22 results about "Traffic sampling" patented technology

The invention discloses a network traffic sampling method, device and equipment and a readable storage medium, and is applied to the technical field of cloud platforms, and the method comprises the steps: obtaining a kernel programmable filtering program created based on a network monitoring instance; wherein the network monitoring instance is an instance created based on each network monitoring rule; the kernel programmable filtering program is a self-defined network flow filtering program dynamically loaded and executed in a kernel; and filtering the network traffic data of the cloud platform by using a kernel programmable filtering program to obtain target sampling traffic data. According to the invention, the kernel programmable filtering program created based on the network monitoring instance is utilized to sample the network traffic data of the cloud platform, and a user can determine the traffic sampling content corresponding to the kernel programmable filtering program based on requirements, so that the accuracy of network traffic sampling can be improved; and since filtering is directly completed in the kernel mode, data does not need to be copied in a cross-state manner, so that the performance of network traffic sampling is improved.

An embodiment trains, using a first plurality of real data packets transmitted over a communications network, a generative adversarial network (GAN) to generate a first plurality of generated data packets corresponding to the plurality of real data packets. An embodiment generates, using the trained GAN, a second plurality of generated data packets from a second plurality of real data packets transmitted over the communications network. An embodiment generates, using a probability distribution of the second plurality of real data packets and a probability distribution of the second plurality of generated data packets, a plurality of sampling indices, each sampling index in the plurality of sampling indices comprising a packet number to be sampled for inspection. An embodiment inspects, using a packet inspector, a third plurality of data packets transmitted over the communications network, each inspected data packet having an index in the plurality of sampling indices.

This application relates to a traffic sampling method, system, apparatus, computer equipment, and readable storage medium, belonging to the field of data communication technology. The method includes: acquiring initial traffic from a service center channel; the initial traffic includes traffic from multiple services; performing flow classification, tagging, and filtering processing on the initial traffic sequentially to obtain an aggregate index and target traffic for each service; the aggregate index represents the correspondence between the target traffic and each service, with each aggregate index pointing to multiple members carrying the target traffic; mapping based on the aggregate index of each service to obtain a mirror member index for each service; the mirror member index corresponds one-to-one with the aggregate index, with each mirror member index pointing to multiple mirror members used for sampling the target traffic; sampling the target traffic based on each mirror member index and preset sampling configuration rules to obtain the sampled traffic, and sending it to a traffic analysis server. This method can improve efficiency.

The invention discloses a network digital twinning-oriented dual-view flow data sampling method and system, and mainly solves the problems of difficult key path capture and low flow reconstruction precision caused by lack of frequency domain perception of a flow sampling method in the prior art. According to the implementation scheme, historical flow interaction data in a network node sliding window are collected to form a third-order flow tensor and normalized, and node frequency domain features are extracted and then smoothly updated to obtain a smooth feature vector; mapping the vector to determine a node category, and dividing source-destination OD pair traffic categories of the whole network; calculating statistics lever scores of all OD pairs, dynamically allocating sampling budget of each category according to the statistics lever scores, and generating a sampling set and a binary sampling mask by adopting a determinacy and random combination strategy; and collecting the flow data of the corresponding position at the current moment based on the mask, constructing a tensor completion optimization model for solving completion, and outputting the recovered whole network flow data. According to the method, through double-view cooperation of the frequency domain features and the statistical lever fraction, precise coverage of a high-value traffic path is realized, and the traffic reconstruction precision of the digital twin network is effectively improved while the sampling overhead is reduced. The method can be applied to measurement and reconstruction of large-scale network traffic.

This invention discloses a device type identification method, terminal device, and storage medium based on traffic sampling. It eliminates the need to collect complete device traffic data; device identification is achieved simply by sampling traffic at the gateway. To address the issue of missing traffic features, traditional tensor imputation algorithms learn the embeddings corresponding to tensor rows, columns, and depths, but cannot generalize to unknown rows, columns, or depths. This results in repeated retraining, time-consuming and costly feature imputation. This invention proposes an inductive tensor imputation method that utilizes historical information to learn and generate embedding functions, enabling fast and effective device traffic feature imputation.

The present invention claims protection for an intrusion detection method based on deep learning in an SDN (Software-Defined Network) environment. For the traffic information flowing through the SDN network, the controller polls the flow table in the switch at a fixed rate to statistically analyze the traffic information. However, if the polling time is too long, it will lead to the inability to obtain network traffic information in a timely manner, thereby affecting the judgment of network intrusion detection. If the time is too short, it will cause an excessive load on the controller. The present invention proposes an adaptive network traffic sampling method based on the change of Renyientropy (Renyi entropy) of the source IP address for collecting traffic data in the SDN network. For intrusion detection, an intrusion detection model combining SAE-GRU (Sparse Autoencoder-Gated Recurrent Unit Neural Network) is proposed to identify abnormal network traffic. When the traffic is determined to be abnormal traffic, the controller issues a flow table to discard the abnormal traffic. The present invention can collect SDN network traffic information more real-time and accurately and identify abnormal traffic in the network.

The invention discloses a network awareness method, a distributed device, equipment and a computer readable storage medium. Message packaging is not carried out on an equipment forwarding layer, so that the equipment bandwidth during forwarding is ensured, and the equipment bandwidth utilization rate is improved; real-time detection and flow sampling report are carried out, and data accuracy and low overhead of a control layer are ensured; the control layer sends the information of the state table of the control layer according to the sending weight to ensure that the management layer can receive important network state information more preferentially, and the overall overhead of the management layer is reduced; compared with the existing network sensing technology based on in-band measurement, the method has the advantages that the sensing level is adjusted from a data packet level to a data flow level by maintaining a forwarding layer state table, so that the consumption of network bandwidth resources is reduced, and the processing complexity of a management layer and the consumption of computing resources are also reduced.

A method for traffic sampling in vehicular networks is disclosed. The method for traffic sampling in vehicular networks according to the present invention includes the steps of receiving inter-vehicle flow information; and determining a sampling amount to extract some of data included in the flow information.

A system and method for performing dynamic load balancing in a network load balancer device. A network packet flow is monitored in a load balancer device for detecting dropped network packets, or a sampling of traffic flow, in the monitored network packet flow. Metadata (e.g., a 5-tuple) is created for the detected dropped network packets or sampling of network traffic flow. The metadata is then transmitted to a flow processing analysis device for performing load balancing flow processing. Upon analysis, a determination is made in the flow processing analysis device for determining reconfiguration load balancing settings for the load balancer to mitigate occurrence of unintended dropping of network packets in the load balancer and / or improve its overall performance. The reconfiguration load balancing settings are then transmitted to the load balancer device, whereupon receipt the load balancer changes its settings in accordance with the determined reconfiguration settings.

The present application provides a method, device, and system for determining the bandwidth for transmitting a service flow. The method includes a first device obtaining a first traffic sampling set for the service flow, the first traffic sampling set including one or more traffic sampling information. The first device obtains a service level parameter corresponding to the service flow and a reliability probability of satisfying the service level parameter. The first device determines the bandwidth for transmitting the service flow based on the first traffic sampling set, the service level parameter, and the reliability probability. This method can improve the reliability of service flow transmission.

A network perception method, distributed device, equipment and computer readable storage medium. In the device forwarding layer, the message is not encapsulated, the device bandwidth during forwarding is guaranteed, and the device bandwidth utilization is improved; real-time detection and flow sampling reporting are performed to guarantee data accuracy and low overhead of the control layer; the control layer sends information of the control layer state table according to a sending weight, so that the management layer can receive important network state information more preferentially, and the overall overhead of the management layer is reduced; compared with the existing network perception technology based on in-band measurement, by maintaining the forwarding layer state table, the perception level is adjusted from a data packet to a data flow level, the consumption of network bandwidth resources is reduced, and the processing complexity and the consumption of computing resources of the management layer are also reduced.

The present invention discloses a method and device for controlling the access frequency of distributed network users, which relates to the field of network security technology. The method includes: receiving threat information reported by each proxy server node in the network; sending the list of blocked users to all proxy server nodes, and generating a hash table with the user ID as the keyword and the user traffic sampling information as the value; traversing the hash table to determine whether the user should be maintained in the list of observed users, added to the list of observed users, removed from the list of observed users, or blocked; sending the latest list of observed users and the latest list of blocked users to all proxy server nodes. The present invention can perform multi-dimensional and in-depth analysis on access traffic on the premise of low memory occupancy and high real-time performance, and provide a more friendly and flexible deployment method to improve the availability of the system.

The subject matter described herein provides technical solutions for technical problems facing computing network security. Technical solutions described herein include adaptive sniffing of networking traffic, such as using a brokered network traffic sniffing framework. A brokered sniffing framework may be used to provide dynamic adjustment of network access points and network traffic sampling queries, such as by providing dynamic adjustment in response to changes to the network topology or network traffic. The brokered sniffing framework may provide improved statistical sampling of network traffic using improved network traffic telemetry, such as by modifying a statistical profile of network traffic contents that are collected. The network traffic telemetry may be used to identify various changes in network traffic, such as by identifying statistically significant changes in latencies, bandwidths, or other data center performance metrics.

The invention relates to the technical field of Ethernet data acquisition, and discloses an Ethernet switch data acquisition system based on edge computing, which comprises an Ethernet switch, an edge computing node, a multi-protocol fusion gateway, a sensor network, a digital twin module and a control module, the Ethernet switch is connected with the monitoring host, the digital hard disk video recorder and the multi-protocol fusion gateway through twisted pairs, supports bidirectional data transmission of Modbus and TCP / IP protocols, and integrates the multi-protocol fusion gateway and the high-precision sensor network through the edge intelligent control all-in-one machine. Static configuration parameters and dynamic operation data of equipment connected with the Ethernet switch are obtained in real time, and full-dimensional data support is provided for dynamically calibrating network performance parameters; on the basis of equipment static parameters, dynamic operation data and a lightweight AI reasoning framework of edge computing nodes, intelligent identification of network flow sampling frequency is realized locally, and the sampling rate of a low-frequency sensor is dynamically adjusted through an interpolation algorithm.

The application discloses a service rate evaluation method, device, equipment, storage medium and program product, the method comprises the following steps: collecting service rate data of user objects set in different analysis scenes; the service rate data comprises at least one group of service peak rate of different sampling periods; according to the service rate data corresponding to each analysis scene, the service peak rate ratio distribution matrix and the service peak average rate ratio matrix in the corresponding analysis scene are constructed; according to the service peak rate ratio distribution matrix and the service peak average rate ratio matrix in each analysis scene, the service rate of the corresponding analysis scene is estimated; the application can realize the estimation of the service peak rate of short sampling period and the bandwidth overrun probability by using the existing traffic sampling function of the existing network, and does not need to upgrade the network and construct an analysis platform, so that the accurate bandwidth use performance analysis demand in the packet network can be met, and the cost is effectively reduced.

Presented herein are systems and methods for reactive hard zoning. In one or more embodiments, a monitoring and visibility services (MVS) controller receives zoning information from a centralized discovery controller and also receives data traffic flow information from traffic samplers that continuously monitor network traffic flows (e.g., using SFLOW) in the network. Responsive to the MVS detecting a violating data traffic flow (i.e., zoning configuration does not allow a host to access a storage port), an enforcement engine of the MVS may cause one or more actions to be taken relative to the detected violation. An action may comprise adding a networking configuration (e.g., ACL or disable (a.k.a., fence) the interface on the switch that the host is attached to) to deny that communication, flagging the communication, etc. The network configuration may be reset to a default policy either automatically (e.g., timeout) or manually via administrative configuration.

The invention discloses an educational metropolitan area network traffic management and optimization method based on an IPFIX protocol. The method comprises the following steps: step 1, traffic sampling and acquisition; step 2, data statistics and processing; step 3, data transmission and collection; and step 4, flow analysis and strategy adjustment. By deploying an IPFIX protocol, setting detailed flow definition parameters and combining a Hash algorithm, refined flow identification and classification are realized, key flow and common flow are effectively distinguished, congestion and resource waste are avoided, management efficiency is improved, a strategy is dynamically adjusted based on flow analysis, bandwidth is allocated in advance, priority scheduling and flow shaping are implemented, and the flow quality is improved. In addition, cross-device management is achieved through a unified protocol, dynamic decision making is achieved in combination with a machine learning algorithm, the manual intervention cost is reduced, the decision making efficiency is improved, and flow management is more intelligent and efficient.

The invention relates to the technical field of data communication, in particular to a traffic sampling method and device, computer equipment and a storage medium. The method comprises the following steps: in response to a sampling message for network equipment, determining a sampling template corresponding to the sampling message; analyzing and counting the network flow according to a to-be-filled field contained in the sampling template to obtain a key field; filling a to-be-filled field in the sampling template through the key field to obtain a sampling data message; and sending the sampling data message to a sampling server, so that the sampling server analyzes the sampling data message to obtain a key field contained in the sampling data message, and performs traffic service processing based on the key field. According to the method and the device, accurate statistics of the SRv6 path information can be realized in the flow sampling process according to the sampling template.

This invention relates to the field of graphics card chip technology and discloses a method and system for dynamic scheduling of computing power in a graphics card cluster. The method includes acquiring graphics card utilization and network traffic sampling sequences, obtaining computationally and communication-intensive stage label sequences through timestamp alignment and stage analysis; calculating the peak computing power and bandwidth requirements of the two types of stages and prioritizing tasks; matching target graphics card groups, generating reserved bandwidth channels by pre-allocating network paths in conjunction with stage switching windows; and synchronizing execution parameters and updating the running status sequence in a closed loop. This method can achieve precise dynamic scheduling of graphics card cluster computing power, meeting the dual requirements of high-performance computing efficiency and resource utilization.

The invention discloses a data processing method and device, equipment, a storage medium and a program product, and the method comprises the steps: responding to an entrance call request, and detecting an interface path and a request body of the entrance call request according to mode matching; if the interface path of the ingress call request and the request body meet pattern matching, determining a traffic threshold corresponding to the traffic type according to the traffic type of the ingress call request; and if the flow of the ingress call request does not exceed the flow threshold value, performing deduplication on the flow of the ingress call request, and storing the deduplicated flow in a flow library. An entry calling request is detected through mode matching, and traffic input specifications are ensured; determining a traffic threshold value according to the traffic type to avoid traffic overload; and finally, the ingress call request traffic is saved to a traffic library after deduplication, so that the influence of repeated data is avoided, and the accuracy of traffic sampling is effectively improved.

The invention discloses a flow sampling method and device and electronic equipment, and relates to the technical field of communication, and the method comprises the steps: when an assembly line entrance of an ASIC switching chip receives a service message, determining the message type of the service message based on an access control list (ACL), and storing the message type in a system header; and then, in response to the fact that the service message arrives at an assembly line outlet of the ASIC switching chip, identifying a system header based on the ACL, determining a message type of the service message, and performing traffic sampling on the service message in the message header according to a sampling rule set based on the message type. According to the method, the message type of the service message is extracted and stored in the system header in advance at an assembly line inlet, the system header is packaged on the outermost layer of the service message, the storage space of an ASIC switching chip is prevented from being occupied, the system header is directly matched through an ACL, so that the message type of the service message is determined, and flow sampling is carried out through a corresponding sampling rule.

An embodiment trains, using a first plurality of real data packets transmitted over a communications network, a generative adversarial network (GAN) to generate a first plurality of generated data packets corresponding to the plurality of real data packets. An embodiment generates, using the trained GAN, a second plurality of generated data packets from a second plurality of real data packets transmitted over the communications network. An embodiment generates, using a probability distribution of the second plurality of real data packets and a probability distribution of the second plurality of generated data packets, a plurality of sampling indices, each sampling index in the plurality of sampling indices comprising a packet number to be sampled for inspection. An embodiment inspects, using a packet inspector, a third plurality of data packets transmitted over the communications network, each inspected data packet having an index in the plurality of sampling indices.