440 results about "NetFlow" patented technology

The invention relates to the technical field of network security, in particular to a dynamic access blocking method based on zero trust. Comprising the following steps: step 1, collecting whole network flow data in real time in a bypass monitoring mode through a flow mirroring function of a network switch, performing deep packet inspection analysis on the collected original flow data, and extracting network flow characteristic parameters; 2, maintaining a dynamic identity information base; 3, performing real-time behavior analysis on each network session; 4, according to the risk assessment result and the real-time security context, generating a dynamic access control strategy based on a minimum permission principle; 5, implementing access control at the network execution point; and 6, continuously monitoring the network flow and the strategy execution effect, collecting feedback data, optimizing the risk assessment model and the strategy generation algorithm based on the feedback data, and forming closed-loop control. By dynamically updating the identity and asset information, the system can identify new assets or changes in real time, so that the adaptability and response capability of a network environment are improved.

The invention discloses a network intrusion detection method and system based on edge attention learning, and a storage medium, and the method comprises the steps: converting an original network flow into a network flow diagram, and constructing a training diagram and a test diagram under the condition that a coarse-grained label and a fine-grained label are reserved; edge embedding representation is obtained through edge feature reservation, adaptive weight distribution and multi-layer feature extraction of the training graph and the test graph; based on the edge embedding representation, performing coarse-grained detection to identify a basic attack category, and performing fine-grained classification by using multi-scale feature fusion related to global graph attributes; and adversarial training: through initializing adversarial disturbance and optimizing disturbance based on loss function gradient iteration, superposing final disturbance into the training graph, and based on loss function back propagation updating, obtaining a trained network intrusion detection model. The method provided by the invention can effectively capture the depth characteristics of the key attack and maintain the stable detection performance in the confrontation environment.

A VCN process may receive, by a value chain network digital twin, information associated with a value chain network. A VCN process may provide the information to a set of Artificial Intelligence (AI)-based learning models, wherein at least one member of the set of AI-based learning models is trained to classify at least one of: an operating state, a fault condition, an operating flow, or a behavior of the value chain network and at least one member of the set of AI-based learning models is trained to determine a task to be completed for the value chain network. A VCN process may provide at least one of an instruction for executing the task in the value chain network digital twin and a recommendation for executing the task in the value chain network digital twin.

Technologies for creating an optimized and accelerated network pipeline using an emulated network pipeline abstraction layer (NPAL) of an emulated data processing unit (DPU), including an emulated processing device and an emulated acceleration hardware engine, are described. The emulated NPAL supports multiple network protocols and network functions in an emulated network pipeline. The emulated network pipeline includes a set of tables and logic organized in a specific order to be accelerated by the emulated acceleration hardware engine. The emulated acceleration hardware engine can process network traffic data using the emulated network pipeline.

Technologies for creating an optimized and accelerated network pipeline using a network pipeline abstraction layer (NPAL) for policy-based routing (PBR) over Service Function Chaining (SFC) are described. A DPU includes acceleration hardware engine to provide a single accelerated data plane. A processing device can generate a first virtual bridge and a second virtual bridge, the first virtual bridge to be controlled by a first network service hosted on the DPU and having a set of one or more network rules, and the second virtual bridge having a policy-based routing policy (PBR policy). The processing device can add the virtual port between the first virtual bridge and the second virtual bridge. The acceleration hardware engine, in the single accelerated data plane, can route network traffic data using the PBR policy and process the network traffic data using the set of one or more network rules.

A method for screening inter-PLMN messages at a SEPP to implement roaming agreements includes storing an originating and target network mapping database containing records including mappings between originating network identifiers and target network identifiers. The method further includes receiving, at the SEPP, an inter-PLMN SBI request message originating from an NF in a network served by the SEPP. The method further includes determining originating and target network identifiers from the message, locating a matching record in the database, and determining, from the record, whether the message should be allowed to flow from the originating network to the target network. The method further includes forwarding the message to the target network or preventing the forwarding of the message to the target network based on results of the determining.

The invention provides a reliability-aware dependent task unloading method based on topology reconstruction in industrial internet edge computing, which comprises the following steps of: constructing a system model covering an edge cloud network platform, an industrial cloud platform and internet of things equipment, and establishing a transmission delay model and a reliability model; constructing a task unloading mathematical model with the maximum reliability level; the method comprises the following steps: modeling a micro-service dependency relationship into a weighted directed acyclic graph based on a network flow theory, and carrying out topology reconstruction on micro-services applied to the Internet of Things through a Ford-Fulkerson approximation algorithm to obtain a micro-service grouping structure formed by minimum cut division; the micro-service grouping structure serves as priori knowledge to be input into the deep Q network, the deep Q network is used for solving a task unloading mathematical model, a task unloading strategy is dynamically adjusted, resource allocation is optimized, and an optimal calculation unloading scheme in the industrial internet edge calculation environment is obtained. The micro-service deployment is optimized, the communication overhead is reduced, and the system reliability and the resource utilization rate are improved through real-time network state dynamic decision making.

Technologies for creating an optimized and accelerated network pipeline using a network pipeline abstraction layer (NPAL) are described. A DPU includes DPU hardware and memory that stores DPU software with the NPAL that supports multiple network protocols and network functions in a network pipeline. The network pipeline includes a set of tables and logic organized in a specific order to be accelerated by an acceleration hardware engine of the DPU. The acceleration hardware engine processes network traffic data using the network pipeline.

System and techniques for network flow-based hardware allocation are described herein. A workload for is obtained for execution. Here, the workload includes a flow that has a processing component and a network component. Then, during execution of the workload, the flow is repeatedly profiled and assigned a network service and a processing service during a next execution based on a network metric and a processing metric obtained from the profiling.

Mobile management method, system and client. The method includes receiving a DNS query for a host name from an application on a client; retrieving reputation data associated with the host name from a local cache on the client; determining a policy for the host name, which is associated with the host name and the reputation data associated with the host name; based on the determined policy for the host name, blocking attempted network flows to a host corresponding to the host name; sending at least attempted network flow metadata related to the blocked attempted network flows to a collector on the client; and transmitting the attempted network flow metadata in the collector to a VPN server pool via a VPN tunnel.

The invention discloses an active source dynamic monitoring and tracking method and system for DDoS attack defense, and the method comprises the steps: collecting Netflow data transmitted by a router in real time; cleaning, normalization processing and feature extraction are carried out on the acquired Netflow traffic data; carrying out statistics on the extracted features, and constructing a traffic baseline; monitoring a reputation value corresponding to each source IP, and constructing an active attack source library for quickly identifying active attack sources; analyzing and detecting the activeness of each monitored source IP based on a sliding time window and a traffic baseline, and further verifying the detected active attack source in combination with the trained LSTM model; performing hop-by-hop tracing, TTL analysis, multi-path probability tracking and probe packet verification on the identified active attack source to realize accurate tracing of the active attack source; and dynamically updating the traffic baseline and the active attack source library according to the traceability result. According to the method and the system, an active attack source is identified through multi-level feature analysis and a cooperative tracking mechanism.

The invention discloses a network flow association method and system based on tetrad metric learning, and the method comprises the following steps: constructing a tetrad data set containing an adversarial disturbance sample through extracting the packet interval and packet size characteristics of network flow; a double-branch feature embedded network is combined with a channel attention and space attention module, so that the dynamic sensing ability of key features is enhanced; introducing a tetrad loss function to optimize a feature embedding space, and compulsorily confronting a rejection relationship between a disturbance sample and a negative sample; based on a dynamic mixed quantile method, a correlation threshold is adaptively selected, and the robustness is improved in combination with a multi-window voting mechanism. According to the method, the association discrimination of the network flow is realized by adopting a tetrad metric learning method, the anti-disturbance capability and the calculation efficiency are remarkably improved, the distribution characteristics of the original flow are not changed, and the method is suitable for a large-scale real-time anonymous network flow association scene.

The invention discloses an encrypted traffic detection method based on LLM enhanced semi-supervised learning. The method comprises the following steps: firstly, training a traffic detection model for detecting encrypted traffic under an LESS framework; and detecting the encrypted traffic by using the trained traffic detection model. Components of the LESS framework include a Prompt orchestrator, an NSSN, and an LLM optimizer. The components work cooperatively, a detection model is trained by using a labeled training set and a label-free training set, and each piece of data in a data set is formed by arranging length values of data packets in a network flow in sequence; the Prompt composer guides the LLM to generate label-free enhanced data in different scenes; the NSSN automatically sets a pseudo label for the enhanced label-free traffic data, and learns traffic detection knowledge accordingly; under the guidance of the SSL loss, the LLM optimizer adjusts the enhancement strategy of the LLM to align the semi-supervised training requirements of the detection model. The training steps of the detection model include LLM pre-fine tuning; marking the LLM enhanced data; and continuous demand alignment can be realized.

Technologies for creating an optimized and accelerated network pipeline using a virtual switch and a network pipeline abstraction layer (NPAL) for fast link recovery are described. The virtual switch can monitor a link availability of each of a plurality of links to a destination, the plurality of links being specified in an initial group of identifiers. The virtual switch can detect a link failure of a first link of the plurality of links. The NPAL can remove a first link identifier, associated with the first link, from the initial group of link identifiers to obtain a modified group of link identifiers. The NPAL can cause a routing table in the NPAL to be updated to remove the first link identifier. The acceleration hardware engine can process network traffic data using the network pipeline and distribute the network traffic data to only the remaining links of the plurality of links.

Technologies for creating an optimized and accelerated network pipeline using a network pipeline abstraction layer (NPAL) for split interfaces are described. A DPU includes a physical port configured to couple to a breakout cable that physically couples to a set of a plurality of devices, DPU hardware, and a memory operatively coupled to the DPU hardware. The NPAL supports a plurality of logical split ports, each logical split port corresponding to one of the plurality of devices, wherein the network pipeline comprises a set of tables and logic organized in a specific order to be accelerated by the acceleration hardware engine. The acceleration hardware engine is to process the network traffic data using the network pipeline.

The invention discloses an organization internal communication efficiency improvement method based on social network analysis. The method comprises the following steps: S1, collecting internal communication data of an organization; s2, preprocessing and standardizing the collected data; s3, constructing a communication network graph, and identifying communication frequency and intensity; s4, identifying communication bottlenecks and key nodes in combination with a social physics model and a graph attention network; s5, introducing a network fluid dynamic model and a swarm intelligence method to optimize a communication strategy; s6, continuously optimizing the network structure based on an adaptive optimization method and a context awareness technology; and S7, generating personalized communication optimization suggestions, and dynamically displaying communication network changes. According to the invention, the communication efficiency and decision-making ability in the organization are effectively improved.

The invention provides an intelligent optical cable performance prediction method and system for a data center, and relates to the technical field of data center performance analys.The intelligent optical cable performance prediction method comprises the steps that firstly, an optical cable microstructure disturbance quantization model is constructed, and an optical cable is divided into a plurality of virtual quantization units in the longitudinal direction; each unit packages a real-time stress-strain state parameter and a response sensitivity coefficient of the basic structure unit, inputting a Brillouin scattering spectrum frequency shift data flow collected in real time into the model for disturbance source analysis, generating a physical excitation decomposition sequence, driving a virtual quantization unit to perform state evolution iterative operation according to the physical excitation decomposition sequence, and obtaining a Brillouin scattering spectrum frequency shift data flow model; a stress-strain state evolution track set is obtained, a time-space correlation network of optical cable link disturbance propagation is constructed according to the stress-strain state evolution track set, network flow characteristic analysis is conducted on the time-space correlation network, an early warning node set is extracted, the future evolution trend of the early warning node set is calculated, and serialized optical cable performance abnormity early warning information is generated. The optical cable performance abnormity can be predicted in advance, and stable operation of the data center optical cable is guaranteed.

Tunnel endpoints may encapsulate the packets of a network flow, such as a forward flow from one computer to another, in encapsulating packets. A forward flow packet of the forward flow may include static header fields, pseudo-dynamic header fields, and dynamic fields. The control plane and the data plane of a tunnel endpoint may omit the static header fields and may omit the pseudo-dynamic header fields from encapsulating packets after sending a first encapsulating packet that includes the forward flow packet and a forward flow value associated with the forward flow. Subsequent encapsulating packets may include the forward flow value and the dynamic field values of subsequent forward flow packets of the forward flow. The static header fields and / or the pseudo-dynamic header fields of the subsequent forward flow packets may be omitted from the subsequent encapsulating packet.

The invention provides a low-delay SDN (Software Defined Network) flow table updating method, and belongs to the technical field of network communication. The method comprises the following steps: firstly, proposing a shortest mobile rule chain for updating a single forwarding rule; and then, aiming at a plurality of concurrency rules which simultaneously reach the switch, designing a dynamic mode to update the concurrency rules, and heuristically updating the plurality of rules in a TCAM limited area, so that the flow table updating efficiency is improved. The method and the device are used for reducing updating delay caused by the rule dependency relationship.

The invention discloses a power grid material vehicle path planning method, and provides a space-time hierarchical modeling and cloud edge collaborative optimization architecture aiming at the problems of dynamic embargo, channel capacity fluctuation, multi-resource conflict, response lag and the like faced by power grid material dispatching in the prior art. By constructing a space-time coupled channel capacity-path planning hierarchical model, multi-commodity network flow pre-calculation and real-time vehicle path dynamic decoupling are carried out, and material distribution is optimized in combination with a space-time double-coding genetic algorithm; a multi-agent deep game decision-making mechanism is designed, channel priorities of different types of materials are dynamically balanced through reinforcement learning, and distributed conflict resolution is achieved; a block chain-based cross-domain scheduling instruction synchronization system is developed, low-delay path re-planning is realized by adopting a differential updating mechanism, and second-level updating of a scheduling scheme under an emergent road condition is supported; the on-chain evidence storage technology is introduced to guarantee instruction integrity and operation tracing, and the scheduling deadlock risk is reduced in combination with a key channel competition early warning model.

The invention relates to a method for detecting a particular cryptographic algorithm used in a computer system, comprising steps of capturing data packets exchanged with a target machine in order to obtain initial measurements of time and data volume, calculating response delays by measuring the time elapsed between sending and receiving the captured data packets, determining a first time signature indicative of a cryptographic algorithm used to generate the captured packets on the basis of the calculated response delays and the exchanged data volumes, determining a level of correspondence between the first time signature determined and at least one second time signature determined beforehand for a particular cryptographic algorithm, and transmitting an alert comprising at least one identifier of a source apparatus and / or of a destination apparatus of the network flow when the level of correspondence is greater than a threshold.

The invention discloses a flow analysis method and device for active PCDN users based on Flink, and the method comprises the steps: screening a user list which accords with PCDN features and PCDN platform domain names from aaa call ticket data provided by an operator, and obtaining a PCDN violation user list; the Flink calculation engine loads the PCDN violation user list, matching is carried out on the basis of user access ip and ports and accessed Netflow traffic data, then traffic light summarization is carried out, and Netflow traffic data associated with PCDN violation users is obtained; the method comprises the following steps: selecting Netflow traffic data associated with PCDN violation users in the online and offline time range of the PCDN violation users to perform activity analysis, calculating the activity ratio of Flow in the online and offline time range of the PCDN violation users, obtaining the activity of the PCDN violation users, and finally outputting a PCDN violation user list with inverted activity. According to the method and the device, the suspected PCDN users are found and sorted according to the activeness, so that subsequent operation is facilitated, the burden of flow settlement is reduced, and the revenue of broadband services is increased.

The invention provides an unknown malicious traffic detection method and device. The method comprises the following steps: converting a network stream to be detected into a grey-scale map; an encoder in the trained generative model is utilized to extract encoding features of the grey-scale map, the minimum distance between the encoding features and Gaussian prototypes corresponding to all known traffic categories is calculated, if the minimum distance is smaller than a preset threshold value, the network flow to be detected is considered to belong to the traffic category corresponding to the minimum distance, and otherwise, the network flow to be detected is considered to be an unknown traffic category; wherein the training process of the generative model comprises the following steps of: constructing a traffic data set marked with category labels; converting each network flow sample in the flow data set into a grey-scale map, sequentially inputting all the grey-scale maps into a conditional variation auto-encoder, calculating ELBO loss according to a generation limit, calculating identification loss according to an identification limit, and calculating total loss to update network parameters; after training is completed, the conditional variation auto-encoder is a generative model, and Gaussian prototypes corresponding to all known traffic categories are obtained.

This disclosure describes techniques for enforcing conditional access to network services. In an example method, a first computing device detects a second device operating in a per-flow authorization mode. The first device receives a first request from a second computing device to communicate with a third computing device using a first network flow and determines that the first flow is authorized (e.g., because of an active past authentication and / or the third device's authentication exemption). Data associated with the first request is transmitted to the third device. The first device then receives a second request to communicate with a fourth computing device using a second network flow and determines that the second flow is not authorized (e.g., because it is not associated with an active past authentication and / or the fourth device is not exempt from authentication). Data associated with the second request is not transmitted to the fourth device.

A system and method are disclosed for performing rough cut capacity planning. The method includes receiving supply chain transaction data as transaction tables, generating a base plan and generating updated transaction tables, denormalizing the base plan and the updated transaction tables, generating supply chain network flow paths and supply chain network data, solving a rough cut capacity planning problem based at least in part on the supply chain network flow paths, the supply chain network data and simulation data, repeating at least the generating and solving until business goals of the rough cut capacity planning meet a threshold, and updating the simulation data based on an upsert process. The method further includes relaxing supply chain network constraints, inverting the supply chain network, and traversing a perturbation in the supply chain network constraints as demands in a reverse direction towards customer nodes.

The invention provides a network data threat detection model training method, a threat detection method and a threat detection device. The method comprises the following steps: intercepting network flow front-end data in a preset byte range from each sample flow, and performing word segmentation to obtain words; the word one-hot vector is used as a byte node, and the TF-IDF sequence of each word in the stream is used as a network stream node. Setting a first type of edge weight as a TF-IDF value to realize byte-stream association; and extracting semantic embedding of all byte nodes by using a pre-trained bidirectional LSTM (Long Short Term Memory), establishing a second class of edges for byte pairs of which the cosine similarity is higher than a threshold value, and calculating the weights of the byte pairs by using global co-occurrence statistics to form a semantic association graph without topology. And constructing an initial model containing double layers of GCN and Softmax, taking graph data with threat type labels as a training set, and updating parameters by minimizing cross entropy loss to obtain a network threat data detection model. According to the method, the generalization ability can be improved, and when the graph data topology is incomplete, the graph structure capable of representing the behavior association relationship is effectively constructed to improve the network data threat detection ability.

The invention relates to a domain name analysis method, device, system and equipment. The method is applied to a first-level cluster, and comprises the following steps: obtaining network flow message data corresponding to a network flow; forwarding the network flow message data to a secondary cluster according to a message forwarding strategy; wherein the network flow message data is used for indicating the secondary cluster to perform domain name resolution processing on the network flow message data to obtain domain name information. According to the invention, the domain name extraction efficiency can be effectively improved.

The present invention relates to a network asset processing method, system, device and medium based on traffic analysis, the method comprising: collecting network traffic to be analyzed, filtering the collected network traffic; performing stream session management on the filtered network traffic to obtain a network stream session; identifying the application layer protocol from the network stream session through built-in protocol rules or custom protocol rules, and parsing the corresponding field features according to the identified application layer protocol type; when the corresponding application layer protocol cannot be identified from the network stream session based on the built-in protocol rules or custom protocol rules, identifying the application layer protocol through a pre-trained supervised machine learning algorithm model; based on the identified application layer protocol and field features, performing asset identification processing of a specified network segment, and generating a corresponding asset log, so as to perform corresponding network asset management for the asset log. The present invention can effectively collect and safely manage network assets of an electric energy system.

The invention discloses a social robot discovery method and system based on flow multi-modal feature fusion. The method comprises the following steps: 1) acquiring encrypted network flows of T types of robots and marking the encrypted network flows to obtain a robot encrypted flow data set on a social platform; wherein fz is a behavior sequence sample of the zth robot; the method comprises the following steps: constructing an OBTT model, wherein the OBTT model comprises an original traffic-to-grey-scale map module, an original sequence feature encoding module, an encoder, a decoder, a time-LSTM module, a feature fusion module and a full-connection neural network; 2) using the unmarked robot encryption network flow to train the OBTT model; 3) performing fine tuning on the trained OBTT model by using the marked robot encrypted traffic data set on the social platform; and 4) inputting a to-be-detected encrypted network flow into the fine-tuned OBTT model to obtain a corresponding robot category. According to the invention, the capability of detecting different robot behavior modes is enhanced.