspection decision label corresponding to the traffic sample includes: establishing an isolation interval based on the calibration isolation factor, and determining a re-inspection interval based on the isolation interval and the confidence threshold; determining the confidence level corresponding to the sample classification result; and determining the re-inspection decision label corresponding to the traffic sample based on the confidence level, the variance driving coefficient, and the re-inspection interval.

[0059] Understandably, an isolation interval (β, 1-β) can be established based on the calibration isolation factor β, and a re-inspection interval can be determined based on the isolation interval and the confidence threshold ε. The re-inspection interval clearly distinguishes between traffic that needs to be re-inspected and traffic that does not need to be re-inspected. For example, when β=0.4, the isolation interval is (0.4, 0.6). This value is chosen because when β=0.3, the isolation interval is too wide (0.3, 0.7), resulting in ambiguity in the decision; when β=0.5, the isolation interval is too narrow (0.5, 0.5), which is meaningless. 0.4 is the optimal value, which can clearly define the decision boundary. The expected effect is to distinguish between high and low variance categories and reduce decision ambiguity by 60%. The confidence threshold is 0.6. This value was chosen because when ε=0.5, there is too much re-inspection traffic, more than 25%, which consumes a lot of bandwidth. When ε=0.7, the false negative rate increases, more than 3%. 0.6 can balance the re-inspection rate and the risk of false negatives. The expected effect is that the re-inspection traffic accounts for 15% and the false negative rate is <1%. Therefore, the re-inspection range is (0.4, 0.6).

[0060] It should be understood that the confidence level corresponding to the sample classification result obtained through the preset fog-end model can be determined, i.e., the accuracy of the sample classification result. Then, the re-examination decision label corresponding to the traffic sample is determined based on the confidence level, variance driving coefficient, and re-examination interval.

[0061] Further, in this embodiment, determining the re-inspection decision label corresponding to the traffic sample based on the confidence level, the variance driving coefficient, and the re-inspection interval includes: determining the maximum and minimum values ​​corresponding to the re-inspection interval; determining the re-inspection decision label corresponding to the traffic sample as a non-re-inspection label when the confidence level is greater than or equal to the maximum value and the variance driving coefficient is greater than or equal to the maximum value; determining the re-inspection decision label corresponding to the traffic sample as a re-inspection label when the confidence level is less than or equal to the minimum value and the variance driving coefficient is less than or equal to the minimum value; and determining the re-inspection decision label corresponding to the traffic sample as a re-inspection label when the confidence level is within the re-inspection interval and the variance driving coefficient is within the re-inspection interval, and the sample-level coefficient is less than a preset threshold.

[0062] Understandably, the maximum and minimum values ​​corresponding to the re-inspection interval can be determined. For example, the maximum value corresponding to the re-inspection interval (0.4, 0.6) is 0.6, and the minimum value is 0.4.

[0063] It should be understood that when both the confidence level and the variance driving coefficient are greater than or equal to the maximum value, the re-inspection decision label for the traffic sample is determined as a non-re-inspection label. For example, if the confidence level is greater than or equal to 0.6 and the variance driving coefficient is greater than or equal to 0.6, it is low variance, considered reliable traffic, and does not require re-inspection. When both the confidence level and the variance driving coefficient are less than or equal to the minimum value, the re-inspection decision label for the traffic sample is determined as a re-inspection label. For example, if the confidence level is less than or equal to 0.4 and the variance driving coefficient is less than or equal to 0.4, it is high variance, considered questionable traffic, and requires re-inspection. When both the confidence level and the variance driving coefficient are within the re-inspection range, if the sample-level coefficient is less than a preset threshold, the re-inspection decision label for the traffic sample is determined as a re-inspection label. For example, if the confidence level is (0.4, 0.6) and the variance driving coefficient is (0.4, 0.6), and the sample-level coefficient δ_i < 0.2, re-inspection is required; otherwise, it is processed locally.

[0064] This embodiment establishes an isolation interval (β, 1-β) using a calibration factor β, and combines this with a confidence threshold ε to clearly distinguish between traffic requiring re-inspection and traffic not requiring re-inspection, avoiding decision ambiguity and achieving precise decision-making in distributed collaboration. The isolation interval is set because when β=0.4, the isolation interval is (0.4, 0.6), and the confidence level is below 0.4 and... Flow rates ≤0.4 (high variance) are directly re-examined, with confidence levels higher than 0.6 and... Traffic with a variance ≥0.6 (low variance) is processed locally, while traffic in between is precisely decided based on δ_i, avoiding unreasonable re-inspection caused by a one-size-fits-all approach. This mechanism is highly effective, reducing decision ambiguity by 60%, stabilizing the proportion of re-inspected traffic at around 15%, and achieving a false negative rate of <1%, thus balancing security and efficiency.

[0065] This embodiment determines the variance driving coefficients between the preset cloud model and the preset fog model based on traffic samples. Then, it determines sample-level coefficients based on the variance driving coefficients and the sample category labels corresponding to the traffic samples. A loss function is then constructed based on these sample-level coefficients, and the initial fog-cloud collaborative model is trained using this loss function to obtain the trained preset fog-cloud collaborative model. This embodiment, by constructing a loss function based on sample-level coefficients and training the initial fog-cloud collaborative model using this loss function, enables the trained preset fog-cloud collaborative model to focus on high-variance categories, thereby specifically optimizing decision-making capabilities.

[0066] The traffic classification method based on fog-cloud intelligent collaboration proposed in this application can be applied to industrial IoT scenarios. The application environment is characterized by high-variance categories in industrial networks, such as industrial protocol attacks and data tampering, which have a high risk of false positives and require priority re-inspection. Low-variance categories, such as normal production traffic, require rapid processing to meet real-time requirements. This scenario is suitable for this application because the false negative rate for industrial protocol attacks is reduced from 8% to 1.2%, the normal traffic processing latency is 157ms, meeting industrial real-time requirements (<200ms), the re-inspection traffic ratio is 15%, bandwidth consumption is reduced by 50%, and it does not affect the normal transmission of the industrial network. It can also be applied to smart home scenarios, characterized by high-variance categories in home networks, such as device hijacking and privacy theft, which require focused re-inspection. Low-variance categories, such as normal internet traffic and video playback traffic, do not require frequent re-inspection, avoiding the consumption of home bandwidth. This scenario is suitable for this application because the re-inspection rate for device hijacking attacks reaches 95%, the re-inspection rate for normal traffic is reduced to 3%, bandwidth consumption is reduced by 85%, it does not affect home network usage, and high-risk attacks are promptly uploaded to the cloud for re-inspection, preventing privacy data leakage and ensuring user security. It can also be applied to edge computing scenarios in smart cities, where edge nodes need to handle traffic from a large number of IoT devices, with a single node connecting thousands of devices. High-variance traffic, such as DDoS and variant attacks, carries a high risk of false positives, while low-variance traffic, such as normal monitoring traffic, constitutes a large proportion and requires precise filtering and re-inspection to avoid bandwidth congestion. This invention is suitable for this scenario because it achieves a re-inspection rate of over 95% for high-variance traffic and 5% for low-variance traffic, reducing overall bandwidth consumption by 50%. It is compatible with large-scale device access, achieves an FCM decision accuracy of over 90%, and has a false negative rate of <1%, improving the overall security protection capabilities of smart cities. The distributed collaboration mode reduces the pressure on centralized cloud processing and improves system stability.

[0067] In terms of decision-making accuracy, FCM achieves over 90% accuracy for high-variance categories, reducing the overall false positive rate by 29% and the attack miss rate to <1%, with the high-risk attack miss rate reduced to 1.2%. Regarding bandwidth optimization, the proportion of re-inspection traffic has decreased from 25% to 15%, reducing bandwidth consumption by 50% and resolving the issue of high bandwidth consumption in traditional distributed collaboration. In terms of collaboration efficiency, it achieves intelligent collaboration between rapid fog-end processing and accurate cloud-based re-inspection, with a fog-end response time of 157ms and a 30% improvement in cloud-based re-inspection efficiency, balancing real-time performance and security. In terms of scalability, it adapts to the traffic characteristics and attack types of different IoT scenarios without requiring significant parameter adjustments, enabling rapid deployment in various scenarios such as industry, home, and cities.

[0068] Reference Figure 3 , Figure 3 This is a structural block diagram of the first embodiment of the traffic classification device based on fog cloud intelligent collaboration of this application.

[0069] like Figure 3 As shown in the embodiments of this application, the traffic classification device based on fog-cloud intelligent collaboration includes: Traffic acquisition module 10 is used to acquire the raw traffic corresponding to the IoT terminal; Traffic classification module 20 is used to classify the original traffic using a preset fog terminal model to obtain an initial traffic classification result; The traffic filtering module 30 is used to input the initial traffic classification result into the preset fog cloud collaborative model to obtain the re-examination traffic in the original traffic. The preset fog cloud collaborative model is trained based on the variance driving coefficient between the preset cloud model and the preset fog terminal model. The traffic classification module 20 is also used to classify the re-inspection traffic using a preset cloud model to obtain the target traffic classification result.

[0070] This embodiment acquires the raw traffic corresponding to IoT terminals, then classifies the raw traffic using a preset fog-end model to obtain initial traffic classification results. These initial classification results are then input into a preset fog-cloud collaborative model to obtain re-inspection traffic from the raw traffic. The preset fog-cloud collaborative model is trained based on the variance driving coefficients between a preset cloud model and a preset fog-end model. Finally, the preset cloud model classifies the re-inspection traffic to obtain the target traffic classification results. This embodiment first classifies the raw traffic using a preset fog-end model, then inputs the initial traffic classification results into the preset fog-cloud collaborative model. The preset fog-cloud collaborative model, trained based on the variance driving coefficients between the preset cloud model and the preset fog-end model, guides the preset fog-cloud collaborative model to focus on traffic of high variance categories based on the variance driving coefficients, thereby filtering re-inspection traffic from the raw traffic. This allows for accurate re-inspection traffic filtering, prioritizing high-risk traffic for re-inspection and processing low-risk traffic locally. Furthermore, the preset cloud model classifies the re-inspection traffic, thus improving the accuracy of traffic classification.

[0071] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of this application. In practical applications, those skilled in the art can select some or all of it to achieve the purpose of this embodiment according to actual needs, and no restrictions are imposed here.

[0072] In addition, for technical details not described in detail in this embodiment, please refer to the traffic classification method based on fog cloud intelligent collaboration provided in any embodiment of this application, which will not be repeated here.

[0073] Based on the first embodiment of the traffic classification device based on fog cloud intelligent collaboration described in this application, a second embodiment of the traffic classification device based on fog cloud intelligent collaboration is proposed.

[0074] In this embodiment, the traffic classification device based on fog-cloud intelligent collaboration further includes a model training module, which is used to determine the variance driving coefficient between the preset cloud model and the preset fog terminal model based on traffic samples; determine the sample-level coefficient based on the variance driving coefficient and the sample category label corresponding to the traffic sample; construct a loss function based on the sample-level coefficient, and train the initial fog-cloud collaborative model based on the loss function to obtain the trained preset fog-cloud collaborative model.

[0075] Furthermore, the model training module is also used to determine the sample classification result corresponding to the traffic sample; for any category in the sample classification result, determine the cloud accuracy of the category on the preset cloud model and the fog accuracy on the preset fog model; and determine the variance driving coefficient between the preset cloud model and the preset fog model based on the cloud accuracy and the fog accuracy.

[0076] Furthermore, the model training module is also used to calculate the accuracy difference between the cloud accuracy and the fog accuracy; and to calculate the variance driving coefficient between the preset cloud model and the preset fog model based on the accuracy difference and the calibration isolation factor.

[0077] Furthermore, the model training module is also used to determine the re-inspection decision label and re-inspection prediction probability corresponding to the traffic sample; and to construct a loss function based on the sample-level coefficients, the re-inspection decision label, and the re-inspection prediction probability.

[0078] Furthermore, the model training module is also used to establish an isolation interval based on the calibration isolation factor, and determine a re-examination interval based on the isolation interval and the confidence threshold; determine the confidence level corresponding to the sample classification result; and determine the re-examination decision label corresponding to the traffic sample based on the confidence level, the variance driving coefficient, and the re-examination interval.

[0079] Furthermore, the model training module is also used to determine the maximum and minimum values ​​corresponding to the re-inspection interval; when the confidence level is greater than or equal to the maximum value and the variance driving coefficient is greater than or equal to the maximum value, the re-inspection decision label corresponding to the traffic sample is determined to be a non-re-inspection label; when the confidence level is less than or equal to the minimum value and the variance driving coefficient is less than or equal to the minimum value, the re-inspection decision label corresponding to the traffic sample is determined to be a re-inspection label; when the confidence level is within the re-inspection interval and the variance driving coefficient is within the re-inspection interval, if the sample-level coefficient is less than a preset threshold, the re-inspection decision label corresponding to the traffic sample is determined to be a re-inspection label.

[0080] Other embodiments or specific implementations of the traffic classification device based on Fog Cloud Intelligent Collaboration in this application can be found in the above-described method embodiments, and will not be repeated here.

[0081] This application provides a traffic classification device based on fog cloud intelligent collaboration. The traffic classification device based on fog cloud intelligent collaboration includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the traffic classification method based on fog cloud intelligent collaboration in the above embodiment 1.

[0082] The following is for reference. Figure 4This document illustrates a structural diagram of a traffic classification device based on fog-cloud intelligent collaboration suitable for implementing embodiments of this application. The traffic classification device based on fog-cloud intelligent collaboration in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 4 The traffic classification device based on Fog Cloud Intelligent Collaboration shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0083] like Figure 4 As shown, the traffic classification device based on fog-cloud intelligent collaboration may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1002 or a program loaded from storage device 1003 into random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the traffic classification device based on fog-cloud intelligent collaboration. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the fog-cloud intelligent collaboration-based traffic classification device to communicate wirelessly or wiredly with other devices to exchange data. Although the figure shows a fog-cloud intelligent collaboration-based traffic classification device with various systems, it should be understood that it is not required to implement or possess all the systems shown. More or fewer systems can be implemented alternatively.

[0084] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0085] The traffic classification device based on fog-cloud intelligent collaboration provided in this application, employing the traffic classification method based on fog-cloud intelligent collaboration in the above embodiments, can solve the technical problem of how to accurately perform re-inspection traffic screening, thereby improving the accuracy of traffic classification. Compared with the prior art, the beneficial effects of the traffic classification device based on fog-cloud intelligent collaboration provided in this application are the same as the beneficial effects of the traffic classification method based on fog-cloud intelligent collaboration provided in the above embodiments, and other technical features in this traffic classification device based on fog-cloud intelligent collaboration are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0086] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0087] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0088] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the traffic classification method based on fog cloud intelligent collaboration in the above embodiments.

[0089] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0090] The aforementioned computer-readable storage medium may be included in a traffic classification device based on Fog Cloud Intelligent Collaboration; or it may exist independently and not be assembled into a traffic classification device based on Fog Cloud Intelligent Collaboration.

[0091] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by a traffic classification device based on fog-cloud intelligent collaboration, the traffic classification device based on fog-cloud intelligent collaboration performs the following: acquires the raw traffic corresponding to the IoT terminal; classifies the raw traffic using a preset fog-end model to obtain an initial traffic classification result; inputs the initial traffic classification result into a preset fog-cloud collaborative model to obtain the re-examined traffic in the raw traffic, wherein the preset fog-cloud collaborative model is trained based on the variance driving coefficients between a preset cloud model and a preset fog-end model; and classifies the re-examined traffic using the preset cloud model to obtain a target traffic classification result.

[0092] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages—such as Python, Java, Smalltalk, and C++—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0093] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0094] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0095] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned traffic classification method based on fog-cloud intelligent collaboration. This solves the technical problem of how to accurately perform re-examination and filtering of traffic, thereby improving the accuracy of traffic classification. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the traffic classification method based on fog-cloud intelligent collaboration provided in the above embodiments, and will not be repeated here.

[0096] The above description is only a part of the embodiments of this application and does not limit the scope of protection of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included in the scope of protection of this application.

Claims

1. A traffic classification method based on intelligent cooperation of fog cloud, characterized in that, The traffic classification method based on fog cloud intelligent collaboration includes the following steps: Obtain the raw traffic corresponding to the IoT terminal; The original traffic is classified by a preset fog terminal model to obtain the initial traffic classification result; The initial traffic classification results are input into the preset fog-cloud collaborative model to obtain the re-inspection traffic in the original traffic. The preset fog-cloud collaborative model is trained based on the variance driving coefficient between the preset cloud model and the preset fog terminal model. The re-inspection traffic is classified using a preset cloud model to obtain the target traffic classification result; Before inputting the initial traffic classification result into the preset fog-cloud collaborative model to obtain the re-inspection traffic in the original traffic, the method further includes: Determine the sample classification result corresponding to the traffic sample; For any category in the sample classification results, determine the cloud accuracy of that category on the preset cloud model and the fog accuracy on the preset fog model; Calculate the accuracy difference between the cloud-based accuracy and the fog-based accuracy; Calculate the variance driving coefficients between the preset cloud model and the preset fog model based on the accuracy difference and the calibration isolation factor; The sample-level coefficients are determined based on the variance driving coefficients and the sample category labels corresponding to the traffic samples; A loss function is constructed based on the sample-level coefficients, and the initial fog-cloud collaborative model is trained based on the loss function to obtain the pre-trained fog-cloud collaborative model.

2. The traffic classification method based on fog-cloud intelligent collaboration as described in claim 1, characterized in that, The step of constructing the loss function based on the sample-level coefficients includes: Determine the re-inspection decision label and re-inspection prediction probability corresponding to the traffic sample; A loss function is constructed based on the sample-level coefficients, the re-inspection decision label, and the re-inspection prediction probability.

3. The traffic classification method based on fog-cloud intelligent collaboration as described in claim 2, characterized in that, Determining the re-inspection decision label corresponding to the traffic sample includes: An isolation interval is established based on the calibration isolation factor, and a retest interval is determined based on the isolation interval and the confidence threshold. Determine the confidence level corresponding to the sample classification result; The re-inspection decision label corresponding to the traffic sample is determined based on the confidence level, the variance driving coefficient, and the re-inspection interval.

4. The traffic classification method based on fog-cloud intelligent collaboration as described in claim 3, characterized in that, The step of determining the re-examination decision label corresponding to the traffic sample based on the confidence level, the variance driving coefficient, and the re-examination interval includes: Determine the maximum and minimum values ​​corresponding to the re-inspection interval; If the confidence level is greater than or equal to the maximum value and the variance driving coefficient is greater than or equal to the maximum value, the re-inspection decision label corresponding to the traffic sample is determined to be the non-re-inspection label; If the confidence level is less than or equal to the minimum value and the variance driving coefficient is less than or equal to the minimum value, the re-examination decision label corresponding to the traffic sample is determined as the re-examination label; If the confidence level is within the re-examination interval and the variance driving coefficient is within the re-examination interval, and the sample-level coefficient is less than a preset threshold, then the re-examination decision label corresponding to the traffic sample is determined as the re-examination label.

5. A traffic classification device based on fog-cloud intelligent collaboration, characterized in that, The traffic classification device based on fog cloud intelligent collaboration includes: The traffic acquisition module is used to acquire the raw traffic corresponding to the IoT terminal; The traffic classification module is used to classify the original traffic using a preset fog terminal model to obtain an initial traffic classification result. The traffic filtering module is used to input the initial traffic classification results into the preset fog cloud collaborative model to obtain the re-examination traffic in the original traffic. The preset fog cloud collaborative model is trained based on the variance driving coefficient between the preset cloud model and the preset fog terminal model. The traffic classification module is also used to classify the re-inspection traffic using a preset cloud model to obtain the target traffic classification result; The traffic classification device based on fog-cloud intelligent collaboration further includes a model training module, used to determine the sample classification result corresponding to the traffic sample; for any category in the sample classification result, determine the cloud accuracy of that category on the preset cloud model and the fog accuracy on the preset fog model; calculate the accuracy difference between the cloud accuracy and the fog accuracy; calculate the variance driving coefficient between the preset cloud model and the preset fog model based on the accuracy difference and the calibration isolation factor; determine the sample-level coefficient based on the variance driving coefficient and the sample category label corresponding to the traffic sample; construct a loss function based on the sample-level coefficient, and train the initial fog-cloud collaborative model based on the loss function to obtain the trained preset fog-cloud collaborative model.

6. A traffic classification device based on fog-cloud intelligent collaboration, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the traffic classification method based on fog cloud intelligent collaboration as described in any one of claims 1 to 4.

7. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the traffic classification method based on fog cloud intelligent collaboration as described in any one of claims 1 to 4.

Images