Traffic feature encoding method, device, system and equipment for large language model and medium

Abstract

The embodiment of the application provides a traffic feature encoding method, device, system, equipment and medium for a large language model, wherein the method comprises the following steps: determining the encoding precision corresponding to a traffic feature; encoding the traffic feature according to the encoding precision to generate traffic feature encoding; and converting the encoded traffic feature into a hexadecimal string. The embodiment of the application can be applied in the field of network security large model fine-tuning or traffic analysis.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of information processing technology, and in particular to a method, apparatus, system, device and medium for traffic feature encoding for large language models. Background Technology

[0002] The core computational unit (Transformer) of the Large Language Model (LLM) can only process high-dimensional dense vectors (Embedding) and cannot directly understand raw packet capture (pcap) messages, Internet Protocol (IP) address strings, or JSON fields. Therefore, the various feature codes extracted from network traffic must be converted into numerical forms that the model can compute.

[0003] Existing technologies provide traffic feature encoding methods for LLM, which include: first, extracting structured traffic features from the original network packets (pcap / json) and converting the traffic features into string format; then, using a tokenizer to split the string into multiple tokens according to a pre-set vocabulary and outputting token IDs; finally, concatenating the token IDs of each traffic feature with a delimiter to form a token sequence.

[0004] Existing technical solutions, when the traffic characteristics are numerical, result in a large number of tokens that are not consecutive. For example, a 32-bit floating-point number, 12345.6789, may be split into 5-8 non-consecutive tokens after being stringified, leading to token inflation and distortion of numerical semantics. Summary of the Invention

[0005] This invention provides a traffic feature encoding method, apparatus, system, device, and medium for large language models, which can solve the problems of token inflation and numerical semantic distortion.

[0006] In a first aspect, embodiments of the present invention disclose a traffic feature encoding method for large language models, the method comprising: Determine the coding precision corresponding to the traffic characteristics; The traffic features are encoded according to the specified encoding precision to generate traffic feature codes; The encoded traffic characteristics are converted into hexadecimal strings.

[0007] Secondly, embodiments of the present invention disclose a traffic feature encoding device for large language models, the device comprising: The first module is used to determine the coding precision corresponding to the traffic characteristics; The second module is used to encode the traffic features according to the encoding precision to generate traffic feature codes; The third module is used to convert the encoded traffic characteristics into hexadecimal strings.

[0008] Thirdly, embodiments of the present invention disclose a traffic feature coding system for large language models, the system comprising: Traffic acquisition network elements are used to obtain raw traffic packets; A feature extraction server is used to extract traffic features from the original traffic packets, determine the encoding precision corresponding to the traffic features, encode the traffic features according to the encoding precision, generate traffic feature codes, and convert the encoded traffic features into hexadecimal strings.

[0009] Fourthly, embodiments of the present invention disclose an electronic device, including a processor and a non-transitory memory having instructions thereon, wherein the instructions, when executed by the processor, cause the processor to perform the aforementioned method.

[0010] Fifthly, embodiments of the present invention disclose a non-transitory computer-readable storage medium storing instructions that cause a processor to execute the aforementioned method.

[0011] In a sixth aspect, embodiments of the present invention disclose a computer program product, characterized in that the computer program product includes a computer program stored in a computer-readable storage medium, and a processor of an electronic device reads from the computer-readable storage medium and executes the computer program, causing the electronic device to perform the aforementioned method.

[0012] Compared with the prior art, the embodiments of the present invention have the following advantages: The technical solution provided in this application, during the encoding of traffic features, uses the encoding precision corresponding to the traffic features to generate traffic feature codes, and converts the encoded traffic features into hexadecimal strings. This skips the cumbersome and inefficient "string-segmentation" stage used in existing technologies, directly compressing the traffic features into a fixed-length (encoded precision) underlying byte stream. This not only directly compresses the token length but also ensures the representation quality of network features in LLM through memory alignment and precision control. It effectively solves the problems of token inflation and numerical semantic distortion. Attached Figure Description

[0013] Figure 1This is a flowchart illustrating the steps of a traffic feature encoding method for large language models according to an embodiment of the present invention. Figure 2 yes Figure 1 The flowchart shown is a schematic diagram of step 101 in the cross-channel service frustration chain construction method of an embodiment of the present invention; Figure 3 yes Figure 2 The diagram shown is a flowchart of step 202 in a cross-channel service frustration chain construction method according to an embodiment of the present invention. Figure 4 yes Figure 1 The flowchart shown is a schematic diagram of step 102 in the cross-channel service frustration chain construction method of an embodiment of the present invention; Figure 5 This is a flowchart illustrating the steps of a traffic feature encoding method for large language models according to another embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of a traffic feature encoding device for large language models according to an embodiment of the present invention; Figure 7 This is a schematic diagram of the structure of a traffic feature coding system for large language models according to an embodiment of the present invention; Figure 8 This is a schematic diagram of the structure of an electronic device 1100 according to an embodiment of the present invention. Detailed Implementation

[0014] In the embodiments of this application, the term "and / or" describes the relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. The character " / " generally indicates that the preceding and following associated objects have an "or" relationship.

[0015] In the embodiments of this application, the term "multiple" refers to two or more, and other quantifiers are similar.

[0016] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0017] The following specific embodiments illustrate the traffic feature encoding method for large language models according to the present invention.

[0018] Reference Figure 1The diagram illustrates a flowchart of a traffic feature encoding method for large language models according to an embodiment of the present invention. The method may specifically include the following steps: Step 101: Determine the coding precision corresponding to the traffic characteristics.

[0019] In this embodiment, step 101 can first extract traffic features from the original network packets (pcap / json), and then determine the encoding precision corresponding to the traffic features.

[0020] In this embodiment, traffic characteristics may include, but are not limited to: source IP, destination port, TCP window size, packet length, etc.

[0021] In this embodiment, as Figure 2 As shown, step 101 may include: Step 201: Obtain the importance coefficient of traffic features.

[0022] In this embodiment, step 201 can evaluate the importance coefficient of each feature using information gain (IG) or pre-trained weights.

[0023] In this embodiment, the principle behind step 201, which evaluates the importance coefficient of each feature through information gain, is to calculate the degree to which a certain traffic feature reduces the uncertainty of traffic classification labels (such as normal / malicious, attack type). The higher the IG, the more important the feature is in distinguishing different categories.

[0024] In this embodiment, the principle of evaluating the importance coefficient of each feature through pre-trained weights in step 201 is as follows: using a pre-trained basic model, such as a pre-trained security model, a BERT-style network traffic model, or a traditional tree model (such as XGBoost), the importance of each input traffic feature is inferred by analyzing the internal weights or output sensitivity of the model.

[0025] For example, in this embodiment, the importance coefficient obtained in step 201 has a value range of [0, 1].

[0026] Step 202: Determine the coding precision corresponding to the traffic characteristics based on the importance coefficient.

[0027] In this embodiment, as Figure 3 As shown, step 202 may include: Step 301: Based on the importance coefficient, classify the flow characteristics into important features and minor features.

[0028] In this embodiment, an importance threshold can be preset. When the importance coefficient is greater than the importance threshold, it is considered an important feature; otherwise, it is considered a minor feature. Of course, the above method is only a specific example. In actual use, other methods can also be used to classify traffic features.

[0029] In this embodiment, important features may include: port, flag bits, time behavior, traffic statistics, key fields in the IP header, etc., which play a decisive role in distinguishing normal / malicious traffic and identifying attack patterns, and are traffic features that the model is highly sensitive to; secondary features may include: fixed or constant fields, honor-derived features, high-level semantic redundancy, etc., which have low distinguishability, are redundant / volatile, and contribute little to the model's decision-making.

[0030] Step 302: Assign high coding precision to important features and low coding precision to minor features.

[0031] In this embodiment, the encoding precision can be 2 bytes, 4 bytes, or 8 bytes. For example, 2 bytes can be used as low encoding precision; 4 bytes and 8 bytes can be used as high encoding precision.

[0032] Step 102: Encode the traffic features according to the encoding precision to generate traffic feature codes.

[0033] In this embodiment, the traffic feature encoding can be a binary representation of a 32-bit floating-point or fixed-point number.

[0034] In this embodiment, as Figure 4 As shown, step 102 may include: Step 401: When the traffic feature is numerical, normalize the traffic feature, map it to the specified byte space for encoding, and generate traffic feature code.

[0035] For example, if the traffic feature is a response delay of 0.02534 seconds and the encoding precision is 2 bytes, step 401 can first scale and map 0.02534, for example, by multiplying it by 10000 and rounding it down to 253; then, encode 253 to generate the traffic feature code.

[0036] It should be noted that step 401 may also skip normalizing the traffic features and mapping them to a specified byte space, and instead directly encode them to generate traffic feature codes.

[0037] For example, if the traffic characteristics are a message length of 1500 and an encoding precision of 2 bytes, step 401 can directly encode 1500 without performing a mapping operation.

[0038] And / or, in step 402, if the traffic feature is categorical, hash the traffic feature to generate a traffic feature code.

[0039] It should be noted that steps 401 and 402 provided in this embodiment do not have a clear logical order in actual use. This embodiment is only used as an example where step 401 occurs before step 402.

[0040] Step 103: Convert the encoded traffic characteristics into a hexadecimal string.

[0041] For example, when the traffic characteristic is a response delay of 0.02534 seconds and the encoding precision is 2 bytes, step 102 can first scale and map 0.02534, for example, by multiplying by 10000 and taking the integer part, which is converted to 253; then, the 253 is encoded to generate the traffic characteristic encoding; step 103 converts the encoding corresponding to 253 into the hexadecimal string 0x00FD.

[0042] For example, when the traffic characteristics are a message length of 1500 and an encoding precision of 2 bytes, after encoding 1500 in step 102, step 103 can convert the encoding corresponding to 1500 into the hexadecimal string 0x05DC.

[0043] Compared with the prior art, the embodiments of the present invention have the following advantages: The technical solution provided in this application, during the encoding of traffic features, uses the encoding precision corresponding to the traffic features to generate traffic feature codes, and converts the encoded traffic features into hexadecimal strings. This skips the cumbersome and inefficient "string-segmentation" stage used in existing technologies, directly compressing the traffic features into a fixed-length (encoded precision) underlying byte stream. This not only directly compresses the token length but also ensures the representation quality of network features in LLM through memory alignment and precision control. It effectively solves the problems of token inflation and numerical semantic distortion.

[0044] Reference Figure 5 This illustrates a flowchart of a traffic feature encoding method for large language models according to another embodiment of the present invention. The method may specifically include the following steps: Step 501: Determine the coding precision corresponding to the traffic characteristics.

[0045] In this embodiment, step 501 can first extract traffic features from the original network packets (pcap / json), and then determine the encoding precision corresponding to the traffic features.

[0046] In this embodiment, traffic characteristics may include, but are not limited to: source IP, destination port, TCP window size, packet length, etc.

[0047] The specific implementation method of step 501 in this embodiment can be found in step 101, and will not be repeated here.

[0048] Step 502: Encode the traffic features according to the encoding precision to generate traffic feature codes.

[0049] In this embodiment, the traffic feature encoding can be a binary representation of a 32-bit floating-point or fixed-point number.

[0050] The specific implementation method of step 502 in this embodiment can be found in step 102, and will not be repeated here.

[0051] Step 503: Convert the encoded traffic characteristics into a hexadecimal string.

[0052] For example, when the traffic characteristic is a response delay of 0.02534 seconds and the encoding precision is 2 bytes, step 502 can first scale and map 0.02534, for example, by multiplying by 10000 and taking the integer part, which is converted to 253; then, the 253 is encoded to generate the traffic characteristic encoding; step 503 converts the encoding corresponding to 253 into the hexadecimal string 0x00FD.

[0053] For example, when the traffic characteristics are a message length of 1500 and an encoding precision of 2 bytes, after encoding 1500 in step 502, step 503 can convert the encoding corresponding to 1500 into the hexadecimal string 0x05DC.

[0054] As shown in the two examples above, the hexadecimal string obtained in step 503, regardless of the numerical value of the traffic feature, always occupies only 2 bytes of space for each traffic feature. Compared to existing technologies, where stringifying to 1500 (4 characters) and 0.02534 (7 characters) might generate 5-8 tokens with variable lengths after tokenization, the input sequence length seen by the model during fine-tuning is reduced by more than 70%, and the positions are strictly aligned. This solves the problem of excessively long traffic feature token sequences and low information density caused by traditional text processing. Furthermore, it addresses the issue of excessive memory consumption caused by long sequences in LLM fine-tuning, which prevents large-batch training.

[0055] Step 504: Concatenate the hexadecimal strings corresponding to multiple traffic characteristics to generate a byte sequence.

[0056] In this embodiment, multiple traffic features can be heterogeneous features. Step 504 involves concatenating the hexadecimal strings corresponding to each traffic feature in sequence. This ensures that the token sequence generated for each traffic sample is physically aligned in memory, preventing fragmentation.

[0057] Step 505: Insert semantic tag bytes into the byte sequence. Semantic tag bytes are used to indicate the importance of traffic features.

[0058] The technical solutions provided in this application can achieve the following technical effects: 1. Extremely high memory efficiency: Through fixed-length compression, the number of training samples that can be accommodated under the same memory is increased by 2-4 times, which significantly reduces the hardware threshold for fine-tuning.

[0059] 2. Accelerated memory reads: Since the dataset is stored in the form of a fixed-length byte stream (contiguous memory), the I / O read efficiency of computing devices (GPU / NPU) is improved, and the preprocessing overhead is reduced to almost zero.

[0060] 3. Improved model accuracy: The hexadecimal fixed-length representation maintains the topological structure between features, enabling the model to more accurately capture minute numerical fluctuations (attack features) in encrypted traffic or complex protocols.

[0061] It should be noted that the technical solution provided in this embodiment, in the application scenario of online inference mapping for lightweight edge devices, for edge gateways with limited computing power (such as industrial firewalls), can directly output a compact binary tensor instead of generating a complete hexadecimal string during traffic feature encoding, and directly load the original bits into the memory cache. This further reduces the power consumption of the CPU when processing string conversion, thus making it more suitable for embedded scenarios.

[0062] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the present invention.

[0063] Based on the description of the above method embodiments, the present invention also provides corresponding embodiments of traffic feature encoding devices for large language models to implement the content described in the above method embodiments.

[0064] Reference Figure 6 The diagram illustrates the structure of a traffic feature encoding device for large language models according to an embodiment of the present invention. The device specifically includes the following modules: The first module 601 is used to determine the coding precision corresponding to the traffic characteristics; The second module 602 is used to encode the traffic features according to the encoding precision to generate traffic feature codes; The third module, 603, is used to convert the encoded traffic characteristics into hexadecimal strings.

[0065] Optionally, the first module 601 is further configured to obtain the importance coefficient of the traffic feature; and determine the coding precision corresponding to the traffic feature based on the importance coefficient.

[0066] Optionally, the first module 601 is further configured to classify the traffic features into important features and minor features according to the importance coefficient; assign high coding precision to the important features and low coding precision to the minor features.

[0067] Optionally, the second module 602 is further configured to, when the traffic feature is numerical, normalize the traffic feature, map it to a specified byte space for encoding, and generate traffic feature encoding.

[0068] Optionally, the third module 603 is further configured to concatenate the hexadecimal strings corresponding to multiple traffic features to generate a byte sequence; and insert semantic tag bytes into the byte sequence, wherein the semantic tag bytes are used to indicate the importance of the traffic features.

[0069] Compared with the prior art, the embodiments of the present invention have the following advantages: The technical solution provided in this application, during the encoding of traffic features, uses the encoding precision corresponding to the traffic features to generate traffic feature codes, and converts the encoded traffic features into hexadecimal strings. This skips the cumbersome and inefficient "string-segmentation" stage used in existing technologies, directly compressing the traffic features into a fixed-length (encoded precision) underlying byte stream. This not only directly compresses the token length but also ensures the representation quality of network features in LLM through memory alignment and precision control. It effectively solves the problems of token inflation and numerical semantic distortion.

[0070] Based on the description of the above method embodiments, the present invention also provides a corresponding embodiment of a traffic feature encoding system for large language models to achieve the content described in the above method embodiments.

[0071] Reference Figure 7 This diagram illustrates the structure of a traffic feature encoding system for a large language model according to an embodiment of the present invention. The system specifically includes: Traffic acquisition network element 701 is used to acquire raw traffic packets; The feature extraction server 702 is used to extract traffic features from the original traffic packets, determine the encoding precision corresponding to the traffic features, encode the traffic features according to the encoding precision, generate traffic feature codes, and convert the encoded traffic features into hexadecimal strings.

[0072] In this embodiment, the feature extraction server 702 can specifically be a high-performance computing server or a cloud container.

[0073] The traffic feature encoding system for large language models provided in this application embodiment is applied to the offline training and online fine-tuning stages of network security large language models. Particularly for scenarios involving encrypted traffic detection, malicious code identification, or automated auditing, the system may further include: Model training / fine-tuning points are used to receive hexadecimal strings from the feature extraction server 702 and perform weight updates for the large language model (such as LoRA or full parameter fine-tuning).

[0074] In this embodiment, the model training / fine-tuning point can specifically be a computing cluster equipped with multiple GPUs / NPUs.

[0075] Optionally, the feature extraction server 702 is further configured to obtain the importance coefficient of the traffic feature; and determine the encoding precision corresponding to the traffic feature based on the importance coefficient.

[0076] Optionally, the feature extraction server 702 is further configured to classify the traffic features into important features and minor features according to the importance coefficient; assign high coding precision to the important features and low coding precision to the minor features.

[0077] Optionally, the feature extraction server 702 is further configured to, when the traffic feature is numerical, normalize the traffic feature, map it to a specified byte space for encoding, and generate traffic feature encoding.

[0078] Optionally, the feature extraction server 702 is further configured to concatenate hexadecimal strings corresponding to multiple traffic features to generate a byte sequence; and insert semantic tag bytes into the byte sequence, wherein the semantic tag bytes are used to indicate the importance of the traffic features.

[0079] To enable those skilled in the art to more clearly understand the traffic feature encoding system for large language models provided in the embodiments of this application, specific embodiments are described below: In applications involving LLM memory optimization and fine-tuning for anomaly detection, when the traffic acquisition network element 701 receives a large-scale network security log or Pcap data stream to be trained, the feature extraction server 702 parses the raw network packets received by the traffic acquisition network element 701 and extracts two traffic features: For source port (category type). This represents the average message length (numerical). The feature extraction server 702 is designed for... Since the port range is fixed, encoding is performed. For example, if the current port is 80, the output is binary 01; for... (Message length is 1500), the mapping function is called, setting the encoding precision to precision=4, converting the decimal 1500 into a 32-bit floating-point or fixed-point binary representation. The feature extraction server 702 converts the binary bitstream obtained from the category encoding and fixed-length byte mapping into a hexadecimal string, such as 0x05DC. The feature extraction server 702 will... and The corresponding hexadecimal fragments are concatenated sequentially to ensure that the token sequence generated by each traffic sample is physically aligned in memory, preventing fragmentation. The feature extraction server 702 outputs the concatenated dataset to the model training / fine-tuning points as the input embedding of the LLM, used to fine-tune the model to learn attack patterns.

[0080] Compared with the prior art, the embodiments of the present invention have the following advantages: The technical solution provided in this application, during the encoding of traffic features, uses the encoding precision corresponding to the traffic features to generate traffic feature codes, and converts the encoded traffic features into hexadecimal strings. This skips the cumbersome and inefficient "string-segmentation" stage used in existing technologies, directly compressing the traffic features into a fixed-length (encoded precision) underlying byte stream. This not only directly compresses the token length but also ensures the representation quality of network features in LLM through memory alignment and precision control. It effectively solves the problems of token inflation and numerical semantic distortion.

[0081] This invention discloses an electronic device, including a processor and a non-transitory memory having instructions thereon, wherein the instructions, when executed by the processor, cause the processor to perform the aforementioned method.

[0082] This invention discloses a non-transitory computer-readable storage medium storing instructions that cause a processor to execute the aforementioned method.

[0083] Non-transitory memory: This refers to components or devices in computer hardware used for non-temporary storage of data and instructions. It emphasizes the "non-transitory" nature of the storage, meaning the data will not be lost due to momentary factors such as the disappearance of electrical signals. Examples include ROM (Read-Only Memory) and the storage chips in solid-state drives (SSDs), which can store data long-term.

[0084] Non-transitory computer-readable recording media: Physical carriers that can permanently store computer data and are readable. Data storage is stable and not temporary. Examples include hard drives, USB flash drives, and optical discs. They can store various types of data such as programs, documents, and videos. Even if the device is powered off or restarted, the data is still retained and can be accessed by the computer later.

[0085] Non-transitory computer-readable storage media: Part of the computer storage system, these are media capable of permanently storing computer-readable data, including hard drives, solid-state drives, and flash memory. Unlike transient storage, they can permanently or long-term retain data. Computers can read the stored instructions and data through corresponding interfaces and protocols for use in program execution, data processing, and other scenarios. For example, they store operation processing terminals, application code, and user files, providing stable data support for computer processing.

[0086] The device used for testing can be an electronic device. Figure 8 A schematic diagram of an electronic device 1100 according to an embodiment of the present invention is shown. The electronic device 1100 specifically includes: one or more processors 1102, a control module (chipset) 1104 coupled to at least one of the processors 1102, a memory 1106 coupled to the control module 1104, a non-volatile memory / storage device 1108 coupled to the control module 1104, one or more input / output devices 1110 coupled to the control module 1104, and a network interface 1112 coupled to the control module 1104.

[0087] Processor 1102 may include one or more single-core or multi-core processors, and processor 1102 may include any combination of general-purpose processors or special-purpose processors (e.g., graphics processors, application processors, baseband processors, etc.). In some embodiments, electronic device 1100 can serve as a terminal device, server (cluster), or other device as described in the embodiments of the present invention.

[0088] In some embodiments, electronic device 1100 may include one or more computer-readable media (e.g., memory 1106 or non-volatile memory / storage device 1108) having instructions 1114 and one or more processors 1102 that are combined with the one or more computer-readable media and configured to execute instructions 1114 to implement modules and thus perform the actions described in this disclosure.

[0089] In one embodiment, the control module 1104 may include any suitable interface controller to provide any suitable interface to at least one of the processors 1102 and / or any suitable device or component communicating with the control module 1104.

[0090] The control module 1104 may include a memory controller module to provide an interface to the memory 1106. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0091] Memory 1106 may be used, for example, to load and store data and / or instructions 1114 for electronic device 1100. In one embodiment, memory 1106 may include any suitable volatile memory, such as suitable DRAM (Dynamic Random Access Memory). In some embodiments, memory 1106 may include double data rate type quad synchronous dynamic random access memory.

[0092] In one embodiment, the control module 1104 may include one or more input / output controllers to provide an interface to the non-volatile memory / storage device 1108 and (one or more) input / output devices 1110.

[0093] For example, non-volatile memory / storage device 1108 may be used to store data and / or instructions 1114. Non-volatile memory / storage device 1108 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable (one or more) non-volatile storage devices (e.g., one or more hard disk drives, one or more optical disk drives, and / or one or more digital universal optical disk drives).

[0094] The non-volatile memory / storage device 1108 may include storage resources that are physically part of a device on which the electronic device 1100 is mounted, or that can be accessed by the device without being part of the device. For example, the non-volatile memory / storage device 1108 may be accessed via a network via one or more input / output devices 1110.

[0095] One or more input / output devices 1110 may provide an interface for electronic device 1100 to communicate with any other suitable device. Input / output devices 1110 may include communication components, audio components, sensor components, etc. Network interface 1112 may provide an interface for electronic device 1100 to communicate via one or more networks. Electronic device 1100 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, such as accessing wireless networks based on communication standards, such as WiFi (Wireless Fidelity), 2G (2-Generation wireless telephone technology), 3G (3-Generation wireless telephone technology), 4G (4-Generation wireless telephone technology), 5G (5-Generation wireless telephone technology), etc., or combinations thereof.

[0096] In one embodiment, at least one of the processors 1102 may be logically packaged with one or more controllers (e.g., memory controller modules) of the control module 1104. In one embodiment, at least one of the processors 1102 may be logically packaged with one or more controllers of the control module 1104 to form a processing-level package. In one embodiment, at least one of the processors 1102 may be logically integrated with one or more controllers of the control module 1104 on the same die. In one embodiment, at least one of the processors 1102 may be logically integrated with one or more controllers of the control module 1104 on the same die to form an on-chip processing layer.

[0097] In various embodiments, electronic device 1100 may be, but is not limited to, a server, desktop computing device, or mobile computing device (e.g., laptop computing device, handheld computing device, touchscreen device, netbook, etc.). In various embodiments, electronic device 1100 may have more or fewer components and / or different architectures. For example, in some embodiments, electronic device 1100 includes one or more cameras, a keyboard, a liquid crystal display screen (including a touchscreen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0098] This invention provides a machine-readable medium storing instructions that, when executed by one or more processors, cause an electronic device to perform one or more of the methods described in the above embodiments.

[0099] Optionally, the machine-readable medium may be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0100] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0101] It will be readily apparent to those skilled in the art that any combination of the above embodiments is feasible, and therefore any combination of the above embodiments constitutes an implementation of the present invention. However, due to space limitations, each embodiment will not be described in detail here. Although preferred embodiments of the present invention have been described, those skilled in the art, once they understand the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the present invention.

[0102] The present invention has provided a detailed description of a testing method, apparatus, device, and medium. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A traffic feature encoding method for large language models, characterized in that, The method includes: Determine the coding precision corresponding to the traffic characteristics; The traffic features are encoded according to the specified encoding precision to generate traffic feature codes; The encoded traffic characteristics are converted into hexadecimal strings.

2. The method according to claim 1, characterized in that, The coding precision corresponding to the determined traffic characteristics includes: Obtain the importance coefficient of traffic features; The coding precision corresponding to the traffic feature is determined based on the importance coefficient.

3. The method according to claim 2, characterized in that, The step of determining the coding precision corresponding to the traffic feature based on the importance coefficient includes: Based on the importance coefficient, the flow characteristics are classified into: important characteristics and minor characteristics; The important features are assigned high coding precision, and the minor features are assigned low coding precision.

4. The method according to claim 1, characterized in that, The step of encoding the traffic features according to the encoding precision to generate traffic feature codes includes: When the traffic feature is numerical, the traffic feature is normalized, mapped to a specified byte space for encoding, and a traffic feature code is generated.

5. The method according to claim 1, characterized in that, Also includes: Concatenate the hexadecimal strings corresponding to multiple traffic characteristics to generate a byte sequence; A semantic tag byte is inserted into the byte sequence. The semantic tag byte is used to indicate the importance of the traffic feature.

6. A traffic feature encoding device for large language models, characterized in that, The device includes: The first module is used to determine the coding precision corresponding to the traffic characteristics; The second module is used to encode the traffic features according to the encoding precision to generate traffic feature codes; The third module is used to convert the encoded traffic characteristics into hexadecimal strings.

7. A traffic feature encoding system for large language models, characterized in that, The system includes: Traffic acquisition network elements are used to obtain raw traffic packets; A feature extraction server is used to extract traffic features from the original traffic packets, determine the encoding precision corresponding to the traffic features, encode the traffic features according to the encoding precision, generate traffic feature codes, and convert the encoded traffic features into hexadecimal strings.

8. An electronic device comprising a processor and a non-transitory memory having instructions thereon, wherein the instructions, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 5.

9. A non-transitory computer-readable storage medium storing instructions that cause a processor to perform the method according to any one of claims 1-5.

10. A computer program product, characterized in that, The computer program product includes a computer program stored in a computer-readable storage medium, wherein a processor of an electronic device reads from and executes the computer program, causing the electronic device to perform the method of any one of claims 1 to 5.

Images