90 results about "Packet classification" patented technology

A method and system for detecting and analyzing internet traffic from Internet of Things (IoT) devices is presented. A network telescope is employed to collect unsolicited data packets. The data packets are analyzed to determine whether they arise from a misconfigured device or from a malicious device (darknet sanitization) or from some other source. Traffic from misconfigured devices is filtered out. The data packets from malicious devices are analyzed and a classification model is trained to classify the data packets into originating from an IoT or from a non-IoT device. The classifier is then validated on a separate set of data. The data packets originating from malicious IoT devices are further analyzed by such techniques a clustering (e.g. agglomerative hierarchical clustering), geo-location analysis, methods of attack, and coordination of attacks.

The present disclosure is related to Multi-Access Management Services (MAMS), which is a programmable framework that provides mechanisms for the flexible selection of network paths in a multi-access (MX) communication environment, based on an application's needs. Generic Multi-Access (GMA) functions are also integrated into the MAMS framework. The present disclosure discusses Per-Packet Prioritization (PPP), intra-flow classification, and Active Queue Management (AQM) techniques for MAMS / GMA systems. Other embodiments may be described and / or claimed.

The invention discloses a power sensitive data identification analysis method and system, and relates to the technical field of power data security analysis, and the method comprises the steps: collecting cross-domain data packets in real time, carrying out the preprocessing, extracting the features of the cross-domain data packets, and carrying out the preliminary screening; constructing a sensitive data identification formula to identify sensitive data in real time; a comprehensive sensitivity model is constructed to calculate the comprehensive sensitivity of the sensitive data, grading is carried out, and corresponding measures are made; and marking the high-sensitivity cross-domain data packet as an abnormal behavior and generating an abnormal behavior report. A constructed sensitive data identification formula is combined with multi-dimensional features such as data packet size, protocol type, transmission time interval and access frequency, dynamic identification of sensitive data is realized, the accuracy of data packet classification is improved, a sensitivity model is synthesized to evaluate the complexity of data packets through information entropy, and a relation between a transmission rate and a data volume is combined, so that the accuracy of data packet classification is improved. Accurate grading of sensitive data is realized.

The invention discloses a power distribution network automatic communication data packet forwarding method based on an improved EPON technology, and the method comprises the steps: 1, classifying and scheduling data packets, and determining the transmission sequence of data packets with different priorities through weighted polling scheduling; step 2, an optical line terminal (OLT) receives the data packet and records sending address information and forwarding rules of the data packet; step 3, the ONU extracts a target address and a forwarding rule, and obtains a position and a connection state to calculate an optimal data transmission path; and step 4, monitoring and managing the operation state, and ensuring the forwarding stability and reliability of the data packet. According to the method for realizing artificial intelligence by improving the EPON technology, automatic communication data packet forwarding is realized, and the transmission efficiency is improved.

The invention discloses a data packet processing method and device, equipment, a storage medium and a product. The invention relates to the technical field of computer networks. The method comprises the steps of coding features of data packets through a pre-trained data packet classification model and determining priorities; coding the numerical characteristics and / or type characteristics of the network traffic through a pre-trained traffic prediction model, and predicting the trend of the network traffic; adjusting the priority and queue length of each data packet according to the prediction result; and in each scheduling, according to the queue length, the priorities of the data packets in the queue and the waiting time, selecting one data packet in the queue, and sending the selected data packet to the network card for processing. The artificial intelligence algorithm is applied to data packet classification and network flow trend prediction, and the data packets in the queue are scheduled according to the priorities based on the data packet classification result and the network flow trend prediction result, so that the network flow change trend can be flexibly adapted while the service processing efficiency of different priorities is ensured.

The invention relates to a packet classification device for flow table normalization storage, electronic equipment and a storage medium, and the device comprises a flow table normalization unit which is used for cutting an original rule set according to two dimensions of a matching domain and a rule domain of the original rule set to obtain rule subsets; the storage mapping unit is used for determining a comparison and selection character string; matching the comparison and selection character string with the rule subsets corresponding to the lengths to obtain first matching results, and forming a single rule subblock by the first matching results corresponding to the same rule subset; taking the regular sub-blocks as a whole, and storing the first matching result in the regular sub-blocks into a storage device; the packet classification searching unit is used for reading a target first matching result matched with a packet header character string from the storage device based on the packet header character string of a to-be-classified data packet; and determining a target forwarding rule corresponding to the to-be-classified data packet based on the target first matching result. Therefore, the scale of the flow table can be improved, and the to-be-classified data can be classified more finely.

The invention belongs to the technical field of information security application, and particularly relates to a message unloading intelligent network card based on ARM + ASIC heterogeneity, the message unloading intelligent network card comprises a message analysis module, an ARM + ASIC heterogeneity module, a flow filtering module and a label adding module, the ARM + ASIC heterogeneity module comprises a GIGABIT MAC module, a rule setting module, a rule searching module, a DDR3 SDRAM controller, a QDR SRAM controller and a PCI-E interface. The intelligent network card based on ARM + ASIC isomerism utilizes the advantages of low cost and low time delay of a domestic chip, realizes high efficiency and high performance of message classification and processing, realizes message classification and filtering in hardware, effectively unloads the overhead of application software for underlying network message processing, and effectively improves the network security application software on a high-speed network. Message capture and data acquisition functions are developed based on an intelligent network card, and the overall performance of the system is effectively improved.

The invention provides a fast and accurate packet classification method based on a learning index, which comprises the following steps: dividing a global rule set into a plurality of rule subsets, and dynamically dividing a key value sequence of each subset into segments with similar distribution trends based on a linear fitting error; the floating point slope parameter and the floating point intercept parameter of each piecewise linear model are coded into integer pairs in a base number-index form, and a lightweight prediction model supporting pure integer operation is constructed; when a to-be-classified data packet is received, all the segment models in each rule subset execute prediction in parallel, and a compact rule group index associated with a target segment is output; and performing parallel retrieval on the rule groups associated with each segment based on the index, and selecting the highest priority rule from matching results of all the rule groups to complete data packet classification.

A method for processing packets, the method comprising receiving a packet by a data processing unit (DPU), making a first determination that there is no exact match flow entry in a hardware switch pipeline in the DPU for the packet, in response to the first determination, classifying, in the DPU, the packet as a data packet, in response to the classifying of the packet: identifying, using a software data plane in the DPU, a forwarding information base (FIB) entry to be used to transmit the packet towards its intended destination, identifying, using the software data plane, a flow associated with the packet, initiating, using the software data plane, programming of an exact match flow entry in the hardware switch pipeline, and initiating, using the software data plane, transmission of the packet towards its intended destination using the FIB entry and the hardware switch pipeline.

Example embodiments describe a method for managing data traffic congestion in a network communication node. The method comprising maintaining a marking probability based on a marking ratio indicative of a change in packets responsible for congestion in a network queue in the network communication node over a change in a total number of packets processed by the network queue. The method further comprising classifying packets processed by the network queue as scalable packets or other packets based on an identifier included in the packets; wherein the scalable packets support scalable congestion control. The method further comprising marking the scalable packets responsible for congestion in the network queue with a congestion mark to signal data traffic congestion; and marking the other packets that support unscalable congestion control with the congestion mark based on the marking probability.

Embodiments of the present application disclose a log packet classification method and a computing device, which are used for classifying a to-be-classified log packet. In the present application, the computing device first determines a plurality of feature types of the to-be-classified log packet, and then determines a plurality of model parameters of the to-be-classified log packet based on the plurality of feature types. Next, the computing device calculates similarities between the to-be-classified log packet and each of K log packet types based on the plurality of model parameters, and obtains K similarities. Finally, the computing device determines a log packet type to which the to-be-classified log packet belongs from the K log packet types according to the K similarities. Thus, the to-be-classified log packet that does not conform to any rule of any of the K log packet types can also be classified.

This invention discloses a blockchain-based information security data defense method and system. In the field of information security defense technology, this invention addresses the technical problem that single-protection errors can reduce data transmission security and negatively impact data transmission. Through reasonable data capacity segmentation, sensitive data identification, and data packet classification, this invention not only improves data transmission security but also adopts corresponding transmission strategies based on the characteristics of different data packets. This ensures both data security and transmission efficiency. Furthermore, it selects different transmission methods based on the characteristics of the data itself and rationally allocates network resources according to actual conditions to ensure secure and efficient data transmission, thereby improving data transmission security. Simultaneously, by replacing existing duplicate data, it further conceals the authenticity of the data content, thereby enhancing data confidentiality and integrity.

The application discloses a kind of combination packet classifier and method based on hash and TCAM, adopt the combination of imperfect hash classification module and TCAM classification module, the complement of imperfect hash classification and TCAM classification on input key value space is realized;Compared with the traditional TCAM packet classification solution based on, the application reduces hardware resource utilization, system power consumption;Compared with the packet classification solution based on perfect hash, the application reduces the design cost of hash function and the time complexity of generation process under the premise of guaranteeing the function of classifier.The application can consider low space resource consumption, low power consumption and low delay in the classification stage, saves design cost in the classifier generation stage, and reduces the time complexity of generation process;Meanwhile, the application can better balance different types of hardware resources on reconfigurable hardware platforms such as FPGA, and provides a new way of thinking for the design of classifier in network tasks such as firewall packet filtering and routing table lookup.

The invention discloses a lightweight routing design method and system suitable for a chain broadband wireless ad hoc network. The system comprises a configuration network node, a definition node routing architecture, a data packet classifier module configured in the node, a delay module, a general module, a neighbor list module, a neighbor information manager module, a delay estimator module, a data packet queue module, a queue processing module, an MAC receiver module and an MAC transmitter module. The method comprises the following steps: calculating queues of delay data packets and general data packets according to data frame structure classification; regularly updating a neighbor list according to the data packets of the adjacency relationship; estimating the time required by local queue transmission; and queuing the delay data and the general data according to the priority, and establishing a forwarding link. According to the invention, the nodes automatically complete path planning and queue ordering in real time according to a routing protocol architecture, unified and centralized scheduling by an upper-layer route is not needed, and network resources are not occupied. According to the method, node resources are utilized to the greatest extent on the basis of ensuring communication delay.

Technologies for programming flexible accelerated network pipelines include a comping device with a network controller. The computing device loads a program binary file that includes a packet processing program and a requested hint section. The binary file may be an executable and linkable format (ELF) file with an extended Berkeley packet filter (eBPF) program. The computing device determines a hardware configuration for the network controller based on the requested offload hints and programs the network controller. The network controller processes network packets with the requested offloads, such as packet classification, hashing, checksums, traffic shaping, or other offloads. The network controller returns results of the offloads as hints in metadata. The packet processing program performs actions based on the metadata, such as forwarding, dropping, packet modification, or other actions. The computing device may compile an eBPF source file to generate the binary file. Other embodiments are described and claimed.

Disclosed is a system (104) and a method (500) for stream-based packet processing in a communication network. The method comprises receiving values corresponding to a plurality of configuration parameters including a parsing unit count. The method further comprises receiving, from a network interface, a plurality of packets corresponding to one or more data streams based upon the values of the plurality of configuration parameters and forming one or more batches of the plurality of packets based on the values corresponding to the plurality of configuration parameters. The method further comprises retrieving the one or more batches stored in a shared memory based on the value of the parsing unit count. The method further comprises parsing the plurality of packets in the retrieved batches to extract protocol header fields and classifying, based on the parsing, the plurality of packets into parsed packets and unparsed packets to enable the stream-based packet processing.

The invention provides a network communication device and method with a dynamic packet transmission sorting mechanism. The packet classification circuit sets each low-latency packet as a selected low-latency packet for storage in a corresponding selected low-latency queue circuit. The transmission sorting circuit calculates a queue time parameter for the selected low-delay packet to sort the selected low-delay packet with other low-delay packets so as to update a sorting list. Wherein the queue time parameter is the proportion of the total queue time of the selected low-delay packet stored in the selected low-delay queue circuit exceeding the dynamic service time threshold value set corresponding to the selected low-delay queue circuit. The communication circuit sequentially transmits the low-latency packets according to the sorting list. The dynamic adjustment circuit calculates the difference between the total packet transmission time of the selected low-delay packet and the target delay threshold value so as to dynamically adjust the dynamic service time threshold value according to the difference.

The present application relates to the field of computer network security technology. The present application provides a network packet classification method based on field distribution entropy and coverage difference, including: obtaining a rule set for a network data packet; dividing the rule set into multiple levels, selecting a rule set with a high optimization level as a candidate rule set; traversing multiple bit segments in the candidate rule set and performing a comprehensive score; selecting the best partitioned bit segment based on the comprehensive score and constructing a tuple hash bucket; establishing a hash table based on the actual value length of the best partitioned bit segment, and distributing the rules to the corresponding tuple hash bucket; traversing each tuple hash bucket for judgment and recursive processing; when the rules of all tuple hash buckets are effectively divided, the tuple hash subtree of the current node is constructed, and the process of rolling back to the previous level or completing the construction of the entire tree is completed. The present application addresses the deficiencies of packet classification technology in terms of search efficiency, structural balance, space utilization, and rule update support.

Systems and methods for determining whether to perform deep packet inspection (DPI) on packets received at a network device based on shallow packet inspection data are disclosed. Embodiments may include DPI classification data in a combined lookup table that is utilized for shallow packet data based packet classification at a network device. Using the results of lookups in such a combined look table based on received packets, determinations can be made whether to perform DPI on such received packets, and those packets forwarded accordingly.

Systems, methods, apparatuses, and computer program products for computer program products for application-centric processing on servers using mobile network connectivity (e.g., 5G system (5GS) connectivity, 6G system (6GS) connectivity, and so forth). A method may include getting information associated with data network terminations. The method may also include establishing, based on the received information, tunnels to setup connectivity between a plurality of data network terminations. The method may further include ensuring that traffic related with edge application servers is sent on the tunnels based on a given quality of service requirement. In addition, the method may include ensuring a given quality of service requirement and / or packet classification information to the traffic.

The application provides a packet classification parallel method and system based on ensemble learning, comprising the following steps: S1, establishing a rule search cost model to quantify the complementarity between different instances of an algorithm; S2, using a genetic algorithm to generate an optimal combination scheme of different instances of the algorithm, and after finding an algorithm instance meeting the requirements, constructing an algorithm instance library; and S3, constructing a packet classification prediction model, and selecting a suitable algorithm instance from the constructed algorithm instance library to complete a packet classification operation. The application first acutely observes the worst case existing in the existing packet classification method and the cause thereof, and under the enlightenment of ensemble learning, mines the complementarity existing between different instances of an algorithm to optimize the performance.

A method of providing differential security services for a ship network by a service provider connected to a client performing the differential security services may comprise: receiving a service request from a user terminal by an authentication performing unit of a service provider including a processor; returning or issuing, by the authentication performing unit, an ID token and an authentication code to the user terminal in response to the service request; receiving, by the client, the ID token and the authentication code from the user terminal; verifying, by the client, validity of the ID token; setting, by the client, a session cookie for the service request when the validity is verified; transmitting, by the client, an access token request including the authentication code to a token issuing unit of the service provider; and receiving, by the client, an access token from the token issuing unit.

A plurality of captured packets are received. The plurality of captured packets are from a plurality of packet flows. A packet flow is a communication session between two devices. For example, a packet flow may be a communication session between a client and a server. The plurality of captured packets are sorted into individual packet flows. The individual packet flows are converted into individual videos. For example, each packet from each packet flow is stored as a separate video frame in an individual video. A machine learning algorithm is applied to the individual videos to perform analytic tasks on the individual videos. For example, the machine learning algorithm may be used to identify anomalies within a packet flow and / or between packet flows.

The invention belongs to the field of computer networks, and discloses a dynamic data packet classification method and system based on a dictionary tree and a multilevel decision tree, and the method comprises the steps: S1, constructing the dictionary tree for IP prefixes of all rules in a preprocessing stage of data packet classification; s2, obtaining prefix huge change points based on the dictionary tree; s3, dividing rule subsets based on the prefix huge change points to obtain accurate rule subsets and complex rule subsets; s4, constructing a main decision tree for the accurate rule subset; inputting the complex rule subset into Box for processing; and S5, constructing a shadow tree or a shadow Box copy of the rule modification operation, and performing pointer replacement through a CAS atomic instruction. According to the method, structural layering, behavior driving and field decoupling are taken as a core design concept, rule pre-division, path structure optimization, update behavior perception and an efficient matching mechanism are comprehensively integrated, and the problems of rule replication redundancy, low path efficiency, dynamic update response lag and the like in data packet classification are solved in a breakthrough manner.

The embodiment of the invention provides a spyware detection method and device based on WiFi hotspot traffic analysis, and the method comprises the steps: capturing the traffic data of all devices connected to a WiFi hotspot, and storing the traffic data of the devices in a time sequence database according to a timestamp; carrying out data packet classification and time sequence analysis on the equipment traffic data based on a time sequence database to obtain a traffic analysis result; and performing comprehensive judgment on the flow analysis result based on a preset rule set, and generating a spyware detection report. According to the scheme, the spyware behavior of the equipment based on the WiFi hotspot can be accurately and efficiently detected.

The present invention relates to a method for implementing a multi-layer tuple space data packet classification algorithm based on a single hash table, and belongs to the field of communication technology. Compared to existing multi-layer tuple space data packet classification algorithm implementations using multiple hash tables, the multi-layer tuple space data packet classification algorithm based on a single hash table implementation simplifies hash table management and is well-suited for implementation in an FPGA. Furthermore, the number of accesses to the tuple space data structure (Tuple), hash node data structure (HashNode), and rule data structure (Rule) in the multi-layer tuple space data packet classification algorithm is also reduced, thereby reducing the number of memory accesses, thereby improving the performance of the multi-layer tuple space data packet classification algorithm.

To provide a differential security service provision method and device for a shipping network that can construct a shipping-dedicated security system by using packet classification based on user authentication.SOLUTION: In an SSO (single sign on) authentication process based on an OIDC (open ID connect) of a differential security service provision device for a shipping network, an authentication execution unit of a service provider 170 receives a service request from a resource owner, and returns an ID token and an authentication code to the resource owner in response to the service request. A client receives the ID token and the authentication code from the resource owner and verifies the validity of the ID token. If the validity is verified, the client sets a session cookie for the service request, transmits an access token request containing the authentication code to a token issuing unit, and receives an access token from the token issuing unit.SELECTED DRAWING: Figure 13

A hardware-based framework is provided that enables a network device to accurately estimate the cardinality of (or in other words, the number of unique elements in) a stream of network packets processed by the device, using minimal memory and compute resources. For example, this framework can enable the network device to accurately estimate the number of unique network flows in the packet stream, the number of unique source Internet Protocol (IP) addresses in the packet stream, the number of unique flows for each of a plurality of packet classification characteristics (e.g., ingress ports on which the packets were received, egress ports on which the packets are sent out, etc.), and so on.

A method of providing differential security services for a ship network by a service provider connected to a client performing the differential security services may comprise: receiving a service request from a user terminal by an authentication performing unit of a service provider including a processor; returning or issuing, by the authentication performing unit, an ID token and an authentication code to the user terminal in response to the service request; receiving, by the client, the ID token and the authentication code from the user terminal; verifying, by the client, validity of the ID token; setting, by the client, a session cookie for the service request when the validity is verified; transmitting, by the client, an access token request including the authentication code to a token issuing unit of the service provider; and receiving, by the client, an access token from the token issuing unit.

An ultra-high speed electronic communications device includes: a network communications interface; a memory; and one or more processing units, communicatively coupled to the memory and the network communications interface, wherein the memory stores instructions configured to cause the one or more processing units to: receive a data packet using the network communications interface; determine a classification of the data packet based, at least in part, on a plurality of factors, wherein the plurality of factors comprises a rate at which the data packet was received and a time at which the data packet was received; select, based at least in part, on the classification, an operation from a plurality of operations, wherein the plurality of operations comprises a cut-through operation and a store-and-forward operation; and perform the selected operation.