CN114553788A - Method, device, computer readable storage medium and processor for traffic classification - Google Patents
Method, device, computer readable storage medium and processor for traffic classification Download PDFInfo
- Publication number
- CN114553788A CN114553788A CN202210152718.7A CN202210152718A CN114553788A CN 114553788 A CN114553788 A CN 114553788A CN 202210152718 A CN202210152718 A CN 202210152718A CN 114553788 A CN114553788 A CN 114553788A
- Authority
- CN
- China
- Prior art keywords
- real
- time
- data packet
- data packets
- length
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
- H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
- H04L47/2441—Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
Abstract
A method, apparatus, computer-readable storage medium, and processor for traffic classification are provided. The method comprises the following steps: acquiring real-time flow of a network layer, wherein the real-time flow comprises an uplink data packet and a downlink data packet, and determining classification characteristics according to the uplink data packet and the downlink data packet, wherein the classification characteristics comprise the length of the uplink data packet, the length of the downlink data packet, the number of the uplink data packets and the number of the downlink data packets; and determining the type of the real-time traffic based on the classification characteristics, wherein the type comprises real-time interactive traffic and non-real-time interactive traffic. In the scheme, real-time flow is classified and applied to the network layer, the type of the real-time flow on the network layer can be efficiently and accurately determined by classifying the real-time flow on the network layer, the scheme has higher real-time performance and effectiveness, and the problem that the network layer with high practicability requirement cannot be effectively classified in the prior art is solved.
Description
Technical Field
The present application relates to the field of mobile communications, and in particular, to a method, an apparatus, a computer-readable storage medium, and a processor for traffic classification.
Background
The rapid development of information technology brings intelligent life and also brings huge network traffic increase, which poses serious challenges to network management, network security guarantee and service quality, so that traffic classification arises, which refers to associating traffic data with a specific application or application type generating the traffic data to achieve the effect of preferentially processing, protecting or organizing certain traffic, and the research on traffic classification has been well established, and is now roughly divided into four types according to different research emphasis and research methods: port number based classification methods, payload based classification methods, statistics based classification methods and behavior based classification methods.
The port number-based classification method and the ordered load-based classification method cannot classify encryption flows, and the current network traffic is almost encrypted, so that the two classification methods are not suitable for traffic classification, the statistical-based classification method and the behavior-based classification method are often processed by using complex algorithms such as a mechanical period, the real-time performance is low, the complexity is high, the classification scene is mostly limited by an application layer, and the effective traffic classification cannot be performed on a network layer with high practicability requirements.
Disclosure of Invention
The present application mainly aims to provide a method, an apparatus, a computer-readable storage medium, and a processor for traffic classification, so as to solve the problem in the prior art that effective traffic classification cannot be performed for a network layer with high practical requirement.
According to an aspect of an embodiment of the present invention, there is provided a traffic classification method, including: acquiring real-time flow of a network layer, wherein the real-time flow comprises an uplink data packet and a downlink data packet, the uplink data packet is a data packet transmitted from a first device to a second device, and the downlink data packet is a data packet transmitted from the second device to the first device; determining classification characteristics according to the uplink data packets and the downlink data packets, wherein the classification characteristics comprise the length of the uplink data packets, the length of the downlink data packets, the number of the uplink data packets and the number of the downlink data packets; determining the type of the real-time traffic based on the classification features, wherein the type comprises real-time interactive traffic and non-real-time interactive traffic.
Optionally, determining a classification characteristic according to the uplink data packet and the downlink data packet includes: acquiring the length of each downlink data packet in an effective data window in a network layer, wherein the effective data window is a data window in a preset time interval, the preset time interval is a time interval from a starting time to an ending time, the number of the downlink data packets in the effective data window is greater than or equal to a preset number, and the time interval for transmitting all the downlink data packets in the effective data window from the second device to the first device is less than the preset time interval; calculating a first length average value of a plurality of downlink data packets in the effective data window; calculating a second length average of a plurality of uplink data packets in the valid data window, and determining the type of the real-time traffic based on the classification characteristics, including: and determining the type of the real-time flow according to at least the first length mean value and the second length mean value.
Optionally, calculating a first length average of a plurality of downlink data packets in the valid data window includes: acquiring the starting time and the ending time of the valid data window; acquiring the number of the downlink data packets in the effective data window; and determining the first length mean value of a plurality of downlink data packets according to the starting time, the ending time, the number of the downlink data packets in the effective data window and the length of each downlink data packet.
Optionally, calculating a second length average of the plurality of uplink data packets in the valid data window includes: acquiring the number of the uplink data packets in the effective data window and the length of each uplink data packet; and determining the second length average value of a plurality of uplink data packets according to the number of the uplink data packets in the effective data window and the length of each uplink data packet.
Optionally, determining the type of the real-time flow according to at least the first length average and the second length average includes: acquiring the number of the uplink data packets and the number of the downlink data packets; calculating a first ratio of the number of the uplink data packets to the number of the downlink data packets; calculating a second ratio of the first length mean and the second length mean; determining the type of the real-time flow as a first flow type under the condition that the first ratio is within a first preset range and the second ratio is within a second preset range; and determining the type of the real-time flow as a second flow type under the condition that the first ratio is not in the first preset range or the second ratio is not in the second preset range.
Optionally, in a case that the first ratio is not within the first predetermined range or the second ratio is not within the second predetermined range, after determining that the type of the real-time traffic is a second traffic type, the method further includes: determining a transmission level of the first traffic type as a first level; determining a transmission level of the second traffic type as a second level, the transmission speed of the first level being greater than the transmission speed of the second level.
Optionally, the method further comprises: acquiring a first IP address of the first device and a second IP address of the second device; storing the first IP address and the second IP address.
According to another aspect of the embodiments of the present invention, there is also provided a traffic classification apparatus, including: a first obtaining unit, configured to obtain real-time traffic of a network layer, where the real-time traffic includes an uplink data packet and a downlink data packet, the uplink data packet is a data packet transmitted from a first device to a second device, and the downlink data packet is a data packet transmitted from the second device to the first device; a first determining unit, configured to determine a classification characteristic according to the uplink data packet and the downlink data packet, where the classification characteristic includes a length of the uplink data packet, a length of the downlink data packet, a number of the uplink data packets, and a number of the downlink data packets; and the second determining unit is used for determining the type of the real-time traffic based on the classification characteristic, wherein the type comprises real-time interactive traffic and non-real-time interactive traffic.
According to still another aspect of embodiments of the present invention, there is also provided a computer-readable storage medium including a stored program, wherein the program executes any one of the methods.
According to still another aspect of the embodiments of the present invention, there is further provided a processor, configured to execute a program, where the program executes any one of the methods.
In the embodiment of the present invention, a real-time traffic of a network layer is first obtained, where the real-time traffic includes an uplink data packet and a downlink data packet, then a classification characteristic is determined according to the uplink data packet and the downlink data packet, and finally a type of the real-time traffic is determined based on the classification characteristic. In the scheme, real-time flow is classified and applied to the network layer, the type of the real-time flow on the network layer can be efficiently and accurately determined by classifying the real-time flow on the network layer, the scheme has higher real-time performance and effectiveness, and the problem that the network layer with high practicability requirement cannot be effectively classified in the prior art is solved.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this application, illustrate embodiments of the application and, together with the description, serve to explain the application and are not intended to limit the application. In the drawings:
FIG. 1 shows a flow diagram of a method of traffic classification according to an embodiment of the present application;
FIG. 2 illustrates a classification effect graph of real-time traffic;
FIG. 3 shows a flow diagram of another method of traffic classification according to an embodiment of the application;
fig. 4 is a schematic structural diagram of a traffic classification device according to an embodiment of the present application.
Detailed Description
It should be noted that the embodiments and features of the embodiments in the present application may be combined with each other without conflict. The present application will be described in detail below with reference to the embodiments with reference to the attached drawings.
In order to make the technical solutions better understood by those skilled in the art, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only partial embodiments of the present application, but not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
It should be noted that the terms "first," "second," and the like in the description and claims of this application and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It should be understood that the data so used may be interchanged under appropriate circumstances such that embodiments of the application described herein may be used. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
It will be understood that when an element such as a layer, film, region, or substrate is referred to as being "on" another element, it can be directly on the other element or intervening elements may also be present. Also, in the specification and claims, when an element is described as being "connected" to another element, the element may be "directly connected" to the other element or "connected" to the other element through a third element.
As mentioned in the background, the prior art cannot effectively classify traffic for a network layer with high practicability, and in order to solve the above problems, in one embodiment of the present application, a method, an apparatus, a computer-readable storage medium, and a processor for traffic classification are provided.
According to an embodiment of the present application, a method of traffic classification is provided.
Fig. 1 is a flow chart of a method of traffic classification according to an embodiment of the present application. As shown in fig. 1, the method comprises the steps of:
step S101, acquiring real-time flow of a network layer, wherein the real-time flow comprises an uplink data packet and a downlink data packet, the uplink data packet is a data packet transmitted from a first device to a second device, and the downlink data packet is a data packet transmitted from the second device to the first device;
step S102, determining classification characteristics according to the uplink data packet and the downlink data packet, wherein the classification characteristics comprise the length of the uplink data packet, the length of the downlink data packet, the number of the uplink data packets and the number of the downlink data packets;
step S103, determining the type of the real-time flow based on the classification characteristics, wherein the type comprises real-time interactive flow and non-real-time interactive flow.
In the method, a real-time flow of a network layer is firstly obtained, the real-time flow comprises an uplink data packet and a downlink data packet, then a classification characteristic is determined according to the uplink data packet and the downlink data packet, and finally the type of the real-time flow is determined based on the classification characteristic. In the scheme, real-time flow is classified and applied to the network layer, the type of the real-time flow on the network layer can be efficiently and accurately determined by classifying the real-time flow on the network layer, the scheme has higher real-time performance and effectiveness, and the problem that the network layer with high practicability requirement cannot be effectively classified in the prior art is solved.
It should be noted that the steps illustrated in the flowcharts of the figures may be performed in a computer system such as a set of computer-executable instructions and that, although a logical order is illustrated in the flowcharts, in some cases, the steps illustrated or described may be performed in an order different than presented herein.
In an embodiment of the present application, determining the classification characteristic according to the uplink data packet and the downlink data packet includes: acquiring the length of each downlink data packet in an effective data window in a network layer, wherein the effective data window is a data window in a preset time interval, the preset time interval is a time interval from a starting time to an ending time, the number of the downlink data packets in the effective data window is greater than or equal to a preset number, and the time interval for transmitting all the downlink data packets in the effective data window from the second device to the first device is less than the preset time interval; calculating a first length average value of a plurality of downlink data packets in the valid data window; calculating a second length average of a plurality of uplink data packets in the valid data window, and determining the type of the real-time traffic based on the classification characteristic, including: and determining the type of the real-time flow according to at least the first length average value and the second length average value. In this embodiment, feature extraction is performed based on the data window, the length of each downlink data packet in the effective data window in the network layer may be obtained, and then the first length average of the plurality of downlink data packets and the second length average of the plurality of uplink data packets in the effective data window are calculated, so that the type of the real-time traffic in the network layer may be determined more efficiently and accurately according to the two length averages.
In another embodiment of the present application, calculating a first length average of a plurality of the downlink data packets in the valid data window includes: acquiring the starting time and the ending time of the valid data window; acquiring the number of the downlink data packets in the effective data window; determining the first length average of the plurality of downlink packets according to the start time, the end time, the number of the downlink packets in the valid data window, and the length of each of the downlink packets. In the embodiment, the first length average of the plurality of downlink data packets can be determined more efficiently and accurately, and the type of the real-time traffic in the network layer can be determined more efficiently and accurately.
In a specific embodiment, the following formula may be used to calculate the first average length of the downlink data packets:
wherein the content of the first and second substances,
denotes the mean value of the first length, WthreshThe window length of the valid data window is indicated,
indicating the length of each downstream packet in the valid data window,
time interval, T, representing the transmission of all downstream data packets in the valid data window from the second device to the first devicethreshIndicating a predetermined time interval.
In another embodiment of the present application, calculating a second length average of a plurality of uplink data packets in the valid data window includes: acquiring the number of the uplink data packets in the valid data window and the length of each uplink data packet; and determining the second length average value of a plurality of uplink data packets according to the number of the uplink data packets in the valid data window and the length of each uplink data packet. In this embodiment, a plurality of uplink data packets can be directly determined according to the number of the obtained effective data windows and the length of each uplink data packet, and a complex calculation process is not required.
In a specific embodiment, the lengths of a plurality of downlink data packets in an effective data window are obtained, the starting time of the effective data window where the first downlink data packet is located is determined, the ending time of the effective data window where the last downlink data packet is located is determined, a plurality of corresponding uplink data packets which are greater than the starting time and less than the ending time are determined according to the starting time and the ending time, and the second length average value of the plurality of uplink data packets is counted.
In another embodiment of the present application, determining the type of the real-time traffic according to at least the first length average and the second length average includes: acquiring the number of the uplink data packets and the number of the downlink data packets; calculating a first ratio of the number of the uplink data packets to the number of the downlink data packets; calculating a second ratio of the first length average to the second length average; determining the type of the real-time flow as a first flow type under the condition that the first ratio is within a first preset range and the second ratio is within a second preset range; and determining the type of the real-time flow as a second flow type when the first ratio is not in the first preset range or the second ratio is not in the second preset range. In this embodiment, in actual application, for different communication devices, Maximum Transmission Units (MTUs) of the communication devices may be different, a first ratio is determined by using the number of uplink data packets and the number of downlink data packets, a second ratio is determined by using a second length average of the uplink data packets and the first length average of the downlink data packets, and then a type of real-time traffic is determined according to the first ratio and the second ratio, so that robustness of a classification algorithm can be improved, and effectiveness of the scheme is further ensured to be good.
In a specific embodiment, as shown in fig. 2, there are 5 real-time traffic, which are live video, video cache, voice call, video call, and web browsing, respectively, where the abscissa in fig. 2 represents a first ratio, the ordinate in fig. 2 represents a second ratio, the first predetermined range is [0.4, 1.4], and the second predetermined range is [0.2, 1.6], and as is apparent from fig. 2, the voice call and the video call are of a first traffic type (real-time interactive traffic), and the live video, the video cache, and the web browsing are of a second traffic type (non-real-time interactive traffic), so that the present scheme can efficiently distinguish the real-time interactive traffic from the non-real-time interactive traffic at a network layer.
In a specific embodiment of the application, after determining that the type of the real-time traffic is a second traffic type when the first ratio is not within the first predetermined range or the second ratio is not within the second predetermined range, the method further includes: determining the transmission grade of the first traffic type as a first grade; and determining the transmission grade of the second flow type as a second grade, wherein the transmission speed of the first grade is greater than that of the second grade. In this embodiment, different transmission priorities may be set for different traffic types, so that the real-time performance of the real-time interactive traffic may be further improved, the user experience effect may be improved, and the real-time interactive traffic delay effect may be reduced.
In another specific embodiment of the present application, the method further includes: acquiring a first IP address of the first equipment and a second IP address of the second equipment; and storing the first IP address and the second IP address. In this embodiment, the first IP address of the first device and the second IP address of the second device may be stored, so that when two subsequent devices communicate again, the classification result may be directly determined according to the real-time traffic and the IP address, thereby further ensuring that the type of the real-time traffic may be determined more efficiently and quickly.
Specifically, as shown in fig. 3, a flow of determining a classification result according to a real-time traffic and an IP address is first to obtain a real-time traffic of a network layer, obtain an IP connection corresponding to the real-time traffic, where the IP connection is a first IP address of a first device and a second IP address of a second device, determine whether the IP connection exists in an IP library, if the IP connection exists, obtain a classification result of the IP from the IP library, if the IP connection does not exist, determine a classification feature of the real-time traffic, determine a type of the real-time traffic based on the classification feature, obtain a classification result of the IP, store the classification result in the IP library, and set a transmission level of the real-time traffic after determining the type of the real-time traffic.
The embodiment of the present application further provides a device for classifying traffic, and it should be noted that the device for classifying traffic of the embodiment of the present application can be used to execute the method for classifying traffic provided by the embodiment of the present application. The following describes a flow classifying device provided in an embodiment of the present application.
Fig. 4 is a schematic diagram of an apparatus for traffic classification according to an embodiment of the present application. As shown in fig. 4, the apparatus includes:
a first obtaining unit 10, configured to obtain a real-time traffic of a network layer, where the real-time traffic includes an uplink data packet and a downlink data packet, the uplink data packet is a data packet transmitted from a first device to a second device, and the downlink data packet is a data packet transmitted from the second device to the first device;
a first determining unit 20 configured to determine a classification characteristic based on the uplink packet and the downlink packet, where the classification characteristic includes a length of the uplink packet, a length of the downlink packet, a number of the uplink packets, and a number of the downlink packets;
a second determining unit 30, configured to determine a type of the real-time traffic based on the classification characteristic, where the type includes real-time interactive traffic and non-real-time interactive traffic.
In the above apparatus, the first obtaining unit obtains a real-time traffic of a network layer, where the real-time traffic includes an uplink data packet and a downlink data packet, the first determining unit determines a classification characteristic according to the uplink data packet and the downlink data packet, and the second determining unit determines a type of the real-time traffic based on the classification characteristic. In the scheme, real-time flow is classified and applied to the network layer, the type of the real-time flow on the network layer can be efficiently and accurately determined by classifying the real-time flow on the network layer, the scheme has higher real-time performance and effectiveness, and the problem that the network layer with high practicability requirement cannot be effectively classified in the prior art is solved.
In an embodiment of the present application, the first determining unit includes an obtaining module, a first calculating module and a second calculating module, where the obtaining module is configured to obtain a length of each downlink data packet in an effective data window in a network layer, where the effective data window is a data window in a predetermined time interval, the predetermined time interval is a time interval from a start time to an end time, a number of the downlink data packets in the effective data window is greater than or equal to a predetermined number, and a time interval during which all the downlink data packets in the effective data window are transmitted from the second device to the first device is smaller than the predetermined time interval; the first calculating module is configured to calculate a first length average of the plurality of downlink data packets in the valid data window; the second calculating module is configured to calculate a second length average of the plurality of uplink data packets in the valid data window, and the second determining unit includes a determining module configured to determine the type of the real-time traffic according to at least the first length average and the second length average. In this embodiment, feature extraction is performed based on the data window, the length of each downlink data packet in the effective data window in the network layer may be obtained, and then the first length average of the plurality of downlink data packets and the second length average of the plurality of uplink data packets in the effective data window are calculated, so that the type of the real-time traffic in the network layer may be determined more efficiently and accurately according to the two length averages.
In another embodiment of the present application, the first calculating module includes a first obtaining sub-module, a second obtaining sub-module, and a first determining sub-module, and the first obtaining sub-module is configured to obtain the start time and the end time of the valid data window; the second obtaining submodule is used for obtaining the number of the downlink data packets in the effective data window; the first determining submodule is configured to determine the first length average of a plurality of downlink data packets according to the start time, the end time, the number of the downlink data packets in the valid data window, and the length of each of the downlink data packets. In the embodiment, the first length average of the plurality of downlink data packets can be determined more efficiently and accurately, and the type of the real-time traffic in the network layer can be determined more efficiently and accurately.
In a specific embodiment, the following formula may be used to calculate the first average length of the downlink data packets:
wherein the content of the first and second substances,
indicates the first lengthDegree mean value, WthreshThe window length of the valid data window is indicated,
indicating the length of each downstream packet in the valid data window,
time interval, T, representing the transmission of all downstream data packets in the valid data window from the second device to the first devicethreshIndicating a predetermined time interval.
In yet another embodiment of the present application, the second calculating module includes a third obtaining sub-module and a second determining sub-module, the third obtaining sub-module is configured to obtain the number of the uplink data packets in the valid data window and the length of each uplink data packet, and the second determining sub-module is configured to determine the second length average of a plurality of uplink data packets according to the number of the uplink data packets in the valid data window and the length of each uplink data packet. In this embodiment, a plurality of uplink data packets can be directly determined according to the number of the obtained effective data windows and the length of each uplink data packet, and a complex calculation process is not required.
In a specific embodiment, the lengths of a plurality of downlink data packets in an effective data window are obtained, the starting time of the effective data window where the first downlink data packet is located is determined, the ending time of the effective data window where the last downlink data packet is located is determined, a plurality of corresponding uplink data packets which are greater than the starting time and less than the ending time are determined according to the starting time and the ending time, and the second length average value of the plurality of uplink data packets is counted.
In another embodiment of the present application, the determining module includes a fourth obtaining sub-module, a first calculating sub-module, a second calculating sub-module, a third determining sub-module, and a fourth determining sub-module, where the fourth obtaining sub-module is configured to obtain the number of the uplink data packets and the number of the downlink data packets; the first calculation submodule is used for calculating a first ratio of the number of the uplink data packets to the number of the downlink data packets; the second calculating submodule is used for calculating a second ratio of the first length mean value and the second length mean value; the third determining submodule is used for determining the type of the real-time flow as a first flow type under the condition that the first ratio is within a first preset range and the second ratio is within a second preset range; the fourth determining submodule is used for determining the type of the real-time flow to be a second flow type under the condition that the first ratio is not in the first preset range or the second ratio is not in the second preset range. In this embodiment, in actual application, for different communication devices, Maximum Transmission Units (MTUs) of the communication devices may be different, a first ratio is determined by using the number of uplink data packets and the number of downlink data packets, a second ratio is determined by using a second length average of the uplink data packets and the first length average of the downlink data packets, and then a type of real-time traffic is determined according to the first ratio and the second ratio, so that robustness of a classification algorithm can be improved, and effectiveness of the scheme is further ensured to be good.
In a specific embodiment of the present application, the apparatus further includes a third determining unit and a fourth determining unit, where the third determining unit is configured to determine, after determining that the type of the real-time traffic is the second traffic type, the transmission level of the first traffic type as the first level when the first ratio is not within the first predetermined range or the second ratio is not within the second predetermined range; the fourth determining unit is configured to determine the transmission rate of the second traffic type as a second rate, and the transmission rate of the first rate is greater than the transmission rate of the second rate. In this embodiment, different transmission priorities may be set for different traffic types, so that the real-time performance of the real-time interactive traffic may be further improved, the user experience effect may be improved, and the real-time interactive traffic delay effect may be reduced.
In another specific embodiment of the present application, the apparatus further includes a second obtaining unit and a storage unit, where the second obtaining unit is configured to obtain a first IP address of the first device and a second IP address of the second device; the storage unit is used for storing the first IP address and the second IP address. In this embodiment, the first IP address of the first device and the second IP address of the second device may be stored, so that when two subsequent devices communicate again, the classification result may be directly determined according to the real-time traffic and the IP address, thereby further ensuring that the type of the real-time traffic may be determined more efficiently and quickly.
The device for classifying the flow comprises a processor and a memory, wherein the first acquiring unit, the first determining unit, the second determining unit and the like are stored in the memory as program units, and the processor executes the program units stored in the memory to realize corresponding functions.
The processor comprises a kernel, and the kernel calls the corresponding program unit from the memory. The kernel can be set to be one or more than one, and effective flow classification is carried out on a network layer with high practical requirement by adjusting kernel parameters.
The memory may include volatile memory in a computer readable medium, Random Access Memory (RAM) and/or nonvolatile memory such as Read Only Memory (ROM) or flash memory (flash RAM), and the memory includes at least one memory chip.
An embodiment of the present invention provides a computer-readable storage medium, on which a program is stored, which, when executed by a processor, implements the above-described method for traffic classification.
The embodiment of the invention provides a processor, which is used for running a program, wherein the method for classifying the traffic is executed when the program runs.
The embodiment of the invention provides equipment, which comprises a processor, a memory and a program which is stored on the memory and can run on the processor, wherein when the processor executes the program, at least the following steps are realized:
step S101, acquiring real-time flow of a network layer, wherein the real-time flow comprises an uplink data packet and a downlink data packet, the uplink data packet is a data packet transmitted from a first device to a second device, and the downlink data packet is a data packet transmitted from the second device to the first device;
step S102, determining classification characteristics according to the uplink data packet and the downlink data packet, wherein the classification characteristics comprise the length of the uplink data packet, the length of the downlink data packet, the number of the uplink data packets and the number of the downlink data packets;
step S103, determining the type of the real-time flow based on the classification characteristics, wherein the type comprises real-time interactive flow and non-real-time interactive flow.
The device herein may be a server, a PC, a PAD, a mobile phone, etc.
The present application further provides a computer program product adapted to perform a program of initializing at least the following method steps when executed on a data processing device:
step S101, acquiring real-time flow of a network layer, wherein the real-time flow comprises an uplink data packet and a downlink data packet, the uplink data packet is a data packet transmitted from a first device to a second device, and the downlink data packet is a data packet transmitted from the second device to the first device;
step S102, determining classification characteristics according to the uplink data packet and the downlink data packet, wherein the classification characteristics comprise the length of the uplink data packet, the length of the downlink data packet, the number of the uplink data packets and the number of the downlink data packets;
step S103, determining the type of the real-time flow based on the classification characteristics, wherein the type comprises real-time interactive flow and non-real-time interactive flow.
In the above embodiments of the present invention, the description of each embodiment has its own emphasis, and reference may be made to the related description of other embodiments for parts that are not described in detail in a certain embodiment.
In the embodiments provided in the present application, it should be understood that the disclosed technology can be implemented in other ways. The above-described embodiments of the apparatus are merely illustrative, and for example, the above-described division of the units may be a logical division, and in actual implementation, there may be another division, for example, multiple units or components may be combined or may be integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, units or modules, and may be in an electrical or other form.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.
The integrated unit may be stored in a computer-readable storage medium if it is implemented in the form of a software functional unit and sold or used as a separate product. Based on such understanding, the technical solution of the present invention, which is substantially or partly contributed by the prior art, or all or part of the technical solution may be embodied in a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to perform all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic or optical disk, and other various media capable of storing program codes.
From the above description, it can be seen that the above-described embodiments of the present application achieve the following technical effects:
1) the traffic classification method comprises the steps of firstly obtaining real-time traffic of a network layer, wherein the real-time traffic comprises an uplink data packet and a downlink data packet, then determining classification characteristics according to the uplink data packet and the downlink data packet, and finally determining the type of the real-time traffic based on the classification characteristics. In the scheme, real-time flow is classified and applied to the network layer, the type of the real-time flow on the network layer can be efficiently and accurately determined by classifying the real-time flow on the network layer, the scheme has higher real-time performance and effectiveness, and the problem that the network layer with high practicability requirement cannot be effectively classified in the prior art is solved.
2) According to the traffic classification device, a first obtaining unit obtains real-time traffic of a network layer, the real-time traffic comprises an uplink data packet and a downlink data packet, a first determining unit determines classification characteristics according to the uplink data packet and the downlink data packet, and finally determines the type of the real-time traffic based on the classification characteristics. In the scheme, the real-time flow is classified and applied to the network layer, the type of the real-time flow in the network layer can be efficiently and accurately determined by classifying the real-time flow in the network layer, the scheme has high real-time performance and effectiveness, and the problem that the network layer with high practicability requirement in the prior art cannot be effectively classified is solved.
The above description is only a preferred embodiment of the present application and is not intended to limit the present application, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims (10)
1. A method of traffic classification, comprising:
acquiring real-time flow of a network layer, wherein the real-time flow comprises an uplink data packet and a downlink data packet, the uplink data packet is a data packet transmitted from a first device to a second device, and the downlink data packet is a data packet transmitted from the second device to the first device;
determining classification characteristics according to the uplink data packets and the downlink data packets, wherein the classification characteristics comprise the length of the uplink data packets, the length of the downlink data packets, the number of the uplink data packets and the number of the downlink data packets;
determining the type of the real-time traffic based on the classification features, wherein the type comprises real-time interactive traffic and non-real-time interactive traffic.
2. The method of claim 1, wherein determining classification characteristics from the upstream data packet and the downstream data packet comprises:
acquiring the length of each downlink data packet in an effective data window in a network layer, wherein the effective data window is a data window in a preset time interval, the preset time interval is a time interval from a starting time to an ending time, the number of the downlink data packets in the effective data window is greater than or equal to a preset number, and the time interval for transmitting all the downlink data packets in the effective data window from the second device to the first device is less than the preset time interval;
calculating a first length average value of a plurality of downlink data packets in the effective data window;
calculating a second length average of a plurality of the upstream data packets in the valid data window,
determining the type of the real-time traffic based on the classification features, including:
and determining the type of the real-time flow according to at least the first length mean value and the second length mean value.
3. The method of claim 2, wherein calculating the first mean length value of the plurality of downlink packets in the valid data window comprises:
acquiring the starting time and the ending time of the valid data window;
acquiring the number of the downlink data packets in the effective data window;
and determining the first length mean value of a plurality of downlink data packets according to the starting time, the ending time, the number of the downlink data packets in the effective data window and the length of each downlink data packet.
4. The method of claim 2, wherein calculating the second mean length value of the plurality of uplink data packets in the valid data window comprises:
acquiring the number of the uplink data packets in the effective data window and the length of each uplink data packet;
and determining the second length average value of a plurality of uplink data packets according to the number of the uplink data packets in the effective data window and the length of each uplink data packet.
5. The method of claim 2, wherein determining the type of the real-time flow based on at least the first length average and the second length average comprises:
acquiring the number of the uplink data packets and the number of the downlink data packets;
calculating a first ratio of the number of the uplink data packets to the number of the downlink data packets;
calculating a second ratio of the first length mean and the second length mean;
determining the type of the real-time flow as a first flow type under the condition that the first ratio is within a first preset range and the second ratio is within a second preset range;
and determining the type of the real-time flow as a second flow type under the condition that the first ratio is not in the first preset range or the second ratio is not in the second preset range.
6. The method of claim 5, wherein after determining the type of the real-time traffic is a second traffic type if the first ratio is not within the first predetermined range or the second ratio is not within the second predetermined range, the method further comprises:
determining a transmission level of the first traffic type as a first level;
determining the transmission level of the second traffic type as a second level, the transmission speed of the first level being greater than the transmission speed of the second level.
7. The method according to any one of claims 1 to 6, further comprising:
acquiring a first IP address of the first device and a second IP address of the second device;
storing the first IP address and the second IP address.
8. An apparatus for classifying a flow, comprising:
a first obtaining unit, configured to obtain real-time traffic of a network layer, where the real-time traffic includes an uplink data packet and a downlink data packet, the uplink data packet is a data packet transmitted from a first device to a second device, and the downlink data packet is a data packet transmitted from the second device to the first device;
a first determining unit, configured to determine a classification characteristic according to the uplink data packet and the downlink data packet, where the classification characteristic includes a length of the uplink data packet, a length of the downlink data packet, a number of the uplink data packets, and a number of the downlink data packets;
and the second determining unit is used for determining the type of the real-time traffic based on the classification characteristic, wherein the type comprises real-time interactive traffic and non-real-time interactive traffic.
9. A computer-readable storage medium, characterized in that the computer-readable storage medium comprises a stored program, wherein the program performs the method of any one of claims 1 to 7.
10. A processor, characterized in that the processor is configured to run a program, wherein the program when running performs the method of any of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210152718.7A CN114553788A (en) | 2022-02-18 | 2022-02-18 | Method, device, computer readable storage medium and processor for traffic classification |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210152718.7A CN114553788A (en) | 2022-02-18 | 2022-02-18 | Method, device, computer readable storage medium and processor for traffic classification |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114553788A true CN114553788A (en) | 2022-05-27 |
Family
ID=81675452
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210152718.7A Pending CN114553788A (en) | 2022-02-18 | 2022-02-18 | Method, device, computer readable storage medium and processor for traffic classification |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114553788A (en) |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2014036490A1 (en) * | 2012-08-30 | 2014-03-06 | Hughes Network Systems, Llc | Staged traffic classification among terminal and aggregation nodes of a broadband communications system |
| CN109063777A (en) * | 2018-08-07 | 2018-12-21 | 北京邮电大学 | Net flow assorted method, apparatus and realization device |
| CN110197234A (en) * | 2019-06-13 | 2019-09-03 | 四川大学 | A kind of encryption traffic classification method based on binary channels convolutional neural networks |
| CN112217834A (en) * | 2020-10-21 | 2021-01-12 | 北京理工大学 | Internet encryption flow interactive feature extraction method based on graph structure |
| CA3166375A1 (en) * | 2019-12-31 | 2021-07-08 | Hughes Network Systems, Llc | Traffic flow classification using machine learning |
-
2022
- 2022-02-18 CN CN202210152718.7A patent/CN114553788A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2014036490A1 (en) * | 2012-08-30 | 2014-03-06 | Hughes Network Systems, Llc | Staged traffic classification among terminal and aggregation nodes of a broadband communications system |
| CN109063777A (en) * | 2018-08-07 | 2018-12-21 | 北京邮电大学 | Net flow assorted method, apparatus and realization device |
| CN110197234A (en) * | 2019-06-13 | 2019-09-03 | 四川大学 | A kind of encryption traffic classification method based on binary channels convolutional neural networks |
| CA3166375A1 (en) * | 2019-12-31 | 2021-07-08 | Hughes Network Systems, Llc | Traffic flow classification using machine learning |
| CN112217834A (en) * | 2020-10-21 | 2021-01-12 | 北京理工大学 | Internet encryption flow interactive feature extraction method based on graph structure |
Non-Patent Citations (3)
| Title |
|---|
| SASAN ADIBI: "Traffic Classification – Packet-, Flow-, and Application-based Approaches" * |
| 彭雄威: "基于行为的网络流量分类方法研究" * |
| 鲁鹏，黄元波: ""EPON***的流量分类实现"" * |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Schuster et al. | Beauty and the burst: Remote identification of encrypted video streams | |
| CN109640348B (en) | Multi-service MEC network architecture, and method and device for processing multi-service data stream | |
| CN106412628B (en) | Bandwidth adjusting method and related equipment | |
| CN108388794B (en) | Page data protection method and device, computer equipment and storage medium | |
| CN105337966A (en) | Processing method for network attacks and device | |
| CN108833450B (en) | Method and device for preventing server from being attacked | |
| EP1678642A1 (en) | Method for prioritizing segments of multimedia content in a proxy cache | |
| US20220021701A1 (en) | Method and System for Providing Edge Service, and Computing Device | |
| CN110995994A (en) | Image shooting method and related device | |
| CN110955541B (en) | Data processing method, device, chip, electronic equipment and readable storage medium | |
| CN112868265A (en) | Network resource management method, management device, electronic device and storage medium | |
| US20130265869A1 (en) | Systems and Methods for Selective Data Redundancy Elimination for Resource Constrained Hosts | |
| WO2017092275A1 (en) | Router bandwidth management method and device, and router | |
| CN109121157B (en) | Network speed limit determining method, terminal and storage medium | |
| WO2021129742A1 (en) | Network data recovery method and device, and mobile terminal | |
| CN114553788A (en) | Method, device, computer readable storage medium and processor for traffic classification | |
| WO2023125380A1 (en) | Data management method and corresponding apparatus | |
| CN110198294B (en) | Security attack detection method and device | |
| CN110020290B (en) | Webpage resource caching method and device, storage medium and electronic device | |
| CN113766650B (en) | Internet resource obtaining method and system based on dynamic balance | |
| CN113918323A (en) | High-energy-efficiency computing task allocation method and device in edge computing | |
| WO2012159485A1 (en) | Method and device for reporting and analyzing data | |
| CN113872987A (en) | Malicious attack defense method and device, storage medium and gateway | |
| KR100367654B1 (en) | Billing system and method according to allocating bandwidth and media for storing program source thereof | |
| CN112399209A (en) | Video service identification processing method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |