Data processing method and device, and related products

Abstract

This disclosure provides a data processing method, apparatus, and related products. The method includes: acquiring communication behavior data, subscription policy data, and first rule data; constructing a first type of user characteristics based on the subscription policy data and the first rule data, and constructing a second type of user characteristics based on the communication behavior data and the first rule data; identifying the user type of the first user request based on the first type of user characteristics, the second type of user characteristics, the acquired subscription policy data corresponding to the first user request, and the communication behavior data; if the target user type is a private network user, identifying the user behavior of the first user request based on the communication behavior data and the first type of user characteristics; if the target user type is a private network user and the target behavior identification result indicates that the user behavior is related to the private network, then determining the first user request as target traffic data. Through this disclosure, traffic data can be accurately segmented to obtain target traffic data related to the private network.

Description

Technical Field

[0001] This document relates to the field of communication technology, and in particular to a data processing method, apparatus, and related products. Background Technology

[0002] A dual-domain network is a converged network that simultaneously includes a public internet domain and a private intranet domain. Hereinafter, the private intranet domain will be referred to as the private network, and the public internet domain as the public network. In a dual-domain network, user terminals can access either the private network or the public network as needed, and perform specific business activities through the accessed domain. For example, a user terminal accessing the private network can perform private network business activities, or it can perform other business activities unrelated to the private network.

[0003] In related technologies, various types of traffic data generated by user terminals accessing different network domains and performing different business activities are stored together. In some scenarios, there may be a need to split traffic data related to private networks. Therefore, how to accurately split traffic data to obtain target traffic data related to private networks has become an urgent technical problem to be solved. Summary of the Invention

[0004] This disclosure provides a data processing method, apparatus, and related products that can accurately split traffic data to obtain target traffic data related to a private network.

[0005] In a first aspect, embodiments of this disclosure provide a data processing method, including: The system acquires communication behavior data, subscription policy data, and first rule data for each user; the subscription policy data represents the subscription information configured by the user related to network access permissions; and the first rule data represents the traffic splitting rules for processing user requests from each user. Based on the contract signing strategy data and the first rule data, a first type of user characteristics corresponding to private network users are constructed, and based on the communication behavior data and the first rule data, a second type of user characteristics corresponding to non-private network users are constructed. The subscription policy data and communication behavior data corresponding to the first user request are obtained, and the user type of the first user request is identified based on the first type of user characteristics, the second type of user characteristics, the subscription policy data and communication behavior data corresponding to the first user request, to obtain the target user type; the target user type is one of the private network user and the non-private network user. If the target user type is the private network user, then based on the communication behavior data corresponding to the first user request and the characteristics of the first type of user, the user behavior of the first user request is identified to obtain the target behavior identification result; the target behavior identification result is used to indicate whether the user behavior of the first user request is related to the private network. If the target user type is the private network user and the target behavior identification result indicates that the user behavior requested by the first user is related to the private network, then the first user request is determined as target traffic data.

[0006] In a second aspect, embodiments of this disclosure provide a data processing apparatus, including: The data acquisition unit is used to acquire communication behavior data, subscription policy data, and first rule data of each user; the subscription policy data is used to represent the subscription information configured by the user related to network access permissions; the first rule data is used to represent the traffic splitting rules for traffic splitting of user requests of each user. The feature construction unit is used to construct a first type of user features corresponding to private network users based on the subscription policy data and the first rule data, and to construct a second type of user features corresponding to non-private network users based on the communication behavior data and the first rule data. The first identification unit is used to acquire the subscription policy data and the communication behavior data corresponding to the first user request, and to identify the user type of the first user request based on the first type of user characteristics, the second type of user characteristics, the subscription policy data and the communication behavior data corresponding to the first user request, to obtain the target user type; the target user type is one of the private network user and the non-private network user. The second identification unit is configured to, if the target user type is the private network user, identify the user behavior of the first user request based on the communication behavior data corresponding to the first user request and the characteristics of the first type of user, and obtain a target behavior identification result; the target behavior identification result is used to indicate whether the user behavior of the first user request is related to the private network. The data determination unit is configured to determine the first user request as target traffic data if the target user type is the private network user and the target behavior identification result indicates that the user behavior requested by the first user is related to the private network.

[0007] Thirdly, embodiments of this disclosure provide an electronic device, including: a memory and a processor, wherein the memory stores computer-executable instructions, which, when executed on the processor, can implement the method described in the first aspect above.

[0008] Fourthly, embodiments of this disclosure provide a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, can implement the method described in the first aspect above.

[0009] Fifthly, embodiments of this disclosure provide a computer program product, the computer program product including a computer program, which, when executed by a processor, implements the method described in the first aspect above.

[0010] In one or more embodiments of this disclosure, firstly, communication behavior data, subscription policy data, and first rule data of each user are acquired; the subscription policy data represents the subscription information configured by the user related to network access permissions; the first rule data represents the traffic splitting rules for processing user requests from each user; secondly, based on the subscription policy data and the first rule data, a first type of user characteristics corresponding to private network users are constructed, and based on the communication behavior data and the first rule data, a second type of user characteristics corresponding to non-private network users are constructed; then, the subscription policy data and communication behavior data corresponding to the first user request are acquired, and based on the first type of user characteristics, the second type of user characteristics, and the first user request... The system uses the subscription policy data and communication behavior data corresponding to the user request to identify the user type of the first user request, thus obtaining the target user type. The target user type is either a private network user or a non-private network user. Next, if the target user type is a private network user, the system identifies the user behavior of the first user request based on the communication behavior data and the characteristics of the first type of user, thus obtaining the target behavior identification result. The target behavior identification result is used to indicate whether the user behavior of the first user request is related to the private network. Finally, if the target user type is a private network user and the target behavior identification result indicates that the user behavior of the first user request is related to the private network, then the first user request is determined as the target traffic data. As can be seen, through this embodiment, on the one hand, by using communication behavior data and first rule data to construct the first type of user characteristics corresponding to private network users, and by using subscription policy data and first rule data to construct the second type of user characteristics for non-private network users, data support can be provided for identifying private network users and non-private network users in subsequent steps; on the other hand, for any first user request obtained, its user type is first identified, and then its user behavior is identified when the target user type is determined to be a private network user. This can constrain the first user request from both user type and user behavior dimensions, accurately identify whether the first user request is target traffic data related to the private network, and achieve accurate segmentation of traffic data. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in one or more embodiments of this disclosure, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 A flowchart illustrating a data processing method provided in an embodiment of this disclosure; Figure 2 This is a partial flowchart illustrating a data processing method according to an embodiment of the present disclosure; Figure 3 This is a second partial flowchart illustrating a data processing method provided in an embodiment of the present disclosure; Figure 4 This is a third partial flowchart illustrating a data processing method provided in an embodiment of the present disclosure; Figure 5 This is a fourth partial flowchart illustrating a data processing method provided in an embodiment of the present disclosure; Figure 6 A fifth partial flowchart illustrating a data processing method provided in an embodiment of this disclosure; Figure 7 A sixth partial flowchart illustrating a data processing method provided in an embodiment of this disclosure; Figure 8 This is a schematic diagram of an application interface for a data processing method provided in an embodiment of the present disclosure; Figure 9 A flowchart illustrating another data processing method provided in an embodiment of this disclosure; Figure 10 A partial flowchart illustrating another data processing method provided in this disclosure embodiment; Figure 11 Another partial flowchart illustrating another data processing method provided in an embodiment of this disclosure; Figure 12 This is a schematic diagram of the structure of a data processing apparatus provided in an embodiment of the present disclosure; Figure 13 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0013] To enable those skilled in the art to better understand the technical solutions in one or more embodiments of this disclosure, the technical solutions in one or more embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of the embodiments. Based on one or more embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of this document.

[0014] It should be understood that the training and prediction processes of the AI ​​models involved in the various embodiments of this specification all adhere to multiple legal and compliant principles, including legal data sources, compliant data content, compliant data governance, compliant training objectives and schemes, compliant training processes, compliant training environments and tools, and compliant ethical verification of training results, and comply with the requirements of Article 5 of the Patent Law. Among them: Data source legitimacy: All datasets used for AI model training were obtained through legal means, covering three categories: publicly authorized data, data authorized by partners, and self-collected compliant data. Publicly authorized data comes from compliant data sources following open-source licenses such as Apache 2.0, with complete copyright attribution and authorization scope clearly marked, and no unauthorized open-source code or data reuse. Data authorized by partners has been subject to formal data usage agreements, clearly defining the scope, duration, and confidentiality obligations, and possessing a complete authorization chain. For self-collected data involving personal information, strict informed consent procedures have been followed, and anonymization processes (including but not limited to field masking, feature anonymization, and differential privacy technology applications) have been implemented to remove personally identifiable information, fully complying with the requirements of relevant laws and regulations such as the "Interim Measures for the Administration of Generative Artificial Intelligence Services" and the "Personal Information Protection Law."

[0015] Data content compliance: The AI ​​model's dataset undergoes multiple screenings and cleaning processes to remove all content that may violate social morality or harm public interests, and to ensure that it does not involve the illegal acquisition or use of genetic resources. For data in sensitive fields (such as healthcare and finance), an additional privacy-preserving computation module (including federated learning and secure multi-party computation technologies) is used to ensure that the data is "usable but not visible," avoiding compliance risks during the original data transmission process and ensuring that the data application scenarios and uses comply with public order and good morals and industry regulatory requirements.

[0016] Data governance norms: A complete data traceability system is established during the AI ​​model training process to automatically record the source, collection time, annotation process, cleaning rules, and permission allocation of training data, generating traceable compliance reports to ensure that the data is verifiable throughout its entire lifecycle. The dataset annotation process for AI models is completed by a professional human R&D team, clearly defining the proportion of human creative contributions and avoiding reliance on AI-generated data that has not undergone substantial human modification, thus meeting the examination requirements for "human main contributions" in AI patent applications.

[0017] Training process compliance: A closed-loop training framework is adopted to ensure compliance and controllability of the training process. The specific process is as follows: First, training samples are obtained through compliant data sources. After the aforementioned data cleaning and desensitization, they are input into the neural network model to generate preliminary training results. Second, an expert system is introduced to verify the preliminary results. Based on preset rules and human expert experience, the feasibility of the results is evaluated, and outputs that may pose ethical risks or compliance hazards are corrected (such as removing decision-making logic that violates public order and good morals, and adjusting model parameters that do not comply with safety regulations). Finally, the loss function weights are dynamically optimized based on expert system feedback to strengthen the model's learning of compliant results, avoid overfitting errors or non-compliant labels, and form a closed-loop control of "data input - model training - expert verification - parameter optimization - result feedback" to ensure that the entire training process complies with A5 ethical review requirements.

[0018] Training environment and tool compliance: AI model training is implemented using nationally licensed chips and a compliant training platform. All open-source frameworks and components used in the training process have obtained their corresponding licenses, and copyright statements and patent citation information are fully retained, with no instances of infringement or reuse. The training environment is built using virtual devices (containers / virtual machines) with fixed random seeds and initial parameter configurations to ensure the reproducibility of the training process. Furthermore, through access control and operation log recording, risks such as data leakage and parameter tampering during training are prevented, ensuring the security and compliance of the training process.

[0019] Training results ethical verification compliance: After the model is trained, it undergoes additional third-party ethical compliance assessment and algorithm filing review to verify that the model output does not violate social morality or harm public interests. For potentially sensitive scenarios (such as public services and intelligent decision-making), a special result verification mechanism is established to ensure that the model always complies with Article 5 of the Patent Law and relevant laws and regulations in practical applications.

[0020] To facilitate understanding of this manual, the following section uses a 5G (5th Generation Mobile Communication Technology) communication network framework as an example to provide a brief explanation of some network elements and interfaces: The 5G communication network framework comprises a 5G core network and a 5G access network. The 5G core network includes: SMF (Session Management Function) network elements, UPF (User Plane Function) network elements, and PCF (Policy Control Function) network elements. The 5G access network includes 5G base stations. 5G base stations and UPF network elements are connected via the N3 interface, while SMF network elements and PCF network elements are connected via the N7 interface.

[0021] The UPF network element stores the ULCL RULE (Uplink Classifier rule), which is a set of detection and forwarding instructions formulated by the SMF network element and issued to the UPF network element for the purpose of offloading user plane data.

[0022] The N3 interface data can be obtained through the aforementioned 5G communication network. This N3 interface data refers to the user plane data transmitted between the 5G base station and the UPF network element via the N3 interface.

[0023] The N7 interface data can be obtained through the aforementioned 5G communication network. The N7 interface data refers to the control plane signaling data transmitted between the SMF network element and the PCF network element through the N7 interface.

[0024] The above description uses the 5G communication network framework as an example to illustrate several network elements, interfaces and related communication data related to this specification. Other communication network frameworks can refer to the corresponding description of the 5G communication network framework.

[0025] In addition, dual-domain networks include DNNs (Dual-Domain Networks). Several user types will be illustrated using DNNs as an example.

[0026]

[0027] The various user types mentioned above are for the purpose of understanding the examples provided in this manual. In practical applications, different user types can be flexibly set according to specific scenarios.

[0028] Figure 1 This is a flowchart illustrating a data processing method provided in an embodiment of the present disclosure.

[0029] The data processing method provided in this disclosure can be applied to servers or other electronic devices. The following description uses a server as the executing entity for the data processing method; other electronic devices are similar to servers and will not be repeated here.

[0030] Step S102: Obtain communication behavior data, subscription policy data, and first rule data for each user; the subscription policy data is used to represent the subscription information configured by the user related to network access permissions; the first rule data is used to represent the traffic splitting rules for processing user requests from each user.

[0031] Step S104: Based on the contract strategy data and the first rule data, construct the first type of user characteristics corresponding to private network users, and based on the communication behavior data and the first rule data, construct the second type of user characteristics corresponding to non-private network users.

[0032] Step S106: Obtain the subscription policy data and communication behavior data corresponding to the first user request, and identify the user type of the first user request based on the characteristics of the first type of user, the characteristics of the second type of user, the subscription policy data and communication behavior data corresponding to the first user request, to obtain the target user type; the target user type is either a private network user or a non-private network user.

[0033] Step S108: If the target user type is a private network user, then the user behavior of the first user request is identified based on the communication behavior data corresponding to the first user request and the characteristics of the first type of user, and the target behavior identification result is obtained; the target behavior identification result is used to indicate whether the user behavior of the first user request is related to the private network.

[0034] Step S110: If the target user type is a private network user and the target behavior identification result indicates that the user behavior requested by the first user is related to the private network, then the first user request is identified as the target traffic data.

[0035] Through this embodiment, on the one hand, communication behavior data and first rule data are used to construct the first type of user characteristics corresponding to private network users, and subscription policy data and first rule data are used to construct the second type of user characteristics for non-private network users, which can provide data support for identifying private network users and non-private network users in subsequent steps; on the other hand, for any first user request obtained, its user type is first identified, and then its user behavior is identified when the target user type is determined to be a private network user. It can be constrained by both user type and user behavior dimensions to accurately identify whether the first user request is target traffic data related to the private network, thereby achieving accurate segmentation of traffic data.

[0036] In step S102 above, communication behavior data, subscription strategy data, and first rule data of each user are obtained.

[0037] The communication behavior data can be data generated during signaling interaction or data transmission between the user terminal and the communication network, used to describe communication behavior. For example, communication behavior data includes N3 interface data. Subscription policy data represents subscription information configured by the user related to network access permissions. For example, subscription policy data includes N7 interface data. First rule data represents the traffic splitting rules for processing user requests from various users. First rule data can be generated after each user triggers traffic splitting. For example, first rule data includes uplink classification rules stored in the UPF network element, which are sent to the UPF network element after a user request actually triggers traffic splitting.

[0038] Before acquiring communication behavior data for each user, a first field can be configured for that data. Similarly, before acquiring subscription policy data for each user, a second field can be configured for that data.

[0039] Figure 2 This is a partial flowchart illustrating a data processing method provided in an embodiment of this disclosure. Figure 2 As shown, the raw communication data 201 is obtained, which includes N3 interface data and N7 interface data.

[0040] User plane filtering is performed on the original communication data 201 to obtain communication behavior data 203. This can be achieved by filtering the N3 interface data in the original communication data 201 through a pre-configured first field to obtain simplified N3 data, and then determining the simplified N3 data as communication behavior data 203.

[0041] The original communication data 201 is filtered by the signaling plane to obtain the subscription strategy data 202. This can be done by filtering the N7 interface data in the original communication data 201 through a pre-configured second field to obtain simplified N7 data, and then determining the simplified N7 data as the subscription strategy data 202.

[0042] The aforementioned raw communication data 201 can be collected from the 5G DNN network. For example, using the core algorithm of "protocol layered filtering," feature data required for 5G DNN identification is extracted from the raw communication data 201, and the extracted feature data is identified as communication behavior data 203 or subscription strategy data 202. Specifically, signaling plane filtering is performed to accurately retain fields such as mobile phone number, DNN, tracking area, and timestamp, providing support for the identification of dedicated DNN subscribed users and dedicated DNN non-subscribed users; user plane filtering is performed, filtering is performed according to application layer protocols, and core information such as mobile phone number and domain name is extracted to adapt to the general DNN subscribed user identification requirements. By simplifying redundant data, a data source with high relevance and scenario adaptability is finally constructed.

[0043] like Figure 2 The partial process shown can be configured to implement some of the technical features of step S102 in the embodiments of this disclosure. Specifically, obtaining communication behavior data and subscription policy data of each user may include: obtaining the original communication data of each user; filtering the original communication data through a pre-configured first field to obtain communication behavior data; and filtering the original communication data through a pre-configured second field to obtain subscription policy data.

[0044] In one example, multiple application layer protocols are predefined, and a corresponding first field can be set for each application layer protocol. These multiple application layer protocols include, but are not limited to, HTTP (Hypertext Transfer Protocol), HTTPS (Hypertext Transfer Protocol Secure), DNS (Domain Name System), and GEN (General). The first field corresponding to each application layer protocol can be the same or different.

[0045] For example, the first field set for the HTTPS protocol includes: date, mobile phone number, IPv4 (Internet Protocol version 4) address of the accessing server, IPv6 (Internet Protocol version 6) address of the accessing server, SNI (Server Name Indication), and TAC (Tracking Area Code).

[0046] The first field for DNS protocol settings includes: date, mobile number, tracking zone, DNS domain name, IPv4 address of the access server, and IPv6 address of the access server.

[0047] The original communication data of each user includes N3 interface data. The communication behavior data is obtained by filtering the N3 interface data through the first fields mentioned above.

[0048] The first fields listed above are merely examples and do not constitute a limitation on the embodiments of this disclosure. In actual applications, the first fields can be set as needed in combination with specific scenarios.

[0049] In another example, the second field includes, but is not limited to: date, DNN (Data Network Name), TAC, and mobile phone number. The DNN name uniquely identifies the corresponding target data network, informing the core network of the type of service it needs to access, such as public network, private network, or IoT service.

[0050] The original communication data of each user includes N7 interface data. The subscription policy data is obtained by filtering the N7 interface data through the aforementioned second fields.

[0051] The various second fields listed above are merely examples and do not constitute a limitation on the embodiments of this disclosure. In practical applications, the second fields can be set as needed in combination with specific scenarios.

[0052] Figure 3 This is a second partial flowchart illustrating a data processing method provided in an embodiment of this disclosure. For example... Figure 3 As shown, heterogeneous uplink classification rule data 301 is obtained. This data is collected from multiple UPF network elements. Due to the different specifications of UPF from various manufacturers, the uplink classification rules output by each UPF network element may differ in configuration fields and data packet formats. Therefore, the original collected data corresponding to each UPF network element is heterogeneous data.

[0053] Data access is performed on the heterogeneous data 301 of the uplink classification rules, and after format normalization, the uplink classification rules 302 under the preset format are obtained.

[0054] Under the default format, the uplink classification rule 302 includes, but is not limited to, the following fields: customer name, customer type, DNN name, traffic splitting IP group, traffic splitting URL (Uniform Resource Locator), customer-side DNS address, and non-contracted customer TAC range.

[0055] For example, the uplink classification rule heterogeneous data 301 of multiple UPFs is obtained by connecting to the core network workbench. The format of the uplink classification rule heterogeneous data 301 is converted to obtain the uplink classification rule 302 in the preset format and stored in the database for subsequent identification.

[0056] like Figure 3 The illustrated partial process can be configured to implement some of the technical features of step S102 in the embodiments of this disclosure. Specifically, obtaining the first rule data for each user may include: collecting raw network element rule data from multiple UPF network elements respectively; summarizing and aggregating the raw network element rule data to obtain heterogeneous rule data; and performing format normalization conversion on the heterogeneous rule data to obtain the first rule data.

[0057] For example, the aforementioned raw network element rule data can be the raw data collected from the uplink classification rules obtained from each UPF network element.

[0058] In some embodiments, the collected data can also be standardized through a preset standardized process to improve the data processing efficiency of subsequent steps. The following section combines... Figures 4-7 The standardized process for communication behavior data, contract strategy data, and first rule data is illustrated by example.

[0059] Figure 4 This is a third partial flowchart illustrating a data processing method provided in an embodiment of this disclosure. For example... Figure 4 As shown, N7 simplified data 401 is acquired and the corresponding N7 data standardization process is executed, outputting N7 data under the preset standard, and the N7 data under the preset standard is determined as contract strategy data; N3 simplified data 402 is acquired and the corresponding N3 data standardization process is executed, outputting N3 data under the preset standard, and the N3 data under the preset standard is determined as communication behavior data; uplink classification rule data 403 is acquired and the corresponding uplink classification rule data standardization process is executed, outputting uplink classification rule data under the preset standard, and the uplink classification rule data under the preset standard is determined as first rule data.

[0060] Figure 5 This is a fourth partial flowchart illustrating a data processing method provided in an embodiment of this disclosure. Figure 5 An example is shown of an N7 data standardization process corresponding to N7 simplified data 401, which includes steps S502-S506.

[0061] Step S502, DNN field cleaning.

[0062] Remove fields from N7 simplified data 401 that are not necessary for subsequent steps, such as MNC000 / mcc460 / gprs, etc.

[0063] Step S504, key field filtering.

[0064] The cleaned DNN fields are whitelisted based on a preset third field, retaining only data whose DNN field values ​​contain the third field. For example, the third field can include "multidomain" and "bj".

[0065] Step S506, standardize the output.

[0066] The irregularly cased DNN names are standardized into a uniform lowercase format, and after deduplication along with the number, TAC, and time, they are output uniformly for subsequent recognition.

[0067] Figure 6This is a fifth partial flowchart illustrating a data processing method provided in an embodiment of this disclosure. Figure 6 An example is shown of an N3 data standardization process corresponding to N3 simplified data 402, which includes steps S602-S608.

[0068] Step S602: Multi-protocol data fusion.

[0069] N3 Simplified Data 402 includes data related to multiple application layer protocols. These protocols include, but are not limited to, HTTP, HTTPS, and DNS (Domain Name System).

[0070] Multi-protocol data fusion involves associating and merging data corresponding to various application layer protocols within the N3 simplified data 402 to generate the first fused data. The first fused data may contain the following fields: date, mobile phone number, DNS address, DNS domain name, server IP, URL, and TAC.

[0071] Step S604, domain name merging.

[0072] Using regular expressions, the parent domain name is extracted from the domain name resolved by the DNS protocol, the URL of the HTTP protocol, and the URL in the SNI of HTTPS; based on the parent domain name, the first fused data is fused to obtain the second fused data.

[0073] Step S606, IP address translation.

[0074] The server IPs in each application layer protocol of the second fused data are aggregated by network segment.

[0075] Step S608, standardize the output.

[0076] The second fused data, after aggregation processing, is organized into a unified format and output externally.

[0077] Figure 7 This is a sixth partial flowchart illustrating a data processing method provided in an embodiment of this disclosure. Figure 7 An example is shown of an upward classification rule data standardization process corresponding to the upward classification rule data 403, which includes steps S702-S706.

[0078] Step S702, domain name merging.

[0079] Using regular expressions, the parent domain name is extracted from the domain names resolved by the DNS protocol, the URLs of the HTTP protocol, and the URLs in the SNI of the HTTPS protocol included in the uplink classification rule data 403; based on the parent domain name, the domain name is merged into the uplink classification rule data 403 to obtain the third merged data.

[0080] Step S702, IP address translation.

[0081] According to the preset fusion simplification rules, independent IPs in the same network segment in the third fusion data are aggregated.

[0082] Step S706, standardize the output.

[0083] The third-party fused data, after aggregation processing, is organized into a unified format and output externally.

[0084] Referring to the above Figures 4-7 The corresponding explanation is that obtaining the communication behavior data, subscription policy data, and first rule data of each user can be done as follows: obtaining the initial communication behavior data of each user and performing standardization processing to obtain the communication behavior data; obtaining the initial subscription policy data of each user and performing standardization processing to obtain the subscription policy data; obtaining the initial network element rule data of each user and performing standardization processing to obtain the first rule data.

[0085] The initial communication behavior data can refer to the simplified N3 data 402 mentioned above, the initial subscription strategy data can refer to the simplified N7 data 401 mentioned above, and the initial network element rule data can refer to the uplink classification rule data 403 mentioned above.

[0086] The initial communication behavior data of each user is obtained and standardized to produce communication behavior data. This can be achieved by: associating and merging the data corresponding to each application layer protocol in the initial communication behavior data to generate first fused data; extracting the parent domain name from the URL information of each application layer protocol included in the first fused data using regular expressions; performing domain name fusion on the first fused data based on the parent domain name to obtain second fused data; aggregating the server IPs of each application layer protocol in the second fused data by network segment; and normalizing the format of the aggregated second fused data to obtain communication behavior data. See the above for details. Figure 6 The corresponding explanation.

[0087] The specific implementation method for obtaining the initial subscription strategy data of each user and performing standardization processing can be found above. Figure 5 The corresponding explanation.

[0088] The initial network element rule data for each user is obtained and standardized to obtain the first rule data. This can be achieved by: extracting the parent domain name from the URL information of each application layer protocol included in the initial network element rule data using regular expressions; performing domain name fusion on the initial network element rule data based on the parent domain name to obtain the third fused data; aggregating independent IPs of the same network segment in the third fused data according to preset fusion simplification rules; and normalizing the format of the aggregated third fused data to obtain the first rule data. See the above for details. Figure 7 The corresponding explanation.

[0089] In step S104 above, a first type of user characteristics corresponding to private network users is constructed based on the subscription policy data and the first rule data, and a second type of user characteristics corresponding to non-private network users is constructed based on the communication behavior data and the first rule data. The first type of user characteristics can be general user characteristics possessed by one or more customer groups within the private network users. For example, the first type of user characteristics can be dedicated DNN user characteristics, which can be used to identify dedicated DNN subscribed users and dedicated DNN unsubscribed users. The second type of user characteristics can be general user characteristics possessed by one or more customer groups within the non-private network users. For example, the second type of user characteristics can be general DNN user characteristics, which can be used to identify general DNN subscribed users.

[0090] Based on the contract signing strategy data and the first rule data, the first type of user characteristics corresponding to the private network users can be constructed as follows: Based on the contract signing strategy data, determine the first rule sub-data related to the private network users in the first rule data; based on the first rule sub-data, construct the second feature extraction channel corresponding to the private network users; input the contract signing strategy data into the second feature extraction channel for feature extraction to obtain the first type of user characteristics corresponding to the private network users.

[0091] Based on the contract signing strategy data and the first rule data, constructing the first type of user characteristics corresponding to the private network user can also be done by: filtering the contract signing strategy data according to the preset private network contract signing information to obtain contract signing sub-data related to the private network user; determining the first rule sub-data related to the private network user in the first rule data based on the contract signing sub-data; and constructing the first type of user characteristics corresponding to the private network user based on the contract signing sub-data and the first rule sub-data.

[0092] Since the first rule data is generated after each user's request has actually triggered traffic splitting, it can be used to distinguish between inactive users whose subscription strategy data contains private network subscription information but has never triggered private network traffic splitting, and active users whose subscription strategy data contains private network subscription information and has triggered private network traffic splitting. Compared with the technical solution of constructing the first type of user characteristics corresponding to private network users using only subscription strategy data, using both subscription strategy data and first rule data to construct the first type of user characteristics can accurately filter out active users who have actually used private network services and eliminate interference data from empty subscriptions, thereby improving the accuracy and effectiveness of the first type of user characteristics.

[0093] In one embodiment, constructing a second type of user characteristics corresponding to non-private network users based on communication behavior data and first rule data includes: constructing a first feature extraction channel based on the first rule data; inputting communication behavior data into the first feature extraction channel for feature extraction to obtain a first initial feature; performing hash encryption processing on the first initial feature to obtain a first feature fingerprint; and adding the first feature fingerprint to the second type of user characteristics.

[0094] The number of first feature extraction channels can be one or more. Each first feature extraction channel can correspond one-to-one with a pre-determined application layer protocol.

[0095] Based on the first rule data, a first feature extraction channel is constructed; communication behavior data is input into the first feature extraction channel for feature extraction to obtain the first initial feature.

[0096] Communication behavior data can include: DNS data, HTTPS / HTTP data, GEN data, etc.

[0097] For example, three parallel channels are constructed based on the first rule data, and communication behavior data is distributed to these three parallel channels according to protocol type: Channel 1: Used to input DNS data into the domain name resolver for domain name resolution, resulting in sub-feature 1; Channel 2: Used to extract information from the URL and IP combination extractor of HTTPS / HTTP data to obtain sub-feature 2; Channel 3: Used to input GEN data into the target IP extractor for information extraction, resulting in sub-feature 3.

[0098] Sub-feature 1, sub-feature 2, and sub-feature 3 are determined as the first initial features.

[0099] The first initial feature is hashed and encrypted to obtain the first feature fingerprint, and then the first feature fingerprint is added to the second type of user features.

[0100] For example, the first initial feature is hashed and encrypted using the MD5 (Message Digest Algorithm 5) encryption algorithm to obtain a 128-bit fingerprint, which is then added to the second type of user feature.

[0101] When there are multiple first-feature fingerprints, these fingerprints can be merged and stored to generate a hash chain fingerprint database. This hash chain fingerprint database can be used for subsequent user feature comparison or user identification.

[0102] In the process of generating the hash chain fingerprint database, the following formula (1) can be used as a reference: H n+1 = SHA-256(H n (1) First characteristic fingerprint) Among them, H n This represents the nth hash value, which can be considered an old hash node. H n+1 The (n+1)th hash value can be considered a new hash node. The symbol "‖" represents a concatenation operation. In formula (1), the "first feature fingerprint" refers to the new fingerprint to be added to the hash chain. SHA-256() represents the SHA-256 hash function.

[0103] Referring to the above formula (1), the first hash value can be a preset initial value. Each time a new first feature fingerprint is generated, the new first feature fingerprint is added to the hash chain by performing the above formula (1) to generate a hash chain fingerprint library. In addition, due to the similar concept, corresponding feature fingerprints and hash chain fingerprint libraries can also be generated during the construction of the first type of user features, which will not be elaborated here.

[0104] As can be seen, through this embodiment, on the one hand, by using communication behavior data and first rule data together to construct the second type of user characteristics, active users who have actually used public network services can be effectively screened out, thereby improving the accuracy and effectiveness of the second type of user characteristics; on the other hand, by generating feature fingerprints, data support can be provided for subsequent identification steps.

[0105] In addition, constructing the second type of user characteristics corresponding to non-private network users based on communication behavior data and first rule data can also be done as follows: filtering communication behavior data based on preset public network subscription information to obtain communication sub-data related to non-private network users; determining the second rule sub-data related to non-private network users in the first rule data based on the communication sub-data; and constructing the second type of user characteristics corresponding to non-private network users based on the communication sub-data and the second rule sub-data.

[0106] In step S106 above, the subscription policy data and communication behavior data corresponding to the first user request are obtained, and the user type of the first user request is identified based on the characteristics of the first type of user, the characteristics of the second type of user, the subscription policy data and communication behavior data corresponding to the first user request, to obtain the target user type; the target user type is either a private network user or a non-private network user.

[0107] The first user request can be any user request. For details on obtaining the subscription policy data and communication behavior data corresponding to the first user request, please refer to the relevant explanation in step S102.

[0108] Based on the first type of user characteristics, the second type of user characteristics, the subscription policy data and communication behavior data corresponding to the first user request, the user type of the first user request is identified to obtain the target user type. This can be done by: inputting the subscription policy data and communication behavior data corresponding to the first user request into a pre-trained classification model to classify the user type of the first user request to obtain the target user type; the classification model is trained based on the first type of user characteristics and the second type of user characteristics.

[0109] In one embodiment, identifying the user type of the first user request based on the first type of user characteristics, the second type of user characteristics, the subscription policy data corresponding to the first user request, and the communication behavior data, to obtain the target user type includes: determining whether the user type of the first user request is a private network user based on the first type of user characteristics and the subscription policy data corresponding to the first user request, and obtaining a first determination result; determining whether the user type of the first user request is a non-private network user based on the second type of user characteristics and the communication behavior data corresponding to the first user request, and obtaining a second determination result; and determining the target user type corresponding to the first user request based on the first determination result and the second determination result.

[0110] Private network users can include: dedicated DNN contracted users and dedicated DNN uncontracted users. Non-private network users can include: general DNN contracted users.

[0111] Based on the characteristics of the first type of user and the subscription policy data corresponding to the first user request, it is determined whether the user type of the first user request is a private network user, and the first determination result is obtained.

[0112] For example, the subscription strategy data includes N7 interface data. The DNN field is extracted from the N7 interface data, and this DNN field is compared in real-time with the dedicated DNN mapping table in the first type of user features. If the comparison is successful, the user number and TAC are further combined to determine whether the user is a "dedicated DNN subscribed user" or a "dedicated DNN non-subscribed user." If the comparison fails, the corresponding data is discarded.

[0113] Specifically, the real-time comparison of the DNN field with the dedicated DNN mapping table in the first type of user features can be performed as follows: hash the DNN field to obtain the fingerprint to be processed, and compare the fingerprint to be processed with each feature fingerprint in the dedicated DNN mapping table.

[0114] Based on the characteristics of the second type of user and the communication behavior data corresponding to the first user request, it is determined whether the user type of the first user request is a non-private network user, and a second determination result is obtained.

[0115] For example, a triple filtering mechanism can be pre-built and the identified non-private network users can be merged: (1) DNS tunneling: If, based on the communication behavior data corresponding to the first user request, it is determined that the DNS request address belongs to the preset DNS address set, then the record is retained, and this record can be regarded as a second determination result.

[0116] (2) HTTPS / HTTP channel processing: If, based on the communication behavior data corresponding to the first user request, it is determined that the (URL, IP) combination belongs to the URL and IP mapping table, then feature capture is triggered, and the record is retained. This record can be regarded as a second determination result.

[0117] (3) GEN channel processing: If, based on the communication behavior data corresponding to the first user request, it is determined that the target IP belongs to the IP diversion pool, then feature capture is triggered and the record is retained. This record can be regarded as a second determination result.

[0118] (4) Merged list of general DNN subscribers The records retained in (1)-(3) above are merged and deduplicated to obtain the list of identified general DNN contracted users.

[0119] The steps described above, "determine whether the user type of the first user request is a private network user based on the first type of user characteristics and the subscription policy data corresponding to the first user request, and obtain the first determination result," and "determine whether the user type of the first user request is a non-private network user based on the second type of user characteristics and the communication behavior data corresponding to the first user request, and obtain the second determination result," can be executed simultaneously to shorten the processing time for user type identification.

[0120] Determining the target user type corresponding to the first user request based on the first determination result and the second determination result may include: if the first determination result and the second determination result do not conflict, then the user type represented by the first determination result and the second determination result is determined as the target user type; if the first determination result and the second determination result conflict, then the target user type is determined according to a preset conflict handling strategy.

[0121] For example, if the first determination result indicates that the user type requested by the first user is a private network user, and the second determination result indicates that the user type requested by the first user is not a non-private network user, and the first and second determination results do not conflict, then the private network user is determined as the target user type. Alternatively, if the first determination result indicates that the user type requested by the first user is a private network user, and the second determination result indicates that the user type requested by the first user is not a private network user, and the first and second determination results conflict, then the first determination result prevails, and the private network user is determined as the target user type.

[0122] After identifying the target user type for each first user request, a user list table can be generated based on this target user type. The user types corresponding to this list table include: dedicated DNN contracted users, private network DNN uncontracted users, and general DNN contracted users. Corresponding output data structures can be set for each user type. For example, the output data structure for dedicated DNN contracted users can be represented as: {Number, DNN, TAC, Associated H}. n The output data structure for a dedicated DNN for unsigned users can be represented as: {Number, DNN, TAC, Association H}. n The output data structure of a general DNN for subscribed users can be represented as: {Number, Main Feature (Domain Name / URL / IP), H} n}

[0123] As can be seen, this embodiment cross-validates user types from two dimensions: signing strategy and communication behavior, thereby improving the accuracy of user type identification.

[0124] In one embodiment, the data processing method further includes: inputting the communication behavior data corresponding to the first user request into a first feature extraction channel for feature extraction to obtain a second initial feature; performing hash encryption on the second initial feature to obtain a second feature fingerprint; comparing the second feature fingerprint with each of the first feature fingerprints in the second type of user features; if the comparison result indicates that the second feature fingerprint is different from each of the first feature fingerprints, then adding the second feature fingerprint to the second type of user features.

[0125] The communication behavior data corresponding to the first user request is input into the first feature extraction channel for feature extraction to obtain the second initial feature.

[0126] The primary feature extraction channels include, but are not limited to: DNS channel, HTTPS / HTTP channel, and GEN channel. Communication behavior data includes, but is not limited to: DNS data, HTTPS / HTTP data, and GEN data.

[0127] If the communication behavior data includes DNS data, then the DNS data is input into the DNS channel for feature extraction to obtain sub-feature 1; if the communication behavior data includes HTTPS / HTTP data, then the HTTPS / HTTP data is input into the HTTPS / HTTP channel for feature extraction to obtain sub-feature 2; if the communication behavior data includes GEN data, then the GEN data is input into the GEN channel for feature extraction to obtain sub-feature 3. Sub-feature 1, sub-feature 2, and sub-feature 3 are determined as the second initial features.

[0128] The second initial feature is hashed and encrypted to obtain the second feature fingerprint. For example, the sub-feature 1 above is hashed and encrypted using the MD5 encryption algorithm to obtain fingerprint 1, which can represent the corresponding domain name. The sub-feature 2 above is hashed and encrypted using the MD5 encryption algorithm to obtain fingerprint 2, which can represent the corresponding URL and IP combination. The sub-feature 3 above is hashed and encrypted using the MD5 encryption algorithm to obtain fingerprint 3, which can represent the corresponding target IP.

[0129] The second feature fingerprint is compared with each of the first feature fingerprints in the second type of user features; if the comparison result indicates that the second feature fingerprint is different from each of the first feature fingerprints, then the second feature fingerprint is added to the second type of user features.

[0130] For example, if fingerprint 1 is different from each of the first feature fingerprints in the second type of user features, then it is determined that the domain name represented by fingerprint 1 is an unregistered domain name, and fingerprint 1 is added to the second type of user features.

[0131] Since fingerprint 2 is different from all the first feature fingerprints in the second type of user features, it is determined that the URL and IP combination represented by fingerprint 2 is an unknown URL and IP combination, and fingerprint 2 is added to the second type of user features.

[0132] Since fingerprint 3 is different from all the first feature fingerprints in the second type of user features, it is determined that the target IP represented by fingerprint 3 is an unrecorded target IP, and fingerprint 3 is added to the second type of user features.

[0133] When the second feature fingerprint is different from all the first feature fingerprints, the incremental update rule can also be set as follows: (1) If the second feature fingerprint represents a DNS feature, then add the second feature fingerprint to the DNS address set; (2) If the second feature fingerprint represents a combination of URL and IP, then add the second feature fingerprint to the URL and IP mapping table; (3) If the second feature fingerprint represents an IP feature, then add the second feature fingerprint to the IP offloading pool.

[0134] Using the above incremental credit enhancement rules, the hash chain fingerprint database can be dynamically expanded. During the expansion of the hash chain fingerprint database, the following formula (2) can be referenced: H n+1 = SHA-256(H n (2) Second feature fingerprint) Among them, H n This represents the nth hash value, which can be considered an old hash node. H n+1 The (n+1)th hash value can be considered a new hash node. The symbol "‖" represents a concatenation operation. The "second feature fingerprint" in formula (2) refers to the new fingerprint to be added to the hash chain, that is, the feature fingerprint corresponding to the first user request. SHA-256() represents the SHA-256 hash function.

[0135] This embodiment can refer to the corresponding description in the foregoing embodiment: "Construct a first feature extraction channel according to the first rule data; input communication behavior data into the first feature extraction channel for feature extraction to obtain a first initial feature; perform hash encryption processing on the first initial feature to obtain a first feature fingerprint, and add the first feature fingerprint to the second type of user features".

[0136] As can be seen, through this embodiment, new feature fingerprints can be continuously mined and added to the second type of user features during the processing of the first user request, thereby realizing the dynamic updating and continuous optimization of the second type of user features.

[0137] In step S108 above, if the target user type is a private network user, the user behavior of the first user request is identified based on the communication behavior data corresponding to the first user request and the characteristics of the first type of user, and the target behavior identification result is obtained; the target behavior identification result is used to indicate whether the user behavior of the first user request is related to the private network.

[0138] The user behavior in the first user request being related to the private network means that the request is used to implement private network service activities. For example, a user terminal accesses the first institution's private network through a dedicated DNN, logs into the first institution's data processing system via the private network, and executes a data processing flow. Considering that the above data processing flow is executed based on the private network, the user behavior in the first user request sent by the user terminal in this data processing flow is related to the private network.

[0139] The user behavior of the first user request being unrelated to the private network means that the request is used to perform business activities unrelated to the private network. For example, if a user terminal accesses the private network of the first institution through a dedicated DNN and downloads entertainment resources such as short videos, music, and e-books that are not part of the services of the first institution's private network, then the user behavior of the first user request sent by the user terminal during the data download process is unrelated to the private network.

[0140] Based on the communication behavior data corresponding to the first user request and the characteristics of the first type of user, the user behavior of the first user request is identified to obtain the target behavior identification result. This can be done by: inputting the communication behavior data corresponding to the first user request into a pre-trained behavior classification model, classifying the user behavior of the first user request, and determining the classification result as the target behavior identification result. The behavior classification model is trained from the characteristics of the first type of user.

[0141] Additionally, if the target user is a non-private network user, no special operation is required.

[0142] In one embodiment, the communication behavior data includes a target protocol type; based on the communication behavior data corresponding to the first user request and the first type of user characteristics, the user behavior of the first user request is identified to obtain a target behavior identification result, including: extracting a target feature field matching the target protocol type from the communication behavior data corresponding to the first user request based on the target protocol type; determining the target behavior judgment condition corresponding to the target protocol type based on the correspondence between the target protocol type and the pre-configured protocol type and behavior judgment condition; and identifying the user behavior of the first user request based on the target feature field, the target behavior judgment condition, and the first type of user characteristics to obtain a target behavior identification result.

[0143] Based on the target protocol type, extract the target feature fields that match the target protocol type from the communication behavior data corresponding to the first user request.

[0144] Target protocol types include, but are not limited to: DNS protocol, HTTPS / HTTP protocol, and GEN protocol.

[0145] If the target protocol type is DNS, then in the process of extracting the target feature field that matches the target protocol type from the communication behavior data corresponding to the first user request, the target domain name and response IP in the domain name resolution request can be separated from the communication behavior data corresponding to the first user request, and the obtained data can be determined as the target feature field.

[0146] If the target protocol type is HTTPS / HTTP, then in the process of extracting the target feature field that matches the target protocol type from the communication behavior data corresponding to the first user request, the complete URL path (preserving the protocol, hostname, path and parameters) and server IP can be extracted from the communication behavior data corresponding to the first user request, and the obtained data can be determined as the target feature field.

[0147] If the target protocol type is GEN protocol, then in the process of extracting the target feature field that matches the target protocol type from the communication behavior data corresponding to the first user request, the target IP in the SYN (Synchronize) message can be extracted from the communication behavior data corresponding to the first user request, and the obtained data can be determined as the target feature field.

[0148] Based on the correspondence between the target protocol type and the pre-configured protocol type and behavior judgment conditions, determine the target behavior judgment conditions corresponding to the target protocol type.

[0149] For example, the correspondence between pre-configured protocol types and behavior judgment conditions is as follows: (1) The behavior judgment conditions corresponding to the DNS protocol include: if the domain name exists in the DNS address set and the response IP belongs to the IP distribution pool, it is marked as a private network service.

[0150] (2) The behavior judgment conditions corresponding to HTTPS / HTTP protocol include: if the URL or target IP matches the URL and IP mapping table, it is marked as a private network service.

[0151] (3) The behavior judgment conditions corresponding to the GEN protocol include: if the target IP belongs to the IP diversion pool address range, it is marked as a private network service.

[0152] If the target protocol type is DNS, then based on the correspondence between the target protocol type and the pre-configured protocol type and behavior judgment conditions, the target behavior judgment condition corresponding to the target protocol type is determined as "if the domain name exists in the DNS address set and the response IP belongs to the IP distribution pool, then it is marked as a private network service".

[0153] The DNS address set, IP routing pool, and URL-IP mapping table mentioned above can be obtained from the fingerprint database constructed above. For details, please refer to the corresponding description of the incremental update rules above.

[0154] Additionally, the hash node H associated with the fingerprint database can be obtained. n As a version identifier, the version identifier can be used to verify the integrity of the fingerprint database before extracting the target feature fields.

[0155] Based on the target feature fields, target behavior judgment conditions, and the characteristics of the first type of user, the user behavior requested by the first user is identified to obtain the target behavior identification result. This can be achieved by: determining the selectable range of the target feature fields related to the private network based on the target behavior judgment conditions and the characteristics of the first type of user; if the value of the target feature field falls within the selectable range, then the target behavior identification result indicates that the user behavior requested by the first user is related to the private network; if the value of the target feature field falls outside the selectable range, then the target behavior identification result indicates that the user behavior requested by the first user is unrelated to the private network.

[0156] For example, if the target protocol type is DNS protocol, and the target behavior judgment condition is "if the domain name exists in the DNS address set and the response IP belongs to the IP distribution pool, then it is marked as a private network service", based on the target behavior judgment condition and the characteristics of the first type of user, the selectable range of the target feature field "DNS address" related to the private network includes: DNS address 1, DNS address 2, and DNS address 3; the selectable range of the target feature field "IP address" related to the private network includes: IP address 1, IP address 2, and IP address 3.

[0157] If the target feature fields include DNS address 1 and IP address 2, and the values ​​of each target feature field fall within the selectable range, then it can be determined that the target behavior identification result indicates that the user behavior requested by the first user is related to the private network.

[0158] If the target feature fields include DNS address 4 and IP address 2, and the values ​​of some target feature fields fall outside the selectable range, then it can be determined that the target behavior identification result indicates that the user behavior requested by the first user is unrelated to the private network.

[0159] If the target feature fields include DNS address 4 and IP address 4, and the values ​​of each target feature field fall outside the selectable range, then it can be determined that the target behavior identification result indicates that the user behavior requested by the first user is unrelated to the private network.

[0160] As can be seen, through this embodiment, different behavior recognition processes can be flexibly adopted for first user requests of different protocol types, thereby improving the accuracy and adaptability of user behavior recognition related to the private network.

[0161] In step S110 above, if the target user type is a private network user and the target behavior identification result indicates that the user behavior requested by the first user is related to the private network, then the first user request is identified as target traffic data. Target traffic data refers to the traffic data generated during the process of a user terminal accessing the private network and implementing private network service behavior.

[0162] In addition, if the target user type is a private network user and the target behavior identification result indicates that the user behavior requested by the first user is unrelated to the private network, no special operation is required.

[0163] In one embodiment, after identifying the first user request as the target traffic data, the data processing further includes: generating a detailed user behavior record corresponding to the target traffic data based on the subscription policy data and communication behavior data corresponding to the target traffic data; and conducting a network quality assessment of the private network based on the detailed user behavior record.

[0164] Based on the subscription policy data and communication behavior data corresponding to the target traffic data, generate detailed user behavior reports for the target traffic data. For example, based on N3 interface data and associated N7 interface data, output detailed user behavior reports for DNS, HTTPS, and HTTP protocols.

[0165] The network quality assessment of the private network is based on user behavior details. This can be achieved by inputting user behavior details into a preset network quality assessment model, which outputs the overall quality assessment results of the private network and the quality assessment results of each business segment.

[0166] Figure 8 This is a schematic diagram of an application interface for a data processing method provided in an embodiment of the present disclosure. Figure 8 An example is shown, illustrating the results of analyzing business issues in a dual-domain network using user behavior details.

[0167] As can be seen, this embodiment can generate detailed user behavior records, providing detailed and traceable data for the assessment of private network quality.

[0168] In summary, through the various embodiments of the data processing methods described above, on the one hand, using communication behavior data and first rule data to construct the first type of user characteristics corresponding to private network users, and using subscription policy data and first rule data to construct the second type of user characteristics for non-private network users, can provide data support for identifying private network users and non-private network users in subsequent steps; on the other hand, for any first user request obtained, first identifying its user type, and then identifying its user behavior when the target user type is determined to be a private network user, can constrain the first user request from both user type and user behavior dimensions, accurately identifying whether the first user request is target traffic data related to the private network, and achieving accurate segmentation of traffic data.

[0169] Based on the same technical concept, this disclosure also provides another data processing method, which can be referred to below. Figures 9-11 .

[0170] Figure 9 This is a flowchart illustrating another data processing method provided in an embodiment of the present disclosure.

[0171] Step 1: Data collection and filtering.

[0172] Step 2: Integrate heterogeneous data for uplink classification rules.

[0173] Step 3: Standardize heterogeneous data.

[0174] Step 4: Hash chain dynamic fingerprint dual-domain private network user identification.

[0175] Step 5: Hash chain dynamic fingerprint dual-domain private network service identification.

[0176] Steps 1-3 above can be referred to the corresponding description of step S102 in the above method embodiment; step 4 above can be referred to the corresponding description of steps S104-106 in the above method embodiment; step 5 above can be referred to the corresponding description of steps S108-110 in the above method embodiment.

[0177] Figure 10 This is a partial flowchart illustrating another data processing method provided in an embodiment of the present disclosure.

[0178] Step 4.1: Construction of hash chain-based dynamic fingerprint feature engineering.

[0179] Step 4.1.1: Input the upstream classification rules.

[0180] Step 4.1.2: Layered fingerprint feature engineering construction.

[0181] Step 4.2: User identification for dual-domain private networks based on hash chain dynamic fingerprinting.

[0182] Step 4.2.1: Standard data input.

[0183] Step 4.2.2: Dual-domain private network user identification.

[0184] Step 4.2.3: Output the list of private network users.

[0185] Step 4.3: Update the fingerprint features for user identification and private network service identification.

[0186] like Figure 10 The partial process shown (i.e., steps 4.1-4.3) can be referred to the corresponding descriptions of steps S104-S106 in the aforementioned method embodiments.

[0187] Figure 11 This is another partial flowchart illustrating another data processing method provided in an embodiment of the present disclosure.

[0188] Step 5.1: Data input and fingerprint database verification.

[0189] Step 5.2: Multi-protocol feature extraction and parsing.

[0190] Step 5.3: Determine the differentiated private network services.

[0191] Step 5.4: Output the private network service label.

[0192] like Figure 11 The partial process shown (i.e., steps 5.1-5.4) can be referred to the corresponding descriptions in steps S108-S110 of the aforementioned method embodiments.

[0193] Because the technical concepts are similar, this embodiment is described in a relatively simple way, and you can refer to the corresponding description above.

[0194] Figure 12 This is a schematic diagram of the structure of a data processing apparatus provided in an embodiment of the present disclosure, as shown below. Figure 12 As shown, the device includes: The data acquisition unit 1201 is used to acquire communication behavior data, subscription policy data, and first rule data of each user; the subscription policy data is used to represent the subscription information configured by the user related to network access permissions; the first rule data is used to represent the diversion rules for diverting user requests of each user. The feature construction unit 1202 is used to construct a first type of user features corresponding to private network users based on the subscription strategy data and the first rule data, and to construct a second type of user features corresponding to non-private network users based on the communication behavior data and the first rule data. The first identification unit 1203 is used to acquire the subscription policy data and the communication behavior data corresponding to the first user request, and to identify the user type of the first user request based on the first type of user characteristics, the second type of user characteristics, the subscription policy data and the communication behavior data corresponding to the first user request, to obtain the target user type; the target user type is one of the private network user and the non-private network user. The second identification unit 1204 is used to identify the user behavior of the first user request based on the communication behavior data corresponding to the first user request and the characteristics of the first type of user if the target user type is the private network user, and to obtain a target behavior identification result; the target behavior identification result is used to indicate whether the user behavior of the first user request is related to the private network. The data determination unit 1205 is used to determine the first user request as target traffic data if the target user type is the private network user and the target behavior identification result indicates that the user behavior requested by the first user is related to the private network.

[0195] Optionally, the first identification unit 1203 is specifically used for: Based on the first type of user characteristics and the subscription policy data corresponding to the first user request, determine whether the user type of the first user request is the private network user, and obtain a first determination result; Based on the second type of user characteristics and the communication behavior data corresponding to the first user request, determine whether the user type of the first user request is the non-private network user, and obtain a second determination result; Based on the first determination result and the second determination result, the target user type corresponding to the first user request is determined.

[0196] Optionally, the feature construction unit 1202 is specifically used for: Based on the first rule data, a first feature extraction channel is constructed; The communication behavior data is input into the first feature extraction channel for feature extraction to obtain the first initial feature; The first initial feature is hashed and encrypted to obtain a first feature fingerprint, which is then added to the second type of user feature.

[0197] Optionally, the communication behavior data includes the target protocol type; the second identification unit 1204 is specifically used for: Based on the target protocol type, extract the target feature field that matches the target protocol type from the communication behavior data corresponding to the first user request; Based on the target protocol type and the pre-configured correspondence between protocol types and behavior judgment conditions, determine the target behavior judgment conditions corresponding to the target protocol type; Based on the target feature fields, the target behavior judgment conditions, and the first type of user features, the user behavior requested by the first user is identified to obtain the target behavior identification result.

[0198] Optionally, the feature construction unit 1202 is further configured to: The communication behavior data corresponding to the first user request is input into the first feature extraction channel for feature extraction to obtain the second initial feature; The second initial feature is hashed and encrypted to obtain the second feature fingerprint; The second feature fingerprint is compared with each of the first feature fingerprints in the second type of user features; If the comparison result indicates that the second feature fingerprint is different from each of the first feature fingerprints, then the second feature fingerprint is added to the second type of user features.

[0199] Optionally, the data processing apparatus further includes: The detailed transaction record generation unit is used to generate a detailed transaction record of user behavior corresponding to the target traffic data based on the subscription policy data and the communication behavior data corresponding to the target traffic data. The network assessment unit is used to assess the network quality of the private network based on the user behavior details.

[0200] Through the embodiments of this disclosure, on the one hand, communication behavior data and first rule data are used to construct the first type of user characteristics corresponding to private network users, and subscription policy data and first rule data are used to construct the second type of user characteristics of non-private network users, which can provide data support for identifying private network users and non-private network users in subsequent steps; on the other hand, for any first user request obtained, its user type is first identified, and then its user behavior is identified when the target user type is determined to be a private network user, which can constrain the first user request from two dimensions of user type and user behavior, accurately identify whether the first user request is target traffic data related to the private network, and achieve accurate splitting of traffic data.

[0201] The data processing apparatus provided in this disclosure can implement the various processes in the foregoing method embodiments and achieve the same functions and effects, which will not be repeated here.

[0202] Furthermore, embodiments of this disclosure also provide an electronic device, Figure 13 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure, such as... Figure 13 As shown, the device includes: a memory 1301, a processor 1302, a bus 1303, and a communication interface 1304. The memory 1301, the processor 1302, and the communication interface 1304 communicate via the bus 1303. The communication interface 1304 may include input / output interfaces, including but not limited to a keyboard, mouse, monitor, microphone, and loudspeaker.

[0203] Figure 13 In the memory 1301, computer-executable instructions that can run on the processor 1302 are stored. When the processor 1302 executes the computer-executable instructions, the following process is implemented: The system acquires communication behavior data, subscription policy data, and first rule data for each user; the subscription policy data represents the subscription information configured by the user related to network access permissions; and the first rule data represents the traffic splitting rules for processing user requests from each user. Based on the contract signing strategy data and the first rule data, a first type of user characteristics corresponding to private network users are constructed, and based on the communication behavior data and the first rule data, a second type of user characteristics corresponding to non-private network users are constructed. The subscription policy data and communication behavior data corresponding to the first user request are obtained, and the user type of the first user request is identified based on the first type of user characteristics, the second type of user characteristics, the subscription policy data and communication behavior data corresponding to the first user request, to obtain the target user type; the target user type is one of the private network user and the non-private network user. If the target user type is the private network user, then based on the communication behavior data corresponding to the first user request and the characteristics of the first type of user, the user behavior of the first user request is identified to obtain the target behavior identification result; the target behavior identification result is used to indicate whether the user behavior of the first user request is related to the private network. If the target user type is the private network user and the target behavior identification result indicates that the user behavior requested by the first user is related to the private network, then the first user request is determined as target traffic data.

[0204] Through the embodiments of this disclosure, on the one hand, communication behavior data and first rule data are used to construct the first type of user characteristics corresponding to private network users, and subscription policy data and first rule data are used to construct the second type of user characteristics of non-private network users, which can provide data support for identifying private network users and non-private network users in subsequent steps; on the other hand, for any first user request obtained, its user type is first identified, and then its user behavior is identified when the target user type is determined to be a private network user, which can constrain the first user request from two dimensions of user type and user behavior, accurately identify whether the first user request is target traffic data related to the private network, and achieve accurate splitting of traffic data.

[0205] The electronic device provided in this disclosure can implement the various processes in the foregoing method embodiments and achieve the same functions and effects, which will not be repeated here.

[0206] This disclosure also provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, can perform the following process: The system acquires communication behavior data, subscription policy data, and first rule data for each user; the subscription policy data represents the subscription information configured by the user related to network access permissions; and the first rule data represents the traffic splitting rules for processing user requests from each user. Based on the contract signing strategy data and the first rule data, a first type of user characteristics corresponding to private network users are constructed, and based on the communication behavior data and the first rule data, a second type of user characteristics corresponding to non-private network users are constructed. The subscription policy data and communication behavior data corresponding to the first user request are obtained, and the user type of the first user request is identified based on the first type of user characteristics, the second type of user characteristics, the subscription policy data and communication behavior data corresponding to the first user request, to obtain the target user type; the target user type is one of the private network user and the non-private network user. If the target user type is the private network user, then based on the communication behavior data corresponding to the first user request and the characteristics of the first type of user, the user behavior of the first user request is identified to obtain the target behavior identification result; the target behavior identification result is used to indicate whether the user behavior of the first user request is related to the private network. If the target user type is the private network user and the target behavior identification result indicates that the user behavior requested by the first user is related to the private network, then the first user request is determined as target traffic data.

[0207] The computer-readable storage medium includes read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, etc.

[0208] Through the embodiments of this disclosure, on the one hand, communication behavior data and first rule data are used to construct the first type of user characteristics corresponding to private network users, and subscription policy data and first rule data are used to construct the second type of user characteristics of non-private network users, which can provide data support for identifying private network users and non-private network users in subsequent steps; on the other hand, for any first user request obtained, its user type is first identified, and then its user behavior is identified when the target user type is determined to be a private network user, which can constrain the first user request from two dimensions of user type and user behavior, accurately identify whether the first user request is target traffic data related to the private network, and achieve accurate splitting of traffic data.

[0209] The computer-readable storage medium provided in this disclosure can implement the various processes in the foregoing method embodiments and achieve the same functions and effects, which will not be repeated here.

[0210] This disclosure also provides a computer program product, which includes a computer program that, when executed by a processor, implements the following process: The system acquires communication behavior data, subscription policy data, and first rule data for each user; the subscription policy data represents the subscription information configured by the user related to network access permissions; and the first rule data represents the traffic splitting rules for processing user requests from each user. Based on the contract signing strategy data and the first rule data, a first type of user characteristics corresponding to private network users are constructed, and based on the communication behavior data and the first rule data, a second type of user characteristics corresponding to non-private network users are constructed. The subscription policy data and communication behavior data corresponding to the first user request are obtained, and the user type of the first user request is identified based on the first type of user characteristics, the second type of user characteristics, the subscription policy data and communication behavior data corresponding to the first user request, to obtain the target user type; the target user type is one of the private network user and the non-private network user. If the target user type is the private network user, then based on the communication behavior data corresponding to the first user request and the characteristics of the first type of user, the user behavior of the first user request is identified to obtain the target behavior identification result; the target behavior identification result is used to indicate whether the user behavior of the first user request is related to the private network. If the target user type is the private network user and the target behavior identification result indicates that the user behavior requested by the first user is related to the private network, then the first user request is determined as target traffic data.

[0211] Through the embodiments of this disclosure, on the one hand, communication behavior data and first rule data are used to construct the first type of user characteristics corresponding to private network users, and subscription policy data and first rule data are used to construct the second type of user characteristics of non-private network users, which can provide data support for identifying private network users and non-private network users in subsequent steps; on the other hand, for any first user request obtained, its user type is first identified, and then its user behavior is identified when the target user type is determined to be a private network user, which can constrain the first user request from two dimensions of user type and user behavior, accurately identify whether the first user request is target traffic data related to the private network, and achieve accurate splitting of traffic data.

[0212] The computer program product in this disclosure embodiment can implement the various processes of the above-described data processing method embodiment and achieve the same effects and functions, which will not be repeated here.

[0213] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0214] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0215] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0216] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0217] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0218] Memory may include non-persistent storage in computer-readable storage media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable storage media.

[0219] Computer-readable storage media include both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer-readable storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable storage media does not include transient media, such as modulated data signals and carrier waves.

[0220] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0221] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0222] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A data processing method, characterized in that, include: Acquire communication behavior data, subscription strategy data, and first rule data for each user; The subscription strategy data is used to represent the subscription information configured by the user related to network access permissions; The first rule data is used to represent the traffic splitting rules for splitting user requests for each of the users; Based on the contract strategy data and the first rule data, construct the first type of user characteristics corresponding to private network users, and based on the communication behavior data and the first rule data, construct the second type of user characteristics corresponding to non-private network users. The subscription policy data and communication behavior data corresponding to the first user request are obtained, and the user type of the first user request is identified based on the first type of user characteristics, the second type of user characteristics, the subscription policy data and communication behavior data corresponding to the first user request, to obtain the target user type; the target user type is one of the private network user and the non-private network user. If the target user type is the private network user, then based on the communication behavior data corresponding to the first user request and the characteristics of the first type of user, the user behavior of the first user request is identified to obtain the target behavior identification result; the target behavior identification result is used to indicate whether the user behavior of the first user request is related to the private network. If the target user type is the private network user and the target behavior identification result indicates that the user behavior requested by the first user is related to the private network, then the first user request is determined as target traffic data.

2. The method according to claim 1, characterized in that, The step of identifying the user type of the first user request based on the first type of user characteristics, the second type of user characteristics, the subscription policy data corresponding to the first user request, and the communication behavior data, to obtain the target user type, includes: Based on the first type of user characteristics and the subscription policy data corresponding to the first user request, determine whether the user type of the first user request is the private network user, and obtain a first determination result; Based on the second type of user characteristics and the communication behavior data corresponding to the first user request, determine whether the user type of the first user request is the non-private network user, and obtain a second determination result; Based on the first determination result and the second determination result, the target user type corresponding to the first user request is determined.

3. The method according to claim 1, characterized in that, The step of constructing the second type of user characteristics corresponding to non-private network users based on the communication behavior data and the first rule data includes: Based on the first rule data, a first feature extraction channel is constructed; The communication behavior data is input into the first feature extraction channel for feature extraction to obtain the first initial feature; The first initial feature is hashed and encrypted to obtain a first feature fingerprint, which is then added to the second type of user feature.

4. The method according to claim 1, characterized in that, The communication behavior data includes the target protocol type; the step of identifying the user behavior of the first user request based on the communication behavior data corresponding to the first user request and the first type of user characteristics, to obtain the target behavior identification result, includes: Based on the target protocol type, extract the target feature field that matches the target protocol type from the communication behavior data corresponding to the first user request; Based on the target protocol type and the pre-configured correspondence between protocol types and behavior judgment conditions, determine the target behavior judgment conditions corresponding to the target protocol type; Based on the target feature fields, the target behavior judgment conditions, and the first type of user features, the user behavior requested by the first user is identified to obtain the target behavior identification result.

5. The method according to claim 3, characterized in that, Also includes: The communication behavior data corresponding to the first user request is input into the first feature extraction channel for feature extraction to obtain the second initial feature; The second initial feature is hashed and encrypted to obtain the second feature fingerprint; The second feature fingerprint is compared with each of the first feature fingerprints in the second type of user features; If the comparison result indicates that the second feature fingerprint is different from each of the first feature fingerprints, then the second feature fingerprint is added to the second type of user features.

6. The method according to claim 1, characterized in that, After determining the first user request as the target traffic data, the process further includes: Based on the subscription policy data and communication behavior data corresponding to the target traffic data, a detailed user behavior record corresponding to the target traffic data is generated; The network quality of the private network is assessed based on the detailed user behavior data.

7. A data processing apparatus, characterized in that, include: The data acquisition unit is used to acquire communication behavior data, subscription strategy data, and first rule data of each user. The subscription strategy data is used to represent the subscription information configured by the user related to network access permissions; The first rule data is used to represent the traffic splitting rules for splitting user requests for each of the users; The feature construction unit is used to construct a first type of user features corresponding to private network users based on the subscription policy data and the first rule data, and to construct a second type of user features corresponding to non-private network users based on the communication behavior data and the first rule data. The first identification unit is used to acquire the subscription policy data and the communication behavior data corresponding to the first user request, and to identify the user type of the first user request based on the first type of user characteristics, the second type of user characteristics, the subscription policy data and the communication behavior data corresponding to the first user request, to obtain the target user type; the target user type is one of the private network user and the non-private network user. The second identification unit is configured to, if the target user type is the private network user, identify the user behavior of the first user request based on the communication behavior data corresponding to the first user request and the characteristics of the first type of user, and obtain a target behavior identification result; the target behavior identification result is used to indicate whether the user behavior of the first user request is related to the private network. The data determination unit is configured to determine the first user request as target traffic data if the target user type is the private network user and the target behavior identification result indicates that the user behavior requested by the first user is related to the private network.

8. An electronic device, characterized in that, The method includes a memory and a processor, wherein the memory stores computer-executable instructions that, when executed on the processor, enable the implementation of the method described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions that, when executed by a processor, enable the implementation of the method described in any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-6.

Images