TW202101944A - Network connected apparatus and traffic estimation method thereof - Google Patents

Abstract

A network connected apparatus and a traffic estimation method thereof are provided. In the method, multiple network packets are captured, the query frequency for at least one domain name in the network packets are counted, and the network traffic of each network layer or each service type is determined according to the query frequency. In addition, a corresponding type feature is generated for the user based on domain name query record in the embodiments. Accordingly, the Internet experience of the user can be improved based on the evaluated result.

Description

Networking device and its flow estimation method

The present invention relates to a network management technology, and particularly relates to a networked device and a method for estimating traffic.

Nowadays, almost everyone has Internet-connected devices (for example, mobile phones, tablets, laptops, smart watches, smart home appliances, etc.), and these devices can be connected via mobile networks and other wireless networks. Connect to the Internet through a road or wired network. With the diversified development of network application services (for example, social media, streaming media, online games, digital education, etc.), the number of users and usage of network operators has also increased exponentially. In order to provide users with a better Internet experience, operators continue to actively increase or upgrade hardware devices. In addition to hardware updates, operators will also configure network resources through network management. However, different users have different requirements for application services. Therefore, how to provide more suitable network management, equipment deployment, and software and hardware configuration for each user, company, government or enterprise is one of the goals of each operator.

In view of this, the embodiment of the present invention provides a networked device and a method for estimating its traffic. The network traffic is obtained based on the query of the domain name, and the behavior of the user using the service is evaluated accordingly, and the equipment deployment and deployment are adjusted based on the analysis result Software and hardware configuration.

The traffic estimation method of the embodiment of the present invention includes the following steps: capturing several network packets, counting the number of queries for at least one domain name in those network packets, and judging the network based on the number of queries flow.

The networking device of the embodiment of the present invention includes but is not limited to a communication transceiver and a processor. The communication transceiver is used to receive several network packets. The processor is coupled to the communication transceiver. The processor retrieves those network packets and counts the number of queries for at least one domain name in those network packets. Judge network traffic based on the number of queries.

Based on the above, the networked device and the traffic estimation method of the embodiment of the present invention predicts the network traffic by analyzing the domain name query, and then evaluates the types of network service applications that users want to use or commonly used. These traffic and user characteristic assessments can be used as network operators to provide better plans for equipment deployment, resource allocation, management configuration, etc., so as to enhance users' online experience.

In order to make the above-mentioned features and advantages of the present invention more comprehensible, the following specific embodiments are described in detail in conjunction with the accompanying drawings.

FIG. 1 is a block diagram of components of a networked device 100 according to an embodiment of the invention. Please refer to FIG. 1, the networked device 100 includes but is not limited to a communication transceiver 110, a storage 130 and a processor 150. The networked device 100 may be a computer, a smart phone, a tablet computer, a server, a router, a switch, a telecommunication device, or other electronic devices.

The communication transceiver 110 can be a communication transceiver that supports fourth-generation (4G) or other generations of mobile communications, Wi-Fi, Ethernet, and fiber optic networks, or it can be a universal serial bus (Universal Serial Bus, USB), Thunderbolt or other communication transmission interface. In the embodiment of the present invention, the communication transceiver 110 is used to receive network packets. The network packet is the unit of data transmitted in the network.

The storage 130 can be any type of fixed or removable random access memory (Random Access Memory, RAM), read-only memory (Read-Only Memory, ROM), flash memory (Flash Memory), and traditional hard drives. Hard Disk Drive (HDD), Solid-State Drive (SSD) or similar components or a combination of the above components. In the embodiment of the present invention, the storage 130 is used to store temporary or permanent data (for example, training samples, estimation models, traffic contribution coefficients, network service application types, etc.), network packets, software modules, or other File, and its detailed content will be detailed in subsequent embodiments.

The processor 150 is coupled to the communication transceiver 110 and the storage 130. The processor 150 may be a central processing unit (CPU) or other programmable general-purpose or special-purpose microprocessors (Microprocessor ), Digital Signal Processor (DSP), programmable controller, Application-Specific Integrated Circuit (ASIC) or other similar components or a combination of the above components. In the embodiment of the present invention, the processor 150 is used to perform all operations of the networked device 100, and can load and execute various software modules, files, and data recorded in the storage 130.

It should be noted that the networked device 100 can be set in any network. For example, FIG. 2 is a schematic diagram of a communication system 20 according to an embodiment of the invention. Please refer to FIG. 2, assuming that the communication system 20 belongs to the third generation (3G), fourth generation (4G) or other generations of mobile communication networks. The communication system 20 may include a user equipment UE, a base station BS, an access network 21, a transmission/Internet Protocol (IP) network 22, a core network 23, and an Internet 24. Depending on actual needs, the networked device 100 can be set in a transmission/Internet Protocol (IP) network 22, a core network 23, or a wireless network formed by the user equipment UE and the base station BS. That is, the networked device 100 is located at a certain network node of the network to which it belongs (it may be an input or output gateway between two networks, or a node located on a specific routing path).

It should be noted that in other embodiments, depending on different system architectures, the wireless network in Figure 2 can also be replaced with a Wi-Fi wireless network, or with a wired Ethernet network, or a digital subscriber line (Digital Subscriber Line). , DSL), optical fiber network, or cable network, and the equipment in the access network 21, transmission/IP network 22, and/or core network 23 can also be changed accordingly, and the present invention is not limited.

In order to facilitate the understanding of the operation flow of the creative embodiment of the present invention, a number of embodiments will be given below to describe in detail the method of estimating network traffic by the networked device 100 in the creative embodiment of the present invention. Hereinafter, various components and modules in the networked device 100 will be used to illustrate the method described in the creative embodiment of the present invention. Each process of the method can be adjusted accordingly according to the implementation situation, and is not limited to this.

Fig. 3 is a flowchart of a flow estimation method according to an embodiment of the present invention. Referring to FIG. 3, the processor 150 captures the network packet through the communication transceiver 110 (step S310). Specifically, the processor 150 may capture network packets through software or libraries such as Wireshark, tcpdump, SmartSniff, libpcap, winpcap, or similar, and further analyze the received network packets. In one embodiment, the processor 150 has at least the function of resolving domain name system (Domain Name System, DNS) queries/quests, or DNS-related packets, and can derive all the desired DNS-related packets The query domain name (and/or corresponding IP address).

For example, Table (1) is an example illustrating the results of packet parsing for DNS queries: Table (1) Timestamp Domain name 4/2 04:44:00 www.youtube.com 4/2 04:44:01 tw.linkedlin.com 4/2 04:44:03 onedrive.live.com 4/2 04:44:03 www.facebook.com 4/2 04:44:06 www.bing.com 4/2 04:44:10 www.youtube.com 4/2 04:44:11 tw.linkedlin.com 4/2 04:44:13 onedrive.live.com 4/2 04:44:13 www.facebook.com 4/2 04:44:16 www.bing.com 4/2 04:44:20 www.youtube.com 4/2 04:44:21 tw.linkedlin.com 4/2 04:44:23 onedrive.live.com 4/2 04:44:23 www.facebook.com 4/2 04:44:26 www.bing.com 4/2 04:44:30 www.youtube.com 4/2 04:44:31 tw.linkedlin.com

It should be noted that, depending on the network where the networked device 100 is located, the number of nodes that can be monitored may be as high as tens of thousands, or may be less than 10, but the embodiment of the present invention does not limit the number of monitoring nodes.

Next, the processor 150 counts the number of queries for one or more domain names in those network packets (step S330). In an embodiment, the processor 150 can set a specific time length (for example, 5, 15, or 30 minutes, etc.) and/or frequency (for example, Once a day, three times a week, 10 times a month, etc.), the present invention is not limited. The processor 150 may further add up the number of DNS queries for each domain name within a statistical time (for example, 15 minutes, one day, or one month, etc.) to obtain the number of queries for these domain names respectively.

For example, Table (2) is an example to illustrate the statistical results of DNS queries: Table (2) Domain name 15-minute queries www.youtube.com 100 tw.linkedin.com 500 onedrive.live.com 100 www.facebook.com 20 www.bing.com 1000

Next, the processor 150 determines the network traffic based on the number of queries (step S350). Specifically, in the initial stage of most network behaviors, the user terminal will issue a DNS query to obtain the corresponding network address, and further connect to remote servers or other electronic devices based on the network address. The domain, website and even network service that the user terminal wants to access can be learned from the DNS query. For example, www.facebook.com is a social media service, and www.youtube.com is a video streaming service. In addition, after experiments or statistical results, different network services may correspond to different network traffic. Based on the foregoing layer-by-layer relationship, the embodiment of the present invention estimates the network traffic of the monitoring node or group by querying the corresponding relationship between the domain name and the network traffic.

In one embodiment, the present invention relies on the high accuracy of artificial intelligence (AI) technology to infer the effect, and uses AI machine learning technology (for example, artificial neural network (Artificial Neural Network, ANN) ), decision tree (Decision tree), or Support Vector Machine (Support Vector Machine, SVM), etc.) to make decisions on the evaluation of network traffic. The processor 150 may use several historical network packets (representing network packets received in a certain period of time in the past) and their actual traffic as several training samples. Similarly or similarly, the processor 150 parses and counts the number of queries for each domain name in the historical network packets, and counts the actual traffic corresponding to each domain name (the network received and/or transmitted from the specific domain name) The total size of the packet). The processor 150 uses those training samples (ie, training set) to train the prediction model based on the machine learning technology. For example, the processor 150 obtains the prediction model through steps such as error function definition, feature extraction, difference minimization, and classification generation. The processor 150 can input the number of queries for each domain name counted in step S330 into this estimation model to obtain the corresponding network traffic.

Figure 4 is an example illustrating the comparison between actual flow and estimated flow. Please refer to Figure 4, assuming that this estimation model is for 68 domain names. The number of queries counted from February 15 to February 26 and the corresponding actual traffic are used as the training set, and the number of queries counted from February 26 to April 14 is used as the input to the validation set. It can be drawn from the figure that the estimated flow rate 401 obtained by the prediction model almost overlaps the actual flow rate 402. The accuracy of the training set is almost 100%, and the accuracy of the verification set can be higher than 97% (this value may change and the present invention is not limited). It can be seen that the existing machine learning algorithms can already provide extremely high inference accuracy.

It should be noted that, in other embodiments, the processor 150 may also obtain the corresponding relationship between the number of queries and the network traffic based on algorithms such as arithmetic average and inferential statistics, and estimate the network traffic based on the corresponding relationship.

In an embodiment, the processor 150 may obtain the traffic contribution coefficient of each domain name. This traffic contribution factor is the traffic corresponding to one query of the domain name. The processor 150 may obtain the flow contribution coefficient based on machine learning or other algorithms. For example, the number of queries for a specific domain name is set to once, and network traffic is obtained based on the foregoing correspondence relationship. It should be noted that the number of queries may be set more than once, but the traffic contribution coefficient of all domain names must be standardized. The processor 150 can then determine the network traffic corresponding to the number of queries of each domain name according to the traffic contribution coefficients of these domain names. For example, the processor 150 multiplies the number of queries by the corresponding traffic contribution coefficient as the estimated network traffic. It should be noted that, in some embodiments, the aforementioned algorithm may be different depending on requirements for assigning weights, biases, or considering other parameters.

For example, Table (3) is an example to illustrate the statistics of network services: Domain service Number of queries .i9.ytime.com YouTube 6871 .apps-mzstatic-cdn-itunes-apple.com.akadns.net iTunes 1356 .r2---sn-45gx5unvox-u2xee.googlevideo.com YouTube 4110 .doc.google.com Google Docs 4614 .accounts.google.com Google Account 19869 .r1—sn-45gx5nuvox-u2xee.googlevideo.com YouTube 4409 Among them, the estimated network traffic is the product of the traffic contribution coefficient times the number of queries.

Depending on the location of the networked device 100, the network packet received in step S310 may flow through the access network, the transmission network, or the core network. In one embodiment, the processor 150 can determine the network traffic flowing through the access network, transmission network, or core network based on the network traffic corresponding to all network names (that is, representing the total network under the network to which it belongs). Road flow). For example, if the networked device 100 is in the core network, the processor 150 sums up the network traffic corresponding to all domain names to represent the total network traffic of the core network. It should be noted that, according to different requirements, network traffic of a specific domain name may be given weight or deviation. Based on the estimated result, the operator can evaluate whether the equipment deployment or management configuration of this network is appropriate or sufficient.

In some embodiments, the processor 150 can further estimate the traffic of the network node according to the routing strategy.

In another embodiment, the processor 150 can set several network service application types. For example, the type of network service application may be video streaming, social media, online games, shopping websites, etc., or the name of a specific network service (for example, YouTube, Douyin, Taobao, etc.). Each domain name may correspond to one or more network service application types. For example, Facebook may correspond to social media, live streaming, shopping and other types. The processor 150 may determine the corresponding network traffic of each network service application type used by the user or those users according to the number of queries of those domain names by one user or more users (corresponding to the user equipment UE). That is, to analyze the network traffic of each network service application type based on the network service orientation. For example, the total traffic of YouTube services in Table (3). Since the number of queries and/or the amount of network traffic can reflect the user’s preference for a particular type or the degree of common use, the processor 150 can further determine the network to which the user belongs based on the corresponding network traffic of each network service application type. Service application type. Each user may belong to one or more types of web service applications. The processor 150 may generate a tag of the type feature for each user according to the type analysis result. For example, tags such as video, shopping, games, etc. Taking Table (3) as an example, the product of all YouTube traffic and weight accounts for the highest proportion, and the processor 150 determines that the user is tagged as an audiovisual user. Based on the estimated results, operators can provide additional services such as proxies and cache servers for users with different tags to improve the Internet experience of specific service types.

In summary, the networking device and the traffic estimation method of the embodiment of the present invention accurately predict the correspondence between the domain name query and the network traffic of the application service in each layer of the network, and can be further applied to Core network, transmission/IP network, then access and wireless/wired network. Not only can the service traffic of each layer of the network be estimated in real time (or almost instantly), but also the network node traffic can be estimated. On the other hand, based on the domain query records, the type characteristics are automatically generated for the users, and the labels that meet each user are obtained accordingly to understand the service needs of the users. In this way, the management plan of the software and hardware in the system architecture can be further improved based on the evaluation result, thereby improving the user's online experience.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention. Anyone with ordinary knowledge in the technical field can make some changes and modifications without departing from the spirit and scope of the present invention. The scope of protection of the present invention shall be determined by the scope of the attached patent application.

100: networked devices 110: Communication transceiver 130: storage 150: processor 20: Communication system 21: Access to the Internet 22: Transmission/IP network 23: core network 24: Internet UE: User Equipment BS: base station S310~S350: steps 401: Estimated traffic 402: Actual flow

FIG. 1 is a block diagram of components of a networked device according to an embodiment of the invention. Fig. 2 is a schematic diagram of a communication system according to an embodiment of the invention. Fig. 3 is a flowchart of a flow estimation method according to an embodiment of the present invention. Figure 4 is an example illustrating the comparison between actual flow and estimated flow.

S310~S350: steps

Claims (10)

A flow estimation method, including: Capture multiple network packets; Count the number of queries for at least one domain name in the network packets; and Determine a network traffic based on the number of queries. For example, in the traffic estimation method described in item 1 of the scope of patent application, the step of judging the network traffic according to the number of queries includes: Take multiple historical network packets and their corresponding actual traffic as multiple training samples; Use the training samples to train a prediction model based on machine learning technology; and Input the number of queries into the estimation model to obtain the network traffic. For example, in the traffic estimation method described in item 1 or item 2 of the scope of patent application, the steps of judging the network traffic based on the number of queries include: Obtain a traffic contribution coefficient for each domain name, where the traffic contribution coefficient is the traffic corresponding to one query for the domain name; and The network traffic corresponding to the number of queries of each domain name is determined according to the traffic contribution coefficient of the at least one domain name respectively. Such as the traffic estimation method described in item 2 or item 3 of the scope of the patent application, wherein the network packets flow through one of an access network, a transmission network and a core network , And the steps for judging the network traffic based on the number of queries include: Determine the network traffic flowing through the access network, the transmission network or the core network based on all the network traffic corresponding to the at least one network name. For example, in the method of traffic estimation described in item 2 or item 3 of the scope of patent application, the steps of judging the network traffic based on the number of queries include: Set multiple network service application types, where each domain name corresponds to at least one network service application type; Judging the corresponding network traffic of each network service application type used by the user according to the number of queries made by a user for the at least one domain name; and According to the corresponding network traffic of each network service application type, a network service application type to which the user belongs is determined. A networking device includes: A communication transceiver that receives multiple network packets; and A processor, coupled to the communication transceiver, and configured to execute: Capture these network packets; Count the number of queries for at least one domain name in the network packets; and Determine a network traffic based on the number of queries. The networked device described in claim 6 wherein the processor is configured to execute: Take multiple historical network packets and their corresponding actual traffic as multiple training samples; Use the training samples to train a prediction model based on machine learning technology; and Input the number of queries into the estimation model to obtain the network traffic. Such as the networked device described in item 6 or item 7 of the scope of patent application, wherein the processor is configured to execute: Obtain a traffic contribution coefficient for each domain name, where the traffic contribution coefficient is the traffic corresponding to one query for the domain name; and The network traffic corresponding to the number of queries of each domain name is determined according to the traffic contribution coefficient of the at least one domain name respectively. For example, the networked device described in item 7 or item 8 of the scope of patent application, wherein the network packets flow through one of an access network, a transmission network, and a core network, and the processor Configured to execute: Determine the network traffic flowing through the access network, the transmission network or the core network based on all the network traffic corresponding to the at least one network name. Such as the networked device described in item 7 or item 8 of the scope of patent application, wherein the processor is configured to execute: Set multiple network service application types, where each domain name corresponds to at least one network service application type; Judging the corresponding network traffic of each network service application type used by the user according to the number of queries made by a user for the at least one domain name; and According to the corresponding network traffic of each network service application type, a network service application type to which the user belongs is determined.

Images