WO2020140419A1 - Procédé et système de calcul et d'analyse d'incrément de trafic de réseau - Google Patents

Procédé et système de calcul et d'analyse d'incrément de trafic de réseau Download PDF

Info

Publication number
WO2020140419A1
WO2020140419A1 PCT/CN2019/096637 CN2019096637W WO2020140419A1 WO 2020140419 A1 WO2020140419 A1 WO 2020140419A1 CN 2019096637 W CN2019096637 W CN 2019096637W WO 2020140419 A1 WO2020140419 A1 WO 2020140419A1
Authority
WO
WIPO (PCT)
Prior art keywords
network traffic
real
virtual network
time
core data
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/096637
Other languages
English (en)
Chinese (zh)
Inventor
匡立伟
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Fiberhome Telecommunication Technologies Co Ltd
Original Assignee
Fiberhome Telecommunication Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Fiberhome Telecommunication Technologies Co Ltd filed Critical Fiberhome Telecommunication Technologies Co Ltd
Publication of WO2020140419A1 publication Critical patent/WO2020140419A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines

Definitions

  • the present invention relates to the field of communication technology, and in particular to network traffic incremental statistics and analysis methods and systems.
  • Network function virtualization technology refers to the virtualization of assembled hardware resources, and the creation of a series of virtual machine VMs (Virtual Machine) by constructing three types of virtual resource pools: computing, storage, and network.
  • VMs Virtual Machine
  • Computing virtualization technology includes two types of full virtualization and paravirtualization, in which full virtualization technology Full Virtualization completely realizes the cooperation of the guest operating system and server hardware through the created virtual machine: the protected computer instructions pass the virtual machine management program Hypervisor captures and processes, and the operating system shares and shares the underlying server hardware through Hypervisor.
  • Para-virtualization technology Para-Virtualization uses the hypervisor Hypervisor to share access to the underlying hardware, but its guest operating system integrates software code for virtualization. There is no need to recompile or trigger traps. Virtual processes are very well coordinated and cooperative. Based on these two virtualization technologies, virtual machines can be dynamically generated or withdrawn based on network expansion and contraction requirements.
  • the virtual network function VNF (Virtualized Network) is a software package that runs on the virtual machine VM and interacts with MANO (Manager and Orchestration) to achieve network flow control and forwarding.
  • the MANO platform implements the description of virtual network functions, virtual deployment units, virtual connections, and network connection points based on the TOSCA (Topology and Orchestration Specification for Cloud Application) template, and builds a network service NS (Network Service) based on the multidirectional forwarding graph FG (Forwarding Graph) ).
  • Multi-directional forwarding diagram covers VNF, PNF (Physical Network Function), VL (Virtual Link), CP (Connection Point), supports the description of the virtual network function forwarding path, supports the description of the virtual network function forwarding point, and realizes the virtual network function
  • the mapping of nodes to TOSCA template nodes and the decomposition to virtual deployment units realize the mapping of VDU (Virtual Deployment Unit) to VM.
  • the orchestrated network service is verified and handed over to the virtual network function manager for analysis, and it is handed over to the VIM to allocate resources according to the description of resources and capabilities in the description file.
  • Incremental processing technology formalizes and represents network traffic according to the time dimension, divides the data into a series of data fragments to better study the context of the virtual network traffic data fragments, and analyzes the data in the time dimension with the help of a series of models Changes in technology.
  • For the newly added virtual network traffic data it analyzes the relationship between the incremental data and the historical data by projecting it onto the historical traffic data, and uses the incremental data for feature projection on each dimension of the high-dimensional space for modeling. Because the virtual network traffic data has a strong Markov property and the current incremental network traffic data is weakly correlated with historical data, it can directly infer on the incremental data and provide services for network function virtualization applications.
  • the virtual network function is an important part of the new generation network.
  • the real-time collection and analysis of the network traffic in the virtual network function can help to achieve more intelligent deployment, coordination and scheduling.
  • the dynamic change characteristics of network traffic in the time dimension there is currently no effective method for analysis.
  • real-time collection and incremental storage of network traffic in a network function virtualization environment can be realized.
  • the statistics and analysis of network traffic in the network can make the deployment, coordination and scheduling of virtual network functions more intelligent.
  • the object of the present invention is to provide network traffic incremental statistics and analysis methods and systems, which can realize the real-time collection and incremental storage of network traffic in a network function virtualization environment to construct a high-dimensional space and Transfer the spatial model, and make statistics or analysis through the incremental method.
  • an embodiment of the present invention provides a network traffic incremental statistics method, which includes the following steps:
  • the data packets are provided with multiple feature items, and the feature items include time;
  • the real-time core data set is saved in real time along the time dimension in the high-dimensional space to obtain a high-quality core data set.
  • the network model is a TCP/IP four-layer reference model, and the data packets are collected from an application layer, a transport layer, a network layer, and a network interface layer.
  • the data packet collected from the application layer includes structured data, semi-structured data, and unstructured data.
  • the characteristic items further include: source MAC address, target MAC address, source IP address, destination IP address, source port, target port, virtual network function identifier, and virtual network traffic data content.
  • VNF Virtualized Network Function
  • VM Virtual Machine
  • HOSVD High-Order Singular Value Decomposition
  • an embodiment of the present invention also provides a network traffic incremental analysis method based on the statistical method described in the first aspect. After obtaining a high-quality core data aggregate, the method further includes:
  • the virtual network traffic state of each real-time core data set in the high-quality core data set Based on the virtual network traffic state of each real-time core data set in the high-quality core data set, the virtual network traffic state and probability of the real-time core data set at the next moment are analyzed.
  • an embodiment of the present invention also provides an analysis method based on the second aspect, which is characterized in that:
  • NFVC is the set of virtual network traffic states of the real-time core data set at the current moment
  • NFVP is the set of virtual network traffic states of the real-time core data set at the previous moment
  • NFVN is the set of virtual network traffic states of the real-time core data set at the next moment
  • the corresponding P of each ANx is the value of the points representing the ACx, APx and each ANx in the three-dimensional transfer space, and expressed in the three-dimensional transfer space, Get the three-dimensional predicted transition space.
  • the virtual network traffic state is at least one interval of the high-dimensional space.
  • the virtual network traffic state is a value/option interval of more than one characteristic item of the real-time core data set.
  • the feature item further includes a hardware usage parameter
  • the hardware usage parameter includes CPU utilization rate, memory usage percentage
  • the virtual network traffic state represented by the real-time core data set is the current hardware location status.
  • the CPU usage rate of 10% or less is defined as State 1
  • the CPU usage rate of 11% to 20% is defined as State 2
  • the CPU usage rate of 91% or more is defined as 10 so that the CPU usage state space is ⁇ 1,2,3,4,5,6,7,8,9,10 ⁇ .
  • the available memory data can be segmented.
  • the available memory below 10G is defined as state 1
  • the available memory from 11G to 20G is defined as state 2, and so on.
  • the state space is also limited. Assuming that the state corresponding to the upper limit of available memory in the data center is N, the state space set is ⁇ 1,2,3,4,5,6,... ,N ⁇ .
  • the three-dimensional prediction transition space is used as a three-dimensional transition space, and further probabilities of all possible virtual network traffic states after the subsequent addition of the real-time core data set are predicted, and expressed in the network transition space, obtained Three-dimensional prediction transition probability space.
  • an embodiment of the present invention also provides a network traffic incremental statistics system, which includes:
  • the collection module is used to obtain and save data packets at various levels of the virtualized network model in real time, and the data packets are provided with multiple feature items, and the feature items include time;
  • a calculation module configured to store the data packet in a high-dimensional space in a way that one feature item corresponds to one dimension, and expand along a preset module to obtain a high-order matrix
  • An extraction module used to remove duplicate and erroneous data in the high-order matrix, and restore to a high-dimensional space to obtain a real-time core data set;
  • the storage module is used to store the real-time core data collection in real time along the time dimension in the high-dimensional space in chronological order to obtain a high-quality core data aggregate.
  • the network model is a TCP/IP four-layer reference model, and the data packets are collected from an application layer, a transport layer, a network layer, and a network interface layer.
  • the data packet collected from the application layer includes structured data, semi-structured data, and unstructured data.
  • the characteristic items further include: source MAC address, target MAC address, source IP address, destination IP address, source port, target port, virtual network function identifier, and virtual network traffic data content.
  • VNF Virtualized Network Function
  • VM Virtual Machine
  • HOSVD High-Order Singular Values Decomposition, high-order singular value decomposition
  • an embodiment of the present invention further provides a network traffic incremental analysis system based on the statistical system according to the fourth aspect, which includes:
  • Corresponding module used to set the correspondence between feature items and virtual network traffic status
  • the sampling module is used to obtain the virtual network traffic status of the real-time core data collection at the current time and the previous time;
  • the analysis module is configured to analyze the virtual network traffic state and probability of the real-time core data set at the next moment according to the virtual network traffic state of each real-time core data set in the high-quality core data set.
  • an embodiment of the present invention further provides an analysis system based on the fifth aspect, which is characterized in that:
  • NFVC represents the virtual network traffic state of the real-time core data set at the current moment
  • NFVP represents the virtual network traffic state of the real-time core data set at the previous moment
  • NFVN represents the virtual network traffic status of the real-time core data collection at the next moment
  • the setting module is used to set the virtual network traffic state of the real-time core data set at the current moment to A Cx , the virtual network traffic state of the real-time core data set at the previous moment to A Px , and the virtual network of the real-time core data set at the next moment
  • the flow state is A Nx ;
  • the statistics module is used to count the probability P of the virtual network traffic state changing from A Px to ACx and finally to various A Nx in the three-dimensional transfer space;
  • the prediction module is used to use the A Cx , A Px and each A Nx as the coordinate value of the three-dimensional transfer space, and the corresponding P of each A Nx is A Cx , A Px and each A Nx represent points in the three-dimensional transfer space Value and expressed in the three-dimensional transition space to obtain a three-dimensional predicted transition space.
  • the virtual network traffic state is at least one interval of the high-dimensional space.
  • the virtual network traffic state is a value/option interval of more than one characteristic item of the real-time core data set.
  • the feature item further includes a hardware usage parameter
  • the hardware usage parameter includes CPU utilization rate, memory usage percentage
  • the virtual network traffic state represented by the real-time core data set is the current hardware location status.
  • the three-dimensional predicted transition space is characterized by using the three-dimensional predicted transition space as a three-dimensional transition space, and further predicting the probability of all possible virtual network traffic states after the subsequent addition of real-time core data sets, and indicating the transition in the network Within the space, a three-dimensional predicted transition probability space is obtained.
  • the network traffic incremental statistical method and system of the present invention first obtain data packets at various levels of the network model of the current virtualized network. Since the network model may have multiple architectures, the levels are also different. If only Setting a specific number of levels for setting may result in incomplete data or redundant data, resulting in statistics and analysis no longer accurate. Further, after obtaining the data package of each score of the network model of the current virtualized network, multiple feature items are set for the data package, and stored in a high-dimensional space according to a feature item corresponding to one dimension, which is relatively lacking in implementation The conversion of real sense data information to the spatial volume with actual dimension. After the conversion is completed, the space is further expanded to obtain matrix-mode data.
  • the present invention saves the data packets in chronological order. Since the present invention focuses on the statistics and analysis of network traffic, it is mainly aimed at the increase of network traffic, that is, the change in network traffic over time. Therefore, the entire collection of high-quality core data that saves data in chronological order is expanded in chronological order, which facilitates subsequent sorting and analysis according to time parameters.
  • the method and system for incremental analysis of network traffic of the present invention first classifies the feature items of the data packets, that is, sets the correspondence between the feature items and the virtual network traffic status, such as setting a certain network port flow rate 0-10M/s as " Low speed state, 10-20M/s is the “medium speed” state, 20-100M/s is the "high speed” state.
  • the current state is used for analysis, and there will be no different analysis schemes for data that has not changed substantially. For example, 1.01M/s and 1.02M/s are processed according to the low-speed state.
  • the classification can be more detailed until the requirements are met, while saving computing resources.
  • Figure 1 is a flow chart of steps of an embodiment
  • FIG. 2 is a schematic structural diagram of data collection in the embodiment
  • FIG. 3 is a schematic diagram of converting network data into high-dimensional spatial data according to an embodiment
  • FIG. 4 is a schematic diagram of an embodiment to save the real-time core data set in real time along the time dimension in a high-dimensional space to obtain a high-quality core data total set;
  • FIG. 7 is a schematic diagram of establishing a three-dimensional transfer space in an embodiment
  • Embodiments of the present invention provide a network traffic incremental statistics and analysis method and system, which can realize real-time network traffic collection and incremental storage in a network function virtualization environment, construct a high-dimensional space and transition space model, and Quantitative methods for analysis.
  • an embodiment of the present invention provides a network traffic incremental statistics method, which includes:
  • S1 Real-time acquisition and storage of data packets at various levels of the virtualized network model.
  • the data packets are provided with multiple feature items, and the feature items include time.
  • the present invention first takes the network model of the virtualized network as the extraction object.
  • the transmission of the network is inseparable from its network model.
  • the computer network refers to a collection of many autonomously working computers connected by communication lines, and each What kind of rules are used to communicate between components is the problem of network model research.
  • the network model generally refers to the OSI seven-layer reference model and the TCP/IP four-layer reference model. The establishment and changes of network traffic are inseparable from the network model, so collecting data packets according to the hierarchy of the network model in the virtualized network is very comprehensive and not lost.
  • the network traffic model contains three elements: One is the node that characterizes the system components. The second is the arrow line (sometimes the edge) that reflects the relationship between the constituent elements. The third is the flow of traffic in the network. On the one hand, it reflects the quantitative relationship between the elements, and it also determines the goal and direction of the network model optimization. When performing statistical analysis on the network traffic increment in the present invention, these three elements in the network model are also indispensable. Therefore, collecting data packets for the network model can obtain more comprehensive types of data.
  • the virtualized network model is the traditional TCP/IP four-layer reference model, and the data packets are collected from the application layer, transport layer, network layer, and network interface layer.
  • the data packets collected from the application layer include structured data, semi-structured data, and unstructured data.
  • the structured data is stored in a cloud platform or distributed computing environment, and stored in a database or file according to actual application requirements.
  • For semi-structured data and unstructured data It is expressed in the form of a file in a cloud platform or distributed computing environment, and the key retrieval information is extracted and analyzed for subsequent rapid and flexible retrieval.
  • the invention provides an incremental analyzer, which distributes the incrementally collected network traffic data packets to each corresponding storage space, merges with historical network data packets, and simultaneously updates various types of data retrieval and key data.
  • VNF Virtualized Network
  • VM Virtual Machine
  • VNF Virtualized Network
  • MANO Manager and Orchestration
  • the MANO platform implements the description of virtual network functions, virtual deployment units, virtual connections, and network connection points based on the TOSCA (Topology and Orchestration Specification for Cloud Application) template, and builds a network service NS (Network Service) based on the multidirectional forwarding graph FG (Forwarding Graph) ).
  • Multi-directional forwarding diagram covers VNF, PNF (Physical Network Function), VL (Virtual Link), CP (Connection Point), supports the description of the virtual network function forwarding path, supports the description of the virtual network function forwarding point, and realizes the virtual network function
  • VNF Physical Network Function
  • VL Virtual Link
  • CP Connection Point
  • the mapping of nodes to TOSCA template nodes and the decomposition to virtual deployment units realize the mapping of VDU (Virtual Deployment Unit) to VM. Therefore, VNF can collect and upload data packets very well.
  • an acquisition manager used to issue collection instructions and parameters.
  • the VNF collects data in real time according to the parameters. Its storage system stores the virtual network traffic data uploaded by the VNF, and the incremental analyzer synthesizes and stores the new and historical data.
  • the data packet is stored in a high-dimensional space according to a feature item corresponding to a dimension, and expanded along a preset modulus to obtain a high-order matrix.
  • data packets with feature items tend to be abstract data, and direct analysis only processes the data through some algorithms. This processing is abstract and may lack actual basis.
  • the present invention models the data, that is, the data package is stored in a high-dimensional space according to a feature item corresponding to a dimension, so that the data package is no longer just a series of stacked data, but each coordinate in the high-dimensional space , Interval. After completing the modeling of the transformation of the data packet into the high-dimensional space, in order to be able to process it further, the high-dimensional space is expanded through a preset module to obtain a high-order matrix.
  • a data packet with N feature items is represented in a high-dimensional space in ASCII form.
  • the defined N-dimensional space model is Where I 1 , I 2 , I 3 , ..., IN represent the first to N-th order of the N-dimensional space.
  • the N-dimensional space is expanded along the Pth order, and the resulting P-module matrix is defined as The number of rows of the P-modular matrix is I P and the number of columns is (IP+1IP+2...I1I2...IP-1) .
  • the module expansion matrix obtained by expanding the high-dimensional space along a specific module can be used in the network traffic subsequent processing algorithm, such as classification, trend prediction, clustering algorithm, etc.
  • a 9-dimensional space is defined as
  • the 9 orders of the 9-dimensional space are represented as I TIM , I SM , I DM , I SI , I DI , I SP , I DP , I VI , I CN represent time Time, source MAC address SrcMAC, destination MAC address DstMAC, Source IP address SrcIP, destination IP address DstIP, source port SrcPort, destination port DstPort, virtual network function identifier VNFID, virtual network traffic content Cnt.
  • the number of rows of the modulo 3 expansion matrix obtained by expanding this 9-dimensional space along the third order is I 3 , and the number of columns is I 4 I 5 I 6 I 7 I 8 I 9 I 1 I 2 .
  • step 2 of Figure 3 during the sampling process, duplicate and erroneous data are unavoidable, so there are inconsistent, duplicate, and redundant data in the current high-order matrix, which may adversely affect the analysis work It may even lead to analysis errors. Therefore, it is necessary to remove the duplicates and erroneous data in the high-order matrix before it can be restored to the high-dimensional space to obtain the real-time core data set. Further data analysis and mining on the core collection in the high-dimensional space is more accurate than processing and analyzing directly on the original data set.
  • the repeated inconsistent data of the high-order matrix can be removed through various technical solutions known to those skilled in the art.
  • HOSVD High-Order Singular Value Decomposition
  • the high-order singularity Value decomposition technology can remove duplicate, redundant, and inconsistent low-quality data to obtain high-quality core data sets.
  • Kalman filtering and regression methods can eliminate noisy data and uncertain data, and realize spatio-temporal data cleaning. Based on probability statistical methods, deleting abnormal data or redundant data with a certain degree of confidence can ensure that the effectiveness of the processing results will not be affected. Fuzzy matching technology calculates the approximate degree of data by designing similarity function, so as to realize the cleaning of repeated redundant data.
  • the real-time core data set is saved in real time along the time dimension in the high-dimensional space to obtain a high-quality core data total set.
  • the real-time core data sets need to be stored one by one for analysis and used as a whole.
  • the virtual network traffic data has a strong Markov property, that is, the connection in the time dimension is large. Therefore, the real-time core data set is saved in the high-dimensional space corresponding to the time dimension, and a high-quality core data set is obtained.
  • the total set of high-quality core data saved in this way can continuously update the left singular vector space by expanding the optimal basis vector of the matrix and incrementally using the newly added virtual network traffic data, projecting the newly added non-zero elements to each truncation In the unit orthogonal basis space, to achieve incremental network traffic quality data extraction and analysis.
  • an embodiment of the present invention provides a network traffic incremental analysis method, which is based on the network traffic statistics method of the embodiment. After completing the statistics method of Embodiment 1, the following steps are performed:
  • A1 Set the correspondence between feature items and virtual network traffic status.
  • the characteristic items of the data packet can be multiple options or a series of continuous values, and the option values in the network traffic of the virtual network may have many options. If the unique data of each single characteristic item is analyzed , Will require huge amounts of computing resources. However, the actual analysis may not require such high accuracy, which in turn causes a waste of resources and an increase in costs.
  • the virtual network traffic state is at least one interval of the high-dimensional space. That is, certain intervals of some feature items in the high-dimensional space are combined to form a virtual network traffic state, and other intervals of the same partial feature items are combined to form another virtual network traffic state, and finally divided into multiple virtual network traffic states. Some feature items.
  • the setting feature item of the present invention corresponds to the virtual network traffic state, setting a certain network port traffic 0-10M/s as “low speed” state, 10-20M/s as “medium speed” state, 20-100M/s as “high speed” "status.
  • the data of 5.01M/s and 5.02M/s are all low-speed states for subsequent analysis, and only three state quantities need to be processed during analysis, which is very convenient and fast. 5.01M/s and 5.02M/s are calculated as different data in detail, which does not have much impact on the fuzzy analysis. If the above status classification does not meet the requirements, further detailed classification can be performed until the analysis requirements are met. This correspondence improves the efficiency of analysis and the cost of calculation.
  • the above example corresponds to the state of a single feature item. If the state distinction of multiple feature items in a high-dimensional space is involved, the traditional detailed analysis of all data may be difficult to achieve, and the present invention can be further subdivided Other characteristic item states, such as the flow characteristic item and the port characteristic item, the corresponding state can be: the flow of port A and port B is 0-10M/s, which is the "low speed” state, and 10-20M/s is the “medium speed” "State, 20-100M/s is the "high speed” state, A port traffic is 0-10M/s, B port traffic is 10-20M/s is "low and medium speed” state, and so on. In this way, the state correspondence ensures a more intuitive connection between different feature items.
  • the change of state means the change of multiple feature items.
  • the analysis of the state actually achieves the analysis of multiple feature items.
  • multiple feature items are counted as a state and are linked together.
  • the analysis result can represent the actual representation of the current virtual network traffic status.
  • each hardware in the virtual network is expressed as a feature item and corresponds to different
  • the hardware load and calculation loss of the virtual network represented by each state can be roughly changed to understand the hardware status of the virtual network, which is more efficient, low cost, and very intuitive.
  • it can also be network traffic, interface switching, error reporting, etc. virtual network data.
  • the virtual network traffic status is the value/option interval of more than one characteristic item of the real-time core data set.
  • feature items may also be options, such as ports A, B, C, etc., as long as they are characterized by one dimension in a high-dimensional space.
  • A2 Obtain the virtual network traffic status of the real-time core data collection at the current time and the previous time.
  • Analysis of the total set of real-time core data that is, to summarize the changes in the virtual network before and after, there is a time sequence, so it is necessary to distinguish the line of real-time core data centers.
  • the time interval can be 1s, 3min, 6h It can also be a time specified by other people, and only need to be specifically limited according to the change time interval to be analyzed.
  • A3 According to the virtual network traffic state of each real-time core data set in the high-quality core data set, analyze the virtual network traffic state and probability of the real-time core data set at the next moment.
  • the virtual network traffic status of the real-time core data collection at the current time and the previous time that is, know the initial conditions of the virtual network traffic status, and then need to perform an overall analysis based on each real-time core data collection in the entire high-quality core data collection to obtain
  • the law of state change can be used to determine the state of network traffic at the next moment.
  • the initial condition is that the hardware usage rate in the network traffic of the virtual network is "high”, “medium” and "low”.
  • the initial condition is to directly change from the "high” state to the "low” state.
  • the current network traffic is between 9M/s and 26M/s.
  • the probability of a ternary sequence starting with 10 in the entire state sequence is 2/9, which means that the probability of the ternary sequence (10, x, x) is 2/9.
  • the value of x is 17, 23; the probability of the occurrence of the ternary sequence with 17 as the first in the entire state sequence is 3/9, that is to say the probability of the occurrence of the ternary sequence of (17, x, x) is 3/9, x
  • the values are 10 and 23; the probability of a ternary sequence with 23 as the first in the entire state sequence is 4/9, which means that the probability of (23, x, x) ternary sequence is 4/9, x is taken The values are 10 and 17.
  • This embodiment intercepts the middle segment of this sequence as (10,17,23,10,17,17,10,10,17,23,10,17,23,17,10,23,10,23,10,23,10,23,10,23,23), the above contains 21 element sequences, (10,x,x) there are 8 such ternary sequences, namely (10,17,23), (10,17,17), (10,10 ,17), (10,17,23), (10,17,23), (10,23,10), (10,23,10), (10,23,23).
  • the first value 10 in the eight ternary sequences indicates that the state at the previous time is 10
  • the second value indicates the state at the current time
  • the third value indicates the state at the next time.
  • the second value is 10 only the third sequence (10,10,17), which indicates the probability that the state at the previous time is 10, the state at the current time is 10, and the state at the next time is 17.
  • the second value is 17 with four sequences, namely (10,17,23), (10,17,17), (10,17,23), (10,17 , 23), indicating that the state at the previous time is 10, the state at the current time is 17, and the probability that the state at the next time is 17 is 1/4. For the same reason, the probability that the state at the previous moment is 10, the current moment is 17, and the next moment is 23 is 3/4.
  • the state at the previous time is 10, the state at the current time is 23, and the probability of the state at the next time is 23 is 1/3.
  • the statistics of the entire virtual network traffic status sequence can be used to obtain the transition probability.
  • this embodiment assumes that the transition probability is shown in Table 1.
  • the top row of Table 1 shows the three states at the last moment, where 10(2/9) means that the probability of state 10 at the last moment is 2/9, and 17(3/9) means that the probability of state 17 at the last moment is 3/9, 23 (4/9) means that the probability of state 23 appearing at the last moment is 4/9.
  • the sum of the probability values of the three states is 1.
  • Table 1 has 12 columns. The first column, the fifth column, and the ninth column indicate the current status. Table 1 has 5 rows, and the second row indicates the next state.
  • Table 1 row 3, columns 2, 3, and 4, row 4, columns 2, 3, and 4, row 5, columns 2, 3, and 4 have a total of 9 state transition probabilities, indicating that the state at the previous time was 10 , The transition probability of each state value between the current time and the next time.
  • the value in the third row and third column of Table 1 is 1, indicating that the state at the previous time is 10, the current state is 10, and the probability at the next time state is 17 is 1.
  • the value of the column is 3/4, indicating that the state at the previous time is 10, the state at the current time is 17, and the probability that the state at the next time is 23 is 3/4.
  • Table 1 row 3, columns 6, 7, and 8, row 4, columns 6, 7, and 8, row 5, columns 6, 7, and 8 have a total of 9 state transition probabilities, indicating that the state at the previous time was 17 o'clock , The transition probability of each state value between the current time and the next time.
  • the transition probability value Multiply the probability corresponding to the state value at the previous time in the first row of Table 1 by the transition probability value below to calculate the transition probability value in three dimensions, as shown in Table 2.
  • Table 2 the sum of the transition probabilities in the third, fourth, and fifth rows is 1.
  • the transition probability of the third row is 2/9, 1/3, 4/9, and the addition is 1.
  • the traffic state of the virtual network can be predicted: if the network traffic state at the previous moment is 23, and the network traffic state at the current moment is 17, according to Table 4, row 4, columns 10, 11, and 12, you can It is learned that the probability of the network traffic state at the next moment is 17 is 5/36, and the probability of 23 is 15/36. Because the probability is high, the possibility is high, so the next time the network traffic state value is most likely to be 23, that is, the network traffic is between 21M/s and 26M/s. After calculating the network traffic status at the next moment, you can then calculate the network traffic status at the next moment.
  • the network traffic at the next moment is most likely to be 10, that is, the network traffic is at Between 9M/s and 14M/s. Further, the necessary measures should be taken for the possible traffic state at the next moment, and disaster prevention.
  • an embodiment of the present invention provides a network traffic analysis method, which is based on the foregoing network traffic analysis method and includes the following steps:
  • NFVC represents the virtual network traffic status of the real-time core data collection at the current moment
  • NFVP represents the virtual network traffic status of the real-time core data collection at the previous moment
  • NFVN represents The virtual network traffic status of the real-time core data collection at the next moment.
  • NFVC represents the virtual network traffic state of the real-time core data collection at the current moment
  • NFVP represents the virtual network traffic state of the real-time core data collection at the previous moment
  • NFVN represents the next moment Virtual network traffic status of real-time core data collection.
  • the high-dimensional space is still too abstract for people, and if the change of the virtual network traffic state can be expressed in a three-dimensional space, it will be more intuitive, and the low-dimensional data will be easier to analyze.
  • the analysis of the three time-related parameters can more reflect the changes of the real-time core data set with time.
  • the characteristic items further include hardware usage parameters, which include CPU utilization rate and memory occupancy percentage, and the virtual network traffic status represented by the real-time core data set is the current hardware status.
  • B2 Set the virtual network traffic state of the real-time core data collection at the current time to A Cx , the virtual network traffic state of the real-time core data collection at the previous time to A Px , and the virtual network traffic state of the real time core data collection at the next time to A Nx ;
  • the virtual network traffic state of the real-time core data set at the current moment is A Cx
  • the virtual network traffic state of the real-time core data set at the previous moment is A Px
  • the virtual network traffic state of the real-time core data set at the next moment may be represented by A Nx .
  • B3 Calculate the probability P of the virtual network traffic state changing from A Px to A Cx and finally to various A Nx in the three-dimensional transfer space.
  • the virtual network traffic state of all real-time core data sets of the high-quality core data set is represented in it, including the virtual network traffic state A Px and the virtual network traffic state A Cx , which can be counted at this time.
  • a Cx , A Px and each A Nx are used as the coordinate values of the three-dimensional transfer space, and the corresponding P of each A Nx is the value of A Cx , A Px and each A Nx representing points in the three-dimensional transfer space, and It is expressed in the three-dimensional transition space to obtain a three-dimensional predicted transition space.
  • a Nx After obtaining various A Nx , A Cx , A Px and each A Nx can also be expressed in the three-dimensional transfer space, but the point is not a 100% solid point, but the probability of all points is added as a 100% virtual Point, if the shade of color is used to represent the probability of A Cx , A Px and each A Nx in the three-dimensional transition space, then you can see a block/line/at least two points with different shades, which intuitively reflects A The possible probability of Nx , that is, the trend of the virtual network traffic state of the virtual network at the next moment, and after identifying A Cx , A Px, and each A Nx to the three-dimensional transfer space, the three-dimensional space actually contains the predicted space, It is set as the three-dimensional prediction transition space.
  • the probability P of various A Nx is obtained, and the probability P is also taken as the value represented by the midpoint in the high-dimensional space.
  • the three-dimensional predicted transition space is used as a three-dimensional transition space to further predict the probability of all possible virtual network traffic states after the subsequent addition of the real-time core data set, and it is expressed in the network transition space to obtain the three-dimensional predicted transition probability space .
  • the network transfer space also includes a four-dimensional transfer space and a five-dimensional transfer space.
  • the three-dimensional transition space includes a three-dimensional prediction transition space; the data in the three-dimensional transition space is used to predict future traffic trends, and the prediction result is expressed in the three-dimensional space to obtain the three-dimensional prediction transition space.
  • the data in the three-dimensional transfer space is used for statistical analysis of historical flow characteristics, and the statistical results are expressed in the three-dimensional space to obtain the three-dimensional statistical transfer space.
  • the three-dimensional predicted transition space includes a three-dimensional predicted transition probability space. If the three-dimensional prediction transition space is predicted by a probabilistic analysis method, and the prediction result is expressed in three-dimensional space, it is the three-dimensional prediction transition probability space.
  • the three-dimensional prediction transition space can also be predicted by using the logic reasoning method in set theory, and the prediction result is expressed in the three-dimensional space to obtain the three-dimensional prediction transition inference space.
  • an embodiment of the present invention provides a network traffic incremental statistics system, which includes an acquisition module 1, a calculation module 2, an extraction module 3, and a storage module 4:
  • the collection module 1 is used to obtain and save data packets at various levels of the virtualized network model in real time.
  • the data packets are provided with a plurality of feature items, and the feature items include time.
  • the collection module 1 takes the network model of the virtualized network as an extraction object.
  • the establishment and change of network traffic cannot be separated from the network model. Therefore, collecting data packets according to the hierarchy of the network model in the virtualized network is very comprehensive and not lost.
  • the network traffic model contains three elements: one is the node that characterizes the system components. The second is the arrow line (sometimes the edge) that reflects the relationship between the constituent elements. The third is the flow of traffic in the network. On the one hand, it reflects the quantitative relationship between the elements, and it also determines the goal and direction of the network model optimization. Therefore, collecting data packets for the network model can obtain more comprehensive types of data.
  • the virtualized network model is the traditional TCP/IP four-layer reference model, and the data packets are collected from the application layer, transport layer, network layer, and network interface layer.
  • the data packets collected from the application layer include structured data, semi-structured data, and unstructured data.
  • the structured data is stored in a cloud platform or distributed computing environment, and stored in a database or file according to actual application requirements.
  • For semi-structured data and unstructured data It is expressed in the form of a file in a cloud platform or distributed computing environment, and the key retrieval information is extracted and analyzed for subsequent rapid and flexible retrieval.
  • the invention provides an incremental analyzer, which distributes the incrementally collected virtual network flow data packets to each corresponding storage space, merges with historical network data packets, and simultaneously updates various types of data retrieval and key data.
  • the collection module 1 obtains data packets from the virtual network environment through a virtual network function VNF (Virtualized Network Function) running on a virtual machine VM (Virtual Machine).
  • Virtual Network Function VNF Virtualized Network
  • the MANO platform implements the description of virtual network functions, virtual deployment units, virtual connections, and network connection points based on the TOSCA (Topology and Orchestration Specification for Cloud Application) template, and builds a network service NS (Network Service) based on the multidirectional forwarding graph FG (Forwarding Graph) ).
  • Multi-directional forwarding diagram covers VNF, PNF (Physical Network Function), VL (Virtual Link), CP (Connection Point), supports the description of the virtual network function forwarding path, supports the description of the virtual network function forwarding point, and realizes the virtual network function
  • VNF Physical Network Function
  • VL Virtual Link
  • CP Connection Point
  • the mapping of nodes to TOSCA template nodes and the decomposition to virtual deployment units realize the mapping of VDU (Virtual Deployment Unit) to VM. Therefore, VNF can collect and upload data packets very well.
  • the calculation module 2 is configured to store the data packet in a high-dimensional space according to a feature item corresponding to a dimension, and expand along a preset modulus to obtain a high-order matrix.
  • the calculation module 2 models the acquired data, that is, the data package is stored in a high-dimensional space according to a feature item corresponding to a dimension, so that the data package is not just a series of stacked data, but each in the high-dimensional space Coordinates, intervals. After completing the modeling of the transformation of the data packet into the high-dimensional space, in order to be able to process it further, the high-dimensional space is expanded through a preset module to obtain a high-order matrix.
  • the N-dimensional space model is defined as Where I 1 , I 2 , I 3 , ..., IN represent the first to N-th order of the N-dimensional space.
  • the N-dimensional space is expanded along the Pth order, and the resulting P-module matrix is defined as The number of rows of the P-module matrix is I P , and the number of columns is (I P+1 I P+2 ...I 1 I 2 ...I P-1 ).
  • the module expansion matrix obtained by expanding the high-dimensional space along a specific module can be used in the network traffic subsequent processing algorithm, such as classification, trend prediction, clustering algorithm, etc.
  • a 9-dimensional space is defined as
  • the 9 orders of the 9-dimensional space are represented as I TIM , I SM , I DM , I SI , I DI , I SP , I DP , I VI , I CN represent time Time, source MAC address SrcMAC, destination MAC address DstMAC, Source IP address SrcIP, destination IP address DstIP, source port SrcPort, destination port DstPort, virtual network function identifier VNFID, virtual network traffic content Cnt.
  • the modulo 3 expansion matrix obtained by expanding this 9-dimensional space along the third order has I 3 rows and I 4 I 5 I 6 I 7 I 8 I 9 I 1 I 2 .
  • the extraction module 3 is used to remove duplicate and erroneous data in the high-order matrix and restore to a high-dimensional space to obtain a real-time core data set.
  • the extraction module 3 removes the duplicate and erroneous data in the high-order matrix, and then can restore to the high-dimensional space to obtain the real-time core data set. Further data analysis and mining on the core collection in the high-dimensional space is more accurate than processing and analyzing directly on the original data set.
  • the storage module 4 is configured to save the real-time core data set in real time along the time dimension in the high-dimensional space in chronological order to obtain a high-quality core data total set.
  • the real-time core data sets need to be stored one by one for analysis and used as a whole.
  • the virtual network traffic data has a strong Markov property, that is, the connection in the time dimension is large. Therefore, the storage module 4 will obtain the real-time core data collection in the high-dimensional space and save it in the corresponding time dimension to obtain high-quality core data. Total set.
  • the total set of high-quality core data saved in this way can continuously update the left singular vector space by expanding the optimal basis vector of the matrix and incrementally using the newly added virtual network traffic data, projecting the newly added non-zero elements to each truncation In the unit orthogonal basis space, to achieve incremental network traffic quality data extraction and analysis.
  • an embodiment of the present invention provides a network traffic incremental analysis system based on Embodiment 4, which includes a corresponding module 5, a collection module 6, and an analysis module 7:
  • Corresponding module 5 is used to set the correspondence between feature items and virtual network traffic status.
  • Corresponding module 5 can further subdivide the status of other feature items, such as port feature items in addition to traffic feature items.
  • the state correspondence ensures a more intuitive connection between different feature items, and at the same time, the status changes during analysis It means the change of multiple feature items, the analysis of the state actually achieves the analysis of multiple feature items, and the multiple feature items are statistically linked as a state.
  • the results of the analysis can represent the current virtual
  • the actual representation of the network traffic status such as expressing each hardware in the virtual network as a feature item and corresponding to different states, after the analysis is completed, that is, the load and calculation loss of the hardware in the virtual network represented by each state generally change , You can understand the hardware status of the virtual network, more efficient, low cost, and very intuitive.
  • it can also be network traffic, interface switching, error reporting, etc. virtual network data.
  • the virtual network traffic status is the value/option interval of more than one characteristic item of the real-time core data set.
  • feature items may also be options, such as ports A, B, C, etc., as long as they are characterized by one dimension in a high-dimensional space.
  • the sampling module 6 is used to obtain the virtual network traffic status of the real-time core data set at the current time and the previous time.
  • the sampling module 6 first needs to obtain the virtual network traffic state with a large correlation before the predicted time, that is, the virtual network traffic state of the real-time core data set at the current time and the previous time. For use in subsequent steps.
  • the analysis of the real-time core data collection that is, the summary of the changes in the virtual network before and after, exists in time, so it is necessary to distinguish the real-time core data center.
  • the time interval can be 1s, 3min, 6h It can also be a time specified by other people, and only need to be specifically limited according to the change time interval to be analyzed.
  • the analysis module 7 is configured to analyze the virtual network traffic state and its probability of the real-time core data set at the next moment according to the virtual network traffic state of each real-time core data set in the high-quality core data set.
  • the analysis module 7 After acquiring the virtual network traffic status of the real-time core data collection at the current time and the previous time, that is, knowing the initial conditions of the virtual network traffic status, the analysis module 7 performs an overall analysis based on each real-time core data collection in the entire high-quality core data collection, Obtaining the change rule of the state and combining the above initial conditions, the state of the network traffic at the next moment can be obtained.
  • an embodiment of the present invention provides a network traffic incremental analysis system based on Embodiment 5, which includes a creation module 8, a setting module 9, a statistics module 10, and an analysis module 11:
  • NFVC represents the virtual network traffic state of the real-time core data set at the current moment
  • NFVP represents the virtual network traffic of the real-time core data set at the previous moment State
  • NFVN represents the virtual network traffic state of the real-time core data set at the next moment.
  • the creation module 8 uses the virtual network traffic status of the current moment, the previous moment, and the next moment as three dimensions of the three-dimensional space, each of which is related to time and can intuitively represent the virtual network traffic of the virtual network Changes in state. During the analysis, the analysis of the three time-related parameters can better reflect the changes of the real-time core data set with time.
  • the characteristic items further include hardware usage parameters, which include CPU utilization rate and memory occupancy percentage, and the virtual network traffic status represented by the real-time core data set is the current hardware status.
  • the setting module 9 is used to set the virtual network traffic state of the real-time core data set at the current moment to A Cx , the virtual network traffic state of the real-time core data set at the previous moment to A Px , and the virtual state of the real-time core data set at the next moment
  • the network traffic status is A Nx .
  • the setting module 9 When predicting the next virtual network traffic state, the setting module 9 needs to obtain the virtual network traffic state of the real-time core data set at the current moment as A Cx , and the virtual network traffic state of the real-time core data set at the previous moment is A Px . There are many changes in network traffic status, and the virtual network traffic status of the real-time core data set at the next moment may be represented by A Nx .
  • the statistics module 10 is used to count the probability P of the virtual network traffic state changing from A Px to A Cx and finally to various A Nx in the three-dimensional transfer space.
  • the virtual network traffic status of all real-time core data sets of the high-quality core data set is represented in it, which includes the virtual network traffic status A Px and the virtual network traffic status A Cx .
  • the statistics module 10 The type and number of changes of A Nx at the next moment can be counted to obtain the probability P of the final change to various A Nx .
  • the prediction module 11 is configured to use the A Cx , A Px and each A Nx as the coordinate value of the three-dimensional transfer space, and the corresponding P of each A Nx is A Cx , A Px and each A Nx represent points in the three-dimensional transfer space And expressed in the three-dimensional transition space to obtain a three-dimensional predicted transition space.
  • a Nx After obtaining various A Nx , A Cx , A Px and each A Nx can also be expressed in the three-dimensional transfer space, but the point is not a 100% solid point, but the probability of all points is added as a 100% virtual Point, if the shade of color is used to represent the probability of A Cx , A Px and each A Nx in the three-dimensional transition space, then you can see a block/line/at least two points with different shades, which intuitively reflects A The possible probability of Nx , that is, the trend of the virtual network traffic state of the virtual network at the next moment, and after identifying A Cx , A Px, and each A Nx to the three-dimensional transfer space, the three-dimensional space actually contains the predicted space, It is set as the three-dimensional prediction transition space.
  • the probability P of various A Nx is obtained, and the probability P is also taken as the value represented by the midpoint in the high-dimensional space.
  • the network traffic incremental analysis system further predicts the probability of all possible virtual network traffic states after the subsequent addition of the real-time core data set, and represents it in the network transition space, The three-dimensional predicted transition probability space is obtained.
  • the network traffic incremental analysis system After predicting the possible virtual network state and probability at the next moment, the network traffic incremental analysis system further predicts the possible virtual network state and probability at the next moment, which can better analyze the change of network state and provide a virtual network State early warning, the initial virtual network can take reasonable precautions and prepare measures to deal with possible subsequent bad states.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

La présente invention concerne le domaine technique des communications, et concerne ainsi un procédé et un système de calcul et d'analyse d'incrément de trafic de réseau. Le procédé consiste : à acquérir et à enregistrer des paquets de données à chaque niveau d'un modèle de réseau d'un réseau virtualisé en temps réel, les paquets de données étant pourvus d'une pluralité d'éléments caractéristiques, et les éléments caractéristiques comprenant le temps ; à enregistrer les paquets de données dans un espace dimensionnel élevé selon un mode unidimensionnel correspondant à un élément caractéristique, et à obtenir une matrice d'ordre élevé parallèlement à une expansion de mode prédéfinie ; après l'élimination des données répétées et erronées dans la matrice d'ordre élevé, à les restaurer dans un espace dimensionnel élevé pour obtenir un ensemble de données de base en temps réel ; et selon une séquence temporelle, à enregistrer l'ensemble de données de base en temps réel parallèlement à une dimension temporelle dans l'espace dimensionnel élevé en temps réel afin d'obtenir un ensemble total de données de base de haute qualité. En utilisant la présente invention, la collecte en temps réel et le stockage incrémental du trafic de réseau dans un environnement de virtualisation de fonction de réseau peuvent être mis en œuvre, un espace dimensionnel élevé et un modèle d'espace de transfert peuvent être construits, et une analyse peut être réalisée au moyen d'un procédé incrémentiel.
PCT/CN2019/096637 2019-01-04 2019-07-19 Procédé et système de calcul et d'analyse d'incrément de trafic de réseau Ceased WO2020140419A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910008924.9A CN109889366B (zh) 2019-01-04 2019-01-04 网络流量增量统计、分析方法及系统
CN201910008924.9 2019-01-04

Publications (1)

Publication Number Publication Date
WO2020140419A1 true WO2020140419A1 (fr) 2020-07-09

Family

ID=66925550

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/096637 Ceased WO2020140419A1 (fr) 2019-01-04 2019-07-19 Procédé et système de calcul et d'analyse d'incrément de trafic de réseau

Country Status (2)

Country Link
CN (1) CN109889366B (fr)
WO (1) WO2020140419A1 (fr)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109889366B (zh) * 2019-01-04 2020-06-16 烽火通信科技股份有限公司 网络流量增量统计、分析方法及系统
CN113132415A (zh) * 2021-05-10 2021-07-16 安徽思珀特信息科技有限公司 一种基于网络流量分析的威胁发现系统
CN117876845A (zh) * 2024-01-15 2024-04-12 华中科技大学 基于双向状态空间模型的视觉表征方法与装置
CN119814589B (zh) * 2024-12-04 2026-04-21 天翼云科技有限公司 内容分发网络的业务增量预测的方法、装置、设备和介质

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101753381A (zh) * 2009-12-25 2010-06-23 华中科技大学 一种检测网络攻击行为的方法
CN104462459A (zh) * 2014-12-16 2015-03-25 芜湖乐锐思信息咨询有限公司 基于神经网络的大数据分析处理系统及方法
CN106095921A (zh) * 2016-06-07 2016-11-09 四川大学 面向海量数据流的实时并行分类方法
US20170185895A1 (en) * 2015-01-26 2017-06-29 Huawei Technologies Co., Ltd. System and Method for Training Parameter Set in Neural Network
CN107547154A (zh) * 2016-06-23 2018-01-05 华为技术有限公司 一种建立视频流量预测模型的方法及装置
CN108199928A (zh) * 2018-02-01 2018-06-22 国网湖北省电力公司信息通信公司 一种多维电力通信网流量预测方法及系统
CN108718257A (zh) * 2018-05-23 2018-10-30 浙江大学 一种基于网络流量的无线摄像头检测及定位方法
CN109889366A (zh) * 2019-01-04 2019-06-14 烽火通信科技股份有限公司 网络流量增量统计、分析方法及系统

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100544287C (zh) * 2006-09-26 2009-09-23 中兴通讯股份有限公司 宽窄带综合接入设备的网络流量统计方法
CN103647670B (zh) * 2013-12-20 2017-12-26 北京理工大学 一种基于sketch的数据中心网络流量分析方法
CN105099757B (zh) * 2015-06-08 2019-03-01 福建星网锐捷网络有限公司 网络流量统计分析方法和装置
CN108965024B (zh) * 2018-08-01 2021-08-13 重庆邮电大学 一种5g网络切片基于预测的虚拟网络功能调度方法

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101753381A (zh) * 2009-12-25 2010-06-23 华中科技大学 一种检测网络攻击行为的方法
CN104462459A (zh) * 2014-12-16 2015-03-25 芜湖乐锐思信息咨询有限公司 基于神经网络的大数据分析处理系统及方法
US20170185895A1 (en) * 2015-01-26 2017-06-29 Huawei Technologies Co., Ltd. System and Method for Training Parameter Set in Neural Network
CN106095921A (zh) * 2016-06-07 2016-11-09 四川大学 面向海量数据流的实时并行分类方法
CN107547154A (zh) * 2016-06-23 2018-01-05 华为技术有限公司 一种建立视频流量预测模型的方法及装置
CN108199928A (zh) * 2018-02-01 2018-06-22 国网湖北省电力公司信息通信公司 一种多维电力通信网流量预测方法及系统
CN108718257A (zh) * 2018-05-23 2018-10-30 浙江大学 一种基于网络流量的无线摄像头检测及定位方法
CN109889366A (zh) * 2019-01-04 2019-06-14 烽火通信科技股份有限公司 网络流量增量统计、分析方法及系统

Also Published As

Publication number Publication date
CN109889366B (zh) 2020-06-16
CN109889366A (zh) 2019-06-14

Similar Documents

Publication Publication Date Title
WO2020140419A1 (fr) Procédé et système de calcul et d'analyse d'incrément de trafic de réseau
CN112640380B (zh) 用于对事件的输入流进行异常检测的设备和方法
CN107817787B (zh) 一种基于机器学习的智能产线机械手故障诊断方法
CN104503826B (zh) 一种云计算数据中心的虚拟机映射方法及装置
Li et al. DeepNFV: A lightweight framework for intelligent edge network functions virtualization
CN112631725A (zh) 一种基于云边端协同的智慧城市的管理系统及方法
CN114401516B (zh) 一种基于虚拟网络流量分析的5g切片网络异常检测方法
CN119719248B (zh) 多源异构数据语义对齐方法、装置及计算机设备
US20210152454A1 (en) Network Flow Measurement Method, Network Measurement Device, and Control Plane Device
CN105978711B (zh) 一种基于最小生成树的最佳交换边查找方法
CN113467851B (zh) 一种基于车辆聚类的动态车辆计算任务卸载方法和装置
CN113259355B (zh) 一种基于sdn的工业互联网标识切片管理系统
CN106528815A (zh) 一种路网移动对象概率聚集查询方法及系统
CN115473688B (zh) 面向软件定义网络的异常检测方法、装置及设备
CN112416950B (zh) 一种三维sketch结构的设计方法和装置
WO2024124640A1 (fr) Procédé et appareil d'analyse de nœud basés sur un graphe d'analyse de menace
CN103051509B (zh) 一种基于树状架构的初始化方法
Ponmalar et al. Machine learning based network traffic predictive analysis
Taneja et al. Predictive analytics on IoT
CN113660209A (zh) 一种基于sketch与联邦学习的DDoS攻击检测系统及应用
CN110275895A (zh) 一种缺失交通数据的填充设备、装置及方法
CN118656699A (zh) 一种基于联邦学习的flvc异常用电检测方法
CN106708867B (zh) 一种基于数据基类型的资源调配方法和服务器
Wang et al. Model-based scheduling for stream processing systems
JP2023064173A (ja) データ処理装置、データ処理方法、及びデータ処理プログラム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19907868

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19907868

Country of ref document: EP

Kind code of ref document: A1