TWI718778B - Network connected apparatus and traffic estimation method thereof - Google Patents

Abstract

A network connected apparatus and a traffic estimation method thereof are provided. In the method, multiple network packets are captured, the query frequency for at least one domain name in the network packets are counted, and the network traffic of each network layer or each service type is determined according to the query frequency. In addition, a corresponding type feature is generated for the user based on domain name query record in the embodiments. Accordingly, the Internet experience of the user can be improved based on the evaluated result.

Description

Networking device and its flow estimation method

The present invention relates to a network management technology, and particularly relates to a networked device and a method for estimating traffic.

Nowadays, almost everyone has Internet-connected devices (for example, mobile phones, tablets, laptops, smart watches, smart home appliances, etc.), and these devices can be connected via mobile networks and other wireless networks. Connect to the Internet through a road or wired network. With the diversified development of network application services (for example, social media, streaming media, online games, digital education, etc.), the number of users and usage of network operators has also increased exponentially. In order to provide users with a better Internet experience, operators continue to actively increase or upgrade hardware devices. In addition to hardware updates, operators will also configure network resources through network management. However, different users have different requirements for application services. Therefore, how to provide more suitable network management, equipment deployment, and software and hardware configuration for each user, company, government or enterprise is the effort of all operators. One of the goals.

In view of this, the embodiments of the present invention provide a networked device and a method for estimating its traffic. The network traffic is obtained based on the query of the domain name, and the behavior of the user using the service is evaluated accordingly, and then the equipment deployment and deployment are adjusted based on the analysis result. Software and hardware configuration.

The traffic estimation method of the embodiment of the present invention includes the following steps: capturing several network packets, counting the number of queries for at least one domain name in those network packets, and judging the network based on the number of queries flow.

The networking device in the embodiment of the present invention includes, but is not limited to, a communication transceiver and a processor. The communication transceiver is used to receive several network packets. The processor is coupled to the communication transceiver. The processor retrieves those network packets, and counts the number of queries for at least one domain name in those network packets. Judge the network traffic based on the number of queries.

Based on the above, the networked device and the traffic estimation method of the embodiment of the present invention predicts the network traffic by analyzing the domain name query, and then evaluates the types of network service applications that the user intends to use or commonly used. These evaluations of traffic and user characteristics can serve as network operators to provide better plans for equipment deployment, resource allocation, management configuration, etc., so as to enhance users' online experience.

In order to make the above-mentioned features and advantages of the present invention more comprehensible, the following specific embodiments are described in detail in conjunction with the accompanying drawings.

100: networked devices

110: Communication transceiver

130: storage

150: processor

20: Communication system

21: Access to the Internet

22: Transmission/1P network

23: core network

24: Internet

UE: User Equipment

BS: base station

S310~S350: steps

401: Estimated traffic

402: actual flow

FIG. 1 is a block diagram of components of a networked device according to an embodiment of the present invention.

Fig. 2 is a schematic diagram of a communication system according to an embodiment of the present invention.

Fig. 3 is a flowchart of a flow estimation method according to an embodiment of the present invention.

Figure 4 is an example illustrating the comparison between the actual flow rate and the estimated flow rate.

FIG. 1 is a block diagram of components of a networked device 100 according to an embodiment of the present invention. Please refer to FIG. 1, the networked device 100 includes but is not limited to a communication transceiver 110, a storage 130 and a processor 150. The networked device 100 may be a computer, a smart phone, a tablet computer, a server, a router, a switch, a telecommunication device, or other electronic devices.

The communication transceiver 110 can be a communication transceiver that supports fourth-generation (4G) or other generations of mobile communications, Wi-Fi, Ethernet, optical fiber networks, etc., or it can be a universal serial bus (Universal Serial Bus). Serial Bus, USB), Thunderbolt or other communication transmission interface. In the embodiment of the present invention, the communication transceiver 110 is used to receive network packets. The network packet is the unit of data transmitted in the network.

The storage 130 can be any type of fixed or removable random access memory (Random Access Memory, RAM), read-only memory (Read-Only Memory, ROM), flash memory (Flash Memory), and traditional hard drives. Hard Disk Drive (HDD), Solid-State Drive (SSD) or similar components or a combination of the above components. In the embodiment of the present invention, the storage 130 is used to store temporary or permanent data (for example, training samples, prediction models, traffic contribution coefficients, Network service application types, etc.), network packets, software modules or other files, and the detailed content will be described in subsequent embodiments.

The processor 150 is coupled to the communication transceiver 110 and the storage 130. The processor 150 may be a central processing unit (CPU), or other programmable general-purpose or special-purpose microprocessors (Microprocessor ), Digital Signal Processor (DSP), programmable controller, Application-Specific Integrated Circuit (ASIC) or other similar components or a combination of the above components. In the embodiment of the present invention, the processor 150 is used to perform all operations of the networked device 100, and can load and execute various software modules, files, and data recorded in the storage 130.

It should be noted that the networked device 100 can be installed in any network. For example, FIG. 2 is a schematic diagram of a communication system 20 according to an embodiment of the invention. Please refer to FIG. 2, assuming that the communication system 20 belongs to the third generation (3G), fourth generation (4G) or other generations of mobile communication networks. The communication system 20 may include a user equipment UE, a base station BS, an access network 21, an Internet Protocol (IP) network 22, a core network 23, and an Internet 24. Depending on actual needs, the networked device 100 can be set in a transmission/Internet Protocol (IP) network 22, a core network 23, or a wireless network formed by the user equipment UE and the base station BS. That is, the networked device 100 is located at a certain network node of the network to which it belongs (it can be an input or output gateway between two networks, or a node located on a specific routing path).

It should be noted that in other embodiments, according to different system architectures, FIG. 2 The wireless network can also be replaced with a Wi-Fi wireless network, or replaced with a wired Ethernet network, digital subscriber line (Digital Subscriber Line, DSL), optical fiber network, or cable network, and access to the network 21. The equipment in the transmission/IP network 22 and/or the core network 23 can also be changed accordingly, and the present invention is not limited.

In order to facilitate the understanding of the operation flow of the embodiment of the present invention, a number of embodiments will be given below to describe in detail the method for estimating network traffic by the networking device 100 in the embodiment of the present invention. Hereinafter, various components and modules in the networked device 100 will be used to illustrate the method according to the embodiment of the present invention. Each process of the method can be adjusted accordingly according to the implementation situation, and is not limited to this.

Fig. 3 is a flowchart of a flow estimation method according to an embodiment of the present invention. Referring to FIG. 3, the processor 150 captures the network packet through the communication transceiver 110 (step S310). Specifically, the processor 150 can capture network packets through software or libraries such as Wireshark, tcpdump, SmartSniff, libpcap, winpcap, or similar, and further analyze the received network packets. In one embodiment, the processor 150 at least has the function of resolving domain name system (Domain Name System, DNS) queries/quests, or DNS-related packets, and can derive all the desired DNS-related packets. The query domain name (and/or corresponding IP address).

For example, Table (1) is an example illustrating the results of packet parsing for DNS queries:

It should be noted that, depending on the network where the networked device 100 is located, the number of nodes that can be monitored may be as high as tens of thousands, or may be less than 10, but the embodiment of the present invention does not limit the number of monitoring nodes.

Next, the processor 150 counts the number of queries for one or more domain names in those network packets (step S330). In an embodiment, the processor 150 may set a specific time length (for example, 5, 15, or 30 minutes, etc.) and/or frequency (for example, One a day Times, three times a week, 10 times a month, etc.), the present invention is not limited. The processor 150 may further add up the number of DNS queries for each domain name within a statistical time (for example, 15 minutes, one day, or one month, etc.) to obtain the number of queries for these domain names respectively.

For example, Table (2) is an example to illustrate the statistical results of DNS queries:

Next, the processor 150 determines the network traffic based on the number of queries (step S350). Specifically, in the initial stage of most network behaviors, the user terminal will issue a DNS query to obtain the corresponding network address, and further connect to remote servers or other electronic devices based on the network address. The domain, website and even network service that the user terminal wants to access can be learned from the DNS query. For example, www.facebook.com is a social media service, and www.youtube.com is a video streaming service. In addition, as a result of experiments or statistics, different network services may correspond to different network traffic. Based on the foregoing layer-by-layer relationship, the embodiment of the present invention estimates the network traffic of the monitoring node or group by querying the correspondence relationship between the domain name and the network traffic.

In one embodiment, the present invention relies on artificial intelligence (Artificial Intelligence) Intelligence, AI) technology’s high-accuracy inference effect, and through AI's machine learning technology (for example, Artificial Neural Network (ANN), Decision tree, or Support Vector Machine) (Support Vector Machine, SVM), etc.) to make decisions on the evaluation of network traffic. The processor 150 may use several historical network packets (representing network packets received in a certain period of time in the past) and their actual traffic as several training samples. Similarly or similarly, the processor 150 parses and counts the number of queries for each domain name in the historical network packet, and counts the actual traffic corresponding to each domain name (the network received and/or transmitted from the specific domain name) The total size of the packet). The processor 150 uses those training samples (ie, training set) to train the prediction model based on the machine learning technology. For example, the processor 150 obtains the prediction model through steps such as error function definition, feature extraction, difference minimization, and classification generation. The processor 150 can input the number of queries for each domain name counted in step S330 into the estimation model to obtain the corresponding network traffic.

Figure 4 is an example illustrating the comparison between the actual flow rate and the estimated flow rate. Please refer to Figure 4, assuming that this estimation model is for 68 domain names. The number of queries counted from February 15 to February 26 and the corresponding actual traffic are used as the training set, and the number of queries counted from February 26 to April 14 is used as the input of the validation set. It can be drawn from the figure that the estimated flow rate 401 obtained by the prediction model almost overlaps the actual flow rate 402. The accuracy of the training set is almost 100%, and the accuracy of the verification set can be higher than 97% (this value may change and the present invention is not limited). It can be seen that the existing machine learning algorithms can already provide extremely high inference accuracy.

It should be noted that in other embodiments, the processor 150 may also be based on Algorithms such as averaging, inferential statistics, etc. obtain the corresponding relationship between the number of queries and the network traffic, and estimate the network traffic based on this corresponding relationship.

In one embodiment, the processor 150 may obtain the traffic contribution coefficient of each domain name. This traffic contribution factor is the traffic corresponding to one query of the domain name. The processor 150 may obtain the flow contribution coefficient based on machine learning or other algorithms. For example, the number of queries for a specific domain name is set to once, and network traffic is obtained based on the foregoing correspondence relationship. It should be noted that the number of queries may be set more than once, but the traffic contribution coefficients of all domain names must be standardized. The processor 150 can then determine the network traffic corresponding to the number of queries of each domain name according to the traffic contribution coefficients of these domain names. For example, the processor 150 multiplies the number of queries by the corresponding traffic contribution coefficient as the estimated network traffic. It should be noted that, in some embodiments, the aforementioned algorithm may be different depending on the requirements for assigning weights, biases, or considering other parameters.

其中，預估的網路流量是流量貢獻係數乘以查詢次數的乘積。 For example, Table (3) is an example to illustrate the statistics of network services:

Among them, the estimated network traffic is the product of the traffic contribution factor multiplied by the number of queries.

Depending on the location of the networked device 100, the network packet received in step S310 may flow through the access network, the transmission network, or the core network. In one embodiment, the processor 150 can determine the network traffic flowing through the access network, transmission network, or core network based on the network traffic corresponding to all network names (that is, representing the total network under the network to which it belongs). Road flow). For example, if the networked device 100 is in the core network, the processor 150 sums up the network traffic corresponding to all domain names to represent the total network traffic of the core network. It should be noted that, according to different needs, network traffic of a specific domain name may be given weight or deviation. Based on the estimated result, the operator can evaluate whether the equipment deployment or management configuration of this network is appropriate or sufficient.

In some embodiments, the processor 150 can further estimate the traffic of the network node according to the routing strategy.

In another embodiment, the processor 150 can set several network service application types. For example, the type of network service application may be video streaming, social media, online game, shopping website, etc., or the name of a specific network service (for example, YouTube, Douyin, Taobao, etc.). Each domain name may correspond to one or more network service application types. For example, Facebook may correspond to social media, live streaming, shopping and other types. The processor 150 may determine whether the user or those users use the number of queries made by one user or more users (corresponding to the user equipment UE) for those domain names. Use the corresponding network traffic of each network service application type. That is, to analyze the network traffic of each network service application type based on the network service orientation. For example, the total traffic of YouTube services in Table (3). Since the number of queries and/or the amount of network traffic can reflect the user’s preference for a particular type of use, or the degree of common use, the processor 150 can further determine the network to which the user belongs based on the corresponding network traffic of each network service application type. Service application type. There may be one or more types of web service applications to which each user belongs. The processor 150 may generate a tag of the type characteristic for each user according to the type analysis result. For example, tags such as video, shopping, games, etc. Taking Table (3) as an example, if the product of all YouTube traffic and weight accounts for the highest proportion, the processor 150 determines that the user is tagged as an audiovisual user. Based on the estimated results, operators can provide additional services such as proxies and cache servers for users with different tags to improve the Internet experience of specific service types.

In summary, the networked device and the method for estimating the traffic of the embodiment of the present invention accurately predict the corresponding relationship between the domain name query and the network traffic of the application service in each layer of the network, and can be further applied to Core network, transmission/IP network, then access and wireless/wired network. Not only can the service traffic of each layer of the network be estimated in real time (or almost instantly), but also the network node traffic can be estimated. On the other hand, based on the domain query records, type characteristics are automatically generated for users, and tags that meet each user are obtained accordingly to understand the user's service needs. In this way, the management plan of the software and hardware in the system architecture can be further improved based on the evaluation result, thereby improving the user's online experience.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention. Anyone with ordinary knowledge in the relevant technical field will not depart from the present invention. Within the spirit and scope, some changes and modifications can be made, so the scope of protection of the present invention shall be subject to those defined by the attached patent scope.

S310~S350: Steps

Claims (10)

A flow estimation method includes: capturing multiple network packets, wherein the network packets flow through an access network, a transmission network, and an Internet Protocol (IP) network One of a network and a core network; counting the number of queries for at least one domain name in the network packets, including: parsing the at least one domain to be queried for the network packets Name; and respectively sum up the number of queries for each domain name to obtain the number of queries; and determine a network traffic based on the number of queries. For example, in the method of traffic estimation described in item 1 of the scope of patent application, the step of judging the network traffic based on the number of queries includes: taking multiple historical network packets and their corresponding actual traffic as multiple training samples; based on machine learning The technology uses the training samples to train a predictive model; and inputs the number of queries into the predictive model to obtain the network traffic. For example, in the traffic estimation method described in item 1 of the scope of patent application, the step of judging the network traffic according to the number of queries includes: obtaining a traffic contribution coefficient of each domain name, wherein the traffic contribution coefficient is the The traffic corresponding to the domain name query once; and the traffic contribution coefficient of the at least one domain name is used to determine each network The network traffic corresponding to the number of queries of the domain name. For example, in the method of traffic estimation described in item 2 or item 3 of the scope of patent application, the step of judging the network traffic according to the number of queries includes: judging the network traffic corresponding to all the at least one network name. The network traffic of the access network, the transmission network, the IP network, or the core network. For example, in the method of traffic estimation described in item 2 or item 3 of the scope of patent application, the step of judging the network traffic according to the number of queries includes: setting a plurality of network service application types, and each of the domain names is at least Corresponding to a network service application type; judging the user's use of the corresponding network traffic of each network service application type according to the number of queries made by a user for the at least one domain name; and according to each network The service application type corresponds to the network traffic to determine the type of the network service application to which the user belongs. A networking device includes: a communication transceiver that receives a plurality of network packets; and a processor coupled to the communication transceiver and configured to execute: capture the network packets, wherein the network packet It is one of an access network, a transmission network, an IP network, and a core network; counting the number of queries for at least one domain name in the network packets, including: resolving the The at least one domain name to be queried by some network packets; and the number of queries for each domain name are respectively added to obtain the query Times; and judging a network traffic based on the number of queries. The networked device described in item 6 of the scope of patent application, wherein the processor is configured to execute: take multiple historical network packets and their corresponding actual traffic as multiple training samples; use these training samples based on machine learning technology To train an estimation model; and input the number of queries into the estimation model to obtain the network traffic. For example, in the networked device described in item 6 of the scope of patent application, the processor is configured to execute: obtain a traffic contribution coefficient of each domain name, wherein the traffic contribution coefficient is the result of a query for the domain name once Corresponding traffic; and respectively determine the network traffic corresponding to the number of queries of each domain name according to the traffic contribution coefficient of the at least one domain name. For example, the networked device described in item 7 or item 8 of the scope of patent application, wherein the processor is configured to execute: judging that the network traffic corresponding to all the at least one network name flows through the access network, The network traffic of the transmission network, the IP network, or the core network. For example, the networked device described in item 7 or item 8 of the scope of patent application, wherein the processor is configured to execute: set a plurality of network service application types, wherein each domain name corresponds to at least one network Service application type; Determine the corresponding network traffic of the user using each of the network service application types based on the number of queries made by a user for the at least one domain name; and determine the corresponding network traffic of each of the network service application types A type of the network service application to which the user belongs.

Images