Message processing method, message processing device, electronic equipment, medium and product

Abstract

The application discloses a message processing method, a message processing device, electronic equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: determining a target traffic data type in a first time period according to first traffic data obtained in the first time period; determining a target prediction model from a plurality of prediction models according to the target traffic data type; performing prediction processing on traffic feature changes of traffic data in a second time period based on the target prediction model to obtain a traffic data prediction result; and determining a message header compression mode of a target message in the second time period according to the traffic data prediction result. In this way, the application can match a corresponding prediction model through traffic type, thereby ensuring the accuracy of traffic prediction, and the header compression mode can be dynamically determined based on the prediction result, thereby reducing the transmission of redundant data in the message header, relieving network congestion, and improving the transmission efficiency of a virtual local area network tunnel network.

Description

Technical Field

[0001] This application relates to the field of message processing technology, and in particular to a message processing method, message processing apparatus, electronic device, computer-readable storage medium, and computer program product. Background Technology

[0002] In related technologies, when transmitting messages through a Virtual Extensible Local Area Network (VXLAN), VXLAN encapsulation is typically based on the RFC7348 standard. However, the message header within the VXLAN standard encapsulation structure usually occupies a fixed 50 bytes, and encapsulating a complete 50-byte header may result in a low payload ratio, thus wasting bandwidth and other resources. Summary of the Invention

[0003] This application provides a message processing method, a message processing apparatus, an electronic device, a computer-readable storage medium, and a computer program product.

[0004] This application provides a message processing method, the method comprising: Based on the first traffic data obtained within the first time period, the target traffic data type within the first time period is determined, wherein the first traffic data includes the message data of the target packet, the target packet is transmitted through an extensible virtual local area network tunnel, and the target traffic data type is used to indicate the behavioral characteristics of the target packet within the first time period; Based on the target traffic data type, a target prediction model corresponding to the target traffic data type is determined from multiple pre-trained prediction models, wherein each prediction model corresponds to a traffic data type. Based on the target prediction model, the changes in traffic characteristics of traffic data within the second time period are predicted to obtain the traffic data prediction result for the second time period, wherein the second time period is later than the first time period. Based on the traffic data prediction results, the header compression method of the target packet within the second time period is determined, so that the header of the target packet to be transmitted is compressed using the header compression method within the second time period, and the target packet with compressed header is forwarded.

[0005] This application provides a message processing apparatus, the apparatus comprising: The type determination module is used to determine the target traffic data type within the first time period based on the first traffic data obtained within the first time period. The first traffic data includes the message data of the target packet, which is transmitted through a Scalable Virtual Local Area Network tunnel. The target traffic data type is used to indicate the behavioral characteristics of the target packet within the first time period. The model determination module is used to determine a target prediction model corresponding to the target traffic data type from a plurality of pre-trained prediction models, based on the target traffic data type, wherein each prediction model corresponds to a traffic data type. The prediction module is used to predict the changes in traffic characteristics of traffic data within a second time period based on the target prediction model, and to obtain the traffic data prediction result for the second time period, wherein the second time period is later than the first time period. The message processing module is used to determine the message header compression method of the target message in the second time period based on the traffic data prediction result, so as to compress the message header of the target message to be transmitted by the message header compression method in the second time period, and forward the target message with compressed message header.

[0006] This application provides an electronic device, including a memory and a processor. The memory stores a computer program, which, when executed by the processor, implements the above-described message processing method.

[0007] This application provides a computer-readable storage medium storing a computer program that, when executed by one or more processors, implements the above-described message processing method.

[0008] This application provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the above-described message processing method.

[0009] The message processing apparatus, electronic device, computer-readable storage medium, and computer program product provided in this application can determine the target traffic data type within a first time period based on the first traffic data acquired within a first time period. Based on the target traffic data type, it determines a target prediction model corresponding to the target traffic data type from multiple pre-trained prediction models. Based on the target prediction model, it performs prediction processing on the traffic characteristic changes of traffic data within a second time period to obtain the traffic data prediction result for the second time period. Based on the traffic data prediction result, it determines the header compression method for the target message within the second time period. In this way, the header of the target message to be transmitted is compressed using the header compression method within the second time period, and the header-compressed target message is forwarded. This allows for matching the traffic type with the corresponding prediction model, thereby ensuring the accuracy of traffic prediction. Furthermore, the header compression method can be dynamically determined based on the prediction result, thereby reducing redundant data transmission in the header of the target message, reducing bandwidth consumption and computational resource overhead, alleviating network congestion, and improving the transmission efficiency of scalable virtual local area network tunnel networks.

[0010] Additional aspects and advantages of embodiments of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of embodiments of this application. Attached Figure Description

[0011] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, wherein: Figure 1 This is one of the flowcharts illustrating a message processing method in certain embodiments of this application; Figure 2 This is a schematic diagram of a message processing apparatus in some embodiments of this application; Figure 3 This is a schematic diagram of an electronic device in some embodiments of this application; Figure 4 This is a second flowchart illustrating a message processing method in certain embodiments of this application; Figure 5 This is the third flowchart illustrating the message processing method in some embodiments of this application; Figure 6 This is the fourth flowchart illustrating the message processing method in some embodiments of this application. Detailed Implementation

[0012] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the embodiments of this application, and should not be construed as limiting the embodiments of this application.

[0013] In related technologies, Virtual eXtensible LAN (VXLAN) is a Layer 2 Virtual Private Network (VPN) technology based on Internet Protocol (IP) networks, using Media Access Control (MAC) frames encapsulated within User Datagram Protocol (UDP) packets. It belongs to the network virtualization technology within Layer 3 (NVO3) network virtualization. For VXLAN packet encapsulation, the industry typically follows the standard encapsulation format defined in RFC 7348 (Request for Comments 7348, the VXLAN protocol standard document).

[0014] In the standard encapsulation format defined in RFC 7348, the VXLAN header occupies 8 bytes, containing an 8-bit Flags field, a 24-bit VXLAN Network Identifier (VNI), a 24-bit reserved field, and an 8-bit reserved field. Of the 8-bit Flags field, only 1 bit is valid; the remaining 7 bits are left empty during transmission. Similarly, both the 24-bit and 8-bit reserved fields are left empty during transmission.

[0015] In addition, the outer UDP header also occupies 8 bytes. The UDP destination port defaults to 4789 and is configurable. The UDP source port is usually obtained by hashing the inner packet. This source port is used for routing and load balancing of overlay traffic in VXLAN load balancing scenarios. The UDP header also includes a checksum and length field. The outer IP header occupies 20 bytes and contains fields such as the source IP address, destination IP address, and IP protocol type. The outer Ethernet header occupies 14 bytes and contains the source MAC address, destination MAC address, 802.1Q tag, and Ethernet frame type identifier.

[0016] Understandably, VXLAN technology brings significant capability improvements to data centers and medium-to-large campus networks. However, due to the relatively fixed packet header encapsulation structure, it also causes a series of problems in practical applications. First, in terms of bandwidth utilization, standard encapsulation adds a fixed 50-byte overhead. When transmitting 64-byte Voice over Internet Protocol (VoIP) or control packets, the effective payload ratio is only 64 / (50+64), approximately 56.1%. In other words, over 43% of bandwidth resources are occupied by header overhead, resulting in significant waste. Second, from a processing performance perspective, a fully encapsulated 50-byte header requires over 800 Central Processing Unit (CPU) clock cycles, potentially leading to bottlenecks in device processing capabilities. Finally, regarding network traffic control, overlay networks generally adopt a spine-leaf architecture, and the standard encapsulation mechanism may amplify traffic in core switches by 1.5 to 2.5 times. To mitigate the resulting network congestion risk, additional load balancers or traffic shaping devices are often required.

[0017] Based on the issues mentioned above, please refer to Figure 1 This application provides a message processing method, the method including: 01: Based on the first traffic data obtained in the first time period, determine the target traffic data type in the first time period, wherein the first traffic data includes the message data of the target message, the target message is transmitted through an extensible virtual local area network tunnel, and the target traffic data type is used to indicate the behavioral characteristics of the target message in the first time period. 02: Based on the target traffic data type, determine the target prediction model corresponding to the target traffic data type from multiple pre-trained prediction models, wherein each prediction model corresponds to a traffic data type. 03: Based on the target prediction model, the changes in traffic characteristics of traffic data in the second time period are predicted to obtain the traffic data prediction results for the second time period, where the second time period is later than the first time period; 04: Based on the traffic data prediction results, determine the header compression method of the target packet in the second time period, so as to compress the header of the target packet to be transmitted in the second time period and forward the target packet with compressed header.

[0018] Please see Figure 2This application provides a message processing apparatus 200. The message processing method of this application can be implemented by the message processing apparatus 200. Specifically, the message processing apparatus 200 includes a type determination module 210, a model determination module 220, a prediction module 230, and a message processing module 240. The type determination module 210 is used to determine the target traffic data type within a first time period based on first traffic data acquired within a first time period. The first traffic data includes the message data of a target message, which is transmitted through a Scalable Virtual Local Area Network (VLAN) tunnel. The target traffic data type indicates the behavioral characteristics of the target message within the first time period. The model determination module 220 is used to determine a target prediction model corresponding to the target traffic data type from a plurality of pre-trained prediction models, based on the target traffic data type. Each prediction model corresponds to a specific traffic data type. The prediction module 230 is used to predict the changes in traffic characteristics of traffic data within a second time period based on the target prediction model, obtaining a traffic data prediction result for the second time period, where the second time period is later than the first time period. The message processing module 240 is used to determine the message header compression method of the target message in the second time period based on the traffic data prediction result, so as to compress the message header of the target message to be transmitted in the second time period by means of the message header compression method, and forward the target message with the compressed message header.

[0019] Please see Figure 3 This application also provides an electronic device 300, which includes a memory 310 and a processor 320. The message processing method of this application can be implemented by the electronic device 300. Specifically, the memory 310 stores a computer program 311, and the processor 320 is used to determine the target traffic data type in the first time period based on the first traffic data obtained in the first time period, and to determine the target prediction model corresponding to the target traffic data type from a plurality of pre-trained prediction models based on the target traffic data type, and to perform prediction processing on the traffic characteristic changes of traffic data in the second time period based on the target prediction model to obtain the traffic data prediction result in the second time period, and to determine the message header compression method of the target message in the second time period based on the traffic data prediction result, so as to compress the message header of the target message to be transmitted in the second time period by means of the message header compression method, and forward the target message with the compressed message header. The first traffic data includes the message data of the target message, which is transmitted through a Scalable Virtual Local Area Network (VLAN) tunnel. The target traffic data type is used to indicate the behavioral characteristics of the target message in the first time period. Each prediction model corresponds to a traffic data type. The second time period is later than the first time period.

[0020] Specifically, in related technologies, VXLAN packets use standard fixed encapsulation, with the packet header consistently occupying 50 bytes. This results in extremely low bandwidth utilization when transmitting small packets, and significant clock cycle overhead for CPU processing the encapsulated header. Furthermore, overlay networks also experience traffic amplification and network congestion. Therefore, this application provides an active predictive packet processing method. The electronic device first determines the traffic type using historical traffic data (i.e., first traffic data), then matches it with a dedicated prediction model (i.e., the target prediction model) to predict future traffic characteristics (i.e., the traffic data prediction result). Finally, based on the prediction result, it dynamically determines the packet header compression method, thereby achieving on-demand simplification and efficient forwarding of VXLAN packet headers.

[0021] In some implementations, the electronic device can be understood as a VXLAN tunnel endpoint (VTEP) device in a VXLAN network.

[0022] In some examples, electronic devices include physical switches, server smart network interface cards, physical routers, VXLAN private gateways, firewalls with integrated VTEP functionality, and load balancers.

[0023] In some implementations, the first time period can be understood as a historical time interval or the current time interval used to collect baseline traffic data.

[0024] In some examples, the first time period is the past 10 minutes since the current moment.

[0025] In some implementations, the first traffic data can be understood as all packet-related data collected within a first time period, including target packets transmitted through the VXLAN tunnel, used for traffic type determination.

[0026] In some implementations, the target traffic data type can be understood as a classification result used to characterize the transmission behavior characteristics of the target message within a first time period, and used to match the prediction model.

[0027] In some implementations, the target message can be understood as a network message to be processed transmitted through a VXLAN tunnel, which adopts the encapsulation form of MAC frame encapsulated in UDP message and follows the standard encapsulation format defined by RFC7348.

[0028] In some implementations, a VXLAN tunnel can be understood as a Layer 2 VPN virtual tunnel based on an IP network, using an encapsulation method where MAC frames are encapsulated within UDP packets, and is dedicated to the transmission of target packets.

[0029] In some implementations, the second time period can be understood as a future period to be predicted that is later than the first time period.

[0030] In some examples, the second time period is the next hour starting from the current moment.

[0031] In some implementations, the prediction model can be understood as a pre-trained traffic prediction algorithm model designed for different traffic characteristics, used to predict future traffic change trends, numerical changes, and numerical value ranges.

[0032] In some implementations, the target prediction model can be understood as a prediction model that precisely matches the data type of the target traffic.

[0033] In some implementations, changes in traffic characteristics can be understood as the changing trends of transmission characteristics such as bandwidth, message frequency, and header field values ​​of traffic within a second time period.

[0034] In some implementations, the traffic data prediction results can be understood as the predicted data about the traffic characteristics of the second time period output by the target prediction model.

[0035] In some implementations, the header compression method of the target message can be understood as a standardized processing rule for simplifying, replacing, and mapping redundant fields in the VXLAN fixed encapsulation header.

[0036] In some examples, the header compression method of the target message includes field compression and dictionary encoding.

[0037] In some implementations, the message header can be understood as a 50-byte standard encapsulation header consisting of the outer Ethernet header, outer IP header, outer UDP header, and VXLAN header of the VXLAN message.

[0038] In some implementations, forwarding can be understood as the operation of transmitting a target packet with a compressed header normally to the receiving end through a VXLAN tunnel.

[0039] To more clearly illustrate the message processing method provided in the embodiments of this application, please refer to the following exemplary description: First, traffic type determination is performed, which involves collecting the first traffic data within the first time period, i.e., the data containing VXLAN tunnel target packets. The data feature analysis is used to determine the type of target traffic, thereby determining the current transmission behavior characteristics of the target packets and providing a basis for subsequent prediction model matching.

[0040] Then, predictive model matching is performed, which means that based on the determined target traffic data type, a target predictive model that is suitable for the traffic type is selected from multiple pre-trained dedicated predictive models to avoid the problem of poor adaptability of a single model.

[0041] Next, future traffic forecasting is performed. This involves using the target forecasting model as the core to predict and calculate the changes in traffic characteristics in a second time period later than the first time period, outputting the traffic data forecast results for that time period, and completing the prediction of traffic trends.

[0042] Finally, header compression and forwarding are completed. Based on the traffic data prediction results, the header compression method of the target packets in the second time period is determined, and the header of the packets to be transmitted is compressed in accordance with the method, and the forwarding operation of the compressed packets is performed.

[0043] Thus, in this embodiment, the target traffic data type within the first time period can be determined based on the first traffic data acquired within the first time period. Based on the target traffic data type, a target prediction model corresponding to the target traffic data type is determined from multiple pre-trained prediction models. Based on the target prediction model, the traffic characteristic changes of the traffic data within the second time period are predicted to obtain the traffic data prediction result for the second time period. Based on the traffic data prediction result, the header compression method for the target packet within the second time period is determined. In the second time period, the header of the target packet to be transmitted is compressed using the header compression method, and the header-compressed target packet is forwarded. This allows for matching the traffic type to the corresponding prediction model, thereby ensuring the accuracy of traffic prediction. Furthermore, the header compression method can be dynamically determined based on the prediction result, thereby reducing redundant data transmission in the header of the target packet, reducing bandwidth consumption and computational resource overhead, alleviating network congestion, and improving the transmission efficiency of the scalable virtual local area network tunnel network.

[0044] In some embodiments provided in this application, step 01 includes: performing a first feature extraction process on the first traffic data to obtain a first data feature of the first traffic data; and determining the target traffic data type based on the first data feature.

[0045] The type determination module 210 in this embodiment is further configured to perform a first feature extraction process on the first traffic data to obtain a first data feature of the first traffic data, and determine the target traffic data type based on the first data feature.

[0046] The processor 320 in this embodiment is further configured to perform a first feature extraction process on the first traffic data to obtain a first data feature of the first traffic data, and determine the target traffic data type based on the first data feature.

[0047] Specifically, considering that the first traffic data transmitted through the VXLAN tunnel contains a large amount of fragmented and redundant underlying packet information, directly using it for traffic type determination may result in low identification accuracy and poor determination efficiency. This could lead to subsequent prediction model matching errors, traffic prediction deviations, and poor header compression effects, failing to fundamentally solve the core defects of existing VXLAN standard encapsulation such as bandwidth waste, CPU performance bottlenecks, and network traffic amplification and congestion. Therefore, in some embodiments provided in this application, the electronic device can perform a first feature extraction process on the original first traffic data to obtain standardized first data features, and then determine the target traffic data type based on these features, thereby improving the situation where the original traffic data cannot be directly used for type determination.

[0048] In some implementations, the first feature extraction process can be understood as a data processing process that, through operations such as filtering, calculation, and normalization, removes redundant and invalid information from the original first traffic data collected within a first time period, and finally obtains key quantitative indicators that can characterize the traffic transmission behavior and change patterns.

[0049] In some implementations, the first data feature can be understood as one or more indicators generated after the first feature extraction process, which can be used to determine the traffic type and distinguish different traffic data types.

[0050] In one example, after completing the first traffic data acquisition, the electronic device performs a first feature extraction process on the first traffic data. That is, based on the traffic characteristics of the VXLAN Overlay network, it purifies the raw traffic data from dimensions such as bandwidth fluctuation amplitude, traffic periodicity, packet burst frequency, Transmission Control Protocol (TCP) retransmission rate, and VNI field characteristics. Invalid and redundant underlying packet data is removed, and indicators that can reflect the essential behavior of the traffic, such as bandwidth rate and bandwidth change per unit time, are retained and calculated. These indicators are then integrated to form the first data feature. Based on the first data feature and combined with preset judgment rules, the target traffic data type within the first time period is determined. Thus, in this embodiment of the application, the first feature extraction process can be performed on the first traffic data to obtain the first data feature of the first traffic data, and the target traffic data type can be determined based on the first data feature. This can eliminate redundancy and noise in the original traffic data through the first feature extraction process, thereby reducing the complexity of data processing, improving the efficiency of traffic type determination, and improving the accuracy of the determination result of the target traffic data type, thus avoiding misjudgment.

[0051] In some embodiments provided in this application, the step of determining the target traffic data type based on the first data feature includes: inputting the first data feature into a pre-trained type prediction model so that the type prediction model can predict the traffic data type of the first traffic data based on the first data feature to obtain the target traffic data type of the first traffic data.

[0052] The model determination module 220 in this embodiment is further configured to input the first data features into a pre-trained type prediction model, so that the type prediction model can perform prediction processing on the traffic data type of the first traffic data based on the first data features, and obtain the target traffic data type of the first traffic data.

[0053] The processor 320 in this embodiment is further configured to input the first data features into a pre-trained type prediction model, so that the type prediction model can perform prediction processing on the traffic data type of the first traffic data based on the first data features, and obtain the target traffic data type of the first traffic data.

[0054] Specifically, considering that traditional methods such as fixed threshold comparison are used to determine traffic type, there are drawbacks such as low efficiency, poor real-time performance, and insufficient accuracy. Therefore, in some embodiments provided in this application, the electronic device can input the extracted traffic feature data into a pre-trained type prediction model to accurately determine the traffic type through the model's prediction processing.

[0055] In some implementations, the type prediction model can be understood as a machine learning model that has been pre-trained using massive amounts of VXLAN traffic feature data and is specifically designed to identify and classify network traffic data types.

[0056] In some implementations, the predictive processing of traffic data types can be understood as a calculation and determination process in which a type prediction model, based on the first data feature of the input, performs internal algorithmic operations, feature matching, and classification decisions to determine the type of traffic data.

[0057] In some implementations, the type prediction model is a support vector machine.

[0058] Thus, in this embodiment of the application, the first data feature can be input into a pre-trained type prediction model, so that the type prediction model can predict the traffic type of the first traffic data based on the first data feature to obtain the target traffic type of the first traffic data. This allows for intelligent prediction based on the machine learning model to accurately identify the traffic type, and the accuracy of traffic type identification is greatly improved.

[0059] In some embodiments provided in this application, the type prediction model is a random forest model.

[0060] Specifically, the random forest model is a classification model based on ensemble learning, which is composed of multiple independent decision trees. It outputs the final classification result by parallel computation of input features and voting decision. It has the characteristics of being resistant to data noise, not being prone to overfitting, and adapting to high-dimensional feature data, and can stably complete the accurate classification of traffic types.

[0061] In this way, relying on the high robustness and high classification accuracy of the random forest model, accurate classification of traffic data features can be achieved, and reliable target traffic data types can be output.

[0062] In some embodiments provided in this application, the first data feature includes at least one of a stability index, a periodic intensity index, and a burst frequency index. The stability index is used to indicate the data change trend within the first flow data, the periodic intensity index is used to indicate the periodic change pattern of the first flow data, and the burst frequency index is used to indicate the number of sudden changes in the first flow data.

[0063] Specifically, in some embodiments provided in this application, the first data feature may include at least one of a stability index, a periodic intensity index, and a burst frequency index, so that the electronic device can accurately determine the data type of the traffic flow through multi-dimensional quantitative features.

[0064] In some implementations, the stability index can be understood as a quantitative parameter that measures the magnitude and trend stability of numerical fluctuations during the transmission of the first traffic data. It can be used to reflect whether the traffic remains stable and without drastic fluctuations.

[0065] In some examples, stationarity metrics include at least one of the following: ADF unit root test p-value, traffic bandwidth coefficient of variation, differential fluctuation amplitude, traffic trend slope, and message arrival interval variance.

[0066] The ADF unit root test p-value is obtained by performing an ADF test on the first flow data. A p-value less than the threshold (e.g., 0.05) indicates stationarity, while a p-value greater than the threshold indicates non-stationarity.

[0067] The coefficient of variation of bandwidth is the quotient of the standard deviation of bandwidth and the mean of bandwidth. A coefficient of variation less than a small threshold (such as 0.2) indicates high stability, greater than a large threshold (such as 0.5) indicates non-stability, and a coefficient of variation between the small and large thresholds indicates moderate stability.

[0068] The fluctuation range after differential is obtained by performing a first-order differential on the first traffic data. If the traffic bandwidth fluctuation range is less than or equal to the threshold (e.g., ±20Mbps), it means that the sequence has been processed into a highly stable sequence.

[0069] The slope of the flow trend is the slope of the change in flow rate per unit time. If the absolute value of the slope is less than the threshold (such as 0.1 Mbps / minute), it can be regarded as having no obvious upward or downward trend and high stability.

[0070] The message arrival interval variance is the time difference variance between adjacent messages. If this variance is less than a threshold (such as 10ms²), it indicates that the message sending rhythm is stable and the traffic is steady.

[0071] In some implementations, the periodic intensity index can be understood as a parameter that quantifies the degree to which the first flow data exhibits a periodic fluctuation pattern, and can be used to reflect the strength of the characteristic of flow changing with a fixed period over time.

[0072] In some examples, the cyclical strength indicators include at least one of the following: the proportion of seasonal terms in the seasonal and trend decomposition using Loess (STL) based on locally weighted regression, the weekday / weekend traffic difference rate, and white noise in Ljung-Box test residuals.

[0073] The STL decomposition seasonal term ratio is calculated by performing STL decomposition on the first flow data to obtain the trend term, seasonal term, and residual term. The quotient of the seasonal term energy and the total energy is then calculated. If the STL decomposition seasonal term ratio is greater than a threshold (such as 70%), it indicates that the cycle intensity is extremely strong.

[0074] The weekday / weekend traffic difference rate is the difference between the weekday peak and the weekend peak divided by the weekday peak. If this difference rate is less than a threshold (such as 30%), the cyclical pattern is stable and predictable.

[0075] In some implementations, the burst frequency index can be understood as the number of times that the first traffic data experiences sudden changes in key data such as bandwidth and packet volume within a unit of time, which can be used to reflect the frequency of sudden fluctuations in traffic.

[0076] In some implementations, the burst frequency index is at least one of the following: number of bursts per unit time, bandwidth change rate per sampling point, peak traffic multiple, burst duration percentage, and bandwidth steep increase rate.

[0077] The number of bursts per unit time refers to the number of traffic bursts within one hour. If this number exceeds a threshold (e.g., 5), it is considered a high burst of traffic.

[0078] The bandwidth change rate of a single sampling point is the amplitude of the bandwidth change between adjacent sampling points. If this rate of change is greater than a threshold (e.g., 50%), it is counted as one valid burst.

[0079] The peak traffic multiple is a multiple of the historical average bandwidth of the instantaneous bandwidth. If this multiple is greater than the threshold (such as 10), it is judged as a severe burst.

[0080] The percentage of burst duration is the duration of a single burst. If this duration is less than a threshold (e.g., 5 minutes), and the total burst duration accounts for less than a threshold (e.g., 10%) of the statistical period, then the burst traffic is considered short and instantaneous.

[0081] The bandwidth surge rate is the bandwidth increase within 1 second. If this rate exceeds a threshold (e.g., 100Mbps), it is considered a strong burst event.

[0082] Thus, in the embodiments of this application, at least one of the stability index, periodic intensity index, and burst frequency index can be used for category prediction, thereby reducing the misclassification rate of traffic type.

[0083] In some embodiments provided in this application, the target flow data type is one of stable flow, burst flow, and mixed flow. Therefore, step 01 above includes: determining the target flow data type as stable flow when the stability index is greater than a first preset threshold and the period intensity index is greater than a second preset threshold; determining the target flow data type as burst flow when the burst frequency index is greater than a third preset threshold; and determining the target flow data type as mixed flow when the stability index is less than or equal to the first preset threshold, the period intensity index is less than or equal to the second preset threshold, and the burst frequency index is less than or equal to the third preset threshold.

[0084] The type determination module 210 in this embodiment is further configured to determine the target flow data type as stable flow when the stability index is greater than the first preset threshold and the period intensity index is greater than the second preset threshold, and to determine the target flow data type as burst flow when the burst frequency index is greater than the third preset threshold, and to determine the target flow data type as mixed flow when the stability index is less than or equal to the first preset threshold, the period intensity index is less than or equal to the second preset threshold, and the burst frequency index is less than or equal to the third preset threshold.

[0085] The processor 320 in this application embodiment is further configured to determine the target flow data type as stable flow when the stability index is greater than a first preset threshold and the period intensity index is greater than a second preset threshold, and to determine the target flow data type as burst flow when the burst frequency index is greater than a third preset threshold, and to determine the target flow data type as mixed flow when the stability index is less than or equal to the first preset threshold, the period intensity index is less than or equal to the second preset threshold, and the burst frequency index is less than or equal to the third preset threshold.

[0086] Specifically, to avoid errors in subsequent traffic prediction model matching due to inaccurate classification results, resulting in a significant decrease in traffic prediction accuracy and making the VXLAN packet header compression strategy unsuitable for actual traffic scenarios, some embodiments provided in this application can set corresponding quantitative preset thresholds for the three major indicators of stability, periodic intensity, and burst frequency, and establish standardized traffic type determination rules. This allows traffic to be accurately classified into three categories: stable, bursty, and mixed, providing an accurate classification basis for subsequent matching of dedicated traffic prediction models.

[0087] In some implementations, stable flow can be understood as a type of flow whose transmission trend is predictable, with small fluctuations, exhibiting stable linear patterns or obvious periodic characteristics, and without frequent instantaneous surges.

[0088] In some implementations, burst traffic can be understood as a type of traffic that experiences a sudden surge in bandwidth over a short period of time, is short in duration, has no fixed transmission pattern, and exhibits strong nonlinear burst characteristics.

[0089] In some implementations, mixed traffic can be understood as a type of traffic that simultaneously possesses multiple characteristics such as stability, periodicity, and burstiness, with no single characteristic dominating, resulting in a complex and varied traffic pattern.

[0090] In some implementations, the first preset threshold can be understood as a quantitative critical value for measuring whether the flow stability index meets the standard and determining whether the flow has high stability.

[0091] In some implementations, the second preset threshold can be understood as a quantitative critical value for measuring whether the flow period intensity index meets the standard and determining whether the flow has strong periodicity.

[0092] In some implementations, the third preset threshold can be understood as a quantitative threshold for measuring whether the traffic burst frequency index meets the standard and determining whether the traffic has a high burst frequency.

[0093] In one example, when the stationarity index is greater than 0.8, that is, when the ADF test p-value in the stationarity index is less than 0.01, if the periodicity index is greater than 0.7, that is, when the seasonal component of the STL decomposition in the periodicity index accounts for more than 70%, then the target flow data type is determined to be stationary flow.

[0094] In one example, when the burst frequency index is greater than 5 times / hour, that is, when the bandwidth change rate of 3 consecutive sampling points is greater than 50%, the target traffic data type is determined to be burst traffic.

[0095] In one example, when the voting share of mixed feature indicators is greater than 60%, that is, when the detected traffic exhibits multiple features simultaneously and no single feature dominates, i.e., all features are relatively significant but none exceed 60% of the weight, or when the stability index is between 0.3 and 0.8, the burst frequency is between 2 and 5 times per hour, the periodic intensity is between 30% and 70%, and the fluctuation clustering is obvious (such as a significant ARCH effect), then the target traffic data type is determined to be mixed traffic.

[0096] Thus, in this embodiment, when the stability index is greater than the first preset threshold and the periodic intensity index is greater than the second preset threshold, the target flow data type is determined to be stable flow; when the burst frequency index is greater than the third preset threshold, the target flow data type is determined to be burst flow; and when the stability index is less than or equal to the first preset threshold, the periodic intensity index is less than or equal to the second preset threshold, and the burst frequency index is less than or equal to the third preset threshold, the target flow data type is determined to be mixed flow. This allows for efficient and accurate determination of flow type through quantified thresholds, thereby ensuring the accuracy of the classification results.

[0097] In some embodiments provided in this application, the target flow data type is one of stable flow, burst flow, and mixed flow, and the multiple prediction models include a first prediction model corresponding to stable flow, a second prediction model corresponding to burst flow, and a third prediction model corresponding to mixed flow.

[0098] Specifically, in some embodiments provided in this application, corresponding first, second, and third prediction models can be configured for three types of traffic data: stable, bursty, and mixed, respectively, thereby establishing a one-to-one matching relationship between traffic types and prediction models. In this way, a dedicated model can be used to adapt to a specific traffic scenario, which is more accurate and has stronger scenario adaptability compared to the single model prediction method.

[0099] In some implementations, stable flow can be understood as a type of flow whose transmission trend is predictable, with small fluctuations, exhibiting stable linear patterns or obvious periodic characteristics, and without frequent instantaneous surges.

[0100] In some implementations, burst traffic can be understood as a type of traffic that experiences a sudden surge in bandwidth over a short period of time, is short in duration, has no fixed transmission pattern, and exhibits strong nonlinear burst characteristics.

[0101] In some implementations, mixed traffic can be understood as a type of traffic that simultaneously possesses multiple characteristics such as stability, periodicity, and burstiness, with no single characteristic dominating, resulting in a complex and varied traffic pattern.

[0102] In some implementations, the electronic device can determine whether the target traffic data type is stable traffic, burst traffic, or mixed traffic based on the first data characteristics of the first traffic data. The specific process can be found in the previous text and will not be repeated here to avoid repetition.

[0103] In some implementations, multiple prediction models can be understood as a collection of multiple dedicated algorithm models that have been pre-trained for different traffic characteristics of VXLAN networks and can independently perform traffic prediction. This is the basis for achieving accurate prediction in different scenarios.

[0104] In some implementations, the first prediction model can be understood as a dedicated prediction model specifically adapted to stationary flow characteristics and used to predict the future trend of such flow.

[0105] In one example, the first prediction model includes a seasonal autoregressive integral moving average model and an autoregressive moving average model. In the actual prediction process, prediction can be made using at least one of the seasonal autoregressive integral moving average model and the autoregressive moving average model.

[0106] In some implementations, the second prediction model can be understood as a dedicated prediction model specifically adapted to the characteristics of sudden traffic flow and used to predict the future trend of such traffic flow.

[0107] In some implementations, the second prediction model is a long short-term memory neural network model.

[0108] In some implementations, the third prediction model can be understood as a dedicated prediction model specifically adapted to the characteristics of mixed traffic and used to predict the future trend of such traffic.

[0109] In some implementations, the second prediction model is a deep learning model.

[0110] Thus, in this embodiment of the application, corresponding first, second, and third prediction models can be configured for the three types of traffic data: stable, bursty, and mixed, respectively, thereby establishing a one-to-one matching relationship between traffic types and prediction models. In this way, a dedicated model can be used to adapt to a specific traffic scenario, which is more accurate and has stronger scenario adaptability compared to the single model prediction method.

[0111] In some embodiments provided in this application, the first traffic data is a data sequence sorted by time. Therefore, step 03 above includes: when the target prediction model is the first prediction model, determining whether the data change trend of the data sequence is stable; when the data change trend of the data sequence is determined to be stable, determining the data sequence as the input data of the first model; when the data change trend of the data sequence is determined to be unstable, performing correction processing on the data sequence, and determining the result of the correction processing as the input data of the first model; based on the first model input data and the first prediction model, performing prediction processing on the traffic characteristic changes of the traffic data in the second time period to obtain the traffic data prediction result for the second time period.

[0112] The prediction module 230 in this application embodiment is further configured to determine whether the data change trend of the data sequence is stable when the target prediction model is the first prediction model, and when the data change trend of the data sequence is determined to be stable, the data sequence is determined to be the input data of the first model, and when the data change trend of the data sequence is determined to be unstable, the data sequence is corrected and the result of the correction is determined to be the input data of the first model, and based on the first model input data and the first prediction model, the flow characteristic change of the flow data in the second time period is predicted to obtain the flow data prediction result of the second time period.

[0113] The processor 320 in this embodiment is further configured to, when the target prediction model is the first prediction model, determine whether the data change trend of the data sequence is stable, and when the data change trend of the data sequence is determined to be stable, determine the data sequence as the input data of the first model, and when the data change trend of the data sequence is determined to be unstable, perform correction processing on the data sequence and determine the result of the correction processing as the input data of the first model, and perform prediction processing on the traffic characteristic changes of the traffic data in the second time period based on the first model input data and the first prediction model to obtain the traffic data prediction result of the second time period.

[0114] Specifically, in order to accurately predict changes in the flow characteristics of stationary flow, in some embodiments provided in this application, the electronic device can first verify the stationarity of the flow data sequence, then correct the non-stationary data, and finally use the stationary data to drive the model prediction, thereby ensuring the accuracy of stationary flow prediction.

[0115] In some implementations, a data sequence can be understood as a first set of traffic data collected and arranged sequentially in chronological order.

[0116] In some implementations, the trend of data change can be understood as the fluctuation range, rise and fall pattern, stability and other characteristics of the data sequence in the time dimension.

[0117] In some implementations, the correction process can be understood as a process that, for non-stationary data sequences, eliminates trend and fluctuation interference and transforms non-stationary data into stationary data through operations such as differencing, logarithmic transformation, and seasonal adjustment.

[0118] In one example, for VXLAN tunnel traffic data (i.e., data sequences) collected at 5-minute intervals and containing indicators such as VNI identifiers, ingress interface bandwidth, and packet forwarding volume, the electronic device can determine stationarity using the ADF unit root test p-value. If the p-value is greater than 0.05, the data sequence is determined to be non-stationary. The data sequence is then subjected to first-order differencing to eliminate trend and seasonal fluctuations, making the sequence more stable. The differrated data sequence is then used as the input data for the first model. Conversely, if the p-value is less than or equal to 0.05, the data sequence is directly used as the input data for the first model.

[0119] In some implementations, if the p-value of the differenced data sequence is still greater than 0.05 after first-order differencing, higher-order differencing can be performed on the differenced data sequence until the p-value is less than 0.05.

[0120] In some implementations, if the p-value of the differenced data sequence is still greater than 0.05 after first-order differencing, seasonal differencing can be performed on the differenced data sequence.

[0121] In some implementations, if the p-value of the differenced data sequence is still greater than 0.05 after first-order differencing, the logarithm of the differenced data sequence can be taken before further differencing.

[0122] In some implementations, the first model input data can be understood as data that, after being judged or corrected for stationarity, meets the first prediction model input criteria and can be directly used for model calculation.

[0123] To more clearly illustrate the message processing method provided in the embodiments of this application, please refer to the following exemplary description: When the target prediction model matches the first prediction model corresponding to stationary flow, the trend of the data sequence is first analyzed to determine whether it is in a stationary state.

[0124] If the data sequence shows a stable trend, it is directly selected as the input data for the first model.

[0125] If the data sequence is determined to be non-stationary, a correction process is immediately performed to eliminate interference factors such as trends and seasonality. The corrected result is then used as the input data for the first model to ensure that the data fully meets the calculation requirements of the first prediction model.

[0126] Finally, the input data of the first model is input into the first prediction model so that the model can perform traffic characteristic change prediction calculations for the second time period that is later than the first time period, and finally output accurate traffic data prediction results.

[0127] Thus, in this embodiment, when the target prediction model is the first prediction model, it can be determined whether the data change trend of the data sequence is stable. When the data change trend of the data sequence is determined to be stable, the data sequence is determined as the input data of the first model. When the data change trend of the data sequence is determined to be unstable, the data sequence is corrected and the result of the correction is determined as the input data of the first model. Based on the input data of the first model and the first prediction model, the traffic characteristic change of the traffic data in the second time period is predicted to obtain the traffic data prediction result for the second time period. Therefore, by judging the stability of the data in advance and making targeted corrections, the model input data can be adapted to the input requirements of the first prediction model, thereby improving the prediction accuracy.

[0128] In some embodiments provided in this application, the first prediction model includes an autoregressive moving average model.

[0129] Specifically, in order to accurately capture the linear patterns and small fluctuations of stable traffic, in some embodiments provided in this application, the first prediction model corresponding to stable traffic can be set as an Autoregressive Integrated Moving Average Model (ARIMA). Then, the electronic device can use the high adaptability of this model to stable time series to accurately predict the future characteristics of stable traffic, thereby providing stable and accurate prediction data for subsequent dynamic compression of VXLAN packet headers and realizing packet processing optimization in stable traffic scenarios.

[0130] In some implementations, the autoregressive moving average model can be understood as a model that uses three core logics—autoregression, differencing, and moving average—to achieve trend fitting and future numerical prediction of stationary time series data, and can be adapted to linear prediction of stationary flow characteristics.

[0131] Thus, in the embodiments of this application, the first prediction model corresponding to the stationary flow can be set as an autoregressive moving average model, thereby utilizing the high adaptability of this model to stationary time series to complete the accurate prediction of the future characteristics of the stationary flow.

[0132] In some embodiments provided in this application, the step of predicting the changes in traffic characteristics of traffic data within a second time period based on the first model input data and the first prediction model to obtain the traffic data prediction result for the second time period includes: determining the autocorrelation function graph and the partial autocorrelation function graph based on the first model input data; configuring the lag order and the moving average order in the first prediction model based on the autocorrelation function graph and the partial autocorrelation function graph; and inputting the first model input data into the first prediction model in which the lag order and the moving average order are configured, so that the first prediction model can predict the changes in traffic characteristics of traffic data within the second time period based on the first model input data to obtain the traffic data prediction result for the second time period.

[0133] The prediction module 230 in this embodiment is further configured to determine the autocorrelation function graph and the partial autocorrelation function graph based on the input data of the first model, configure the lag order and the moving average order in the first prediction model based on the autocorrelation function graph and the partial autocorrelation function graph, and input the input data of the first model into the first prediction model in which the lag order and the moving average order are configured, so that the first prediction model can perform prediction processing on the changes in the flow characteristics of the flow data in the second time period based on the input data of the first model, and obtain the flow data prediction result of the second time period.

[0134] The processor 320 in this embodiment is further configured to determine the autocorrelation function graph and the partial autocorrelation function graph based on the first model input data, configure the lag order and the moving average order in the first prediction model based on the autocorrelation function graph and the partial autocorrelation function graph, and input the first model input data into the first prediction model in which the lag order and the moving average order are configured, so that the first prediction model performs prediction processing on the changes in the flow characteristics of the flow data in the second time period based on the first model input data, and obtains the flow data prediction result for the second time period.

[0135] Specifically, the lag order *p* and moving average order *q* of the ARIMA model are key parameters affecting prediction accuracy. However, in traditional techniques, these parameters are typically selected based on manual experience, which can easily lead to unreasonable parameter configurations and consequently affect the model's prediction accuracy. Therefore, in some embodiments provided in this application, the core parameters of the model can be accurately determined using autocorrelation function graphs and partial autocorrelation function graphs. After completing the model configuration, stationary traffic data is input to achieve accurate prediction of the stationary traffic characteristics in the second time period, providing a reliable basis for subsequent VXLAN packet header compression.

[0136] In some implementations, the Autocorrelation Function Plot (ACF) can be understood as a statistical graph that reflects the degree of linear correlation between current data and historical lagged data in a flow time series, and is used to determine the moving average order of the ARIMA model.

[0137] In some implementations, the Partial Autocorrelation Function Plot (PACF) can be understood as a statistical graph showing the correlation between the current data of the flow time series and the specified lag data after removing interference from intermediate lag data, and is used to determine the lag order of the ARIMA model.

[0138] In some implementations, the lag order p can be understood as the order of the autoregressive term in the ARIMA model, representing the number of steps by which historical flow data influences the current prediction result.

[0139] In some implementations, the moving average order q can be understood as the order of the moving average term in the ARIMA model, representing the number of steps by which historical prediction errors affect the current prediction result.

[0140] To more clearly illustrate the message processing method provided in the embodiments of this application, please refer to the following exemplary description: First, based on the input data of the first model after stabilization, autocorrelation function (ACF) and partial autocorrelation function (PACF) plots are drawn to intuitively present the correlation characteristics of the flow series.

[0141] Then, the lag order p is determined by the cutoff point of the PACF plot, and the moving average order q is determined by the cutoff point of the ACF plot, thus completing the parameter configuration of the ARIMA model. The cutoff point can be understood as the boundary point in the autocorrelation function plot or partial autocorrelation function plot where the lag order suddenly becomes zero after a certain lag, or the boundary point where the lag order falls within the confidence interval and is no longer significantly non-zero after a certain lag.

[0142] Finally, the input data of the first model is passed to the ARIMA model with the parameters configured. Based on the linear law of historical stable flow, the model calculates and infers the flow characteristics changes in the second time period, which is later than the first time period, and finally outputs the flow data prediction results.

[0143] Thus, in this embodiment, the autocorrelation function graph and partial autocorrelation function graph can be determined based on the input data of the first model. Based on these graphs, the lag order and moving average order in the first prediction model can be configured. The input data of the first model is then input into the first prediction model, where both the lag order and moving average order are configured. This allows the first prediction model to predict the changes in traffic characteristics of the traffic data within the second time period based on the input data, thereby obtaining the traffic data prediction result for the second time period. Therefore, model parameters can be configured using the autocorrelation function graph and partial autocorrelation function graph, which is more accurate and efficient than manual configuration.

[0144] In some embodiments provided in this application, the step of predicting the changes in flow characteristics of flow data within a second time period based on the first model input data and the first prediction model to obtain the flow data prediction result for the second time period includes: when the target prediction model is the first prediction model, if the first model input data has a periodic pattern and is east-west flow data, then configuring the seasonal periodic parameter, seasonal difference parameter, and seasonal lag term parameter of the first prediction model; decomposing the first model input data to obtain the trend term, seasonal term, and residual term; performing a preset verification process on the first prediction model with configured parameters using the first model input data; and inputting the first model input data into the first prediction model with configured parameters after the preset verification process has been passed, so that the first prediction model can predict the changes in flow characteristics of flow data within the second time period based on the first model input data to obtain the flow data prediction result for the second time period.

[0145] The prediction module 230 in this embodiment is further configured to, when the target prediction model is the first prediction model, configure the seasonal periodic parameters, seasonal difference parameters, and seasonal lag parameters of the first prediction model if the input data of the first model has a periodic pattern and is east-west flow data, and decompose the input data of the first model to obtain trend terms, seasonal terms, and residual terms, and perform preset verification processing on the first prediction model with configured parameters through the input data of the first model, and input the input data of the first model to the first prediction model with configured parameters when the first prediction model with configured parameters passes the preset verification processing, so that the first prediction model can perform prediction processing on the flow characteristics changes of the flow data in the second time period according to the input data of the first model, and obtain the flow data prediction result of the second time period.

[0146] The processor 320 in this embodiment is further configured to, when the target prediction model is a first prediction model, configure the seasonal periodic parameters, seasonal difference parameters, and seasonal lag parameters of the first prediction model if the input data of the first model has a periodic pattern and is east-west flow data, and decompose the input data of the first model to obtain trend terms, seasonal terms, and residual terms, and perform preset verification processing on the first prediction model with configured parameters through the input data of the first model, and input the input data of the first model to the first prediction model with configured parameters when the first prediction model with configured parameters passes the preset verification processing, so that the first prediction model can perform prediction processing on the flow characteristics changes of the flow data in the second time period according to the input data of the first model, and obtain the flow data prediction result of the second time period.

[0147] Specifically, for east-west stable traffic with periodic patterns, in some embodiments provided in this application, the first prediction model can be optimized through seasonal parameter configuration, data decomposition, and model preset verification. Then, the verified model can be used to complete future traffic prediction, thereby achieving accurate prediction of periodic stable traffic and providing reliable data for subsequent VXLAN header compression.

[0148] In some implementations, the seasonal periodic parameter can be understood as a fixed time interval parameter that characterizes the periodic fluctuations of traffic flow, used to match the daily, weekly, and other periodic patterns of east-west traffic flow.

[0149] In some implementations, the seasonality difference parameter can be understood as the difference order parameter used to eliminate seasonal fluctuations in traffic data.

[0150] In some implementations, the seasonal lag parameter can be understood as a lag order parameter that describes the relationship between the current periodic flow and the historical periodic flow, and is used to capture periodic characteristics.

[0151] In some implementations, decomposition processing can be understood as a data analysis operation that breaks down the raw traffic data into different characteristic components.

[0152] In some examples, the decomposition process is performed as an STL decomposition.

[0153] In some implementations, the trend term can be understood as the long-term stable direction of change in traffic data, which is the core trend of traffic change.

[0154] In some implementations, the seasonality can be understood as the fluctuating characteristics that repeat at fixed periods in the flow data, which is the core feature of east-west flow.

[0155] In some implementations, the residual term can be understood as a random fluctuation component that cannot be explained by the trend and seasonal terms after decomposition, representing random disturbances in the flow.

[0156] In some implementations, the preset verification process can be understood as a standardized verification operation to check the fitting effect of the prediction model and ensure the effectiveness of the model prediction.

[0157] To more clearly illustrate the message processing method provided in the embodiments of this application, please refer to the following exemplary description: First, after confirming that the current prediction model corresponds to a stable flow and that the input data of the first model has obvious periodic patterns, such as a flow peak from 9:00 to 18:00 and a flow trough in the early morning, it can be confirmed that the input data of the first model belongs to east-west flow data. Based on the periodic characteristics of east-west flow, matching seasonal period parameters, seasonal difference parameters, and seasonal lag parameters are configured for the first prediction model. For example, the seasonal period parameter s is set to 24 hours, and a seasonal difference parameter D is introduced and set to 1. Seasonal lag parameters P and Q are introduced and set to 1. This enables the input data of the first model to have the ability to capture periodic fluctuations.

[0158] Then, STL decomposition is performed on the input data of the first model to split the input data of the first model into trend terms, seasonal terms, and residual terms, thereby separating the long-term trend, fixed periodic fluctuations and random interference of the flow and eliminating invalid noise.

[0159] Subsequently, based on the white noise test method using residuals, such as the Ljung-Box test, the model with configured parameters is validated by inputting the first model data to test the model's ability to fit the periodic flow, ensuring that the model has no overfitting or underfitting problems and has reliable predictive capabilities.

[0160] Finally, once the model passes validation, the first model input data is fed into the model. Based on periodic and trend characteristics, the model predicts the changes in traffic characteristics in the second time period and ultimately outputs reliable traffic data prediction results. This guides subsequent packet header compression. For example, in a government cloud data center scenario, the model can predict the daily "9-to-5" traffic peak 30 minutes in advance, allowing the TTL field in the VXLAN header to be pre-adjusted, such as reducing it from the default 64 to 32, reducing invalid tunnel forwarding and improving link utilization.

[0161] Thus, in this embodiment, when the target prediction model is a first prediction model, if the input data of the first model exhibits a periodic pattern and is east-west flow data, then the seasonal periodic parameters, seasonal difference parameters, and seasonal lag parameters of the first prediction model are configured. The input data of the first model is then decomposed to obtain trend terms, seasonal terms, and residual terms. A preset verification process is then performed on the first prediction model with configured parameters using the first model input data. If the first prediction model with configured parameters passes the preset verification process, the input data of the first model is input into the first prediction model with configured parameters. This allows the first prediction model to predict the changes in flow characteristics of the flow data within a second time period based on the first model input data, obtaining the flow data prediction result for the second time period. This allows for accurate capture of the periodic fluctuation pattern of east-west flow through seasonal parameter adaptation, thereby reducing flow prediction errors. Furthermore, random interference can be eliminated through data decomposition, further improving the model's prediction accuracy. In addition, preset verification ensures that the model's prediction function is not invalid, thus guaranteeing the reliability of the prediction results.

[0162] In some embodiments provided in this application, the first prediction model includes a seasonal autoregressive integral moving average model.

[0163] Specifically, considering that the ARIMA model can only handle aperiodic, stable traffic flow, and its performance is poor for east-west traffic flow with fixed daily / weekly periodic fluctuations, the first prediction model can be configured as a Seasonal Autoregressive Integrated Moving Average (SARIMA) model when the input data for the first model is east-west traffic flow. This allows the model to capture the periodic patterns of east-west stable traffic flow through its seasonal parameter configuration, thereby enabling accurate prediction of traffic characteristics in the second time period and providing a reliable prediction basis for subsequent VXLAN packet header compression.

[0164] In some implementations, the seasonal autoregressive integral moving average model can be understood as a time series prediction model that adds seasonal period, seasonal difference, and seasonal lag term parameters to the autoregressive integral moving average model. It is specifically designed to process traffic data with fixed periodicity and seasonal fluctuation patterns, and can accurately capture the periodic change characteristics of traffic.

[0165] Thus, in this embodiment of the application, the periodic pattern of east-west stable traffic can be captured by the seasonal autoregressive integral moving average model, thereby completing the accurate prediction of traffic characteristics in the second time period and providing a reliable prediction basis for subsequent VXLAN packet header compression.

[0166] In some embodiments provided in this application, step 03 includes: when the target prediction model is a second prediction model, performing a second feature extraction process on the first traffic data to obtain a data feature vector; inputting the data feature vector into the second prediction model so that the second prediction model can perform prediction processing on the traffic feature changes of the traffic data in the second time period based on the data feature vector, and obtain the traffic data prediction result for the second time period.

[0167] In this embodiment, the prediction module 230 is further configured to perform a second feature extraction process on the first traffic data to obtain a data feature vector when the target prediction model is a second prediction model; and input the data feature vector into the second prediction model so that the second prediction model can perform prediction processing on the traffic feature changes of the traffic data in the second time period based on the data feature vector, and obtain the traffic data prediction result for the second time period.

[0168] The processor 320 in this embodiment is further configured to perform a second feature extraction process on the first traffic data to obtain a data feature vector when the target prediction model is a second prediction model; input the data feature vector into the second prediction model so that the second prediction model can perform prediction processing on the traffic feature changes of the traffic data in the second time period based on the data feature vector, and obtain the traffic data prediction result for the second time period.

[0169] Specifically, in some embodiments provided in this application, for the second prediction model corresponding to burst traffic, the electronic device can generate an adapted data feature vector through dedicated second feature extraction processing, input it into the second prediction model for prediction, thereby accurately obtaining the traffic feature change results of the second time period, and providing reliable data support for subsequent dynamic compression of VXLAN packet headers.

[0170] In some implementations, the second feature extraction process can be understood as a feature processing operation that performs feature filtering, processing and integration on the first flow data in response to the nonlinear, transient and event-driven characteristics of sudden flow.

[0171] In some implementations, the data feature vector can be understood as multidimensional structured data containing the core identifier of bursty flow, formed after the second feature extraction process, and is the input of the second prediction model.

[0172] Thus, in this embodiment of the application, when the target prediction model is the second prediction model, the first traffic data can be processed by the second feature extraction process to obtain a data feature vector; the data feature vector is then input into the second prediction model so that the second prediction model can predict the changes in traffic characteristics of the traffic data in the second time period based on the data feature vector, thereby obtaining the traffic data prediction result for the second time period. In this way, the feature vector suitable for the second prediction model can be extracted from the burst traffic through the second feature extraction process, thereby eliminating invalid data interference and improving the input quality and prediction accuracy of the second prediction model.

[0173] In some embodiments provided in this application, the second prediction model is a long short-term memory neural network model.

[0174] Specifically, considering that burst traffic in VXLAN tunnel transmission has the characteristics of instantaneous bandwidth surge of more than 10 times, short duration, and extremely strong nonlinear characteristics, such as virtual machine hot migration and distributed storage data synchronization, in order to improve the prediction accuracy of traffic characteristic changes in traffic data in the second time period, in some embodiments provided in this application, electronic devices can accurately predict future characteristic changes of burst traffic through the powerful processing capability of the Long Short-Term Memory (LSTM) neural network model for nonlinear time-series data, thereby providing a reliable basis for dynamic compression of VXLAN packet headers and optimizing packet transmission efficiency in burst traffic scenarios.

[0175] In some implementations, the Long Short-Term Memory (LSTM) neural network model can be understood as a recurrent neural network optimized for processing time series data. It solves the problem of long-term dependency loss in traditional recurrent neural networks through three core structures: forget gate, input gate, and output gate. It is good at capturing the nonlinearity, instantaneous changes, and temporal correlation characteristics of data, and is especially suitable for traffic prediction scenarios with no fixed rules and instantaneous changes.

[0176] In some implementations, electronic devices can continuously sample data feature vectors from past moments using a sliding window of a preset size, such as a sliding window with a window size of 60 and a step size of 10, to generate a sample set. Then, the vectors from past moments can be used to predict the flow characteristics of future moments, such as using data from time t-10 to time t to predict the flow characteristics from time t+1 to time t+60.

[0177] In some embodiments, the long short-term memory neural network model in this application is a bidirectional long short-term memory neural network model, and the model is equipped with an attention mechanism module. Furthermore, after the sample set is input into the model, the forward LSTM can capture the increasing traffic feature, the backward LSTM can capture the decreasing traffic feature, and the attention module can dynamically allocate the weights of features at different times, such as increasing the weight of bandwidth change in the 30 seconds before the migration starts to 0.8.

[0178] In some implementations, the flow sequence can be decomposed into high-frequency components representing burst noise and low-frequency components representing the underlying trend using Haar wavelet decomposition. Then, the high-frequency components are used to train an LSTM model separately to improve the model's sensitivity to burst flow.

[0179] In some implementations, the Long Short-Term Memory (LSTM) neural network model can be trained using an Adam optimizer with a learning rate of 0.001 and a batch size of 32. Meanwhile, overfitting can be avoided using early stopping.

[0180] In some implementations, when the server sends a virtual machine migration readiness signal via the virtio-balloon protocol, the electronic device can immediately trigger the fast prediction mode of the long short-term memory neural network model to shorten the sliding window from 1 minute to 10 seconds and increase the parameter update frequency from 5 minutes / time to 1 second / time, ensuring a rapid response to instantaneous traffic changes.

[0181] In some implementations, when the long short-term memory neural network model predicts that the bandwidth at a certain future moment exceeds 150% of the historical peak and continues for two sampling periods, VXLAN header pre-reconstruction processing is triggered, such as dynamically adjusting the outer UDP destination port to a low-latency queue to avoid erroneous operations caused by single noise.

[0182] Thus, in the embodiments of this application, the powerful processing capability of the long short-term memory neural network model for nonlinear time-series data can be used to accurately predict the future characteristic changes of burst traffic, thereby providing a reliable basis for dynamic compression of VXLAN packet headers and optimizing packet transmission efficiency in burst traffic scenarios.

[0183] In some embodiments provided in this application, the data feature vector consists of at least one of the following: virtual machine migration instructions, storage snapshot trigger signals, and the target packet's priority field, upper-layer protocol type, average bandwidth, packet burst frequency, network identifier, and retransmission rate.

[0184] Specifically, in order to improve the accuracy of model prediction, in some embodiments provided in this application, the three types of features, namely event features, message static features, and dynamic features, can be used to construct the input system of the second prediction model, so that the model can accurately capture the causes, attributes and states of sudden traffic, thereby improving the accuracy of pattern prediction.

[0185] In some implementations, a virtual machine migration command can be understood as a binary signal that indicates whether the server has triggered a virtual machine hot migration operation. It is an event that directly causes a burst of VXLAN traffic and is therefore an event characteristic.

[0186] In some implementations, the storage snapshot trigger signal can be understood as a binary signal that identifies whether the storage device has performed a data snapshot operation. It is an event that causes a sudden surge in traffic and is therefore an event characteristic.

[0187] In some implementations, the priority field can be understood as a field in the VXLAN packet header used to mark the priority of the packet's Quality of Service (QoS) / Class of Service (CoS), and is a static feature.

[0188] In some implementations, the upper-layer protocol type can be understood as the network protocol type such as TCP, UDP, and ICMP used by the inner message encapsulated by VXLAN, which is a static feature.

[0189] In some implementations, the network identifier can be understood as the VNI field in the VXLAN header, which is used to distinguish different virtual networks and is a static feature.

[0190] In some implementations, average bandwidth can be understood as the average amount of data transmitted through the VXLAN tunnel per unit time, which can reflect the overall traffic load level and is a dynamic characteristic.

[0191] In some implementations, the message burst frequency can be understood as the number of times the traffic volume experiences a sudden and significant surge per unit time, which can reflect the burstiness of traffic and is a dynamic characteristic.

[0192] In some implementations, the retransmission rate can be understood as the proportion of retransmitted packets to the total number of packets in a TCP transmission scenario. It reflects the network transmission quality and is a dynamic characteristic.

[0193] In some implementations, the data feature vector is an 18-dimensional feature vector, which includes 3-dimensional static features, 9-dimensional dynamic features, and 6-dimensional event features. Among them, the static features include VNI, the priority field, and the message type, that is, the network identifier in the VXLAN header, the CoS / QoS priority in the VXLAN header, and the upper-layer protocol type (TCP / UDP / ICMP, etc.) encapsulated by VXLAN.

[0194] Dynamic features include the average bandwidth over the past 10 minutes, which reflects the number of bytes per second; the average bandwidth over the past 5 minutes, which reflects short-term bandwidth trends; the packet length variance, which reflects the degree of change in packet size; the packet arrival time interval, which reflects the time difference between adjacent packets; the packet burst frequency, which reflects the number of bursts per unit time; the TCP retransmission rate, which represents the proportion of retransmitted packets to total TCP packets; the ratio of uplink to downlink traffic; the connection establishment frequency, which represents the rate of establishing new TCP connections; and the proportion of abnormal packets, which represents the proportion of packets containing error flags.

[0195] Event characteristics include virtual machine migration commands, storage snapshot trigger signals, virtual machine startup / shutdown events, network policy change signals, load balancer status changes, and timestamp characteristics. Virtual machine migration commands are binary signals indicating whether a migration event has occurred. Storage snapshot trigger signals are binary signals indicating snapshot operations. Virtual machine startup / shutdown events are virtual machine status change signals. Network policy change signals can characterize security group or ACL change events. Load balancer status changes can characterize load balancer node addition / removal events. Timestamp characteristics can characterize periodic time features such as hours or days of the week. Thus, in this embodiment of the application, the model can make predictions based on a data feature vector composed of at least one of the following: virtual machine migration instructions, storage snapshot trigger signals, and target packet priority field, upper layer protocol type, average bandwidth, packet burst frequency, network identifier, and retransmission rate, thereby ensuring the accuracy of model predictions to a certain extent.

[0196] In some embodiments provided in this application, the third prediction model includes an autoregressive moving average model and a generalized autoregressive conditional heteroscedasticity model. Therefore, step 03 includes: when the target prediction model is the third prediction model, inputting the first flow data into the autoregressive moving average model, so that the autoregressive moving average model performs prediction processing on the linear characteristics of the flow data in the second time period based on the first flow data, to obtain a linear characteristic prediction result for the second time period; inputting the first flow data into the generalized autoregressive conditional heteroscedasticity model, so that the generalized autoregressive conditional heteroscedasticity model performs prediction processing on the fluctuation characteristics of the flow data in the second time period based on the first flow data, to obtain a fluctuation characteristic prediction result for the second time period; and determining the flow data prediction result for the second time period based on the linear characteristic prediction result and the fluctuation characteristic prediction result.

[0197] The prediction module 230 in this embodiment is further configured to, when the target prediction model is a third prediction model, input the first flow data into an autoregressive moving average model so that the autoregressive moving average model performs prediction processing on the linear characteristics of the flow data in the second time period based on the first flow data to obtain the linear characteristic prediction result in the second time period; and input the first flow data into a generalized autoregressive conditional heteroscedasticity model so that the generalized autoregressive conditional heteroscedasticity model performs prediction processing on the fluctuation characteristics of the flow data in the second time period based on the first flow data to obtain the fluctuation characteristic prediction result in the second time period; and determine the flow data prediction result in the second time period based on the linear characteristic prediction result and the fluctuation characteristic prediction result.

[0198] The processor 320 in this embodiment is further configured to, when the target prediction model is a third prediction model, input the first flow data into an autoregressive moving average model so that the autoregressive moving average model performs prediction processing on the linear characteristics of the flow data in the second time period based on the first flow data to obtain the linear characteristic prediction result in the second time period; input the first flow data into a generalized autoregressive conditional heteroscedasticity model so that the generalized autoregressive conditional heteroscedasticity model performs prediction processing on the fluctuation characteristics of the flow data in the second time period based on the first flow data to obtain the fluctuation characteristic prediction result in the second time period; and determine the flow data prediction result in the second time period based on the linear characteristic prediction result and the fluctuation characteristic prediction result.

[0199] Specifically, in hybrid cloud multi-tenant VXLAN networks, traffic exhibits a mixture of stable linear trends, periodic fluctuations, and instantaneous bursts. Therefore, a single prediction model can only capture a single linear or nonlinear characteristic, failing to account for both the traffic baseline and fluctuations, resulting in extremely low traffic prediction accuracy. Based on this, in some embodiments provided in this application, for mixed traffic, electronic devices employ a combined third prediction model comprised of an autoregressive moving average model and a generalized autoregressive conditional heteroscedasticity model. This model fits the linear baseline trend of the traffic using the autoregressive moving average model and corrects for traffic fluctuation deviations using the generalized autoregressive conditional heteroscedasticity model. Finally, the two prediction results are fused to obtain accurate traffic data prediction results, providing a reliable basis for subsequent VXLAN packet header compression.

[0200] In some implementations, the third prediction model can be understood as a combined prediction model designed specifically for mixed traffic, consisting of two sub-models working together to adapt to complex traffic scenarios where linear trends and sudden fluctuations coexist.

[0201] In some implementations, the Generalized Autoregressive Conditional Heteroskedasticity (GARCH) model can be understood as a statistical model used to analyze residual fluctuations, variance changes, and sudden disturbances in flow data, and to correct for biases in linear predictions.

[0202] In some implementations, the linear feature prediction results can be understood as the predictive data output by the autoregressive moving average model, reflecting the basic bandwidth of the traffic and the steady growth / decline trend.

[0203] In some implementations, the fluctuation characteristic prediction results can be understood as the predictive data output by the generalized autoregressive conditional heteroscedasticity model, reflecting short-term changes in flow, fluctuation amplitude, and sudden disturbances.

[0204] To more clearly illustrate the message processing method provided in the embodiments of this application, please refer to the following exemplary description: First, the first flow data collected in the first time period is input into the autoregressive moving average model. The model extracts the linear patterns such as the basic bandwidth and slow trend changes of the flow, and outputs the linear feature prediction results for the second time period.

[0205] Meanwhile, the same first flow data is input into the generalized autoregressive conditional heteroscedasticity model. The model analyzes the residual sequence after linear prediction, captures the fluctuation characteristics of flow such as short-term jumps, variance changes, and sudden disturbances, and outputs the fluctuation characteristics prediction results for the second time period to correct the error of linear prediction.

[0206] Finally, by combining the linear feature prediction results with the fluctuation feature prediction results, and integrating the traffic baseline and fluctuation range, the traffic data prediction results for the second time period are finally determined, forming complete predictive data covering all characteristics of mixed traffic.

[0207] Thus, in this embodiment of the application, when the target prediction model is a third prediction model, the first flow data can be input into an autoregressive moving average model, so that the autoregressive moving average model can perform prediction processing on the linear characteristics of the flow data in the second time period based on the first flow data to obtain the linear characteristic prediction result in the second time period. The first flow data can also be input into a generalized autoregressive conditional heteroscedasticity model, so that the generalized autoregressive conditional heteroscedasticity model can perform prediction processing on the fluctuation characteristics of the flow data in the second time period based on the first flow data to obtain the fluctuation characteristic prediction result in the second time period. Based on the linear characteristic prediction result and the fluctuation characteristic prediction result, the flow data prediction result in the second time period is determined. This solves the problem of single model prediction failure, and the confidence and accuracy of flow prediction can be guaranteed.

[0208] In some embodiments provided in this application, the traffic data prediction result includes the field value of each field in the header of the target packet in the second time period. Therefore, step 04 above includes: determining the information entropy of each field based on the field value of each field in the header of the target packet in the second time period; and determining the compression method of each field based on the information entropy of each field.

[0209] The message processing module 240 in this embodiment is further configured to determine the information entropy of each field based on the field value of each field in the message header of the target message in the second time period, and to determine the compression method of each field based on the information entropy of each field.

[0210] The processor 320 in this embodiment is further configured to determine the information entropy of each field based on the field value of each field in the second time period of the message header of the target message, and to determine the compression method of each field based on the information entropy of each field.

[0211] Specifically, VXLAN packets typically use a fixed 50-byte header encapsulation. However, the value patterns and redundancy levels of different header fields vary greatly. Therefore, when using a uniform encapsulation method, the redundant data in low-entropy fixed fields consumes a large amount of bandwidth, while forcibly compressing high-entropy random fields can easily cause protocol compatibility issues. Furthermore, fixed encapsulation also wastes CPU processing cycles and amplifies overlay network traffic, making it impossible to achieve accurate and efficient header compression. Based on this, in some embodiments provided in this application, the future field values ​​of each field in the packet header obtained from traffic prediction can be used to quantify the data redundancy and discrete characteristics of each field through information entropy. Then, based on the entropy value, different compression methods are matched and adapted to different fields to achieve differentiated and accurate compression of the VXLAN packet header.

[0212] In some implementations, the traffic data prediction result can be understood as the result of traffic data characteristic changes in the second time period based on the output of the target prediction model, including the specific values ​​of each field in the target packet header in the second time period.

[0213] In some implementations, the fields in the message header can be understood as the smallest data unit in the message header that has independent protocol meaning, such as VNI, UDP source port, Flags, outer IP address, etc.

[0214] In some implementations, the second time period can be understood as the predicted time period after the first time period used for traffic type identification, where packet header compression needs to be performed.

[0215] In some implementations, field values ​​can be understood as the specific data values ​​of each field in the message header within a second time period.

[0216] In some implementations, information entropy can be understood as an indicator calculated based on formulas such as Shannon entropy and Rényi entropy, used to measure the dispersion of field values ​​and data uncertainty, and can reflect field redundancy.

[0217] In some implementations, the compression method of a field can be understood as a differentiated processing method used for the header fields of a message.

[0218] In some examples, field compression may include at least one of the following methods: field compression, dictionary encoding, static mapping, etc.

[0219] To more clearly illustrate the message processing method provided in the embodiments of this application, please refer to the following exemplary description: First, after predicting the specific field values ​​of each field in the target message header in the second time period using the target prediction model, the entropy value is calculated using the information entropy formula. A lower entropy value indicates more fixed field values ​​and higher redundancy; a higher entropy value indicates more random field values ​​and lower redundancy.

[0220] Next, based on the entropy value of each field, a dedicated compression method is assigned to each field, so that the field compression strategy is adapted to the field data characteristics.

[0221] Finally, based on the compression method of each field, each field is compressed, and through the VXLAN tunnel, the header-compressed target packet is forwarded to the corresponding receiving end.

[0222] Thus, in this embodiment of the application, the information entropy of each field can be determined based on the field value of each field in the second time period of the message header of the target message, and the compression method of each field can be determined based on the information entropy of each field, thereby making the field compression strategy compatible with the field data characteristics, and thus ensuring the rationality of field compression.

[0223] In some implementations, the step of determining the information entropy of each field based on the field value of each field in the header of the target message during the second time period includes: constructing a field value matrix based on the field value of each field during the second time period; performing nonnegation processing on the field value matrix so that each element in the field value matrix is ​​non-negative, thereby obtaining a field value processing matrix; and determining the information entropy of each field based on the field value processing matrix.

[0224] The message processing module 240 in this embodiment is further configured to construct a field value matrix based on the field value of each field in the second time period, and to perform nonnegation processing on the field value matrix so that each element in the field value matrix is ​​not negative, thereby obtaining a field value processing matrix, and to determine the information entropy of each field based on the field value processing matrix.

[0225] The processor 320 in this embodiment is further configured to construct a field value matrix based on the field value of each field in the second time period, and to perform nonnegation processing on the field value matrix so that each element in the field value matrix is ​​not negative, thereby obtaining a field value processing matrix, and to determine the information entropy of each field based on the field value processing matrix.

[0226] Specifically, considering that when calculating the information entropy of VXLAN packet header fields, the predicted values ​​of each header field may become negative due to factors such as traffic fluctuations and data statistics, and the information entropy calculation formula cannot handle negative values, this would directly lead to the failure of entropy calculation and the distortion of results. Therefore, in some embodiments provided in this application, the electronic device can construct a data matrix based on the predicted packet header field values, eliminate negative values ​​in the matrix through non-negativity processing, and then calculate the information entropy using a compliant processing matrix. This ensures the accuracy and feasibility of entropy calculation from the data preprocessing level, providing a reliable basis for subsequent matching and compression methods.

[0227] In some implementations, the field value matrix can be understood as a two-dimensional data matrix formed by arranging the predicted field values ​​of each field at each time point in the second time period in chronological order, with each field in the target message header as a single dimension.

[0228] In one example, a matrix of field values Mx This can be expressed as shown in the following formula (1), that is: (1) In the formula, x nk The first in the header of the target message k The field in the second time period n The predicted value at each time point.

[0229] In some implementations, nonnegation can be understood as a data preprocessing operation that adjusts the values ​​of any negative elements that may exist in the field value matrix using a normalized shift method, so that all elements in the matrix are nonnegative.

[0230] In some implementations, the field value processing matrix can be understood as a compliant data matrix obtained by nonnegating the field value matrix, which has no negative elements and can be directly used for accurate calculation of information entropy.

[0231] To more clearly illustrate the message processing method provided in the embodiments of this application, please refer to the following exemplary description: First, based on the results output by the target traffic prediction model, the predicted field values ​​of each field in the VXLAN packet header in the second time period are extracted and organized into a two-dimensional field value matrix according to the time series and field type, thus obtaining the field value matrix as shown in formula (1). Mx .

[0232] Then, to avoid the possibility of negative values ​​causing the entropy calculation to fail, the field value matrix was modified accordingly. Mx Perform translation processing. During the translation process, different processing strategies can be adopted according to the characteristics of different fields.

[0233] For example, for fields where larger values ​​are more important, such as package size, nonnegation can be achieved through normalization shift, as shown in formula (2): (2) In the formula, x j Representative field value matrix Mx The Middle j List all elements, x ij Representative field value matrix Mx The Middle i Line 1j Column elements, x ij Represents the normalized and shifted matrix of field values. Mx The Middle i Line 1 j Column elements, j The value range is 1 to k , i The value range is 1 to n .

[0234] For example, for fields where smaller values ​​are more important, such as packet loss rate, nonnegation can be achieved through reverse normalization shift, as shown in formula (3): (3) After completion Mx The nonnegation of each element in the matrix is ​​performed to obtain the field value processing matrix. Mx' Then, the information entropy of each field can be calculated using the following formula (4): (4) In the formula, , , For the first j The information entropy of a field. It can be understood that the closer the information entropy e is to 0, the more concentrated the data in the field, and the more fixed the numerical value, such as the VNI field. Conversely, the closer the information entropy e is to 1, the more dispersed the data in the field, and the stronger the randomness of the numerical value, such as the UDP source port field.

[0235] Thus, in this embodiment of the application, a field value matrix can be constructed based on the field value of each field in the second time period; the field value matrix is ​​non-negatively processed so that each element in the field value matrix is ​​not negative, resulting in a field value processing matrix; based on the field value processing matrix, the information entropy of each field is determined, thereby avoiding the situation where the information entropy calculation fails due to the field prediction value being negative, and thus ensuring the accuracy and stability of the entropy value calculation.

[0236] In some embodiments provided in this application, the step of determining the compression method of each field based on the information entropy of each field includes: determining the information entropy interval corresponding to each field based on the information entropy of each field; determining the compression method of the field as field compression when the field is located in the first information entropy interval; determining the compression method of the field as dictionary encoding when the field is located in the second information entropy interval, wherein the lower limit of the first information entropy interval is greater than the upper limit of the second information entropy interval; and determining the compression method of the field as static mapping when the field is located in the third information entropy interval, wherein the lower limit of the second information entropy interval is greater than the upper limit of the third information entropy interval.

[0237] The message processing module 240 in this embodiment is further configured to determine the information entropy interval corresponding to each field based on the information entropy of each field; and, when the field is within the first information entropy interval, determine the compression method of the field as field compression; when the field is within the second information entropy interval, determine the compression method of the field as dictionary encoding; and when the field is within the third information entropy interval, determine the compression method of the field as static mapping. The lower limit of the first information entropy interval is greater than the upper limit of the second information entropy interval, and the lower limit of the second information entropy interval is greater than the upper limit of the third information entropy interval.

[0238] The processor 320 in this embodiment is further configured to determine the information entropy interval corresponding to each field based on the information entropy of each field, and to determine the compression method of the field as field compression when the field is in the first information entropy interval, to determine the compression method of the field as dictionary encoding when the field is in the second information entropy interval, and to determine the compression method of the field as static mapping when the field is in the third information entropy interval. The lower limit of the first information entropy interval is greater than the upper limit of the second information entropy interval, and the lower limit of the second information entropy interval is greater than the upper limit of the third information entropy interval.

[0239] Specifically, considering that some fields in the standard VXLAN header have fixed values, such as VNI and reserved bits, some fields have finitely discrete values, such as Flags and ECN (Explicit Congestion Notification), and some fields have highly random values, such as UDP source port and inner IP, in order to ensure the field compression effect, in some embodiments provided in this application, the electronic device can divide the information entropy of each field in the VXLAN header into three types of information entropy intervals, and match the field compression, dictionary encoding, and static mapping methods according to the interval to which the field belongs, so as to achieve header compression that is accurately adapted according to the degree of field dispersion.

[0240] In some implementations, the information entropy interval can be understood as a three-level numerical interval divided according to the calculation result of the field information entropy, used to distinguish the degree of field dispersion. The intervals are arranged in order of entropy value, without overlap or omission.

[0241] In some implementations, field compression can be understood as a compression process that dynamically truncates and reduces the length of highly discrete, high-entropy fields, thereby reducing the number of bytes occupied by the field.

[0242] In some implementations, dictionary encoding can be understood as establishing a global index mapping table for discrete, medium-entropy value fields, and using short indexes to replace the encoding compression method of the original long field values.

[0243] In some implementations, static mapping can be understood as transmitting low-discrete, low-entropy value fields with their original values ​​intact, without any cropping or encoding.

[0244] In some implementations, the difference coefficient g of each field in the VXLAN header can be calculated using the information entropy of each field in the VXLAN header, and then the weight w of each field in the VXLAN header can be calculated. Finally, based on the weight w of each field in the VXLAN header, three types of information entropy intervals are divided. The difference coefficient g and the weight w of each field in the VXLAN header can be calculated using the following formulas (5) and (6), respectively: (5) (6) In the formula, For the first j The difference coefficient of each field For the first j The weight of each field.

[0245] In some implementations, as shown in Table 1, for fields like UDP source port and inner IP, which have a weight w greater than 0.35 and exhibit high randomness, the corresponding compression method is field compression. For fields like Flags and ECN, which have a weight w less than or equal to 0.35 and greater than or equal to 0.15 and exhibit finite discrete characteristics, the corresponding compression method is dictionary encoding. For fields like VNI and reserved bits, which have a weight w less than 0.15 and are relatively fixed, the corresponding compression method is static mapping, which is directly applied.

[0246] Table 1

[0247] Thus, in this embodiment, the information entropy range corresponding to each field can be determined based on the information entropy of each field. When a field is in the first information entropy range, the compression method of the field is determined to be field compression; when a field is in the second information entropy range, the compression method of the field is determined to be dictionary encoding; and when a field is in the third information entropy range, the compression method of the field is determined to be static mapping. This allows redundant transmission to be eliminated through differentiated compression methods, enabling high-entropy fields to be reduced in bytes, medium-entropy fields to be indexed and encoded, and low-entropy fields to be statically mapped. This improves the effective payload ratio of the message and reduces bandwidth waste.

[0248] In some embodiments provided in this application, the step of determining the compression method of each field based on the information entropy of each field includes: determining a target compression template for each field from a plurality of predetermined compression templates based on the information entropy of each field, so as to perform compression processing on the corresponding field through the target compression template, wherein each compression template corresponds to a compression method.

[0249] The message processing module 240 in this embodiment is further configured to determine the target compression template for each field from a plurality of predetermined compression templates based on the information entropy of each field, so as to perform compression processing on the corresponding field through the target compression template, wherein each compression template corresponds to a compression method.

[0250] The processor 320 in this embodiment is further configured to determine a target compression template for each field from a plurality of predetermined compression templates based on the information entropy of each field, so as to perform compression processing on the corresponding field through the target compression template, wherein each compression template corresponds to a compression method.

[0251] Specifically, in order to improve compression processing efficiency, in some embodiments provided in this application, the electronic device can pre-design a compression template corresponding to each compression method, and then select the target compression template to be used when compressing the field from multiple compression templates according to the actual calculated field information entropy. Subsequently, the compression processing of each field is directly performed based on the target compression template, thereby realizing the template-based, standardized and fast matching of compression methods.

[0252] In some implementations, the compression template can be understood as a standard execution process for a type of field compression method.

[0253] In some implementations, the target compression template can be understood as the unique compression template that matches the entropy value of a certain field in the VXLAN packet header, selected from a set of predetermined compression templates based on the information entropy actually calculated in the second time period.

[0254] In some implementations, the compression template includes a base template, an index template, a dynamic bit template, and a standard template. The message compression methods defined in the base template include directly removing the UDP Dst Port, VXLAN Flags, and Outer IP Protocol.

[0255] As an example, taking Table 1 as an example, for the UDP Dst Port field, the weight w of this field is at a low entropy level, and therefore can be compressed using the basic template, that is, replacing UDP Dst Port:4789 with a 1-bit template flag. It is understandable that when the receiver receives the VXLAN message and decompresses the compressed UDP Dst Port:4789, it can fill in the corresponding fixed value.

[0256] Index templates are suitable for fields such as Outer MAC / Src IP that are at the medium entropy level in Table 1. A global index table is created within this template, such as the index relationship between 16 MAC addresses and a 4-bit index, thus saving 12 bytes of space. For example, a fixed index can be assigned to a VTEP when a traffic surge is predicted.

[0257] Dynamic bit templates are suitable for fields such as VNI that are at high entropy levels in Table 1. They can be dynamically truncated to 3 bits based on the predicted entropy value of 2.5, thus representing 8 VNIs and saving 5 bits. As an example, when the load forecast shows that the range of VNI values ​​is expanding, it is automatically expanded to 5 bits, thereby supporting 32 VNIs and avoiding compression failure.

[0258] To more clearly illustrate the field compression process based on the compression template in the embodiments of this application, please refer to [link / reference]. Figure 4 , Figure 4 This is a flowchart illustrating the message processing method in some embodiments of this application, i.e. Figure 4 As shown, in some embodiments provided in this application, in the control plane, the load prediction module in the electronic device can be responsible for collecting VXLAN traffic data, matching the corresponding prediction model through scene recognition, completing the prediction of traffic characteristics for subsequent time periods and outputting the load prediction result (i.e., the traffic data prediction result for the second time period).

[0259] After obtaining the load prediction results, the electronic device performs entropy calculation and index update steps, that is, it performs information entropy calculation on each field of the VXLAN packet header; at the same time, it dynamically updates the dictionary index table used for medium entropy field compression based on the entropy changes and current traffic characteristics to ensure that the index table is highly matched with the current traffic scenario.

[0260] Subsequently, the electronic device responds to the input operation and configures the template switching decision. That is, it determines the appropriate field-level compression template for the current traffic scenario based on the entropy calculation result, the confidence level of the load prediction, and the entropy fluctuation rate. At the same time, it determines whether it is necessary to trigger the switching of the compression template and outputs clear execution instructions for subsequent compression processing.

[0261] Subsequently, the electronic device performs entropy calculation and load prediction operations based on the raw VXLAN data packets, that is, VXLAN messages that are not compressed in any way and are strictly encapsulated in accordance with the RFC7348 standard. These packets contain a 50-byte standard encapsulation header consisting of VXLAN Header, Outer UDP Header, Outer IP Header, and Outer Ethernet Header, as well as a message payload. In other words, the entropy value of the real-time traffic field data is recalculated, and the calculated entropy value is compared with the entropy value of each field in the prediction result. The matching degree between the prediction result and the real-time field data is checked a second time. If the entropy value of a certain field fluctuates more than 20% of the threshold, a template switch is triggered, such as switching from a dynamic bit template to a standard template.

[0262] After completing the various steps in the control plane, the electronic device can perform compression processing on the VXLAN message header to convert the original data packet into a header-compressed message.

[0263] The compression process includes a field-level compression step. This step involves the electronic device dividing the VXLAN packet header fields into three levels—low entropy, medium entropy, and high entropy—based on the entropy weight of each field. Different compression strategies are then applied to fields of different levels, namely, low-entropy field compression, medium-entropy field compression, and high-entropy field compression.

[0264] Low-entropy field compression refers to the compression stage of low-entropy fields in hierarchical field compression, such as VNI fields with a weight w less than 0.15 and reserved bits. These fields have highly concentrated data and relatively fixed values, and can be compressed using a base template for implementing fixed-value omission. Fixed-value omission means that for low-entropy fields with relatively fixed values, the original fixed-value field data is directly deleted, and only the template flag bits are retained. During decompression, the fixed values ​​are automatically filled in through the flag bits, significantly reducing the number of bytes in the packet header.

[0265] Medium-entropy field compression refers to the compression stage of medium-entropy fields in hierarchical field compression, such as Flags and ECN fields with a weight w less than 0.35 and greater than or equal to 0.15. These fields exhibit finite discrete values ​​and can be compressed using index templates designed for dictionary encoding. Dictionary encoding involves creating a global index table to map the original values ​​of medium-entropy fields to short-byte / bit index values, replacing the original field data with these index values. This simplifies the medium-entropy field data, and the index table dynamically adjusts as entropy calculations and index updates occur.

[0266] High-entropy field compression refers to the compression stage of high-entropy fields in hierarchical field compression, such as UDP source ports and inner IP addresses with a weight greater than 0.35. These fields exhibit strong randomness in their values ​​and can be compressed using dynamic bit templates, a compression method employed for dynamic encoding. Dynamic encoding involves predicting the value range of high-entropy fields based on load prediction results, dynamically truncating and encoding the fields to minimize bit length while ensuring the integrity and validity of the field information, thus achieving efficient compression of high-entropy fields.

[0267] After the compression process is completed, the electronic device can integrate and assemble the data of each field after the low-entropy, medium-entropy and high-entropy fields are compressed according to the adaptation compression template structure determined by the template switching decision to form a complete VXLAN compression header. This compression header is combined with the payload of the original message to finally obtain a transmittable VXLAN message with a simplified header, thus completing the entire VXLAN message header compression process.

[0268] It is worth noting that the electronic device can select a template based on the entropy value of each field, and then perform field pruning and index replacement on the 50-byte header according to the selected template. The compressed header can be shortened to 25-35 bytes. Simultaneously, it can bind the Outer IP to the index table through hash mapping, such as binding Src IP=10.0.0.1 to index 0010. For the receiver (i.e., the other end of the electronic device), after receiving the compressed header, it can query the global index table based on the template flag to reconstruct the original 50-byte header.

[0269] In addition, the standard template is selected when the field entropy value changes abruptly. For example, when the number of tenants temporarily increases, and the VNI field entropy value suddenly increases from 2.5 to 4.0, the electronic device can switch the compression template corresponding to the VNI field from the dynamic bit template to the standard template to avoid packet loss.

[0270] In some implementations, when the volatility of a field entropy value exceeds a threshold (e.g., 20%), the electronic device compresses the field based on this model.

[0271] In addition, for a clearer explanation of the template switching process in the embodiments of this application, please refer to [link to relevant documentation]. Figure 5 , Figure 5 This is a flowchart illustrating the message processing method in some embodiments of this application, i.e. Figure 5 As shown, in some embodiments provided in this application, the electronic device can first perform the entropy fluctuation detection step, that is, to calculate and compare the actual entropy values ​​of each field in the VXLAN packet header with the predicted entropy values ​​output by the load prediction model in real time during the second time period, detect the fluctuation difference between the two, and obtain entropy fluctuation rate data.

[0272] Then, the electronic device can perform the "volatility > threshold?" judgment step, which compares the entropy volatility calculated in the previous step with the system's preset entropy volatility threshold (such as 20%).

[0273] If the determination result is yes (Y), then template switching is triggered. Specifically, the electronic device will automatically switch the appropriate VXLAN header compression template according to the actual fluctuation of the current entropy value. For example, when the entropy value of the VNI field suddenly increases from 2.5 to 4.0, the electronic device can switch the compression template corresponding to the VNI field from the dynamic bit template to the standard template, thereby avoiding packet loss caused by the mismatch between the compression template and the field entropy value.

[0274] If the result is negative (N), the normal message compression output process will begin. In other words, since the entropy fluctuation rate of each field in the current VXLAN message header does not exceed the preset threshold, it indicates that the load prediction entropy value matches the actual entropy value well. Therefore, there is no need to adjust the compression template, and subsequent message header compression operations can be performed according to the currently selected compression template.

[0275] Finally, the electronic device (i.e., the compression end, or the VTEP transmitting side) outputs a compressed packet based on the finally selected compression template. Specifically, the electronic device performs compression operations such as field trimming and index replacement on the 50-byte VXLAN header according to the currently selected three-level compression template, generating a compressed VXLAN packet and outputting it.

[0276] For the other end of the electronic device, that is, for the receiving end of the compressed package, the receiving end decompresses the data. That is, the receiving end will query the global index table and other preset configurations according to the template flag in the compressed package, and decompress the header of the compressed message through FPGA hardware offloading or a dedicated compression engine.

[0277] Subsequently, the receiving end reconstructs the message header. That is, the receiving end restores and fills the clipped and replaced fields according to the decompression result and the preset template rules, and reconstructs a 50-byte VXLAN original encapsulation header that conforms to the RFC7348 standard. This ensures that the message can be forwarded in accordance with the standard protocol. This step is the key to ensuring the protocol compatibility of the compressed message.

[0278] After completing the VXLAN header reconstruction, the receiving end forwards the packet to the target virtual machine. That is, it forwards the processed packet to the specified target virtual machine according to the topology rules of the Overlay network, thus completing the entire VXLAN packet compression and transmission process.

[0279] Thus, in this embodiment of the application, a target compression template for each field can be determined from a plurality of predetermined compression templates based on the information entropy of each field, so that the corresponding field can be compressed using the target compression template. This allows the compression of each field to be performed based on the compression template corresponding to the information entropy, thereby improving the field compression efficiency.

[0280] In some embodiments provided in this application, the traffic data prediction result also includes the prediction confidence level at each time point within the second time period. Furthermore, step 04 above also includes: when the prediction confidence level is less than or equal to a preset confidence threshold, the information entropy interval corresponding to each field is determined a second time based on the information entropy of each field and the preset correction parameter.

[0281] The message processing module 240 in this application embodiment is further used to determine the information entropy interval corresponding to each field a second time based on the information entropy of each field and the preset correction parameters when the prediction confidence is less than or equal to a preset confidence threshold.

[0282] The processor 320 in this embodiment is further configured to, when the prediction confidence is less than or equal to a preset confidence threshold, perform a secondary determination of the information entropy interval corresponding to each field based on the information entropy of each field and a preset correction parameter.

[0283] Specifically, when sudden events occur in the network such as virtual machine hot migration, tenant service expansion, or network topology changes, the output of the prediction model will deviate significantly, and the corresponding prediction confidence will drop sharply. If the information entropy is still calculated and the compression method is determined directly based on the low-confidence prediction result, the compression method will be severely mismatched with the actual characteristics of the field, ultimately affecting message transmission. Based on this, in some embodiments provided in this application, a prediction confidence verification and information entropy dynamic adjustment step can be set. Then, the electronic device can compare the prediction confidence at each time point of the second time period with a preset confidence threshold in real time. If the prediction confidence is less than or equal to the threshold, the current prediction result is determined to be invalid, and the compression method is immediately re-determined; if the prediction confidence is higher than the threshold, the original process is maintained, thereby compensating for the deviation caused by the prediction failure and ensuring that the compression method is always adapted to the actual characteristics of the field.

[0284] In some implementations, prediction confidence can be understood as an indicator used to quantify the reliability of traffic data prediction results at each time point within the second time period. It is calculated by the prediction model in combination with factors such as prediction error, traffic feature matching degree, and scenario adaptability. The higher the value, the higher the probability that the prediction result is the same as the actual result.

[0285] In some implementations, the preset confidence threshold can be understood as a confidence threshold value set in advance based on factors such as network service requirements, prediction model performance, and network stability requirements. It can be a fixed value or a value that can be dynamically configured according to the network scenario.

[0286] In some implementations, the secondary determination of the information entropy interval can be understood as the process of redetermining the information entropy interval to which the field information entropy belongs through a preset algorithm when the prediction confidence level fails to reach the threshold and the prediction result is determined to be invalid.

[0287] In some examples, the secondary determination of the information entropy interval may include: when the prediction confidence is less than 85%, the electronic device calculates the field weights based on formula (7) instead of the aforementioned formula (6). Formula (7) is shown below: (7) In the formula, α This is the sudden sensitivity factor (i.e., the correction parameter), with a default value of 0.3; σ j for Mx The Middle j Standard deviation of all fields in the row; μj for Mx The Middle j The average of all fields in a row.

[0288] Next, the weights of each field are calculated using formula (7). Then, determine the compression method for each field using Table 1 above, or select the appropriate compression method from the various compression templates based on the weight. The target compression template that is matched.

[0289] Thus, in this embodiment, when the prediction confidence is less than or equal to a preset confidence threshold, the information entropy interval corresponding to each field is determined a second time based on the information entropy of each field and the preset correction parameters. This allows for a second determination of the field's information entropy interval based on the field's information entropy and correction parameters when prediction fails. The compression method of the field is then determined based on the second determined information entropy interval, thereby preventing packet parsing failures, network packet loss, and other situations, and ensuring the normal data transmission of the target packet.

[0290] In some embodiments provided in this application, step 03 includes: when the target traffic data type changes and the target prediction model is switched from the first traffic prediction model to the second traffic prediction model, within a first preset period in the second time period, calculating the weighted sum of the first traffic data prediction result of the first traffic prediction model and the first weight, and the second traffic data prediction result of the second traffic prediction model and the second weight, to obtain the traffic data prediction result within the first preset period; within a second preset period in the second time period, determining the traffic data prediction result of the second traffic prediction model as the traffic data prediction result within the second preset period, wherein the second preset period is later than the first preset period.

[0291] The prediction module 230 in this application embodiment is further configured to, when the target traffic data type changes and the target prediction model is switched from the first traffic prediction model to the second traffic prediction model, calculate the weighted sum of the first traffic data prediction result of the first traffic prediction model and the first weight, and the second traffic data prediction result of the second traffic prediction model and the second weight within a first preset period in the second time period, to obtain the traffic data prediction result within the first preset period, and determine the traffic data prediction result of the second traffic prediction model as the traffic data prediction result within the second preset period within the second time period, wherein the second preset period is later than the first preset period.

[0292] The processor 320 in this application embodiment is further configured to, when the target traffic data type changes and the target prediction model is switched from the first traffic prediction model to the second traffic prediction model, calculate the weighted sum of the first traffic data prediction result of the first traffic prediction model and the first weight, and the second traffic data prediction result of the second traffic prediction model and the second weight within a first preset period in the second time period, to obtain the traffic data prediction result within the first preset period, and determine the traffic data prediction result of the second traffic prediction model as the traffic data prediction result within the second preset period within the second time period, wherein the second preset period is later than the first preset period.

[0293] Specifically, considering that the traffic behavior characteristics in real-time networks are not fixed and can dynamically switch due to factors such as changes in business, equipment operation, and tenant demand adjustments, such as stable traffic suddenly changing into burst traffic and mixed traffic turning into stable traffic, the corresponding prediction model also needs to be switched synchronously.

[0294] Furthermore, if one directly switches from one traffic prediction model to another second traffic prediction model, the traffic data prediction results will fluctuate drastically due to the fundamental differences in the prediction logic, fitting trend, and output dimensions of the old and new models. This may lead to header compression failure, packet parsing errors, or even data packet loss and network congestion.

[0295] Based on this, in some embodiments provided in this application, for scenarios where prediction model switching is triggered by changes in traffic data types, a periodic prediction result fusion strategy can be designed. The second time period is divided into a transitional first preset period and a formal second preset period. During the transition phase, a weighted sum of the prediction results from the old and new models is used as the target prediction result. During the formal phase, the prediction result from the new model is used directly. This result-level fusion processing achieves a smooth switching of the prediction model, avoiding abrupt changes in prediction results caused by direct switching and ensuring the continuity and stability of traffic characteristic prediction.

[0296] In some implementations, the first traffic prediction model can be understood as a traffic prediction model that matches the original target traffic data type and is in use before the model switch.

[0297] In some implementations, the second traffic prediction model can be understood as a traffic prediction model that matches the new target traffic data type and is about to be put into use after model switching.

[0298] In some implementations, the first preset period can be understood as the transition time interval set after model switching. It is a key period for achieving a smooth connection between the prediction results of the old and new models and is located in the preceding stage of the second time period.

[0299] In some implementations, the second preset period can be understood as the formal usage time interval set after model switching, which is later than the first preset period. It is the period during which the new model independently plays a predictive role, and together with the first preset period, it forms a complete second time period.

[0300] In some implementations, the first weight can be understood as a proportion coefficient assigned to the prediction results of the first traffic prediction model during the model switching transition phase, which is used to control the degree of influence of the original model results during the transition phase.

[0301] In some implementations, the second weight can be understood as a proportion coefficient assigned to the prediction results of the second traffic prediction model during the model switching transition phase, which is used to control the degree of influence of the new model results during the transition phase.

[0302] For example, in one instance, when the first traffic prediction model is ARIMA and the second traffic prediction model is LSTM, the traffic data prediction results for the first three periods (i.e., the first preset period) can be represented as w1*R. ARIMA + w2*R LSTM Where w1 is the first weight, R ARIMA This represents the traffic data prediction result output by ARIMA, where w2 is the second weight, and R... LSTM This represents the traffic data prediction result output by LSTM.

[0303] In some implementations, the first and second weights can be obtained from the model's prediction error. For example, if the prediction error of ARIMA is 10%, then w1 is 0.8 and w2 is 0.2.

[0304] Thus, in this embodiment, when the target traffic data type changes and the target prediction model switches from the first traffic prediction model to the second traffic prediction model, within a first preset period in the second time period, the weighted sum of the first traffic data prediction result of the first traffic prediction model and the first weight, and the second traffic data prediction result of the second traffic prediction model and the second weight is calculated to obtain the traffic data prediction result within the first preset period. Within the second preset period in the second time period, the traffic data prediction result of the second traffic prediction model is determined as the traffic data prediction result within the second preset period. This achieves a smooth switch between the old and new traffic prediction models, thereby avoiding precipitous fluctuations in the traffic data prediction results and ensuring the robust transmission of the target message.

[0305] Furthermore, for a clearer explanation of the message processing method provided in the embodiments of this application, please refer to [link to relevant documentation]. Figure 6 , Figure 6 This is a flowchart illustrating the message processing method in some embodiments of this application, i.e. Figure 6As shown, in some embodiments provided in this application, the electronic device may include, for example: Figure 6 The templates shown are executable. Figure 6 The specific steps are as follows: VXLAN Traffic Data Acquisition: Electronic devices collect various raw traffic data transmitted through the VXLAN tunnel via the interfaces of the VXLAN tunnel endpoint devices and the upper-layer controller (i.e., the VTEP interface / controller), such as VNI identifier, ingress interface bandwidth, packet forwarding volume, packet type, TCP retransmission rate, and other indicators. It can be understood that the VTEP, as the endpoint device of the VXLAN tunnel, directly generates and transmits VXLAN packet data through its interface, while the upper-layer controller of this device can aggregate the traffic status data of the entire network's VXLAN tunnels. Therefore, electronic devices can collect traffic data from at least one of the VXLAN tunnel endpoint device interfaces and the upper-layer controller.

[0306] Feature engineering: Electronic equipment performs preprocessing and feature extraction on the raw VXLAN traffic data collected. Specifically, this includes data cleaning, difference processing after ADF unit root test, feature vector construction, index calculation, etc., and finally outputs indicators that can characterize traffic features, such as stationarity index, periodic intensity index, burst frequency index, and bandwidth change rate.

[0307] Scene recognition module based on random forest classifier: The electronic device inputs the traffic feature indicators output by feature engineering into the random forest classifier, thereby completing the classification of the current traffic scene through model calculation.

[0308] A stability index > 0.8 and a periodicity index > 0.7: When this condition is met, the current traffic is determined to be stable traffic (corresponding to a stable scenario). This type of traffic is mostly north-south traffic from regular data center operations, characterized by predictable trends and small fluctuations. The stability index indicates the stability of the traffic data's trend, while the periodicity index indicates the periodic variation pattern of the traffic data. Burst frequency > 5 times / hour and bandwidth change > 50%: When this condition is met, the current traffic is determined to be bursty traffic (corresponding to burst scenarios). This type of traffic is mostly traffic in scenarios such as virtual machine hot migration and distributed storage data synchronization, characterized by instantaneous bandwidth surges and short durations. Burst frequency refers to the number of times the traffic bandwidth changes abruptly per unit time, and the bandwidth change rate reflects the fluctuation range of the traffic bandwidth. Mixed characteristics percentage > 60%: When this condition is met, the current traffic is determined to be mixed traffic (corresponding to mixed and complex scenarios). This type of traffic often occurs in complex network environments with hybrid cloud multi-tenancy. Among them, the mixed characteristics percentage refers to the proportion of traffic that simultaneously exhibits multiple characteristics such as stability, bursts, and periodicity, without any single characteristic dominating.

[0309] ARIMA / SARIMA models are prediction models for stationary scenarios. ARIMA is suitable for stationary traffic without obvious seasonal characteristics, while SARIMA is suitable for stationary traffic with seasonal characteristics such as daily cycles, such as east-west traffic in data centers.

[0310] Parameter Optimization - Difference Order d / Seasonal Period s: In the parameter tuning phase of the ARIMA / SARIMA model, the difference order d is used to transform non-stationary traffic sequences into stationary ones, and the seasonal period s is a parameter specific to the SARIMA model, used to adapt to the seasonal cyclical characteristics of traffic. It can be understood that the ARIMA / SARIMA model optimized using this parameter can control the traffic prediction error within 5% in stationary scenarios.

[0311] LSTM+Attention Mechanism: A prediction model for matching sudden scenarios. This model uses bidirectional LSTM to capture the nonlinear features of increasing and decreasing traffic. The attention layer dynamically allocates the weights of traffic features at different times, which can accurately identify the nonlinear change patterns of sudden traffic and adapt to the feature requirements of sudden traffic.

[0312] Parameter Optimization - Sliding Window / Wavelet Decomposition: In the parameter tuning phase of the LSTM+Attention mechanism model, the sliding window is used to construct the traffic sample set and determine the prediction time range. Wavelet decomposition breaks down the original traffic sequence into high-frequency and low-frequency components, improving the model's sensitivity to sudden traffic spikes. Understandably, the LSTM+Attention mechanism model optimized with these parameters can achieve a 12-second early warning for sudden traffic spikes.

[0313] Mixed Complex Scenarios - ARIMA-GARCH Combination: A prediction model for mixed complex scenarios, employing a two-level architecture of ARIMA linear prediction combined with GARCH fluctuation correction. ARIMA captures the linear trend of traffic, while GARCH corrects for the fluctuation and clustering of traffic, adapting to the complex characteristics of mixed traffic.

[0314] Parameter Optimization - GARCH Fluctuation Correction: In the parameter tuning phase of the ARIMA-GARCH combined model, fluctuation correction is primarily applied to the GARCH model. The conditional variance equation is solved using maximum likelihood estimation, enabling the model to simultaneously capture short-term bandwidth jumps and long-term variance changes in traffic. Understandably, after this parameter optimization, the ARIMA-GARCH combined model can achieve a 95% confidence level in traffic prediction results under mixed scenarios.

[0315] Output prediction bandwidth - error <5%: The prediction result output by the ARIMA / SARIMA model after parameter optimization, that is, the traffic prediction bandwidth in the second time period, has an error of less than 5%.

[0316] Output Predicted Bandwidth - 12-Second Early Warning: After parameter optimization, the LSTM+attention mechanism model outputs the predicted bandwidth of the burst traffic in the second time period, which enables accurate prediction of instantaneous surge traffic and provides an early warning of burst traffic for 12 seconds.

[0317] Output prediction interval - 95% confidence level: After parameter optimization, the ARIMA-GARCH combined model outputs a prediction interval that covers the actual flow range with a 95% confidence level, adapting to the fluctuation characteristics of mixed flow.

[0318] Decision Engine: The decision unit of the entire load forecasting process. It can receive the forecast results output by each forecasting model, compare the real-time collected actual traffic data with the forecast results, and determine whether the forecast deviation meets the preset threshold.

[0319] Prediction deviation <20%: If this condition is met, it means that the deviation between the traffic prediction result and the actual traffic is within an acceptable range. The VXLAN header pre-reconstruction operation will be performed, that is, the compression method of the VXLAN packet header will be determined according to the traffic prediction result, and the TTL / VNI mapping will be adjusted.

[0320] Prediction deviation ≥ 20%: If this condition is met, it indicates that the traffic pattern has changed abruptly and the prediction result cannot match the actual traffic. In this case, a rollback to real-time encapsulation mode will be performed, the header pre-reconstruction will be abandoned, and the traditional VXLAN standard encapsulation method will be used to process the packets to ensure the stability of network transmission.

[0321] Traffic forwarding execution: Based on the decision engine's judgment result, perform the corresponding packet processing and forwarding operations; if the prediction is determined to be valid, forward the VXLAN packet after header pre-reconstruction (compression); if the prediction is determined to be invalid, forward the standard encapsulated VXLAN packet to complete the actual transmission of traffic.

[0322] Monitoring and feedback closed-loop update of model parameters: After traffic forwarding is executed, the actual traffic transmission data and model prediction effect are continuously monitored, and the feedback data obtained from the monitoring is sent back to the model training and parameter optimization stage to update the parameters of each prediction model in real time, so that the model can dynamically adapt to changes in network traffic, continuously improve prediction accuracy, and realize self-optimization of the load prediction process.

[0323] This application also provides a computer-readable storage medium storing a computer program that, when executed by one or more processors, implements the above-described message processing method.

[0324] This application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the above-described message processing method.

[0325] In this specification, the terms "specifically," "furthermore," "particularly," "understandably," etc., refer to specific features, structures, materials, or characteristics described in connection with embodiments or examples that are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0326] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the function involved, as will be understood by those skilled in the art to which embodiments of this application pertain.

[0327] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A message processing method, characterized in that, The method includes: Based on the first traffic data obtained within the first time period, the target traffic data type within the first time period is determined, wherein the first traffic data includes the message data of the target packet, the target packet is transmitted through an extensible virtual local area network tunnel, and the target traffic data type is used to indicate the behavioral characteristics of the target packet within the first time period; Based on the target traffic data type, a target prediction model corresponding to the target traffic data type is determined from multiple pre-trained prediction models, wherein each prediction model corresponds to a traffic data type. Based on the target prediction model, the changes in traffic characteristics of traffic data within the second time period are predicted to obtain the traffic data prediction result for the second time period, wherein the second time period is later than the first time period. Based on the traffic data prediction results, the header compression method of the target packet within the second time period is determined, so that the header of the target packet to be transmitted is compressed using the header compression method within the second time period, and the target packet with compressed header is forwarded.

2. The message processing method according to claim 1, characterized in that, The step of determining the target traffic data type within the first time period based on the first traffic data acquired within the first time period includes: The first feature extraction process is performed on the first traffic data to obtain the first data feature of the first traffic data; Based on the first data feature, the target traffic data type is determined.

3. The message processing method according to claim 2, characterized in that, Determining the target traffic data type based on the first data feature includes: The first data feature is input into a pre-trained type prediction model so that the type prediction model can predict the traffic data type of the first traffic data based on the first data feature, thereby obtaining the target traffic data type of the first traffic data.

4. The message processing method according to claim 2, characterized in that, The first data feature includes at least one of a stability index, a periodic intensity index, and a burst frequency index. The stability index is used to indicate the data change trend within the first flow data, the periodic intensity index is used to indicate the periodic change pattern of the first flow data, and the burst frequency index is used to indicate the number of sudden changes in the first flow data.

5. The message processing method according to claim 4, characterized in that, The target traffic data type is one of stable traffic, burst traffic, and mixed traffic. Determining the target traffic data type based on the first data characteristic includes: If the stability index is greater than a first preset threshold and the periodic intensity index is greater than a second preset threshold, the target flow data type is determined to be stable flow. If the burst frequency index is greater than the third preset threshold, the target traffic data type is determined to be burst traffic; If the stability index is less than or equal to the first preset threshold, the periodic intensity index is less than or equal to the second preset threshold, and the burst frequency index is less than or equal to the third preset threshold, the target traffic data type is determined to be mixed traffic.

6. The message processing method according to claim 1 or 5, characterized in that, The target flow data type is one of stable flow, burst flow, and mixed flow, and the multiple prediction models include a first prediction model corresponding to the stable flow, a second prediction model corresponding to the burst flow, and a third prediction model corresponding to the mixed flow.

7. The message processing method according to claim 6, characterized in that, The first traffic data is a time-sorted data sequence. The step of predicting the changes in traffic characteristics of the traffic data within a second time period based on the target prediction model to obtain the traffic data prediction result for the second time period includes: When the target prediction model is the first prediction model, determine whether the data change trend of the data sequence is stable; When it is determined that the data change trend of the data sequence is stable, the data sequence is determined as the input data of the first model; When it is determined that the data change trend of the data sequence is not stable, the data sequence is corrected, and the result of the correction is determined as the input data of the first model. Based on the input data of the first model and the first prediction model, the changes in traffic characteristics of traffic data within the second time period are predicted to obtain the prediction results of the traffic data for the second time period.

8. The message processing method according to claim 7, characterized in that, The first prediction model includes an autoregressive moving average model.

9. The message processing method according to claim 7 or 8, characterized in that, The step of predicting the changes in traffic characteristics of traffic data within a second time period based on the input data of the first model and the first prediction model, to obtain the prediction result of the traffic data for the second time period, includes: Based on the input data of the first model, determine the autocorrelation function graph and the partial autocorrelation function graph; Based on the autocorrelation function graph and the partial autocorrelation function graph, configure the lag order and moving average order in the first prediction model; The input data of the first model is input into the first prediction model, in which the lag order and moving average order are configured, so that the first prediction model can perform prediction processing on the changes in the flow characteristics of the flow data in the second time period based on the input data of the first model, and obtain the prediction result of the flow data in the second time period.

10. The message processing method according to claim 7, characterized in that, The step of predicting the changes in traffic characteristics of traffic data within a second time period based on the input data of the first model and the first prediction model, to obtain the prediction result of the traffic data for the second time period, includes: If the target prediction model is the first prediction model, and the input data of the first model has a periodic pattern and is east-west flow data, then configure the seasonal periodic parameter, seasonal difference parameter and seasonal lag term parameter of the first prediction model. The input data of the first model is decomposed to obtain the trend term, seasonal term, and residual term. The first prediction model, with its parameters configured, is subjected to a preset verification process by inputting data into the first model. When the first prediction model with the parameters configured passes the preset verification process, the first model input data is input to the first prediction model with the parameters configured, so that the first prediction model performs prediction processing on the changes in traffic characteristics of traffic data in the second time period based on the first model input data, and obtains the traffic data prediction result for the second time period.

11. The message processing method according to claim 10, characterized in that, The first prediction model includes a seasonal autoregressive integral moving average model.

12. The message processing method according to claim 6, characterized in that, The step of predicting the changes in traffic characteristics of traffic data within the second time period based on the target prediction model to obtain the traffic data prediction result for the second time period includes: When the target prediction model is the second prediction model, the first traffic data is subjected to a second feature extraction process to obtain a data feature vector; The data feature vector is input into the second prediction model so that the second prediction model can predict the changes in traffic characteristics of traffic data in the second time period based on the data feature vector, and obtain the traffic data prediction result for the second time period.

13. The message processing method according to claim 12, characterized in that, The second prediction model includes a long short-term memory neural network model.

14. The message processing method according to claim 12, characterized in that, The data feature vector consists of at least one of the following: virtual machine migration instructions, storage snapshot trigger signals, and the target packet's priority field, upper-layer protocol type, average bandwidth, packet burst frequency, network identifier, and retransmission rate.

15. The message processing method according to claim 6, characterized in that, The third prediction model includes an autoregressive moving average model and a generalized autoregressive conditional heteroscedasticity model. Based on the target prediction model, the flow characteristic changes of the flow data within the second time period are predicted to obtain the flow data prediction results for the second time period, including: When the target prediction model is the third prediction model, the first flow data is input into the autoregressive moving average model so that the autoregressive moving average model performs prediction processing on the linear characteristics of the flow data in the second time period based on the first flow data, and obtains the linear characteristic prediction result in the second time period. The first flow data is input into the generalized autoregressive conditional heteroscedasticity model so that the generalized autoregressive conditional heteroscedasticity model can predict the fluctuation characteristics of the flow data in the second time period based on the first flow data, and obtain the fluctuation characteristic prediction result of the second time period. Based on the linear feature prediction results and the fluctuation feature prediction results, the traffic data prediction results for the second time period are determined.

16. The message processing method according to claim 1, characterized in that, The traffic data prediction result includes the field values ​​of each field in the header of the target packet during the second time period. Determining the header compression method of the target packet during the second time period based on the traffic data prediction result includes: Based on the field value of each field in the header of the target message during the second time period, determine the information entropy of each field; The compression method for each field is determined based on the information entropy of each field.

17. The message processing method according to claim 16, characterized in that, The step of determining the information entropy of each field based on its value in the second time period within the header of the target message includes: Construct a field value matrix based on the field value of each field in the second time period; The field value matrix is ​​denegated so that each element in the field value matrix is ​​non-negative, resulting in a field value processing matrix. The information entropy of each field is determined by processing the matrix based on the field values.

18. The message processing method according to claim 16, characterized in that, The step of determining the compression method for each field based on the information entropy of each field includes: Based on the information entropy of each field, determine the information entropy range corresponding to each field; If the field is located within the first information entropy range, the compression method for the field is determined to be field compression; When the field is located in the second information entropy interval, the compression method of the field is determined to be dictionary encoding, wherein the lower limit of the first information entropy interval is greater than the upper limit of the second information entropy interval; When the field is located in the third information entropy interval, the compression method of the field is determined to be static mapping, wherein the lower limit of the second information entropy interval is greater than the upper limit of the third information entropy interval.

19. The message processing method according to claim 18, characterized in that, The step of determining the compression method for each field based on the information entropy of each field includes: Based on the information entropy of each field, a target compression template for each field is determined from a plurality of pre-determined compression templates, so as to perform compression processing on the corresponding field through the target compression, wherein each compression template corresponds to a compression method.

20. The message processing method according to claim 18, characterized in that, The traffic data prediction result also includes the prediction confidence level at each time point within the second time period. The step of determining the compression method for each field based on its information entropy further includes: When the prediction confidence level is less than or equal to a preset confidence threshold, the information entropy interval corresponding to each field is determined a second time based on the information entropy of each field and the preset correction parameters.

21. The message processing method according to claim 1, characterized in that, The step of predicting the changes in traffic characteristics of traffic data within the second time period based on the target prediction model to obtain the traffic data prediction result for the second time period includes: When the target traffic data type changes and the target prediction model is switched from the first traffic prediction model to the second traffic prediction model, within the first preset period of the second time period, the weighted sum of the first traffic data prediction result of the first traffic prediction model and the first weight, and the second traffic data prediction result of the second traffic prediction model and the second weight is calculated to obtain the traffic data prediction result within the first preset period. Within a second preset period in the second time period, the traffic data prediction result of the second traffic prediction model is determined as the traffic data prediction result within the second preset period, wherein the second preset period is later than the first preset period.

22. A message processing apparatus, characterized in that, The device includes: The type determination module is used to determine the target traffic data type within the first time period based on the first traffic data obtained within the first time period. The first traffic data includes the message data of the target packet, which is transmitted through a Scalable Virtual Local Area Network tunnel. The target traffic data type is used to indicate the behavioral characteristics of the target packet within the first time period. The model determination module is used to determine a target prediction model corresponding to the target traffic data type from a plurality of pre-trained prediction models, based on the target traffic data type, wherein each prediction model corresponds to a traffic data type. The prediction module is used to predict the changes in traffic characteristics of traffic data within a second time period based on the target prediction model, and to obtain the traffic data prediction result for the second time period, wherein the second time period is later than the first time period. The message processing module is used to determine the message header compression method of the target message in the second time period based on the traffic data prediction result, so as to compress the message header of the target message to be transmitted by the message header compression method in the second time period, and forward the target message with compressed message header.

23. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted for loading by a processor to perform the message processing method according to any one of claims 1-21.

24. An electronic device, characterized in that, The electronic device includes a processor and a memory, the memory storing a computer program, and the processor executing the message processing method according to any one of claims 1-21 by calling the computer program stored in the memory.

25. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the message processing method according to any one of claims 1-21.

Images