116 results about "Network traffic management" patented technology

The invention discloses a multi-layer network flow dynamic monitoring and analysis method based on a graph neural network. The method comprises the following steps: S1, collecting data of each node in real time and preprocessing the data; s2, dividing the preprocessed data based on a preset time window, and constructing graph structure data; s3, carrying out topology learning on the constructed graph structure data by adopting an improved EvolveGCN, and generating final feature representation of dynamic change of a network topology structure; s4, carrying out modeling on the preprocessed data by utilizing Graph WaveNet, and extracting final feature representations of space-time dependency and local spatial correlation; s5, performing feature fusion to generate a comprehensive feature vector; s6, generating a final monitoring result based on the comprehensive feature vector; and S7, transmitting the final monitoring result to a network flow management platform for data processing and analysis. According to the method, an efficient and scientific optimization scheme can be provided in dynamic monitoring of the network traffic, and remarkable technical values and economic benefits are brought to practical application.

The invention discloses a distributed traffic mirror image acquisition method based on an OVS flow table and a VXLAN protocol, and the method comprises the following steps: S1, initializing a working environment, and configuring an OVS service; s2, creating a virtual machine and acquiring network bridge information of the virtual machine; s3, binding the VXLAN tunnel interface to a network bridge of the virtual machine; s4, adding a flow table rule in the network bridge to realize flow matching and mirror image output; s5, the rules are dynamically adjusted through an adaptive flow table optimization algorithm, and the flow processing efficiency is improved; s6, detecting and removing repeated data packets by using an in-segment data deduplication algorithm; s7, receiving the mirror image data and carrying out traffic summarization and classification processing; and S8, completing distributed flow collection, and obtaining high-quality flow data for analysis and processing. According to the method, additional services are not needed, the deployment process is simplified, the flow collection efficiency and the data integrity are improved through dynamic adjustment and de-duplication optimization, and the method is suitable for network flow management and analysis of a large-scale cloud computing environment.

The invention provides a traffic processing method and device based on deep packet inspection, equipment and a medium, relates to the technical field of network management, and is used for solving the problem that a traditional traffic management mode cannot accurately identify a complex protocol. Storing the at least one plug-in into an array corresponding to the target chain; when the target data packet enters the PREROUTING chain, extracting session information from the target data packet; performing deep packet inspection analysis according to the session information to obtain an analysis result; when the target data packet enters the target chain, calling at least one plug-in in sequence according to a preset priority; and the at least one plug-in processes the target data packet according to the analysis result. According to the method, a complex application layer protocol can be accurately identified through a deep packet inspection technology, and the plug-in dynamically processes the traffic according to a deep packet inspection result, so that efficient, intelligent and refined network traffic management is realized.

A system for optimizing network traffic management is provided. The system includes a plurality of data processing units (DPUs), each assigned an identifier and configured to process network traffic for associated virtual network interface cards (vNICs). The system also includes a vNIC placement handler configured to receive media access control (MAC) address information from the plurality of DPUs and execute a relocation of at least two vNICs to be directly associated with one of the plurality of DPUs without through an inter-DPU physical network based on mapping the MAC address information to the identifier. The system further includes a communication framework integrated with the vNIC placement handler to enable transmission of MAC address information from the plurality of DPUs to the vNIC placement handler and offload network traffic from the vNICs to corresponding one or more of the plurality of DPUs.

Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with optimizing selection from hardware security servers includes receiving data from candidate hardware security servers after sending an operation status request or a capability query to the candidate hardware security servers. The hardware security requirements can comprise of one or more server operation rules. Then, generating compliance scores for the candidate hardware security servers based on hardware security server requirements, built-in hardware security server requirements, and received data from the candidate hardware security servers. The method can then include generating a rank for the candidate hardware security servers based on the compliance scores of the candidate hardware security servers and providing the hardware security server recommendation for one of the candidate hardware security servers to the client based on the generated rank of the candidate hardware security servers with compliance scores above a predetermined threshold.

The invention discloses a flow characteristic adaptive QoS intelligent prediction adjustment method, and relates to the field of network flow management, and the method comprises the steps: 1, collecting flow data in real time, and constructing a multi-dimensional characteristic vector based on protocol types, port numbers and user behavior dynamic classification; 2, high-frequency / low-frequency components are separated, and QoS parameter prediction is output through fusion of an LSTM short-term prediction module and a periodic trend analysis module; 3, solving a resource pre-allocation scheme by adopting reinforcement learning by taking minimization of packet delay as a target; and 4, executing traffic identification, speed limiting and priority queue scheduling by using NPU hardware unloading. According to the method, the precision is improved through a high-frequency / low-frequency combined prediction architecture, decision delay is compressed to a large extent through reinforcement learning and NPU cooperation, and meanwhile online model iteration is achieved through a prediction error triggering mechanism.

The invention relates to the technical field of cloud computing virtual networks, and discloses a flow data distribution method and device, a server and a storage medium. The method comprises the following steps: acquiring a pre-configured routing rule and a flow data packet to be distributed; analyzing the traffic data packet, and determining a source address of the traffic data packet; matching the source address with a pre-configured routing rule, and determining a target forwarding path of the traffic data packet based on a matching result; and forwarding the traffic data packet from the source address to the target address according to the target forwarding path. By implementing the technical scheme of the invention, the flow data packet can be intelligently distributed based on the pre-configured routing rule, and the network flow management and forwarding efficiency is improved.

The invention relates to the technical field of flow management, in particular to a communication network flow management system which comprises a flow monitoring module, an abnormal flow processing module, a flow priority adjusting module and a network load balancing module. According to the method, the abnormal data flow can be identified by analyzing the distribution characteristics of the communication data flow in real time, the abnormal level can be quantitatively evaluated according to the abnormal influence, the flow limiting is more targeted by positioning the source node of the abnormal flow and implementing the bandwidth limitation according to the abnormal level, the flow limiting degree can be adjusted as required, unnecessary broadband waste is avoided, and the flow limiting efficiency is improved. By considering the importance and real-time performance indexes of services, when the priority of communication data is adjusted, the performance of key applications is guaranteed preferentially, and by monitoring the delay and packet loss conditions of nodes in real time and intelligently adjusting node bandwidth allocation according to the flow priority, the overall operation efficiency and stability of a network are improved, and the network performance is improved. And the network performance management is optimized.

Technologies are disclosed for performing context-aware routing of traffic based on an application of a series of filters and / or selectors to determine an optimal group of interfaces for servicing traffic relating to a prefix. A traffic management control plane processes input data corresponding to aggregated telemetry data for a network by determining candidate groups of interfaces to service a network prefix and applies tunable filters and / or selectors to the candidate groups to determine a targeted group to use for servicing traffic corresponding to the prefix. The determined targeted group is mapped to the prefix in a mapping result, which is then provided to an actuator interface to control network devices to inject the new mapping into the network to control traffic according to the mapping.

Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with mitigating DDoS attack using a hardware device includes determining when a received network packet in an established connection between a client and a destination server includes a connection identifier cookie. A connection validation cookie is generated based on at least data in the received network packet, when the determination indicates the received network packet includes the connection identifier cookie. The connection identifier cookie is compared against the generated connection validation cookie. The received network packet is dropped when the comparison indicates the connection validation cookie fails to match the connection identifier cookie.

The invention discloses a flow control method and device, a storage medium and electronic equipment, and relates to the technical field of network flow management, and the method comprises the steps: determining a plurality of feature vectors matched with input network flow based on a plurality of feature extraction modules; performing feature fusion processing on the plurality of feature vectors through a gating attention mechanism to obtain distribution strategy features, and determining a traffic distribution strategy matched with the input network traffic according to the distribution strategy features; determining network resources respectively allocated to the network traffic of the plurality of traffic categories in the input network traffic according to a traffic allocation strategy; updating a flow distribution strategy according to the network transmission performance information; the decision model updating strategy is adjusted in real time based on the strategy execution result, learning and optimization of the adaptive network state in the operation process are achieved, it is ensured that the long-term service quality index is kept at the optimal level, the technical problems that the flow distribution strategy is poor in performance and cannot meet the requirement are solved, and the technical effect of improving the network resource utilization rate is achieved.

The application relates to the technical field of network flow management, and discloses a network flow detection method and device. The method comprises the following steps: a gateway acquires to-be-detected network flow corresponding to a specified port on a server; the gateway classifies and processes to-be-detected flow data according to a preset rule to obtain flow data corresponding to each flow type, wherein the preset rule is a classification rule set for the flow type; the gateway performs abnormality detection on the flow data of each flow type to obtain to-be-distributed flow data; the gateway distributes the to-be-distributed flow data to a service node associated with the corresponding flow type; and the service node performs abnormality detection on the flow data received from the gateway when the micro service of the service node is started. Through implementation of the application, the gateway and each service node can directly perform independent abnormality detection on the flow data, and the detection time of malicious flow is saved, and the detection efficiency of the malicious flow is improved.

The invention relates to the technical field of network traffic data analysis, in particular to a network traffic data analysis method based on a traffic large model. The method comprises the following steps: collecting network flow data from network flow management equipment, analyzing messages in a flow data packet based on a network protocol or application features and the like, and extracting key feature information; and recording corresponding specific behavior operation of the traffic data in the network platform by using the data label, collecting and forming a behavior data set, constructing a traffic large model based on the general large model, and training and verifying the model by inputting the behavior data set. The large model is applied to network management equipment, behavior data of network users are recorded, then the behavior data are counted to form a visual chart, possible behaviors of the next network users can be predicted through the current behavior data, and network managers are helped to supervise behavior specifications of the users and guarantee safety of a network platform.

Technologies related to mitigation of volumetric distributed denial of service attacks are disclosed. Malicious network connection request detection can be performed using a first network traffic management module (NTMM) that executes before network connection resources are allocated and a second NTMM that executes after connection resource allocation. The second NTMM can be used to determine whether a connection request is from a potential bad actor. If the request is from a potential bad actor, the second NTMM can add an identifier for the potential bad actor to a list of potential bad actors. When a subsequent connection request is received, the first NTMM can generate the identifier based on the subsequent request and determine whether it is stored in the list of potential bad actors. If it is, the first NTMM can drop the subsequent request before connection resources for establishing the second request are allocated.

Methods, non-transitory computer readable media, network traffic management devices, and network traffic management systems that protect resources that are accessible to a secondary device that is connected to a hotspot hosted by a host device that has an established VPN tunnel with a secure server storing the protected resources are illustrated. With this technology, a connection to a protected resource via a VPN tunnel is established by a host device based on a successful compliance check and the host device also simultaneously operates as a hotspot. The host device intercepts one or more data packets from a secondary device that is connected to the hotspot and in response to determining that the data packets have a TTL value that is less than a default value, the host device executes a security action with respect to the data packets.

The invention provides an aggregate communication server node sorting method and device, equipment, a medium and a product, and relates to the technical field of network flow management. Comprising the following steps: acquiring a to-be-sorted server node original list participating in set communication; according to a topology database, querying to obtain topology information of each server node in the server node original list; according to the topological information of each server node, reordering each server node in the server node original list, and generating a topological affinity node list; a list of topological affinity nodes is output for a collective communication operation. According to the method provided by the invention, by ensuring that the adjacent server nodes are at the same level or adjacent levels in the physical topology, the cross-level flow of set communication can be minimized, so that the set communication efficiency is improved, and the time consumption of a training task is reduced.

Technologies related to mitigation of volumetric distributed denial of service attacks are disclosed. Malicious network connection request detection can be performed using a first network traffic management module (NTMM) that executes before network connection resources are allocated and a second NTMM that executes after connection resource allocation. The second NTMM can be used to determine whether a connection request is from a potential bad actor. If the request is from a potential bad actor, the second NTMM can add an identifier for the potential bad actor to a list of potential bad actors. When a subsequent connection request is received, the first NTMM can generate the identifier based on the subsequent request and determine whether it is stored in the list of potential bad actors. If it is, the first NTMM can drop the subsequent request before connection resources for establishing the second request are allocated.

The DPD manager adaptively parses IT network traffic with a DPD ML engine based upon determining a port configuration setting in a network server in an IT network and a protocol utilized by IT network traffic. The DPD manager can detect a non-standard configuration set up for IT network traffic to be processed by a port on the network server, a non-standard protocol utilized by the IT network traffic, and any combination of both, and then completes a deep packet inspection upon the IT network traffic that has the non-standard configuration set up and / or the non-standard protocol utilized by the IT network traffic.

A method for providing efficient overload protection in a 5G core network, a non-transitory computer-readable medium, a network traffic management apparatus, and a network traffic management system are shown. With this technique, a load at a producer network function (NF) is monitored, and in response to determining that the producer NF is overloaded, multiple types of network traffic to the overloaded producer NF are monitored. An overloaded network traffic type is identified, the overloaded network traffic type being a type of network traffic flowing to a producer NF, the amount of the overloaded network traffic type exceeding a first threshold amount above a first baseline amount of network traffic. An overload session is identified that is a session that overloads an amount of network traffic type that exceeds a second threshold amount above a second baseline amount of network traffic. A mitigation action is performed to reduce network traffic from the overload session.

The invention relates to the technical field of network traffic management, in particular to a traffic management and control method and system fusing TSim and eSIM card data, and the method comprises the steps: receiving a traffic management and control instruction initiated by an ith terminal through an interactive gateway, recording the receiving time of the traffic management and control instruction, and if the data interaction amount is greater than or equal to a preset interaction amount threshold value, executing the step 1; and generating a to-be-transmitted data instruction for suggesting to use the eSIM card to send the to-be-transmitted data by using the interactive gateway, returning the to-be-transmitted data instruction to the ith terminal, when the to-be-transmitted data returned by the ith terminal is received, forwarding the to-be-transmitted data to the low-power-consumption network, and if the data interaction amount is smaller than the interaction amount threshold value, sending the to-be-transmitted data to the ith terminal. And generating a to-be-transmitted data instruction for suggesting to use the TSim card to send the to-be-transmitted data by using the interactive gateway, and transmitting the to-be-transmitted data to a target terminal of the ith terminal by using the first service RPL instance or the second service RPL instance. According to the invention, the flexibility and stability of TSim and eSIM card data traffic control can be improved.

The present disclosure is directed to network traffic management and load balancing at a cloud-based secure access service accessible to remotely connected user devices. In one example, a cloud-based secure service system includes a network controller configured to receive network traffic from one or more user devices remotely connected to the controller; parse the network traffic into flow data and contextual information associated with the network traffic; determine that the network traffic is to be serviced by a target firewall service at the cloud-based secure service system based on the flow data and the contextual information; and direct the network traffic to the target firewall service to be serviced.

Methods, non-transitory computer-readable media, network traffic manager devices, and systems to assist in generating insights with TLS parameters include receiving a request from a client to establish a TLS connection to a server. In some examples, the request includes parameters for the TLS connection. Next, the network traffic manager device determines an identity of the client based on the TLS parameter unique to the client in the request, and performs an action to alter handling of the request based on the TLS parameter.

The present disclosure provides a deep reinforcement learning (DRL) based dynamic network traffic management system including a LAN router, a plurality of WAN routers, a network switch, and a GNAT controller configured to measure one or more traffic states of a plurality of data flows, obtain an expected reward at the current time point, obtain the one or more traffic states to input to a DRL model to provide an expected reward of each data flow estimated for a next time point, obtain a target reward at the current time point, adjust parameters of the DRL model, predict a plurality of long-term rewards using the trained DRL model, select one of the plurality of long-term rewards, and adjust the bandwidth assigned to each data flow based on the selected long-term reward.

Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with mitigating DDOS attack using a hardware device includes determining when a received network packet in an established connection between a client and a destination server includes a connection identifier cookie. A connection validation cookie is generated based on at least data in the received network packet, when the determination indicates the received network packet includes the connection identifier cookie. The connection identifier cookie is compared against the generated connection validation cookie. The received network packet is dropped when the comparison indicates the connection validation cookie fails to match the connection identifier cookie.

The application relates to the technical field of network security and discloses a network traffic threat detection and early warning method based on decoupling representation learning, which comprises the following steps: S1, detecting and identifying network traffic data in a network traffic management device to construct a data set containing a threat traffic data set and a normal traffic data set; S2, obtaining potential representation of the threat traffic data set according to a pre-trained Glow generation model; S3, constructing a learning strategy based on traffic changes in a potential space of the Glow generation model according to the potential representation to obtain a threat interpretable direction of a candidate traversal; S4, designing a comparison module through contrastive learning and extracting decoupling representation according to the threat interpretable direction; S5, constructing a threat detection model based on the decoupling representation and setting an early warning mechanism through a result of the threat detection model. The two can be obviously distinguished through decoupling, so that the efficiency of the detection process is improved. The method can well cope with detection and analysis of massive network traffic data.

The application discloses an edge network traffic prediction method based on redundancy reserve pool calculation, comprising the following steps: collecting traffic data of an edge base station, and constructing a training set and a test set according to the traffic data; inputting the constructed training set into an ESN model and training, and collecting a reserve pool state matrix; performing high-dimensional mapping on the reserve pool state matrix by using a ordinal pattern conversion network modeling method, calculating the ordinal complexity of reserve pool neurons according to a complex network measurement index, and determining key and non-key neurons of the reserve pool; balancing migrating the input weight and the internal weight of the key neurons of the reserve pool to the non-key neurons of the reserve pool in a redundant manner to form a new ESN model, retraining the new ESN model, and obtaining an optimal output weight matrix; deploying the trained new ESN model on an edge side network traffic management device, collecting traffic data of the edge base station in real time as input of the model, and obtaining a prediction value of future network traffic as output of the model.

A computer system for managing congestion control of packets includes a processor that implements a network traffic manager including a congestion controller and a socket. The congestion controller determines messages parameters for packets of a plurality of messages and assigns a congestion control algorithm setting to each packet based on the message parameters associated with each packet. The socket includes a buffer with a queue having a plurality of threshold queue positions. The congestion controller determines that a subset of packets exceeds at least a first threshold queue position and selects a congestion control action for each packet in the subset based on the assigned congestion control setting for each respective packet and a position of each respective packet relative to the plurality of threshold queue positions.

Methods, non-transitory computer readable media, network traffic management devices and network traffic management systems that provide for intelligent signaling message steering in 5G core are illustrated. With this technology, a network request is received and a set of features are identified. Based on the set of identified features and a failure probability table, a faulty producer network function (NFs) of a plurality of producer NFs can be identified. A subset of the plurality of NFs that does not include the faulty NF can be defined and the network request can be routed to one of the subset of the plurality of NFs. Accordingly, a network request can be routed away from a NF that, based on the features of the network request, has a relative high probability of resulting in a failure of processing the network request.

Methods, non-transitory computer readable media, network traffic management apparatuses, central management devices, and network traffic management systems that control access to configuration data in a distributed system are illustrated. With this technology, a set of configuration data is stored in a first data structure and a corresponding set of configuration data is stored in a second data structure along with an encrypted digest value that was encrypted using a private key associated with a particular administrator role. The stored configuration data and / or newly received modifications to stored configuration data can be authenticated via a comparison of a digest value calculated using the configuration data compared to the stored encrypted digest value, which is decrypted with a stored public key corresponding to the administrator role. Accordingly, configuration data can be securely controlled by authenticating it as valid in accordance with authorized administrator roles prior to being updated or loaded.