CN117591854A - Self-adaptive flow analysis method, system, electronic equipment and medium - Google Patents

Abstract

The invention belongs to the technical field of flow mapping, and its purpose is to provide an adaptive flow analysis method, system, electronic equipment and media. The invention discloses an adaptive traffic analysis method, which includes: obtaining a traffic record file, performing feature analysis on the traffic record file, and obtaining a traffic basic feature information table; and analyzing the traffic basic features in the traffic basic feature information table. The information is preprocessed to obtain a preprocessed traffic feature information table; a traffic feature correlation matrix is obtained based on the preprocessed traffic feature information table; and a pre-stored historical traffic feature correlation matrix is dynamically and adaptively updated based on the traffic feature correlation matrix. , obtain the updated traffic characteristic correlation matrix, and obtain the optimal characteristic correlation set according to the updated traffic characteristic correlation matrix; obtain the traffic evaluation result according to the optimal characteristic correlation set. The invention can improve the accuracy and effectiveness of flow analysis.

Description

An adaptive flow analysis method, system, electronic device and medium

Technical field

The invention belongs to the technical field of flow mapping, and specifically relates to an adaptive flow analysis method, system, electronic equipment and media.

Background technique

VoIP (Voice over Internet Protocol, voice transmission based on IP) is a technology that uses IP protocol for voice communication. VoIP can convert voice signals into digital data packets so that they can be transmitted through the Internet or other IP networks. Due to its low cost, flexible communication, high scalability, and easy integration and management, VoIP communication technology has been widely used It is used in homes, enterprises, operators and other places to provide technical support for high-quality, affordable and multi-functional communication services.

Traffic mapping in the VoIP system environment network refers to measuring and analyzing traffic characteristics in VoIP communications, such as delay, jitter, packet loss, etc., in order to extract various performance indicators and feature information about call quality, network performance and user experience. . By measuring, analyzing and evaluating actual communication traffic, such as security monitoring, quality of service (QoS) assessment, data compression, traffic classification, anomaly detection and business analysis, VoIP network security can be effectively strengthened and VoIP service quality optimized. During the application process, first of all, network administrators can discover bottlenecks and problems in the network through traffic measurement and analysis, and then take corresponding optimization measures, such as adjusting network parameters, increasing bandwidth, improving network topology, etc., to improve the efficiency of VoIP calls. Quality and stability; secondly, by measuring and analyzing user call traffic, the service provider can understand the user's experience in different network environments, thereby optimizing the user's communication experience and improving user satisfaction; in addition, regular VoIP network traffic Analysis can identify and monitor abnormal activities and potential security threats in the network, prevent abnormal network behaviors and intrusion attempts, protect it from potential attacks and abuse, and help improve the security and reliability of VoIP networks.

However, in the process of using the prior art, the inventor discovered that there are at least the following problems in the prior art:

In the existing technology, there is a problem of low accuracy and effectiveness when performing traffic mapping in a VoIP system environment network. Specifically, in the existing technology, most traffic mapping work is usually implemented through network traffic monitoring tools, building traffic analysis systems or active measurement technologies, and at the same time using traffic statistics and analysis software, etc., when oriented to the traffic in the VoIP softswitch system When surveying and mapping, the existing technology lacks targeted traffic characteristics to perform surveying and mapping. Therefore, when faced with large throughput call traffic scenarios, the existing technology has problems of weak surveying and mapping capabilities, low surveying and mapping accuracy, and low effectiveness.

Contents of the invention

The present invention aims to solve the above technical problems at least to a certain extent. The present invention provides an adaptive traffic analysis method, system, electronic equipment and media.

In order to achieve the above objects, the present invention adopts the following technical solutions:

In a first aspect, the present invention provides an adaptive traffic analysis method, including:

Obtain the traffic record file, perform feature analysis on the traffic record file, and obtain a traffic basic feature information table; wherein the traffic basic feature information table includes traffic basic feature information in each time period;

Preprocess the basic traffic characteristic information in the basic traffic characteristic information table to obtain a preprocessed traffic characteristic information table;

Obtain a traffic feature correlation matrix according to the preprocessed traffic feature information table;

Dynamically adaptively update the pre-stored historical traffic feature correlation matrix according to the traffic feature correlation matrix to obtain an updated traffic feature correlation matrix, and obtain an optimal feature correlation set based on the updated traffic feature correlation matrix;

According to the optimal feature association set, a traffic evaluation result is obtained.

The invention can improve the accuracy and effectiveness of flow analysis. Specifically, in the process of traffic analysis and traffic feature extraction, the present invention obtains the traffic feature correlation matrix based on the pre-processed traffic feature information table, introduces mutual information as an index to measure the correlation between pre-processed traffic features, and mutual information. Information analysis can help identify and quantify the interactions between features to discover key information and patterns hidden in traffic data. At the same time, in the process of obtaining the optimal feature association set, the present invention also dynamically and adaptively updates the pre-stored historical traffic feature association matrix according to the traffic feature association matrix, thereby obtaining the optimal feature association set, so as to obtain the optimal feature association set according to the traffic feature association matrix. The optimal feature association set is used to obtain the traffic evaluation results. In this process, the present invention establishes an adaptive feature extraction process that can automatically adjust the weight of features according to actual conditions, increase attention to key features, reduce the impact on irrelevant features, and narrow down the number of features to be evaluated. feature range, thereby improving the accuracy and effectiveness of traffic analysis, automatically adapting to different traffic scenarios and extracting the most representative features. Based on the above content, the present invention can optimize the network performance of the VoIP system environment by adaptively measuring and analyzing the traffic characteristics in the VoIP system environment network in the terminal soft-switching network, and exploring and analyzing network problems that may occur in communications in the VoIP system environment. Indicators are used to improve the security and reliability of the network and provide new solutions for the further improvement of network security and network services.

In a possible design, feature analysis is performed on the traffic record file to obtain a basic traffic feature information table, including:

Segment the traffic record file to obtain multiple basic traffic fields;

Perform parsing and processing on multiple basic traffic fields to obtain full traffic protocol fields;

Parse the full-flow protocol field to obtain the SIP protocol header field;

A traffic basic characteristic information table is obtained according to the full traffic protocol field and the SIP protocol header field.

In a possible design, the basic traffic characteristic information in the basic traffic characteristic information table is preprocessed to obtain a preprocessed traffic characteristic information table, including:

Perform data cleaning on the traffic basic feature information in the traffic basic feature information table to obtain the cleaned traffic basic feature information;

Denoise the cleaned traffic basic feature information in the traffic basic feature information table to obtain the denoised traffic basic feature information;

The denoised traffic basic feature information in the traffic basic feature information table is standardized to obtain a preprocessed traffic feature information table.

In a possible design, any traffic feature correlation information in the traffic feature correlation matrix is:

In the formula, p(x) is the edge probability density function corresponding to any preprocessed traffic basic characteristic information x in the preprocessed traffic characteristic information table, and p(y) is the preprocessed traffic characteristic information table. The marginal probability density function corresponding to the preprocessed traffic basic feature information y located in the adjacent time period of the preprocessed traffic basic feature information x, p (x, y) is the preprocessed traffic basic feature information x and the preprocessed traffic basic The joint probability density function corresponding to the feature information y.

In a possible design, the updated traffic characteristic correlation matrix is:

In the formula, C is the traffic characteristic correlation matrix, is the pre-stored historical traffic characteristic correlation matrix, and w is the preset update coefficient.

In a possible design, the optimal feature correlation set is obtained based on the updated traffic feature correlation matrix, including:

Obtain the covariance matrix of the updated traffic characteristic correlation matrix through the PCA method;

According to the size of the eigenvalues in the covariance matrix, select the first k principal components in the covariance matrix; where k is a natural number greater than 1;

Project the first k principal components into the new feature space to obtain the optimal feature correlation set.

In one possible design, the covariance matrix is:

In the formula, _Xi is the updated traffic characteristic correlation matrix The i-th updated traffic feature correlation information in , n is the total data amount in the updated traffic feature correlation matrix, and T is the transpose symbol.

In a second aspect, the present invention provides an adaptive traffic analysis system for implementing the adaptive traffic analysis method as described in any one of the above; the adaptive traffic analysis system includes:

The traffic feature analysis module is used to obtain the traffic record file, perform feature analysis on the traffic record file, and obtain a traffic basic feature information table; wherein the traffic basic feature information table includes traffic basic feature information in each time period. ;

A data preprocessing module, communicatively connected to the traffic feature analysis module, is used to preprocess the basic traffic feature information in the traffic basic feature information table, and obtain a preprocessed traffic feature information table;

a correlation calculation module, communicatively connected to the data preprocessing module, and used to obtain a traffic feature correlation matrix according to the preprocessed traffic feature information table;

The adaptive feature extraction module is communicatively connected to the correlation calculation module, and is used to dynamically and adaptively update the pre-stored historical traffic feature correlation matrix according to the traffic feature correlation matrix, obtain the updated traffic feature correlation matrix, and perform the adaptive feature extraction module according to the traffic feature correlation matrix. The updated traffic feature correlation matrix is used to obtain the optimal feature correlation set;

A feature analysis module is communicatively connected to the adaptive feature extraction module, and is used to obtain a traffic assessment result based on the optimal feature association set.

In a third aspect, the present invention provides an electronic device, including:

Memory for storing computer program instructions; and,

A processor, configured to execute the computer program instructions to complete the operations of the adaptive traffic analysis method as described in any one of the above.

In a fourth aspect, the present invention provides a computer-readable storage medium for storing computer-readable computer program instructions, the computer program instructions being configured to execute the adaptive traffic according to any one of the above when running. Operation of analytical methods.

Description of drawings

Figure 1 is a flow chart of an adaptive traffic analysis method in an embodiment;

Figure 2 is a module block diagram of an adaptive traffic analysis system in the embodiment;

Figure 3 is a module block diagram of an electronic device in the embodiment.

Detailed ways

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the present invention will be briefly introduced below in conjunction with the accompanying drawings and the description of the embodiments or the prior art. Obviously, the following description of the structure of the drawings is only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without exerting creative efforts. It should be noted here that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention.

Example 1:

This embodiment discloses an adaptive traffic analysis method, which can be, but is not limited to, executed by a computer device or a virtual machine with certain computing resources, such as by an electronic device such as a personal computer, a smart phone, a personal digital assistant or a wearable device, Or executed by a virtual machine.

As shown in Figure 1, an adaptive traffic analysis method can, but is not limited to, include the following steps:

S1. Capture the full flow of traffic in the VoIP network, obtain the traffic record file, and perform feature analysis on the traffic record file to obtain a basic traffic feature information table; wherein the basic traffic feature information table includes each time period Basic traffic characteristic information within the system.

Specifically, perform feature analysis on the traffic record file to obtain a traffic basic feature information table, including:

S101. Segment the traffic record file to obtain multiple basic traffic fields;

S102. Analyze multiple basic traffic fields to obtain full traffic protocol fields;

S103. Parse the full-flow protocol field to obtain the SIP (Session initialization Protocol) protocol header field;

S104. Obtain a traffic basic characteristic information table according to the full traffic protocol field and the SIP protocol header field.

In this embodiment, the timestamp of the traffic data is used to segment the traffic record file with the preset time interval parameter T _default , and then the basic characteristics of the traffic information in each time period are obtained, that is, multiple basic traffic fields; This embodiment can also perform segmented collection and preliminary analysis of multiple captured basic traffic fields according to the configured time interval parameters, so as to obtain the final basic traffic characteristic information table.

S2. Preprocess the basic flow characteristic information in the flow basic characteristic information table to obtain a preprocessed flow characteristic information table; when preprocessing the basic flow characteristic information table, it includes but is not limited to the flow rate The basic traffic characteristic information in the basic characteristic information table undergoes operations such as data cleaning, noise removal, and standardization to ensure the accuracy, reliability, and consistency of the analyzed data.

In this embodiment, the basic traffic characteristic information in the basic traffic characteristic information table is preprocessed to obtain a preprocessed traffic characteristic information table, which includes:

S201. Perform data cleaning on the traffic basic feature information in the traffic basic feature information table to obtain the cleaned traffic basic feature information; specifically, data cleaning can remove invalid or erroneous data in the traffic basic feature information to improve data quality. .

S202. Denoise the cleaned traffic basic feature information in the traffic basic feature information table to obtain the denoised traffic basic feature information;

Specifically, in this embodiment, denoising processing is used to filter out offset information that occasionally appears in the basic traffic characteristic information table, so as to reduce the number of noise points in the basic traffic characteristic information. In this embodiment, the Z-Score normalization algorithm is used , the following formula is used to standardize the cleaned traffic basic feature information in the traffic basic feature information table:

In the formula, x _i ′ is the basic traffic characteristic information after cleaning in the basic traffic characteristic information table, _xi is the standardized data matching the basic traffic characteristic information after cleaning x _i ′, and μ is the basic traffic characteristic information. The average value of the basic characteristic information of the flow after cleaning in the table, σ is the standard deviation of the basic characteristic information of the flow after cleaning in the basic flow characteristic information table;

Then the median filtering algorithm in the following formula is used to further remove the noise in the information:

Y _i =median(xi _-n+1 ,xi _-n+2 ,…, _xi );

In the formula, Y _i is the basic traffic characteristic information after denoising in the basic traffic characteristic information table, xi _-n+1 , _xi-n+2 ,..., _xi is the standardized data, and n is the filtering window. Size, usually a positive integer above 3.

S203. Standardize the denoised traffic basic feature information in the traffic basic feature information table to obtain a preprocessed traffic feature information table.

Specifically, in this embodiment, the standardization process can standardize the traffic basic feature information in the traffic basic feature information table, and scale all information features to the same range. In this embodiment, depending on the standardization algorithm used, it is usually [ 0,1] or [-1,1], usually Min-Max normalization algorithm or Z-score normalization algorithm is used. The calculation formula of the Min-Max normalization algorithm is as follows:

In the formula, Y _norm is the preprocessed traffic feature information in the preprocessed traffic feature information table that matches Y _i , and Y _min is the minimum value in the denoised traffic basic feature information in the traffic basic feature information table. , Y _max is the maximum value in the denoised traffic basic feature information in the traffic basic feature information table.

S3. Obtain the traffic characteristic correlation matrix according to the pre-processed traffic characteristic information table; obtain the traffic characteristic correlation matrix according to the pre-processed traffic characteristic information table, including: sequentially obtaining adjacent items in the pre-processed traffic characteristic information table. The correlation degree between the preprocessed traffic basic characteristic information within the time period is used to obtain multiple traffic characteristic correlation information; the traffic characteristic correlation matrix is obtained based on the multiple traffic characteristic correlation information; in this embodiment, by introducing the measure of mutual information Standard, the correlation degree between the preprocessed traffic basic characteristic information is quantified pairwise. After the correlation calculation, the traffic characteristic correlation matrix can be obtained, which is used to evaluate the criticality of the characteristics in the next step.

Specifically, in this embodiment, any traffic feature correlation information in the traffic feature correlation matrix is:

In the formula, p(x) is the edge probability density function corresponding to any preprocessed traffic basic characteristic information x in the preprocessed traffic characteristic information table, and p(y) is the preprocessed traffic characteristic information table. The marginal probability density function corresponding to the preprocessed traffic basic feature information y located in the adjacent time period of the preprocessed traffic basic feature information x, p (x, y) is the preprocessed traffic basic feature information x and the preprocessed traffic basic The joint probability density function corresponding to the feature information y.

S4. Dynamically and adaptively update the pre-stored historical traffic feature correlation matrix (that is, the updated traffic feature correlation matrix obtained in the previous cycle) according to the traffic feature correlation matrix to obtain the updated traffic feature correlation matrix, and perform The updated traffic feature correlation matrix obtains the optimal feature correlation set.

In this embodiment, the updated traffic characteristic correlation matrix is:

In the formula, C is the traffic characteristic correlation matrix, is the pre-stored historical traffic characteristic correlation matrix, and w is the preset update coefficient.

In this embodiment, an exponentially weighted moving average method is used to dynamically and adaptively update the pre-stored historical traffic characteristic correlation matrix, in which the update coefficient w can be configured by the user to control the speed of matrix update.

Specifically, in this embodiment, the example calculation formula of the update coefficient w is as follows:

w=α×CosSim+β×EucilideanDist;

In the formula, CosSim is the pre-stored historical traffic characteristic correlation matrix and the cosine similarity between the traffic feature correlation matrix C, EucilideanDist is the pre-stored historical traffic feature correlation matrix/> The Euclidean distance between the traffic characteristic correlation matrix C and α is the preset first weight, and β is the preset second weight. In this embodiment, α and β are set taking into account the simultaneous use of cosine similarity and Euclidean distance. There are three situations: if only cosine similarity is used, α is 1 and β is 0; If only Euclidean distance is used, α is 0 and β is 1; if both are used, the user needs to customize the weights of the two distance methods and then assign α and β.

In this embodiment, the update coefficient w formula input by the user is analyzed during initialization. By verifying the legality of the formula and analyzing the mathematical expression, the corresponding update coefficient w can finally be obtained. At the end of each T _default period, the traffic characteristic correlation matrix can be updated according to the calculation formula of the update coefficient w.

In this embodiment, the optimal feature correlation set is obtained according to the updated traffic feature correlation matrix, including:

S401. Obtain the covariance matrix of the updated traffic characteristic correlation matrix through the PCA (Principal Component Analysis) method;

In this embodiment, the covariance matrix is:

In the formula, _Xi is the updated traffic characteristic correlation matrix The i-th updated traffic feature correlation information in , n is the total data amount in the updated traffic feature correlation matrix, and T is the transpose symbol.

S402. Select the first k principal components in the covariance matrix according to the size of the eigenvalues in the covariance matrix; where k is a natural number greater than 1;

S403. Project the first k principal components into the new feature space to obtain the optimal feature correlation set.

Specifically, for a data set with n features, the covariance matrix is an n×n matrix that represents the covariance between each feature. In this embodiment, the eigenvalues and eigenvectors of the covariance matrix can be solved through linear algebra. Eigenvectors represent directions in feature space, and eigenvalues represent the importance of feature vectors along that direction. After the eigenvalue calculation is completed, you can sort according to the size of the eigenvalue, customize k, and select the first k principal components of the eigenvalue to obtain the optimal feature association set to represent the reduced features.

It should be noted that in this embodiment, the importance of features is adjusted by dynamically updating weights, and the pre-stored historical traffic feature correlation matrix is performed on the pre-stored historical traffic feature correlation matrix by adaptively assigning weights to data of different importance through the analysis method of exponentially weighted moving average. Dynamic adaptive update; select the first k principal components (specified by the user) according to the feature size in the latest feature association set to obtain the optimal feature association set, which will help narrow the scope of feature research and carry out follow-up more efficiently network data analysis work.

S5. Obtain the traffic evaluation result according to the optimal feature association set. In this embodiment, the SVM classifier obtained through manual experience training of the network administrator performs classification and evaluation on the optimal feature association set, and then the traffic evaluation result can be obtained. In this embodiment, the traffic evaluation results include TCM network QoS (Quality of Service, Quality of Service) indicators such as delay, packet loss rate, jitter, and bandwidth. Each indicator can be divided into categories used to evaluate network QoS from good to bad. Five-level classification results.

This embodiment can improve the accuracy and effectiveness of traffic analysis. Specifically, in this embodiment, during the process of traffic analysis and traffic feature extraction, the traffic feature correlation matrix is obtained according to the pre-processed traffic feature information table, and mutual information is introduced as an indicator to measure the correlation between pre-processed traffic features. Mutual information analysis can help identify and quantify the interaction relationships between features to facilitate the discovery of key information and patterns hidden in traffic data. At the same time, in the process of obtaining the optimal feature association set, this embodiment also dynamically and adaptively updates the pre-stored historical traffic feature association matrix according to the traffic feature association matrix, thereby obtaining the optimal feature association set, so that the optimal feature association set can be obtained according to the traffic feature association matrix. The optimal feature association set is described to obtain the traffic assessment results. In this process, this embodiment establishes an adaptive feature extraction process that can automatically adjust the weight of features according to the actual situation, increase attention to key features, reduce the impact on irrelevant features, and narrow down the number of features to be evaluated. feature range, thereby improving the accuracy and effectiveness of traffic analysis, automatically adapting to different traffic scenarios and extracting the most representative features. Based on the above content, this embodiment can optimize the network of the VoIP system environment by adaptively measuring and analyzing the traffic characteristics in the VoIP system environment network in the terminal soft-switching network, and exploring and analyzing network problems that may occur in communications in the VoIP system environment. Performance indicators, in order to improve the security and reliability of the network, provide new solutions for the further improvement of network security and network services.

Example 2:

This embodiment discloses an adaptive traffic analysis system, which is used to implement the adaptive traffic analysis method in Embodiment 1; as shown in Figure 2, the adaptive traffic analysis system includes:

The traffic feature analysis module is used to obtain the traffic record file, perform feature analysis on the traffic record file, and obtain a traffic basic feature information table; wherein the traffic basic feature information table includes traffic basic feature information in each time period. ;

A data preprocessing module, communicatively connected to the traffic feature analysis module, is used to preprocess the basic traffic feature information in the traffic basic feature information table, and obtain a preprocessed traffic feature information table;

a correlation calculation module, communicatively connected to the data preprocessing module, and used to obtain a traffic feature correlation matrix according to the preprocessed traffic feature information table;

The adaptive feature extraction module is communicatively connected to the correlation calculation module, and is used to dynamically and adaptively update the pre-stored historical traffic feature correlation matrix according to the traffic feature correlation matrix, obtain the updated traffic feature correlation matrix, and perform the adaptive feature extraction module according to the traffic feature correlation matrix. The updated traffic feature correlation matrix is used to obtain the optimal feature correlation set;

A feature analysis module is communicatively connected to the adaptive feature extraction module, and is used to obtain a traffic assessment result based on the optimal feature association set.

Example 3:

Based on Embodiment 1 or 2, this embodiment discloses an electronic device, which may be a smart phone, a tablet computer, a notebook computer, a desktop computer, etc. Electronic devices may be called user terminals, portable terminals, desktop terminals, etc. As shown in Figure 3, electronic devices include:

Memory for storing computer program instructions; and,

A processor, configured to execute the computer program instructions to complete the operations of the adaptive traffic analysis method as described in any one of Embodiment 1.

Specifically, the processor 301 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 301 can be implemented in at least one hardware form among DSP (Digital Signal Processing, digital signal processing), FPGA (Field-Programmable Gate Array, field programmable gate array), and PLA (Programmable Logic Array, programmable logic array). . The processor 301 may also include a main processor and a co-processor. The main processor is a processor used to process data in the wake-up state, also called CPU (Central Processing Unit, central processing unit); the co-processor is A low-power processor used to process data in standby mode. In some embodiments, the processor 301 may be integrated with a GPU (Graphics Processing Unit, image processor), and the GPU is responsible for rendering and drawing content to be displayed on the display screen.

Memory 302 may include one or more computer-readable storage media, which may be non-transitory. Memory 302 may also include high-speed random access memory, and non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 302 is used to store at least one instruction, and the at least one instruction is used to be executed by the processor 301 to implement the adaptive method provided in Embodiment 1 of this application. Traffic analysis methods.

In some embodiments, the terminal optionally further includes: a communication interface 303 and at least one peripheral device. The processor 301, the memory 302 and the communication interface 303 may be connected through a bus or a signal line. Each peripheral device can be connected to the communication interface 303 through a bus, a signal line or a circuit board. Specifically, the peripheral device includes: at least one of a radio frequency circuit 304, a display screen 305, and a power supply 306.

The communication interface 303 may be used to connect at least one I/O (Input/Output) related peripheral device to the processor 301 and the memory 302 . In some embodiments, the processor 301, the memory 302 and the communication interface 303 are integrated on the same chip or circuit board; in some other embodiments, any one or both of the processor 301, the memory 302 and the communication interface 303 It can be implemented on a separate chip or circuit board, which is not limited in this embodiment.

The radio frequency circuit 304 is used to receive and transmit RF (Radio Frequency, radio frequency) signals, also called electromagnetic signals. Radio frequency circuit 304 communicates with communication networks and other communication devices through electromagnetic signals.

The display screen 305 is used to display UI (User Interface, user interface). The UI can include graphics, text, icons, videos, and any combination thereof.

The power supply 306 is used to power various components in the electronic device.

Example 4:

Based on any one of Embodiments 1 to 3, this embodiment discloses a computer-readable storage medium for storing computer-readable computer program instructions, where the computer program instructions are configured to run The operation of the adaptive traffic analysis method described in Embodiment 1 is performed.

Obviously, those skilled in the art should understand that the above-mentioned modules or steps of the present invention can be implemented using general-purpose computing devices. They can be concentrated on a single computing device, or distributed across a network composed of multiple computing devices. , optionally, they can be implemented with program codes executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be separately made into individual integrated circuit modules, or they can be Multiple modules or steps are made into a single integrated circuit module. As such, the invention is not limited to any specific combination of hardware and software.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention, but not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that it can still be used Modify the technical solutions described in the foregoing embodiments, or make equivalent replacements for some of the technical features. However, these modifications or substitutions do not cause the essence of the corresponding technical solution to deviate from the spirit and scope of the technical solution of each embodiment of the present invention.

Claims (10)

1. An adaptive traffic analysis method, characterized by: including: Obtain the traffic record file, perform feature analysis on the traffic record file, and obtain a traffic basic feature information table; wherein the traffic basic feature information table includes traffic basic feature information in each time period; Preprocess the basic traffic characteristic information in the basic traffic characteristic information table to obtain a preprocessed traffic characteristic information table; Obtain a traffic feature correlation matrix according to the preprocessed traffic feature information table; Dynamically adaptively update the pre-stored historical traffic feature correlation matrix according to the traffic feature correlation matrix to obtain an updated traffic feature correlation matrix, and obtain an optimal feature correlation set based on the updated traffic feature correlation matrix; According to the optimal feature association set, a traffic evaluation result is obtained. 2. An adaptive traffic analysis method according to claim 1, characterized in that: performing feature analysis on the traffic record file to obtain a traffic basic feature information table, including: Segment the traffic record file to obtain multiple basic traffic fields; Perform parsing and processing on multiple basic traffic fields to obtain full traffic protocol fields; Parse the full-flow protocol field to obtain the SIP protocol header field; A traffic basic characteristic information table is obtained according to the full traffic protocol field and the SIP protocol header field. 3. An adaptive traffic analysis method according to claim 1, characterized in that: preprocessing the traffic basic feature information in the traffic basic feature information table to obtain a preprocessed traffic feature information table, including: Perform data cleaning on the traffic basic feature information in the traffic basic feature information table to obtain the cleaned traffic basic feature information; Denoise the cleaned traffic basic feature information in the traffic basic feature information table to obtain the denoised traffic basic feature information; The denoised traffic basic feature information in the traffic basic feature information table is standardized to obtain a preprocessed traffic feature information table. 4. An adaptive traffic analysis method according to claim 1, characterized in that: any traffic feature correlation information in the traffic feature correlation matrix is: In the formula, p(x) is the edge probability density function corresponding to any preprocessed traffic basic characteristic information x in the preprocessed traffic characteristic information table, and p(y) is the preprocessed traffic characteristic information table. The marginal probability density function corresponding to the preprocessed traffic basic feature information y located in the adjacent time period of the preprocessed traffic basic feature information x, p(x, y) is the preprocessed traffic basic feature information x and the preprocessed traffic basic The joint probability density function corresponding to the feature information y. 5. An adaptive traffic analysis method according to claim 1, characterized in that: the updated traffic characteristic correlation matrix is: In the formula, C is the traffic characteristic correlation matrix, is the pre-stored historical traffic characteristic correlation matrix, and w is the preset update coefficient. 6. An adaptive traffic analysis method according to claim 1, characterized in that: obtaining an optimal feature association set according to the updated traffic feature association matrix, including: Obtain the covariance matrix of the updated traffic characteristic correlation matrix through the PCA method; According to the size of the eigenvalues in the covariance matrix, select the first k principal components in the covariance matrix; where k is a natural number greater than 1; Project the first k principal components into the new feature space to obtain the optimal feature correlation set. 7. An adaptive traffic analysis method according to claim 6, characterized in that: the covariance matrix is: In the formula, _Xi is the updated traffic characteristic correlation matrix The i-th updated traffic feature correlation information in , n is the total data amount in the updated traffic feature correlation matrix, and T is the transpose symbol. 8. An adaptive traffic analysis system, characterized in that: used to implement the adaptive traffic analysis method according to any one of claims 1 to 7; the adaptive traffic analysis system includes: The traffic feature analysis module is used to obtain the traffic record file, perform feature analysis on the traffic record file, and obtain a traffic basic feature information table; wherein the traffic basic feature information table includes traffic basic feature information in each time period. ; A data preprocessing module, communicatively connected to the traffic feature analysis module, is used to preprocess the basic traffic feature information in the traffic basic feature information table, and obtain a preprocessed traffic feature information table; a correlation calculation module, communicatively connected to the data preprocessing module, and used to obtain a traffic feature correlation matrix according to the preprocessed traffic feature information table; The adaptive feature extraction module is communicatively connected to the correlation calculation module, and is used to dynamically and adaptively update the pre-stored historical traffic feature correlation matrix according to the traffic feature correlation matrix, obtain the updated traffic feature correlation matrix, and perform the adaptive feature extraction module according to the traffic feature correlation matrix. The updated traffic feature correlation matrix is used to obtain the optimal feature correlation set; A feature analysis module is communicatively connected to the adaptive feature extraction module, and is used to obtain a traffic assessment result based on the optimal feature association set. 9. An electronic device, characterized by: including: Memory for storing computer program instructions; and, A processor, configured to execute the computer program instructions to complete the operations of the adaptive traffic analysis method according to any one of claims 1 to 7. 10. A computer-readable storage medium for storing computer-readable computer program instructions, characterized in that: the computer program instructions are configured to execute the method according to any one of claims 1 to 7 when running. Operation of adaptive traffic analysis methods.