247 results about "NetFlow" patented technology

The invention relates to the technical field of network security, in particular to a dynamic access blocking method based on zero trust. Comprising the following steps: step 1, collecting whole network flow data in real time in a bypass monitoring mode through a flow mirroring function of a network switch, performing deep packet inspection analysis on the collected original flow data, and extracting network flow characteristic parameters; 2, maintaining a dynamic identity information base; 3, performing real-time behavior analysis on each network session; 4, according to the risk assessment result and the real-time security context, generating a dynamic access control strategy based on a minimum permission principle; 5, implementing access control at the network execution point; and 6, continuously monitoring the network flow and the strategy execution effect, collecting feedback data, optimizing the risk assessment model and the strategy generation algorithm based on the feedback data, and forming closed-loop control. By dynamically updating the identity and asset information, the system can identify new assets or changes in real time, so that the adaptability and response capability of a network environment are improved.

Technologies for creating an optimized and accelerated network pipeline using an emulated network pipeline abstraction layer (NPAL) of an emulated data processing unit (DPU), including an emulated processing device and an emulated acceleration hardware engine, are described. The emulated NPAL supports multiple network protocols and network functions in an emulated network pipeline. The emulated network pipeline includes a set of tables and logic organized in a specific order to be accelerated by the emulated acceleration hardware engine. The emulated acceleration hardware engine can process network traffic data using the emulated network pipeline.

Technologies for creating an optimized and accelerated network pipeline using a network pipeline abstraction layer (NPAL) for policy-based routing (PBR) over Service Function Chaining (SFC) are described. A DPU includes acceleration hardware engine to provide a single accelerated data plane. A processing device can generate a first virtual bridge and a second virtual bridge, the first virtual bridge to be controlled by a first network service hosted on the DPU and having a set of one or more network rules, and the second virtual bridge having a policy-based routing policy (PBR policy). The processing device can add the virtual port between the first virtual bridge and the second virtual bridge. The acceleration hardware engine, in the single accelerated data plane, can route network traffic data using the PBR policy and process the network traffic data using the set of one or more network rules.

Technologies for creating an optimized and accelerated network pipeline using a network pipeline abstraction layer (NPAL) are described. A DPU includes DPU hardware and memory that stores DPU software with the NPAL that supports multiple network protocols and network functions in a network pipeline. The network pipeline includes a set of tables and logic organized in a specific order to be accelerated by an acceleration hardware engine of the DPU. The acceleration hardware engine processes network traffic data using the network pipeline.

Technologies for creating an optimized and accelerated network pipeline using a virtual switch and a network pipeline abstraction layer (NPAL) for fast link recovery are described. The virtual switch can monitor a link availability of each of a plurality of links to a destination, the plurality of links being specified in an initial group of identifiers. The virtual switch can detect a link failure of a first link of the plurality of links. The NPAL can remove a first link identifier, associated with the first link, from the initial group of link identifiers to obtain a modified group of link identifiers. The NPAL can cause a routing table in the NPAL to be updated to remove the first link identifier. The acceleration hardware engine can process network traffic data using the network pipeline and distribute the network traffic data to only the remaining links of the plurality of links.

Technologies for creating an optimized and accelerated network pipeline using a network pipeline abstraction layer (NPAL) for split interfaces are described. A DPU includes a physical port configured to couple to a breakout cable that physically couples to a set of a plurality of devices, DPU hardware, and a memory operatively coupled to the DPU hardware. The NPAL supports a plurality of logical split ports, each logical split port corresponding to one of the plurality of devices, wherein the network pipeline comprises a set of tables and logic organized in a specific order to be accelerated by the acceleration hardware engine. The acceleration hardware engine is to process the network traffic data using the network pipeline.

The invention provides an intelligent optical cable performance prediction method and system for a data center, and relates to the technical field of data center performance analys.The intelligent optical cable performance prediction method comprises the steps that firstly, an optical cable microstructure disturbance quantization model is constructed, and an optical cable is divided into a plurality of virtual quantization units in the longitudinal direction; each unit packages a real-time stress-strain state parameter and a response sensitivity coefficient of the basic structure unit, inputting a Brillouin scattering spectrum frequency shift data flow collected in real time into the model for disturbance source analysis, generating a physical excitation decomposition sequence, driving a virtual quantization unit to perform state evolution iterative operation according to the physical excitation decomposition sequence, and obtaining a Brillouin scattering spectrum frequency shift data flow model; a stress-strain state evolution track set is obtained, a time-space correlation network of optical cable link disturbance propagation is constructed according to the stress-strain state evolution track set, network flow characteristic analysis is conducted on the time-space correlation network, an early warning node set is extracted, the future evolution trend of the early warning node set is calculated, and serialized optical cable performance abnormity early warning information is generated. The optical cable performance abnormity can be predicted in advance, and stable operation of the data center optical cable is guaranteed.

The invention discloses a power grid material vehicle path planning method, and provides a space-time hierarchical modeling and cloud edge collaborative optimization architecture aiming at the problems of dynamic embargo, channel capacity fluctuation, multi-resource conflict, response lag and the like faced by power grid material dispatching in the prior art. By constructing a space-time coupled channel capacity-path planning hierarchical model, multi-commodity network flow pre-calculation and real-time vehicle path dynamic decoupling are carried out, and material distribution is optimized in combination with a space-time double-coding genetic algorithm; a multi-agent deep game decision-making mechanism is designed, channel priorities of different types of materials are dynamically balanced through reinforcement learning, and distributed conflict resolution is achieved; a block chain-based cross-domain scheduling instruction synchronization system is developed, low-delay path re-planning is realized by adopting a differential updating mechanism, and second-level updating of a scheduling scheme under an emergent road condition is supported; the on-chain evidence storage technology is introduced to guarantee instruction integrity and operation tracing, and the scheduling deadlock risk is reduced in combination with a key channel competition early warning model.

The invention relates to a method for detecting a particular cryptographic algorithm used in a computer system, comprising steps of capturing data packets exchanged with a target machine in order to obtain initial measurements of time and data volume, calculating response delays by measuring the time elapsed between sending and receiving the captured data packets, determining a first time signature indicative of a cryptographic algorithm used to generate the captured packets on the basis of the calculated response delays and the exchanged data volumes, determining a level of correspondence between the first time signature determined and at least one second time signature determined beforehand for a particular cryptographic algorithm, and transmitting an alert comprising at least one identifier of a source apparatus and / or of a destination apparatus of the network flow when the level of correspondence is greater than a threshold.

The invention provides a network data threat detection model training method, a threat detection method and a threat detection device. The method comprises the following steps: intercepting network flow front-end data in a preset byte range from each sample flow, and performing word segmentation to obtain words; the word one-hot vector is used as a byte node, and the TF-IDF sequence of each word in the stream is used as a network stream node. Setting a first type of edge weight as a TF-IDF value to realize byte-stream association; and extracting semantic embedding of all byte nodes by using a pre-trained bidirectional LSTM (Long Short Term Memory), establishing a second class of edges for byte pairs of which the cosine similarity is higher than a threshold value, and calculating the weights of the byte pairs by using global co-occurrence statistics to form a semantic association graph without topology. And constructing an initial model containing double layers of GCN and Softmax, taking graph data with threat type labels as a training set, and updating parameters by minimizing cross entropy loss to obtain a network threat data detection model. According to the method, the generalization ability can be improved, and when the graph data topology is incomplete, the graph structure capable of representing the behavior association relationship is effectively constructed to improve the network data threat detection ability.

The invention relates to a domain name analysis method, device, system and equipment. The method is applied to a first-level cluster, and comprises the following steps: obtaining network flow message data corresponding to a network flow; forwarding the network flow message data to a secondary cluster according to a message forwarding strategy; wherein the network flow message data is used for indicating the secondary cluster to perform domain name resolution processing on the network flow message data to obtain domain name information. According to the invention, the domain name extraction efficiency can be effectively improved.

The invention relates to the technical field of network security, in particular to a routing anomaly detection method and device of an autonomous system and electronic equipment. Determining a traffic behavior data set of each AS node based on the routing data and the Netflow traffic statistical data of each AS node in a preset time window; constructing a spatial-temporal feature sequence based on the registration data and the traffic behavior data set of each AS node in a preset time window; performing spatial enhancement processing on the spatial-temporal feature sequence by using a structured correlation model to generate a spatially optimized spatial-temporal feature sequence, the structured correlation model being generated according to the topological relationship among the AS nodes; performing time feature extraction on the spatially optimized spatial-temporal feature sequence to obtain a spatial-temporal feature abstract matrix of each AS node in a preset time window; and performing anomaly judgment on the spatial-temporal feature abstract matrix to obtain a detection result of each AS node route. The accuracy of AS routing anomaly identification is enhanced, and the false alarm rate is effectively reduced.

The present disclosure is directed to implementations of systems and methods for quality-of-experience (QoE)-aware quality-of-service (QoS) management for network flows. In some implementations, a wireless transmit receive unit (WTRU) may transmit to a network a registration request comprising quality-of-experience (QoE) assistance information. The WTRU may receive, from the network, a registration acceptance response indicating a QoE-Aware Quality-of-Service Function (QQF) of the network is configured to provide flow control or QoS management for an application of the WTRU based on the QoE assistance information. The WTRU may execute the application and monitor a QoE score during execution of the application. Responsive to a change in the QoE score, the WTRU may transmit to the QQF one or more network or application performance measurements.

The invention discloses a communication data analysis system and method for network security, and relates to the technical field of computer internet. Time sequence features, protocol semantic features and interactive topology features of communication session historical data are extracted based on network flow data; the method comprises the following steps of: acquiring a time sequence feature, a protocol semantic feature and an interactive topology feature, fusing the time sequence feature, the protocol semantic feature and the interactive topology feature into a unified high-dimensional feature vector, acquiring a communication behavior record and a communication behavior dynamic feature vector of network equipment in a communication network, calculating a digital feature of a coupling relationship evaluation value, and when a certain communication session occurs, judging whether the communication session occurs or not. The method comprises the following steps of: calculating real-time coupling relationship evaluation values among network equipment, quantifying the difference degree of the real-time coupling relationship evaluation values through digital characteristics, accumulating the coupling relationship evaluation values in the process of performing a certain communication session, calculating the total anomaly degree of the communication session, and calculating the abnormal degree of the communication session. The method aims at solving the problems that advanced persistent threats are difficult to effectively recognize, feature expression is insufficient and the perceptual ability is weak in the prior art.

Improved network traffic flow processing techniques are described. In a network device providing multiple processing planes, each processing plane comprising multiple processing units, techniques are described that take advantage of flow affinity / locality principles such that the same processing component of a processing plane, which previously performed processing for a network flow, is used for performing subsequent processing for the same network flow. This enables faster processing of network traffic flows by the network device. In certain implementations, the techniques described herein can be implemented in a network virtualization device (NVD) that is configured to perform network virtualization functions.

The invention provides an Internet of Vehicles DNN collaborative reasoning method based on a rate splitting multiple access technology. The method comprises the following steps: S1, establishing an edge computing system model; s2, establishing a communication model; s3, based on a rate splitting multiple access strategy, a road side unit RSU divides the information sent to each group of vehicles into a public flow and a private flow, and distributes a precoding matrix for each group; s4, in combination with a given DNN partition strategy and an RSU computing resource allocation method, calculating the communication rate received by each vehicle by using a continuous convex approximation algorithm; s5, on the basis of the communication rate and RSU computing resources, constructing a directed acyclic graph model of a DNN reasoning task, expanding the model into a network flow graph, and performing task partitioning on the model by adopting a genetic algorithm to minimize reasoning time delay to obtain a corresponding edge-vehicle partition node set; s6, converting an optimization problem into a KKT condition, and solving an optimal allocation scheme of RSU computing resources; and S7, repeating the steps from S4 to S6, and carrying out iterative updating to obtain an optimal solution of the system.

The invention discloses a channel scheduling method and a storage medium, and the method comprises the steps: building a network flow-discretization ship kinematics model based on channel parameters which comprise ship lock parameters and ship channel parameters; first real-time data of the ship arriving at the ship lock is obtained in real time, a queuing strategy is obtained, and the first real-time data comprises ship arrival time, departure port information and destination port information; generating a ship lock scheduling plan based on the network flow-discrete ship kinematics model and a queuing strategy; and if the ship leaves the ship lock, generating a ship lane scheduling plan based on the network flow-discretization ship kinematics model. According to the method, the channel topology is abstracted into the network flow model with capacity constraint, and discretization simulation is carried out on ship microcosmic motion in a superposition manner, so that multi-scale coupling of macroscopic scheduling and microcosmic behaviors can be realized, the channel congestion prediction error rate is reduced, and the scheduling efficiency is improved.

The invention relates to an encrypted traffic classification method and system based on semi-supervised contrast learning, and a storage medium, and the method comprises the steps: 1, carrying out the flow division of an original encrypted traffic, respectively aligning the header and load of a data packet in a network flow, and generating an enhanced header and an enhanced load according to an enhancement strategy; step 2, multi-granularity feature extraction: a double-branch feature extractor is adopted to process an enhanced head and an enhanced load respectively, a cross attention mechanism is utilized to obtain fused flow level representation, and depth features are extracted through Mama; and step 3, semi-supervised contrast learning: the contrast learning loss and the cross entropy loss of the label data and the FixMatch loss of the non-label data are integrated, and an encrypted traffic fine-grained classifier is trained. The method has the beneficial effects that the noise propagation is jointly inhibited by comparing the feature structured constraint of learning and a high-confidence threshold filtering mechanism in FixMatch, the training stability is improved, and the labeling cost is remarkably reduced.

This invention relates to the field of network traffic splitter technology, and discloses a high-performance Netflow packet output method, system, and storage medium. The method involves receiving packets and parsing them; generating dynamic entries based on the parsed packet information and storing these dynamic entries in the FPGA's built-in high-bandwidth memory; simultaneously triggering the generation of quasi-static entries, which are stored in external DDR4 memory; establishing an association index between the dynamic and quasi-static entries using a 5-tuple hash value; and triggering the flow information association output of the quasi-static entries when the dynamic entries age, framing and outputting packet statistics, 5-tuples, MAC addresses, and IP version numbers according to the Netflow packet output format. This method enables the collection and output of 400G network traffic flow information with extremely low resource and peripheral consumption.

This invention provides a method, device, and medium for segmenting network flow data packets, relating to the field of network flow data packet segmentation technology. The method includes: determining the communication type between terminal devices corresponding to target network flow data; segmenting the target network flow data using a preset fixed duration; obtaining the target task identifier corresponding to the target network flow data; segmenting the target network flow data using the segmentation duration corresponding to the task identifier in the segmentation duration mapping table that is the same as the target task identifier; if the target task identifier does not exist in the preset segmentation duration mapping table, then segmenting the target network flow data using a preset fixed duration to obtain several network flow data packets corresponding to the target network flow data. This invention can significantly improve the processing efficiency and resource utilization of subsequent data packet caching, transmission, disk storage, and analysis stages.

A network intrusion detection system counterattack method, the method comprises the following steps: training a Transform flow feature encoder based on a SimCLR contrast learning framework, extracting a feature representation of a network flow, and constructing a flow feature embedding space; using flow feature similarity to retrieve the most similar benign flow for the target malicious flow, pre-training a strategy network through behavior cloning to achieve imitation learning warm-up; using flow feature similarity increments as intermediate rewards, weighting with escape rewards to construct a deep reinforcement learning reward function; using a curriculum learning strategy to dynamically adjust the reward weight, training a PPO algorithm in a continuous action space to generate a counterattack flow, and realizing counterattack. The cold start problem of deep reinforcement learning is solved through imitation learning warm-up, the sparse reward problem in long sequence decision is alleviated through similarity intermediate reward, and the success rate of counterattack is significantly improved.

A computer-implemented system and method for scoring and ranking entities based on network-derived popularity metrics is disclosed. The invention collects data from multiple networked sources using asynchronous retrieval services, processes and normalizes the data via a server-based system, and employs analytics— including natural language processing and trend analysis— to generate popularity profiles. A ranking module calculates dynamic weighted scores to produce final rankings, which are presented to users through an interactive output interface. A model registry and quality assurance processes further ensure accuracy and adaptability, providing a scalable, real-time solution for dynamic popularity analysis.

The application discloses an APT flow detection method based on a knowledge graph, which comprises the following steps: analyzing network data flow characteristics in network flow, establishing a knowledge graph of network data flow, and classifying the established network flow knowledge graph by using a graph neural network algorithm to detect APT attack flow in the network, so that the attack behavior of an APT organization can be detected from the network level. The application can detect unknown APT attack network data flow, and is helpful for flexibly and accurately detecting APT flow.

In one embodiment, a network device includes a network interface to receive packets over a packet data network, packet processing circuitry to manage a multiplex network receive queue, and including a policer to provide queue fairness for a plurality of network flows competing for access to the multiplex network receive queue, and including meters to label the received packets, and selectively operate in (a) a two-level mode with two-levels of the meters, and (b) a single-level mode with a single one of the meters, and queueing logic to add some of the received packets to the multiplex network receive queue and drop others of the received packets responsively to labelling of the packets by the meters.

The application provides a charging demand regulation and guidance method and device for autonomous on-demand mobile vehicle fleet, and belongs to the field of electric vehicle charging regulation and guidance. The method comprises the following steps: a network flow optimization scheduling model of the autonomous on-demand mobile vehicle fleet and an optimal pricing model of a charging station operator are respectively constructed; based on master-slave game, the optimal pricing model of the charging station operator is taken as an upper model, and the network flow optimization scheduling model of the autonomous on-demand mobile vehicle fleet is taken as a lower model; the lower model is embedded into the upper model as a constraint condition, an updated optimal pricing model of the charging station operator is obtained and solved, so that a pricing scheme for regulating the charging demand of the autonomous on-demand mobile vehicle fleet is obtained. In the decision-making process of charging pricing, the time and space behavior mode and the price response characteristics of the autonomous on-demand mobile vehicle fleet are fully considered, and a targeted price signal is formulated according to the price response characteristics, so that the regulation efficiency of the autonomous on-demand mobile vehicle fleet is improved.

The invention provides a network flow table automatic analysis method and system based on an OpenFlow technology, relates to the technical field of operation and maintenance of a cloud computing data center network and a software defined network, and aims to carry out automatic routing inspection and positioning aiming at the problems of missing, repetition and inconsistency of a CVK host flow table at a bottom layer of a cloud platform. The method comprises the following steps: inputting target CVK host access information and carrying out connectivity and authentication verification; traversing virtual machine network information on the CVK host, connecting the Redis to query security group information associated with a virtual network card, and detecting missing of a security group flow table; the offline state of the network-cvk-agent service is checked, whether the network-cvk-agent service is caused by missing of a basic flow table of a network port or not is positioned in the offline mode, and missing information is output; detecting repetition and inconsistency of the basic flow table when the basic flow table is not offline or not missing; and finally, all task results are summarized and output to a console, and repair guidance is provided in a knowledge base link form, so that operation and maintenance personnel are helped to quickly position root causes and recover businesses.

Technologies for creating an optimized and accelerated network pipeline using a shared interface Network Pipeline Abstraction Layer (NPAL) are described. A Data Processing Unit (DPU) comprises a physical port configured to couple with a breakout cable, which is physically coupled to a set of multiple devices, DPU hardware, and memory operationally coupled to the DPU hardware. The NPAL supports multiple logically split ports, with each logically split port corresponding to one of the multiple devices. The network pipeline comprises a set of tables and logic organized in a specific order to be accelerated by the acceleration hardware engine. The acceleration hardware engine is designed to process network traffic data using the network pipeline.

The application relates to a key power transmission section optimization identification method under an extreme event N-K broken line fault scene, which comprises the following steps: S1, converting a power grid into a non-directed graph, searching and deleting a hanging node in the non-directed graph, and finding a cut point of the simplified non-directed graph through a Tarjan algorithm; S2, performing power flow calculation on a large power grid to obtain power flow of each line in the power grid, and establishing a network flow graph of each partition of the large power grid according to a power flow calculation result and a maximum transmission power rating of the line; S3, iteratively searching by excluding each edge in an initial cut set in turn, identifying and deleting redundant cut edges and invalid cut edges, until the search of all minimum cut sets in the network flow graph is completed, and a power transmission section is obtained; and S4, obtaining a key power transmission section with an overload tripping risk when N-K lines are broken. The application can quickly and effectively identify the key power transmission section of the large power grid under an extreme event such as a natural disaster, and ensures safe and reliable operation of the large power grid.

SCS negotiation can be used to establish different QoS profiles for a network flow. However, switching between tiers and / or profiles using SCS messages (which are typically management frames) is time consuming. SCS messages are typically processed in the host processor (e.g., a host central processing unit (CPU)) in the AP. Instead, the embodiments herein discuss signaling schemes to quickly switch between quality tiers or QoS profiles using data or control frames.

The application discloses a network congestion control method for minimum bandwidth guarantee, and comprises the following steps: (1) distinguishing the types of network flows, wherein the types comprise deadline flows and non-deadline flows; (2) setting minimum window values according to the types of network flows; (3) adjusting the congestion window values according to the minimum window values and the congestion degrees when adjusting the congestion windows in each stage of the congestion control. The application further discloses a network congestion control device for minimum bandwidth guarantee and a computer readable storage medium, which are used for realizing the network congestion control method for minimum bandwidth guarantee. The application can guarantee the minimum bandwidth of TCP deadline flows and achieve the purpose of congestion control by distinguishing the deadline flows and the non-deadline flows.