A quic multi-path scheduling preference inversion method based on passive flow observation

Abstract

The application discloses a QUIC multi-path scheduling preference inversion method based on passive flow observation, and belongs to the technical field of network application performance monitoring and encrypted flow analysis. The method first collects network flow and processes it, reconstructs the session of QUIC data packets, divides them by paths, calculates relevant network indexes in the session path set, constructs a path quality function to invert the network scheduling behavior preference, and finally outputs and analyzes the scheduling behavior based on the network scheduling behavior preference. The method realizes the interpretable analysis of the QUIC multi-path scheduling strategy without decrypting the communication content and without the cooperation of the client, can invert the path selection behavior of the client and its influencing factors from the passive observation data on the network side, solves the problem that the scheduling strategy is a black box and cannot be observed in the prior art, realizes the quantitative modeling of the path scheduling mechanism, and improves the scheduling level observability in the QUIC encrypted flow environment.

Description

Technical Field

[0001] This invention belongs to the technical field of network application performance monitoring and encrypted traffic analysis. It relates to a method for inverting and modeling the path scheduling strategy in QUIC multipath communication by passively collecting network traffic without decrypting communication content or requiring client cooperation. Background Technology

[0002] With the widespread deployment of the QUIC protocol and HTTP / 3, multipath transmission has gradually become an important means to improve network performance. The QUIC protocol supports the simultaneous use of multiple network paths within the same connection, and its path scheduling strategy is controlled internally by the client.

[0003] Existing technologies mainly focus on multi-path scheduling algorithm design, such as path selection based on RTT and packet loss rate, and end-side optimization strategies, such as reinforcement learning schedulers. However, scheduling decisions are mostly completed internally by the client, which is a black-box behavior, and the network side cannot obtain the scheduling strategy. Passive observation methods cannot explain scheduling behavior; that is, they can only see "which path the traffic takes" but cannot explain "why it takes this path." The QUIC protocol is encrypted, and scheduling information cannot be obtained through protocol parsing. There is a lack of a method to infer the scheduling strategy from passive observation by the network side. Summary of the Invention

[0004] The technical problem that the invention aims to solve

[0005] This invention addresses the analysis of QUIC multipath scheduling strategies and path selection behavior under black-box conditions, as well as the scheduling-level observability problem of encrypted traffic. It proposes a QUIC multipath scheduling preference inversion method based on passive traffic observation. The method constructs a mapping relationship between path quality indicators and actual traffic distribution, and inversely infers the client scheduling preference function, thereby realizing the inversion of scheduling strategies.

[0006] Technical solution

[0007] To achieve the above objectives, the technical solution provided by the present invention is as follows:

[0008] A QUIC multipath scheduling preference inversion method based on passive traffic observation includes the following steps:

[0009] Step 1: Collect and process network traffic, including the following steps:

[0010] Step 1-1: Deploy bypass acquisition devices at key network nodes to mirror UDP traffic data. The acquired traffic data includes packet arrival time, source IP / destination IP / source port / destination port / protocol 5-tuple, QUIC connection ID, packet direction, and packet length.

[0011] Step 1-2: Identify the protocol, source port, and destination port information in the five-tuple of traffic data extracted in Step 1-1. If the protocol is UDP and the source or destination port is 443, then the data packet is identified as QUIC traffic.

[0012] Steps 1-3 involve processing the QUIC stream data identified in Steps 1-2. The processing methods include: sorting the data packets according to their arrival time, filtering duplicate data packets, and filtering abnormal data packets.

[0013] Steps 1-4: The QUIC data packets processed in steps 1-3 are arranged into a data packet sequence PacketStream = {pkt1, pkt2, ..., pkt} according to their arrival time. N Each data packet in the sequence contains the traffic data information collected in step 1-1.

[0014] Step 2 involves reconstructing the QUIC data packets and dividing them by path, including the following steps:

[0015] Step 2-1: Reconstruct a session from packets belonging to the same QUIC connection ID in the PacketStream obtained in Step 1: Session = { pkt i pkt i .ConnectionID = CID}, where ConnectionID represents the QUIC connection ID, and CID represents the ConnectionID value corresponding to a specific connection.

[0016] Step 2-2: Calculate the path P of each data packet in the Session obtained in Step 2-1. i P i =(SrcIP, DstIP, SrcPort, DstPort, PathFingerprint i ), where SrcIP is the source IP address, DstIP is the destination IP address, SrcPort is the source port, DstPort is the destination port, and PathFingerprint is the path source port. i For path P i The characteristic fingerprint of a path includes the distribution of data packet direction, data packet RTT distribution, and data packet length distribution along the path.

[0017] Steps 2-3: Construct the time window t = [t, t + Δt], for each path P constructed in step 2-2 i In the time window tBuilt-in packetSubset i (t): PacketSubset i (t) = {pkt j pkt j Belonging to the same session, pkt j The path is P i The arrival time of pktj is located in the time window. t Inside}.

[0018] Steps 2-4, based on path P i Time window t PacketSubset i (t) Construct a session path set SessionPaths, SessionPaths = {(P i Window t PacketSubset i (t))}.

[0019] Step 3, calculate the relevant network metrics within the SessionPaths set obtained in Step 2, including the following steps:

[0020] Step 3-1, calculate path P within the path set. i Traffic percentage, calculated using the time window method. t Inner path P i Traffic i (t),

[0021] Traffic i (t) = Σ pkt j .size, pkt j ∈PacketSubset i (t),

[0022] pkt j .size indicates the length of the data packet in bytes.

[0023] Calculate path P i Traffic share Usage i (t), the method is:

[0024] .

[0025] Step 3-2: Calculate the ACK contribution ratio (ACK_ratio) within the path set. i(t) First, ACK packets are identified by their direction, length, and arrival time. Then, a path P is constructed for the identified ACK packets. i ACK packet set ACKPackets i (t) = { pkt j pkt j ACK packet and pkt j The path is P i},

[0026] Then calculate path P. i ACK traffic ACK i (t), ACK i (t) = Σ pkt j .size, pkt j ∈ACKPackets i (t), where pkt j .size indicates the length of the data packet in bytes.

[0027] Finally, the ACK contribution ratio (ACK_ratio) is calculated. i (t), the method is:

[0028]

[0029] Step 3-3, calculate path P i Packet loss rate on i (t),

[0030] First, in path P i The data packets in the sending direction are sorted by time to construct a sequence Seq. i = {pkt1, pkt2,..., pkt n When the time interval between receiving two adjacent data packets exceeds a threshold, or when a sent data packet fails to receive a corresponding ACK response within a preset time window but subsequent data packets have been acknowledged by ACK, it is determined that there is a packet loss phenomenon.

[0031] Then count the number of lost packets and calculate the packet loss rate (Loss). i (t), the method is:

[0032]

[0033] Sendpacket i (t) represents the total number of data sent within the time window t, Losspacket i (t) represents the number of lost data packets detected within the time window t.

[0034] Steps 3-4: Calculate path P within time window t. i Average Time Difference (RTT) between the sent data packet and the corresponding ACK data packet i (t), the method is:

[0035] For the data packet sequence Seq in the sending direction i = {pkt1, pkt2, ..., pkt n}, identify the corresponding ACK packet set ACKPackets i (t) = { pkt j pkt j ACK packet and pkt j The path is P i The matching is based on the temporal relationship between the two.

[0036] For each sent packet pkt s ∈Seq i Find the earliest arriving ACK packet pkt a ∈ACKPackets i (t), calculate the time difference RTT_sample between the two arrivals.

[0037] RTT_sample = pkt a .time - pkt s .time

[0038] Where *.time represents the time the data packet arrived.

[0039] Mean Time Difference (RTT) i (t) = Avg(RTT_sample), which is the average time difference of all transmitted data packets.

[0040] Steps 3-5: Calculate path P within time window t. i Up-latency jitter i (t), the method is as follows: form a set {RTT_sample} from the time differences RTT_sample obtained in steps 3-4, then

[0041]

[0042] RTT m This represents the RTT_sample value of data packet m in the set {RTT_sample}, where M is the total number of elements in the set {RTT_sample}.

[0043] Step 3-6, use the Usage obtained in Step 3-1 i(t), the ACK_ratio obtained in step 3-2 i (t), Loss obtained in step 3-3 i (t), the RTT obtained in steps 3-4 i (t), the Jitter obtained in steps 3-5 i (t) forms the path feature vector F i (t) ={Usage i (t), ACK_ratio i (t), Loss i (t), RTT i (t), Jitter i (t)}.

[0044] Step 4: Construct the path quality function Q based on the path feature vectors obtained in Step 3. i (t), the method is:

[0045]

[0046] Where α, β, γ, δ > 0 are the parameters to be estimated, satisfying α + β + γ + δ = 1.

[0047] Step 5 involves inverting network scheduling behavior preferences, including the following steps:

[0048] Step 5-1, based on the path quality function Q obtained in Step 4 i (t) Construct a scheduling preference probability model, the method is as follows: ,satisfy: Prefer i (t) represents the client's access to path P within the time window t. i The probability of scheduling preference.

[0049] Step 5-2: Construct the objective function based on the observation data. The objective is to minimize L(α, β, γ, δ), which means deriving the parameters α, β, γ, and δ in the path quality function by minimizing the difference between the observed distribution and the model distribution.

[0050] Step 5-3: Calculate the parameters α, β, γ, and δ from step 5-2 using the gradient descent method.

[0051] Step 6: Output and analyze scheduling behavior based on network scheduling behavior preferences, including the following steps:

[0052] Step 6-1, for each path P i Construct a time series preference curve (PreferCurve) based on the time window. i :

[0053] PreferCurve i = {Prefer i (t1), Prefer i (t2), ..., Prefer i (t n )},

[0054] The time series preference curve depicts the change in the scheduling probability of a path within different time windows;

[0055] Step 6-2, for each path P i Construct a time-quality curve (QualityCurve) based on the quality function. i QualityCurve i = {Q i (t1), Q i (t2), ..., Q i (t n )};

[0056] Step 6-3: Analyze the relationship between path quality and scheduling behavior by comparing the two curves obtained in steps 6-1 and 6-2, including: judging path switching behavior by changes in the main path, judging changes in load balancing strategy by changes in the proportion of multiple paths, and judging the stability of network scheduling strategy by the degree of curve fluctuation.

[0057] Step 6-4, Define the path scheduling change rate ,

[0058]

[0059] When ΔPrefer i If the value is greater than the threshold θ, a scheduling switch event is determined to exist.

[0060] Step 6-5, using the mass function Q i The method for detecting abnormal scheduling behavior using the (t) value is as follows:

[0061] When Q i (t) > Q high AndUsage i (t) < U low When it is determined that a high-quality path is not being used, Q high U low This is the default value;

[0062] When Q i (t) < Q low AndUsage i (t) > Uhigh When it is determined that a low-quality path is being prioritized, Q low U high This is the default value;

[0063] Furthermore, when QUIC is running on a non-standard port, steps 1-2 identify QUIC traffic through packet characteristics. Packet characteristics include header characteristics, connection identifier characteristics, load randomness characteristics, and flow behavior characteristics. When a packet meets any one or more of the above characteristics, it is determined to be QUIC traffic.

[0064] Furthermore, in step 3-3, lost data packets are determined by retransmission behavior. If two data packets within a time window t satisfy the following conditions: identical 5-tuple, same data packet length, and arrival time interval less than a preset threshold, then retransmission is considered to have occurred. The number of retransmitted data packets is counted to calculate the packet loss rate (Loss). i (t):

[0065] ,

[0066] Sendpacket i (t) represents the total number of data sent within the time window t, Retrypacket i (t) represents the number of retransmitted data packets detected within the time window t.

[0067] Furthermore, the process of calculating the parameters using the gradient descent method in step 5-3 includes the following steps:

[0068] Step 5-3-1: Initialize the parameter vector W=(α, β, γ, δ);

[0069] Step 5-3-2, for each path P within each time window t i Calculate the path quality function Q according to steps 3 and 4. i (t), calculate Prefer according to the method in step 5. i (t);

[0070] Step 5-3-3: Calculate the objective function L(α, β, γ, δ) using the following method:

[0071] ;

[0072] Step 5-3-4, calculate the gradient, the method is as follows:

[0073]

[0074] in:

[0075]

[0076] in:

[0077] ;

[0078] Step 5-3-5, update the parameter vector W, the method is as follows: , Let η be the updated parameter vector, and η be the learning rate. The parameter vector update terminates when the change in the objective function between two consecutive iterations is less than the convergence threshold or the number of iterations reaches the preset upper limit.

[0079] Step 5-3-6: After the update steps are completed, the final parameter vector W is obtained. * =(α * , β * , γ * , δ * ).

[0080] Step 5-3-7: Construct the path scheduling preference function f(P) based on the parameters obtained in step 5-3-6. i ),

[0081] .

[0082] Further, step 5-3 solves for the parameter vector W using the least squares approximation method, and makes a first-order linear approximation of the preference probability model in the neighborhood of the current parameters, resulting in: , where a i b i The coefficients are obtained by expanding at the current iteration point.

[0083] Construct the least squares objective function:

[0084] ,

[0085] Solve this least squares problem to obtain the initial values ​​W of the parameter vector. (0) =(A T A) -1 A T Y, where A is the coefficient a i The matrix formed, where Y is the observation vector Usage i (t), the initial values ​​of the parameter vector are updated using the gradient descent optimization process in step 5-3.

[0086] Furthermore, in step 5-3, the parameter vector W is solved using the EM algorithm, and the scheduling preference probability Prefer is calculated. i (t) is treated as a latent variable, and the parameters are solved iteratively using the expectation-maximization method, including the following steps:

[0087] E-step: Given the current parameter vector W (r)Under the given conditions, the scheduling preference probability of each path within each time window is calculated according to the preference probability model:

[0088] ;

[0089] M-step: Obtained by fixing the E-step Minimize the following loss function:

[0090] ;

[0091] Iteration step: Update the parameter vector to W (r+1) Repeat the E-step and M-step until the change in the loss function is lower than the preset threshold or the maximum number of iterations is reached.

[0092] Furthermore, another method for detecting abnormal scheduling behavior in step 6-5 is to define a scheduling deviation degree. i (t),

[0093] Deviation i (t) = |Usage i (t) - Prefer i (t)|,

[0094] When Deviation i If (t) is greater than the preset threshold, then it is determined that there is abnormal scheduling behavior.

[0095] Beneficial effects

[0096] The beneficial effects of the method of the present invention are as follows:

[0097] (1) The method of the present invention realizes interpretable analysis of QUIC multipath scheduling strategy without decrypting communication content or client cooperation. It can deduce client path selection behavior and its influencing factors from passive observation data on the network side, thereby solving the problem of unobservable black box scheduling strategy in the prior art.

[0098] (2) Based on the mapping relationship between path quality indicators and actual traffic distribution, the method of the present invention realizes quantitative modeling of path scheduling mechanism by constructing a scheduling preference function. It can not only observe the "traffic direction" but also explain the "reasons for path selection", which significantly improves the scheduling-level observability capability in encrypted traffic environment.

[0099] (3) The method of the present invention provides multi-granularity scheduling strategy evaluation capabilities at the network session level, path level and time window level, which can characterize the time dynamic change process of scheduling behavior, support path switching identification, load balancing analysis and scheduling stability evaluation, thereby realizing refined analysis of complex multi-path transmission behavior;

[0100] (4) The method of the present invention does not rely on QUIC protocol decryption or terminal logs. It can achieve analysis based solely on passive traffic collection. It has good deployment compatibility and practical engineering feasibility, and can be widely applied to scenarios such as network performance monitoring, intelligent operation and maintenance analysis and multi-path transmission optimization. Attached Figure Description

[0101] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0102] To further understand the content of this invention, it will be described in detail with reference to the accompanying drawings and specific embodiments.

[0103] like Figure 1 As shown, the QUIC multipath scheduling preference inversion method based on passive traffic observation of this invention includes the following steps:

[0106] Step 1: Network Traffic Collection and Data Preprocessing

[0107] 1) Deploy bypass acquisition devices at key network nodes to mirror UDP traffic. Acquisition devices can be TAP, SPAN, etc. In this embodiment, the traffic data collected includes packet arrival time, source IP / destination IP / source port / destination port / protocol 5-tuple, QUIC connection ID, packet direction (uplink / downlink), and packet length.

[0108] 2) To identify QUIC flow, extract the protocol, source port, and destination port information from the five-tuple of the traffic data packet. If the protocol is UDP and the source or destination port is 443, then the data packet is identified as QUIC flow.

[0109] Optionally, when QUIC is running on a non-standard port, further identification is performed using packet characteristics. Packet characteristics include...

[0110] Message header characteristics: The first byte of a QUIC data packet conforms to a fixed long or short header format, such as the high-order bits of the first byte conforming to a fixed pattern defined by the QUIC protocol.

[0111] Connection identification characteristics: QUIC packets contain a Connection ID field, the length of which conforms to the QUIC protocol specification (usually in the range of 0~20 bytes).

[0112] Load randomness characteristic: The payload of QUIC packets is uniformly and randomly distributed, which is consistent with the characteristics of encrypted traffic.

[0113] Popularity characteristics: Data packets within the same connection exhibit a stable bidirectional communication pattern and have typical request-response time correlation.

[0114] In this embodiment, when a data packet satisfies any one or more of the above characteristics, it is determined to be QUIC traffic.

[0115] 3) Process the QUIC stream data identified in 2), including: sorting the data packets according to their arrival time, filtering duplicate data packets, and filtering abnormal data packets.

[0116] In this embodiment, the method for judging duplicate data packets is as follows: within a preset time window Δt, if two data packets simultaneously satisfy (1) the source IP / destination IP / source port / destination port / protocol 5-tuple is the same, (2) the data packet length is the same, and (3) the hash values ​​of the contents of the data packets are consistent or the similarity is greater than the preset threshold θ, then the two data packets are judged to be duplicate data packets, and one of them is kept and the other is deleted. In this embodiment, the time window Δt is 1ms ~ 10ms, the hash algorithm is MD5 or CRC, and the threshold θ is 0.95.

[0117] If two data packets are detected within a time window Δt = 5ms: data packet A is 1200 bytes long and data packet B is 1200 bytes long. Both have the same 5-tuple and completely identical MD5 hash values, then they are determined to be duplicate data packets, and one of them is deleted.

[0118] The method for identifying abnormal data packets is as follows:

[0119] Calculate the mean μ and standard deviation σ of the round-trip time (RTT) of data packets on this path. When the RTT of data packets on this path satisfies RTT > μ ​​+ kσ, the data packet is determined to be abnormal, where k is a preset parameter, and in this embodiment, the value range is 2~4.

[0120] 4) Arrange the QUIC data packets processed in step 3) into a data packet sequence PacketStream = {pkt1, pkt2, ..., pkt} according to their arrival time. N Each data packet in the sequence contains the traffic data information collected in step 1).

[0121] Step 2, Session Reconstruction and Path Division

[0122] 1) Reconstruct a session for packets belonging to the same QUIC connection ID in the PacketStream packet sequence: Session = { pkt i pkt i.ConnectionID = CID}, where ConnectionID represents the QUIC connection ID, and CID represents the ConnectionID value corresponding to a specific connection.

[0123] 2) Construct path P from the information of each data packet in the session obtained in step 1). i P i = (SrcIP,DstIP, SrcPort, DstPort, PathFingerprint i ), where SrcIP is the source IP address, DstIP is the destination IP address, SrcPort is the source port, DstPort is the destination port, and PathFingerprint is the path source port. i For path P i The characteristic fingerprint of a path includes the distribution of data packet direction, data packet RTT distribution, and data packet length distribution along the path.

[0124] 3) Constructing a time window t = [t, t + Δt], for each path P i In the time window t Built-in packetSubset i (t):

[0125] PacketSubset i (t) = {pkt j pkt j Belonging to the same session, pkt j The path is P i The arrival time of pktj is located in the time window. t In this embodiment, the value of Δt ranges from 100ms to 1s. The purpose of the time window is to reduce the impact of short-term jitter on the statistical results.

[0126] 4) Based on path P i Time window t PacketSubset i (t) Construct a session path set SessionPaths, SessionPaths = {(P i Window t PacketSubset i (t))}.

[0127] Step 3: Calculate the relevant network metrics within the SessionPaths set obtained in Step 2.

[0128] 1) Calculate path P within the path set i Traffic percentage, calculated using the time window method. t Inner path P i Traffic i (t),

[0129] Traffic i (t) = Σ pkt j .size, pkt j ∈PacketSubset i (t),

[0130] pkt j .size indicates the length of the data packet in bytes.

[0131] Calculate path P i Traffic share Usage i (t), the method is:

[0132]

[0133] 2) Calculate the ACK contribution ratio ACK_ratio i (t) In the QUIC protocol, ACK information is fed back through ACK data packets. First, the ACK data packet is identified. In this embodiment, the ACK data packet is identified by the following characteristics: the data packet direction is from the receiver to the sender, the data packet length is small, and the arrival time of the data packet has a close timing relationship with the preceding sent packet.

[0134] For the identified ACK packet, construct path P i ACK packet set ACKPackets i (t) = { pkt j pkt j ACK packet and pkt j The path is P i}

[0135] Calculate path P i ACK traffic ACK i (t),

[0136] ACK i (t) = Σ pkt j .size, pkt j ∈ACKPackets i (t),

[0137] pkt j .size indicates the length of the data packet in bytes.

[0138] Calculate ACK contribution ratio ACK_ratio i (t):

[0139]

[0140] 3) Calculate path P i Packet loss rate on i (t)

[0141] On path P i Above, sort the data packets in the sending direction by time to construct a sequence Seq. i = {pkt1, pkt2,..., pkt n The following conditions indicate that packet loss has occurred:

[0142] (1) Abnormal time interval between adjacent data packets: When the time interval between two adjacent data packets is greater than the threshold τ, it is determined that there is packet loss. In this embodiment, τ = m * Avg(Δt) is taken, m ∈ [3,10], and Avg(Δt) represents the average time interval obtained from historical experience values;

[0143] (2) ACK feedback jump: If a sent data packet does not receive the corresponding ACK response within the preset time window, but subsequent data packets have been confirmed by ACK, then the sent data packet is determined to be lost.

[0144] Count the number of lost packets and calculate the packet loss rate. i (t), the method is:

[0145]

[0146] Sendpacket i (t) represents the total number of data sent within the time window t, Losspacket i (t) represents the number of lost data packets detected within the time window t.

[0147] Optionally, lost data packets are determined by retransmission behavior. If two data packets within a time window t satisfy the following conditions: identical 5-tuple, same packet length, and arrival time interval less than a preset threshold, then a retransmission is considered to have occurred, and the packet loss rate (Loss) is calculated by counting the number of retransmitted data packets. i (t):

[0148]

[0149] Sendpacketi (t) represents the total number of data sent within the time window t, Retrypacket i (t) represents the number of retransmitted data packets detected within the time window t.

[0150] 4) Calculate path P within time window t i Average Time Difference (RTT) between the sent data packet and the corresponding ACK data packet i (t)

[0151] For the data packet sequence Seq in the sending direction i = {pkt1, pkt2, ..., pkt n}, identify the corresponding ACK packet set ACKPackets i (t) = { pkt j pkt j ACK packet and pkt j The path is P i Matching is performed based on the temporal correlation between the two.

[0152] For each sent packet pkt s ∈Seq i Find the earliest arriving ACK packet pkt a ∈ACKPackets i (t), calculate the time difference RTT_sample between the two arrivals.

[0153] RTT_sample = pkt a .time - pkt s .time

[0154] Where *.time represents the time the data packet arrived.

[0155] Mean Time Difference (RTT) i (t) = Avg(RTT_sample), which is the average time difference of all transmitted data packets.

[0156] 5) Calculate path P within the time window t i Up-latency jitter i (t), the method is:

[0157] Form the time difference RTT_sample obtained in step 4) into a set {RTT_sample}, then

[0158]

[0159] RTT mThis represents the RTT_sample value of data packet m in the set {RTT_sample}, where M is the total number of elements in the set {RTT_sample}.

[0160] 6) Use the Usage obtained in step 1). i (t), the ACK_ratio obtained in step 2) i (t), Loss obtained in step 3) i (t), the RTT obtained in step 4) i (t), the Jitter obtained in step 5) i (t) forms the path feature vector F i (t) = {Usage i (t), ACK_ratio i (t), Loss i (t), RTT i (t), Jitter i (t)}

[0161] Step 4: Construct the path quality function Q based on the path feature vectors obtained in Step 3. i (t):

[0162]

[0163] Where α, β, γ, δ > 0 are the parameters to be estimated, satisfying α + β + γ + δ = 1.

[0164] Step 5: Invert the network scheduling behavior preferences.

[0165] 1) Assume that during multipath transmission, the client follows a probability allocation mechanism for scheduling each path.

[0166] Based on path quality function Q i (t) Construct a scheduling preference probability model, the method is as follows: This model is a Softmax normalized model, used to map path quality to a probability distribution, satisfying: Prefer i (t) represents the client's interaction with path P within the time window t. i The probability of scheduling preference.

[0167] 2) Construct an objective function based on observation data The objective is to minimize L(α, β, γ, δ), which means deriving the parameters α, β, γ, and δ in the path quality function by minimizing the difference between the observed distribution and the model distribution.

[0168] 3) Calculate the parameters α, β, γ, and δ using the gradient descent method. The method is as follows:

[0169] (1) Initialize the parameter vector W=(α, β, γ, δ). In this embodiment, W 0 =(0.25,0.25,0.25,0.25), indicating that the initial weights of each indicator are the same.

[0170] (2) For each path P within each time window t i Calculate the path quality function Q according to steps 3 and 4. i (t), calculate Prefer according to the method in step 5. i (t)

[0171] (3) Calculate the objective function

[0172] (4) Calculate the gradient, the method is as follows:

[0173]

[0174] in:

[0175]

[0176] in:

[0177]

[0178] (5) Update the parameter vector W as follows: , The updated parameter vector is denoted by η, which is the learning rate. In this embodiment, η = 0.01. The termination condition for parameter vector updating is the change in the objective function between two consecutive iterations. The convergence threshold ε is less than the maximum convergence number or the number of iterations reaches the preset upper limit R. max In this embodiment, ε = 10 -4 R max = 500.

[0179] (6) After the update step is completed, the final parameter vector W is obtained. * =(α * , β * , γ * , δ * )

[0180] Optionally, the parameter vector W is solved using the least squares approximation method, and the Softmax model is approximated by a first-order linear approximation in the neighborhood of the current parameters, resulting in: , where a i b i The coefficients are obtained by expanding at the current iteration point.

[0181] Construct the least squares objective:

[0182]

[0183] Solve this least squares problem to obtain the initial values ​​W of the parameter vector. (0) =(A T A) -1 A T Y, where A is the coefficient a i The matrix formed, where Y is the observation vector Usage i (t), the initial values ​​of the parameter vector are updated using the gradient descent optimization process in step 3) to improve the accuracy of parameter estimation.

[0184] Optionally, the parameter vector W is solved using the EM algorithm, and the scheduling preference probability Prefer is calculated. i (t) is treated as a latent variable, and the parameters are solved iteratively using the expectation-maximization method:

[0185] E-step: Given the current parameter vector W (r) Under these conditions, the scheduling preference probability of each path within each time window is calculated according to the Softmax model:

[0186]

[0187] M-step: Obtained by fixing the E-step Minimize the following loss function:

[0188]

[0189] Update the parameter vector to W (r+1) Repeat the E-step and M-step until the change in the loss function is lower than the preset threshold or the maximum number of iterations is reached.

[0190] (7) Obtain the path scheduling preference function

[0191]

[0192] This function is used to approximate the client scheduling strategy, reflecting the degree of influence of different network metrics on path selection.

[0193] Step 6, Scheduling Behavior Output and Analysis

[0194] 1) For each path P i Construct a time series preference curve (PreferCurve) based on the time window. i :

[0195] PreferCurve i = {Prefer i(t1), Prefer i (t2), ..., Prefer i (t n )}

[0196] The time series preference curve depicts the change in the scheduling probability of a path within different time windows.

[0197] 2) For each path P i Construct a time-quality curve (QualityCurve) based on the quality function. i :

[0198] QualityCurve i = {Q i (t1), Q i (t2), ..., Q i (t n )}

[0199] 3) Analyze the relationship between path quality and scheduling behavior by comparing the two curves in steps 1) and 2), including:

[0200] Changes in the main path indicate path switching behavior; changes in the proportion of multiple paths indicate changes in load balancing strategies; and the degree of fluctuation in the curve indicates the stability of network scheduling strategies.

[0201] 4) Define the path scheduling change rate ,

[0202]

[0203] When ΔPrefer i A scheduling switchover event is determined when the value exceeds a threshold θ. θ is a dynamic threshold, defined as: θ = μ Δ + k σ Δ , where μ Δ For ΔPrefer i Historical mean, σ Δ For ΔPrefer i The historical standard deviation, k∈[2,3].

[0204] 5) Through the mass function Q i The method for detecting abnormal scheduling behavior using the (t) value is as follows:

[0205] When Q i (t) > Q high AndUsage i (t) < U low When it is determined that a high-quality path is not being used, Q high Ulow As a preset value, Q is taken in this embodiment. high =90%, U low =10%;

[0206] When Q i (t) < Q low AndUsage i (t) > U high When it is determined that a low-quality path is being prioritized, Q low U high As a preset value, Q is taken in this embodiment. low =10%, U high =50%;

[0207] Optionally, define the scheduling deviation. i (t), Deviation i (t) = |Usage i (t) -Prefer i (t)|, when Deviation i If (t) is greater than the preset threshold, then it is determined that there is abnormal scheduling behavior.

[0208] The present invention and its embodiments have been described above illustratively. This description is not restrictive, and the figures shown are only one embodiment of the present invention; the actual structure is not limited thereto. Therefore, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the present invention, such designs should fall within the protection scope of the present invention.

Claims

1. A QUIC multipath scheduling preference inversion method based on passive traffic observation, characterized in that, Includes the following steps: Step S1, collect and process network traffic, including the following steps: Step S1-1: Deploy bypass acquisition devices at key network nodes to mirror UDP traffic data. The acquired traffic data includes packet arrival time, source IP / destination IP / source port / destination port / protocol 5-tuple, QUIC connection ID, packet direction, and packet length. Step S1-2: Identify the protocol, source port, and destination port information in the five-tuple of traffic data extracted in step S1-1. When the protocol is UDP and the source or destination port is 443, the data packet is identified as QUIC traffic. Step S1-3: Process the QUIC stream data identified in step S1-2. The processing methods include: sorting the data packets according to their arrival time, filtering duplicate data packets, and filtering abnormal data packets. Step S1-4: The QUIC data packets processed in step S1-3 are arranged into a data packet sequence PacketStream = {pkt1, pkt2, ..., pkt} according to their arrival time. N Each data packet in the sequence contains the traffic data information collected in step S1-1; Step S2 involves reconstructing the QUIC data packets and dividing them by path, including the following steps: Step S2-1: Reconstruct a session from packets belonging to the same QUIC connection ID in the PacketStream sequence obtained in step S1: Session = { pkt i pkt i .ConnectionID = CID}, where ConnectionID represents the QUIC connection ID, and CID represents the ConnectionID value corresponding to a specific connection; Step S2-2: Calculate the information path P of each data packet in the Session obtained in step S2-1. i P i =(SrcIP, DstIP, SrcPort, DstPort, PathFingerprint i ), where SrcIP is the source IP address, DstIP is the destination IP address, SrcPort is the source port, DstPort is the destination port, and PathFingerprint is the path source port. i For path P i The characteristic fingerprint of the path includes the data packet direction distribution, data packet RTT distribution, and data packet length distribution along the path. Step S2-3, construct the time window. t = [t, t + Δt], for each path P constructed in step S2-2 i In the time window t Built-in packetSubset i (t): PacketSubset i (t) = {pkt j pkt j Belonging to the same session, pkt j The path is P i The arrival time of pktj is located in the time window. t Inside}; Step S2-4, based on path P i Time window t PacketSubset i (t) Construct a session path set SessionPaths, SessionPaths = {(P i Window t PacketSubset i (t))}; Step S3, calculate the relevant network metrics within the SessionPaths set obtained in Step S2, including the following steps: Step S3-1: Calculate path P within the path set. i Traffic percentage, calculated using the time window method. t Inner path P i Traffic i (t), Traffic i (t) = Σ pkt j .size,pkt j ∈PacketSubset i (t), pkt j .size indicates the length of the data packet in bytes; Calculate path P i Traffic share Usage i (t), the method is: ； Step S3-2: Calculate the ACK contribution ratio (ACK_ratio) within the path set. i (t) First, ACK packets are identified by their direction, length, and arrival time. Then, a path P is constructed for the identified ACK packets. i ACK packet set ACKPackets i (t) = { pkt j pkt j ACK packet and pkt j The path is P i }, Then calculate path P. i ACK traffic ACK i (t), ACK i (t) = Σ pkt j .size, pkt j ∈ACKPackets i (t), where pkt j .size indicates the length of the data packet in bytes. Finally, the ACK contribution ratio (ACK_ratio) is calculated. i (t), the method is: ； Step S3-3, calculate path P i Packet loss rate on i (t), first on path P i The data packets in the sending direction are sorted by time to construct a sequence Seq. i = {pkt1, pkt2, ..., pkt n When the time interval between receiving two adjacent data packets exceeds a threshold, or when a sent data packet fails to receive a corresponding ACK response within a preset time window but subsequent data packets have been acknowledged by ACK, it is determined that there is packet loss. Then count the number of lost packets and calculate the packet loss rate (Loss). i (t), the method is: ， Sendpacket i (t) represents the total number of data sent within the time window t, Losspacket i (t) represents the number of lost data packets detected within the time window t; Step S3-4: Calculate path P within time window t. i Average Time Difference (RTT) between the sent data packet and the corresponding ACK data packet i (t), the method is: For the data packet sequence Seq in the sending direction i = {pkt1, pkt2, ..., pkt n }, identify the corresponding ACK packet set ACKPackets i (t) = { pkt j pkt j ACK packet and pkt j The path is P i The matching is based on the temporal correlation between the two. For each sent packet pkt s ∈Seq i Find the earliest arriving ACK packet pkt a ∈ACKPackets i (t), calculate the time difference RTT_sample between the two arrivals. RTT_sample = pkt a .time - pkt s .time Where *.time represents the time the data packet arrived; Mean Time Difference (RTT) i (t) = Avg(RTT_sample), which is the average time difference of all transmitted data packets; Step S3-5: Calculate path P within time window t. i Up-latency jitter i (t), the method is as follows: form a set {RTT_sample} from the time differences RTT_sample obtained in steps S3-4, then ， RTT m This represents the RTT_sample value of data packet m in the set {RTT_sample}, where M is the total number of elements in the set {RTT_sample}; Step S3-6, use the Usage obtained in step S3-1 i (t), the ACK_ratio obtained in step S3-2 i (t), the Loss obtained in step S3-3 i (t), the RTT obtained in step S3-4 i (t), the Jitter obtained in step S3-5 i (t) forms the path feature vector F i (t) = {Usage i (t), ACK_ratio i (t), Loss i (t), RTT i (t), Jitter i (t)}; Step S4: Construct the path quality function Q based on the path feature vector obtained in step S3. i (t), the method is: ， Where α, β, γ, δ > 0 are the parameters to be estimated, satisfying α + β + γ + δ = 1; Step S5 involves inverting network scheduling behavior preferences, including the following steps: Step S5-1, based on the path quality function Q obtained in step S4 i (t) Construct a scheduling preference probability model, the method is as follows: ,satisfy: Prefer i (t) represents the client's access to path P within the time window t. i The probability of scheduling preference; Step S5-2: Construct the objective function based on the observation data. The objective is to minimize L(α, β, γ, δ), that is, to deduce the parameters α, β, γ, δ in the path quality function by minimizing the difference between the observed distribution and the model distribution; Step S5-3: Calculate the parameters α, β, γ, and δ in step S5-2 using the gradient descent method; Step S6, output and analyze scheduling behavior based on network scheduling behavior preferences, including the following steps: Step S6-1, for each path P i Construct a time series preference curve (PreferCurve) based on the time window. i : PreferCurve i = {Prefer i (t1), Prefer i (t2), ..., Prefer i (t n )}, The time series preference curve depicts the change in the scheduling probability of a path within different time windows; Step S6-2, for each path P i Construct a time-quality curve (QualityCurve) based on the quality function. i QualityCurve i = {Q i (t1), Q i (t2), ..., Q i (t n )}; Step S6-3 involves analyzing the relationship between path quality and scheduling behavior by comparing the two curves obtained in steps S6-1 and S6-2, including: judging path switching behavior by changes in the main path, judging changes in load balancing strategy by changes in the proportion of multiple paths, and judging the stability of network scheduling strategy by the degree of curve fluctuation. Step S6-4, Define the path scheduling change rate , ， When ΔPrefer i A scheduling switch event is determined to exist when the value is greater than the threshold θ. Step S6-5, using the mass function Q i The method for detecting abnormal scheduling behavior using the (t) value is as follows: When Q i (t) > Q high AndUsage i (t) < U low When it is determined that a high-quality path is not being used, Q high U low This is the default value; When Q i (t) < Q low AndUsage i (t) > U high When it is determined that a low-quality path is being prioritized, Q low U high This is the default value.

2. The QUIC multipath scheduling preference inversion method based on passive traffic observation as described in claim 1, characterized in that, When QUIC is running on a non-standard port, step S1-2 identifies QUIC traffic through packet characteristics. The packet characteristics include header characteristics, connection identifier characteristics, load randomness characteristics, and flow behavior characteristics. When a packet meets any one or more of the above characteristics, it is determined to be QUIC traffic.

3. The QUIC multipath scheduling preference inversion method based on passive traffic observation as described in claim 1, characterized in that, In step S3-3, lost data packets are determined by retransmission behavior. If two data packets within a time window t satisfy the following conditions: identical 5-tuple, same data packet length, and arrival time interval less than a preset threshold, then retransmission is considered to have occurred. The number of retransmitted data packets is counted to calculate the packet loss rate (Loss). i (t): ， Sendpacket i (t) represents the total number of data sent within the time window t, Retrypacket i (t) represents the number of retransmitted data packets detected within the time window t.

4. The QUIC multipath scheduling preference inversion method based on passive traffic observation as described in claim 1, characterized in that, The process of calculating parameters using the gradient descent method in step S5-3 includes the following steps: Step S5-3-1: Initialize the parameter vector W=(α, β, γ, δ); Step S5-3-2, for each path P within each time window t i The path quality function Q is calculated according to steps S3 and S4. i (t), calculate Prefer according to the method in step S5. i (t); Step S5-3-3: Calculate the objective function L(α, β, γ, δ) using the following method: ； Step S5-3-4, calculate the gradient, the method is as follows: ， in: ， in: ； Step S5-3-5, update the parameter vector W, the method is as follows: , The updated parameter vector is η, where η is the learning rate. The parameter vector update terminates when the change in the objective function between two consecutive iterations is less than the convergence threshold or the number of iterations reaches the preset upper limit. Step S5-3-6: After the update step is completed, the final parameter vector W is obtained. * =(α * , β * , γ * , δ * ); Step S5-3-7: Construct a path scheduling preference function f(P) based on the parameters obtained in step S5-3-6. i ), 。 5. The QUIC multipath scheduling preference inversion method based on passive traffic observation as described in claim 1, characterized in that, Step S5-3 solves for the parameter vector W using the least squares approximation method, and then converts the preference probability model Prefer obtained in step S5-1 into a value. i (t) Make a first-order linear approximation in the neighborhood of the current parameter, and we get: , where a i b i The coefficients obtained by expansion at the current iteration point, Construct the least squares objective function: ， Solve this least squares problem to obtain the initial values ​​W of the parameter vector. (0) =(A T A) -1 A T Y, where A is the coefficient a i The matrix formed, where Y is the observation vector Usage i (t), the initial values ​​of the parameter vector are updated using the gradient descent optimization process in step 5-3.

6. The QUIC multipath scheduling preference inversion method based on passive traffic observation as described in claim 1, characterized in that, Step S5-3 uses the EM algorithm to solve for the parameter vector W, and then calculates the scheduling preference probability Prefer. i (t) is treated as a latent variable, and the parameters are solved iteratively using the expectation-maximization method, including the following steps: E-step: Given the current parameter vector W (r) Under the given conditions, the scheduling preference probability of each path within each time window is calculated according to the preference probability model: ； M-step: Obtained by fixing the E-step Minimize the following loss function: ， Iteration step: Update the parameter vector to W (r+1) Repeat the E-step and M-step until the change in the loss function is lower than a preset threshold or the maximum number of iterations is reached.

7. The QUIC multipath scheduling preference inversion method based on passive traffic observation as described in claim 1, characterized in that, Another method for detecting abnormal scheduling behavior in step S6-5 is to define a scheduling deviation degree. i (t), Deviation i (t) = | Usage i (t) - Prefer i (t)|, When Deviation i If (t) is greater than the preset threshold, then it is determined that there is abnormal scheduling behavior.

Images