260 results about "Traffic type" patented technology

A method is provided for encrypted network traffic analysis. The method includes capturing network traffic data; calculating entropy of said data to classify traffic as encrypted or non-encrypted; applying statistical and sequential feature hybridization on encrypted traffic to extract comprehensive features; analyzing the features using a neural network model to identify encrypted traffic types and detect anomalies; and refining the analysis based on entropy and neural network insights through a feedback loop.

The invention discloses an intrusion detection method and device based on a graph neural network and a medium, and relates to the field of computer networks, and the method comprises the steps: constructing a graph structure according to network flow data in a current time window; the graph structure comprises a node set, an edge set, a node feature matrix, an edge feature matrix and an adjacent matrix; the adjacent matrix is used for representing a communication state between the nodes; inputting the graph structure corresponding to the current time window into a network node traffic type identification model to obtain the traffic type of each node; the network node traffic type identification model is obtained by training a preset graph neural network by adopting a training sample set; in a preset graph neural network, for an input graph structure, a Bi-LSTM layer is adopted to extract time feature information, and a graph convolution layer and a graph attention mechanism are combined to extract space feature information in a time dimension, so that a traffic type of each node is obtained. According to the invention, more accurate network intrusion detection is realized.

The invention discloses a TSN scheduling optimization method and device based on flow sensing autonomous learning, equipment and a medium. The method comprises the following steps: deploying a lightweight flow detection module in a switch or a router, and after a controller receives a data request, automatically identifying a newly arrived unknown service flow by using the lightweight flow detection module, and judging whether the newly arrived unknown service flow is a periodic TT flow or an unpredictable burst flow; the controller performs classification management on the identified service flow types, collects topological information and flow requirements of the whole network and issues the topological information and the flow requirements to the terminal nodes through a network management interface; the controller constructs an intelligent queue scheduling task based on the collected network topology information and traffic demand and converts the task into a Markov decision process MDP, network resources, queue states and priorities are used as a state space, a scheduling strategy is used as an action space, a reward function is designed in combination with throughput and delay indexes, and an intelligent queue scheduling task is obtained. Driving a dynamic environment through real-time data and training a DRL model; an enhanced queue scheduling mechanism Pro-CQF is adopted, different priority labels are configured according to classified flow types, and then mixed flow scheduling is carried out; the controller periodically collects time delay, packet loss rate and end-to-end transmission delay indexes and feeds back the indexes to the DRL model, and a scheduling strategy is updated online. According to the method, the traffic sensing and scheduling efficiency is greatly improved in a network environment in which multiple service flows coexist and end-side equipment functions are different, and the reliability and the expandability of the TSN in industrial Internet of Things, edge computing and other high-real-time application scenes are remarkably enhanced.

The invention relates to the field of network security, and discloses a network abnormal traffic monitoring and attack defense system based on artificial intelligence, which comprises a data preprocessing module used for receiving original traffic data, executing cleaning, duplicate removal and normalization processing, and dividing a processing result into data fragments according to a preset time window; the network flow analysis module is used for receiving the data fragments, performing feature extraction and mode analysis and outputting an analysis result representing the flow abnormal degree, and the analysis result at least comprises a score value representing the overall abnormal degree and a feature vector representing the flow mode feature; the attack judgment module is used for comparing the score value with a preset abnormal threshold value so as to judge whether network abnormal traffic exists or not, if yes, the feature vector is further matched with a pre-constructed abnormal traffic type feature library, and a specific abnormal traffic type is determined according to a matching result; and the attack defense module is used for automatically triggering and executing a corresponding defense strategy.

An operation mode from a plurality of operation modes can be determined (310) based on at least one traffic type originated from a UE. The plurality of operation modes can include at least one group operation mode and an individual operation mode. The at least one group operation mode can support a plurality of UEs grouped into a group of UEs. The at least one group operation mode can support at least one network entity communicating associated messages with the group of UEs including the UE. The associated messages can be associated with the group of UEs. A network entity can be informed (320) of the determined operation mode.

The invention relates to the technical field of time-sensitive networks, and particularly provides a round-robin queue forwarding scheduling model and method for mixed time-sensitive traffic, and a terminal. The circular queue forwarding scheduling model comprises a delay sensitive queue, a first time sensitive queue and a second time sensitive queue. The method comprises the following steps: creating two time slot systems; defining fixed injection time and a queue scheduling strategy for the time-triggered traffic; carrying out pre-scheduling planning according to the knowability of the time-triggered stream, and obtaining injection time corresponding to the time-triggered stream and a corresponding injection queue; and for the emergently arrived event trigger flow, incremental scheduling is carried out according to real-time link resources, and a suitable time slot is obtained for forwarding. According to the invention, the event trigger traffic and the time trigger traffic are placed in different queues, and the model designs a scheduling mode of the corresponding event trigger traffic, so that the isolation of traffic types is effectively realized, the scheduling and forwarding of the time sensitive traffic are optimized, and the network communication efficiency is enhanced.

The invention relates to an encrypted traffic classification method based on a two-stage adaptive architecture, and belongs to the technical field of computer network security. The method comprises the following steps: firstly, distinguishing data in-distribution (ID) and out-of-distribution (OOD) traffic through a mixed OOD detection mechanism, and processing a detection result by adopting a self-adaptive classification strategy: for the ID traffic, accurately classifying known categories by adopting a transformer-based encoder; for OOD traffic, a classification task is converted into a generation task by combining a large language model (LLM) and a newly proposed semantic enhancement prompt strategy (SPS), so that flexible fine-grained recognition of unknown traffic types is realized. The SPS strategy comprises three levels of a strict mode, a complete mode and an expansion mode, and a flexible generation space is provided while the classification precision is ensured. Through the innovative two-stage design, the problem that the emerging network application cannot be accurately identified by the existing method is effectively solved while the high-precision classification of the ID traffic is maintained.

The invention provides a method and system for judging suspicious traffic in encrypted traffic, and the method comprises the steps: collecting to-be-detected encrypted traffic, and extracting the encrypted traffic features of the to-be-detected encrypted traffic; wherein the encrypted traffic feature comprises a first traffic feature and a second traffic feature, and the second traffic feature comprises domain name popularity; the second traffic feature is determined based on a malicious neighborhood value determined according to the relation graph; the relation graph comprises domain name nodes, entity nodes, edges connecting the entity nodes and edges connecting the entity nodes and the domain name nodes, and the edge attributes of the edges of the relation graph comprise communication related data and traffic types; determining the traffic type of the to-be-measured encrypted traffic based on the encrypted traffic feature of the to-be-measured encrypted traffic, the traffic type including normal traffic and suspicious traffic; and in response to the fact that the traffic type of the to-be-tested encrypted traffic is suspicious traffic, performing subsequent decryption analysis on the to-be-tested encrypted traffic through a decryption DPI module.

The invention discloses an encrypted malicious traffic detection method based on deep learning, and the method comprises the steps: extracting time sequence features of network traffic data through an LSTM model, further extracting semantic features of the traffic data through a BERT model, and finally forming comprehensive feature representation; clustering the comprehensive feature representation by using a DBSCAN algorithm; optimizing sample labels in each cluster according to a defined naming rule, and classifying traffic types with similar attack characteristics into uniform labels; constructing a graph structure, performing edge connection on the optimized traffic sample labels and the comprehensive feature representation thereof, and establishing edge connection among different clusters according to cosine similarity; and constructing a GraphSAGE graph neural network model, performing information aggregation on nodes of a graph structure and neighbor nodes thereof to obtain an updated feature vector of each node, performing classification processing by using updated node features, and identifying whether the traffic is malicious encrypted traffic. According to the invention, the detection precision and robustness are improved.

The present invention provides according to one of its aspects a method of communication in a wireless network comprising an access point and a plurality of stations, the method comprising, at one of the stations:receiving a trigger frame from the access point, the trigger frame reserving a transmission opportunity on at least one communication channel of the wireless network, the transmission opportunity including random resource units that the stations may access using a contention scheme, wherein the trigger frame includes a first indicator specifying a traffic type of data allowed to be sent on at least one of the random resource units;determining, based on the first indicator, eligible resource units, among the resource units in the reserved transmission opportunity, for the station to contend for access for transmitting data; andtransmitting data on a determined eligible resource unit using a contention scheme.

The invention provides a network condition detection method based on Internet of Things traffic features and electronic equipment, and the method comprises the steps: obtaining a first feature set of a traffic segment, the first feature set comprising a total byte number and a total packet number corresponding to a traffic direction; analyzing the first feature set by using a clustering-based first model to obtain an anomaly detection result, the first model being unsupervised learning, and the anomaly detection result representing whether traffic anomaly occurs; obtaining a second feature set of the traffic fragment, the second feature set comprising traffic statistical information corresponding to a traffic type, the traffic type being related to at least one of a traffic direction, a traffic source, a protocol type and a network identifier; analyzing the second feature set by using a second model based on a decision tree to obtain an attack result; and determining a detection result based on the anomaly detection result and the attack result. Therefore, the effectiveness of low-rate attack detection and the convenience of detection can be improved.

The invention belongs to the field of process optimization and finance, and relates to an application lossless release method, which comprises the following steps of: obtaining application configuration information of a new version application, and deploying the application configuration information in gray environment resources to obtain a gray version application; service feature data obtained by analyzing the service request is matched with a preset traffic dyeing rule, and when the traffic type is gray traffic, the service request is routed to a gray version application; the method comprises the steps of obtaining a flow state of a service request to judge whether service flow is normal or not, verifying a gray-level version application when the flow is normal, switching flow from a production environment to a gray-level environment step by step after verification is passed, continuously monitoring a running state of the gray-level version application in a preset time period, releasing a new-level application to the production environment, and releasing gray-level environment resources. The invention further provides an application lossless release device, computer equipment and a storage medium. In addition, the invention also relates to a block chain technology, and the new version application can be stored in a block chain. Smooth transition between the new version and the old version is achieved.

The invention is applicable to the technical field of network communication, and provides a roaming switching method and a roaming switching device in an FTTR (Fiber To The Room) network environment, the method can be applied to fiber to the Room (FTTR), enterprise-level fiber to the Room-Bus (FTTR-B) and broadband fusion terminal products, and the roaming switching method and the roaming switching device in the FTTR network environment can be applied to fiber to the Room (FTTR) and the enterprise-level fiber to the Room-Bus (FTTR-B). The roaming switching method in the FTTR network environment comprises the following steps: when first signal strength of current access point equipment is lower than a first threshold value, terminal equipment sends a traffic type to other access point equipment; receiving roaming priorities returned by other access point equipment according to the traffic type; screening a target access point device from the plurality of other access point devices according to the roaming priorities corresponding to the plurality of other access point devices and the second signal intensities corresponding to the plurality of other access point devices; and switching the current access point equipment which is currently connected with the terminal equipment to the target access point equipment. According to the scheme, by optimizing the switching process, the problems of lagging, delay and the like caused by network switching are remarkably reduced.

Methods, devices, and systems are disclosed for multi-hop relays that may be implemented by advertising first relaying capabilities and a first number of hops to reach a remote wireless transmit / receive unit (WTRU), receiving second relaying capabilities and a second number of hops to reach the remote WTRU from a selected relay WTRU, updating a relay capabilities table based on the second relaying capabilities and the second number of hops, receiving a packet comprising a payload, the packet having a traffic type and further comprising a maximum number of hops, selecting the selected relay WTRU based on the traffic type, the maximum number of hops, and the relay capabilities table, generating a first updated packet comprising the payload, the traffic type and a first updated number of hops that is one less than the maximum number of hops, and transmitting the first updated packet to the selected relay WTRU.

Solutions for service aware proxy-call session control function (P-CSCF) traffic routing include: receiving, at a master P-CSCF in a pool of a plurality of P-CSCFs, internet protocol (IP) multimedia subsystem (IMS) traffic from a device; determining, by the master P-CSCF, a traffic type (e.g., 5G, 4G, SMS, WiFi, etc.) of the IMS traffic from the device; based on at least the traffic type of the IMS traffic from the device, selecting, by the master P-CSCF, a serving P-CSCF from the pool for the device; and forwarding, by the serving P-CSCF for the device, the IMS traffic from the device to an IMS. In some examples, the serving P-CSCF selection also includes loading considerations. In some examples, an alternate P-CSCF is available for failover as the new master P-CSCF. In some examples, a network includes multiple pools of P-CSCFs, with each pool having its own master P-CSCF and alternate P-CSCF.

The invention discloses a differentiated congestion control method based on RDMA (Remote Direct Memory Access) and a hardware controller system. In the invention, a differentiated congestion control algorithm is provided by using the DSCP, so that the limitation of complete fair regulation and control of the traditional congestion control algorithm is broken through, accurate resource allocation for different flow types is realized, and a more efficient bandwidth utilization rate is achieved under the congestion condition; complete hardening of a congestion controller system is realized, a scheme for dynamically supporting all congestion flows in a network and supporting 1024 concurrent congestion flows at most is provided, and the congestion flows in the network can be managed more efficiently to achieve the purpose of relieving network congestion; the data which is read from the host and participates in operation does not need to be stored in the cache, so that the burden of the host is reduced, the performance reduction caused by bus data reading delay is eliminated, the processing speed of the parallel congestion event is remarkably improved, and the delay of rate feedback is reduced.

Network operators can define port mappings for UDP destination ports and the encapsulated protocol / traffic type (X) in UDP. BGP may be used to notify the UDP destination port-to-traffic type mapping to an encapsulator. A generic UDP encapsulation mechanism (X-in-UDP), where UDP can be used to encapsulate packets of any user configured protocol / traffic type X (e.g., IPv4, IPv6, MPLS, etc.), is described. Primary benefits of using UDP for encapsulation are to leverage UDP port numbers for load-balancing. Generic UDP encapsulation of any protocol / traffic type using user defined port-maps provides flexibility to network operators in constructing different overlay networks. UDP encapsulation helps leverage fine-grade load balancing over Equal-Cost Multipath (ECMP).

The invention provides a network traffic classification method, device and equipment based on multi-feature fusion, and belongs to the field of artificial intelligence. The method comprises the following steps: preprocessing traffic data to obtain a traffic grey-scale map; screening a minority class traffic sample set from the traffic grey-scale map; simulating a minority class traffic sample set through a WGAN model, and constructing and generating a sample; supplementing the generated sample into the flow grey-scale map to form a balanced sample set; inputting the balanced sample set into a ViT hybrid model to extract features, and obtaining sequence features; fusing the sequence features based on a cross attention mechanism to obtain a target traffic diagram; and classifying the target flow diagram by utilizing a multi-layer perceptron module of the perceptual layer to obtain a classification result. According to the method, the global features and the local features of the network traffic data can be effectively combined for classification, meanwhile, the model architecture is lightened, the accuracy of the model is improved, and the situation that the number of partial traffic type samples is small can be effectively handled.

The invention relates to a network abnormal traffic detection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining the port traffic information of network equipment, carrying out the anomaly detection based on the port traffic information in combination with a preset traffic interval corresponding to the network equipment, obtaining an abnormal traffic type and abnormal traffic time, and carrying out the detection of the abnormal traffic according to the abnormal traffic time. Target traffic information, a first traffic upper limit number and a first traffic lower limit number corresponding to the first target device are obtained, then abnormal traffic types are adopted, abnormal traffic path identification is carried out in combination with the target traffic information, the first traffic upper limit number and the first traffic lower limit number, and an abnormal traffic path result is obtained; therefore, the position and the condition of the abnormal flow can be quickly and accurately determined through the abnormal flow path result, the purposes of not manually finding the abnormity and checking the network link are achieved, and the problem of poor network abnormity positioning efficiency caused by the fact that the abnormity needs to be manually found in the prior art is solved.

The invention provides a differentiated service classification and multi-path traffic scheduling method and system, and belongs to the technical field of network communication, the quintuple, packet size and timestamp characteristics of each data packet are captured in real time, a timestamp is mapped to an image horizontal axis, the packet size is mapped to a longitudinal axis after standardization, and discrete data is converted into a continuous visual mode; classifying the traffic in the network by using a pre-trained classification model, and distributing corresponding service requirements and priorities for each traffic type; distributing an INT data packet for each path, and detecting and monitoring the time delay, throughput and packet loss rate of the path in real time; and selecting an optimal path by adopting a CMAB algorithm in combination with the priority of the flow, the service demand, the real-time performance of the path and historical scheduling feedback. According to the invention, comprehensive path quality evaluation is realized; the high-priority service is ensured to obtain stable and high-quality transmission quality; and the accuracy and robustness of path selection are improved.

The invention discloses an internet behavior early warning method and system based on network packet processing, and belongs to the field of network security, and the system comprises gateway equipment, a DPI analysis module, a user portrait module and an early warning module. The gateway equipment is used for capturing user data packets in real time on a network driving layer by using an XDP technology, filtering the captured data packets, and selecting the data packets conforming to a set rule; the DPI analysis module is used for deeply analyzing the selected data packets through a DPI technology and carrying out traffic type marking and classified storage on the data packets of each user according to an analysis result; the user portrait module is used for performing user portrait analysis based on the storage data packet of the user and identifying an abnormal behavior; and the early warning module is used for configuring an early warning rule and a notification mode and giving out early warning aiming at the abnormal behavior of the user. According to the invention, high-speed processing of the data packet can be realized, and on the premise of not sacrificing performance, abnormal behaviors of a user can be accurately identified and timely early warning can be given out.

The invention discloses a multi-protocol label switching optimization method and device, equipment and a storage medium, and relates to the technical field of network communication, and the method comprises the steps: obtaining current network flow data and network state data; obtaining a bandwidth utilization rate, a link utilization rate and a network traffic type according to the traffic data of the network; generating optimization parameters based on the network state data, the bandwidth utilization rate, the link utilization rate and the network flow type, wherein the optimization parameters comprise a label allocation table, a target forwarding path and a bandwidth adjustment instruction; and optimizing the multi-protocol label switching network according to the optimization parameters. According to the invention, the optimization of the multi-protocol label switching protocol is completed through intelligent label management, the technical problems of resource waste and congestion delay are solved, and the efficiency and flexibility of the multi-protocol label switching network are improved.

The invention discloses a multi-link aggregated cloud native network system and a flow scheduling method. The system comprises an application sensing layer, a virtual link layer and a physical link layer, the application sensing layer is connected with the virtual link layer and used for analyzing network traffic to be distributed to obtain features of the network traffic, and the features comprise traffic types, priorities and bandwidth requirements; the virtual link layer is connected with the physical link layer, and is used for detecting the states of the plurality of links to obtain the state information of the plurality of links, and determining the flow distribution strategy of the plurality of links based on the characteristics and the state information; and the physical link layer is used for carrying out flow distribution on the plurality of links based on the flow distribution strategy. According to the invention, the technical problem that the traditional cloud native network depends on single link transmission, so that network congestion is easy to occur when the service flow is increased sharply is solved.

Provided are a terminal waking method and device, and a storage medium. The method includes: determining a traffic group where target terminals are located according to a traffic type of the target terminals; determining a sequence index corresponding to the target terminals at least according to the traffic group; and sending a wake up signal (WUS) corresponding to the sequence index to the target terminals.

Systems and method are disclosed for adaptive and / or autonomous traffic control. In one illustrative implementation, there is provided a method for processing traffic information. Moreover, the method may include receiving data regarding travel of vehicles associated with an intersection, using neural network technology to recognize types and / or states of traffic, and using the neural network technology to process / determine / memorize optimal traffic flow decisions as a function of experience information. Exemplary implementations may also include using the neural network technology to achieve efficient traffic flow via recognition of the optimal traffic flow decisions.

The invention provides a CSQF-based wide area network mixed flow scheduling method and system and an electronic device, and the method combines the scheduling demands of a TT flow and an AVB flow through the reasonable division of a periodic resource block, guarantees that the timeliness requirement of the TT flow is satisfied, and provides a flexible bandwidth allocation strategy for the AVB flow. And a dynamic period scaling mechanism is introduced to adapt to the change of the network load, and conflicts among different traffic types are reduced through a sliding window preemption strategy, so that the overall scheduling effect of the mixed traffic is optimized.

The invention discloses a processing method, a communication device and a storage medium, and the processing method comprises the steps that a first device determines an effective message 1 time domain resource in response to meeting a first condition; through the technical scheme of the invention, a resource determination mechanism for autonomously initiating the random access of the DO-A is defined so as to support the DO-A traffic type.

Methods and apparatus for prioritizing data traffic in small-cell wireless system. In one embodiment, the system utilizes “quasi-licensed” CBRS (Citizens Broadband Radio Service) wireless spectrum in conjunction with a wireless communication network (e.g., 3GPP 4G-LTE or 5G-NR-based). A “traffic profile” message is used to prioritize the data traffic. In one variant, the traffic profile message is generated by a Customer Premises Equipment (CPE) such as a CBRS FWA, and includes data related to CPE identification, default bearer identification, number of client devices served by the CPE (e.g., via a wireless router connected to the CPE), traffic type and / or priority level associated with each client device and / or data traffic type, etc. In another variant, the base station provides data services to a plurality of fixed wireless access (FWA) apparatus installed at user or subscriber premises of a network based on prioritization according to the present disclosure.