353 results about "Traffic type" patented technology

A method is provided for encrypted network traffic analysis. The method includes capturing network traffic data; calculating entropy of said data to classify traffic as encrypted or non-encrypted; applying statistical and sequential feature hybridization on encrypted traffic to extract comprehensive features; analyzing the features using a neural network model to identify encrypted traffic types and detect anomalies; and refining the analysis based on entropy and neural network insights through a feedback loop.

The invention discloses an intrusion detection method and device based on a graph neural network and a medium, and relates to the field of computer networks, and the method comprises the steps: constructing a graph structure according to network flow data in a current time window; the graph structure comprises a node set, an edge set, a node feature matrix, an edge feature matrix and an adjacent matrix; the adjacent matrix is used for representing a communication state between the nodes; inputting the graph structure corresponding to the current time window into a network node traffic type identification model to obtain the traffic type of each node; the network node traffic type identification model is obtained by training a preset graph neural network by adopting a training sample set; in a preset graph neural network, for an input graph structure, a Bi-LSTM layer is adopted to extract time feature information, and a graph convolution layer and a graph attention mechanism are combined to extract space feature information in a time dimension, so that a traffic type of each node is obtained. According to the invention, more accurate network intrusion detection is realized.

Methods, systems, and apparatuses are provided for handling Non-Terrestrial Network (NTN) store and forward (S&F) configurations in a wireless communication system, wherein a method of a User Equipment (UE) comprises being provided with an indication or a configuration about traffic type for an S&F operation from a network, and determining whether to use the S&P operation based on the indication or the configuration

Various solutions for adaptation of measurement gap configuration with dynamic control signaling are described. A network node may determine a traffic type. The network node may determine a measurement gap repetition period for the traffic type according to a periodicity of a reference signal (RS) and a video frame rate associated with the traffic type. The network node may transmit a measurement gap configuration with the measurement gap repetition period to a user equipment (UE).

The invention discloses a TSN scheduling optimization method and device based on flow sensing autonomous learning, equipment and a medium. The method comprises the following steps: deploying a lightweight flow detection module in a switch or a router, and after a controller receives a data request, automatically identifying a newly arrived unknown service flow by using the lightweight flow detection module, and judging whether the newly arrived unknown service flow is a periodic TT flow or an unpredictable burst flow; the controller performs classification management on the identified service flow types, collects topological information and flow requirements of the whole network and issues the topological information and the flow requirements to the terminal nodes through a network management interface; the controller constructs an intelligent queue scheduling task based on the collected network topology information and traffic demand and converts the task into a Markov decision process MDP, network resources, queue states and priorities are used as a state space, a scheduling strategy is used as an action space, a reward function is designed in combination with throughput and delay indexes, and an intelligent queue scheduling task is obtained. Driving a dynamic environment through real-time data and training a DRL model; an enhanced queue scheduling mechanism Pro-CQF is adopted, different priority labels are configured according to classified flow types, and then mixed flow scheduling is carried out; the controller periodically collects time delay, packet loss rate and end-to-end transmission delay indexes and feeds back the indexes to the DRL model, and a scheduling strategy is updated online. According to the method, the traffic sensing and scheduling efficiency is greatly improved in a network environment in which multiple service flows coexist and end-side equipment functions are different, and the reliability and the expandability of the TSN in industrial Internet of Things, edge computing and other high-real-time application scenes are remarkably enhanced.

The invention relates to the field of network security, and discloses a network abnormal traffic monitoring and attack defense system based on artificial intelligence, which comprises a data preprocessing module used for receiving original traffic data, executing cleaning, duplicate removal and normalization processing, and dividing a processing result into data fragments according to a preset time window; the network flow analysis module is used for receiving the data fragments, performing feature extraction and mode analysis and outputting an analysis result representing the flow abnormal degree, and the analysis result at least comprises a score value representing the overall abnormal degree and a feature vector representing the flow mode feature; the attack judgment module is used for comparing the score value with a preset abnormal threshold value so as to judge whether network abnormal traffic exists or not, if yes, the feature vector is further matched with a pre-constructed abnormal traffic type feature library, and a specific abnormal traffic type is determined according to a matching result; and the attack defense module is used for automatically triggering and executing a corresponding defense strategy.

An operation mode from a plurality of operation modes can be determined (310) based on at least one traffic type originated from a UE. The plurality of operation modes can include at least one group operation mode and an individual operation mode. The at least one group operation mode can support a plurality of UEs grouped into a group of UEs. The at least one group operation mode can support at least one network entity communicating associated messages with the group of UEs including the UE. The associated messages can be associated with the group of UEs. A network entity can be informed (320) of the determined operation mode.

The invention relates to the technical field of time-sensitive networks, and particularly provides a round-robin queue forwarding scheduling model and method for mixed time-sensitive traffic, and a terminal. The circular queue forwarding scheduling model comprises a delay sensitive queue, a first time sensitive queue and a second time sensitive queue. The method comprises the following steps: creating two time slot systems; defining fixed injection time and a queue scheduling strategy for the time-triggered traffic; carrying out pre-scheduling planning according to the knowability of the time-triggered stream, and obtaining injection time corresponding to the time-triggered stream and a corresponding injection queue; and for the emergently arrived event trigger flow, incremental scheduling is carried out according to real-time link resources, and a suitable time slot is obtained for forwarding. According to the invention, the event trigger traffic and the time trigger traffic are placed in different queues, and the model designs a scheduling mode of the corresponding event trigger traffic, so that the isolation of traffic types is effectively realized, the scheduling and forwarding of the time sensitive traffic are optimized, and the network communication efficiency is enhanced.

The invention relates to an encrypted traffic classification method based on a two-stage adaptive architecture, and belongs to the technical field of computer network security. The method comprises the following steps: firstly, distinguishing data in-distribution (ID) and out-of-distribution (OOD) traffic through a mixed OOD detection mechanism, and processing a detection result by adopting a self-adaptive classification strategy: for the ID traffic, accurately classifying known categories by adopting a transformer-based encoder; for OOD traffic, a classification task is converted into a generation task by combining a large language model (LLM) and a newly proposed semantic enhancement prompt strategy (SPS), so that flexible fine-grained recognition of unknown traffic types is realized. The SPS strategy comprises three levels of a strict mode, a complete mode and an expansion mode, and a flexible generation space is provided while the classification precision is ensured. Through the innovative two-stage design, the problem that the emerging network application cannot be accurately identified by the existing method is effectively solved while the high-precision classification of the ID traffic is maintained.

The invention discloses a storm control method based on application program identification, and relates to the technical field of network traffic management, and the method comprises the steps: obtaining network traffic passing through an application layer under the condition that a network storm is detected, identifying an application layer protocol corresponding to the network traffic, and transmitting the network traffic to the application layer, obtaining an application traffic type; determining the priority of the application traffic according to the application traffic type; and acquiring a network flow state in real time, and determining and dynamically adjusting a storm control strategy according to the network flow state, the priority of the application flow and a preset model, so as to perform network storm control through the dynamically adjusted storm control strategy. The application type can be identified, the storm control strategy can be dynamically adjusted, and the traffic demands of different applications can be guaranteed.

The invention provides a method and system for judging suspicious traffic in encrypted traffic, and the method comprises the steps: collecting to-be-detected encrypted traffic, and extracting the encrypted traffic features of the to-be-detected encrypted traffic; wherein the encrypted traffic feature comprises a first traffic feature and a second traffic feature, and the second traffic feature comprises domain name popularity; the second traffic feature is determined based on a malicious neighborhood value determined according to the relation graph; the relation graph comprises domain name nodes, entity nodes, edges connecting the entity nodes and edges connecting the entity nodes and the domain name nodes, and the edge attributes of the edges of the relation graph comprise communication related data and traffic types; determining the traffic type of the to-be-measured encrypted traffic based on the encrypted traffic feature of the to-be-measured encrypted traffic, the traffic type including normal traffic and suspicious traffic; and in response to the fact that the traffic type of the to-be-tested encrypted traffic is suspicious traffic, performing subsequent decryption analysis on the to-be-tested encrypted traffic through a decryption DPI module.

The invention discloses an encrypted malicious traffic detection method based on deep learning, and the method comprises the steps: extracting time sequence features of network traffic data through an LSTM model, further extracting semantic features of the traffic data through a BERT model, and finally forming comprehensive feature representation; clustering the comprehensive feature representation by using a DBSCAN algorithm; optimizing sample labels in each cluster according to a defined naming rule, and classifying traffic types with similar attack characteristics into uniform labels; constructing a graph structure, performing edge connection on the optimized traffic sample labels and the comprehensive feature representation thereof, and establishing edge connection among different clusters according to cosine similarity; and constructing a GraphSAGE graph neural network model, performing information aggregation on nodes of a graph structure and neighbor nodes thereof to obtain an updated feature vector of each node, performing classification processing by using updated node features, and identifying whether the traffic is malicious encrypted traffic. According to the invention, the detection precision and robustness are improved.

The invention relates to the technical field of network security, in particular to a network traffic anomaly detection method and system based on a knowledge graph, and the method comprises the steps: extracting entities in a traffic data set, relationships between the entities and entity attributes, and constructing a traffic information knowledge graph based on the extracted entities, relationships between the entities and entity attributes; storing the flow information knowledge graph into a graph database; and obtaining a feature similarity score between the to-be-detected unknown traffic and the traffic in the stored traffic information knowledge graph by adopting a collaborative filtering algorithm, and determining the type of the to-be-detected unknown traffic according to the feature similarity score. According to the method, the traffic information is stored in the graph database Neo4j, so that the relationship of characteristic values among the traffic is clearer and clearer, the operation of security personnel is facilitated, and the visualization effect is improved; through matching of intervals where flow characteristic values in the knowledge graph are located, the flow range participating in calculation of an anomaly detection algorithm is narrowed, and the calculation efficiency is improved; and by fusing the weight coefficients and comprehensively considering the two similarity results, the accuracy of the detection result is improved.

The present invention provides according to one of its aspects a method of communication in a wireless network comprising an access point and a plurality of stations, the method comprising, at one of the stations:receiving a trigger frame from the access point, the trigger frame reserving a transmission opportunity on at least one communication channel of the wireless network, the transmission opportunity including random resource units that the stations may access using a contention scheme, wherein the trigger frame includes a first indicator specifying a traffic type of data allowed to be sent on at least one of the random resource units;determining, based on the first indicator, eligible resource units, among the resource units in the reserved transmission opportunity, for the station to contend for access for transmitting data; andtransmitting data on a determined eligible resource unit using a contention scheme.

The invention provides a network condition detection method based on Internet of Things traffic features and electronic equipment, and the method comprises the steps: obtaining a first feature set of a traffic segment, the first feature set comprising a total byte number and a total packet number corresponding to a traffic direction; analyzing the first feature set by using a clustering-based first model to obtain an anomaly detection result, the first model being unsupervised learning, and the anomaly detection result representing whether traffic anomaly occurs; obtaining a second feature set of the traffic fragment, the second feature set comprising traffic statistical information corresponding to a traffic type, the traffic type being related to at least one of a traffic direction, a traffic source, a protocol type and a network identifier; analyzing the second feature set by using a second model based on a decision tree to obtain an attack result; and determining a detection result based on the anomaly detection result and the attack result. Therefore, the effectiveness of low-rate attack detection and the convenience of detection can be improved.

The invention relates to the technical field of network flow management, in particular to a network flow management method based on data analysis, and the method comprises the steps: obtaining the historical flow data of all network user sides, and the flow use data and user side information of each network user side from a server; obtaining geographic position distribution of all network user sides, and determining a traffic type of each network user side; determining the flow use user type of each network user side according to the user side information and the flow type; determining usage related characterization parameters of the network user side, and determining a traffic management area in combination with the traffic usage user type; determining a flow management mode in the next flow management period according to the flow management area; according to the invention, the traffic characteristics of the user side are analyzed, and the corresponding traffic management is carried out according to the traffic use demand, so that the rationality of the traffic management is improved, and the traffic demands of different users are ensured.

The invention belongs to the field of process optimization and finance, and relates to an application lossless release method, which comprises the following steps of: obtaining application configuration information of a new version application, and deploying the application configuration information in gray environment resources to obtain a gray version application; service feature data obtained by analyzing the service request is matched with a preset traffic dyeing rule, and when the traffic type is gray traffic, the service request is routed to a gray version application; the method comprises the steps of obtaining a flow state of a service request to judge whether service flow is normal or not, verifying a gray-level version application when the flow is normal, switching flow from a production environment to a gray-level environment step by step after verification is passed, continuously monitoring a running state of the gray-level version application in a preset time period, releasing a new-level application to the production environment, and releasing gray-level environment resources. The invention further provides an application lossless release device, computer equipment and a storage medium. In addition, the invention also relates to a block chain technology, and the new version application can be stored in a block chain. Smooth transition between the new version and the old version is achieved.

The invention is applicable to the technical field of network communication, and provides a roaming switching method and a roaming switching device in an FTTR (Fiber To The Room) network environment, the method can be applied to fiber to the Room (FTTR), enterprise-level fiber to the Room-Bus (FTTR-B) and broadband fusion terminal products, and the roaming switching method and the roaming switching device in the FTTR network environment can be applied to fiber to the Room (FTTR) and the enterprise-level fiber to the Room-Bus (FTTR-B). The roaming switching method in the FTTR network environment comprises the following steps: when first signal strength of current access point equipment is lower than a first threshold value, terminal equipment sends a traffic type to other access point equipment; receiving roaming priorities returned by other access point equipment according to the traffic type; screening a target access point device from the plurality of other access point devices according to the roaming priorities corresponding to the plurality of other access point devices and the second signal intensities corresponding to the plurality of other access point devices; and switching the current access point equipment which is currently connected with the terminal equipment to the target access point equipment. According to the scheme, by optimizing the switching process, the problems of lagging, delay and the like caused by network switching are remarkably reduced.

Methods, devices, and systems are disclosed for multi-hop relays that may be implemented by advertising first relaying capabilities and a first number of hops to reach a remote wireless transmit / receive unit (WTRU), receiving second relaying capabilities and a second number of hops to reach the remote WTRU from a selected relay WTRU, updating a relay capabilities table based on the second relaying capabilities and the second number of hops, receiving a packet comprising a payload, the packet having a traffic type and further comprising a maximum number of hops, selecting the selected relay WTRU based on the traffic type, the maximum number of hops, and the relay capabilities table, generating a first updated packet comprising the payload, the traffic type and a first updated number of hops that is one less than the maximum number of hops, and transmitting the first updated packet to the selected relay WTRU.

The invention discloses a traffic abnormal event processing method, system and device and a storage medium, and the traffic abnormal event processing method is used for splitting a video image into a plurality of image units in a single frame form, extracting traffic type information in each image unit, and obtaining traffic type information of each image unit based on a preset optical flow algorithm. The method comprises the steps of obtaining operation information of each piece of traffic type information in each direction, identifying that each piece of operation information and / or each piece of operation information meet a preset abnormal condition so as to detect abnormal events, integrating video stream data corresponding to a plurality of abnormal events with heartbeat data in a corresponding time period so as to obtain a plurality of pieces of event integration information, and sending the plurality of pieces of event integration information to a server. And the plurality of event integration information is transmitted to the terminal, so that the abnormal event of the field traffic can be quickly judged and acquired, and the abnormal event and the corresponding video stream data are integrated and transmitted to the terminal, and the response and feedback efficiency of the abnormal event is improved.

Solutions for service aware proxy-call session control function (P-CSCF) traffic routing include: receiving, at a master P-CSCF in a pool of a plurality of P-CSCFs, internet protocol (IP) multimedia subsystem (IMS) traffic from a device; determining, by the master P-CSCF, a traffic type (e.g., 5G, 4G, SMS, WiFi, etc.) of the IMS traffic from the device; based on at least the traffic type of the IMS traffic from the device, selecting, by the master P-CSCF, a serving P-CSCF from the pool for the device; and forwarding, by the serving P-CSCF for the device, the IMS traffic from the device to an IMS. In some examples, the serving P-CSCF selection also includes loading considerations. In some examples, an alternate P-CSCF is available for failover as the new master P-CSCF. In some examples, a network includes multiple pools of P-CSCFs, with each pool having its own master P-CSCF and alternate P-CSCF.

The invention discloses an industrial control system threat trapping method based on a machine learning algorithm, which aims at solving the problems of complicated abnormal traffic type, high feature dimension and the like of an electric power industrial control system, introduces a random forest algorithm to design a data detection module of a dynamic honeynet system, and improves the accuracy of abnormal traffic identification. And meanwhile, a DQN algorithm of deep reinforcement learning is utilized to help the honeynet system to make strategy dynamic adjustment when facing different attack behaviors. Experimental results show that the network security protection capability of the industrial control system can be effectively improved.

The invention discloses a differentiated congestion control method based on RDMA (Remote Direct Memory Access) and a hardware controller system. In the invention, a differentiated congestion control algorithm is provided by using the DSCP, so that the limitation of complete fair regulation and control of the traditional congestion control algorithm is broken through, accurate resource allocation for different flow types is realized, and a more efficient bandwidth utilization rate is achieved under the congestion condition; complete hardening of a congestion controller system is realized, a scheme for dynamically supporting all congestion flows in a network and supporting 1024 concurrent congestion flows at most is provided, and the congestion flows in the network can be managed more efficiently to achieve the purpose of relieving network congestion; the data which is read from the host and participates in operation does not need to be stored in the cache, so that the burden of the host is reduced, the performance reduction caused by bus data reading delay is eliminated, the processing speed of the parallel congestion event is remarkably improved, and the delay of rate feedback is reduced.

Network operators can define port mappings for UDP destination ports and the encapsulated protocol / traffic type (X) in UDP. BGP may be used to notify the UDP destination port-to-traffic type mapping to an encapsulator. A generic UDP encapsulation mechanism (X-in-UDP), where UDP can be used to encapsulate packets of any user configured protocol / traffic type X (e.g., IPv4, IPv6, MPLS, etc.), is described. Primary benefits of using UDP for encapsulation are to leverage UDP port numbers for load-balancing. Generic UDP encapsulation of any protocol / traffic type using user defined port-maps provides flexibility to network operators in constructing different overlay networks. UDP encapsulation helps leverage fine-grade load balancing over Equal-Cost Multipath (ECMP).

The invention provides a network traffic classification method, device and equipment based on multi-feature fusion, and belongs to the field of artificial intelligence. The method comprises the following steps: preprocessing traffic data to obtain a traffic grey-scale map; screening a minority class traffic sample set from the traffic grey-scale map; simulating a minority class traffic sample set through a WGAN model, and constructing and generating a sample; supplementing the generated sample into the flow grey-scale map to form a balanced sample set; inputting the balanced sample set into a ViT hybrid model to extract features, and obtaining sequence features; fusing the sequence features based on a cross attention mechanism to obtain a target traffic diagram; and classifying the target flow diagram by utilizing a multi-layer perceptron module of the perceptual layer to obtain a classification result. According to the method, the global features and the local features of the network traffic data can be effectively combined for classification, meanwhile, the model architecture is lightened, the accuracy of the model is improved, and the situation that the number of partial traffic type samples is small can be effectively handled.

Apparatuses and methods for traffic type based quality of experience (QoE) maintenance for mobile devices. A user equipment (UE) includes a transceiver. The transceiver is configured to receive and transmit traffic over a link with a wireless network. The UE further includes a processor operably coupled to the transceiver. The processor is configured to classify the traffic into at least one of real time (RT) traffic or non-real-time (NRT) traffic, generate a link deterioration prediction, select, based on the link deterioration prediction and the traffic class, a QoE maintenance action, and perform the QoE maintenance action.

The invention relates to a network abnormal traffic detection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining the port traffic information of network equipment, carrying out the anomaly detection based on the port traffic information in combination with a preset traffic interval corresponding to the network equipment, obtaining an abnormal traffic type and abnormal traffic time, and carrying out the detection of the abnormal traffic according to the abnormal traffic time. Target traffic information, a first traffic upper limit number and a first traffic lower limit number corresponding to the first target device are obtained, then abnormal traffic types are adopted, abnormal traffic path identification is carried out in combination with the target traffic information, the first traffic upper limit number and the first traffic lower limit number, and an abnormal traffic path result is obtained; therefore, the position and the condition of the abnormal flow can be quickly and accurately determined through the abnormal flow path result, the purposes of not manually finding the abnormity and checking the network link are achieved, and the problem of poor network abnormity positioning efficiency caused by the fact that the abnormity needs to be manually found in the prior art is solved.

The invention provides a differentiated service classification and multi-path traffic scheduling method and system, and belongs to the technical field of network communication, the quintuple, packet size and timestamp characteristics of each data packet are captured in real time, a timestamp is mapped to an image horizontal axis, the packet size is mapped to a longitudinal axis after standardization, and discrete data is converted into a continuous visual mode; classifying the traffic in the network by using a pre-trained classification model, and distributing corresponding service requirements and priorities for each traffic type; distributing an INT data packet for each path, and detecting and monitoring the time delay, throughput and packet loss rate of the path in real time; and selecting an optimal path by adopting a CMAB algorithm in combination with the priority of the flow, the service demand, the real-time performance of the path and historical scheduling feedback. According to the invention, comprehensive path quality evaluation is realized; the high-priority service is ensured to obtain stable and high-quality transmission quality; and the accuracy and robustness of path selection are improved.

The present invention belongs to the field of network security, and specifically relates to an automated processing method, system and device for network security attack traffic, aiming to solve the problems of existing network attack detection methods lacking automated processing capabilities, high resource consumption and low efficiency. The present invention includes: matching alarm data in historical network traffic through predefined rules; training a security model based on deep learning through the alarm data, and connecting the trained security model based on deep learning to the application end, and outputting the network traffic prediction result in the application end; the security model based on deep learning outputs the prediction result according to the alarm data, obtains the historical attack text through natural language processing of the prediction result, and adjusts the parameters of the security model based on deep learning according to the preset evaluation index and loss function of the historical attack text; diagnoses the attack traffic type according to the attacker characteristics and attack type, and then initiates the disposal measures corresponding to the attack traffic type.