Distributed network traffic classification method, apparatus, and device, and storage medium

Abstract

The present application relates to the technical field of the Internet, and discloses a distributed network traffic classification method, apparatus, and device, and a storage medium. The method comprises: splitting an initial model into a plurality of classification paths, and on the basis of the plurality of classification paths, performing model recombination and model enhancement on the initial model to obtain a plurality of enhanced basic models; determining an enhanced basic model allocation solution by means of an allocation solution of a network offline stage and an allocation solution of a network online stage; and deploying the plurality of enhanced basic models into a plurality of switches on the basis of the enhanced basic model allocation solution, and classifying network traffic by means of the plurality of switches to obtain a classification result.

Description

Distributed network traffic classification method, device, equipment and storage medium

[0001] Related applications

[0002] This application claims priority to Chinese patent application No. 202311271277.3 filed on September 27, 2023, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of Internet technology, and in particular to a distributed network traffic classification method, apparatus, device and storage medium. Background Art

[0004] In recent years, machine learning-based network classification technology has been widely used in fields such as traffic classification, aiming to simplify network management, improve network service quality, and ensure network security.

[0005] Current network traffic classification solutions are all centralized, deploying complete but cumbersome models on a single switch. However, in practice, the limited resources of a single switch make it difficult to support the deployment of high-precision, large-scale models. Furthermore, for network-wide model deployment covering all traffic, repetitive deployment of the same model on multiple switches results in significant waste of network device resources processing traffic already handled by the first switch. Therefore, the industry urgently needs a method that can improve the accuracy of network traffic classification in scenarios with limited network resources.

[0006] The above content is only used to assist in understanding the technical solution of this application and does not constitute an admission that the above content is prior art.

[0007] Summary of the Invention

[0008] The main purpose of this application is to provide a distributed network traffic classification method, device, equipment and storage medium, aiming to solve the technical problem that the existing technology cannot improve the classification accuracy of network traffic classification in scenarios with limited network resources.

[0009] To achieve the above objectives, the present application provides a distributed network traffic classification method, which includes the following steps:

[0010] Splitting the initial model into multiple classification paths, and reorganizing and enhancing the initial model based on the multiple classification paths to obtain multiple enhanced basic models, wherein the initial model is used to perform centralized classification of network traffic;

[0011] Determine the enhanced basic model allocation scheme through the allocation scheme in the network offline phase and the allocation scheme in the network online phase;

[0012] The multiple enhanced basic models are deployed to multiple switches based on the enhanced basic model allocation scheme, and the network traffic is classified through the multiple switches to obtain classification results.

[0013] In one embodiment, the step of splitting the initial model into multiple classification paths includes:

[0014] Determining a flow set based on a flow sequence number of an original data packet, wherein the flow sequence number is obtained by performing a hash operation on a preset feature in the original data packet;

[0015] Extracting key flow-level features from the original data packets and constructing a training set based on the key flow-level features;

[0016] A tree-like ensemble model is generated based on the stream set and the training set, and the initial model is split into multiple classification paths through the tree-like ensemble model.

[0017] In one embodiment, the step of reorganizing and enhancing the initial model based on the multiple classification paths to obtain multiple enhanced basic models includes:

[0018] Storing the multiple classified paths in a path pool, and reorganizing the classified paths in the path pool to obtain multiple basic models;

[0019] Performing model screening on the multiple basic models to obtain a screened basic model;

[0020] The initial model is enhanced according to the filtered basic model and the priorities of the multiple classification paths to obtain an enhanced basic model.

[0021] In one embodiment, after the step of screening the multiple basic models to obtain the screened basic models, the method further includes:

[0022] Obtaining traffic subsets, sample true categories, and sample predicted categories corresponding to the multiple classification paths respectively;

[0023] Priorities of the multiple classification paths are calculated based on the traffic subset, the true category of the sample, and the predicted category of the sample.

[0024] In one embodiment, the step of determining the enhanced base model allocation scheme based on the allocation scheme in the network offline phase and the allocation scheme in the network online phase includes:

[0025] Calculating an objective function of the plurality of enhanced basic models in a network offline state based on topology awareness, and determining an allocation scheme for the network offline phase based on the objective function and a genetic algorithm;

[0026] Modeling the dynamic traffic transmission process of the multiple enhanced basic models when the network is online as a Markov decision process, and determining the allocation scheme in the online stage of the network based on the Markov decision process, wherein the Markov decision process is established based on a deep reinforcement learning method;

[0027] An enhanced basic model allocation scheme is determined based on the allocation scheme in the network offline phase and the allocation scheme in the network online phase.

[0028] In one embodiment, the step of deploying the multiple enhanced base models to multiple switches based on the enhanced base model allocation scheme, and classifying the network traffic through the multiple switches to obtain classification results includes:

[0029] converting classification paths in the plurality of enhanced base models into range matching rules based on the enhanced base model allocation scheme;

[0030] The range matching rule is deployed to a plurality of switches, and the network traffic is classified based on the range matching rule by the plurality of switches to obtain a classification result.

[0031] In one embodiment, the distributed network traffic classification method further includes:

[0032] When the current network resources of the switch change, obtaining the rule priority corresponding to the range matching rule contained in the switch;

[0033] The range matching rule is adjusted based on the rule priority to obtain an updated enhanced basic model.

[0034] In addition, to achieve the above objectives, the present application also proposes a distributed network traffic classification device, which includes:

[0035] A model processing module, configured to split an initial model into multiple classification paths, and reorganize and enhance the initial model based on the multiple classification paths to obtain multiple enhanced basic models, wherein the initial model is used to perform centralized classification of network traffic;

[0036] A scheme determination module is used to determine an enhanced basic model allocation scheme through the allocation scheme in the network offline phase and the allocation scheme in the network online phase;

[0037] A traffic classification module is used to deploy the multiple enhanced basic models to multiple switches based on the enhanced basic model allocation scheme, and classify the network traffic through the multiple switches to obtain classification results.

[0038] In addition, to achieve the above-mentioned purpose, the present application also proposes a distributed network traffic classification device, which includes: a memory, a processor, and a distributed network traffic classification program stored on the memory and runnable on the processor, and the distributed network traffic classification program is configured to implement the steps of the distributed network traffic classification method described above.

[0039] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, on which a distributed network traffic classification program is stored. When the distributed network traffic classification program is executed by a processor, the steps of the distributed network traffic classification method described above are implemented.

[0040] The present application obtains multiple enhanced basic models by splitting the initial model into multiple classification paths, and reorganizing and enhancing the initial model based on the multiple classification paths, wherein the initial model is set to centrally classify network traffic; determining the enhanced basic model allocation scheme through the allocation scheme of the network offline phase and the allocation scheme of the network online phase; deploying the multiple enhanced basic models to multiple switches based on the enhanced basic model allocation scheme, and classifying the network traffic through the multiple switches to obtain classification results. Compared with traditional network traffic classification methods, the above-mentioned method of the present application is based on reorganizing and enhancing the models of the multiple classification paths split from the initial model to obtain the enhanced basic model, and deploying the enhanced basic model to multiple switches based on the enhanced basic model allocation scheme, thereby classifying the network traffic through the multiple switches, thereby improving the classification accuracy of network traffic classification in scenarios with limited network resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] FIG1 is a schematic diagram of the structure of a distributed network traffic classification device in a hardware operating environment according to an embodiment of the present application;

[0042] FIG2 is a flow chart of a first embodiment of a distributed network traffic classification method of the present application;

[0043] FIG3 is a flow chart of a second embodiment of the distributed network traffic classification method of the present application;

[0044] FIG4 is a schematic diagram of a lightweight integrated general optional model design for the distributed network traffic classification method of the present application;

[0045] FIG5 is a flow chart of a third embodiment of the distributed network traffic classification method of the present application;

[0046] FIG6 is a structural block diagram of the first embodiment of the distributed network traffic classification device of the present application.

[0047] The realization of the objectives, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0048] It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application.

[0049] Refer to Figure 1, which is a schematic diagram of the structure of a distributed network traffic classification device in the hardware operating environment involved in the embodiment of the present application.

[0050] As shown in Figure 1, the distributed network traffic classification device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may include a standard wired interface and a wireless interface (such as a wireless fidelity (WI-FI) interface). The memory 1005 may be a high-speed random access memory (RAM) or a stable non-volatile memory (NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0051] Those skilled in the art will understand that the structure shown in FIG1 does not constitute a limitation on the distributed network traffic classification device, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0052] As shown in FIG. 1 , the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a distributed network traffic classification program.

[0053] In the distributed network traffic classification device shown in Figure 1, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the distributed network traffic classification device of the present application can be set in the distributed network traffic classification device, and the distributed network traffic classification device calls the distributed network traffic classification program stored in the memory 1005 through the processor 1001, and executes the distributed network traffic classification method provided in the embodiment of the present application.

[0054] An embodiment of the present application provides a distributed network traffic classification method. Referring to FIG. 2 , FIG. 2 is a flow chart of a first embodiment of the distributed network traffic classification method of the present application.

[0055] In this embodiment, the distributed network traffic classification method includes the following steps:

[0056] Step S10: splitting the initial model into multiple classification paths, and reorganizing and enhancing the initial model based on the multiple classification paths to obtain multiple enhanced basic models, wherein the initial model is used to perform centralized classification of network traffic.

[0057] It should be noted that the execution subject of the method of this embodiment can be a terminal device with model deployment, data processing and program execution functions, such as a smartphone, smart watch, etc., or an electronic device with the same or similar functions, such as the above-mentioned distributed network traffic classification device. The following uses the distributed network traffic classification device (hereinafter referred to as the classification device) as an example to illustrate this embodiment and the following embodiments.

[0058] It is understandable that the above-mentioned initial model can be a centralized classification model. This type of model usually deploys a complete but heavy model on a single switch, which makes it difficult to support the deployment of high-precision large-scale models. In addition, for the deployment of a full-network model covering all traffic, the same model is repeatedly deployed on multiple switches, resulting in a large amount of network equipment resources being wasted on processing traffic that has already been processed by the first switch.

[0059] It should be understood that the above classification path may refer to a series of classification categories that an entity or document passes through when being assigned to a specific classification.

[0060] In a specific implementation, the initial model can be restructured and enhanced by integrating a lightweight, universal, and optional model design module. More specifically, since different classification paths correspond to different traffic subsets, the initial model can be restructured into a coarse-grained model by combining these classification paths, and the resulting model can be enhanced into a fine-grained model.

[0061] Step S20: Determine the enhanced basic model allocation scheme based on the allocation scheme in the network offline phase and the allocation scheme in the network online phase.

[0062] It should be noted that the allocation scheme in the offline network phase may be the optimal allocation scheme for enhancing the basic model when the model is in the offline network phase, and the allocation scheme in the online network phase may be the optimal allocation scheme for enhancing the basic model.

[0063] In a specific implementation, when deploying a lightweight integrated universal optional model across the entire network, resource consumption, traffic coverage, and classification accuracy are important indicators for determining the optimal allocation scheme for the enhanced basic model. However, directly modeling the correspondence between the model allocation scheme and network traffic is challenging and unreliable. Due to the dynamic nature of traffic, the current allocation scheme may not be able to effectively adapt to future traffic. To overcome this problem, this embodiment can adopt a two-stage (i.e., the above-mentioned network offline stage and the network online stage) resource-aware model allocation strategy.

[0064] Step S30: deploying the multiple enhanced basic models to multiple switches based on the enhanced basic model allocation scheme, and classifying the network traffic through the multiple switches to obtain classification results.

[0065] It should be noted that the above-mentioned switch may be a network device for forwarding electrical (optical) signals, which may provide an exclusive electrical signal path for any two network nodes connected to the switch.

[0066] In the specific implementation, the lightweight integrated universal optional model in this embodiment is the core component of the classification device, so it is first compared with four traditional integrated models, namely random forest, extreme tree, adaptive boosting algorithm and gradient boosting decision tree. The focus of the comparison is on the number of classification paths required to achieve the same accuracy and F1 score. This embodiment conducts experiments on three public datasets, namely UNSW-NB15, BoT-IoT and CIC-IDS, to identify whether real-world traffic is malicious or benign. Each dataset is divided into two parts, 80% for training and 20% for testing. The lightweight integrated universal optional model can achieve the same performance level with fewer classification paths. The lightweight integrated universal optional model (W / O) represents a streamlined version without fine-grained model enhancement, while the lightweight integrated universal optional model (W / ) is the full version. Compared with random forest, both versions of the lightweight integrated universal optional model achieve the same accuracy while significantly reducing the number of classification paths. The lightweight integrated universal optional model (W / O) demonstrates the contribution of path-based model splitting and coarse-grained model reorganization in forming a lightweight base model and eliminating redundant information. Fine-grained model enhancement in the lightweight integrated universal optional model (W / ) further enhances the base model by inserting valuable paths as supplements to ensure the classification path's recognition capability. In contrast, the large size of traditional integrated models limits their practical deployment in programmable switches, forcing a compromise between model size and classification performance. The lightweight integrated universal optional model does not suffer from this limitation. Furthermore, since only one enhanced base model needs to be deployed on each switch, fewer resources are required.

[0067] In order to extend the lightweight integrated universal optional model to full network deployment and demonstrate the effectiveness and superiority of In-Forest (i.e., the model in the classification device of this embodiment), this embodiment uses UNSW-NB15 as the traffic dataset and Abilene as the network topology to simulate traffic transmission. Random forest and decision tree are selected for comparison to demonstrate the performance of the two-stage resource-aware model allocation. Since the existing solutions lack a full network distributed deployment mechanism, four deployment methods (Random Forest-100%, Random Forest-70%, Random Forest-20% and Decision Tree-100%) are added for expansion and used as baselines: (1) Random Forest-100%: Random Forest is deployed on all switches. (2) Random Forest-70% and Random Forest-20%: Random Forest is deployed on 70% or 20% of the switches. (3) Decision Tree-100%: Decision Tree is deployed on all switches. (4) In-Forest: An offline phase is used to select the optimal allocation scheme for the enhanced base model. Among them, In-Forest can achieve optimal model allocation by adjusting D and E to adapt to different resource scenarios, and achieve optimal model scaling through a lightweight model update mechanism. Larger D and E mean that the network has more hardware resources available for model deployment. Conversely, when resources are limited, network administrators will set smaller D and E. Compared with Random Forest-100%, In-Forest can improve accuracy while reducing the number of range matching rules. Compared with DT-100%, In-Forest has higher accuracy. Since the models are the same, traffic will not see any accuracy improvement after passing through multiple decision trees. In contrast, In-Forest can improve accuracy by aggregating the classification results of different enhanced base models and can cover all traffic without rescheduling.

[0068] This embodiment splits the initial model into multiple classification paths, and reorganizes and enhances the initial model based on the multiple classification paths to obtain multiple enhanced basic models. The initial model is used to centrally classify network traffic; the enhanced basic model allocation scheme is determined through the allocation scheme of the network offline phase and the allocation scheme of the network online phase; the multiple enhanced basic models are deployed to multiple switches based on the enhanced basic model allocation scheme, and the network traffic is classified through the multiple switches to obtain classification results. Compared with traditional network traffic classification methods, the above method of this embodiment is based on reorganizing and enhancing the multiple classification paths split from the initial model to obtain an enhanced basic model, and deploying the enhanced basic model to multiple switches based on the enhanced basic model allocation scheme, so that the network traffic is classified through the multiple switches, thereby improving the classification accuracy of network traffic classification in scenarios with limited network resources.

[0069] Refer to FIG3 , which is a flow chart of a second embodiment of the distributed network traffic classification method of the present application.

[0070] Based on the first embodiment, in this embodiment, in order to simplify the complex initial model into multiple classification paths, thereby preventing the initial model from occupying a large amount of network resources, step S10 may include:

[0071] Step S101: determining a flow set based on a flow sequence number of an original data packet, wherein the flow sequence number is obtained by performing a hash operation on a preset feature in the original data packet.

[0072] It should be understood that the above-mentioned flow sequence number is obtained by performing a hash operation on the preset features in the original data packet, where the preset features may include a five-tuple (IP address, source port, destination IP address, destination port and transport layer protocol).

[0073] In a specific implementation, the original data packets may be sorted according to the flow sequence number, and the original data packets in a specified sorting range (eg, the first 100 and the last 50) may be integrated to obtain the above flow set.

[0074] Step S102: extracting key flow-level features from the original data packet, and constructing a training set based on the key flow-level features.

[0075] It is understandable that the above-mentioned key flow level feature may be an average data packet length, or a minimum data packet length, a maximum data packet length, etc., and this embodiment does not impose any limitation on this.

[0076] Step S103: generating a tree-like integrated model based on the flow set and the training set, and splitting the initial model into multiple classification paths through the tree-like integrated model.

[0077] In a specific implementation, we can start from the first internal node (i.e., the root node) of the tree in the tree-like ensemble model and traverse a series of internal nodes in sequence. Each internal node contains a classification feature and a decision threshold. The sample feature is compared with the threshold to determine the direction of branching left or right. This branching process continues until a leaf node is reached, and each leaf node contains the classification result of the ensemble model. For each path from the root node to the leaf node in the ensemble model, it can be encoded as the above classification path.

[0078] In one implementation, in this embodiment, in order to improve the classification capability of the model through model reorganization and model enhancement, thereby achieving distributed deployment, the step S10 may further include:

[0079] Step S104: storing the multiple classified paths in a path pool, and reorganizing the classified paths in the path pool to obtain multiple basic models.

[0080] Step S105: performing model screening on the multiple basic models to obtain a screened basic model.

[0081] In a specific implementation, the aforementioned multiple base models can be filtered using a Top-K filtering method to obtain a filtered base model. The Top-K filtering method can be used to filter the top K most valuable or relevant data items from a large-scale dataset. More specifically, the Top-K filtering method sets a threshold K, sorts the data items in the dataset according to a certain metric, and selects the top K data items as the result. This metric can be a metric, rating, score, weight, or other importance indicator, depending on the specific scenario.

[0082] Step S106: performing model enhancement on the initial model according to the filtered basic model and the priorities of the multiple classification paths to obtain an enhanced basic model.

[0083] In the specific implementation, please refer to Figure 4, which is a schematic diagram of the design of a lightweight integrated general optional model for the distributed network traffic classification method of this application. The classification path of the combined model that is not selected by the Top-K filtering method still contains important value, such as path 4 in Figure 2. Path 4 accurately classifies samples 6 and 7 and can be used as a supplement to the basic model to correct misclassified samples. In this scenario, both path 3 and path 4 can process sample 6. However, considering that path 4 has a higher priority, it is selected to achieve accurate classification of sample 6. The same logic applies to sample 7. By combining the basic model with its corresponding supplement, an enhanced basic model can be formed. The lightweight integrated general optional model is obtained by integrating the enhanced basic model to avoid overfitting, thereby improving classification accuracy. It is worth noting that the classification path of the enhanced basic model will be converted into an interpretable range matching rule and deployed in the programmable switch.

[0084] Based on the first embodiment described above, in this embodiment, in order to sort the priorities of the classification paths so as to establish a model with better performance based on the classification paths with higher priorities, after step S105, the following steps may be further included:

[0085] Step S1051: Obtain the traffic subsets, sample true categories, and sample predicted categories corresponding to the multiple classification paths respectively.

[0086] Step S1052: Calculate the priorities of the multiple classification paths based on the traffic subset, the true category of the sample, and the predicted category of the sample.

[0087] In the specific implementation, in order to ensure better performance after integration, it is necessary to improve the performance of each basic model as much as possible. All classification paths are sorted in descending order according to the priority of the path. The priority calculation formula is as follows:

[0088] Among them, x j represents the traffic subset corresponding to path j, y and represent the true category and predicted category of the sample respectively.

[0089] This embodiment determines a flow set based on the flow sequence number of the original data packet, and the flow sequence number is obtained by performing a hash operation on the preset features in the original data packet; extracts key flow-level features from the original data packet, and constructs a training set based on the key flow-level features; generates a tree-like integration model based on the flow set and the training set, and splits the initial model into multiple classification paths through the tree-like integration model; stores the multiple classification paths in a path pool, and reorganizes the classification paths in the path pool to obtain multiple basic models; performs model screening on the multiple basic models to obtain a screened basic model; performs model enhancement on the initial model according to the screened basic model and the priorities of the multiple classification paths to obtain an enhanced basic model; obtains the traffic subsets, sample true categories and sample predicted categories corresponding to the multiple classification paths respectively; and calculates the priorities of the multiple classification paths based on the traffic subsets, the sample true categories and the sample predicted categories. Compared with traditional network traffic classification methods, the above method in this embodiment simplifies the complex initial model into multiple classification paths, thereby avoiding the initial model from occupying a large amount of network resources, and improves the classification ability of the model through model reorganization and model enhancement, thereby realizing the distributed deployment of the enhanced basic model.

[0090] Refer to FIG5 , which is a flow chart of a third embodiment of the distributed network traffic classification method of the present application.

[0091] Based on the above embodiments, in this embodiment, in order to allocate a suitable enhanced basic model to classify corresponding network traffic, thereby improving classification accuracy, step S20 may include:

[0092] Step S201: Calculating the objective function of the plurality of enhanced basic models in a network offline state based on topology awareness, and determining an allocation scheme in the network offline stage based on the objective function and a genetic algorithm.

[0093] In the specific implementation, this embodiment uses an offline phase to obtain topology-aware model allocation solutions under different resource scenarios, where traffic coverage is converted to path coverage between subnet pairs, and classification accuracy is converted to enhancing the diversity of the basic model on all paths. Then, the model allocation problem can be simplified as follows:

[0094] Where W can represent the number of switches, B can represent the number of enhanced basic models, N can represent the number of subnet pairs, D can represent the maximum number of deployable switches, and E can represent the maximum number of range matching rules that can be stored in the entire network. It can indicate whether to deploy the enhanced basic model on the switch. n It can represent the selected path between subnet pair n, e b The number of rules that can be used to enhance the base model b.

[0095] It can be understood that the above objective function is to optimize the path coverage and model diversity while minimizing the required range matching rules. D represents the variable used to determine the model allocation scheme. n is a one-dimensional vector of length W encoded with binary values, indicating whether switch w is on the selected path between subnet pair n. The function Step(·) converts values ​​greater than 0 to 1 and all other values ​​to 0. To ensure comparability among the three metrics in the objective function, they are normalized to the range [0, 1]. α1, α2, and α3 are the weights of the metrics, with values ​​of α1 = 0.6, α2 = 0.2, and α3 = 0.2. By adjusting D and E, model allocation solutions can be obtained for different resource scenarios.

[0096] In a specific implementation, the above-mentioned genetic algorithm can be used. A population containing many D with different values ​​is randomly generated, and each D is flattened into a one-dimensional vector of length W×B. Each vector represents a candidate solution and is evaluated by fitness (i.e., the objective function in the model allocation problem). The population is iteratively evolved, and solutions with higher fitness are more likely to reproduce offspring in the next iteration. Offspring are generated through crossover and mutation, replacing some existing solutions to maintain the population size. The process is iterated until the fitness converges. For solutions that do not meet the constraints, a large negative value is assigned to the fitness. The solution with the highest fitness is considered to be the allocation solution for the above-mentioned network offline phase.

[0097] Step S202: Modeling the dynamic traffic transmission process of the multiple enhanced basic models when the network is online as a Markov decision process, and determining the allocation plan of the network online stage based on the Markov decision process, wherein the Markov decision process is established based on a deep reinforcement learning method.

[0098] In a specific implementation, traffic transmission can be modeled as a Markov decision process to effectively utilize deep reinforcement learning methods. The Markov decision process is defined by a four-tuple (S, A, R, T), where S represents the state space, A represents the action space, R represents the reward space, and T represents the state transition probability. At time step t, the classification device receives network information s t , determine the model allocation scheme a t , then get reward r t The Markov decision process aims to find the optimal policy that maximizes the objective function. It is efficiently solved using the proximal policy optimization algorithm, known for improving sampling efficiency and reducing training variance. Importance sampling is used to effectively utilize data sampled from old policy parameters.

[0099] In state space, flow characteristics (a five-tuple of data per flow), traffic distribution (number of flows in a link), and the current model allocation scheme are considered. The action output of each switch is a vector of length B + 1. The first B dimensions represent the probability of deployment of each enhanced base model, while the last dimension represents the probability of non-deployment. To determine the allocation scheme during the online phase of the network, the actions with the highest probability are selected for each switch and combined into a global action.

[0100] Step S203: Determine an enhanced basic model allocation scheme based on the allocation scheme in the network offline phase and the allocation scheme in the network online phase.

[0101] In the specific implementation, a stable learning mechanism is employed to ensure the effectiveness of the online phase. The deployed switches are determined during the offline phase, and the enhanced base model on these switches is then adjusted during the online phase. This reduces the dimensionality of the action space, enabling faster convergence. Furthermore, the allocation scheme from the offline phase serves as the initial value for the proximal policy optimization algorithm, which further explores and refines it. If the action output does not outperform the offline phase, the model allocation scheme remains unchanged. The online phase scheme must also meet constraints. For schemes that perform worse than the offline phase or fail to meet constraints, a penalty is added to the reward.

[0102] Based on the above embodiments, in this embodiment, to ensure that corresponding rules are deployed in each switch, so that multiple switches can independently solve the classification task and further improve the classification efficiency, step S30 may include:

[0103] Step S301: converting the classification paths in the plurality of enhanced basic models into range matching rules based on the enhanced basic model allocation scheme.

[0104] In a specific implementation, each enhanced base model can be translated into a single matching action table that matches all features. Each classification path in the enhanced base model is converted into a range matching rule and stored in the table. This model representation ensures flexibility in model updates. Specifically, data features are mapped to numerical ranges and represented as an interpretable range matching rule, which is then implemented in the programmable switch.

[0105] For example, if the enhanced base model classifies data with feature u1≤5 and feature u2>7 as benign (represented by category 1), then the following rule can be obtained:

[0106] if u1∈[a,5],u2∈(7,b],then category←1.

[0107] Step S302: deploying the range matching rule to multiple switches, and classifying the network traffic based on the range matching rule by the multiple switches to obtain classification results.

[0108] It should be understood that the packet header field can be used to record the classification results of the model deployed on the previous switch. Specifically, the variable prob is initialized with the value of H, which represents the maximum number of switches between the subnet pair. In the anomaly detection task, if the enhanced base model classifies the incoming flow as malicious, prob is increased by 1. Subsequently, the value of prob is checked. If prob exceeds H, it means that at least one model predicts that the flow is malicious, and the larger the prob, the higher the confidence. On the contrary, if prob is less than H, it means that at least two previous models classify the flow as benign, which means that the current model result may be wrong, and the result will be corrected subsequently by majority voting. When prob is equal to H, the forwarding of the flow will continue, indicating that the class of the flow cannot be determined at this time. The comparison of prob can be achieved through range matching rules.

[0109] In a specific implementation, the aforementioned range matching rules can be installed in the match action table of a programmable switch. Subsequently, using a program to specify the packet header field of the data, the switch's parser will parse the incoming switch data according to the program's instructions to extract the required data features. Then, based on the range matching rules stored in the match action table, the data is matched and the corresponding actions are executed, achieving data classification. By storing different range matching rules in the match action table, line-speed packet processing is achieved.

[0110] Based on the above embodiments, in this embodiment, in order to improve the efficiency and flexibility of model updating, the distributed network traffic classification method may further include:

[0111] Step S40: When the current network resources of the switch change, the rule priority corresponding to the range matching rule contained in the switch is obtained.

[0112] Step S50: adjusting the range matching rule based on the rule priority to obtain an updated enhanced basic model.

[0113] It should be understood that in order to enhance the flexibility of model deployment, this embodiment introduces a lightweight model update mechanism. Each range matching rule is obtained from the conversion of the classification path, and the range matching rule obtained after the conversion of the classification path with a higher priority also has a higher priority. The range matching rule with a higher priority will give priority to matching the packet header vector. When the available resources change, optimal model scaling can be achieved by adding (or deleting) range matching rules with higher (or lower) priorities. In the online phase, it is critical to ensure that the model is updated in time to respond to dynamic traffic changes. For the enhanced base model on each switch, it can be updated with another model with the same number of range matching rules. This update can be done by changing the range matching rules individually, without the need to restart the switch.

[0114] This embodiment calculates the objective functions of the multiple enhanced basic models in the network offline state based on topology awareness, and determines the allocation scheme in the network offline stage based on the objective function and the genetic algorithm; models the dynamic traffic transmission process of the multiple enhanced basic models in the network online state as a Markov decision process, and determines the allocation scheme in the network online stage based on the Markov decision process, and the Markov decision process is established based on the deep reinforcement learning method; determines the enhanced basic model allocation scheme based on the allocation scheme in the network offline stage and the allocation scheme in the network online stage; converts the classification paths in the multiple enhanced basic models into range matching rules based on the enhanced basic model allocation scheme; deploys the range matching rules to multiple switches, and classifies the network traffic based on the range matching rules through the multiple switches to obtain classification results; when the current network resources of the switch change, obtains the rule priority corresponding to the range matching rule contained in the switch; adjusts the range matching rule based on the rule priority to obtain an updated enhanced basic model. Compared with the traditional distributed network traffic classification method, the above method of this embodiment improves the classification accuracy by assigning a suitable enhanced basic model to classify the corresponding network traffic; and adjusts the range matching rules corresponding to the enhanced basic model in the switch based on the rule priority, thereby improving the efficiency and flexibility of the model update.

[0115] In addition, an embodiment of the present application further proposes a storage medium on which a distributed network traffic classification program is stored. When the distributed network traffic classification program is executed by a processor, the steps of the distributed network traffic classification method described above are implemented.

[0116] Refer to FIG. 6 , which is a structural block diagram of the first embodiment of the distributed network traffic classification device of the present application.

[0117] As shown in FIG6 , the distributed network traffic classification device proposed in the embodiment of the present application includes:

[0118] A model processing module 601 is configured to split an initial model into multiple classification paths, and reorganize and enhance the initial model based on the multiple classification paths to obtain multiple enhanced basic models. The initial model is used to perform centralized classification of network traffic.

[0119] A scheme determination module 602 is configured to determine an enhanced basic model allocation scheme based on the allocation scheme in the network offline phase and the allocation scheme in the network online phase;

[0120] The traffic classification module 603 is configured to deploy the multiple enhanced basic models to multiple switches based on the enhanced basic model allocation solution, and classify the network traffic through the multiple switches to obtain classification results.

[0121] This embodiment splits the initial model into multiple classification paths, and reorganizes and enhances the initial model based on the multiple classification paths to obtain multiple enhanced basic models. The initial model is used to centrally classify network traffic; the enhanced basic model allocation scheme is determined through the allocation scheme of the network offline phase and the allocation scheme of the network online phase; the multiple enhanced basic models are deployed to multiple switches based on the enhanced basic model allocation scheme, and the network traffic is classified through the multiple switches to obtain classification results. Compared with traditional network traffic classification methods, the above method of this embodiment is based on reorganizing and enhancing the multiple classification paths split from the initial model to obtain an enhanced basic model, and deploying the enhanced basic model to multiple switches based on the enhanced basic model allocation scheme, so that the network traffic is classified through the multiple switches, thereby improving the classification accuracy of network traffic classification in scenarios with limited network resources.

[0122] Based on the first embodiment of the distributed network traffic classification device of the present application, a second embodiment of the distributed network traffic classification device of the present application is proposed.

[0123] In this embodiment, the model processing module 601 is also used to determine a flow set based on the flow sequence number of the original data packet, where the flow sequence number is obtained by performing a hash operation on preset features in the original data packet; extract key flow-level features from the original data packet, and construct a training set based on the key flow-level features; generate a tree-like integration model based on the flow set and the training set, and split the initial model into multiple classification paths through the tree-like integration model.

[0124] In one embodiment, the model processing module 601 is also used to store the multiple classification paths in a path pool, and reorganize the classification paths in the path pool to obtain multiple basic models; perform model screening on the multiple basic models to obtain screened basic models; and perform model enhancement on the initial model according to the screened basic model and the priority of the multiple classification paths to obtain an enhanced basic model.

[0125] In one embodiment, the model processing module 601 is also used to obtain the traffic subsets, sample true categories and sample predicted categories corresponding to the multiple classification paths respectively; and calculate the priorities of the multiple classification paths based on the traffic subsets, the sample true categories and the sample predicted categories.

[0126] In one embodiment, the scheme determination module 602 is also used to calculate the objective function of the multiple enhanced basic models when they are in a network offline state based on topology perception, and determine the allocation scheme of the network offline stage based on the objective function and the genetic algorithm; model the dynamic traffic transmission process of the multiple enhanced basic models when they are in a network online state as a Markov decision process, and determine the allocation scheme of the network online stage based on the Markov decision process, and the Markov decision process is established based on a deep reinforcement learning method; determine the enhanced basic model allocation scheme based on the allocation scheme of the network offline stage and the allocation scheme of the network online stage.

[0127] In one embodiment, the traffic classification module 603 is further used to convert the classification paths in the multiple enhanced basic models into range matching rules based on the enhanced basic model allocation scheme; deploy the range matching rules to multiple switches, and classify the network traffic based on the range matching rules through the multiple switches to obtain classification results.

[0128] In one embodiment, the traffic classification module 603 is further used to obtain the rule priority corresponding to the range matching rule contained in the switch when the current network resources of the switch change; adjust the range matching rule based on the rule priority to obtain an updated enhanced basic model.

[0129] Other embodiments or specific implementations of the distributed network traffic classification device of the present application can refer to the above-mentioned method embodiments and will not be repeated here.

[0130] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0131] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0132] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as read-only memory / random access memory, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0133] The above are merely optional embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A distributed network traffic classification method, wherein: The method comprises the following steps: Splitting the initial model into multiple classification paths, and reorganizing and enhancing the initial model based on the multiple classification paths to obtain multiple enhanced basic models, wherein the initial model is used to perform centralized classification of network traffic; Determine the enhanced basic model allocation scheme through the allocation scheme in the network offline phase and the allocation scheme in the network online phase; The multiple enhanced basic models are deployed to multiple switches based on the enhanced basic model allocation scheme, and the network traffic is classified through the multiple switches to obtain classification results.

2. The distributed network traffic classification method according to claim 1, wherein: The step of splitting the initial model into multiple classification paths includes: Determine a flow set based on a flow sequence number of an original data packet, wherein the flow sequence number is obtained by performing a hash operation on a preset feature in the original data packet; Extracting key stream-level features from the original data packets, and constructing a training set based on the key stream-level features; A tree-like integrated model is generated based on the stream set and the training set, and the initial model is split into multiple classification paths through the tree-like integrated model.

3. The distributed network traffic classification method according to claim 2, wherein: The step of reorganizing and enhancing the initial model based on the multiple classification paths to obtain multiple enhanced basic models includes: The multiple classification paths are stored in a path pool, and the classification paths in the path pool are reorganized to obtain multiple basic models; Performing model screening on the multiple basic models to obtain screened basic models; The initial model is enhanced according to the filtered basic model and the priorities of the multiple classification paths to obtain an enhanced basic model.

4. The distributed network traffic classification method according to claim 3, wherein: After the step of screening the multiple basic models to obtain the screened basic models, the method further includes: Obtaining the traffic subsets, sample real categories, and sample predicted categories respectively corresponding to the multiple classification paths; Priorities of the multiple classification paths are calculated based on the traffic subset, the true category of the sample, and the predicted category of the sample.

5. The distributed network traffic classification method according to any one of claims 1 to 4, wherein: The step of determining the enhanced basic model allocation scheme through the allocation scheme in the network offline phase and the allocation scheme in the network online phase includes: Calculate the objective function of the multiple enhanced basic models in a network offline state based on topology awareness, and determine the allocation scheme for the network offline stage based on the objective function and the genetic algorithm; The dynamic traffic transmission process of the multiple enhanced basic models in the online state of the network is modeled as a Markov A decision-making process, and determining an allocation scheme for an online phase of the network based on the Markov decision process, wherein the Markov decision process is established based on a deep reinforcement learning method; An enhanced basic model allocation scheme is determined based on the allocation scheme in the network offline phase and the allocation scheme in the network online phase.

6. The distributed network traffic classification method according to any one of claims 1 to 4, wherein: The step of deploying the plurality of enhanced basic models to a plurality of switches based on the enhanced basic model allocation scheme, and classifying the network traffic through the plurality of switches to obtain classification results comprises: converting classification paths in the plurality of enhanced base models into range matching rules based on the enhanced base model allocation scheme; The range matching rule is deployed to a plurality of switches, and the network traffic is classified based on the range matching rule by the plurality of switches to obtain a classification result.

7. The distributed network traffic classification method according to any one of claims 1 to 4, wherein: The method further comprises: When the current network resources of the switch change, obtaining the rule priority corresponding to the range matching rule contained in the switch; The range matching rule is adjusted based on the rule priority to obtain an updated enhanced basic model.

8. A distributed network traffic classification device, wherein: The distributed network traffic classification device comprises: A model processing module, used for splitting the initial model into multiple classification paths, and reorganizing and enhancing the initial model based on the multiple classification paths to obtain multiple enhanced basic models, wherein the initial model is used for centralized classification of network traffic; A scheme determination module, used for determining an enhanced basic model allocation scheme through an allocation scheme in a network offline phase and an allocation scheme in a network online phase; The traffic classification module is used to deploy the multiple enhanced basic models to multiple switches based on the enhanced basic model allocation scheme, and classify the network traffic through the multiple switches to obtain classification results.

9. A distributed network traffic classification device, wherein: The device comprises: a memory, a processor, and a distributed network traffic classification program stored in the memory and executable on the processor, wherein the distributed network traffic classification program is configured to implement the steps of the distributed network traffic classification method according to any one of claims 1 to 7.

10. A storage medium, wherein: The storage medium stores a distributed network traffic classification program, which, when executed by a processor, implements the steps of the distributed network traffic classification method according to any one of claims 1 to 7.

Images