CN117041073A - Network behavior prediction method, system, equipment and storage medium - Google Patents
Network behavior prediction method, system, equipment and storage medium Download PDFInfo
- Publication number
- CN117041073A CN117041073A CN202311139277.8A CN202311139277A CN117041073A CN 117041073 A CN117041073 A CN 117041073A CN 202311139277 A CN202311139277 A CN 202311139277A CN 117041073 A CN117041073 A CN 117041073A
- Authority
- CN
- China
- Prior art keywords
- prediction
- sequence
- network behavior
- behavior
- historical
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 57
- 238000012549 training Methods 0.000 claims abstract description 43
- 238000010276 construction Methods 0.000 claims abstract description 14
- 238000004458 analytical method Methods 0.000 claims abstract description 13
- 230000006399 behavior Effects 0.000 claims description 235
- 238000004364 calculation method Methods 0.000 claims description 4
- 238000007781 pre-processing Methods 0.000 claims description 4
- 238000012216 screening Methods 0.000 claims description 4
- 230000008569 process Effects 0.000 description 18
- 238000010586 diagram Methods 0.000 description 11
- 230000008901 benefit Effects 0.000 description 6
- 238000004590 computer program Methods 0.000 description 6
- 230000000694 effects Effects 0.000 description 6
- 238000012545 processing Methods 0.000 description 5
- 230000009471 action Effects 0.000 description 4
- 238000004891 communication Methods 0.000 description 4
- 230000006870 function Effects 0.000 description 3
- 238000004519 manufacturing process Methods 0.000 description 3
- 239000000203 mixture Substances 0.000 description 3
- 230000004075 alteration Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000002159 abnormal effect Effects 0.000 description 1
- 238000007792 addition Methods 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 238000000354 decomposition reaction Methods 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 230000003203 everyday effect Effects 0.000 description 1
- 238000003780 insertion Methods 0.000 description 1
- 230000037431 insertion Effects 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000005215 recombination Methods 0.000 description 1
- 230000006798 recombination Effects 0.000 description 1
- 238000005070 sampling Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
- 230000000007 visual effect Effects 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/147—Network analysis or design for predicting network behaviour
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0876—Network utilisation, e.g. volume of load or congestion level
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/04—Protocols for data compression, e.g. ROHC
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Environmental & Geological Engineering (AREA)
- Computer Security & Cryptography (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The embodiment discloses a network behavior prediction method, a system, equipment and a storage medium. Wherein the method comprises the following steps: acquiring a historical network behavior sequence in historical flow data of historical network equipment; carrying out subsequence construction on the historical network behavior sequence to obtain a historical network behavior subsequence; the historical network behavior subsequence is used as a training sample to be input into an initial behavior prediction model for model training, so that a trained behavior prediction model is obtained; and based on the trained behavior prediction model, carrying out network behavior analysis and network behavior prediction on the target network equipment to be predicted. The method can split a large amount of flow sequence data, compress the split sequence data into the branch tree model, finally obtain the prediction result of the flow sequence data, save the storage space of the model and the resources consumed by the operation time, and reduce the training time consumption and the training complexity of the model.
Description
Technical Field
The disclosure relates to the technical field of network security, and in particular relates to a network behavior prediction method, a system, equipment and a storage medium.
Background
In everyday network activities, especially in private networks, the network behavior of network devices is one of the most common network activity behaviors, thereby generating a large amount of network traffic within the private network. The network equipment in the private network, especially the network equipment needing to pay attention to and monitor, can predict the next possible network behavior, has important significance for network security operation and maintenance analysis, and can perform related data analysis tasks such as abnormal network behavior analysis and the like. The network behavior of the network device may be obtained through the traffic data. The network behavior of a network device can form a network behavior sequence, and the problem of predicting the sequence can be converted into a state sequence prediction problem.
In the related art, prediction is performed according to historical data of a carrier based on a Markov chain model; or after inputting the data to be predicted into a plurality of different models, calculating a plurality of uncertain parameters and weights by using the models, and finally weighting the models, wherein the model structure of the related technology is complex, the models are more, the model training time is long, the data quantity to be calculated is more and complex, the sequence length of the network equipment behavior is longer, the sequence with different lengths is simultaneously provided, and the state space is larger, so that the resources such as the consumed storage space, the operation time and the like are more.
Disclosure of Invention
In view of this, the embodiments of the present disclosure provide a network behavior prediction method, system, device, and storage medium, which can extract a historical network behavior sequence of a network behavior for historical traffic data of a network behavior of a network device, and then perform model construction and training to generate a trained behavior prediction model based on a branch tree structure, and predict next state data of traffic sequence data of a target network device to be predicted by using a specific branch structure and a statistical-based prediction method. Therefore, a large amount of flow sequence data are split, the split sequence data are compressed into a branch tree model, and finally, a prediction result of the flow sequence data is obtained, the storage space of the model and the resources consumed by operation time are saved, and the training time consumption and the training complexity of the model are reduced.
In a first aspect, an embodiment of the present disclosure provides a network behavior prediction method, which adopts the following technical scheme:
acquiring a historical network behavior sequence in historical flow data of historical network equipment;
performing subsequence construction on the historical network behavior sequence to obtain a historical network behavior subsequence;
Inputting the historical network behavior subsequence as a training sample into an initial behavior prediction model for model training to obtain a trained behavior prediction model;
and based on the trained behavior prediction model, carrying out network behavior analysis and network behavior prediction on the target network equipment to be predicted.
In some embodiments, obtaining a historical network behavior sequence in historical traffic data of a historical network device includes:
classifying the historical flow data of the historical network equipment to obtain classified data of each class;
and carrying out data preprocessing on the classified data of each category to obtain a plurality of historical network behavior sequences.
In some embodiments, constructing the subsequence of the historical network behavior sequence to obtain a historical network behavior subsequence includes:
when the total length of the historical network behavior sequence is smaller than a preset length threshold value, fixedly setting subsequence characteristics of the historical network behavior subsequence when the sliding window is moved each time;
randomly setting subsequence characteristics of the historical network behavior subsequence when the sliding window is moved each time when the total length of the historical network behavior sequence is greater than or equal to a preset length threshold;
Moving the sliding window according to the fixed or randomly arranged subsequence characteristics to construct a plurality of historical network behavior subsequences;
wherein the subsequence features include a sliding window size and a subsequence length of the historical network behavior subsequence.
In some embodiments, inputting the historical network behavior subsequence as a training sample into an initial behavior prediction model for model training to obtain a trained behavior prediction model, including:
creating a root node of a branch tree structure of the initial behavior prediction model;
sequentially adding each element of the first historical network behavior subsequence to the branch tree structure from the root node to generate a plurality of leaf nodes;
inserting each element of a first historical network behavior sub-sequence into the branch tree structure and generating an inverted index table and a sequence lookup table;
obtaining a prediction result output by the initial behavior prediction model;
when the similarity between the prediction result and the historical prediction result of the historical network equipment is greater than or equal to a preset similarity threshold, determining that the initial behavior prediction model is successfully trained, and obtaining the trained behavior prediction model;
And when the similarity between the predicted result and the historical predicted result of the historical network equipment is smaller than a set similarity threshold, continuing model training by adjusting parameters of the initial behavior prediction model until the trained behavior prediction model is obtained.
In some embodiments, starting from the root node, adding each element of a first one of the historical network behavior subsequences to the branch tree structure in turn, generating a plurality of leaf nodes, comprising:
inserting a first element of a first one of the historical network behavior sub-sequences as a first child node of the branch tree structure under the root node;
inserting a second element of the first historical network behavior sub-sequence as a second sub-node of the branch tree structure under the first sub-node until all elements of the first historical network behavior sub-sequence are added;
when the first element of the second historical network behavior sub-sequence is not a sub-node of the root node, adding the first element of the second historical network behavior sub-sequence as a new sub-node under the root node;
And when the first element of the second historical network behavior sub-sequence is a sub-node of the root node, continuing to judge whether the second element of the second historical network behavior sub-sequence is added under the root node or not until each element of each historical network behavior sub-sequence is added into the branch tree structure as a leaf node.
In some embodiments, based on the trained behavior prediction model, performing network behavior analysis and network behavior prediction on the target network device to be predicted, including:
acquiring each target to-be-predicted sequence in the to-be-predicted data set of the target network equipment to be predicted;
searching a similar sequence corresponding to each target sequence to be predicted based on the inverted index table and the sequence lookup table;
taking a sequence after a similar element which is the same as the last element of the target sequence to be predicted and appears for the first time in each similar sequence as a subsequent sequence;
taking the remaining elements of each subsequent sequence after removing the elements identical to the target sequence to be predicted as candidate prediction elements to obtain a candidate prediction data set containing a plurality of candidate prediction elements;
And screening out the candidate prediction elements with higher prediction scores as target prediction results based on the prediction scores of a plurality of candidate prediction elements in the candidate prediction data set.
In some embodiments, based on the prediction scores of a plurality of candidate prediction elements in the candidate prediction data set, screening out the candidate prediction elements with higher prediction scores as target prediction results, and adopting the following calculation formula:
wherein S is i A prediction score for the i-th candidate prediction element; p (P) i The total number of times the i candidate predicted element appears before the last element of the target to-be-predicted sequence in all similar sequences; q (Q) i The total number of occurrences of the i-th candidate prediction element in all similar sequences; j (j) im In the M-th similar sequence of the M similar sequences, the i-th candidate prediction element appears in the j-th sequence of the subsequent sequences of the target to-be-predicted sequence im A plurality of positions;
selecting the candidate prediction element with higher prediction score as a target prediction result;
when the prediction scores of at least two candidate prediction elements with higher prediction scores are the same, respectively calculating the total number of times of occurrence of at least two candidate prediction elements with higher prediction scores in all similar sequences and the total number of times of occurrence of the candidate prediction elements in all subsequences constructing the trained behavior prediction model, so as to obtain the confidence coefficient of each candidate prediction element with higher prediction score:
And selecting the candidate prediction element with higher confidence as a target prediction result.
In a second aspect, an embodiment of the present disclosure further provides a network behavior prediction apparatus, which adopts the following technical scheme:
an acquisition unit configured to acquire a historical network behavior sequence in historical traffic data of a historical network device;
the subsequence construction unit is configured to perform subsequence construction on the historical network behavior sequence to obtain a historical network behavior subsequence;
the input unit is configured to input the historical network behavior subsequence as a training sample into an initial behavior prediction model for model training so as to obtain a trained behavior prediction model;
and the prediction unit is configured to perform network behavior analysis and network behavior prediction on the target network equipment to be predicted based on the trained behavior prediction model.
In a third aspect, an embodiment of the present disclosure further provides an electronic device, which adopts the following technical scheme:
the electronic device includes:
at least one processor; the method comprises the steps of,
a memory communicatively coupled to the at least one processor; wherein,
the memory stores instructions executable by the at least one processor to enable the at least one processor to perform any one of the network behavior prediction methods described above.
In a fourth aspect, the disclosed embodiments also provide a computer-readable storage medium storing computer instructions for causing a computer to perform any one of the above network behavior prediction methods.
According to the network behavior prediction method provided by the embodiment of the disclosure, after a historical network behavior sequence of network behavior is extracted aiming at historical flow data of network behavior of network equipment, model construction and training are carried out to generate a trained behavior prediction model based on a branch tree structure, and the next state data of flow sequence data of target network equipment to be predicted is predicted by utilizing a special branch structure and a statistical-based prediction method. Therefore, a large amount of flow sequence data are split, the split sequence data are compressed into a branch tree model, and finally, a prediction result of the flow sequence data is obtained, the storage space of the model and the resources consumed by operation time are saved, and the training time consumption and the training complexity of the model are reduced.
The foregoing description is only an overview of the disclosed technology, and may be implemented in accordance with the disclosure of the present disclosure, so that the above-mentioned and other objects, features and advantages of the present disclosure can be more clearly understood, and the following detailed description of the preferred embodiments is given with reference to the accompanying drawings.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings that are needed in the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present disclosure, and other drawings may be obtained according to these drawings without inventive effort to a person of ordinary skill in the art.
Fig. 1 is a flow chart of a network behavior prediction method according to an embodiment of the present disclosure;
fig. 2 is a schematic link diagram of a branch tree structure and a terminal node thereof according to an embodiment of the present disclosure;
fig. 3 is a schematic structural diagram of a network behavior prediction apparatus according to an embodiment of the present disclosure;
fig. 4 is a schematic structural diagram of an electronic device according to an embodiment of the disclosure.
Detailed Description
Embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.
It should be appreciated that the following specific embodiments of the disclosure are described in order to provide a better understanding of the present disclosure, and that other advantages and effects will be apparent to those skilled in the art from the present disclosure. It will be apparent that the described embodiments are merely some, but not all embodiments of the present disclosure. The disclosure may be embodied or practiced in other different specific embodiments, and details within the subject specification may be modified or changed from various points of view and applications without departing from the spirit of the disclosure. It should be noted that the following embodiments and features in the embodiments may be combined with each other without conflict. All other embodiments, which can be made by one of ordinary skill in the art without inventive effort, based on the embodiments in this disclosure are intended to be within the scope of this disclosure.
It is noted that various aspects of the embodiments are described below within the scope of the following claims. It should be apparent that the aspects described herein may be embodied in a wide variety of forms and that any specific structure and/or function described herein is merely illustrative. Based on the present disclosure, one skilled in the art will appreciate that one aspect described herein may be implemented independently of any other aspect, and that two or more of these aspects may be combined in various ways. For example, an apparatus may be implemented and/or a method practiced using any number of the aspects set forth herein. In addition, such apparatus may be implemented and/or such methods practiced using other structure and/or functionality in addition to one or more of the aspects set forth herein.
It should also be noted that the illustrations provided in the following embodiments merely illustrate the basic concepts of the disclosure by way of illustration, and only the components related to the disclosure are shown in the drawings and are not drawn according to the number, shape and size of the components in actual implementation, and the form, number and proportion of the components in actual implementation may be arbitrarily changed, and the layout of the components may be more complicated.
In addition, in the following description, specific details are provided in order to provide a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects may be practiced without these specific details.
Fig. 1 is a flow chart of a network behavior prediction method provided by an embodiment of the present disclosure, where the network behavior prediction method provided by the embodiment of the present disclosure includes the following steps:
s101, acquiring a historical network behavior sequence in historical flow data of historical network equipment.
The history network device may be a history private network device, and likewise, the target network device described in the following embodiments may be a target private network device.
S102, performing subsequence construction on the historical network behavior sequence to obtain a historical network behavior subsequence.
S103, inputting the historical network behavior subsequence as a training sample into an initial behavior prediction model for model training to obtain a trained behavior prediction model.
S104, based on the trained behavior prediction model, carrying out network behavior analysis and network behavior prediction on the target network equipment to be predicted.
In some embodiments, obtaining a historical network behavior sequence in historical traffic data of a historical network device includes:
Classifying the historical flow data of the historical network equipment to obtain classified data of each class;
and carrying out data preprocessing on the classified data of each category to obtain a plurality of historical network behavior sequences.
For example, the historical traffic data may be traffic session data of asset information of the historical private network device, the type of the historical traffic data may be application type of the traffic session data, for example, application software such as SSH, rdp, mysql is adopted, different application software is represented by category type variable, application a represents SSH, application B represents rdp, and the like, and finally, the network behavior sequences a, B, C, a, and the like are obtained by arranging (i.e., preprocessing data) according to the occurrence time sequence of the traffic session data.
In some embodiments, the sub-sequence constructing the historical network behavior sequence to obtain a historical network behavior sub-sequence includes:
when the total length of the historical network behavior sequence is smaller than a preset length threshold value, fixedly setting subsequence characteristics of the historical network behavior subsequence when the sliding window is moved each time;
when the total length of the historical network behavior sequence is larger than or equal to a preset length threshold value, randomly setting subsequence characteristics of the historical network behavior subsequence when the sliding window is moved each time;
Moving a sliding window according to the fixed or randomly arranged subsequence characteristics to construct a plurality of historical network behavior subsequences;
wherein the subsequence features include a sliding window size and a subsequence length of the historical network behavior subsequence.
Optionally, a plurality of historical network behavior subsequences are constructed from the historical network behavior sequences arranged according to the time sequence in a sliding window mode, and the subsequence characteristics of the historical network behavior subsequences comprise a subsequence minimum length Lmin, a subsequence maximum length Lmax and a sliding window size W.
In the actual application process, the user can reasonably select the subsequence characteristics of the subsequence of the sliding window structure according to the actual data size, the computer hardware condition or the evaluation experience of the technician, and the embodiment of the disclosure is not limited to this.
Optionally, in order to increase the randomness degree of the historical network behavior sub-sequence, in the process of constructing the historical network behavior sub-sequence by utilizing the sliding window, the sub-sequence characteristics of the historical network behavior sub-sequence constructed each time the sliding window is moved, namely the sliding window size Wi of the ith historical network behavior sub-sequence and the sub-sequence length Li of the historical network behavior sub-sequence, wherein the sub-sequence length Li is greater than or equal to the minimum sub-sequence length Lmin and smaller than the maximum sub-sequence length Lmax, can be set through a programming language.
For example, when the total length of the historical network behavior sequence is smaller than a preset length threshold (the preset length threshold may take a value of 128), then the subsequence length of the historical network behavior subsequence is fixedly set to 16 each time the sliding window is moved, and the sliding window size is fixedly set to 1, and the subsequence is constructed so as to ensure that enough subsequence samples are used for modeling and prediction in the process of constructing the historical network behavior subsequence.
For another example, when the total length of the historical network behavior sequence is greater than or equal to the preset length threshold 128, the construction of the historical network behavior sub-sequence with random length may be performed three times before each moving the sliding window: randomly acquiring a subsequence length between 8 and 16 for the first time to construct a historical network behavior subsequence; randomly acquiring a subsequence length between 16 and 24 for the second time to construct a historical network behavior subsequence; and thirdly, acquiring a subsequence length between 24 and 32 to construct a historical network behavior subsequence, and carrying out next moving sliding window after constructing the historical network behavior subsequence for three times. In other words, three random historical network behavior subsequences with the length are obtained as training data every time the sliding window is moved, so that training data can be effectively enriched, and higher prediction accuracy can be obtained according to the constructed richer random samples during prediction.
In some embodiments, inputting the historical network behavior subsequence as a training sample into an initial behavior prediction model for model training to obtain a trained behavior prediction model, comprising:
creating a root node of a branch tree structure of an initial behavior prediction model;
starting from a root node, sequentially adding each element of a first historical network behavior sub-sequence into a branch tree structure to generate a plurality of leaf nodes;
inserting each element of the first historical network behavior subsequence into the branch tree structure and generating an inverted index table and a sequence lookup table;
obtaining a prediction result output by an initial behavior prediction model;
when the similarity between the predicted result and the historical predicted result of the historical network equipment is greater than or equal to a preset similarity threshold, determining that the initial behavior prediction model is successfully trained, and obtaining a trained behavior prediction model;
and when the similarity between the predicted result and the historical predicted result of the historical network equipment is smaller than a set similarity threshold, continuing model training by adjusting the parameters of the initial behavior prediction model until a trained behavior prediction model is obtained.
Optionally, the similarity threshold is used to evaluate the similarity capability of the predicted result and the historical predicted result of the historical network device, and the user may set the similarity threshold according to the actual service requirement, which is not limited in the embodiment of the disclosure.
Optionally, with the insertion of each historical network behavior sub-sequence, the branch tree structure will generate a plurality of leaf nodes, each leaf node containing the following three data elements: element data item, representing the actual data item stored in the leaf node, i.e. an element data item in a historical network behavior sub-sequence; a child node list representing a list of all child nodes of the leaf node; a parent node link, representing a link to the parent node of the leaf node. In constructing an initial behavior prediction model based on a branch tree structure, all historical network behavior sub-sequences are compressed into a branch tree form, and one historical network behavior sub-sequence can be expressed as a complete branch or a partial branch from a first sub-node of a root node in the branch tree structure.
In some embodiments, starting from the root node, adding each element of the first historical network behavior subsequence to the branch tree structure in turn, generating a plurality of leaf nodes, comprising:
inserting a first element of a first historical network behavior sub-sequence as a first sub-node of a branch tree structure under a root node;
Inserting a second element of the first historical network behavior sub-sequence as a second sub-node of the branch tree structure under the first sub-node until all elements of the first historical network behavior sub-sequence are added;
when the first element of the second historical network behavior sub-sequence is not a sub-node of the root node, adding the first element of the second historical network behavior sub-sequence as a new sub-node under the root node;
when the first element of the second historical network behavior sub-sequence is a sub-node of the root node, continuing to judge whether the second element of the second historical network behavior sub-sequence is added under the root node or not until each element of each historical network behavior sub-sequence is added into the branch tree structure as a leaf node.
Optionally, a root node of the branch tree structure is created, the root node having no data element entries, no parent node links, and a list of child nodes that are currently empty. For example, the sample dataset contains 5 historical network behavior subsequences: subsequence 1 (a, B, C); subsequence 2 (a, B, D); subsequence 3 (a, B, E); subsequence 4 (B, C, F); subsequence 5 (B, C, A, B). When inserting the sub-sequence 1 into the branch tree structure, firstly judging whether the first element A of the sub-sequence 1 is a sub-node of the root node, if not, adding the first element A of the sub-sequence 1 into a sub-list of the root node, adding an entry with the element A into an inverted index table containing the sub-sequence 1, and then moving the current node to the node A. Judging whether the second element B of the sub-sequence 1 is a child node of the current node (namely node A), if not, adding the second element B of the sub-sequence 1 into a sub-list of the node A, adding an entry with the element B into an inverted index table containing the sub-sequence 1, and then moving the current node to the node B; the above steps are repeated until the last element C of sub-sequence 1 is added to the sub-list of node B and an entry with element C is added to the inverted index table containing sub-sequence 1. Finally, the last node C of the sub-sequence 1 is added to the sequence lookup table, resulting in the sequence lookup table = { 'sequence 1': node C }. Then subsequence 2 (a, B, D), subsequence 3 (a, B, E), subsequence 4 (B, C, F) and subsequence 5 (B, C, a, B) are inserted into the branching tree structure in sequence.
Fig. 2 is a schematic link diagram of a branch tree structure and its terminal nodes according to an embodiment of the present disclosure, and an inverted index table shown in fig. 2 is generated based on the schematic link diagram shown in fig. 2. The inverted index table is to find out faster and more conveniently which sub-sequences an element appears in for a given element. Thus, during the prediction process, the inverted index table may be used to find all sub-sequences containing a set of elements, where the key of the inverted index table is an element (i.e., a data item) that appears in all sub-sequences, each column corresponds to all sub-sequences in the training sample, the data item and the column corresponding value is represented by a binary 0 or 1, and if the data item of the row appears in one sub-sequence, its value is set to 1, and if the data item of the row does not appear in one sub-sequence, its value is set to 0. If there are N non-repeated sub-sequences in the training dataset, there are N columns in the inverted index table, one for each sub-sequence.
Table one, reverse index table
| Data item | Subsequence 1 | Subsequence 2 | Subsequence 3 | Subsequence 4 | Subsequence 5 |
| A | 1 | 1 | 1 | 0 | 1 |
| B | 1 | 1 | 1 | 1 | 1 |
| C | 1 | 0 | 0 | 1 | 1 |
| D | 0 | 1 | 0 | 0 | 0 |
| E | 0 | 0 | 1 | 0 | 0 |
| F | 0 | 0 | 0 | 1 | 0 |
Alternatively, in addition to the tabular form shown in Table one, in the actual encoding process, the data structure of the inverted index table may be implemented by selecting a dictionary data structure common in programming languages, where the dictionary's key is an element of a subsequence in the training dataset and the value is a collection of sequences in which the element occurs. The inverted index table may be expressed in dictionary form as:
Inverted index table = {
'A': { 'subsequence 1', 'subsequence 2', 'subsequence 3', 'subsequence 5',
'B': { 'subsequence 1', 'subsequence 2', 'subsequence 3', 'subsequence 4', 'subsequence 5',
'C': { 'subsequence 1', 'subsequence 4', 'subsequence 5',
'D': { 'subsequence 2',
'E': { 'subsequence 3',
'F': { 'subsequence 4' }
}。
Based on the link diagram shown in fig. 2, it can be known that the terminal node of the sub-sequence 1 is the node C, the terminal node of the sub-sequence 2 is the node D, the terminal node of the sub-sequence 3 is the node E, the terminal node of the sub-sequence 4 is the node F, and the terminal node of the sub-sequence 5 is the node B, and the generated sequence lookup table = { 'sub-sequence 1': node C, 'sub-sequence 2': node D, 'sub-sequence 3': node E, 'sub-sequence 4': node F, 'sub-sequence 5': node B }. According to the sequence lookup table, the value of the sub-sequence 1 is node C, the node C stores its parent node (node B) and node B stores its parent node (node A) through the branch tree structure, and finally the behavior time sequences of the sub-sequence 1 are obtained as A, B and C.
In some embodiments, performing network behavior analysis and network behavior prediction on a target network device to be predicted based on a trained behavior prediction model, includes:
Acquiring each target to-be-predicted sequence in a to-be-predicted data set of target network equipment to be predicted;
searching a similar sequence corresponding to each target sequence to be predicted based on the inverted index table and the sequence lookup table;
taking a sequence after a similar element which appears for the first time in each similar sequence and is the same as the last element of the target sequence to be predicted as a subsequent sequence;
taking the remaining elements of each subsequent sequence after removing the elements identical to the target sequence to be predicted as candidate prediction elements to obtain a candidate prediction data set containing a plurality of candidate prediction elements;
and screening out candidate prediction elements with higher prediction scores as target prediction results based on the prediction scores of a plurality of candidate prediction elements in the candidate prediction data set.
The disclosed embodiments predict each sequence to be predicted in a test dataset or other target network device to be predicted in a dataset to be predicted: predictions are made of the next likely network behavior of a sequence. Searching a similar sequence corresponding to each target sequence to be predicted by using an inverted index table, wherein the similar sequence comprises; if the total sequence length S of the sequence to be predicted is greater than or equal to the maximum length Lmax of the constructed subsequence, taking the last Lmax elements of the sequence to be predicted as a target sequence to be predicted; and if the total sequence length S is smaller than the minimum length Lmax of the constructed subsequence, taking the complete sequence to be predicted as a target sequence to be predicted.
Optionally, searching all unique elements in the target sequence to be predicted based on the inverted index table, namely, de-duplicating the elements of the target sequence to be predicted. For example, the target sequence to be predicted is [ ' A ', ' B ', ' C ', ' A ', ] and all unique elements after deduplication are [ ' A ', ' B ', ' C ', '. Searching a subsequence ID set with a specific unique element, and searching all subsequences containing three elements of 'A', 'B' and 'C' and IDs thereof in an inverted index table. Since the sequence of the elements is not recorded in the inverted index table, the IDs of the similar sequences including all the elements of the target sequence to be predicted are found out through the inverted index table. And according to the ID of the similar sequence, finding corresponding subsequence data in the constructed branch tree structure through the constructed sequence lookup table, and taking the subsequence data as a final similar sequence.
Optionally, a sequence after the first appearance of the similar element identical to the last element of the target to-be-predicted sequence in each similar sequence is used as a subsequent sequence, for example, the target to-be-predicted sequence= [ 'a', 'B', 'C' ], wherein one similar sequence= [ 'X', 'a', 'Y', 'B', 'C', 'E', 'a', 'F' ], the last element (i.e. the terminal data item) of the target to-be-predicted sequence is C, the subsequent sequence of the similar sequence after the first appearance of the element C identical to the last element of the target to-be-predicted sequence in the similar sequence is [ 'E', 'a', 'F' ], and the obtained remaining elements 'E' and 'F' are candidate predicted elements at the node a in the subsequent sequence repeated with the target to-be-predicted sequence.
In some embodiments, based on the prediction scores of a plurality of candidate prediction elements in the candidate prediction data set, candidate prediction elements with higher prediction scores are screened out as target prediction results, and the following calculation formula is adopted:
wherein S is i A prediction score for the i-th candidate prediction element; p (P) i The total number of times the i candidate predicted element appears before the last element of the target to-be-predicted sequence in all similar sequences; q (Q) i The total number of occurrences of the i-th candidate prediction element in all similar sequences; j (j) im In the M-th similar sequence of the M similar sequences, the i-th candidate prediction element appears in the j-th sequence of the subsequent sequences of the target to-be-predicted sequence im A plurality of positions;
selecting a candidate prediction element with higher prediction score as a target prediction result;
when the prediction scores of the at least two candidate prediction elements with higher prediction scores are the same, respectively calculating the total number of occurrences of the at least two candidate prediction elements with higher prediction scores in all similar sequences and the total number of occurrences of the candidate prediction elements in all subsequences constructing the trained behavior prediction model, and obtaining the confidence of each candidate prediction element with higher prediction scores:
And selecting the candidate prediction element with higher confidence as a target prediction result.
For example, the target sequence to be predicted= [ 'a', 'B', 'C']One of the similar sequences = [ 'X', 'a', 'Y', 'B', 'C', 'E', 'a', 'F', 'E']The candidate prediction element is E, the terminal data item (last element) of the target sequence to be predicted is C, in the current similar sequence, the element E appears at the 1 st position behind the terminal data item C, then j is present im The value of (2) is 1; if in another similar sequence = [ ' X ', ' a ', ' Y ', ' B ', ' C ', ' F, ' a ', ' E ', ' F '.]Because element E is at the 3 rd position after terminal data item C, then j is now im The value of (2) is 3. And, if the candidate prediction element is relatively closer to the last element of the target sequence, the prediction score of the candidate prediction element is relatively higher.
Alternatively, the confidence coefficient is calculated by the formulaWherein C is i Confidence for the i-th candidate prediction element; q (Q) i The total number of occurrences of the i-th candidate prediction element in all similar sequences; t (T) i The total number of occurrences of the i-th candidate prediction element in all sub-sequences constructing the trained behavior prediction model. In general, the prediction score S is selected i The highest candidate prediction element is used as the final target prediction result. If there is a predictive score S i The same candidate predicted element is then determined by comparing the confidence level C of the candidate predicted element i And selecting the candidate prediction element with larger confidence as the final target prediction result.
According to the embodiment of the disclosure, the subsequence is constructed and a branch tree model is trained through the historical network behavior sequence in the collected historical flow data of the historical network equipment, and network behavior analysis and network behavior prediction are carried out on target network equipment to be predicted, which needs to be predicted. In the process of processing the historical network behavior sequence of the network asset, the historical network behavior sequence is subjected to subsequence construction, a sliding window mode is used for constructing a plurality of historical network behavior subsequences, relevant parameters of the historical network behavior subsequences comprise a subsequence minimum length Lmin, a subsequence maximum length Lmax and a sliding window size W, and the parameters can be flexibly adjusted according to actual data conditions. In addition, in the process of constructing the subsequence, a specific random sampling and constructing mode is used for enriching the subsequence data, creating more training data and improving the prediction accuracy of a final model.
In the process of training the branch tree model, the embodiment of the disclosure constructs the branch tree structure, and the structure can effectively compress training data and reduce the storage space occupied by the data. The inverted index table is constructed in the process of training the branch tree model, so that each historical network behavior sequence can be conveniently inquired which unique elements are contained in the inverted index table, and the required similar sequences can be conveniently searched in the subsequent prediction process. In the process of training the branch tree model, the embodiment of the disclosure points the subsequence of the training sample to the last element of the subsequence in a pointer manner to obtain a sequence lookup table. In the subsequent prediction process, the position of the screened original sequence in the branch tree structure can be found through a sequence lookup table, so that the original sequence data and the ordering mode can be retrieved.
In the prediction process of the branch tree model of the embodiment of the disclosure, the prediction score of the candidate prediction element is calculated, and the calculation formula of the prediction score considers the occurrence times of the candidate prediction element, the relative position distance from the last element of the target sequence to be predicted and the occurrence frequency in the overall similar sequence. The candidate prediction element with the highest prediction score is usually selected as the target prediction result of the target sequence to be predicted. And, the confidence level of the candidate prediction element can be calculated, and the candidate prediction element with higher confidence level is selected as the final target prediction result.
Fig. 3 is a schematic structural diagram of a network behavior prediction apparatus provided by an embodiment of the present disclosure, where the embodiment of the present disclosure further provides a network behavior prediction apparatus, including:
an obtaining unit 31 configured to obtain a historical network behavior sequence in the historical traffic data of the historical network device;
a subsequence construction unit 32 configured to perform subsequence construction on the historical network behavior sequence to obtain a historical network behavior subsequence;
an input unit 33 configured to input the historical network behavior subsequence as a training sample to an initial behavior prediction model for model training to obtain a trained behavior prediction model;
and a prediction unit 34 configured to perform network behavior analysis and network behavior prediction on the target network device to be predicted based on the trained behavior prediction model.
An electronic device according to an embodiment of the present disclosure includes a memory and a processor. The memory is for storing non-transitory computer readable instructions. In particular, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and/or non-volatile memory. The volatile memory may include, for example, random Access Memory (RAM) and/or cache memory (cache), and the like. The non-volatile memory may include, for example, read Only Memory (ROM), hard disk, flash memory, and the like.
The processor may be a Central Processing Unit (CPU) or other form of processing unit having data processing and/or instruction execution capabilities, and may control other components in the electronic device to perform the desired functions. In one embodiment of the present disclosure, the processor is configured to execute the computer readable instructions stored in the memory, to cause the electronic device to perform all or part of the steps of the network behavior prediction method of the embodiments of the present disclosure described above.
It should be understood by those skilled in the art that, in order to solve the technical problem of how to obtain a good user experience effect, the present embodiment may also include well-known structures such as a communication bus, an interface, and the like, and these well-known structures are also included in the protection scope of the present disclosure.
Fig. 4 is a schematic structural diagram of an electronic device according to an embodiment of the disclosure. A schematic diagram of an electronic device suitable for use in implementing embodiments of the present disclosure is shown. The electronic device shown in fig. 4 is merely an example and should not be construed to limit the functionality and scope of use of the disclosed embodiments.
As shown in fig. 4, the electronic device may include a processor (e.g., a central processing unit, a graphic processor, etc.) that may perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM) or a program loaded from a storage device into a Random Access Memory (RAM). In the RAM, various programs and data required for the operation of the electronic device are also stored. The processor, ROM and RAM are connected to each other by a bus. An input/output (I/O) interface is also connected to the bus.
In general, the following devices may be connected to the I/O interface: input means including, for example, sensors or visual information gathering devices; output devices including, for example, display screens and the like; storage devices including, for example, magnetic tape, hard disk, etc.; a communication device. The communication means may allow the electronic device to communicate wirelessly or by wire with other devices, such as edge computing devices, to exchange data. While fig. 4 shows an electronic device having various means, it is to be understood that not all of the illustrated means are required to be implemented or provided. More or fewer devices may be implemented or provided instead.
In particular, according to embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a non-transitory computer readable medium, the computer program comprising program code for performing the method shown in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from ROM. All or part of the steps of the network behavior prediction method of the embodiments of the present disclosure are performed when the computer program is executed by a processor.
The detailed description of the present embodiment may refer to the corresponding description in the foregoing embodiments, and will not be repeated herein.
A computer-readable storage medium according to an embodiment of the present disclosure has stored thereon non-transitory computer-readable instructions. When executed by a processor, perform all or part of the steps of the network behavior prediction method of the embodiments of the present disclosure described above.
The computer-readable storage medium described above includes, but is not limited to: optical storage media (e.g., CD-ROM and DVD), magneto-optical storage media (e.g., MO), magnetic storage media (e.g., magnetic tape or removable hard disk), media with built-in rewritable non-volatile memory (e.g., memory card), and media with built-in ROM (e.g., ROM cartridge).
The detailed description of the present embodiment may refer to the corresponding description in the foregoing embodiments, and will not be repeated herein.
The basic principles of the present disclosure have been described above in connection with specific embodiments, however, it should be noted that the advantages, benefits, effects, etc. mentioned in the present disclosure are merely examples and not limiting, and these advantages, benefits, effects, etc. are not to be considered as necessarily possessed by the various embodiments of the present disclosure. Furthermore, the specific details disclosed herein are for purposes of illustration and understanding only, and are not intended to be limiting, since the disclosure is not necessarily limited to practice with the specific details described.
In this disclosure, relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions, and the block diagrams of devices, apparatuses, devices, systems involved in this disclosure are merely illustrative examples and are not intended to require or implicate that connections, arrangements, configurations must be made in the manner shown in the block diagrams. As will be appreciated by one of skill in the art, the devices, apparatuses, devices, systems may be connected, arranged, configured in any manner. Words such as "including," "comprising," "having," and the like are words of openness and mean "including but not limited to," and are used interchangeably therewith. The terms "or" and "as used herein refer to and are used interchangeably with the term" and/or "unless the context clearly indicates otherwise. The term "such as" as used herein refers to, and is used interchangeably with, the phrase "such as, but not limited to.
In addition, as used herein, the use of "or" in the recitation of items beginning with "at least one" indicates a separate recitation, such that recitation of "at least one of A, B or C" for example means a or B or C, or AB or AC or BC, or ABC (i.e., a and B and C). Furthermore, the term "exemplary" does not mean that the described example is preferred or better than other examples.
It is also noted that in the systems and methods of the present disclosure, components or steps may be disassembled and/or assembled. Such decomposition and/or recombination should be considered equivalent to the present disclosure.
Various changes, substitutions, and alterations are possible to the techniques herein without departing from the teachings as defined by the appended claims. Furthermore, the scope of the claims of the present disclosure is not limited to the particular aspects of the process, machine, manufacture, composition of matter, means, methods and acts described above. The processes, machines, manufacture, compositions of matter, means, methods, or acts, presently existing or later to be developed that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein may be utilized. Accordingly, the appended claims are intended to include within their scope such processes, machines, manufacture, compositions of matter, means, methods, or acts.
The previous description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other aspects without departing from the scope of the disclosure. Thus, the present disclosure is not intended to be limited to the aspects shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
The foregoing description has been presented for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of the disclosure to the form disclosed herein. Although a number of example aspects and embodiments have been discussed above, a person of ordinary skill in the art will recognize certain variations, modifications, alterations, additions, and subcombinations thereof.
Claims (10)
1. A method for predicting network behavior, comprising:
acquiring a historical network behavior sequence in historical flow data of historical network equipment;
performing subsequence construction on the historical network behavior sequence to obtain a historical network behavior subsequence;
inputting the historical network behavior subsequence as a training sample into an initial behavior prediction model for model training to obtain a trained behavior prediction model;
and based on the trained behavior prediction model, carrying out network behavior analysis and network behavior prediction on the target network equipment to be predicted.
2. The network behavior prediction method according to claim 1, wherein acquiring a historical network behavior sequence in historical traffic data of a historical network device comprises:
classifying the historical flow data of the historical network equipment to obtain classified data of each class;
And carrying out data preprocessing on the classified data of each category to obtain a plurality of historical network behavior sequences.
3. The network behavior prediction method according to claim 1 or 2, wherein the step of constructing the subsequence of the historical network behavior sequence to obtain the historical network behavior subsequence comprises:
when the total length of the historical network behavior sequence is smaller than a preset length threshold value, fixedly setting subsequence characteristics of the historical network behavior subsequence when the sliding window is moved each time;
randomly setting subsequence characteristics of the historical network behavior subsequence when the sliding window is moved each time when the total length of the historical network behavior sequence is greater than or equal to a preset length threshold;
moving the sliding window according to the fixed or randomly arranged subsequence characteristics to construct a plurality of historical network behavior subsequences;
wherein the subsequence features include a sliding window size and a subsequence length of the historical network behavior subsequence.
4. A network behavior prediction method according to claim 3, wherein inputting the historical network behavior subsequence as a training sample into an initial behavior prediction model for model training to obtain a trained behavior prediction model comprises:
Creating a root node of a branch tree structure of the initial behavior prediction model;
sequentially adding each element of the first historical network behavior subsequence to the branch tree structure from the root node to generate a plurality of leaf nodes;
inserting each element of a first historical network behavior sub-sequence into the branch tree structure and generating an inverted index table and a sequence lookup table;
obtaining a prediction result output by the initial behavior prediction model;
when the similarity between the prediction result and the historical prediction result of the historical network equipment is greater than or equal to a preset similarity threshold, determining that the initial behavior prediction model is successfully trained, and obtaining the trained behavior prediction model;
and when the similarity between the predicted result and the historical predicted result of the historical network equipment is smaller than a set similarity threshold, continuing model training by adjusting parameters of the initial behavior prediction model until the trained behavior prediction model is obtained.
5. The network behavior prediction method of claim 4, wherein sequentially adding each element of a first of the historical network behavior sub-sequences to the branch tree structure from the root node generates a plurality of leaf nodes, comprising:
Inserting a first element of a first one of the historical network behavior sub-sequences as a first child node of the branch tree structure under the root node;
inserting a second element of the first historical network behavior sub-sequence as a second sub-node of the branch tree structure under the first sub-node until all elements of the first historical network behavior sub-sequence are added;
when the first element of the second historical network behavior sub-sequence is not a sub-node of the root node, adding the first element of the second historical network behavior sub-sequence as a new sub-node under the root node;
and when the first element of the second historical network behavior sub-sequence is a sub-node of the root node, continuing to judge whether the second element of the second historical network behavior sub-sequence is added under the root node or not until each element of each historical network behavior sub-sequence is added into the branch tree structure as a leaf node.
6. The network behavior prediction method according to claim 4, wherein performing network behavior analysis and network behavior prediction on the target network device to be predicted based on the trained behavior prediction model comprises:
Acquiring each target to-be-predicted sequence in the to-be-predicted data set of the target network equipment to be predicted;
searching a similar sequence corresponding to each target sequence to be predicted based on the inverted index table and the sequence lookup table;
taking a sequence after a similar element which is the same as the last element of the target sequence to be predicted and appears for the first time in each similar sequence as a subsequent sequence;
taking the remaining elements of each subsequent sequence after removing the elements identical to the target sequence to be predicted as candidate prediction elements to obtain a candidate prediction data set containing a plurality of candidate prediction elements;
and screening out the candidate prediction elements with higher prediction scores as target prediction results based on the prediction scores of a plurality of candidate prediction elements in the candidate prediction data set.
7. The network behavior prediction method according to claim 6, wherein the candidate prediction elements with higher prediction scores are screened out as target prediction results based on the prediction scores of a plurality of candidate prediction elements in the candidate prediction data set, and the following calculation formula is adopted:
wherein the method comprises the steps of，S i A prediction score for the i-th candidate prediction element; p (P) i The total number of times the i candidate predicted element appears before the last element of the target to-be-predicted sequence in all similar sequences; q (Q) i The total number of occurrences of the i-th candidate prediction element in all similar sequences; j (j) im In the M-th similar sequence of the M similar sequences, the i-th candidate prediction element appears in the j-th sequence of the subsequent sequences of the target to-be-predicted sequence im A plurality of positions;
selecting the candidate prediction element with higher prediction score as a target prediction result;
when the prediction scores of at least two candidate prediction elements with higher prediction scores are the same, respectively calculating the total number of times of occurrence of at least two candidate prediction elements with higher prediction scores in all similar sequences and the total number of times of occurrence of the candidate prediction elements in all subsequences constructing the trained behavior prediction model, so as to obtain the confidence coefficient of each candidate prediction element with higher prediction score:
and selecting the candidate prediction element with higher confidence as a target prediction result.
8. A network behavior prediction apparatus, comprising:
an acquisition unit configured to acquire a historical network behavior sequence in historical traffic data of a historical network device;
The subsequence construction unit is configured to perform subsequence construction on the historical network behavior sequence to obtain a historical network behavior subsequence;
the input unit is configured to input the historical network behavior subsequence as a training sample into an initial behavior prediction model for model training so as to obtain a trained behavior prediction model;
and the prediction unit is configured to perform network behavior analysis and network behavior prediction on the target network equipment to be predicted based on the trained behavior prediction model.
9. An electronic device, the electronic device comprising:
at least one processor; the method comprises the steps of,
a memory communicatively coupled to the at least one processor; wherein,
the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the network behavior prediction method of any one of claims 1 to 7.
10. A computer-readable storage medium storing computer instructions for causing a computer to perform the network behavior prediction method of any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311139277.8A CN117041073B (en) | 2023-09-05 | 2023-09-05 | Network behavior prediction method, system, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311139277.8A CN117041073B (en) | 2023-09-05 | 2023-09-05 | Network behavior prediction method, system, equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN117041073A true CN117041073A (en) | 2023-11-10 |
| CN117041073B CN117041073B (en) | 2024-05-28 |
Family
ID=88635456
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311139277.8A Active CN117041073B (en) | 2023-09-05 | 2023-09-05 | Network behavior prediction method, system, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117041073B (en) |
Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109146131A (en) * | 2018-07-11 | 2019-01-04 | 国网河北省电力有限公司 | A kind of wind-power electricity generation prediction technique a few days ago |
| CN111130839A (en) * | 2019-11-04 | 2020-05-08 | 清华大学 | Flow demand matrix prediction method and system |
| CN111405327A (en) * | 2020-04-03 | 2020-07-10 | 广州市百果园信息技术有限公司 | Network bandwidth prediction model training method, video data playing method and device |
| CN112702342A (en) * | 2020-12-22 | 2021-04-23 | 北京天融信网络安全技术有限公司 | Network event processing method and device, electronic equipment and readable storage medium |
| US20220190940A1 (en) * | 2020-12-10 | 2022-06-16 | Verizon Patent And Licensing Inc. | Systems and methods for optimizing a network based on weather events |
| US20220200870A1 (en) * | 2019-09-12 | 2022-06-23 | Huawei Technologies Co., Ltd. | Inter-terminal connection state prediction method and apparatus and analysis device |
| US20220210026A1 (en) * | 2019-09-17 | 2022-06-30 | Huawei Technologies Co., Ltd. | Network Parameter Configuration Method and Apparatus, Computer Device, and Storage Medium |
| CN115022210A (en) * | 2022-07-26 | 2022-09-06 | 中国银行股份有限公司 | Construction method, prediction method and device of network traffic prediction model |
| WO2022257743A1 (en) * | 2021-06-11 | 2022-12-15 | 中兴通讯股份有限公司 | Flow suppression prediction method, electronic device and storage medium |
| WO2023029853A1 (en) * | 2021-09-02 | 2023-03-09 | 中兴通讯股份有限公司 | Model training method, data processing method, electronic device, and computer-readable storage medium |
| CN116582449A (en) * | 2023-05-26 | 2023-08-11 | 中国联合网络通信集团有限公司 | Network performance prediction model training method, device, equipment and storage medium |
-
2023
- 2023-09-05 CN CN202311139277.8A patent/CN117041073B/en active Active
Patent Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109146131A (en) * | 2018-07-11 | 2019-01-04 | 国网河北省电力有限公司 | A kind of wind-power electricity generation prediction technique a few days ago |
| US20220200870A1 (en) * | 2019-09-12 | 2022-06-23 | Huawei Technologies Co., Ltd. | Inter-terminal connection state prediction method and apparatus and analysis device |
| US20220210026A1 (en) * | 2019-09-17 | 2022-06-30 | Huawei Technologies Co., Ltd. | Network Parameter Configuration Method and Apparatus, Computer Device, and Storage Medium |
| CN111130839A (en) * | 2019-11-04 | 2020-05-08 | 清华大学 | Flow demand matrix prediction method and system |
| CN111405327A (en) * | 2020-04-03 | 2020-07-10 | 广州市百果园信息技术有限公司 | Network bandwidth prediction model training method, video data playing method and device |
| US20220190940A1 (en) * | 2020-12-10 | 2022-06-16 | Verizon Patent And Licensing Inc. | Systems and methods for optimizing a network based on weather events |
| CN112702342A (en) * | 2020-12-22 | 2021-04-23 | 北京天融信网络安全技术有限公司 | Network event processing method and device, electronic equipment and readable storage medium |
| WO2022257743A1 (en) * | 2021-06-11 | 2022-12-15 | 中兴通讯股份有限公司 | Flow suppression prediction method, electronic device and storage medium |
| WO2023029853A1 (en) * | 2021-09-02 | 2023-03-09 | 中兴通讯股份有限公司 | Model training method, data processing method, electronic device, and computer-readable storage medium |
| CN115022210A (en) * | 2022-07-26 | 2022-09-06 | 中国银行股份有限公司 | Construction method, prediction method and device of network traffic prediction model |
| CN116582449A (en) * | 2023-05-26 | 2023-08-11 | 中国联合网络通信集团有限公司 | Network performance prediction model training method, device, equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN117041073B (en) | 2024-05-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10878004B2 (en) | Keyword extraction method, apparatus and server | |
| CN108320171B (en) | Hot-sold commodity prediction method, system and device | |
| CN113302634B (en) | System, medium, and method for learning and predicting key phrases and generating predictions | |
| US11568300B2 (en) | Apparatus and method for managing machine learning with plurality of learning algorithms and plurality of training dataset sizes | |
| CN109242013B (en) | Data labeling method and device, electronic equipment and storage medium | |
| CN108491226B (en) | Spark configuration parameter automatic tuning method based on cluster scaling | |
| JP2022024102A (en) | Method for training search model, method for searching target object and device therefor | |
| CN109165040B (en) | Code plagiarism suspicion detection method based on random forest model | |
| CN110706015A (en) | Advertisement click rate prediction oriented feature selection method | |
| CN110968802B (en) | Analysis method and analysis device for user characteristics and readable storage medium | |
| Bezáková et al. | Graph model selection using maximum likelihood | |
| CN110968664A (en) | Document retrieval method, device, equipment and medium | |
| CN110310012B (en) | Data analysis method, device, equipment and computer readable storage medium | |
| CN114219562A (en) | Model training method, enterprise credit evaluation method and device, equipment and medium | |
| CN103324641A (en) | Information record recommendation method and device | |
| Mazzolini et al. | Heaps' law, statistics of shared components, and temporal patterns from a sample-space-reducing process | |
| CN109460474B (en) | User preference trend mining method | |
| CN117041073B (en) | Network behavior prediction method, system, equipment and storage medium | |
| CN116976491A (en) | Information prediction method, device, equipment, storage medium and program product | |
| JP2005222445A (en) | Information processing method and analysis device in data mining | |
| CN116760723B (en) | Data prediction method, device, equipment and medium based on prediction tree model | |
| CN115099344A (en) | Model training method and device, user portrait generation method and device, and equipment | |
| CN111538898B (en) | Web service package recommendation method and system based on combined feature extraction | |
| CN111339287B (en) | Abstract generation method and device | |
| CN113627513A (en) | Training data generation method and system, electronic device and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant |