Pcdn traffic closed loop identification method and system

Abstract

This invention discloses a PCDN traffic closed-loop identification method and system, applied to a user-side access gateway, comprising: collecting packets flowing through the gateway; performing multi-dimensional behavior scoring on access devices; identifying devices whose scores reach a confidence threshold as candidate PCDN devices and determining the IP address of the control plane; recording the data plane traffic rate of the device as a baseline rate; enabling packet discarding for a continuously preset duration for the IP address of the control plane, which is automatically revoked upon expiration, while maintaining forwarding of data plane traffic during this period; observing the changing trend of the data plane traffic rate relative to the baseline rate; adjusting the processing based on the changing trend and generating identification labels; and writing back the identification labels to update the scoring weight parameters, so that identification and processing form a feedback closed loop, thereby improving the identification accuracy.

Description

Technical Field

[0001] This invention relates to the field of computer network security and network traffic identification and control, and in particular to a PCDN traffic closed-loop identification method and system based on gateway-side packet dropping disturbances. Background Technology

[0002] PCDN (Point-to-Point Content Delivery Network) transforms idle hosts, set-top boxes, and other devices under the user-side access gateway into content delivery edge nodes. These nodes utilize the user's uplink bandwidth to distribute content to other terminals, thus consuming uplink bandwidth on the access network for extended periods and impacting the service quality of users within the same network segment. The user-side access gateway is the necessary point of entry for these devices to access the network and possesses the capability to observe and manage traffic flowing through it. How to identify and manage PCDN devices from the gateway side is a problem that needs to be solved in the field of network traffic identification and control.

[0003] In existing technologies, the gateway collects packets flowing through it, extracts features such as DNS query domain names, TLS SNI, JA3 / JA4 fingerprints, and packet payload content, and performs multi-dimensional behavioral scoring on access devices. Devices with scores reaching a threshold are identified as PCDN devices, and the IP address of the control plane associated with that device is determined, i.e., the address to which control traffic such as scheduling and reporting is sent. After identification, packets are continuously dropped from the control plane IP address to cut off the device's access to tasks. The weight parameters used in the above multi-dimensional behavioral scoring are set during deployment, and the identification results rely on manual verification.

[0004] The existing technologies described above have the following problems: First, the weight parameters of multi-dimensional behavioral scoring are fixed, and the recognition results rely on manual verification, leading to persistent scoring errors and making it difficult to improve recognition accuracy with changes in the network environment and device behavior. Second, packet dropping is a continuous process, and the recognition results lack verification. When misjudgments occur, it is difficult to detect and recover from misjudged devices in a timely manner, resulting in continuous damage to normal services. Third, recognition and handling are independent of each other, the effect of handling actions cannot be measured, and handling cannot be adjusted based on the actual behavior of the devices. These problems cause recognition to rely on a one-time scoring result, leading to repeated misjudgments and preventing the recognition accuracy from improving as the handling process progresses. Summary of the Invention

[0005] In view of the above problems, a PCDN traffic loop identification method and system based on gateway-side packet drop disturbance is proposed to overcome or at least partially solve the above problems, specifically including:

[0006] A PCDN traffic loop identification method based on gateway-side packet drop disturbance, applied to user-side access gateways, includes:

[0007] Collect packets flowing through the gateway;

[0008] Based on the message, the access devices of the access gateway are scored in multiple dimensions to obtain the PCDN confidence score of the access devices. Access devices whose PCDN confidence score reaches the confidence threshold are identified as candidate PCDN devices, and the IP address of the control plane associated with the candidate PCDN device is determined. The multi-dimensional behavior score is calculated based on the weight parameters.

[0009] Record the data plane traffic rate of the candidate PCDN device as a reference rate. The data plane traffic is the traffic of the candidate PCDN device distributing content to the peer node device.

[0010] Packet dropping is enabled for a preset duration for IP addresses in the control plane. Packet dropping is automatically canceled after the preset duration is reached. During the period when packet dropping is enabled, data plane traffic of candidate PCDN devices is continued to be forwarded.

[0011] The observed data plane flow rate changes relative to the baseline rate during and after the message drop feature is enabled.

[0012] The handling of IP addresses of the control surface is adjusted according to the changing trend, and identification labels are generated according to the changing trend. The identification labels are then written back to update the weight parameters of the multi-dimensional behavior score.

[0013] Optionally, collecting packets flowing through the gateway includes: capturing uplink and downlink packets in promiscuous mode on the gateway's WAN and LAN ports; classifying the captured packets into a bidirectional flow table according to five-tuples; extracting flow statistical features, protocol features, and content features from the flows in the bidirectional flow table; the protocol features and content features include nDPI protocol identification results, DNS query domain names, TLS SNI, JA3 / JA4 fingerprints, HTTP Host field, URL field, User Agent (UA) field, DHCP hostname, and the first 64 bytes of hexadecimal content of the packet payload; the five-tuple consists of source IP address, destination IP address, source port, destination port, and transport layer protocol.

[0014] Optionally, multi-dimensional behavioral scoring of the access devices of the access gateway based on the messages includes:

[0015] Extract the MAC address and IP address of the access device from the header of the access-side message in the flow to form the composite key of the flow;

[0016] Within a preset observation window, flows with the same composite key are grouped into a flow set;

[0017] Statistical analysis is performed on the flow set, and the flow statistical characteristics, protocol characteristics and content characteristics of each flow in the flow set are aggregated into the flow statistical characteristics, protocol characteristics and content characteristics of the access device, forming a device-level behavioral profile of the access device;

[0018] Extract a preset number of behavioral dimension values ​​from the device-level behavioral profile to form the behavioral feature vector of the access device;

[0019] Perform multidimensional behavioral scoring based on behavioral feature vectors.

[0020] Optionally, before performing multidimensional behavioral scoring, the following may also be included:

[0021] The protocol identification result is obtained by taking the protocol features and content features of the streams in the stream set and using them as the protocol identification result.

[0022] The domain name, TLS SNI, JA3 / JA4 fingerprint, and hexadecimal content of the first 64 bytes of the message payload in the stream set are matched with the rules of the local rule layer. The matched rules are used as evidence of rule hit. The local rule layer supports hot reloading.

[0023] Based on the terminal model, MAC address OUI and public IP address of the access device, query the cloud feature database to obtain cloud feature database hit evidence. The cloud feature database hit evidence includes the application affiliation, manufacturer affiliation and public IP affiliation of the access device.

[0024] The protocol identification results, rule-matching evidence, and cloud-based feature database matching evidence are combined into application attribution and matching evidence.

[0025] Optional, multidimensional behavioral scores include:

[0026] The behavioral dimension is at least two of the following dimensions in the device-level behavioral profile: uplink / downlink byte ratio, total uplink volume, peak concentration, long duration, concurrent connections, UDP byte ratio, port concentration, fixed block mode, domain name binding ratio, and destination IP nature.

[0027] Application attribution and hit evidence are added as additional behavioral dimensions to the behavioral feature vector. The additional behavioral dimensions include the vendor label dimension, and the value of the vendor label dimension is taken from the vendor attribution in the application attribution and hit evidence.

[0028] Set weight parameters for each behavioral dimension in the behavioral feature vector;

[0029] Map the values ​​of each behavioral dimension in the behavioral feature vector to scores for each behavioral dimension according to the score range;

[0030] The scores of each behavioral dimension are weighted and summed according to the weight parameters to obtain the comprehensive score; the comprehensive score is used as the confidence level of PCDN.

[0031] Optionally, observe the trend of data plane traffic rate relative to the baseline rate during and after packet drop is enabled, including:

[0032] The data plane traffic rate of the candidate PCDN device is continuously sampled to obtain a rate sequence, which includes the data plane traffic rate of the candidate PCDN device during the packet dropping activation period and after its deactivation.

[0033] Each rate value in the rate sequence is compared point by point with the reference rate to obtain the comparison results.

[0034] The trend of the rate sequence is determined based on the comparison results, and the trend is taken as the changing trend.

[0035] Optionally, the handling of IP addresses of control surfaces can be adjusted according to the changing trend, and identification labels can be generated based on the changing trend. The identification labels can then be written back to update the weight parameters of the multi-dimensional behavioral score, including:

[0036] When the trend is that the data plane traffic rate remains at the baseline rate after packet dropping is enabled, and the duration of this maintenance exceeds the preset initial observation period, and then decreases monotonically, an acknowledgment label is generated. Based on the acknowledgment label, the weight parameters of the multi-dimensional behavior score are increased, and continuous packet dropping is performed on the IP address of the control plane.

[0037] When the trend is that the data plane traffic rate drops to zero within the preset initial observation period after packet dropping is enabled, a misjudgment label is generated. Based on the misjudgment label, the weight parameters of the multi-dimensional behavior score are reduced, and forwarding is maintained for the IP address of the control plane.

[0038] When the trend changes to the other direction, a suspicious label is generated. The weight parameters of the multi-dimensional behavior score are maintained based on the suspicious label. Forwarding is maintained for the IP address of the control face and re-identification is triggered for the candidate PCDN device.

[0039] Optionally, after the confirmation label is generated, the method further includes: continuously discarding the control plane destination IP address among the destination IP addresses of the candidate PCDN devices, and performing hierarchical classification on the remaining destination IP addresses among the destination IP addresses of the candidate PCDN devices;

[0040] Add the destination IP addresses that match the whitelist address from the remaining destination IP addresses to the whitelist address;

[0041] Add the destination IP addresses that match the T1 level from the destination IP addresses that are not included in the whitelist to the T1 level destination IP address;

[0042] The destination IP address that matches the T2 level among the destination IP addresses that are not included in the whitelist and the T1 level destination IP address is included in the T2 level destination IP address;

[0043] Among the remaining destination IP addresses after allocation, the destination IP addresses whose corresponding flow is between the candidate PCDN device and the destination IP address, whose UDP traffic bytes in the corresponding flow account for a preset percentage threshold of the total traffic bytes between the candidate PCDN device and the destination IP address, and whose packet length in the corresponding flow presents a fixed block mode, are determined to be dynamic peer IP addresses.

[0044] Persistent packet dropping is performed on the T1-level destination IP address and the T2-level destination IP address; uplink rate limiting is performed on the data plane traffic corresponding to the dynamic peer IP address; forwarding is maintained for the whitelisted addresses; and forwarding is maintained for the remaining destination IP addresses after the inclusion.

[0045] Optionally, the method also includes:

[0046] Persistent packet dropping is performed on the fill traffic flowing to the candidate PCDN device. The fill traffic is the traffic used by the candidate PCDN device to obtain cache fill content. The whitelist address and the maintenance forwarding of the remaining destination IP address after inclusion only apply to traffic other than the fill traffic.

[0047] During the continuous packet dropping of IP addresses on the control plane and the continuous packet dropping of fill traffic, the candidate PCDN device stops acquiring new scheduling tasks, the filling of the content cache of the candidate PCDN device stops, and the content in the content cache is continuously reduced during the transmission of data plane traffic by the candidate PCDN device and is exhausted within a finite time.

[0048] Once the content in the content cache is exhausted, the candidate PCDN device stops sending data plane traffic.

[0049] A PCDN traffic loop identification system based on gateway-side packet drop disturbance, applied to user-side access gateways, includes:

[0050] Traffic acquisition unit, used to collect packets flowing through the gateway;

[0051] The PCDN multidimensional behavior scoring unit is used to perform multidimensional behavior scoring on the access devices of the access gateway based on the message, obtain the PCDN confidence of the access devices, identify the access devices whose PCDN confidence reaches the confidence threshold as candidate PCDN devices, and determine the IP address of the control plane associated with the candidate PCDN devices. The multidimensional behavior score is calculated based on the weight parameters.

[0052] The effect feedback and attenuation observation unit is used to record the data plane traffic rate of the candidate PCDN device as a reference rate. The data plane traffic is the traffic of the candidate PCDN device distributing content to the peer node device.

[0053] The dynamic blocking unit is used to enable packet dropping of IP addresses in the control plane for a continuous preset duration. After the preset duration is reached, the packet dropping is automatically canceled. During the period when packet dropping is enabled, the data plane traffic of the candidate PCDN device is maintained and forwarded.

[0054] The effect feedback and attenuation observation unit is also used to observe the change trend of the data plane flow rate relative to the reference rate during the message dropping activation period and after the cancellation. Based on the change trend, it outputs the handling adjustment command to the dynamic blocking unit, generates identification labels based on the change trend, and writes the identification labels back to update the weight parameters of the PCDN multidimensional behavior scoring unit.

[0055] Compared to existing technologies, this solution limits packet dropping to a preset duration and automatically cancels it after the preset duration. During the packet dropping period, the data plane traffic of the candidate PCDN device continues to be forwarded, making the handling action a verification process for the identification results. Packet dropping only affects the IP address of the control plane destination on which the candidate PCDN device obtains the scheduling task. The data plane traffic of the device distributing content to the peer node device and the normal service traffic in the network where the device is located continue to be forwarded during the verification period, and the impact of the handling process on normal services is controlled.

[0056] The above verification process is implemented based on the device's task caching mechanism. When the candidate PCDN device is indeed a PCDN device, a control plane interruption stops the injection of new scheduled tasks. The device continues to serve the peer node device with existing content in its content cache. Its data plane traffic rate initially maintains the baseline rate, then decreases as the content in the cache decreases. Based on this trend, the identification result is confirmed and the handling is adjusted. When a candidate PCDN device is misjudged, the candidate PCDN device has no content cache to serve. The data plane traffic rate of the candidate PCDN device drops to zero after packet dropping is enabled. Based on this trend, the handling is revoked, and communication between the candidate PCDN device and normal services is restored. By judging the identification result based on the actual response of the device during the handling process, misjudgments can be detected and reversed, and the identification accuracy improves as the handling process progresses.

[0057] Multidimensional behavior scoring is calculated based on weight parameters. The observed trends are generated into identification labels and written back to update the weight parameters. The handling results are continuously transformed into scoring parameters. The scoring parameters are calibrated according to changes in the network environment and device behavior. Identification and handling form a feedback loop. The handling effect is measurable and the handling can be adjusted according to the actual behavior of the device. Attached Figure Description

[0058] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 This is a flowchart of a PCDN traffic closed-loop identification method based on gateway-side packet drop disturbance provided by an embodiment of the present invention;

[0060] Figure 2 This is a diagram of the PCDN traffic closed-loop identification system architecture provided in an embodiment of the present invention;

[0061] Figure 3 This is a flowchart of the multidimensional behavior scoring provided in the embodiments of the present invention;

[0062] Figure 4 This is a diagram showing the overall system architecture and the connection relationships between various units provided in an embodiment of the present invention. Detailed Implementation

[0063] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0064] Reference Figures 1 to 4 This invention provides a method for PCDN traffic closed-loop identification based on gateway-side packet drop disturbances, which may specifically include:

[0065] A PCDN traffic loop identification method based on gateway-side packet drop disturbance, applied to user-side access gateways, includes:

[0066] Collect packets flowing through the gateway;

[0067] Based on the message, the access devices of the access gateway are scored in multiple dimensions to obtain the PCDN confidence score of the access devices. Access devices whose PCDN confidence score reaches the confidence threshold are identified as candidate PCDN devices, and the IP address of the control plane associated with the candidate PCDN device is determined. The multi-dimensional behavior score is calculated based on the weight parameters.

[0068] Record the data plane traffic rate of the candidate PCDN device as a reference rate. The data plane traffic is the traffic of the candidate PCDN device distributing content to the peer node device.

[0069] Packet dropping is enabled for a preset duration for IP addresses in the control plane. Packet dropping is automatically canceled after the preset duration is reached. During the period when packet dropping is enabled, data plane traffic of candidate PCDN devices is continued to be forwarded.

[0070] The observed data plane flow rate changes relative to the baseline rate during and after the message drop feature is enabled.

[0071] The handling of IP addresses of the control surface is adjusted according to the changing trend, and identification labels are generated according to the changing trend. The identification labels are then written back to update the weight parameters of the multi-dimensional behavior score.

[0072] PCDN stands for Point-to-Point Content Delivery Network. The user-side access gateway is the essential node through which access devices access the network. Access devices include idle hosts, set-top boxes, and other devices on the home or enterprise user side. PCDN services use access devices as content delivery edge nodes, distributing content from the access devices to other terminals.

[0073] Traffic to access devices includes control plane traffic and data plane traffic. Control plane traffic refers to the traffic between the access device and the address used for scheduling and reporting purposes. Control plane traffic carries control purposes such as obtaining scheduling tasks and reporting operating status. Data plane traffic refers to the traffic from the access device to the peer node device, which refers to the terminal device receiving the content.

[0074] The method collects packets flowing through the gateway at the gateway side, performs multi-dimensional behavioral scoring on access devices accessing the gateway based on the packets, performs packet dropping disturbances for a preset duration on access devices whose PCDN confidence level reaches a confidence threshold, observes the changing trend of data plane traffic rate relative to the baseline rate during and after the packet dropping is enabled, adjusts the handling of IP addresses of control plane objects based on the changing trend, and generates weight parameters for identification, labeling, and writing back to update the multi-dimensional behavioral scores based on the changing trend, so that identification and handling form a feedback closed loop. The method is described in detail below with reference to the above steps.

[0075] The gateway collects packets flowing through it. It captures uplink and downlink packets on its WAN and LAN ports, and parses fields such as source IP address, destination IP address, source port, destination port, transport layer protocol, packet length, and packet content. The captured packets are then grouped and statistically analyzed by flow to obtain flow statistical characteristics, protocol characteristics, and content characteristics.

[0076] The gateway performs multi-dimensional behavioral scoring on access devices based on the packets. The gateway aggregates packets by access device, combining traffic statistics for the same access device into a device-level behavioral profile. Multiple behavioral dimensions are extracted from this profile, and weight parameters are set for each dimension. The scores for each behavioral dimension are then weighted and accumulated according to these weight parameters. The scores are obtained by mapping the values ​​of each behavioral dimension to a score range, resulting in a comprehensive score. This comprehensive score is used as the PCDN confidence level of the access device.

[0077] Weight parameters refer to the coefficients corresponding to each behavioral dimension in the multi-dimensional behavioral score. These weight parameters are continuously updated during gateway operation. Access devices whose PCDN confidence level reaches the confidence threshold are identified as candidate PCDN devices. The confidence threshold is set by the deployer based on the PCDN confidence level distribution of normal access devices within the network and is adjusted as the gateway operates.

[0078] Determine the control plane IP address associated with the candidate PCDN device. The control plane IP address refers to the destination IP address to which control-purpose messages such as scheduling requests, reporting messages, and tunnel establishment requests sent by the candidate PCDN device are sent. The determination method is as follows: upon identifying a candidate PCDN device, extract the vendor attribution, hit evidence, and a list of key destination IP addresses from the candidate PCDN device identification results. The destination IP address corresponding to scheduling, reporting, and tunneling purposes is then determined as the control plane IP address.

[0079] The list of key destination IP addresses is obtained by collecting the destination IP addresses corresponding to the hit evidence. The rule hit evidence records the destination IP address of the flow that hits the rule one by one. The cloud feature database hit evidence records the public IP address of the destination IP address.

[0080] When determining that a destination IP address belongs to control plane purposes, the destination IP address simultaneously meets the data center attribute condition, the port concentration condition, and the domain name absence condition. The data center attribute condition means that the destination IP address is marked as a data center IP address by the cloud feature database and its geographical distribution spans multiple provinces. The port concentration condition means that the destination ports of the flow between the candidate PCDN device and the destination IP address are concentrated in a small number of ports. The domain name absence condition means that the flow is directly connected by IP address without carrying a domain name.

[0081] When the cloud-based feature database is unreachable, the IP address of the control plane is composed of the destination IP address of the flow that hits the PCDN vendor's control plane rules in the rule hit evidence. Data center attribute conditions are not involved in the determination, while port concentration conditions and no domain name conditions still apply.

[0082] The control plane IP address can be a single IP address or multiple IP addresses, and multiple control plane IP addresses constitute a control plane IP address set. The control plane IP address is distinct from the destination IP address of data plane traffic. The destination IP address of data plane traffic is the address of the peer node device, and the address of the peer node device changes dynamically.

[0083] The data plane traffic rate of the candidate PCDN device is recorded as a baseline rate. Data plane traffic refers to the traffic in which the candidate PCDN device distributes content to the peer node device. The recording method is as follows: the data plane traffic sent by the candidate PCDN device to the peer node device is statistically analyzed at a set length statistical period. The number of uplink bytes contained in the data plane traffic within the statistical period is divided by the duration of the statistical period to obtain the data plane traffic rate of the statistical period. The average value of the data plane traffic rate of several consecutive statistical periods before packet dropping is enabled is taken as the baseline rate.

[0084] The statistical period can be set to, for example, 1 second, and the number of statistical periods participating in the averaging can be set to, for example, 5. Both the statistical period and the number of statistical periods participating in the averaging are set and adjusted according to the network environment. Control plane traffic between candidate PCDN devices and control plane IP addresses is not included in the data plane traffic rate statistics. The statistical caliber of the baseline rate is consistent with the statistical caliber used in rate sequence sampling. The baseline rate is stored in the gateway's traffic statistics results for subsequent comparison.

[0085] Packet dropping is enabled for a preset duration for IP addresses in the control plane. After the preset duration, the packet dropping is automatically canceled. During the period when packet dropping is enabled, data plane traffic of candidate PCDN devices continues to be forwarded. The gateway attaches a packet dropping action to the packet forwarding path. The packet dropping action includes matching conditions and dropping procedures. The destination IP address field of the matching conditions matches the set of IP addresses in the control plane. Packets that match the conditions are dropped, while packets that do not match the conditions are forwarded normally.

[0086] Since the matching criteria only cover the IP addresses of the control plane, the data plane traffic of candidate PCDN devices and the traffic of other access devices under the same gateway are continued to be forwarded during the packet drop enable period. The packet drop is carried out as follows: when the gateway has eBPF capability, the drop program is mounted at the mount point of the flow control subsystem, and the matching table is stored in the mapping table. The matching table supports on-the-fly updates; when the gateway does not have eBPF capability, the packet drop action is carried out by packet filtering rules or Internet Protocol set rules, or it can be carried out by hardware access control lists.

[0087] The preset duration is implemented by recording the activation time and starting a timer mechanism when packet dropping is enabled. When the preset duration expires, the timer mechanism triggers a cancellation action, deleting the entry corresponding to the control plane IP address in the matching table, and resuming packet forwarding to the control plane IP address. The timer mechanism is implemented by a user-space timer; if the gateway has kernel timer capabilities, the timer mechanism is implemented by a kernel timer.

[0088] The preset duration is determined by covering the time required for the content cache of candidate PCDN devices to be exhausted. This ensures that the data plane traffic rate of candidate PCDN devices completes a complete trend of first maintaining a baseline rate and then monotonically decreasing during the packet dropping period. The preset duration is set and adjusted by the deployer according to the content cache size and data plane traffic rate of the candidate PCDN devices. When a misjudgment or doubtful label is generated, the gateway prematurely cancels packet dropping before the preset duration expires, allowing normal services of the misjudged devices to resume immediately.

[0089] The data plane traffic rate was observed to change relative to the baseline rate during and after the packet drop feature was enabled. During and after the packet drop feature was enabled, the data plane traffic rate of candidate PCDN devices was continuously statistically analyzed. The data plane traffic rate for each statistical period was compared with the baseline rate to obtain the trend of the data plane traffic rate relative to the baseline rate. The trends included initially maintaining the baseline rate and then monotonically decreasing, decreasing to zero after enabling the feature, and other possible trends.

[0090] The handling of IP addresses in the control plane is adjusted based on the changing trends, and identification labels are generated according to these trends. These labels are then written back to update the weight parameters of the multi-dimensional behavioral score. The correspondence between the changing trends and the identification conclusions is determined based on the content caching mechanism of the candidate PCDN devices.

[0091] If a candidate PCDN device is indeed a PCDN device, the candidate PCDN device obtains the scheduling task through the control plane and stores the corresponding content of the task in the content cache. After the control plane message discarding is enabled, new scheduling tasks stop being injected. The candidate PCDN device still distributes the content already cached in the content cache to the peer node device, and the data plane traffic rate is maintained at a rate close to the baseline rate. As the content in the content cache decreases, the data plane traffic rate decreases, showing a trend of first maintaining and then monotonically decreasing.

[0092] If a candidate PCDN device is misjudged, the candidate PCDN device has no content cache available for distribution, and the data plane traffic is driven by the interactive behavior of the candidate PCDN device itself, which drops to zero after packet dropping is enabled.

[0093] Accordingly, if the trend is that the rate initially remains at the baseline and then decreases monotonically, the candidate PCDN device is confirmed as a PCDN device, and packet dropping of the control plane IP address is maintained; if the trend drops to zero after activation, the identification result is determined to be a misjudgment, packet dropping of the control plane IP address is revoked, and packet forwarding to the control plane IP address is resumed; if the trend is any other, the candidate PCDN device may obtain a scheduling task through other means to re-execute the identification of the candidate PCDN device in order to update the control plane IP address set.

[0094] The identification annotation records the changing trend and corresponding identification conclusion obtained from this observation. The identification annotation is written back to the PCDN multidimensional behavior scoring unit. Based on the identification annotation, the weight parameters of the multidimensional behavior score are adjusted to correspond to the identification conclusion. When the identification conclusion is confirmed, the weight parameters are increased; when the identification conclusion is misjudged, the weight parameters are decreased; when the identification conclusion is questionable, the weight parameters are maintained. The adjustment range of the weight parameters is a preset step size, which is set by the deployer.

[0095] After the write-back is completed, the multidimensional behavioral score uses the updated weight parameters to calculate the PCDN confidence level of the access device. Thus, the results observed during the handling process are continuously transformed into scoring parameters, and the multidimensional behavioral score is calibrated according to changes in the network environment and the behavior of the access device, forming a mutually reinforcing closed loop between identification and handling.

[0096] In the above embodiments, the gateway is not limited to a home gateway, but can also be an enterprise gateway or a software router. When the gateway is deployed in a bypass manner, the probes deployed in the bypass manner are responsible for collection and identification, and the packet dropping action is performed by the gateway on the forwarding path. The identification result is sent to the gateway on the forwarding path through the policy channel. The packet dropping method can be replaced by the mount point of eBPF mounted on the flow control subsystem with packet filtering rules, Internet Protocol set rules, or hardware access control lists. The statistical period, the number of statistical periods participating in the average, the preset duration, the confidence threshold, and the adjustment step size of the weight parameters are set and adjusted according to the network environment. The above modifications do not depart from the inventive essence of this method.

[0097] In one or more embodiments of the present invention, collecting packets flowing through the gateway includes: capturing uplink and downlink packets in promiscuous mode at the gateway's WAN and LAN ports; classifying the captured packets into a bidirectional flow table according to a 5-tuple; extracting flow statistical features, protocol features, and content features from the flows in the bidirectional flow table; the protocol features and content features include nDPI protocol identification results, DNS query domain name, TLS SNI, JA3 / JA4 fingerprint, HTTP Host field, URL field, User Agent (UA) field, DHCP hostname, and the first 64 bytes of hexadecimal content of the packet payload; the 5-tuple consists of source IP address, destination IP address, source port, destination port, and transport layer protocol.

[0098] The gateway captures uplink and downlink packets in promiscuous mode on both the WAN and LAN ports. By default, the network port only accepts Ethernet frames whose destination Media Access Control address is the local network port address, or a multicast or broadcast address. Promiscuous mode enables the network port to receive all Ethernet frames arriving on the link where the network port is located, capturing both packets sent from the access device to the WAN and packets sent from the WAN to the access device.

[0099] Packets captured from the LAN port and sent to the WAN are considered uplink packets, while packets captured from the WAN port and sent to the LAN are considered downlink packets. The packet capture engine used is libpcap, AF_PACKET, or DPDK. libpcap obtains packet copies in user space through a bypass filtering interface; AF_PACKET directly obtains link-layer packets through sockets; DPDK bypasses the kernel protocol stack and directly processes network interface packets in user space, making it suitable for high-traffic gateways. The gateway selects the packet capture engine based on traffic volume; changing the packet capture engine does not change the flow table maintenance and feature extraction processing logic.

[0100] The gateway parses captured packets to obtain the source IP (Internet Protocol) address, destination IP address, source port, destination port, and transport layer protocol, which serve as the basis for flow table merging and retrieval. It also records the packet's arrival time, length, direction, and payload. For IP fragmented packets, the gateway first performs fragmentation and reassembly, then extracts the source and destination ports from the reassembled packet. The fragmentation and reassembly buffer is organized according to the source IP address, destination IP address, and IP identifier field, and is released after reassembly. Fragmentation and reassembly ensures the integrity of the port information in the 5-tuple.

[0101] A 5-tuple refers to the combination of source IP address, destination IP address, source port, destination port, and transport layer protocol. The gateway categorizes captured packets into the bidirectional flow table according to these 5-tuples. The bidirectional flow table maintains entries for active flows. Each entry contains a flow table key and statistical items. The flow table key consists of a 5-tuple, and the statistical items include the number of upstream bytes, downstream bytes, number of upstream packets, number of downstream packets, flow establishment time, time of the first packet, time of the most recent packet, destination port set, and packet length distribution.

[0102] The inclusion method is as follows: if the packet's 5-tuple matches the flow table key of a flow table entry, the packet is included in that entry; if the packet's 5-tuple is symmetrical to the flow table key of a flow table entry (symmetry refers to the source and destination being interchanged, the source and destination ports being interchanged, and the transport layer protocol being the same), the packet is included in that entry and counted in the downlink statistics. Bidirectional merging ensures that uplink and downlink packets of the same session fall into the same flow, making the statistics of uplink and downlink byte counts, packet counts, and durations complete.

[0103] The active flow capacity limit is set to 100,000 entries. TCP (Transmission Control Protocol) flows are evicted after 60 seconds of no packets, and UDP (User Datagram Protocol) flows are evicted after 300 seconds of no packets. The evicting method is as follows: the gateway periodically scans the flow table and deletes flow entries whose most recent packet time differs from the current time by more than the corresponding aging time; when the number of flow table entries reaches the capacity limit, the flow entry with the oldest most recent packet time is evicted.

[0104] The gateway extracts flow statistics from the bidirectional flow table. These statistics are compiled from flow table entries and include uplink / downlink byte count, uplink / downlink packet count, flow duration, destination port set, and packet length distribution. Flow duration is obtained by the difference between the time of the first packet and the time of the most recent packet. The destination port set records the destination port values ​​for all packets in the flow and the frequency of each value. The packet length distribution records the packet length values ​​in the flow and the frequency of each length; this distribution is used to determine whether the flow exhibits a pattern of fixed-size data blocks plus small responses.

[0105] The gateway extracts protocol and content features from the flows in the bidirectional flow table. These features include nDPI protocol identification results, DNS (Domain Name System) query domain names, TLS (Transport Layer Security) SNI (Server Name Indicator), JA3 / JA4 fingerprints, HTTP (Hypertext Transfer Protocol) Host field, URL (Uniform Resource Locator) field, User Agent (UA) field, DHCP (Dynamic Host Configuration Protocol) hostname, and the first 64 bytes of the message payload in hexadecimal format.

[0106] The nDPI protocol identification results are obtained as follows: the gateway inputs the packet payload of the flow into the nDPI open-source deep packet inspection library; nDPI maintains the inspection status according to the flow and outputs the protocol identification results of the flow based on payload feature matching and statistical models. For DNS packets carried on UDP destination port 53 or TCP port 53, the gateway parses the DNS packet header, distinguishes between query packets and response packets based on header flags, parses the query area of ​​the query packet, and restores the complete domain name based on the compressed pointer to obtain the DNS query domain name.

[0107] For TLS handshake messages, the gateway identifies TLS records of type 22, parses the extension section in the client greeting message, locates the Server Name Indicator extension (SNI) of extension type 0, reads the hostname carried in the extension, and obtains the TLS SNI. Both JA3 and JA4 fingerprints are TLS client fingerprints. The JA3 fingerprint is obtained by concatenating the TLS version, cipher suite list, extension list, elliptic curve parameters, and elliptic curve format from the client greeting message into a string, performing an MD5 hash on the string, and using the hash result as the JA3 fingerprint.

[0108] The JA4 fingerprint is obtained by encoding the TLS version, cipher suite, and extension and application layer protocol negotiation elements in the client's greeting message, performing SHA256 hashing on each, and concatenating the first 12 bytes of each hash result. The concatenated result is the JA4 fingerprint. JA3 / JA4 fingerprints identify the client software initiating the TLS connection and are used to distinguish different client implementations in encrypted traffic scenarios.

[0109] For HTTP plaintext messages, the gateway identifies the HTTP request message based on the format of the request line and header fields. It parses the request line to obtain the request target, which is used as the URL field; it parses the header fields to obtain the Host header field and User Agent header field, which are used as the HTTP Host and User Agent fields. For DHCP messages carried on UDP ports 67 and 68, the gateway parses the DHCP message's options section, locates option number 12 to read the hostname string, which is used as the DHCP hostname; and locates option number 60 to read the vendor category identifier.

[0110] For each flow, the gateway extracts the first 64 bytes of the payload of the first data packet of the flow. If the payload is less than 64 bytes, it is extracted according to the actual length. The extracted content is converted into a hexadecimal string and used as the hexadecimal content of the first 64 bytes of the packet payload.

[0111] Protocol and content features are extracted along with the flow, and the extraction results are stored in the corresponding flow entries. When a flow entry is eliminated, the features carried by that flow entry are also cleared. The flow statistics features accumulated in the bidirectional flow table, along with protocol and content features, constitute the data source for constructing the access device behavior profile.

[0112] In one or more embodiments of the present invention, performing multi-dimensional behavioral scoring on the access device of the access gateway based on the message includes:

[0113] Extract the MAC address and IP address of the access device from the header of the access-side message in the flow to form the composite key of the flow;

[0114] Within a preset observation window, flows with the same composite key are grouped into a flow set;

[0115] Statistical analysis is performed on the flow set, and the flow statistical characteristics, protocol characteristics and content characteristics of each flow in the flow set are aggregated into the flow statistical characteristics, protocol characteristics and content characteristics of the access device, forming a device-level behavioral profile of the access device;

[0116] Extract a preset number of behavioral dimension values ​​from the device-level behavioral profile to form the behavioral feature vector of the access device;

[0117] Perform multidimensional behavioral scoring based on behavioral feature vectors.

[0118] The gateway extracts the MAC (Media Access Control) address and IP address of the access device from the header of the access-side packets in the flow, forming the composite key of the flow. Access-side packets refer to packets flowing through the local area network (LAN) port. For uplink packets, the source MAC address and source IP address carried in the packet header are the MAC address and IP address of the access device; for downlink packets, the destination MAC address and destination IP address carried in the packet header are the MAC address and IP address of the access device.

[0119] Since bidirectional flow tables group uplink and downlink packets of the same session into the same flow, the uplink and downlink packets in the flow normally carry the MAC address of the same access device. The gateway can extract the composite key by randomly selecting one uplink or downlink packet from the flow. When the flow contains only downlink packets during the observation period, the composite key is formed by the destination MAC address and the destination IP address.

[0120] A composite key is a combination of a MAC address and an IP address. Different composite keys are formed when the same MAC address corresponds to different IP addresses at different times, and when the same IP address is occupied by different access devices at different times. A composite key uniquely corresponds to one access device on the gateway side.

[0121] Within a preset observation window, the gateway groups flows with the same composite key into a flow set. The observation window is a rolling time window, and its duration is set according to the network environment, such as 5 minutes, 1 hour, or 1 day. The observation window extends backward from the current time. Each time a statistical period elapses, the gateway merges newly appearing flows with the same composite key within that period into the flow set of the corresponding access device, and removes flows exceeding the observation window's time range from the flow set, ensuring that the flow set always covers the flows within the most recent observation window. The statistical period can be set to 1 second.

[0122] Flows removed from the flow set will no longer participate in the profile statistics of the access device, but the historical cumulative statistics of the access device will be retained. The historical cumulative statistics will be written back to local storage by the gateway after each collection is completed.

[0123] The gateway performs statistical analysis on the flow set, aggregating the flow statistical characteristics, protocol characteristics, and content characteristics of each flow in the flow set into the flow statistical characteristics, protocol characteristics, and content characteristics of the access device, forming a device-level behavioral profile of the access device. The aggregation method is as follows: summing the uplink and downlink byte counts of each flow in the flow set to obtain the uplink and downlink byte count of the access device within the observation window; summing the uplink and downlink packet counts of each flow in the flow set to obtain the uplink and downlink packet count of the access device within the observation window; merging the destination port sets of each flow in the flow set to obtain the destination port set of the access device within the observation window; merging the packet length distributions of each flow in the flow set to obtain the packet length distribution of the access device within the observation window; and using the number of flows in the flow set as the number of active flows of the access device within the observation window.

[0124] Based on the protocol and content characteristics of the access device, the DNS query domain name, TLS SNI, JA3 / JA4 fingerprint, HTTP Host field, URL field, User Agent field, DHCP hostname, and the first 64 bytes of hexadecimal content of the packet payload carried by each flow in the flow set are respectively collected to obtain the domain name set, server name indication set, client fingerprint set, host field set, Uniform Resource Locator set, User Agent field set, hostname and hexadecimal content set of the access device within the observation window. Each element in the set is accompanied by the number of times it appears.

[0125] After the data is collected, the gateway will combine the uplink and downlink byte counts, uplink and downlink packet counts, active flow counts, destination port set, packet length distribution, domain name set, server name indicator set, client fingerprint set, host field set, Uniform Resource Locator set, user agent field set, hostname and hexadecimal content set of the access device with the MAC address, IP address and composite key of the access device to form a device-level behavioral profile of the access device.

[0126] The device-level behavioral profile also includes the manufacturer information and hostname information of the access device. The manufacturer information is obtained by querying the IEEE (Institute of Electrical and Electronics Engineers) OUI (Organization Unique Identifier) ​​database from the MAC address, and the hostname information is obtained from the DHCP hostname. The device-level behavioral profile is stored in the gateway's local storage and is loaded from the local storage after the gateway restarts. The cumulative statistical results remain valid after the gateway restarts.

[0127] The gateway extracts a preset number of behavioral dimension values ​​from the device-level behavioral profile to form the behavioral feature vector of the access device. A behavioral dimension refers to a statistical measure in the device-level behavioral profile that reflects the characteristics of PCDN traffic. The values ​​of the behavioral dimensions are calculated from the statistical results in the device-level behavioral profile. For example, the uplink / downlink byte ratio is obtained by dividing the number of uplink bytes by the number of downlink bytes within the observation window; when the number of downlink bytes is zero, the uplink byte ratio is used as the value. The total uplink volume is taken as the number of uplink bytes within the observation window. The number of concurrent connections is taken as the number of different destination IP addresses corresponding to active flows within the observation window. The UDP byte percentage is obtained by dividing the number of UDP traffic bytes within the observation window by the total traffic bytes within the observation window.

[0128] The types and number of behavioral dimensions are set by the deployer. These dimensions are extracted from device-level behavioral profiles and arranged in a fixed order to form the behavioral feature vector of the access device. The behavioral feature vector is a numerical sequence, and multi-dimensional behavioral scoring uses this vector as input.

[0129] The gateway performs multi-dimensional behavior scoring based on the behavior feature vector. The PCDN multi-dimensional behavior scoring unit reads the score and corresponding weight parameter of each behavior dimension in the behavior feature vector. The score is obtained by mapping the value of each behavior dimension according to the score range. The score of each behavior dimension is multiplied by the corresponding weight parameter and then summed to obtain a comprehensive score. The comprehensive score is used as the PCDN confidence score of the access device. Access devices with a PCDN confidence score that reaches the confidence threshold are identified as candidate PCDN devices.

[0130] The initial values ​​of the weight parameters are set by the deployer based on known PCDN device samples and known normal device samples. The weight parameters are continuously updated based on the identification labels as the gateway operates. The scoring execution process in this embodiment is connected to the scoring execution process in the previous embodiment. The processes of recording the baseline rate, enabling packet dropping, observing the changing trend, generating identification labels, and writing back the weight parameters in the previous embodiment all start from the candidate PCDN devices and PCDN confidence obtained in this embodiment.

[0131] In this embodiment, the duration of the observation window and the duration of the statistical period are both operating parameters, which are set and adjusted according to the network environment; the composite key composed of MAC address and IP address ensures that the access device is still correctly collected in scenarios where the IP address changes and multiple devices share the same IP address; the device-level behavior profile is saved in local storage so that the cumulative statistical results of the access device are not lost after the gateway restarts.

[0132] In one or more embodiments of the present invention, prior to performing multidimensional behavioral scoring, the method further includes:

[0133] The protocol identification result is obtained by taking the protocol features and content features of the streams in the stream set and using them as the protocol identification result.

[0134] The domain name, TLS SNI, JA3 / JA4 fingerprint, and hexadecimal content of the first 64 bytes of the message payload in the stream set are matched with the rules of the local rule layer. The matched rules are used as evidence of rule hit. The local rule layer supports hot reloading.

[0135] Based on the terminal model, MAC address OUI and public IP address of the access device, query the cloud feature database to obtain cloud feature database hit evidence. The cloud feature database hit evidence includes the application affiliation, manufacturer affiliation and public IP affiliation of the access device.

[0136] The protocol identification results, rule-matching evidence, and cloud-based feature database matching evidence are combined into application attribution and matching evidence.

[0137] The three-layer recognition process is performed after the device-level behavior profile is constructed and before the multi-dimensional behavior scoring is executed. It outputs the application attribution and hit evidence of the accessed device, which serves as one of the inputs for the multi-dimensional behavior scoring.

[0138] The gateway retrieves the nDPI protocol identification results from the protocol features and content features corresponding to the flows in the flow set, and uses these as the protocol identification results. Each flow has already obtained its nDPI protocol identification result during the feature extraction stage; the protocol identification result represents the transport protocol type and application protocol type of the flow. For a flow set containing multiple flows, the gateway groups the flows in the flow set according to their protocol identification results, calculates the proportion of bytes corresponding to each group's protocol identification result to the total number of bytes in the flow set, and uses the protocol identification result with the highest proportion as the protocol identification result of the access device, while retaining the proportion of each group as well.

[0139] Protocol identification results are selected proportionally by byte to prevent transient probe streams and noise streams from dominating the identification results. The identification results include transport and application protocol types such as TLS, HTTP, and QUIC, providing evidence at the protocol level.

[0140] The local rule layer stores domain name rules, SNI rules, JA3 / JA4 fingerprint rules, and hexadecimal rules for message payloads. Each rule includes a rule identifier, matching type, matching value, application name, vendor affiliation, and rule source. Domain name rules and SNI rules support full matching and subdomain matching. JA3 / JA4 fingerprint rules use complete fingerprint value matching. Hexadecimal rules for message payloads use prefix matching. The prefix matching process involves comparing the hexadecimal string in the rule with the first 64 bytes of the hexadecimal content of the message payload in the stream, byte by byte. A successful match occurs when all hexadecimal bytes in the rule match.

[0141] When the gateway performs matching, it retrieves the domain name, TLS SNI, JA3 / JA4 fingerprint, and the first 64 bytes of hexadecimal content of the packet payload from the flow set. It then matches the domain name against the domain name rules, the TLS SNI against the SNI rules, the JA3 / JA4 fingerprint against the JA3 / JA4 fingerprint rules, and the first 64 bytes of the packet payload against the packet payload hexadecimal rules. Matching is accelerated using an index. The domain name rules and SNI rules are organized into a tree index according to the domain name hierarchy, and the matching process searches segment by segment along the domain name hierarchy. The JA3 / JA4 fingerprint rules are organized into a hash table according to the fingerprint value, and the matching process performs a hash lookup on the fingerprint value. The packet payload hexadecimal rules are grouped by the first byte of the hexadecimal string, and the matching process locates candidate rules based on the first byte and then compares them byte by byte.

[0142] The matched rules serve as rule hit evidence. Rule hit evidence includes the rule identifier, matching type, matching value, and the application name and vendor affiliation carried by the rule. When multiple rules are matched in the same flow, all matched rules are recorded in the rule hit evidence, and the flow corresponding to each rule is labeled. Rule hit evidence is output along with the recognition results.

[0143] The local rule layer supports hot reloading. The gateway monitors the rule files, and when the content of the rule files changes, a loading is triggered. The gateway reads the changed rule files, parses them to generate a new set of rules and a rule index. After the new set of rules and the rule index are built, the rule query entry point is switched to the new set of rules and the rule index. The switching process does not interrupt rule matching, and the gateway process does not restart.

[0144] The rule files are in text format, with rule fields organized using fixed delimiters. Rules support incremental updates; during incremental updates, the gateway only rebuilds the index entries corresponding to the changed rules. Hot reloading enables the gateway to update matching rules promptly after acquiring new PCDN vendor characteristics. The sources of rules in the local rule layer include rules written by the deployer and candidate rules generated by the evidence graph mechanism. The evidence graph mechanism observes the co-occurrence relationships of flow features in the flow set, automatically clustering frequently co-occurring domains, TLS SNI, JA3 / JA4 fingerprints, and hexadecimal content of the message payload to generate candidate rules. These candidate rules are then confirmed by the deployer and enter the local rule layer.

[0145] The gateway queries the cloud-based feature database based on the terminal model, MAC address OUI, and public IP address of the access device. The terminal model is obtained from the user agent field set in the device-level behavioral profile and resolved using DHCP hostname. The user agent field carries device model information, and the DHCP hostname carries device model information and manufacturer information. The gateway extracts the WAN-side IP address from the access device's traffic and uses it as the access device's public IP address. The WAN-side IP address is recorded by the gateway during the address translation process. In a home gateway scenario, when multiple access devices share the same WAN-side IP address, the public IP addresses obtained by the multiple access devices after querying belong to the same entity.

[0146] The gateway encapsulates the terminal model, MAC address, OUI, and public IP address into a query request and sends it to the cloud-based feature database service. The cloud-based feature database stores the mappings between terminal models and application affiliations, OUIs and vendor affiliations, and public IP addresses and their corresponding public IP addresses. The public IP address mapping includes data center attributes, carrier attributes, geographic location attributes, and multi-tenant annotations. The cloud-based feature database returns a match result, which includes the application affiliation, vendor affiliation, and public IP address of the access device.

[0147] Query results are cached locally on the gateway with a set validity period. Repeated queries from the same access device within this period directly use the cached results. The cache validity period for public IP address-based queries can be set to 24 hours, while the cache validity period for terminal model-based and OUI-based queries can be set to 7 days. The cache validity period is adjusted according to the update frequency of the cloud-based feature database. When the cloud-based feature database is unavailable, the gateway continues to perform local rule matching and multi-dimensional behavior scoring. If the cloud-based feature database has no matching evidence, the corresponding dimension in the multi-dimensional behavior score will use its default value.

[0148] The gateway merges the protocol identification results, rule-matching evidence, and cloud-based feature database matching evidence into application attribution and matching evidence. During merging, the gateway sets priorities for the protocol identification results, rule-matching evidence, and cloud-based feature database matching evidence. The vendor attribution and public IP attribution in the cloud-based feature database matching evidence are directly incorporated into the matching evidence. When there are multiple sources for application attribution, the application name carried by the rule-matching evidence is used first. When rule-matching evidence is missing, the application attribution in the cloud-based feature database matching evidence is used. When cloud-based feature database matching evidence is also missing, the application name corresponding to the protocol identification results is used.

[0149] The merged application attribution and hit evidence includes application name, vendor attribution, public IP address attribution, and hit evidence entries. Each hit evidence entry records the evidence type, matching content, and source. In the aforementioned embodiments, the determination of the control face's IP address is based on the data center attributes marked in the cloud feature library. The cloud feature library hit evidence merged in this embodiment provides the data center attributes. The execution of the multi-dimensional behavior scoring in the aforementioned embodiments uses the application attribution and hit evidence merged in this embodiment as input.

[0150] In this embodiment, the execution order of the three-layer identification process is protocol identification, local rule matching, and cloud feature library query. The three-layer identification process can be executed in parallel, and the merging step is executed after the three-layer identification process is completed. The monitoring period of the rule file, the validity period of the query cache, and the merging priority are operating parameters that are set and adjusted according to the network environment.

[0151] In one or more embodiments of the present invention, multidimensional behavioral scoring includes:

[0152] The behavioral dimension is at least two of the following dimensions in the device-level behavioral profile: uplink / downlink byte ratio, total uplink volume, peak concentration, long duration, concurrent connections, UDP byte ratio, port concentration, fixed block mode, domain name binding ratio, and destination IP nature.

[0153] Application attribution and hit evidence are added as additional behavioral dimensions to the behavioral feature vector. The additional behavioral dimensions include the vendor label dimension, and the value of the vendor label dimension is taken from the vendor attribution in the application attribution and hit evidence.

[0154] Set weight parameters for each behavioral dimension in the behavioral feature vector;

[0155] Map the values ​​of each behavioral dimension in the behavioral feature vector to scores for each behavioral dimension according to the score range;

[0156] The scores of each behavioral dimension are weighted and summed according to the weight parameters to obtain the comprehensive score; the comprehensive score is used as the confidence level of PCDN.

[0157] Multidimensional behavioral scoring uses a behavioral feature vector as input, which is composed of the values ​​of behavioral dimensions in the device-level behavioral profile. A behavioral dimension refers to a statistical measure in the device-level behavioral profile that reflects the characteristics of PCDN traffic. Candidate types of behavioral dimensions include uplink / downlink byte ratio, total uplink volume, peak concentration, long duration, concurrent connections, UDP byte percentage, port concentration, fixed block mode, domain name binding ratio, and destination IP nature. The deployer selects at least two dimensions from the above behavioral dimensions to form the behavioral dimension set used for scoring. The types and number of dimensions included in the behavioral dimension set are determined based on known PCDN device samples and known normal device samples within the network. In this embodiment, a perfect score refers to the state where the behavioral dimension score reaches the upper limit.

[0158] The calculation methods for uplink / downlink byte ratio, total uplink volume, concurrent connections, and UDP byte percentage have been disclosed in the aforementioned embodiments. This embodiment supplements the scoring rules for the behavioral dimensions. The uplink / downlink byte ratio reflects the relationship between the number of uplink bytes and downlink bytes on the access device. When the PCDN device distributes content to the peer node device, the number of uplink bytes is greater than the number of downlink bytes. A higher uplink / downlink byte ratio indicates that the access device is closer to the PCDN device. The score increases as the uplink / downlink byte ratio increases. Full marks are awarded when the uplink / downlink byte ratio reaches a set value, which can be set to 5. When the uplink / downlink byte ratio is between 3 and 5, the score is taken from the middle range. When the uplink / downlink byte ratio is less than 3, the score is taken from the lower range. The middle range and the lower range are set by the deployer.

[0159] The total uplink volume reflects the number of uplink bytes of the access device within the observation window. PCDN devices distribute content to the outside for a long time, so the total uplink volume is large. When the total uplink volume reaches the total volume threshold, the full score is obtained. When the total uplink volume does not reach the total volume threshold, the score increases as the total uplink volume approaches the total volume threshold. The total volume threshold is set by the deployer based on the bandwidth limit of the access device.

[0160] Peak concentration reflects the degree of concentration of uplink traffic during peak periods. The statistics of peak concentration adopt a daily observation window, with 20:00 to 24:00 each day as the peak period. The start and end times of the peak period are set and adjusted according to the network environment. The proportion of uplink bytes during the peak period to the total uplink bytes of the day is counted, and this proportion is used as the value of the peak concentration dimension. The uplink traffic of PCDN devices increases synchronously with the content demand of the entire network during peak periods, and the peak concentration is high. When the peak concentration reaches the proportion threshold, full marks are awarded. When the proportion does not reach the proportion threshold, the score increases as the proportion approaches the proportion threshold.

[0161] Long persistence reflects the duration of continuous high-bandwidth uplink by the access device. The observation window is divided into statistical periods, and the uplink traffic rate of the access device within each statistical period is counted. The statistical period in which the uplink traffic rate reaches the high bandwidth threshold is recorded as a high bandwidth period. Consecutive high bandwidth periods constitute a high bandwidth continuous segment. The longest duration of the high bandwidth continuous segment is taken as the value of the long persistence dimension. The high bandwidth threshold is set as a set percentage of the upper limit of the uplink bandwidth of the access device. The set percentage can be set to 50%. The PCDN device continuously distributes content. The longer the duration of the high bandwidth continuous segment, the higher the score.

[0162] The number of concurrent connections reflects the number of destination IP addresses that the access device can connect to simultaneously. PCDN devices establish connections with a large number of peer node devices simultaneously, and the score increases with the number of concurrent connections. The UDP byte percentage reflects the proportion of UDP traffic bytes to the total traffic bytes of the access device. PCDN data plane primarily uses UDP, and the score increases with the UDP byte percentage.

[0163] Port concentration reflects the degree of concentration of destination ports of the control plane flow of the access device. It is calculated by counting the destination ports of the flow between the access device and the destination IP address of the data center attribute, and taking the number of different values ​​of the destination port as the value of the port concentration dimension. The data center attribute is taken from the public IP attribution in the hit evidence of the cloud feature library. The destination ports of the PCDN control plane flow are concentrated in a small number of ports. The fewer the number of different values ​​of the destination port, the higher the score. The full score is obtained when the number of different values ​​of the destination port is 1 to 2.

[0164] The fixed block pattern reflects whether the flow of the access device presents a pattern of fixed-size data blocks plus small responses. For each flow of the access device, the message length values ​​are sorted in descending order of their occurrence frequency. If the message length value with the highest occurrence frequency corresponds to the data block length, and the message length value with the second highest occurrence frequency corresponds to the response length, and the number of messages corresponding to these two message length values ​​accounts for a set proportion of the total number of messages in the flow, then the flow is determined to present a fixed block pattern. The data block length value can be set to 1049 bytes, and the response length can be set to 23 bytes. The proportion of the number of bytes of the flow presenting the fixed block pattern to the total number of bytes of traffic in the observation window is counted. This proportion is used as the value of the fixed block pattern dimension, and the score increases as the proportion increases.

[0165] The domain name binding ratio reflects the proportion of traffic carrying domain names in the traffic of the access device. It is calculated by counting the number of bytes of traffic carrying domain names within the observation window. Carrying domain names refers to the traffic carrying DNS query domain names, TLS SNI, or HTTP Host fields. The proportion of the number of bytes of traffic carrying domain names to the total number of bytes of traffic within the observation window is the value of the domain name binding ratio dimension. PCDN control plane traffic is directly connected by IP address and does not carry domain names. The lower the domain name binding ratio, the higher the score. When the access device's hit evidence hits a domain name in the PCDN vendor's exclusive domain name set or the PCDN dedicated domain name set, the domain name binding ratio dimension gets full marks.

[0166] The destination IP property reflects the data center attribute and geographical location distribution of the destination IP address accessed by the access device. Evidence is obtained from the cloud feature database to determine the public IP address affiliation of the destination IP address within the observation window. The proportion of destination IP addresses with data center attributes to the total number of destination IP addresses is calculated, as well as the number of provinces covered by the geographical location of the destination IP address. The PCDN control face end is a data center attribute address and its distribution spans multiple provinces. Full marks are awarded when the proportion of data center attributes reaches a set ratio and the number of provinces reaches a set number. If the ratio is not reached, the score varies with the proportion of data center attributes and the number of provinces.

[0167] The gateway adds application attribution and hit evidence as additional behavioral dimensions to the behavioral feature vector. The additional behavioral dimensions include the vendor label dimension. The value of the vendor label dimension is taken from the vendor attribution in the application attribution and hit evidence. When the vendor attribution matches a known PCDN vendor, the vendor label dimension takes the hit value. When the vendor attribution is empty, the vendor label dimension takes the default value. The vendor label dimension gets full marks when it matches a known PCDN vendor and zero marks when it does not match.

[0168] The gateway maps the value of each behavior dimension to the score of the behavior dimension according to the score range. The score range is set by the deployer based on the known PCDN device samples and the known normal device samples. The upper limit of the score range is 1, the full score corresponds to a score of 1, the middle range value and the low range value correspond to the values ​​within the score range. The mapped score is used as the score value of the behavior dimension. The score value is used for weighted accumulation. The value of each behavior dimension is stored in the behavior feature vector.

[0169] When the value of the behavior dimension cannot be obtained, the lower score of the behavior dimension is used as the default value for weighted accumulation. Situations where the value cannot be obtained include insufficient access time of the access device to the gateway to cover the statistical time required for the behavior dimension, unreachable cloud feature library, and empty vendor affiliation.

[0170] The gateway sets weight parameters for each behavioral dimension in the behavioral feature vector. These weight parameters reflect the contribution of the behavioral dimension to the PCDN determination. The maximum score for each behavioral dimension is 1, and the score for any behavioral dimension cannot exceed 1. The initial values ​​of the weight parameters are set based on known PCDN device samples and known normal device samples. An example setting for the weight parameters is as follows: uplink / downlink byte ratio: 20; total uplink volume: 15; long persistence: 10; concurrent connections: 15; UDP byte percentage: 10; port concentration: 5; domain name binding ratio: 10; destination IP nature: 10; vendor tag dimension: 5. The sum of these weight parameters is 100, constituting the full score. When the deployer enables the peak concentration dimension or fixed block mode dimension, weight parameters are set for these dimensions, and the full score is adjusted according to the sum of the weight parameters.

[0171] After the weight parameter update causes a change in the full score, the confidence threshold is adjusted synchronously according to the set proportion of the full score. The set proportion is determined by the deployer based on the PCDN confidence distribution of normally accessed devices in this network.

[0172] When the gateway performs weighted accumulation, it reads the score and corresponding weight parameter of each behavioral dimension in the behavioral feature vector, multiplies the score of each behavioral dimension by the corresponding weight parameter, and adds all the products to obtain the comprehensive score. The sum of all weight parameters constitutes the full value of the comprehensive score, which is used as the PCDN confidence level of the access device. Access devices whose PCDN confidence level reaches the confidence threshold are identified as candidate PCDN devices. The confidence threshold is set by the deployer based on the PCDN confidence level distribution of normal access devices in the network.

[0173] The identification and label write-back update weight parameters described in the foregoing embodiments are the weight parameters set in this embodiment as the objects of the write-back update. After the weight parameters are updated, the gateway performs weighted accumulation according to the updated weight parameters.

[0174] In this embodiment, the selection of the behavioral dimension set, the score range, the weight parameters, the full score and the confidence threshold are all operating parameters, which are set and adjusted according to the network environment and known PCDN device samples and known normal device samples.

[0175] In one or more embodiments of the present invention, observing the change trend of data plane traffic rate relative to a reference rate during and after packet drop is enabled includes:

[0176] The data plane traffic rate of the candidate PCDN device is continuously sampled to obtain a rate sequence, which includes the data plane traffic rate of the candidate PCDN device during the packet dropping activation period and after its deactivation.

[0177] Each rate value in the rate sequence is compared point by point with the reference rate to obtain the comparison results.

[0178] The trend of the rate sequence is determined based on the comparison results, and the trend is taken as the changing trend.

[0179] An event notification mechanism is established between the effect feedback and attenuation observation unit and the dynamic blocking unit. When the dynamic blocking unit enables packet dropping, it records the activation time and outputs an activation event to the effect feedback and attenuation observation unit. The activation event carries the candidate PCDN device identifier and the set of control plane IP addresses corresponding to packet dropping. When packet dropping is automatically revoked after a preset time, the dynamic blocking unit records the revocation time and outputs a revocation event to the effect feedback and attenuation observation unit. The candidate PCDN device identifier and the set of control plane IP addresses carried by the revocation event are consistent with those of the activation event.

[0180] The effect feedback and attenuation observation unit initiates sampling of the data plane flow rate of the candidate PCDN device based on the enable event, and divides the sampling points into sampling points during the enable period and sampling points after the revocation event based on the revocation event. The enable event and the revocation event ensure that the sampling object and the disposal object correspond to the same candidate PCDN device.

[0181] The sampling process follows a statistical period. The statistical period, as disclosed in the aforementioned embodiments, can be set to 1 second.

[0182] The statistical caliber for data plane traffic rate is as follows: Uplink traffic from the candidate PCDN devices to each destination IP address is grouped by destination IP address, with a statistical period as the unit. For each destination IP address group, the distribution of uplink bytes, UDP bytes, and packet length within the statistical period is statistically analyzed. Fixed block mode and UDP byte percentage are determined for each destination IP address group, using the same methods as those used in dynamic peer IP address determination. When a destination IP address group simultaneously meets both the fixed block mode and UDP percentage conditions, the traffic corresponding to that destination IP address group is the traffic from the candidate PCDN device distributing content to the peer node device. Uplink traffic to the control plane destination IP address set is not included in the above grouping statistics. The gateway maintains a destination IP address byte counter using a composite key and the destination IP address. This counter accumulates with each uplink packet length during packet parsing. The counter value is not cleared when flow entries in the bidirectional flow table are evicted. If no packets arrive at a destination IP address group for 300 consecutive seconds, the counter corresponding to that destination IP address group is cleared. At the end of each statistical period, the effect feedback and decay observation unit sums the counter differences corresponding to each destination IP address group that simultaneously satisfies the fixed block mode condition and the UDP proportion condition, divides the sum by the duration of the statistical period, and obtains the data plane traffic rate of the statistical period. The data plane traffic rate is used as a sampling point.

[0183] Sampling continues from the start time and continues after the cancellation time until the trend is determined. If the trend is still not determined by the end of the set observation period after cancellation, sampling is extended until the maximum sampling period expires. The set observation period after cancellation can be set to 600 seconds. The maximum sampling period is set by the deployer according to the content cache size of the candidate PCDN device, and the maximum sampling period covers the time required for the content cache to be exhausted. Each sampling point is arranged in order of sampling time, forming a rate sequence. The rate sequence includes the data plane traffic rate of the candidate PCDN device during and after the packet dropping period. Each sampling point records the sampling time, rate value, and stage identifier. The stage identifier indicates whether the sampling point belongs to the sampling point during the activation period or the sampling point after cancellation. The rate sequence is stored locally on the gateway for trend analysis.

[0184] Each rate value in the rate sequence is compared point-by-point with a reference rate to obtain the comparison result. The point-by-point comparison is performed by comparing the rate value of each sampling point in the rate sequence with the reference rate, determining the category of the sampling point based on the position of the rate value relative to the reference rate, and the category of the sampling point constitutes the comparison result of the sampling point.

[0185] Sampling point categories include level sampling points, high-level sampling points, low-level sampling points, and zero-rate sampling points. Level sampling points refer to sampling points where the rate value is within the range near the reference rate and the reference rate is greater than zero; high-level sampling points refer to sampling points where the rate value is higher than the upper limit of the range near the reference rate; low-level sampling points refer to sampling points where the rate value is lower than the lower limit of the range near the reference rate and is greater than zero; zero-rate sampling points refer to sampling points where the rate value is equal to zero.

[0186] The upper and lower bounds of the interval near the reference rate are set by the deployer. The upper bound is higher than the reference rate, and the lower bound is lower than the reference rate. The upper bound can be 120% of the reference rate, and the lower bound can be 80% of the reference rate. The sample point category sequence obtained by point-by-point comparison is used as the comparison result. The comparison result is generated point by point as sampling progresses.

[0187] The trend of the rate sequence is determined based on the comparison results, and this trend is taken as the changing direction. The trend determination is based on segments composed of consecutive sampling points, which are segments composed of sampling points with adjacent sampling times and the same sampling point category. The trend determination rule consists of three criteria.

[0188] Criterion 1 is that the rate sequence has a continuous segment of flat sampling points from the moment the message discard is enabled, the duration of the flat sampling point segment exceeds the preset initial observation duration, the sampling points after the flat sampling point segment are low-level sampling points or zero-rate sampling points, the rate value continues to decrease, and the rate value after the decrease remains in the low-level sampling point range or zero rate; when criterion 1 is satisfied, the trend is that it first maintains the baseline rate and then decreases monotonically.

[0189] Criterion two is that the rate sequence shows its first zero-rate sampling point within a preset initial observation period starting from the moment message discarding is enabled, and the zero-rate sampling point continues until the end of the current rate sequence; when criterion two is satisfied, the trend is that it decreases to zero after being enabled. The preset initial observation period used for criteria one and two is an operating parameter set by the deployer.

[0190] Criterion three is that the trend follows the other trends when any of the following conditions are met in the rate sequence: the sampling point after the end of the flat sampling point segment is a high sampling point; the rate value decreases and then rebounds; the rate value rebounds to the flat sampling point after cancellation; the trend is still undetermined when the longest sampling duration expires. If criteria one and two are not met and none of the above conditions have occurred, sampling continues. Sampling points after cancellation participate in trend determination.

[0191] Trend judgment is performed after each sampling point is generated. The effect feedback and decay observation unit incorporates the newly generated sampling points into the rate sequence and checks whether the trend meets the above three criteria. Once the trend meets the criteria, it is output, and the output trend is used as the change trend. After the trend is output, sampling continues to be executed to observe the continuity of the trend. After generating a confirmation label, sampling enters the long-term observation stage and continues to be executed. The long-term observation duration is set by the deployer and covers the time required for the content cache to be exhausted. After generating a misjudged label or a questionable label, sampling execution stops when the set observation duration expires after cancellation.

[0192] The trend determination process described above is completed locally at the gateway, and the comparison results and trend judgment do not rely on cloud services. The upper and lower bounds of the interval near the reference rate, the observation duration after cancellation, and the statistical period are operating parameters, which are set and adjusted according to the network environment and the traffic characteristics of the candidate PCDN devices.

[0193] In one or more embodiments of the present invention, the handling of the IP address of the control plane is adjusted according to the changing trend, and an identification label is generated according to the changing trend. The identification label is then written back to update the weight parameters of the multi-dimensional behavior score, including:

[0194] When the trend is that the data plane traffic rate remains at the baseline rate after packet dropping is enabled, and the duration of this maintenance exceeds the preset initial observation period, and then decreases monotonically, an acknowledgment label is generated. Based on the acknowledgment label, the weight parameters of the multi-dimensional behavior score are increased, and continuous packet dropping is performed on the IP address of the control plane.

[0195] When the trend is that the data plane traffic rate drops to zero within the preset initial observation period after packet dropping is enabled, a misjudgment label is generated. Based on the misjudgment label, the weight parameters of the multi-dimensional behavior score are reduced, and forwarding is maintained for the IP address of the control plane.

[0196] When the trend changes to the other direction, a suspicious label is generated. The weight parameters of the multi-dimensional behavior score are maintained based on the suspicious label. Forwarding is maintained for the IP address of the control face and re-identification is triggered for the candidate PCDN device.

[0197] The preset initial observation duration refers to the observation period used to distinguish device response types after packet dropping is enabled. The preset initial observation duration is determined by the deployer calculating the duration of traffic disappearance for known normal devices within the network after packet dropping is enabled. This traffic disappearance duration includes the time required for the playback buffer of known normal devices to exhaust. The preset initial observation duration is set to a value higher than this traffic disappearance duration, ensuring that the data plane traffic of normal devices completes its response within the preset initial observation duration, and that the PCDN device maintains service using content caching for a time exceeding the preset initial observation duration. The preset initial observation duration can be set to 60 seconds and adjusted according to the network environment.

[0198] The effect feedback and decay observation unit calculates the maintenance duration and zeroing time from the sampling time of the rate sequence. The maintenance duration is the time between the message discard activation time and the end time of the flat sampling point segment, and the zeroing time is the sampling time of the first zero rate sampling point.

[0199] When the data plane traffic rate remains at the baseline rate after packet dropping is enabled, and the duration of this maintenance exceeds the preset initial observation period, followed by a monotonic decrease, the effect feedback and attenuation observation unit generates a confirmation label. The confirmation label includes the candidate PCDN device's composite key, label type, trend, control plane IP address set, generation time, and the behavioral feature vector used to score the candidate PCDN device. A duration exceeding the preset initial observation period indicates that the candidate PCDN device continues to provide service via content caching after the control plane interruption; the subsequent monotonic decrease indicates a continuous reduction in content in the content cache, thus confirming the candidate PCDN device as a PCDN device.

[0200] The method for updating the weight parameters corresponding to the confirmation label is as follows: calculate the score of each behavioral dimension based on the behavioral feature vector carried by the confirmation label; for behavioral dimensions whose scores exceed half of the upper limit of the score, increase the weight parameter by a preset step size; each behavioral dimension's weight parameter has an adjustment lower limit and an adjustment upper limit, which are set by the deployer based on known PCDN device samples and known normal device samples, and the increase of the weight parameter is performed within the range of the adjustment lower limit and adjustment upper limit.

[0201] The confirmed action is to continuously drop packets from the IP address of the control plane. If automatic cancellation of packet dropping has not yet been executed, the gateway cancels the automatic cancellation, and packet dropping remains effective from the date it was enabled. If automatic cancellation of packet dropping has already been executed, the gateway re-enables packet dropping, and the re-enabled packet dropping remains effective. Continuous packet dropping prevents the candidate PCDN device from acquiring new scheduling tasks, causing its content cache to continuously decrease and eventually exhaust it within a finite time. After exhaustion, data plane traffic to the candidate PCDN device ceases.

[0202] When the data plane traffic rate drops to zero within a preset initial observation period after packet drop is enabled, the effect feedback and attenuation observation unit generates a misjudgment label. The misjudgment label includes the candidate PCDN device's composite key, label type, trend, control plane IP address set, generation time, and the behavioral feature vector used to score the candidate PCDN device. If the zeroing time falls within the preset initial observation period, or if the data plane traffic rate remains zero after packet drop is enabled, it indicates that the candidate PCDN device's data plane traffic is driven by interactive behavior, the candidate PCDN device has no content cache available for service, and the identification result is a misjudgment.

[0203] The weight parameter update method for misjudged labels is as follows: calculate the score of each behavioral dimension based on the behavioral feature vector carried by the misjudged label; for behavioral dimensions whose scores exceed half of the upper limit of the score, reduce the weight parameter by a preset step size; and the reduction of the weight parameter is performed within the range of the lower limit and the upper limit of the adjustment.

[0204] The handling for misclassification is to maintain forwarding to the control plane IP address. If automatic revocation of packet dropping has not yet been executed, the gateway prematurely deletes the matching entry corresponding to packet dropping, and packets destined for the control plane IP address resume forwarding; if automatic revocation of packet dropping has already been executed, the gateway maintains forwarding to the control plane IP address. After the weight parameters are updated, the gateway uses the updated weight parameters to re-perform multi-dimensional behavioral scoring on the candidate PCDN device, obtaining an updated PCDN confidence score. This updated PCDN confidence score is used for subsequent identification and handling of the candidate PCDN device.

[0205] When the trend is one of the other, the effect feedback and decay observation unit generates a questionable label. The questionable label includes the candidate PCDN device's composite key, label type, trend, control plane IP address set, generation time, and the behavioral feature vector used to score the candidate PCDN device. Other trends include the trend where the data plane traffic rate remains at the baseline rate after packet dropping is enabled, and the trend where the data plane traffic rate decreases and then increases. If these trends cannot support a confirmed or misjudged conclusion, the status of the candidate PCDN device needs to be re-identified and determined. The situation where the data plane traffic rate remains at the baseline rate may stem from the candidate PCDN device obtaining scheduling tasks through means other than the control plane IP address set.

[0206] The weight parameters corresponding to the suspicious label are updated by maintaining the weight parameters. The handling for the suspicious label is to continue forwarding to the control plane IP address and trigger re-identification for the candidate PCDN device. If the automatic cancellation of packet dropping has not yet been executed, the gateway deletes the matching entry corresponding to packet dropping in advance, and packets sent to the control plane IP address resume forwarding; if the automatic cancellation of packet dropping has been executed, the gateway maintains the forwarding state for the control plane IP address.

[0207] When the number of times the same candidate PCDN device generates a suspicious label reaches the upper limit of the suspicious label count, the gateway will suspend the packet dropping disturbance of the candidate PCDN device and hand it over to manual verification. The upper limit of the suspicious label count is set by the deployer.

[0208] The re-identification process involves the gateway re-aggregating and clustering the traffic of the candidate PCDN devices. Within the observation window used for re-identification, flows with the same composite key are grouped into a flow set, updating the device-level behavioral profile of the candidate PCDN devices. The three-layer identification process is then re-executed, taking the updated protocol identification results, rule hit evidence, and cloud feature library hit evidence, and merging them to obtain the updated application attribution and hit evidence. The behavioral dimension values ​​are extracted from the updated device-level behavioral profile, and multi-dimensional behavioral scoring is performed to obtain the updated PCDN confidence score. Based on the updated application attribution and hit evidence, the IP address set of the control face is re-determined.

[0209] During the re-identification process, the gateway continues to forward the control plane IP addresses of the candidate PCDN devices, keeping the control plane traffic of the candidate PCDN devices visible. After the control plane IP address set is updated, the gateway re-executes the processes of recording the baseline rate, enabling packet dropping for a preset duration, observing change trends, generating identification labels, and adjusting the handling of the updated control plane IP address set.

[0210] The generation of identification tags and the output of handling adjustment instructions are executed by the effect feedback and attenuation observation unit. Handling adjustment instructions are sent to the dynamic blocking unit, which, based on the instructions, enables, cancels, and maintains packet discarding. Identification tags are written back to the PCDN multi-dimensional behavior scoring unit, which updates weight parameters based on the tags. Identification tags are stored locally on the gateway, sorted by generation time. The deployer can query all identification tags to verify the identification and handling process. The preset initial observation duration, preset step size, adjustment lower limit, and adjustment upper limit are all operating parameters, set and adjusted according to the network environment and known PCDN device samples and known normal device samples.

[0211] In one or more embodiments of the present invention, after confirming that the annotation has been generated, the method further includes:

[0212] Persistent packet dropping is performed on the control plane destination IP address among the destination IP addresses of the candidate PCDN devices, and hierarchical classification is performed on the remaining destination IP addresses of the candidate PCDN devices;

[0213] Add the destination IP addresses that match the whitelist address from the remaining destination IP addresses to the whitelist address;

[0214] Add the destination IP addresses that match the T1 level from the destination IP addresses that are not included in the whitelist to the T1 level destination IP address;

[0215] The destination IP address that matches the T2 level among the destination IP addresses that are not included in the whitelist and the T1 level destination IP address is included in the T2 level destination IP address;

[0216] Among the remaining destination IP addresses after allocation, the destination IP addresses whose corresponding flow is between the candidate PCDN device and the destination IP address, whose UDP traffic bytes in the corresponding flow account for a preset percentage threshold of the total traffic bytes between the candidate PCDN device and the destination IP address, and whose packet length in the corresponding flow presents a fixed block mode, are determined to be dynamic peer IP addresses.

[0217] Persistent packet dropping is performed on the T1-level destination IP address and the T2-level destination IP address; uplink rate limiting is performed on the data plane traffic corresponding to the dynamic peer IP address; forwarding is maintained for the whitelisted addresses; and forwarding is maintained for the remaining destination IP addresses after the inclusion.

[0218] After the annotation is confirmed, the gateway performs a four-level classification of the destination IP addresses accessed by the candidate PCDN devices within the observation window, and performs corresponding processing on the destination IP addresses at each level according to the classification results. The destination IP address set is obtained by the gateway extracting all destination IP addresses from the flow set of the candidate PCDN devices and deduplicating them to obtain the destination IP address set of the candidate PCDN devices, and then removing the control plane destination IP addresses from the destination IP address set. The set of destination IP addresses after removal is the object of hierarchical classification.

[0219] A whitelist of addresses refers to a pre-configured set of destination IP addresses that are forwarded once a match is found. This whitelist includes multi-tenant public cloud CDN addresses, public DNS addresses, cloud metadata addresses, instant messaging service addresses, payment service addresses, reserved addresses, and private addresses. The whitelist is stored in the gateway's policy management storage and is maintained and updated by the deployer according to the network environment.

[0220] The first step in the partitioning process is to compare each destination IP address in the destination IP address set with the whitelist address set. Matching destination IP addresses are added to the whitelist. Whitelisted destination IP addresses are not considered in subsequent hierarchical determinations, but forwarding is maintained for them. Normal service traffic corresponding to whitelisted addresses remains available during the handling of candidate PCDN devices, and services such as instant messaging, payment, and live video streaming carried by multi-tenant public cloud CDNs are unaffected. The maintenance forwarding of whitelisted addresses only applies to traffic other than filler traffic. Continuous packet dropping of filler traffic constitutes an exception to the maintenance forwarding of whitelisted addresses. This exception only applies to filler traffic of the candidate PCDN device and does not affect traffic forwarding of other access devices carried by the same whitelisted address.

[0221] The criteria for T1-level matching are the attribution nature of the destination IP address and the domain name evidence corresponding to the destination IP address. The gateway obtains the public IP address attribution from the cloud feature database, which includes data center attributes, carrier attributes, geographical location attributes, and multi-tenant labeling. The gateway obtains the domain name and certificate information corresponding to the destination IP address from the rule matching evidence. For flows using TLS 1.2, the gateway reads the certificate subject name from the server certificate field; if the certificate subject name is unavailable, the domain name corresponding to the destination IP address in the DNS resolution record is used as a substitute.

[0222] The determination process is as follows: when the destination IP address meets the following conditions, it is classified as a T1-level destination IP address: the destination IP address is marked as having data center attributes in the cloud feature database; the domain name or certificate subject name corresponding to the destination IP address matches a known set of PCDN vendor-specific domain names, which is compiled by the deployer based on the domain names of the PCDN vendor's control server, scheduling server, and reporting server; and the multi-tenancy label of the destination IP address is empty, meaning that the destination IP address is not marked as a multi-tenant public cloud infrastructure in the cloud feature database. A T1-level destination IP address corresponds to the PCDN vendor's own control server, scheduling server, and reporting server, and the control plane purpose carried by the T1-level destination IP address is clearly defined.

[0223] The T2 level matching determination is performed between destination IP addresses that are not included in the whitelist and T1 level destination IP addresses. The gateway obtains the domain name corresponding to the destination IP address from the DNS resolution record, which is obtained by the gateway saving the mapping between the domain name and the Internet Protocol address when resolving the DNS response message.

[0224] The determination process is as follows: when the domain name corresponding to the destination IP address matches the PCDN dedicated domain name set, and the multi-tenant label of the destination IP address is empty, the destination IP address is classified as a T2-level destination IP address. The PCDN dedicated domain name set includes resource domain names, scheduling domain names, and reverse probing domain names from the PCDN vendor. This set is compiled by the deployer based on publicly available information from the PCDN vendor and actual network traffic. The PCDN dedicated domain name set is stored in the local rule layer and is updated via hot loading. The T2-level destination IP address is obtained by resolving the PCDN dedicated domain name and is used for scheduling and resource distribution.

[0225] The determination of the dynamic peer IP address is performed among the remaining destination IP addresses after allocation. For each remaining destination IP address, the gateway retrieves the flow with the source IP address being the candidate PCDN device IP address and the destination IP address being the destination IP address from the bidirectional flow table, merges all such flows into a flow group, counts the total number of traffic bytes and UDP traffic bytes of the flow group, calculates the proportion of UDP traffic bytes to the total traffic bytes of the flow group, and determines that the UDP proportion condition is met when the proportion reaches a preset proportion threshold. The preset proportion threshold is set by the deployer and can be set to 50%.

[0226] The gateway performs a fixed block mode determination on the flow group. The determination method for the fixed block mode has been disclosed in the previous embodiments. When the flow group exhibits a fixed block mode, the fixed block mode condition is met. When both the UDP percentage condition and the fixed block mode condition are met, the destination IP address is determined to be a dynamic peer IP address. The dynamic peer IP address corresponds to the peer node device that has established a peer connection with the candidate PCDN device. The IP address of the peer node device changes dynamically, and the dynamic peer IP address is not included in the packet drop list.

[0227] The tiered processing procedure involves continuously dropping packets for T1-level and T2-level destination IP addresses. The method for continuously dropping packets has been disclosed in the aforementioned embodiments. The control plane destination IP address associated with the candidate PCDN device maintains continuous packet dropping, which is performed by the action corresponding to the acknowledgment label. The continuous packet dropping performed on T1-level and T2-level destination IP addresses is consistent with the continuous packet dropping action corresponding to the acknowledgment label.

[0228] Uplink rate limiting is applied to data plane traffic corresponding to dynamic peer IP addresses. The rate limiting target is the uplink data plane traffic sent by the candidate PCDN device to the dynamic peer IP address set. The implementation of uplink rate limiting involves the gateway mounting a rate limiting program in the traffic control subsystem. This program maintains rate limiting entries indexed by destination IP address. The matching condition for a rate limiting entry is that the source IP address is the IP address of the candidate PCDN device and the destination IP address belongs to the dynamic peer IP address set. The rate limiting entries use a token bucket mechanism. The token bucket generates tokens according to the rate limiting rate. The token bucket capacity is the product of the rate limiting rate and a set time. When a packet hits a rate limiting entry, it obtains the number of tokens corresponding to the packet length from the token bucket. If there are enough tokens, the packet is forwarded; if there are insufficient tokens, the packet is discarded. The rate limiting rate is set by the deployer and can be set as a percentage of the uplink bandwidth limit of the candidate PCDN device.

[0229] Uplink rate limiting suppresses the rate at which the candidate PCDN device distributes content to peer nodes, reducing its service capability as a content distribution edge node while preserving its normal communication. Forwarding continues for whitelisted addresses and remaining destination IP addresses after inclusion. Since the remaining destination IP addresses after inclusion do not meet any criteria and their affiliation is unclear, forwarding continues for these unaffiliated destination IP addresses to avoid unnecessarily disrupting the normal operations of the candidate PCDN device.

[0230] The hierarchical classification and handling are executed after the confirmation label is generated. The classification results and handling adjustment instructions are recorded together, and the handling adjustment instructions are sent to the dynamic blocking unit for execution. The classification results of T1-level destination IP addresses, T2-level destination IP addresses, dynamic peer IP addresses, and whitelisted addresses are stored in the policy management storage, and the classification results are updated as the candidate PCDN devices are re-identified. The preset percentage threshold, rate limit rate, and token bucket capacity are all operating parameters that are set and adjusted according to the network environment.

[0231] In one or more embodiments of the present invention, the method further includes:

[0232] Persistent packet dropping is performed on the fill traffic flowing to the candidate PCDN device. The fill traffic is the traffic used by the candidate PCDN device to obtain cache fill content. The whitelist address and the maintenance forwarding of the remaining destination IP address after inclusion only apply to traffic other than the fill traffic.

[0233] During the continuous packet dropping of IP addresses on the control plane and the continuous packet dropping of fill traffic, the candidate PCDN device stops acquiring new scheduling tasks, the filling of the content cache of the candidate PCDN device stops, and the content in the content cache is continuously reduced during the transmission of data plane traffic by the candidate PCDN device and is exhausted within a finite time.

[0234] Once the content in the content cache is exhausted, the candidate PCDN device stops sending data plane traffic.

[0235] This embodiment provides a detailed description of the continuous packet dropping process for fill traffic. Fill traffic refers to the traffic used by candidate PCDN devices to obtain cached fill content. The continuous packet dropping of fill traffic is performed after the generation of acknowledgment labels, and works in conjunction with the continuous packet dropping of control plane IP addresses disclosed in the previous embodiments.

[0236] The identification of fill traffic is based on the set of fill source addresses and the packet length distribution. The gateway constructs the fill source address set by including IP addresses corresponding to resource distribution purposes of DNS-resolved domain names from the T2-level destination IP address set; IP addresses marked as PCDN content sources in the cloud feature library are also included. The determination of resource distribution purpose is based on the domain name classification information in the PCDN dedicated domain name set. Domain names carrying resource distribution purposes in the PCDN dedicated domain name set have already been marked during the T2-level destination IP address allocation stage. The fill source address set is stored in the policy management storage and updated with the re-identification of the candidate PCDN devices.

[0237] The gateway filters candidate flow for fill traffic from the bidirectional flow table. The filtering criteria for candidate flow for fill traffic are that the source IP address of the flow belongs to the set of fill source addresses and the destination IP address of the flow is the IP address of the candidate PCDN device. Flows that meet the filtering criteria are fill-direction flows, which carry fill content transmitted from the content source to the candidate PCDN device.

[0238] The gateway performs packet length distribution statistics on the fill-direction flow. The statistics are calculated by taking the packet length of all packets in the flow, and using the ratio of the length of the most frequently occurring packet to the total number of packets in the flow as the length concentration ratio. When the length concentration ratio reaches a set ratio, and the length of the most frequently occurring packet reaches a fill length threshold, the flow is identified as fill traffic. The fill length threshold can be set to 1300 bytes, and the set ratio can be set to 60%. These thresholds and ratios are adjusted according to the network environment. Fill traffic primarily consists of content block transmissions, resulting in a concentrated packet length. The control packets between the candidate PCDN device and the fill source are short, and the packet length distribution statistics distinguish fill traffic from control packets.

[0239] The continuous packet dropping of padding traffic is executed as follows: the gateway generates padding drop matching conditions, which include source IP address matching, destination IP address matching, and packet length matching. Source IP address matching means that the packet source IP address belongs to the padding source address set, destination IP address matching means that the packet destination IP address is the IP address of the candidate PCDN device, and packet length matching means that the packet length reaches the padding length threshold. Packets that match the padding drop matching conditions are dropped, while packets that do not match the padding drop matching conditions are continued to be forwarded.

[0240] The fill drop matching condition is mounted at the traffic control subsystem mounting point. The fill drop matching condition and the control plane drop matching condition disclosed in the aforementioned embodiments are effective simultaneously. The control plane drop matching condition corresponds to the uplink packets sent by the candidate PCDN device to the control plane destination IP address, and the fill drop matching condition corresponds to the fill packets sent from the fill source to the candidate PCDN device. The directions and matching fields of the two matching conditions are complementary, and the same packet will not simultaneously match both conditions. Continuous packet dropping of fill traffic is enabled after the acknowledgment label is generated and remains effective without automatic cancellation. Continuous packet dropping of fill traffic constitutes an exception to maintaining forwarding to the whitelisted addresses. When the source address of the fill traffic belongs to the whitelisted addresses, the fill traffic still undergoes continuous packet dropping.

[0241] During the continuous packet dropping of control plane IP addresses and the continuous packet dropping of fill traffic, the candidate PCDN device stops acquiring new scheduling tasks. Control plane packets are continuously dropped, and scheduling tasks cannot reach the candidate PCDN device; this mechanism has been disclosed in the foregoing embodiments. Fill traffic is continuously dropped, and fill packets sent from content sources to the candidate PCDN device cannot reach it; therefore, filling of the candidate PCDN device's content cache stops, and the content cache no longer receives new content.

[0242] The candidate PCDN device stores the corresponding content of the scheduled tasks it has acquired in a content cache. The candidate PCDN device continues to send data plane traffic to the peer node device, consuming content in the content cache with each transmission, causing the content in the cache to continuously decrease. The content cache has a limited capacity; filling stops while consumption continues, and the content in the cache is exhausted within a finite time. The exhaustion time depends on the content cache capacity and the data plane traffic transmission rate, and varies among different candidate PCDN devices.

[0243] Once the content cache is exhausted, the candidate PCDN device has no content to distribute and stops sending data plane traffic. The cessation of data plane traffic is manifested by a continuous occurrence of zero-rate sampling points in the rate sequence. The continuous packet dropping of fill traffic only applies to fill packets that match the fill drop condition; the remaining traffic between the candidate PCDN device and the gateway continues to be forwarded.

[0244] In this embodiment, the fill length threshold, the set ratio, and the composition of the fill source address set are all operating parameters, which are set and adjusted according to the network environment and publicly available information from the PCDN manufacturer.

[0245] In one or more embodiments of the present invention, after the candidate PCDN device is identified, the gateway performs the table entry and submission of the identification results. The identification results include the composite key of the candidate PCDN device, device type label, PCDN confidence score, vendor attribution, application attribution and hit evidence, control plane IP address set and generation time. The gateway writes the device type label and PCDN confidence score into the device-level behavioral profile of the candidate PCDN device, writes the composite key of the candidate PCDN device and control plane IP address set into the device attribution field of the corresponding flow entry in the bidirectional flow table, where the corresponding flow entry refers to the flow entry whose flow table key contains the IP address of the candidate PCDN device, and submits the identification results to the policy management storage.

[0246] The policy management storage preserves the identification results, destination IP address classification results, and handling adjustment instructions. The dynamic blocking unit reads the handling adjustment instructions from the policy management storage and executes them. In the aforementioned embodiments, the recording of the baseline rate, the activation of packet dropping, and the reading of the control plane destination IP address set all use the identification results as the data source. After generating a misjudgment label, the gateway updates the device type label in the device-level behavior profile to a normal device and synchronously updates the identification results stored in the policy management storage. The table entry and submission of the identification results ensure that the identification and handling processes reference the same data.

[0247] In addition to the data center attribute conditions, domain name evidence conditions, and multi-tenant labeling null conditions disclosed in the aforementioned embodiments, the T1-level matching and T2-level matching of the destination IP address also include an access percentage condition. The access percentage condition refers to the access percentage of the destination IP address among the confirmed PCDN devices reaching an access percentage threshold. The set of confirmed PCDN devices consists of candidate PCDN devices that generated confirmation labels. The statistical method is as follows: take the set of confirmed PCDN devices, count the number of devices in the set that have flows destined for the destination IP address within the observation window, divide the number of devices by the total number of devices in the set, and obtain the access percentage. The access percentage condition is met when the access percentage reaches the access percentage threshold.

[0248] When the number of devices in the confirmed PCDN device set reaches the minimum statistical count, the destination IP address is classified as a T1 or T2 level destination IP address only when the data center attribute condition, domain name evidence condition, multi-tenant labeling empty condition, and access percentage condition are all met simultaneously. If any of the above conditions are missing, the destination IP address continues to forward. When the number of devices in the confirmed PCDN device set is below the minimum statistical count, the destination IP address is classified as a T1 or T2 level destination IP address only when the data center attribute condition, domain name evidence condition, and multi-tenant labeling empty condition are all met simultaneously. T1 level destination IP addresses include the destination IP address obtained from the vendor-reported domain name resolution and the destination IP address corresponding to the PCDN dedicated control server port. The access percentage condition limits the classification of T1 and T2 level destination IP addresses to the range where multiple conditions are met simultaneously. The public DNS addresses in the whitelist address set include 119.29.29.29 and 223.5.5.5, which are maintained by the deployer based on the network environment. The access percentage threshold and minimum statistical count are set by the deployer.

[0249] The evidence graph mechanism takes a set of confirmed and candidate PCDN devices as input to generate candidate rules. The co-occurrence relationship is statistically analyzed by taking any two records from the domain name, TLS SNI, JA3 / JA4 fingerprint, and the first 64 bytes of hexadecimal content of the packet payload within the same observation window as feature pairs for the same access device's flow set. The co-occurrence count is accumulated using these feature pairs as keys. Feature pairs whose co-occurrence counts reach a co-occurrence threshold constitute a frequent co-occurrence feature group. Candidate rules are generated by combining the repeatedly occurring domain name, TLS SNI, JA3 / JA4 fingerprint, and hexadecimal prefix of the packet payload from the frequent co-occurrence feature group. Candidate rules carry suggested values ​​for application name and vendor affiliation. After confirmation by the deployer, candidate rules are written to the rule file and hot-loaded into the rule index with the local rule layer. The input to the evidence graph mechanism is updated with the identification labels. The flow set generating confirmed labels continuously expands the co-occurrence statistics, while the flow set generating misclassified labels is removed from the co-occurrence statistics. The co-occurrence threshold is set by the deployer.

[0250] In addition to matching the source IP address and destination IP address, the uplink rate limiting matching criteria also include matching the MAC address of candidate PCDN devices. Rate limiting entries are organized by MAC address index. The hit determination process involves first locating candidate PCDN devices based on the MAC address carried in the packet, then checking whether the destination IP address of the packet belongs to the dynamic peer IP address set. If the destination IP address check passes, the packet enters the token bucket for processing. When the IP address of a candidate PCDN device changes, MAC address matching ensures that the uplink rate limiting remains effective for that candidate PCDN device. Matching entries for continuously dropped packets can be aggregated by network segment of the destination IP address; destination IP addresses within the same network segment are merged into one matching entry, reducing the number of matching entries.

[0251] After re-identification is completed, the gateway performs a policy upgrade. The upgrade method is to add the newly added control plane destination IP address to the matching entry for continuous packet dropping, and add the newly added T1 level destination IP address and T2 level destination IP address to the matching entry for continuous packet dropping. The packet dropping of the newly added destination IP address and the original continuous packet dropping take effect simultaneously.

[0252] Multidimensional behavior scoring can be extended from rule-based scoring to a lightweight classification model. The training samples for the lightweight classification model are the behavior feature vectors and label types corresponding to the identified labels. Positive samples are generated from the behavior feature vectors corresponding to confirmed labels, and negative samples are generated from the behavior feature vectors corresponding to misclassified labels. The lightweight classification model adjusts its parameters based on the training samples and outputs the PCDN confidence score of the access device. The lightweight classification model is activated after the rule-based scoring has stabilized. When both the output of the lightweight classification model and the output of the rule-based scoring exist, the output with the higher confidence score is taken as the PCDN confidence score.

[0253] The three-layer identification process can be simplified to a purely local mode. In this mode, the cloud feature library query step is skipped, while protocol identification and local rule matching proceed as usual. Application attribution and hit evidence are obtained by merging the protocol identification results and rule hit evidence. Alternatively, the three-layer identification process can retain a local plus cloud mode, which follows the same process as described in the aforementioned embodiments. Device-level behavioral profiles, identification annotations, and policy management are stored in the gateway's local storage using an SQLite database. After a gateway restart, the data is loaded from the local storage, and the accumulated statistical results remain valid.

[0254] After confirming label generation and enabling continuous packet dropping, the effect feedback and attenuation observation unit continues to sample the rate sequence. The long-term observation period is set by the deployer and can be set to 24 to 48 hours. During the long-term observation period, if the data plane traffic rate continuously drops to zero, it indicates that continuous packet dropping is effective, and the handling action is maintained. During the long-term observation period, if the data plane traffic rate rebounds, it indicates that the candidate PCDN device has resumed scheduling task acquisition through a means other than the control plane IP address set, triggering a re-identification and handling policy upgrade. After continuous packet dropping takes effect, the deployer can downgrade the handling action to uplink rate limiting as needed for operation and maintenance. After downgrading, the normal communication bandwidth of the candidate PCDN device is retained. The content cache exhaustion time depends on the content cache capacity and the data plane traffic transmission rate. Typically, exhaustion is completed within 24 to 48 hours.

[0255] Example 1 uses a device connected to a home gateway as an example to illustrate the complete identification and handling process. The gateway collects and aggregates the device's traffic to obtain a device-level behavioral profile. The device-level behavioral profile shows that the uplink / downlink byte ratio is 6.2, the uplink byte count during peak hours accounts for 72% of the total uplink byte count for the day, the high-bandwidth continuous period lasts for 23 hours, the number of concurrent connections is 672, the UDP byte count accounts for 81%, the destination ports of the control plane flow are concentrated on 2 ports, the UDP data plane flow presents a pattern of 1049-byte data blocks plus 23-byte responses, the control plane flow is directly connected by IP address, the IP address of the control plane destination is marked by the cloud feature database as having data center attributes and spans 5 provinces, and the rule matching evidence matches the proprietary domain name and JA3 / JA4 fingerprint of a known PCDN vendor.

[0256] Based on the device-level behavioral profile, behavioral feature vectors are extracted and multi-dimensional behavioral scoring is performed. The comprehensive score is used as the PCDN confidence score. When the PCDN confidence score reaches a confidence threshold, the device is identified as a candidate PCDN device. A list of control plane IP addresses associated with the candidate PCDN devices is determined. The control plane IP address list includes the scheduler address, the reporting server address, and the tunnel entry address. The data plane traffic rate of the candidate PCDN devices is recorded as a baseline rate. Packet dropping is enabled for the control plane IP addresses for a preset duration. After the preset duration is reached, the packet dropping is automatically canceled.

[0257] After packet dropping is enabled, the data plane traffic rate of the candidate PCDN device remains at the baseline rate. After exceeding the preset initial observation period, it monotonically decreases, generating an acknowledgment marker. Continuous packet dropping is then performed on the IP address of the control plane destination. The destination IP addresses of the candidate PCDN devices are categorized into T1-level and T2-level destination IP addresses. Destination IP addresses matching at the T1 level are classified as T1-level destination IP addresses, and those matching at the T2 level are classified as T2-level destination IP addresses. Destination IP addresses with a UDP traffic byte ratio reaching a preset threshold and exhibiting a fixed block pattern are identified as dynamic peer IP addresses. The public DNS addresses 119.29.29.29 and 223.5.5.5 are added to the whitelist. Continuous packet dropping is performed on T1-level and T2-level destination IP addresses. Uplink rate limiting is applied to the data plane traffic corresponding to dynamic peer IP addresses, while forwarding is maintained for whitelisted addresses.

[0258] Example 2 involves a government and enterprise gateway deployment scenario. The government and enterprise gateway carries traffic from multiple access devices, with a larger traffic volume than a home gateway. Packet collection uses the DPDK engine, which bypasses the kernel protocol stack to process packets in user space. The collection rate meets the traffic volume of the government and enterprise gateway, and the processing logic for flow table maintenance and feature extraction is consistent with the aforementioned examples.

[0259] The access devices of the government and enterprise gateway include office terminals and servers. Misjudgments can significantly impact office operations. In this embodiment, packet dropping disturbances only affect the IP addresses of the control plane, and the office traffic of the access devices continues to be forwarded during the disturbance period. Packet dropping is carried out by the hardware access control list. The set of IP addresses of the control plane is sent to the hardware access control list. Packets that match the entries are directly dropped by the forwarding hardware. Automatic cancellation is performed by the gateway management plane deleting the entries corresponding to the IP addresses of the control plane from the hardware access control list when a preset time expires.

[0260] The baseline rate recording, trend observation, identification label generation, and weight parameter update follow the execution method of the aforementioned embodiments. After confirming label generation, continuous packet dropping is performed on T1-level and T2-level destination IP addresses, and uplink rate limiting is performed on data plane traffic corresponding to dynamic peer IP addresses. In the government and enterprise gateway scenario, the observation window can be set to 1 day to cover the cross-day behavior cycle of access devices. Adjusting the observation window does not affect the execution of the remaining steps.

[0261] Example 3 involves a scenario where a bypass probe and a forwarding gateway are deployed collaboratively. The bypass probe receives mirror copies of uplink and downlink packets via a mirror port, while the forwarding gateway handles packet forwarding. The bypass probe performs flow table maintenance, feature extraction, device-level behavior profiling, multi-dimensional behavior scoring, candidate PCDN device identification, IP address determination of the control plane, baseline rate recording, and trend observation. Packet dropping is handled by the forwarding gateway.

[0262] A policy channel is established between the bypass probe and the forwarding gateway. The identification results and handling adjustment instructions generated by the bypass probe are sent to the forwarding gateway through the policy channel. The enable and deactivation events for packet discarding are reported to the bypass probe through the policy channel. The bypass probe divides the sampling points during the enable period and the sampling points after deactivation in the rate sequence based on the enable and deactivation events. The policy channel message carries the composite key of the candidate PCDN device and the set of IP addresses of the control plane. The forwarding gateway locates the access device according to the composite key and executes packet discarding according to the set of IP addresses of the control plane.

[0263] The bypass probe collects data on the surface traffic rate based on mirrored packets. The content of the mirrored packets is consistent with that of the forwarded packets, and the statistical results are consistent with those of the forwarding gateway. This embodiment is applicable to scenarios where the forwarding gateway does not have identification capabilities. Data collection and identification are completed by the bypass probe, while processing is completed by the forwarding gateway.

[0264] Example 4 involves a software router deployment scenario. The software router uses a general-purpose computer platform, and the packet collection engine uses libpcap or AF_PACKET. When the software router kernel lacks eBPF capabilities, packet dropping is handled by packet filtering rules and Internet Protocol set rules. The IP address set of the control plane is written into the Internet Protocol set, and the packet filtering rules reference the Internet Protocol set to execute packet dropping. Packets that match entries in the Internet Protocol set are dropped by the packet filtering rules.

[0265] Automatic cancellation is triggered by a user-space timer upon the expiration of a preset duration, deleting the entry corresponding to the control plane IP address in the Internet Protocol set, and resuming forwarding of packets destined for the control plane IP address. Uplink rate limiting is carried out by token bucket rules, with rate limiting entries organized according to the MAC address index of the access device. The matching and processing process for rate limiting entries is consistent with the aforementioned embodiments. In the soft router scenario, the effectiveness of continuous packet dropping and uplink rate limiting does not depend on eBPF capabilities, and the generation criteria for confirmation labels, misjudgment labels, and suspicious labels are consistent with the aforementioned embodiments.

[0266] Example 5 involves a pure local mode and a lightweight classification model. When the network where the gateway is located cannot access the cloud feature library, the three-layer recognition process is trimmed to a pure local mode. The cloud feature library query step is skipped, while protocol recognition and local rule matching are performed as usual. Application affiliation and hit evidence are obtained by merging the protocol recognition result and the rule hit evidence. The determination of the IP address of the control face is performed according to the judgment method when the cloud feature library is unreachable. The behavioral dimension in the behavioral feature vector that depends on the cloud feature library takes the default value and participates in the weighted accumulation. The handling method of the default value is the same as that in the previous examples.

[0267] After the rule-based scoring system stabilizes, the multi-dimensional behavior scoring is expanded into a lightweight classification model. The lightweight classification model uses a logistic regression model. The training samples consist of identification labels. The behavior feature vectors that generate confirmation labels correspond to positive samples, and the behavior feature vectors that generate misjudgment labels correspond to negative samples. The scores obtained by mapping the values ​​of each behavior dimension in the behavior feature vectors are normalized according to the upper limit of the score. The normalized scores are input into the logistic regression model. The parameters of the logistic regression model are updated incrementally after each identification label is generated. The update process uses gradient descent, and the learning step size of gradient descent is set by the deployer.

[0268] The logistic regression model outputs the PCDN confidence score of the access device. When the output of the logistic regression model and the rule score output coexist, the higher output is taken as the PCDN confidence score. Access devices whose PCDN confidence score reaches the confidence threshold are identified as candidate PCDN devices. The subsequent disturbance, observation, labeling and handling process is the same as the aforementioned embodiment.

[0269] Example 6 involves a gateway scenario with only IP handling capabilities. When the gateway lacks DNS interception capabilities, the tiered handling only includes persistent packet dropping and uplink rate limiting. After the label is confirmed to be generated, the gateway performs persistent packet dropping on T1-level and T2-level destination IP addresses, performs uplink rate limiting on data plane traffic corresponding to dynamic peer IP addresses, performs persistent packet dropping on padding traffic, and continues forwarding to whitelisted addresses and the remaining destination IP addresses after being added.

[0270] Continuous packet dropping cuts off the control plane and filling plane. The candidate PCDN device stops acquiring new scheduling tasks, content cache filling stops, and the content in the content cache continuously decreases with the transmission of data plane traffic, eventually being exhausted within a finite time. After exhaustion, the candidate PCDN device stops transmitting data plane traffic. The effect feedback and attenuation observation unit continues to observe for a long period. A data plane traffic rate that remains at zero indicates that the treatment is effective. When the data plane traffic rate recovers, it triggers a re-identification and treatment strategy upgrade. This embodiment demonstrates that this solution can suppress the service capabilities of PCDN devices without relying on DNS interception capabilities.

[0271] This invention also provides a PCDN traffic closed-loop identification system based on gateway-side packet drop disturbance, applied to a user-side access gateway, comprising:

[0272] Traffic acquisition unit, used to collect packets flowing through the gateway;

[0273] The PCDN multidimensional behavior scoring unit is used to perform multidimensional behavior scoring on the access devices of the access gateway based on the message, obtain the PCDN confidence of the access devices, identify the access devices whose PCDN confidence reaches the confidence threshold as candidate PCDN devices, and determine the IP address of the control plane associated with the candidate PCDN devices. The multidimensional behavior score is calculated based on the weight parameters.

[0274] The effect feedback and attenuation observation unit is used to record the data plane traffic rate of the candidate PCDN device as a reference rate. The data plane traffic is the traffic of the candidate PCDN device distributing content to the peer node device.

[0275] The dynamic blocking unit is used to enable packet dropping of IP addresses in the control plane for a continuous preset duration. After the preset duration is reached, the packet dropping is automatically canceled. During the period when packet dropping is enabled, the data plane traffic of the candidate PCDN device is maintained and forwarded.

[0276] The effect feedback and attenuation observation unit is also used to observe the change trend of the data plane flow rate relative to the reference rate during the message dropping activation period and after the cancellation. Based on the change trend, it outputs the handling adjustment command to the dynamic blocking unit, generates identification labels based on the change trend, and writes the identification labels back to update the weight parameters of the PCDN multidimensional behavior scoring unit.

[0277] Compared to existing technologies, this solution limits packet dropping to a preset duration and automatically cancels it after the preset duration. During the packet dropping period, the data plane traffic of the candidate PCDN device continues to be forwarded, making the handling action a verification process for the identification results. Packet dropping only affects the IP address of the control plane destination on which the candidate PCDN device obtains the scheduling task. The data plane traffic of the device distributing content to the peer node device and the normal service traffic in the network where the device is located continue to be forwarded during the verification period, and the impact of the handling process on normal services is controlled.

[0278] The above verification process is implemented based on the device's task caching mechanism. When the candidate PCDN device is indeed a PCDN device, a control plane interruption stops the injection of new scheduled tasks. The device continues to serve the peer node device with existing content in its content cache. Its data plane traffic rate initially maintains the baseline rate, then decreases as the content in the cache decreases. Based on this trend, the identification result is confirmed and the handling is adjusted. When a candidate PCDN device is misjudged, the candidate PCDN device has no content cache to serve. The data plane traffic rate of the candidate PCDN device drops to zero after packet dropping is enabled. Based on this trend, the handling is revoked, and communication between the candidate PCDN device and normal services is restored. By judging the identification result based on the actual response of the device during the handling process, misjudgments can be detected and reversed, and the identification accuracy improves as the handling process progresses.

[0279] Multidimensional behavior scoring is calculated based on weight parameters. The observed trends are generated into identification labels and written back to update the weight parameters. The handling results are continuously transformed into scoring parameters. The scoring parameters are calibrated according to changes in the network environment and device behavior. Identification and handling form a feedback loop. The handling effect is measurable and the handling can be adjusted according to the actual behavior of the device.

[0280] The above provides a detailed description of the PCDN traffic closed-loop identification method and system based on gateway-side packet dropping disturbance. Specific examples are used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A PCDN traffic closed-loop identification method, applied to a user-side access gateway, characterized in that, The method includes: Collect packets flowing through the gateway; Based on the message, the access devices connected to the gateway are scored in multiple dimensions to obtain the PCDN confidence score of the access devices. Access devices whose PCDN confidence scores reach the confidence threshold are identified as candidate PCDN devices, and the IP address of the control plane associated with the candidate PCDN device is determined. The multidimensional behavior score is calculated based on weight parameters. Record the data plane traffic rate of the candidate PCDN device as a reference rate. The data plane traffic is the traffic of the candidate PCDN device distributing content to the peer node device. Packet dropping is enabled for a preset duration for the IP address of the control plane destination. After the preset duration is reached, the packet dropping is automatically canceled. During the period when packet dropping is enabled, the data plane traffic of the candidate PCDN device is continued to be forwarded. Observe the trend of the data plane traffic rate relative to the baseline rate during and after the packet drop is enabled and revoked; The handling of the IP address of the control surface is adjusted according to the changing trend, and an identification label is generated according to the changing trend. The identification label is then written back to update the weight parameters of the multidimensional behavior score.

2. The method according to claim 1, characterized in that, The process of collecting packets flowing through the gateway includes: capturing uplink and downlink packets in promiscuous mode at the gateway's WAN and LAN ports; classifying the captured packets into a bidirectional flow table according to five-tuples; extracting flow statistical features, protocol features, and content features from the flows in the bidirectional flow table; the protocol features and content features include nDPI protocol identification results, DNS query domain names, TLS SNI, JA3 / JA4 fingerprints, HTTP Host field, URL field, User Agent (UA) field, DHCP hostname, and the first 64 bytes of hexadecimal content of the packet payload; the five-tuple consists of source IP address, destination IP address, source port, destination port, and transport layer protocol.

3. The method according to claim 2, characterized in that, The multi-dimensional behavioral scoring of the access device connected to the gateway based on the message includes: The MAC address and IP address of the access device are extracted from the header of the access-side packets in the stream to form the composite key of the stream; Within a preset observation window, flows with the same composite bond are grouped into a flow set; The flow set is statistically analyzed, and the flow statistical features, protocol features, and content features of each flow in the flow set are aggregated into the flow statistical features, protocol features, and content features of the access device, forming a device-level behavioral profile of the access device; A preset number of behavioral dimension values ​​are extracted from the device-level behavioral profile to form the behavioral feature vector of the access device; The multidimensional behavior score is performed based on the behavioral feature vector.

4. The method according to claim 3, characterized in that, Before performing the multidimensional behavioral scoring, the following is also included: The protocol identification result is obtained by taking the protocol features and content features corresponding to the streams in the stream set as the protocol identification result; The domain name, TLS SNI, JA3 / JA4 fingerprint, and hexadecimal content of the first 64 bytes of the packet payload of the streams in the stream set are matched with the rules of the local rule layer. The matched rules are used as evidence of rule hit. The local rule layer supports hot reloading. Based on the terminal model of the access device, the OUI of the MAC address and the public IP address, the cloud feature database is queried to obtain cloud feature database hit evidence. The cloud feature database hit evidence includes the application affiliation, manufacturer affiliation and public IP affiliation of the access device. The protocol identification result, the rule hit evidence, and the cloud feature library hit evidence are combined into application attribution and hit evidence.

5. The method according to claim 4, characterized in that, The multidimensional behavioral score includes: The behavioral dimension is at least two of the following dimensions in the device-level behavioral profile: uplink / downlink byte ratio, total uplink volume, peak concentration, long duration, concurrent connections, UDP byte ratio, port concentration, fixed block mode, domain name binding ratio, and destination IP nature. The application attribution and hit evidence are added as an additional behavioral dimension to the behavioral feature vector. The additional behavioral dimension includes a vendor label dimension, and the value of the vendor label dimension is taken from the vendor attribution in the application attribution and hit evidence. Set weight parameters for each behavioral dimension in the behavioral feature vector; The values ​​of each behavioral dimension in the behavioral feature vector are mapped to scores for each behavioral dimension according to the score range; The scores of each behavioral dimension are weighted and summed according to the weight parameters to obtain a comprehensive score; the comprehensive score is used as the confidence level of the PCDN.

6. The method according to claim 1, characterized in that, The observation of the data plane traffic rate relative to the baseline rate during and after the packet dropping is enabled includes: The data plane traffic rate of the candidate PCDN device is continuously sampled to obtain a rate sequence, which includes the data plane traffic rate of the candidate PCDN device during the packet drop enable period and after its revocation. Each rate value in the rate sequence is compared point by point with the reference rate to obtain the comparison result; The trend of the rate sequence is determined based on the comparison results, and the trend is taken as the change trend.

7. The method according to claim 6, characterized in that, The process of adjusting the handling of the IP address of the control surface based on the changing trend, generating identification labels based on the changing trend, and writing back the identification labels to update the weight parameters of the multi-dimensional behavior score includes: When the trend is that the data plane traffic rate remains at the baseline rate after the packet dropping is enabled, and the duration of the maintenance exceeds the preset initial observation duration, and then decreases monotonically, an acknowledgment label is generated. Based on the acknowledgment label, the weight parameters of the multi-dimensional behavior score are increased, and continuous packet dropping is performed on the IP address of the control plane destination. When the trend of change is such that the data plane traffic rate drops to zero within a preset initial observation period after the packet dropping is enabled, a misjudgment label is generated, and the weight parameters of the multidimensional behavior score are reduced based on the misjudgment label, and forwarding is maintained for the IP address of the control plane destination. When the trend of change is the other trend, a question mark is generated, the weight parameters of the multidimensional behavior score are maintained according to the question mark, the IP address of the control face is continued to be forwarded, and the candidate PCDN device is triggered to re-identify.

8. The method according to claim 7, characterized in that, After the confirmation label is generated, the following is also included: Persistent packet dropping is performed on the control plane destination IP address among the destination IP addresses of the candidate PCDN devices, and hierarchical classification is performed on the remaining destination IP addresses of the candidate PCDN devices; Add the destination IP addresses that match the whitelist address from the remaining destination IP addresses to the whitelist address; Add the destination IP addresses that match the T1 level from the destination IP addresses that are not included in the whitelist to the T1 level destination IP address; The destination IP address that matches the T2 level among the destination IP addresses that are not included in the whitelist and the T1 level destination IP address is included in the T2 level destination IP address; Among the remaining destination IP addresses after allocation, the destination IP addresses whose corresponding flow is between the candidate PCDN device and the destination IP address, whose UDP traffic bytes in the corresponding flow account for a preset percentage threshold of the total traffic bytes between the candidate PCDN device and the destination IP address, and whose packet length in the corresponding flow presents a fixed block mode, are determined to be dynamic peer IP addresses. Persistent packet dropping is performed on the T1-level destination IP address and the T2-level destination IP address; uplink rate limiting is performed on the data plane traffic corresponding to the dynamic peer IP address; forwarding is maintained for the whitelisted addresses; and forwarding is maintained for the remaining destination IP addresses after the inclusion.

9. The method according to claim 8, characterized in that, The method further includes: Persistent packet dropping is performed on the fill traffic flowing to the candidate PCDN device. The fill traffic is the traffic used by the candidate PCDN device to obtain cache fill content. The whitelist address and the maintenance forwarding of the remaining destination IP address after inclusion only apply to traffic other than the fill traffic. During the continuous packet dropping of the IP address of the control plane destination and the continuous packet dropping of the filling traffic, the candidate PCDN device stops acquiring new scheduling tasks, the filling of the content cache of the candidate PCDN device stops, and the content in the content cache is continuously reduced during the process of the candidate PCDN device sending the data plane traffic and is exhausted within a limited time. Once the content in the content cache is exhausted, the candidate PCDN device stops sending the data plane traffic.

10. A PCDN traffic closed-loop identification system, applied to a user-side access gateway, characterized in that, The system includes: A traffic acquisition unit is used to collect packets flowing through the gateway; The PCDN multidimensional behavior scoring unit is used to perform multidimensional behavior scoring on the access devices accessing the gateway based on the message, obtain the PCDN confidence level of the access devices, identify access devices whose PCDN confidence level reaches the confidence threshold as candidate PCDN devices, and determine the IP address of the control plane associated with the candidate PCDN devices. The multidimensional behavior score is calculated based on weight parameters. The effect feedback and attenuation observation unit is used to record the data plane traffic rate of the candidate PCDN device as a reference rate. The data plane traffic is the traffic of the candidate PCDN device distributing content to the peer node device. The dynamic blocking unit is used to enable packet dropping for a preset duration on the IP address of the control plane destination, and automatically cancel the packet dropping after the preset duration is reached. During the period when the packet dropping is enabled, the data plane traffic of the candidate PCDN device is maintained for forwarding. The effect feedback and attenuation observation unit is also used to observe the change trend of the data plane traffic rate relative to the baseline rate during the packet dropping activation period and after its cancellation, output the handling adjustment instruction to the dynamic blocking unit according to the change trend, generate identification labels according to the change trend, and write back the identification labels to update the weight parameters of the PCDN multidimensional behavior scoring unit.

Images