Traffic detection method, communication device, and storage medium

Abstract

Embodiments of the present application provide a traffic detection method, a communication device, and a storage medium. The method comprises: first collecting traffic, and determining an application attribute of the traffic (110); then, determining a target traffic type detection threshold corresponding to the application attribute (120); and performing traffic detection for the application attribute on the basis of the target traffic type detection threshold (130).

Description

Traffic detection methods, communication equipment and storage media

[0001] Cross-references to related applications

[0002] This application is based on and claims priority to Chinese Patent Application No. 202510139684.1, filed on February 8, 2025, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of communication technology, and in particular to a traffic detection method, communication device and storage medium. Background Technology

[0004] With the continuous growth of network traffic and the diversification of Internet applications, the problem of elephant flow in the network has become increasingly prominent. In order to suppress the problems caused by elephant flow, it is necessary to detect elephant flow and implement corresponding traffic control strategies.

[0005] Existing elephant flow detection methods typically rely on static threshold settings. However, in reality, different types of users have different traffic usage needs, and there are differences in traffic between different application types. These factors make static thresholds unsuitable for elephant flow detection targeting different attributes, resulting in inaccurate elephant flow detection. Summary of the Invention

[0006] This application provides a traffic detection method, a communication device, and a storage medium.

[0007] In a first aspect, embodiments of this application provide a traffic detection method, the method comprising:

[0008] Traffic is collected to determine the application attributes of the traffic;

[0009] Determine the target traffic type detection threshold corresponding to the application attribute;

[0010] Traffic detection is performed on the application attributes based on the target traffic type detection threshold.

[0011] Secondly, embodiments of this application provide a communication device, including:

[0012] One or more processors;

[0013] A memory having stored one or more computer programs that, when executed by one or more processors, cause the one or more processors to implement the traffic detection method as described in the first aspect.

[0014] Thirdly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the traffic detection method as described in the first aspect.

[0015] Fourthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the traffic detection method as described in the first aspect. Attached Figure Description

[0016] Figure 1 is a flowchart illustrating a traffic detection method provided in an embodiment of this application;

[0017] Figure 2 is a flowchart of an embodiment of a sub-step of step 120 in Figure 1;

[0018] Figure 3 is a flowchart of an embodiment of a sub-step of step 220 in Figure 2;

[0019] Figure 4 is a flowchart of an embodiment of a sub-step of step 330 in Figure 3;

[0020] Figure 5 is a flowchart of an embodiment of a sub-step of step 430 in Figure 4;

[0021] Figure 6 is a flowchart of an embodiment of a sub-step of step 520 in Figure 5;

[0022] Figure 7 is a network device architecture diagram for implementing a traffic detection method according to an embodiment of this application;

[0023] Figure 8 is an information interaction diagram of a specific embodiment of the network device based on Figure 7 in this application;

[0024] Figure 9 is a schematic diagram of the structure of a communication device provided in an embodiment of this application. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0026] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0027] In this application, the terms "furthermore," "exemplarily," or "optionally" are used as examples, illustrations, or descriptions and should not be construed as being more preferred or advantageous than other embodiments or designs. The use of terms such as "furthermore," "exemplarily," or "optionally" is intended to present the relevant concepts in a specific manner.

[0028] Existing elephant flow detection methods typically rely on static threshold settings. However, in reality, different types of users have different traffic usage needs, and there are differences in traffic between different application types. These factors make static thresholds unsuitable for elephant flow detection targeting different attributes, resulting in inaccurate elephant flow detection.

[0029] To improve the adaptability of the elephant flow detection threshold to traffic with different attributes, thereby enhancing the accuracy of elephant flow detection for traffic with varying attributes, this application provides a traffic detection method, communication device, computer-readable storage medium, and computer program product. The method first collects traffic and determines its application attributes. Then, it determines a target traffic type detection threshold corresponding to the application attribute. Finally, it performs traffic detection based on the target traffic type detection threshold for the application attribute. By determining the application attribute of the traffic, a target traffic type detection threshold suitable for that application attribute in the current traffic usage can be determined. This allows for accurate identification of elephant flows based on the target traffic type detection threshold during application attribute-based traffic detection, effectively improving the adaptability of the elephant flow detection threshold to traffic with different attributes, and thus enhancing the accuracy of elephant flow detection for traffic with different attributes.

[0030] Referring to Figure 1, which illustrates a traffic detection method provided in an embodiment of this application, the traffic detection method in Figure 1 can be applied to network devices. These network devices can be core network devices, backbone network routers, or devices composed of multiple sub-devices, etc., and are not specifically limited here. The traffic detection method in Figure 1 may include steps 110 to 130.

[0031] Step 110: Collect traffic data and determine its application attributes;

[0032] Step 120: Determine the target traffic type detection threshold corresponding to the application attribute;

[0033] Step 130: Perform traffic detection based on application attributes according to the target traffic type detection threshold.

[0034] In one embodiment, collecting traffic data and determining its application attributes refers to the operation of collecting traffic data and determining its application attributes based on the collected data. The collected data may include user ID, traffic data volume, transmission rate, etc., but is not specifically limited here.

[0035] In one embodiment, application attributes refer to information used to define the purpose, source, and user of the traffic. These application attributes are carried by the traffic itself and can be determined from the traffic using techniques such as Deep Packet Inspection (DPI). The application attributes may include at least one of the following: traffic application type and traffic user attributes. The traffic application type refers to information defining the purpose of the traffic type, such as high-definition video streaming, file download, VR, etc., without specific limitations. The traffic user attributes refer to information defining the nature of the user using the traffic, such as the user being located in a specific region, or a user with low / high data volume, without specific limitations.

[0036] In one embodiment, the application attribute of traffic can be either traffic application type or traffic user attribute, or it can be a combination of traffic application type and traffic user attribute (e.g., identifying a high-definition video stream traffic belonging to a high-data-volume user). For network devices, these specific application attributes can be used in combination, and no specific limitation is made here. For example, a network device can uniformly use either traffic application type or traffic user attribute as a specific traffic attribute; as another example, a network device can define traffic using at least two of the following: traffic application type, traffic user attribute, and combined attribute.

[0037] In one embodiment, determining the target traffic type detection threshold corresponding to an application attribute refers to calculating a target traffic type detection threshold suitable for the application attribute under the current traffic usage conditions, based on the application attribute. Here, the target traffic type detection threshold refers to an elephant flow detection threshold suitable for the application attribute under the current traffic usage conditions; the target traffic type detection threshold is not a preset value but a calculated value. Furthermore, the data source used to determine the target traffic type detection threshold corresponding to the application attribute can be a pre-set calculation base value, or the traffic rate and data volume of the application attribute during collection, etc., etc., and is not specifically limited here.

[0038] In one embodiment, after determining the application attributes of multiple traffic flows, in the process of determining the target traffic type detection threshold corresponding to the application attribute, the target traffic type detection threshold corresponding to each application attribute can be determined separately.

[0039] In one embodiment, performing traffic detection for application attributes based on the target traffic type detection threshold means updating the threshold currently corresponding to the application attribute of the collected traffic to the target traffic type detection threshold, and when detecting the application attribute, using the target traffic type detection threshold currently corresponding to the application attribute to detect whether the traffic of the application attribute is an elephant flow.

[0040] In one embodiment, after determining the application attributes of multiple traffic flows, during the process of traffic detection based on the target traffic type detection threshold, specifically, one application attribute corresponding to a traffic flow among various application attributes can be determined first. When the detection threshold corresponding to this application attribute is updated to the target traffic type detection threshold corresponding to the application attribute, the target traffic type detection threshold corresponding to the application attribute is used to perform elephant flow detection on the traffic flow. When the detection threshold corresponding to this application attribute is not updated to the target traffic type detection threshold corresponding to the application attribute, the target traffic type detection threshold corresponding to the application attribute is used to perform elephant flow detection on the traffic flow.

[0041] For ease of description, the following example illustrates various embodiments of the target traffic type detection threshold for a single application attribute. In scenarios where multiple application attributes are determined, the following embodiments can be used to execute the process for each application attribute to obtain the target traffic type detection threshold corresponding to each application attribute. These will not be elaborated upon here.

[0042] Referring to Figure 2, Figure 2 illustrates the flow of an embodiment of a sub-step of step 120 in Figure 1. In one embodiment, step 120 may include the following sub-steps.

[0043] Step 210: Determine the reference threshold and evaluation threshold for traffic type detection corresponding to the application attribute. The reference threshold and evaluation threshold for traffic type detection are different.

[0044] Step 220: Based on the traffic type detection reference threshold and the traffic type detection evaluation threshold, correct the traffic type detection evaluation threshold to obtain the target traffic type detection threshold for the application attribute.

[0045] In one embodiment, the traffic type detection reference threshold is a threshold used to determine the reference traffic type (i.e., the first traffic type mentioned below) of the collected traffic. The first traffic type determined by the traffic type detection reference threshold can serve as a reference for the estimated result of the second traffic type obtained by the traffic type detection evaluation threshold, thereby assisting in correcting the traffic type detection evaluation threshold. Here, traffic type refers to whether the currently collected traffic belongs to an elephant flow or a non-elephant flow. Furthermore, the traffic type detection reference threshold can be a preset value, the currently used detection threshold, etc., and is not specifically limited here.

[0046] In one embodiment, the traffic type detection and evaluation threshold refers to a threshold used to estimate the traffic type (i.e., the second traffic type mentioned below) of the collected traffic. The second traffic type can be referenced by the first traffic type to assist in correcting the traffic type detection and evaluation threshold. The traffic type detection and evaluation threshold is a preset value, and there can be one or more thresholds; this is not specifically limited here. Furthermore, when there are multiple traffic type detection and evaluation thresholds, the correction performed after each traffic collection is for one of the thresholds. The corrected threshold can be randomly selected, or it can be selected based on preset conditions (such as the median of multiple thresholds based on the number of times it has been selected), etc., and this is not specifically limited here. For ease of description, except for the embodiments specifically describing the case of multiple traffic type detection and evaluation thresholds, other embodiments are for a single traffic type detection and evaluation threshold. For cases involving multiple traffic type detection and evaluation thresholds, the execution method for a single traffic type detection and evaluation threshold below can be referred to multiple times, which will not be elaborated here.

[0047] For example, suppose the reference threshold for traffic type detection is A, and the evaluation threshold for traffic type detection is only set to B. Then, B is the object to be corrected later. A plays an auxiliary role in the correction process and will not be corrected. For example, if the first traffic type is determined by A and the second traffic type is determined by B, since B has not been adjusted at this time, the second traffic type determined by B is the estimated traffic type. Then, B can be corrected by the first and second traffic types (that is, the embodiment shown in Figure 3 below) so that the estimated traffic type after B is corrected is more consistent with the current traffic usage of the application attribute. The result after B is corrected is the target traffic type detection threshold mentioned above.

[0048] In one embodiment, the traffic type detection reference threshold may include one of the following: a traffic data volume reference threshold, a traffic transmission rate reference threshold, or a combined reference threshold obtained by combining the traffic data volume reference threshold and the traffic transmission rate reference threshold. The traffic data volume reference threshold is a threshold used to determine the traffic type (i.e., the third evaluation traffic type mentioned below) of the collected traffic based on its data volume, and the traffic transmission rate reference threshold is a threshold used to determine the traffic type (i.e., the fourth evaluation traffic type mentioned below) of the collected traffic based on its data transmission rate. Furthermore, the combined reference threshold refers to a two-dimensional threshold matrix that includes the traffic data volume reference threshold and the traffic transmission rate reference threshold.

[0049] In one embodiment, the traffic type detection and evaluation threshold may include one of the following: a traffic data volume evaluation threshold, a traffic transmission rate evaluation threshold, or a combined evaluation threshold obtained by combining the traffic data volume evaluation threshold and the traffic transmission rate evaluation threshold. The traffic data volume evaluation threshold is a threshold used to determine the traffic type (i.e., the first evaluated traffic type hereinafter referred to as the first evaluation traffic type) of the collected traffic based on its data volume, and the traffic transmission rate evaluation threshold is a threshold used to determine the traffic type (i.e., the second evaluation traffic type hereinafter referred to as the second evaluation traffic type) of the collected traffic based on its data transmission rate. Furthermore, the combined evaluation threshold refers to a two-dimensional threshold matrix that includes the traffic data volume evaluation threshold and the traffic transmission rate evaluation threshold.

[0050] In one embodiment, in the process of determining the traffic type detection reference threshold and traffic type detection evaluation threshold corresponding to the application attribute, the corresponding traffic type detection reference threshold and traffic type detection evaluation threshold can be determined from a preset storage table based on the application attribute.

[0051] In one embodiment, the target traffic type detection threshold for the application attribute is obtained by correcting the traffic type detection evaluation threshold based on the traffic type detection reference threshold and the traffic type detection evaluation threshold. This involves first determining the representation gap based on the traffic type detection reference threshold and the traffic type detection evaluation threshold, and then correcting the traffic type detection evaluation threshold based on the representation gap to obtain the target traffic type detection threshold for the application attribute. The representation gap can be the difference between the traffic type determined by the traffic type detection reference threshold and the traffic type detection evaluation threshold, or the difference between the spatial vectors represented by the traffic type detection reference threshold and the traffic type detection evaluation threshold, etc., and is not specifically limited here.

[0052] In one embodiment, when there are multiple traffic type detection evaluation thresholds, in the process of correcting the traffic type detection evaluation thresholds according to the traffic type detection reference threshold and the traffic type detection evaluation threshold to obtain the target traffic type detection threshold for the application attribute, specifically, one traffic type detection evaluation threshold that needs to be corrected can be determined from the multiple traffic type detection evaluation thresholds first. Then, the selected traffic type detection evaluation threshold is corrected according to the traffic type detection reference threshold and the multiple traffic type detection evaluation thresholds to obtain the target traffic type detection threshold for the application attribute.

[0053] In the embodiment shown in Figure 2, by determining the traffic type detection reference threshold and traffic type detection evaluation threshold corresponding to the application attribute, the traffic type detection evaluation threshold can be corrected using the traffic type detection reference threshold and traffic type detection evaluation threshold corresponding to the application attribute. This allows the traffic type detection evaluation threshold to be dynamically corrected to the target traffic type detection threshold adapted to the current traffic usage of the application attribute, thereby effectively improving the accuracy of elephant flow detection for traffic with different attributes.

[0054] Furthermore, since each application attribute can determine its own target traffic type detection threshold through the embodiment shown in Figure 2, the network device can continuously and dynamically adjust the traffic type detection evaluation threshold corresponding to the application attribute of the traffic during traffic forwarding services. This allows the obtained target traffic type detection threshold to dynamically adapt to the application attribute of the traffic in the current traffic usage, thereby further improving the adaptability of the elephant flow detection threshold to traffic with different attributes.

[0055] Referring to Figure 3, Figure 3 illustrates the flow of an embodiment of a sub-step of step 220 in Figure 2. In one embodiment, step 220 may include steps 310 to 330.

[0056] Step 310: Based on the traffic type detection reference threshold and the traffic type detection evaluation threshold, determine the first traffic type and the second traffic type accordingly;

[0057] Step 320: Determine the traffic type loss value based on the first traffic type and the second traffic type;

[0058] Step 330: Correct the traffic type detection evaluation threshold based on the traffic type loss value to obtain the target traffic type detection threshold.

[0059] In one embodiment, in the process of determining the first traffic type and the second traffic type based on the traffic type detection reference threshold and the traffic type detection evaluation threshold, the data obtained from the collected traffic can be compared with the traffic type detection reference threshold and the traffic type detection evaluation threshold respectively, resulting in a first comparison result and a second comparison result. Then, the first traffic type and the second traffic type are determined according to the first comparison result and the second comparison result. The comparison process between the collected traffic data and the traffic type detection reference threshold can precede or follow the comparison process with the traffic type detection evaluation threshold; no specific limitation is made here.

[0060] In one embodiment, the traffic type loss value is a numerical representation of the difference between the process of determining the traffic type using a traffic type detection reference threshold and the process of determining the traffic type using a traffic type detection evaluation threshold. Specifically, based on a specific traffic type detection reference threshold and a specific traffic type detection evaluation threshold, the traffic type loss value can reflect one of the differences in their discrimination performance in terms of rate, data volume, or a combination of rate and data volume (i.e., corresponding to the case where a first traffic type and a second traffic type are determined using a combined evaluation threshold and a combined reference threshold), without further limitation here.

[0061] By determining the flow type loss value based on a first flow type with reference properties and a second flow type with predictive properties, the difference between the process of determining the flow type by the flow type detection reference threshold and the process of determining the flow type by the flow type detection evaluation threshold can be identified. Thus, the process of determining the flow type by adjusting the flow type detection evaluation threshold can be adjusted by adjusting the flow type loss value, thereby improving the accuracy of the elephant flow detection threshold for different application attributes.

[0062] In one embodiment, in the process of determining the traffic type loss value based on the first traffic type and the second traffic type, the traffic type loss value can be obtained by first converting the first traffic type and the second traffic type into a first feature vector and a second feature vector respectively, and then determining the spatial distance between the first feature vector and the second feature vector as the traffic type loss value. Alternatively, the traffic type loss value can be obtained by converting the result of whether the first traffic type and the second traffic type are the same, etc. The specific method is not limited here.

[0063] In one embodiment, adjusting the traffic type detection and evaluation threshold based on the traffic type loss value to obtain the target traffic type detection threshold refers to the process of adjusting the traffic type detection and evaluation threshold to a target traffic type detection threshold that adapts to the traffic usage of the current application attributes based on the traffic type loss value. The methods for adjusting the traffic type detection and evaluation threshold are varied. For example, the traffic loss value and the traffic type detection and evaluation threshold can be superimposed with a coefficient; another example is obtaining a corresponding preset adjustment value based on the traffic type loss value and superimposing this preset adjustment value with the traffic type detection and evaluation threshold with a coefficient, etc. No specific limitation is specified here.

[0064] Referring to Figure 4, Figure 4 illustrates the flow of an embodiment of a sub-step of step 330 in Figure 3. In one embodiment, step 330 may include steps 410 to 430.

[0065] Step 410: Determine the accuracy loss value based on the first traffic type and the second traffic type;

[0066] Step 420: Determine the real-time loss value based on the type detection duration, where the type detection duration is the time taken from collecting traffic based on the traffic type detection evaluation threshold to obtaining the second traffic type;

[0067] Step 430: Determine the traffic type loss value based on the accuracy loss value and the real-time loss value.

[0068] In one embodiment, the accuracy loss value refers to the difference value used to represent whether the judgment of the second traffic type is correct relative to the first traffic type; the real-time loss value refers to the value used to represent the business impact of the type detection time on the process of determining the second traffic type based on the traffic type detection evaluation threshold.

[0069] In one embodiment, the process of determining the real-time loss value based on the type detection duration can be achieved by querying a pre-set "duration-loss value" table to determine the real-time loss value, or by calculating the real-time loss value based on the type detection duration, etc., and is not specifically limited here.

[0070] In one embodiment, the traffic type loss value can be determined by adding the two values ​​together, or by adding them directly, etc., based on the accuracy loss value and the real-time loss value. No specific limitation is made here.

[0071] By using the first and second traffic types, an accuracy loss value can be obtained to improve the accuracy of identifying elephant flows. This allows the target traffic type detection threshold to more accurately determine whether a traffic is an elephant flow. A real-time loss value is added during the correction process, so that the correction process can take into account the impact of the time taken to identify elephant flows on the elephant flow detection process. Thus, while improving the accuracy of the determination, the efficiency of determining whether a traffic is an elephant flow can also be improved during the process of correcting the traffic type detection evaluation threshold.

[0072] In one embodiment, in determining the accuracy loss value based on the first traffic type and the second traffic type, the actual label value corresponding to the first traffic type and the predicted value corresponding to the second traffic type can be determined first. Then, the actual label value corresponding to the first traffic type and the predicted value corresponding to the second traffic type are substituted into a preset accuracy loss function to calculate the accuracy loss value. The accuracy loss function can be one of specific loss functions such as the cross-entropy loss function and the mean absolute error loss function; no specific limitation is made here.

[0073] In one embodiment, the process of determining the actual label value corresponding to the first traffic type and the predicted value corresponding to the second traffic type can be represented by the following formulas (1) and (2).

[0074] In formula (1), V i This refers to the i-th traffic instance collected, where i is the index of the collected traffic instance.

[0075] θ j This refers to the detection and evaluation threshold for the j-th traffic type;

[0076] It refers to the predicted value of the second traffic type corresponding to the i-th traffic sample relative to the detection and evaluation threshold of the j-th traffic type.

[0077] Additionally, in formula (2), V i This refers to the i-th traffic instance collected, where i is the index of the collected traffic instance.

[0078] θ r This refers to the reference threshold for traffic type detection;

[0079] y i It refers to the actual label value corresponding to the first traffic type of the i-th traffic sample relative to the traffic type detection reference threshold.

[0080] In one embodiment, the process of substituting the actual label value corresponding to the first traffic type and the predicted value corresponding to the second traffic type into a preset accuracy loss function to calculate the accuracy loss value can be represented by the following formula (3).

[0081] Among them, L accuracy (θ) refers to the accuracy loss value;

[0082] N refers to the number of data points collected;

[0083] M refers to the amount of traffic collected;

[0084] It refers to the predicted value of the second traffic type corresponding to the i-th traffic collected relative to the detection and evaluation threshold of the j-th traffic type, where i refers to the index of the collected traffic.

[0085] y i It refers to the actual label value corresponding to the first traffic type of the i-th traffic sample relative to the traffic type detection reference threshold.

[0086] In one embodiment, the process of determining the real-time loss value based on the type detection duration can be represented by the following formula (4).

[0087] Among them, L timing (θ) refers to the real-time performance loss value;

[0088] N refers to the number of data points collected;

[0089] M refers to the amount of traffic collected;

[0090] i refers to the index of the collected traffic;

[0091] j refers to the index of the traffic type detection and evaluation threshold;

[0092] T detect,ij This refers to the type detection time required to determine the second traffic type of the i-th traffic relative to the type detection evaluation threshold of the j-th traffic.

[0093] Referring to Figure 5, Figure 5 illustrates the flow of an embodiment of a sub-step of step 430 in Figure 4. In one embodiment, step 430 may include steps 510 to 520.

[0094] Step 510: Determine the first weighting coefficient for the accuracy loss value and the second weighting coefficient for the real-time performance loss value;

[0095] Step 520: Determine the traffic type loss value based on the first weighting coefficient, the accuracy loss value, the second weighting coefficient, and the real-time loss value.

[0096] By using the first and second weighting coefficients, the impact of accuracy and real-time detection on the correction process can be balanced, thereby enabling flexible optimization of accuracy and detection speed in different scenarios, taking into account the needs of different levels, and helping to improve the adaptability of the target traffic type detection threshold.

[0097] In one embodiment, the process of determining the traffic type loss value based on the first weighting coefficient, the accuracy loss value, the second weighting coefficient, and the real-time loss value can be expressed as the following formula (5) L total (θ)=αL accuracy (θ)+βL timing (θ) (5);

[0098] Wherein, θ refers to the threshold for traffic type detection and evaluation;

[0099] L total (θ) refers to the loss value for the flow type;

[0100] L accuracy (θ) refers to the accuracy loss value;

[0101] α refers to the first weighting coefficient;

[0102] L timing (θ) refers to the real-time performance loss value;

[0103] β refers to the second weighting coefficient.

[0104] Referring to Figure 6, Figure 6 illustrates the flow of an embodiment of a sub-step of step 520 in Figure 5. In one embodiment, step 520 may include steps 610 to 620.

[0105] Step 610: Determine the correction gradient value corresponding to the traffic type detection and evaluation threshold based on the traffic type loss value;

[0106] Step 620: Based on the corrected gradient value and the traffic type loss value, correct the traffic type detection evaluation threshold to obtain the target traffic type detection threshold.

[0107] In one embodiment, there are various ways to correct the traffic type detection evaluation threshold by correcting the gradient value and the traffic type loss value. For example, the corrected gradient value and the traffic type loss value can be directly superimposed on the traffic type detection evaluation threshold to obtain the corrected traffic type detection evaluation threshold. Another example is to calculate a compensation value based on the corrected gradient value and the traffic type loss value, and add the compensation value to the traffic type detection evaluation threshold to obtain the corrected gradient value and the traffic type loss value, etc. The specific method is not limited here.

[0108] By refining the traffic type detection and evaluation threshold using gradient and traffic type loss values, the optimal traffic type loss value can be quickly determined, thereby improving the efficiency of threshold refinement. Furthermore, since the refinement process is performed using gradient values, it becomes more flexible and universal, thus enhancing the adaptability of thresholds to different application attributes.

[0109] In one embodiment, in the process of correcting the traffic type detection evaluation threshold based on the corrected gradient value and the traffic type loss value to obtain the target traffic type detection threshold, the learning rate coefficient corresponding to the corrected gradient value can be determined first. Then, the traffic type detection evaluation threshold is corrected based on the learning rate coefficient, the corrected gradient value, and the traffic type loss value to obtain the target traffic type detection threshold. The learning rate coefficient is a parameter used to control the step size of parameter updates during the iterative process of correcting the traffic type detection evaluation threshold. Furthermore, the process of correcting the traffic type detection evaluation threshold is an iterative process that will iterate until a preset condition is met before stopping, at which point the target traffic type detection threshold can be obtained.

[0110] In one embodiment, the process of correcting the traffic type detection evaluation threshold based on the learning rate coefficient, the corrected gradient value, and the traffic type loss value to obtain the target traffic type detection threshold can be achieved by the following formula (6).

[0111] Where θ2 refers to the traffic type detection evaluation threshold that enables the gradient of the loss function to decrease the fastest after iteration, which is also the traffic type detection evaluation threshold after one correction.

[0112] θ1 refers to the traffic type detection evaluation threshold that enables the gradient descent of the loss function to be the fastest in this iteration. When the iteration process is the first iteration, θ1 is the original traffic type detection evaluation threshold. When the iteration process is the second or subsequent iterations, θ1 is the currently corrected traffic type detection evaluation threshold.

[0113] η refers to the learning rate coefficient;

[0114] This refers to correcting the gradient value.

[0115] For formula (6), the preset condition is that the loss function converges, at which point the target traffic type detection threshold is a local minimum. The convergence condition for the loss function can be that the change in the parameter is less than a preset value, or the change in the loss function value is less than a preset value, etc., and is not specifically limited here.

[0116] In one embodiment, when the traffic type detection and evaluation threshold includes a combined evaluation threshold, in the process of determining the second traffic type based on the traffic type detection and evaluation threshold, specifically, a first evaluated traffic type corresponding to the traffic data volume evaluation threshold and a second evaluated traffic type corresponding to the traffic transmission rate evaluation threshold can be determined first based on the traffic data volume evaluation threshold and the traffic transmission rate evaluation threshold. Then, the second traffic type is determined based on the first evaluated traffic type and the second evaluated traffic type. The first evaluated traffic type refers to the traffic type determined based on the traffic data volume evaluation threshold at the data volume level (it can be an "elephant flow," or it can be a non-elephant flow). The second evaluated traffic type refers to the traffic type determined based on the traffic transmission rate evaluation threshold at the transmission rate level (it can be an "elephant flow," or it can be a non-elephant flow).

[0117] In one embodiment, determining the first assessed traffic type corresponding to the traffic data volume assessment threshold and the second assessed traffic type corresponding to the traffic transmission rate assessment threshold based on the traffic data volume assessment threshold and the traffic transmission rate assessment threshold refers to comparing the traffic data volume with the traffic data volume assessment threshold and comparing the traffic transmission rate data with the traffic transmission rate assessment threshold to obtain the first assessed traffic type and the second assessed traffic type. The comparison process between the traffic data volume and the traffic data volume assessment threshold can precede or follow the comparison process between the traffic transmission rate data and the traffic transmission rate assessment threshold; no specific limitation is made here.

[0118] In one embodiment, during the process of determining the second flow type based on the first and second assessed flow types, the elephant flow can be determined as the second flow type if either the first or second assessed flow type is an elephant flow, or if both the first and second assessed flow types are elephant flows, the elephant flow can be determined as the second flow type, and so on. No specific limitation is made here.

[0119] In one embodiment, when the traffic type detection reference threshold includes a combined reference threshold, in the process of determining the first traffic type based on the traffic type detection reference threshold, specifically, the third evaluated traffic type corresponding to the traffic data volume reference threshold and the fourth evaluated traffic type corresponding to the traffic transmission rate reference threshold can be determined first based on the traffic data volume reference threshold and the traffic transmission rate reference threshold. Then, the first traffic type is determined based on the third evaluated traffic type and the fourth evaluated traffic type.

[0120] In one embodiment, determining the third evaluated traffic type corresponding to the traffic data volume reference threshold and the fourth evaluated traffic type corresponding to the traffic transmission rate reference threshold, based on the traffic data volume reference threshold and the traffic transmission rate reference threshold, refers to comparing the traffic data volume with the traffic data volume reference threshold and comparing the traffic transmission rate data with the traffic transmission rate reference threshold to obtain the corresponding third and fourth evaluated traffic types. The comparison process between the traffic data volume and the traffic data volume reference threshold can precede or follow the comparison process between the traffic transmission rate data and the traffic transmission rate reference threshold; no specific limitation is made here.

[0121] In one embodiment, during the process of determining the first flow type based on the third and fourth assessment flow types, the target type can be determined as the first flow type if either the third or fourth assessment flow type is the target type (i.e., elephant flow), or the target type can be determined as the first flow type if both the third and fourth assessment flow types are target types (i.e., elephant flow), etc. The specific details are not limited here.

[0122] In one embodiment, referring to Figure 7, the network device 700 can be a device composed of sub-devices. Specifically, the network device 700 may include a traffic detection and forwarding device 710 and an online learning device 720. The traffic detection and forwarding device 710 and the online learning device 720 can communicate with each other to realize data exchange. The traffic detection and forwarding device 710 can be a router, core network device, etc., and the online learning device 720 can be a separate computing device. The online learning device 720 can be an external device to the traffic detection and forwarding device 710, or it can be a device installed on the traffic detection and forwarding device 710, etc., and is not specifically limited here.

[0123] In one embodiment, the traffic detection and forwarding device 710 may include a main control module 711, a first communication module 712, a traffic attribute identification module 713, and a parameter setting module 714. The first communication module 712, the traffic attribute identification module 713, and the parameter setting module 714 are all connected to the main control module 711. The main control module 711 can coordinate the operation of the traffic detection and forwarding device 710 itself and its interaction with the online learning device 720, ensuring that both work together to achieve efficient traffic management. The operation of the traffic detection and forwarding device 710 itself may include determining first and second target traffic types. The traffic attribute identification module 713 can be used to analyze the traffic attributes of the collected traffic in real time. The parameter setting module 714 can select existing parameters for type detection of the current traffic based on the current traffic attributes analyzed by the traffic attribute identification module 713, so that the main control module 711 can perform targeted control of the current traffic based on the traffic type. Specifically, the parameter setting module 714 can set the currently required traffic type detection threshold to a default threshold before receiving the target traffic detection threshold returned by the online learning device 720, and can also set the target traffic detection threshold returned by the online learning device 720 as the current traffic type detection threshold. The first communication module 712 can be used to communicate with the second communication module 722 in the online learning device 720 to periodically synchronize information such as the traffic attributes, traffic type, and thresholds used to determine the first and second target traffic types of the traffic samples analyzed by the traffic detection and forwarding device 710 to the online learning device 720, and to receive the target traffic detection threshold returned by the online learning device 720.

[0124] In one embodiment, the online learning device 720 may include a learning optimization module 721 and a second communication module 722. The learning optimization module 721 and the second communication module 722 are interconnected. The second communication module 722 can periodically receive data sent by the traffic detection and forwarding device 710 and return a target traffic detection threshold. The learning optimization module 721 can be used to determine a loss value and adjust the evaluation threshold based on the loss value.

[0125] The following describes an embodiment of the application using a combined evaluation threshold and a combined reference threshold, with reference to the hardware structure shown in Figure 7. Embodiments using a single type of threshold can be found in the embodiments below, which will not be repeated here.

[0126] Referring to Figure 8, for network device 700, during the normal traffic forwarding process, traffic detection and forwarding device 710 can perform large-scale traffic judgment on the forwarded traffic through the currently set combined thresholds, and execute corresponding control strategies based on the judgment results. In this process, traffic detection and forwarding device 710 can sample multiple traffic flows to obtain the data volume and transmission rate data of each sampled traffic flow. Then, the traffic attribute identification module 713 determines the traffic application type and traffic user attribute of each sampled traffic flow. Finally, the parameter setting module 714 determines the combined evaluation threshold and combined reference threshold corresponding to each traffic application type under each traffic user attribute. Following this, for each traffic application type under each traffic user attribute, the main control module 711 first compares the traffic data volume with the traffic data volume evaluation threshold in the combined evaluation threshold, and compares the traffic transmission rate data with the traffic transmission rate evaluation threshold in the combined evaluation threshold, thus obtaining the first evaluation type and the second evaluation type. Then, based on the first and second evaluation types, the second traffic type of this traffic is determined. Next, the traffic data volume is compared with the traffic data volume reference threshold in the combined reference threshold, and the traffic transmission rate data is compared with the traffic transmission rate reference threshold in the combined reference threshold, thus obtaining the third and fourth evaluation types. Finally, based on the third and fourth evaluation types, the first traffic type of this traffic is determined. After obtaining the first traffic type, the second traffic type, the type detection duration required to determine the second traffic type, the traffic application type, and the traffic user attribute for each collected traffic, this data is synchronized to the online learning device 720 through the first communication module 712 according to the timing sample synchronization rules.

[0127] After receiving this data through the second communication module 722, the online learning device 720, for each traffic application type under each traffic user attribute, first determines the accuracy loss value of that traffic application type under that traffic user attribute based on the first and second traffic types of each traffic under that traffic application type through the learning optimization module 721. Next, it determines the real-time loss value based on the type detection duration corresponding to each traffic under that traffic application type. Then, it determines the first weighting coefficient of the accuracy loss value and the second weighting coefficient of the real-time loss value. Finally, it calculates the result by summing the products of the first weighting coefficient and the accuracy loss value, and the second weighting coefficient and the real-time loss value. The system obtains the traffic type loss value for the traffic application type under the traffic user attribute. Then, based on the traffic type loss value, it determines the correction gradient value corresponding to the traffic application type. Next, based on the correction gradient value and the traffic type loss value, it corrects the traffic transmission rate evaluation threshold and the traffic data volume evaluation threshold in the combined evaluation threshold, respectively, to obtain the target traffic data volume evaluation threshold and the target traffic transmission rate evaluation threshold. Then, it obtains the target traffic type detection threshold (i.e., the target combined evaluation threshold obtained based on the combination of the target traffic data volume evaluation threshold and the target traffic transmission rate evaluation threshold) based on the target traffic data volume evaluation threshold and the target traffic transmission rate evaluation threshold. After obtaining the target traffic type detection threshold for each traffic application type under each traffic user attribute, the second communication module 722 updates all obtained target traffic type detection thresholds to the traffic detection and forwarding device 710, enabling the parameter setting module 714 of the traffic detection and forwarding device 710 to perform targeted traffic detection for each traffic application type under each traffic user attribute based on the obtained target traffic type detection thresholds.

[0128] Figure 9 is a schematic diagram of a communication device according to an embodiment of this application. As shown in Figure 9, the communication device includes a memory 1100 and a processor 1200. The number of memory 1100 and processor 1200 can be one or more. Figure 9 shows an example of one memory 1100 and one processor 1200. The memory 1100 and processor 1200 in Figure 9 can be connected by a bus or other means. Figure 9 shows an example of connection via a bus.

[0129] The memory 1100, as a computer-readable storage medium, can be used to store one or more software programs, computer-executable programs, and modules, such as the programs, instructions, or modules corresponding to the traffic detection method provided in any embodiment of this application. The processor 1200 implements the traffic detection method provided in any embodiment of this application by executing one or more computer programs, instructions, and modules stored in the memory 1100.

[0130] The memory 1100 may primarily include a program storage area and a data storage area, wherein the program storage area may store the operating system and computer programs required for at least one function. Furthermore, the memory 1100 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 1100 may further include memory remotely located relative to the processor 1200, and these remote memories can be connected to the device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0131] An embodiment of this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the traffic detection method as provided in any embodiment of this application.

[0132] An embodiment of this application also provides a computer program product, including a computer program that, when executed by a processor, implements the traffic detection method as provided in any embodiment of this application.

[0133] The system architecture and application scenarios described in this application are intended to more clearly illustrate the technical solutions of this application and do not constitute a limitation on the technical solutions provided in this application. Those skilled in the art will understand that as system architectures evolve and new application scenarios emerge, the technical solutions provided in this application are also applicable to similar technical problems.

[0134] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0135] In hardware implementations, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0136] As used in this specification, the terms "component," "module," "system," etc., are used to refer to computer-related entities, hardware, firmware, combinations of hardware and software, software, or software in execution. For example, a component can be, but is not limited to, a process running on a processor, a processor, an object, an executable file, an execution thread, a program, or a computer. As illustrated, applications running on computing devices and computing devices can both be components. One or more components may reside in a process or execution thread, and components may be located on a single computer or distributed among two or more computers. Furthermore, these components can be executed from various computer-readable media on which various data structures are stored. Components can communicate, for example, via local or remote processes based on signals having one or more data packets (e.g., data from two components interacting with another component between a local system, a distributed system, or a network, such as the Internet interacting with other systems via signals).

Claims

1. A flow detection method, comprising: Traffic is collected to determine the application attributes of the traffic; Determine the target traffic type detection threshold corresponding to the application attribute; Traffic detection is performed on the application attributes based on the target traffic type detection threshold.

2. The method according to claim 1, wherein, Determining the target traffic type detection threshold corresponding to the application attribute includes: Determine the traffic type detection reference threshold and traffic type detection evaluation threshold corresponding to the application attribute, wherein the traffic type detection reference threshold and the traffic type detection evaluation threshold are different; Based on the traffic type detection reference threshold and the traffic type detection evaluation threshold, the traffic type detection evaluation threshold is corrected to obtain the target traffic type detection threshold for the application attribute.

3. The method according to claim 2, wherein, The step of correcting the traffic type detection evaluation threshold based on the traffic type detection reference threshold and the traffic type detection evaluation threshold to obtain the target traffic type detection threshold for the application attribute includes: Based on the traffic type detection reference threshold and the traffic type detection evaluation threshold, the first traffic type and the second traffic type are determined accordingly. Based on the first traffic type and the second traffic type, determine the traffic type loss value; The target traffic type detection threshold is obtained by correcting the traffic type detection evaluation threshold based on the traffic type loss value.

4. The method according to claim 3, wherein, The step of determining the traffic type loss value based on the first traffic type and the second traffic type includes: Determine the accuracy loss value based on the first traffic type and the second traffic type; Based on the type detection duration, a real-time loss value is determined, wherein the type detection duration is the time taken from collecting the traffic based on the traffic type detection evaluation threshold to obtaining the second traffic type; The traffic type loss value is determined based on the accuracy loss value and the real-time loss value.

5. The method according to claim 2, wherein, The traffic type detection and evaluation threshold includes one of the following: Traffic data volume assessment threshold; Traffic transmission rate evaluation threshold; The combined evaluation threshold is obtained by combining the traffic data volume evaluation threshold and the traffic transmission rate evaluation threshold; The reference threshold for traffic type detection includes one of the following: Reference threshold for traffic data volume; Traffic transmission rate reference threshold; The combined reference threshold is obtained by combining the traffic data volume reference threshold and the traffic transmission rate reference threshold.

6. The method according to claim 5, wherein, When the traffic type detection and evaluation threshold includes the combined evaluation threshold, the process of determining the second traffic type of the traffic based on the traffic type detection and evaluation threshold includes: Based on the traffic data volume assessment threshold and the traffic transmission rate assessment threshold, a first assessment traffic type corresponding to the traffic data volume assessment threshold and a second assessment traffic type corresponding to the traffic transmission rate assessment threshold are determined; The second traffic type is determined based on the first assessed traffic type and the second assessed traffic type.

7. The method according to claim 6, wherein, When the traffic type detection reference threshold includes the combined reference threshold, determining the first traffic type of the traffic based on the traffic type detection reference threshold includes: Based on the traffic data volume reference threshold and the traffic transmission rate reference threshold, determine the third evaluation traffic type corresponding to the traffic data volume reference threshold and the fourth evaluation traffic type corresponding to the traffic transmission rate reference threshold; The first traffic type is determined based on the third and fourth assessed traffic types.

8. A communication device, comprising: One or more processors; A memory having stored one or more computer programs that, when executed by one or more processors, cause the one or more processors to implement the traffic detection method as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, the computer program, when executed by a processor, implementing the flow detection method as described in any one of claims 1 to 7.

10. A computer program product comprising a computer program that, when executed by a processor, implements the traffic detection method as described in any one of claims 1 to 7.

Images