276 results about "Packet detection" patented technology

The invention discloses a network line intelligent operation and maintenance monitoring management system and method. The method comprises the steps that an intelligent network monitoring and optimizing system regularly collects network equipment information through a protocol, and a monitoring agent collects server and machine room environment data; processing data in real time by adopting distributed storage and a stream processing framework; predicting a network fault by adopting threshold monitoring and a machine learning model, and identifying a bottleneck and scheduling resources based on flow analysis; in combination with deep packet inspection and an AI algorithm, network traffic is monitored in real time, security threats are identified, and IPS system protection is deployed; a repair operation is automatically triggered through a self-healing strategy, and backup resources are started; the AI engine analyzes historical and real-time data, generates network topology and link state visual content, and automatically generates reports, optimization and decision support; according to the intelligent operation and maintenance monitoring management system and method for the network line, a fault tree analysis and decision support system is introduced, and a plurality of fault reasons are intelligently analyzed and repair measures are automatically executed.

The invention relates to the technical field of Internet of Things, and discloses an OpenHarmony-based Internet of Things control method and platform, and the method comprises the steps: carrying out the distributed discovery and lightweight authentication of Internet of Things equipment, and constructing a dynamic equipment topological graph; generating a device capability description file according to the authentication device set, and creating a virtualization layer; acquiring multi-source sensor data from the virtualization layer and performing fusion processing to obtain a scene control strategy; acquiring network data packets at key nodes of the dynamic equipment topological graph and extracting features to obtain a security situation assessment result; performing deep packet detection based on a security situation assessment result and a scene control strategy, identifying an abnormal behavior, and generating a network optimization strategy; the cluster head nodes are selected according to the network optimization strategy to perform load-balanced data transmission, and the node working mode and the network topology structure are dynamically adjusted to realize global energy efficiency optimization, so that the global energy efficiency optimization is realized, and the overall operation time of the Internet of Things system is prolonged.

A method and system for detecting malicious network packets via an intelligent large language model are described. In addition, a method for fine-tuning a pretrained large language model to detect malicious network packets is described. The training process generates a plurality of embeddings from input network packet data, generates clusters for those embeddings, performs an entropy analysis, and calculates a loss value. Contrastive learning is used to further fine-tune the large language model based embedder.

The invention provides an automatic perception model method and system for illegal access in a network security isolation area, and belongs to the technical field of computer systems based on specific calculation models.The method comprises the steps that firstly, a network topological graph matrix of the security isolation area is constructed, an equipment asset list is established, and then distributed flow collection nodes are deployed to obtain real-time network data; a deep packet detection technology is used for extracting features to establish an equipment behavior baseline library, a multi-target risk assessment function is used for carrying out risk grade division on equipment, a multi-layer perceptron and a time sequence anomaly detection algorithm are used for identifying abnormal communication, and an equipment fingerprint identification mechanism based on physical layer characteristics is established to verify the legality of the identity of the equipment. A security isolation intelligent sensing network model is utilized to analyze network behaviors, a multi-dimensional abnormal scoring system is constructed to calculate risk scores, a response mechanism based on a rule engine is realized, a federal learning technology can be selectively adopted to optimize the model, and an all-dimensional and multi-level illegal access automatic sensing protection system is formed.

A method, UPF function / node, computer program, and computer program product to classify traffic of a user equipment, UE by a UPF is provided. A PFCP session establishment request comprising a session ID and a flow information profile is received. Responsive to the flow information profile indicating that flow information is to be stored for sessions by the UE, whether or not there is stored flow information for a session associated with the session ID is determined. UE application traffic is received, the UE application traffic including the session ID. Responsive to there being stored flow information for the session, the UE application traffic is classified based on the stored flow information. Responsive to there not being stored flow information for the session, the UE application traffic for a corresponding packet detection rule of the session; is classified and flow information for the session based on the classifying is stored.

The invention provides a flow processing system, a processing method and a flow processing cluster, and the system comprises a converging and shunting module which is used for receiving mirror image flow from a communication link, and carrying out the rule matching, data copying and label marking processing of the mirror image flow, so as to generate a first data flow carrying flow feature information; the integrated exchange processing module is used for receiving the first data stream and forwarding the first data stream to the corresponding deep packet detection module based on the flow characteristic information of the first data stream; the deep packet detection module is used for receiving the second data stream forwarded by the integrated exchange processing module and executing protocol analysis, content identification and behavior log generation processing on the second data stream; and the backboard connection module is used for providing power connection and data communication interconnection among the functional modules. And the converging and shunting module, the integrated exchange processing module and the deep packet detection module are integrated on the same system platform, so that the data circulation efficiency and the resource cooperation capability in the system are improved.

Disclosed herein is a method performed by a UPF 302, the method comprising: receiving a request message transmitted by a management function, MF, the request message comprising: i) first packet detection information, PDI, comprising one or more of an application identifier, AppID, that identifies an application or a first flow description, FD, that defines a first packet flow; ii) first quality-of-service, QoS, enforcement information, QEI, associated with the first PDI, the first QEI comprising a first flow identifier, FI, that identifies a first QoS flow to which the first packet flow is bound; and iii) first monitoring control information, MCI, the first MCI comprising the first FI; obtaining first QoS information pertaining to the packet flow bound to the QoS flow identified by the first FI; and transmitting a first notification comprising: i) the obtained first QoS information and ii) one or both of the AppID or the first FD.

The invention provides a traffic processing method and device based on deep packet inspection, equipment and a medium, relates to the technical field of network management, and is used for solving the problem that a traditional traffic management mode cannot accurately identify a complex protocol. Storing the at least one plug-in into an array corresponding to the target chain; when the target data packet enters the PREROUTING chain, extracting session information from the target data packet; performing deep packet inspection analysis according to the session information to obtain an analysis result; when the target data packet enters the target chain, calling at least one plug-in in sequence according to a preset priority; and the at least one plug-in processes the target data packet according to the analysis result. According to the method, a complex application layer protocol can be accurately identified through a deep packet inspection technology, and the plug-in dynamically processes the traffic according to a deep packet inspection result, so that efficient, intelligent and refined network traffic management is realized.

The invention discloses a multi-link-based network traffic scheduling method and device, equipment and a storage medium. The method comprises the following steps: receiving data packets sent by a plurality of terminals, and determining a user role corresponding to each terminal; for any data packet, performing deep packet detection on the data packet sent by the terminal to obtain application information of the data packet, and dynamically determining the priority of the data packet based on the application information, the corresponding user role and the network state information; and performing MLO link selection and wireless network resource selection for each data packet based on the priority of each data packet, and dynamically adjusting the distribution of the MLO link and the wireless network resource based on the feedback information of each current terminal. Therefore, the problems of single link selection strategy, lack of dynamic adaptive capacity and the like in the prior art are solved, the MLO links and the wireless network resources are dynamically allocated, the allocation precision, flexibility and reliability of the MLO links and the wireless network resources are improved, and the utilization rate of the network resources is improved through the DPI technology and multi-link dynamic scheduling.

An information processing method and a communication device are provided. The method includes: performing, by a first communication device, a first operation, where the first operation includes at least one of the following: determining data packet detection information, where the data packet detection information includes ECN information; sending the data packet detection information; configuring a third requirement or a seventh requirement for a QoS flow; or sending the third requirement or the seventh requirement corresponding to the QoS flow.

The utility model discloses a bale breaking detection state monitoring system for small cigarette bales, which belongs to the technical field of tobacco production equipment and comprises a first pressure reduction module, a control machine and a display screen. Wherein an input pin of the first voltage reduction module is connected to the bale breaking detection device and the small-box tobacco bale packaging machine, the bale breaking detection device comprises a bale breaking detection camera and a bale breaking detection controller, the bale breaking detection camera is in communication connection with the bale breaking detection controller, and an output pin of the first voltage reduction module is connected with a control machine; the control machine is connected to the first voltage reduction module, the control machine is in communication connection with the display screen, and the display screen is controlled by the control machine to display. According to the utility model, the abnormal monitoring of the bale breaking detection state of the small cigarette bale can be ensured in real time, the effectiveness of the bale breaking detection of the small cigarette bale can be automatically verified in multiple frequencies, and manpower and material resources are saved.

The invention provides a non-deep traffic analysis streaming matching search analysis method, which comprises the following steps of: constructing a deep data packet detection architecture on the basis of a data platform development kit (DPDK); aiming at the non-encrypted traffic, establishing a multi-mode recognition mechanism combining a regular expression and a feature bit stream mode; aiming at the encrypted traffic, constructing an encrypted traffic feature library according to the statistical features, the protocol features and the behavior features; real-time risk detection of network traffic is realized by adopting a streaming matching search technology; and constructing an intelligent decision and response mechanism, and integrating flow analysis and identification results. According to the non-deep traffic analysis streaming matching search analysis method provided by the invention, real-time analysis, risk identification and supervision of network non-encrypted traffic and encrypted traffic are realized by taking a data platform development kit (DPDK) as a basis and combining a high-performance streaming regular expression engine and a finite-state machine principle; the method can be widely applied to scenes of network communication supervision, data security protection, malicious traffic monitoring and the like.

Disclosed are systems, apparatuses, methods, and computer-readable media for policy-based transparent packet inspection for last mile zero-trust workload protection. The method comprises receiving a packet on a network interface of a provisioned resource in a data center or a user device within a network; determining, by a first intercepting agent provisioned within the network interface, whether to inspect the packet based on rules received from a control plane of the network, wherein the network interface comprises a smart network interface card (SmartNIC) or a data processing unit (DPU) and is configured with the first intercepting agent based on the control plane; selectively invoking a deep packet inspection of the packet based on inspection of the packet by the first intercepting agent using the rules from the control plane; and blocking the packet at the network interface based on the deep packet inspection identifying malicious content within the packet.

The invention provides an encrypted traffic analysis method based on interaction spatio-temporal characteristics, relates to the field of network security, and aims at an original encrypted stream to construct a FITDect model consisting of an input layer, a GNN layer, an MLP layer and an output layer, and dynamically characterizes the traffic interaction diagram by mining the spatio-temporal interaction relationship of data packets in the original encrypted stream, constructing a dynamic traffic interaction diagram, and finally, analyzing the encrypted traffic. And analyzing a space-time coupling relationship through a GNN layer of the FITDect model by utilizing layered feature extraction, performing classification decision by utilizing an MLP layer of the FITDect model, sending a classification result to an output layer, and finally outputting an analysis result. According to the method, the problems that an existing deep flow detection technology depends on shallow statistical characteristics and a traditional deep packet detection technology fails are solved, fusion analysis of encrypted flow spatio-temporal characteristics is realized, the characterization capability of a model on encrypted flow hidden behaviors is remarkably enhanced, and a hidden behavior mode of the encrypted flow can be effectively captured.

The present application discloses a message forwarding method supporting packet retransmission between network nodes, aiming to support packet loss detection and fast retransmission between network nodes during message forwarding. The message forwarding method comprises: 1) an upstream node uniformly numbers messages in the same flow, fills in message sequence numbers, a flow identifier, an upstream node network address and a retransmitted packet flag field, sequentially writes the messages into a send buffer on the basis of the sequence numbers, copies the messages from the buffer and sends the messages according to the current sending rate; 2) a downstream node performs packet loss detection on the basis of the message sequence numbers, constructs feedback information and sends same to the upstream node; and 3) the upstream node determines lost messages on the basis of the received feedback information, reassigns sequence numbers and retransmits the messages. The method of the present application can carry out packet loss detection and fast retransmission between network nodes, effectively reducing the packet loss rate in a network and enhancing the transmission reliability of data packets in the network.

The invention provides a wireless Mesh self-adaptive channel selection method and system, and relates to the technical field of channel selection and optimizing.The wireless Mesh self-adaptive channel selection method comprises the steps that firstly, according to a Mesh network topological structure, a data transmission path and a corresponding channel are marked, and performance parameters such as delay packet loss rate, transmission rate bandwidth signal intensity and noise intensity are collected at fixed time intervals; the method comprises the following steps: calculating a delay packet loss rate transmission rate by detecting a data packet, obtaining bandwidth signal intensity and noise intensity by means of a tool, then extracting the delay packet loss rate transmission rate and bandwidth data, constructing a channel quality model, identifying a service type by using a deep packet inspection engine nDPI, and dynamically adjusting a weight according to a bandwidth proportion. Meanwhile, a channel signal interference quantization model is constructed according to the signal intensity and the noise intensity, finally, a signal interference quantization threshold value is set, the channel meeting the condition is screened out, the channel with the maximum channel quality result is selected as the optimal channel and switched, and the reasonability and communication performance of wireless Mesh network channel selection are effectively improved.

The invention relates to a Java background service deployment method and system based on double-node dynamic routing, and the method comprises the steps: obtaining the health state of each node based on TCP port activity detection and / or UDP heartbeat packet detection; judging the nodes of which the detection failure times exceed the preset times as fault nodes, and setting the fault nodes to be in an offline state; determining a traffic allocation weight according to the real-time working state of the node; performing routing distribution on the client request based on the traffic distribution weight; route distribution is dynamically adjusted based on the traffic allocation weight, the resource utilization rate of the nodes is improved, and the situation that the load of a single node is too heavy is avoided; when a fault node occurs, the other node is automatically switched to respond to the request, so that the fault switching time is shortened; and the data consistency between the double nodes is adjusted based on the Redis cluster and the MySql cluster. Based on cooperation of the steps, the problems of failure switching delay, low resource utilization and low data consistency in a traditional scheme are solved.

The present disclosure provides a method (500) and system (108) for creating sessions in a telecommunication network (106). The method includes receiving session request from the CPE and establishing the CPE session in the telecommunication network (106). Upon successful establishment, an individual HGW session request is received corresponding to HGW child sessions for each of a set of HGW devices connected over the CPE session. A unique Packet Detection Rule (PDR) Identifier (ID) is assigned to each HGW child session based on the respective HGW session request. Subsequently, the HGW child sessions are created using the assigned PDR IDs. The method enables efficient session creation, resource optimization, and independent session handling for multiple HGWs operating behind a common CPE in the telecommunication network (106).

Apparatuses and methods for DDD status event handling with I-SMF improvement. In one embodiment, a session management function, SMF, node is provided. The SMF node includes processing circuitry configured to receive a subscription request to an event associated with the SMF node where the subscription request includes at least one of a packet detection rule, PDR, information and a Traffic Descriptor, and instruct a user plane function, UPF, node based at least on the subscription request.

The embodiments of the present application relate to the technical field of communications. Provided are a communication method and apparatus, which are used for reducing a service processing delay and improving a network resource utilization rate and communication efficiency. The method can comprise: a first apparatus receiving first data, and matching the first data with a corresponding first data packet detection rule; on the basis of the first data packet detection rule, determining an associated first data processing rule, wherein the first data processing rule is associated with a first service function; and on the basis of the first data processing rule, executing, on the first data, one or more service functions corresponding to the first service function, so as to obtain second data.

The invention discloses a low-power-consumption Bluetooth weak link communication method and device based on adaptive symbol extension and DNN demodulation technology, and the method comprises the steps: measuring a channel environment of a transmitting end, judging a current channel environment through transmitting different extension factors and data packet lengths, and determining an optimal symbol extension factor; sending data of a sending end, and after the optimal symbol expansion factor is determined, expanding a data packet and segmenting the data by a transmitter, and carrying out data de-whitening operation; a receiving end captures a BLE signal, captures the signal and preprocesses the signal; identifying a receiving end and positioning a BLE data packet, detecting a data packet preamble based on phase peak clustering, identifying the data packet and synchronizing symbols; and a receiving end demodulates the BLE signal to obtain final BLE data, and demodulates the wireless signal by adopting a demodulator based on a time-frequency domain combined DNN model. According to the invention, stable BLE communication can be maintained in a low signal-to-noise environment, the method is widely supported in commercial BLE chip equipment, the equipment does not need to be modified, and the communication capability of the BLE equipment in a weak link is improved.

The invention discloses a malicious traffic defense method, system and device based on a data processing unit, and the method comprises the steps: when a distributed DPU cluster receives to-be-processed traffic, a network controller generates a traffic defense strategy according to the to-be-processed traffic, and issues the traffic defense strategy to the distributed DPU cluster; wherein a trained target strategy network and a trained target value network are deployed on the network controller; and the distributed DPU cluster executes at least one of a load balancing function, a data packet detection function and a traffic filtering function on the traffic to be processed based on the traffic defense strategy. According to the technical scheme of the invention, the trained target strategy network and target value network are deployed on the network controller to generate the flow defense strategy, so that the problem that the existing DDoS defense function deployment scheme cannot realize dynamic balance between the defense effect and resource consumption is solved; the problems that the service quality of normal traffic in a high-load scene is sharply reduced and real-time response is difficult to realize are solved, and the defense efficiency and the resource utilization rate are improved.

The invention discloses a logical channel LoRa data packet detection method based on window sliding, a medium and equipment, and belongs to the technical field of network communication. The method comprises the following steps: for a received data packet, extracting peak values from the same symbol by tracking a change mode of a plurality of peak values in a continuous time window, and generating a corresponding peak value sequence by matching the peak values of the symbols to obtain a plurality of peak value sequences; identifying the characteristics of the same data packet in the frequency domain and the time domain, and matching the plurality of peak sequences to obtain a matched peak sequence; extracting LoRa parameters of the data packet by combining the characteristics of the plurality of peak sequences by using the matched peak sequences, the LoRa parameters including a spreading factor and a bandwidth; and aligning the demodulation windows in the frequency domain and the time domain, and evaluating the carrier frequency offset of each data packet. According to the invention, the data packet can be detected more accurately, and high-quality and high-capacity communication is realized.

There is provided a method for performing Maximum Transmission Unit size enforcement. The method comprises: receiving at a first node, a first Maximum Transmission Unit size threshold and at least one Packet Detection Rule associated with the first Maximum Transmission Unit size threshold, each of the at least one Packet Detection Rule being associated with one or more enforcement actions for a Protocol Data Unit session; determining at the first node, whether the size of a packet received from a network host exceeds the first Maximum Transmission Unit size threshold; and performing at the first node, an action corresponding to the at least one Packet Detection Rule associated with the first Maximum Transmission Unit size threshold if it is determined that the size of the packet exceeds the first Maximum Transmission Unit size threshold.

Embodiments of the present disclosure provide method and apparatus for charging. A method performed by a user plane function entity comprises receiving a first message from a control plane function entity. The first message comprises one or more information elements referencing one or more pre-defined packet detection rules (PDRs) configured in the user plane function entity. The one or more pre-defined PDRs specify one or more predefined usage reporting rules (URRs). The method further comprises activating the one or more predefined PDRs. The method further comprises generating a usage report for at least one of the one or more predefined URRs. The usage report comprises information for describing received user traffic which is related to the at least one of the one or more predefined URRs. The method further comprises sending a second message comprising the usage report to the control plane function entity.

A network node may be configured with packet detection rules (PDRs). The PDRs may allow the network node to identify one or more extended reality (XR) streams. The network node may be configured with forward action rules (FARs). The FARs may include information related to how one or more XR streams should be routed. The network node may invoke a user plane function (UPF). The UPF may be configured using information from the PDRs and / or the FARs. The network node may establish a protocol data unit (PDU) session. The network node may identify one or more XR streams indicated in the PDU session based on, at least, its configured PDRs. The network node may forward one or more XR streams according to the information in the FARs.

A user equipment (UE) route selection policy (URSP) detection method including obtaining first policy section identifier (PSI) information corresponding to a first URSP rule corresponding to a target user equipment, the first URSP rule being matched with a target service flow corresponding to the target user equipment, generating a first packet detection rule based on the first URSP rule that corresponds to the first PSI information, configuring the first packet detection rule to a user plane function (UPF) network element of a first protocol data unit (PDU) session, the first PDU session corresponding to the first URSP rule, and receiving, from the UPF network elements, a first detection result based on the first packet detection rule and indicating whether the target service flow associated with the first PDU session matches the first packet detection rule.

The invention relates to the technical field of network information security, in particular to a network attack identification and blocking method and system based on deep packet inspection, and the method comprises the steps: capturing a message in an intelligent substation network; analyzing the message through a DPI technology, extracting key features in header information and application data, and matching the key features with a malicious network behavior fingerprint database to identify known attacks; performing traffic behavior analysis on the data packets which are not matched with the known attacks, and identifying abnormal traffic modes and behaviors; and taking corresponding blocking measures according to the identification result. The method has the beneficial effects that through accurate deep packet detection and behavior analysis, complex network attacks aiming at an intelligent substation network can be effectively identified and blocked, so that the service interruption risk of a power grid system caused by the network attacks is reduced, the potential economic loss is reduced, the adaptability to novel threats is improved, and the safety of the power grid system is improved. And the stability and safety of a power grid communication network are ensured.

The invention relates to the technical field of network communication, and provides a multi-level selection retransmission system based on an RDMA programmable switch gateway, and the technical scheme is that the multi-level selection retransmission system comprises a programmable switch, an RDMA server and an SACK / NAK trigger retransmission module; the programmable switch comprises an RDMA message cache module, an RDMA flow tail packet detection module and an active retransmission module; the RDMA message caching module is used for identifying an RDMA message and caching the RDMA message to an RDMA server; the RDMA flow tail packet detection module is used for identifying the flow tail packet loss condition of the RDMA message in the process of caching the RDMA message; the SACK / NAK triggering retransmission module is used for triggering a retransmission mechanism; and the active retransmission module is used for reading a flow tail packet of the lost RDMA message and returning the flow tail packet to the RDMA message cache module to finish retransmission operation. According to the invention, the programmable switch is combined with the RDMA, and active caching, rapid retransmission and tail packet loss detection are taken as core functions, so that the bottleneck of traditional RDMA transmission in packet loss retransmission and delay is solved.

The invention relates to a vehicle-mounted message anomaly detection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a training sample which comprises a sample vehicle-mounted message and a hard tag indicating whether the sample vehicle-mounted message is abnormal or not; the training sample is adopted to construct and train a teacher model, a MobileNet layer in the teacher model is used for extracting spatial features of the sample vehicle-mounted message, and a gating circulation unit in the teacher model is used for capturing time sequence features of the sample vehicle-mounted message; according to the hard label of the training sample and a soft label output by the teacher model, knowledge distillation learning is carried out on an initial student model, and the soft label refers to category probability distribution of the sample vehicle-mounted message; and detecting whether the target vehicle-mounted message is abnormal or not by adopting the trained student model. According to the invention, both the message detection accuracy and the high calculation efficiency are considered.