WO2022057355A1

WO2022057355A1 - Data packet recognition method and apparatus

Info

Publication number: WO2022057355A1
Application number: PCT/CN2021/101662
Authority: WO
Inventors: 卢嘉勋; 李秉帅; 邵云峰
Original assignee: 华为技术有限公司
Priority date: 2020-09-21
Filing date: 2021-06-22
Publication date: 2022-03-24
Also published as: CN114298116A

Abstract

The present application discloses a data packet recognition method and apparatus, which relate to the field of artificial intelligence. In the case where a new application is added, model training may be performed on the basis a data packet generated by the newly added application which is marked, wherein the calculation amount is small, and the training time is short. Said method comprises: acquiring a first target model, the first target model being used to extract first feature information of a first data packet, and determine a first application among a first application set corresponding to the first data packet; when a trigger condition is satisfied, acquiring a second target model, the second target model being used to extract second feature information of a second data packet, and determine a second application among a second application set corresponding to the second data packet; and acquiring a third data packet, and determining, according to the first target model and the second target model, a first application or a second application corresponding to the third data packet.

Description

Data packet identification method and device

This application claims the priority of the Chinese patent application with the application number 202010998077.8 and the application title "Data Packet Recognition Method and Device", which was submitted to the State Intellectual Property Office of China on September 21, 2020, the entire contents of which are incorporated herein by reference Applying.

technical field

The present application relates to the field of artificial intelligence, and in particular, to a method and device for identifying data packets.

Background technique

With the rapid development of the Internet, there are more and more Internet applications (Application, APP), for example,

and

etc. These applications generate data packets at runtime, and the data packets generated by different applications may have different network requirements. In order to implement differentiated management of data packets generated by different applications, it is first necessary to identify which application generated each data packet.

Currently, data packets can be identified through deep learning methods. For example, the data packet identification device can identify data packets generated by existing applications through the following methods: the data packet identification device will obtain a large number of marked data packets, which are data packets generated by existing applications; data packets The packet identification device will identify the characteristic information of each data packet, for example, the keyword of the application corresponding to the data packet; the data packet identification device will repeatedly train the model according to the identified characteristic information of each data packet, and through the training The model identifies newly received packets generated by existing applications.

In the development process of the Internet, in addition to existing applications, new applications will appear. In this case, the above-mentioned data packet identification device cannot identify the data packet generated by the newly added application. Therefore, the data packet identification device will again perform model training based on a large number of marked data packets, so that the trained model can identify data packets generated by existing applications and data packets generated by new applications. This process is not only computationally intensive, but also takes a long time to train. In addition, if new applications appear frequently, the data packet identification device needs to perform the above process frequently, and the data overhead and calculation overhead are relatively large.

SUMMARY OF THE INVENTION

The present application provides a method and device for identifying a data packet, which can perform model training based on the data packet generated by the marked new application in the case of a new application, with a small amount of calculation and a short training time.

To achieve the above object, the embodiments of the present application adopt the following technical solutions:

In a first aspect, an embodiment of the present application provides a method for identifying a data packet. The method includes: a first device obtains a first target model, and the first target model is used to extract first feature information of a first data packet, and determine the first target model. The first application in the first application set corresponding to the data packet; in the case of satisfying the trigger condition, the first device obtains the second target model, and the second target model is used to extract the second feature information of the second data packet, and determine the first The second application in the second application set corresponding to the two data packets, the first application in the first application set is different from the second application in the second application set; the first device acquires the third data packet, according to the first target model and the second target model to determine the first application or the second application corresponding to the third data packet.

In the method provided by the above-mentioned first aspect, when a new application appears after using the first target model (the new application is the application in the second application set), the first device does not need to use the marked first application Perform model training on the data packets of the first application set and the data packets of the second application to obtain a model that can identify both the data packets of the applications in the first application set and the data packets of the applications in the second application set. The first device can perform model training according to the marked data packets of the second application to obtain the second target model, and subsequently, identify the data packets of the applications in the first application set according to the first target model and the second target model , or a data packet of an application in the second application set. Because the number of marked data packets of the second application is much smaller than the number of marked data packets of the first application and the number of data packets of the second application, in the method provided by the first aspect, the first device's The amount of computation is small and the training time is short. In addition, in the method provided in the first aspect, in the case of a newly added application, the first device uses the data package of the marked second application for model training, so the marked first application can be released data packets, reducing the cost of data storage.

A possible implementation manner, where the first device acquires the second target model, includes: the first device receives information from the server of the first initial model and a list of second applications included in the second application set, where the first initial model is based on Determined by the number of applications in the second application set, the list of second applications is used to indicate the correspondence between the second application in the second application set and the output end of the first initial model; The marked data packet of the second application trains the first initial model to obtain the first intermediate model; the first device sends the information of the first intermediate model to the server; the first device receives the information of the second target model from the server, the second The information of the target model is obtained by aggregating information from intermediate models of multiple first devices; the first device obtains the second target model according to the information of the second target model and the first initial model. Based on the above method, a device participating in model training, such as a first device, can receive information about the first initial model from the server and a list of second applications included in the second application set, and train according to the marked data packets of the second application For the first initial model, the first intermediate model is obtained, and the information of the first intermediate model is sent to the server, so that the server aggregates the information of the intermediate models from multiple first devices to obtain the information of the second target model. Subsequently, the first device may receive the information of the second target model from the server, and obtain the second target model according to the information of the second target model and the first initial model. On the one hand, all devices participating in the model training can obtain a model that can finally identify the data packets applied in the second application set. On the other hand, in the above method, the server does not need to perform model training, but delegates the model training process to the devices participating in the model training. The number of marked data packets used by each device participating in the model training when training the model is also It is less than the number of marked data packets used by the server to train the model. For these devices, the amount of calculation is not large, and it can also save the time of model training.

In a possible implementation manner, the first device obtains the second target model, and further includes: the first device obtains the data packet of the second application; the first device sends the data packet of the second application to the server; the first device receives the data packet from the server. Annotated data packets of the second application. Based on the above method, the first device can send the data packet of the second application to the server, so that the server can mark the data packet conveniently.

A possible implementation manner, the trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold; or, the trigger condition is that the number of data packets applied in the second application set is greater than or equal to the second threshold; Alternatively, the trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets applied in the second application set is greater than or equal to the second threshold. Based on the above method, when the number of newly added applications reaches the first threshold, or when the number of unidentifiable data packets is greater than the second threshold, or when the number of newly added applications reaches the first threshold, And when the number of unidentifiable data packets is greater than the second threshold, the first device may be triggered to acquire the second target model. In this way, on the one hand, it can be avoided that the first device frequently acquires the second target model, resulting in excessive computational overhead of the first device. On the other hand, it can be avoided that the first device does not acquire the second target model for a long time, resulting in the generation of a large number of unidentified data packets, which affects the use of services.

In a possible implementation manner, the first device determines the first application or the second application corresponding to the third data packet according to the first target model and the second target model, including: the first device obtains the third data packet according to the first target model. The first output entropy of the data packet, the first output entropy is used to indicate the probability that the application corresponding to the third data packet is the application predicted by the first target model; the first device obtains the second data packet according to the second target model. The output entropy, the second output entropy is used to indicate the probability that the application corresponding to the third data packet is the application predicted by the second target model; The application predicted by the target model is determined as the application corresponding to the third data packet. Based on the above method, the first device can determine the application corresponding to the third data packet according to the first output entropy and the second output entropy, thereby realizing the combination of the first target model and the second target model to identify the application. In this way, in the case of a newly added application, the first device does not need to perform model training according to the marked data packets of the first application and the data packets of the second application to obtain an application that can both identify the first application set The data packets of the second application set are also capable of identifying the data packet models of the applications in the second application set.

A possible implementation manner, the method further includes: the first device obtains a second initial model, and the second initial model is determined according to the number of applications in the first application set and the number of applications in the second application set; A device trains a second initial model to obtain a third target model according to the labeling results of the data packets obtained by the first device based on the first target model and the second target model, and the third target model is used to extract third feature information, and according to The third characteristic information determines the application corresponding to the data packet corresponding to the third characteristic information, the third characteristic information includes characteristic information of the data packet corresponding to the third characteristic information, and the data packet corresponding to the third characteristic information is the application in the first application set The data packet, or the data packet of the application in the second application set. Based on the above method, the first device can obtain the second initial model, and train the second initial model to obtain the third target model according to the first target model and the labeling result of the data packet obtained by the first device by the second target model. Subsequently, the first device can identify the data packet according to the third target model, which can save time for the first device to identify the data packet. In addition, by continuously compressing the model, the first device can stabilize the size of the model, which is beneficial to the deployment of the model in the system-on-chip.

A possible implementation manner, the method further includes: the first device, according to the marked data packets used when acquiring the first target model, and/or the marked data packets used when acquiring the second target model, train the first device. A three-target model is obtained, and a third target model after training is obtained. Based on the above method, the first device can train the third target model according to the marked data packet used when acquiring the first target model, and/or the marked data packet used when acquiring the second target model, so that after training The accuracy of the third target model is higher and the identification of data packets is more accurate.

A possible implementation manner, the method further includes: the first device receives indication information from a server, where the indication information is used to instruct the first device to retrain a data packet for identifying the first application and the second application The fourth destination model of the packet. Based on the above method, the server may instruct the first device to retrain the model, so that the trained model can identify the data packets applied in the first application set and the data packets applied in the second application set.

In a second aspect, an embodiment of the present application provides a method for identifying a data packet. The method includes: the server obtains information of a first target model, and the first target model is used to extract the first feature information of the first data packet, and determine the first target model. The first application in the first application set corresponding to the data packet; the server sends the information of the first target model to the first device; when the trigger condition is met, the server obtains the information of the second target model, and the second target model is used for extracting the second feature information of the second data packet, and determining the second application in the second application set corresponding to the second data packet, where the first application in the first application set is different from the second application in the second application set; the server Send information of the second target model to the first device.

In the method provided by the above second aspect, on the one hand, the server does not need to perform model training, but delegates the model training process to the devices (the first device and the second device) participating in the model training, and the server transfers the data from the middle of multiple devices. The information of the model can be aggregated, which reduces the computing overhead of the server. On the other hand, in the case where a new application appears after using the first target model, the first device does not need to perform model training according to the marked data packets of the first application and the second application, and obtain a model that can both The data packets of the applications in the first application set are identified, and the model of the data packets of the applications in the second application set can be identified. The first device performs model training according to the marked data packets of the second application to obtain a second target model, and subsequently, identifies the data packets of the applications in the first application set according to the first target model and the second target model, or Data packets of applications in the second set of applications. The number of marked data packets of the second application is much smaller than the number of marked data packets of the first application and the second application, so the calculation amount of the first device is small and the training time is short. . In addition, in the method provided in the above second aspect, in the case of a newly added application, the first device uses the data package of the marked second application for model training, so the marked first device can be released. Application data package, reducing the cost of data storage.

A possible implementation manner, the server acquiring the information of the second target model includes: the server sending the information of the first initial model and the list of the second applications included in the second application set to the first device, the first initial model is based on the first initial model. The number of applications in the second application set is determined, and the list of the second application is used to indicate the corresponding relationship between the second application in the second application set and the output end of the first initial model; the server receives the first intermediate model from the first device. information, the first intermediate model is obtained by the first device training the first initial model according to the marked data packets of the second application obtained by the first device; the server sends the information of the first initial model and the first initial model to the second device. 2. A list of applications; the server receives the information of the second intermediate model from the second device, and the second intermediate model is obtained by the second device training the first initial model according to the marked data packets of the second application obtained by the second device ; the server aggregates the information of the first intermediate model and the information of the second intermediate model to obtain the information of the second target model. Based on the above method, the server can send the information of the first initial model and the list of the second application to the device participating in the model training, such as the first device, so that the first device can train the first initial model according to the marked data packets of the second application. model, obtain the first intermediate model, and send the information of the first intermediate model to the server. After receiving the information of the intermediate models from multiple devices, the server aggregates the information of the multiple intermediate models to obtain the information of the second target model, and sends the information of the second target model to the first device so that the first device can According to the information of the second target model and the first initial model, the second target model is obtained. On the one hand, all devices participating in the model training can obtain a model that can finally identify the data packets applied in the second application set. On the other hand, in the above method, the server does not need to perform model training, but delegates the model training process to the devices participating in the model training. The number of marked data packets used by each device participating in the model training when training the model is also It is less than the number of marked data packets used by the server to train the model. For these devices, the amount of calculation is not large, and it can also save the time of model training.

In a possible implementation manner, the server obtains the information of the second target model, and further includes: the server receives the data packet of the second application from the first device; the server obtains the marked data packet of the second application according to the data packet of the second application. data packet; the server sends the marked data packet of the second application to the first device. Based on the above method, the server may receive the data packet of the second application from the first device, and mark the data packet, so that the first device can perform model training according to the marked data packet.

A possible implementation manner, the trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold; or, the trigger condition is that the number of data packets applied in the second application set is greater than or equal to the second threshold; Alternatively, the trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets applied in the second application set is greater than or equal to the second threshold. Based on the above method, when the number of newly added applications reaches the first threshold, or when the number of unidentifiable data packets is greater than the second threshold, or when the number of newly added applications reaches the first threshold, And if the number of unidentifiable data packets is greater than the second threshold, the server may be triggered to acquire information of the second target model. In this way, on the one hand, it can be avoided that the server frequently obtains the information of the second target model, resulting in excessive computing overhead of the server. On the other hand, it can be avoided that the server does not acquire the information of the second target model for a long time, resulting in the generation of a large number of unidentified data packets, which affects the use of services.

A possible implementation manner, the method further includes: if the correct rate of identifying the data packets between the first target model and the second target model is less than or equal to a third threshold, the server sends indication information to the first device, and the indication information is used to indicate the first device. A device retrains a fourth target model for identifying packets of the first application and packets of the second application. Based on the above method, when the correct rate of identifying data packets between the first target model and the second target model is less than or equal to the third threshold, the server may instruct the first device to retrain the model, so that the trained model can identify the first application the data packet and the data packet of the second application.

In a third aspect, an embodiment of the present application provides an apparatus for identifying a data packet, which can implement the method in the first aspect or any possible implementation manner of the first aspect. The apparatus comprises corresponding units or components for carrying out the above-described method. The units included in the apparatus may be implemented by software and/or hardware. The apparatus may be, for example, a first device, or a chip, a chip system, or a processor that can support the first device to implement the above method.

In a fourth aspect, an embodiment of the present application provides an apparatus for identifying a data packet, which can implement the method in the second aspect or any possible implementation manner of the second aspect. The apparatus comprises corresponding units or components for carrying out the above-described method. The units included in the apparatus may be implemented by software and/or hardware. The apparatus can be, for example, a server, or a chip, a chip system, or a processor that can support the server to implement the above method.

In a fifth aspect, an embodiment of the present application provides an apparatus for identifying a data packet, including: a processor, where the processor is coupled to a memory, and the memory is used to store a program or an instruction, when the program or the instruction is processed by the When the device is executed, the device is made to implement the method described in the first aspect or any possible implementation manner of the first aspect.

In a sixth aspect, an embodiment of the present application provides an apparatus for identifying a data packet, including: a processor, the processor is coupled to a memory, and the memory is used to store a program or an instruction, when the program or instruction is processed by the When the device is executed, the device is made to implement the method described in the second aspect or any possible implementation manner of the second aspect.

In a seventh aspect, an embodiment of the present application provides an apparatus for identifying a data packet, where the apparatus is configured to implement the method described in the first aspect or any possible implementation manner of the first aspect.

In an eighth aspect, an embodiment of the present application provides an apparatus for identifying a data packet, where the apparatus is configured to implement the method described in the second aspect or any possible implementation manner of the second aspect.

In a ninth aspect, an embodiment of the present application provides a computer-readable medium on which a computer program or instruction is stored, and when the computer program or instruction is executed, enables a computer to perform the above-mentioned first aspect, or any possibility of the first aspect method described in the implementation of .

In a tenth aspect, an embodiment of the present application provides a computer-readable medium on which a computer program or instruction is stored, and when the computer program or instruction is executed, enables a computer to execute the second aspect or any possibility of the second aspect. method described in the implementation of .

In an eleventh aspect, an embodiment of the present application provides a computer program product, which includes computer program code, and when the computer program code is run on a computer, enables the computer to execute the above-mentioned first aspect, or any possible possibility of the first aspect. Implement the method described in the method.

In a twelfth aspect, an embodiment of the present application provides a computer program product, which includes computer program code, and when the computer program code is run on a computer, enables the computer to execute the second aspect or any of the possibilities of the second aspect. Implement the method described in the method.

In a thirteenth aspect, an embodiment of the present application provides a chip, including: a processor, where the processor is coupled to a memory, and the memory is used to store a program or an instruction, and when the program or instruction is executed by the processor , so that the chip implements the method described in the first aspect or any possible implementation manner of the first aspect.

In a fourteenth aspect, an embodiment of the present application provides a chip, including: a processor, where the processor is coupled to a memory, and the memory is used to store programs or instructions, and when the programs or instructions are executed by the processor , so that the chip implements the method described in the second aspect or any possible implementation manner of the second aspect.

In a fifteenth aspect, an embodiment of the present application provides a data packet identification system. The system includes the device described in the third aspect and/or the device described in the fourth aspect, or the system includes the device described in the fifth aspect and/or the device described in the sixth aspect, or the system It includes the device of the seventh aspect and/or the device of the eighth aspect.

It can be understood that any identification device, chip, computer readable medium, computer program product or identification system of the data packet provided above are all used to execute the corresponding method provided above. For the beneficial effects that can be achieved, reference may be made to the beneficial effects in the corresponding method, which will not be repeated here.

In a sixteenth aspect, an embodiment of the present application provides a method for identifying a data packet. The method includes: acquiring a first target model, where the first target model is used to extract first feature information of the first data packet, and determine the first data packet. The first application in the corresponding first application set; in the case of satisfying the trigger condition, the second target model is obtained, and the second target model is used to extract the second feature information of the second data packet, and determine the corresponding the second application in the second application set, where the first application in the first application set is different from the second application in the second application set; acquire a third data packet, and determine the first application according to the first target model and the second target model The first application or the second application corresponding to the three data packets.

In the method provided by the above sixteenth aspect, when a new application appears after using the first target model (the new application is the application in the second application set), the first device does not need to use the marked first target model. Model training is performed on the data packets of the application and the data packets of the second application to obtain a model that can identify both the data packets of the applications in the first application set and the data packets of the applications in the second application set. The first device can perform model training according to the marked data packets of the second application to obtain the second target model, and subsequently, identify the data packets of the applications in the first application set according to the first target model and the second target model , or a data packet of an application in the second application set. Because the number of marked data packets of the second application is much smaller than the marked quantities of the marked data packets of the first application and the second application, in the method provided by the sixteenth aspect, the first The computational complexity of the device is small, and the training time is short. In addition, in the method provided by the sixteenth aspect, in the case of a newly added application, the first device uses the marked data package of the second application to perform model training, so the marked first application can be released. Application data package, reducing the cost of data storage.

A possible implementation manner, acquiring the second target model includes: acquiring the marked data package of the second application; acquiring the first initial model and a list of the second applications included in the second application set, where the first initial model is based on Determined by the number of applications in the second application set, the list of second applications is used to indicate the correspondence between the second application in the second application set and the output end of the first initial model; according to the marked data packets of the second application , train the first initial model to obtain the second target model. Based on the above method, the first device can train the first initial model according to the marked data package of the second application to obtain the second target model, so that the first device can subsequently determine the first target model according to the first target model and the second target model. The application corresponding to the three data packets.

A possible implementation manner, determining the first application or the second application corresponding to the third data packet according to the first target model and the second target model includes: obtaining the first output of the third data packet according to the first target model entropy, the first output entropy is used to indicate the probability that the application corresponding to the third data packet is an application predicted by the first target model; according to the second target model, the second output entropy of the third data packet is obtained, and the second output entropy is used for Indicate the probability that the application corresponding to the third data packet is the application predicted by the second target model; in the first output entropy and the second output entropy, the application predicted by the target model corresponding to the output entropy with a low value is determined as the third data packet corresponding to Applications. Based on the above method, the first device can determine the application corresponding to the third data packet according to the first output entropy and the second output entropy, thereby realizing the combination of the first target model and the second target model to identify the application. In this way, in the case of a new application, the first device does not need to perform model training according to the marked data packets of the first application and the data packets of the second application to obtain an application that can both identify the first application set The data packets of the second application set are also capable of identifying the data packet models of the applications in the second application set.

A possible implementation manner, the method further includes: acquiring a second initial model, where the second initial model is determined according to the number of applications in the first application set and the number of applications in the second application set; according to the first target The model and the second target model mark the result of the data packet obtained by the first device, train the second initial model to obtain the third target model, and the third target model is used to extract the third feature information, and determine the third target model according to the third feature information. The application corresponding to the data packet corresponding to the three characteristic information, the third characteristic information includes characteristic information of the data packet corresponding to the third characteristic information, the data packet corresponding to the third characteristic information is the data packet of the application in the first application set, or the second characteristic information A package of apps in the app collection. Based on the above method, the first device can obtain the second initial model, and train the second initial model to obtain the third target model according to the first target model and the labeling result of the data packet obtained by the first device by the second target model. Subsequently, the first device can identify the data packet according to the third target model, which can save time for the first device to identify the data packet. In addition, the first device can stabilize the size of the model by continuously compressing the model, which is beneficial to the deployment of the model in the system-on-chip.

A possible implementation, the method further includes: training the third target model according to the marked data packets used when acquiring the first target model and/or the marked data packets used when acquiring the second target model , to get the third target model after training. Based on the above method, the first device can train the third target model according to the marked data packets used when acquiring the first target model, and/or the marked data packets used when acquiring the second target model, so that after training The accuracy of the third target model is higher and the identification of data packets is more accurate.

A possible implementation, the method further includes: if the correct rate of the first target model and the second target model identifying the data packet is less than or equal to a third threshold, retraining the data packet and the second application for identifying the first application. The fourth destination model of the packet. Based on the above method, when the correct rate of identifying data packets between the first target model and the second target model is less than or equal to the third threshold, the first device can retrain the model, so that the trained model can identify the first application set Application data packets and data packets of applications in the second application set.

In a seventeenth aspect, an embodiment of the present application provides a data packet identification device, the device includes: an acquisition module and a determination module; the acquisition module is used to acquire a first target model, and the first target model is used to extract the first data packet The first feature information of the first data packet is used to determine the first application in the first application set corresponding to the first data packet; the obtaining module is also used to obtain a second target model when the trigger condition is met, and the second target model is used to extract The second feature information of the second data packet determines the second application in the second application set corresponding to the second data packet, and the first application in the first application set is different from the second application in the second application set; determining module , which is used to obtain the third data packet, and determine the first application or the second application corresponding to the third data packet according to the first target model and the second target model.

A possible implementation manner, the acquisition module is specifically used to acquire the marked data package of the second application; the acquisition module is also specifically used to acquire the first initial model and the list of the second applications included in the second application set, the first An initial model is determined according to the number of applications in the second application set, and the list of second applications is used to indicate the corresponding relationship between the second application in the second application set and the output end of the first initial model; the acquiring module, also specifically It is used to train the first initial model according to the marked data packets of the second application, so as to obtain the second target model.

A possible implementation manner, the trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold; or, the trigger condition is that the number of data packets applied in the second application set is greater than or equal to the second threshold; Alternatively, the trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets applied in the second application set is greater than or equal to the second threshold.

A possible implementation manner, the determination module is specifically used to obtain the first output entropy of the third data packet according to the first target model, and the first output entropy is used to indicate that the application corresponding to the third data packet is predicted by the first target model. The determination module is also specifically used to obtain the second output entropy of the third data packet according to the second target model, and the second output entropy is used to indicate that the application corresponding to the third data packet is predicted by the second target model. The probability of the application; the determining module is further specifically configured to determine the application predicted by the target model corresponding to the output entropy with a lower value among the first output entropy and the second output entropy as the application corresponding to the third data packet.

A possible implementation manner, the device further includes: a training module; an acquisition module, further configured to acquire a second initial model, the second initial model is based on the number of applications in the first application set and the number of applications in the second application set The number is determined; the training module is used to train the second initial model to obtain the third target model according to the labeling results of the data packets obtained by the first device by the first target model and the second target model, and the third target model is used for Extract the third feature information, and determine the application corresponding to the data packet corresponding to the third feature information according to the third feature information, the third feature information includes the feature information of the data packet corresponding to the third feature information, and the data packet corresponding to the third feature information. It is a data packet of an application in the first application set, or a data packet of an application in the second application set.

A possible implementation, the training module is also used to train the third target according to the marked data packets used when acquiring the first target model, and/or the marked data packets used when acquiring the second target model model to obtain the third target model after training.

A possible implementation, the acquisition module is also used to retrain the data packets and the second data packets for identifying the first application if the correct rate of the first target model and the second target model to identify the data packets is less than or equal to the third threshold. The fourth destination model of the applied packet.

In an eighteenth aspect, an embodiment of the present application provides an apparatus for identifying a data packet, including: a processor, where the processor is coupled to a memory, and the memory is used to store a program or an instruction. When executed by the processor, the apparatus is made to implement the method described in the sixteenth aspect or any possible implementation manner of the sixteenth aspect.

In a nineteenth aspect, an embodiment of the present application provides an apparatus for identifying a data packet, where the apparatus is configured to implement the method described in the sixteenth aspect or any possible implementation manner of the sixteenth aspect.

In a twentieth aspect, embodiments of the present application provide a computer-readable medium on which a computer program or instruction is stored, and when the computer program or instruction is executed, causes a computer to execute the above-mentioned sixteenth aspect, or any of the sixteenth aspect. A possible implementation of the method described in.

In a twenty-first aspect, an embodiment of the present application provides a computer program product, which includes computer program code, and when the computer program code runs on a computer, causes the computer to execute the above-mentioned sixteenth aspect or any one of the sixteenth aspects. methods described in possible implementations.

In a twenty-second aspect, an embodiment of the present application provides a chip, including: a processor, where the processor is coupled to a memory, and the memory is used to store programs or instructions, and when the programs or instructions are executed by the processor , the chip is made to implement the method described in the sixteenth aspect or any possible implementation manner of the sixteenth aspect.

It can be understood that the identification device, chip, computer readable medium or computer program product of any of the data packets provided above are all used to execute the corresponding method provided above. Therefore, the beneficial effects that can be achieved can be achieved. Referring to the beneficial effects in the corresponding method, details are not repeated here.

Description of drawings

1 is a schematic diagram of the architecture of a data packet identification system provided by an embodiment of the present application;

2 is a schematic diagram of a hardware structure of an identification device provided by an embodiment of the present application;

3 is a schematic flowchart of a method for identifying a data packet according to an embodiment of the present application;

4A is a schematic diagram of a first target model provided by an embodiment of the present application;

4B is a schematic diagram of a second target model provided by an embodiment of the present application;

5 is a schematic flowchart of another data packet identification method provided by an embodiment of the present application;

6A is a schematic diagram of a third initial model provided by an embodiment of the present application;

6B is a schematic diagram of a first initial model provided by an embodiment of the present application;

7 is a schematic flowchart of another data packet identification method provided by an embodiment of the present application;

8 is a schematic flowchart of another data packet identification method provided by an embodiment of the present application;

9 is a schematic flowchart of another data packet identification method provided by an embodiment of the present application;

10 is a schematic flowchart of another data packet identification method provided by an embodiment of the present application;

11 is a schematic flowchart of another data packet identification method provided by an embodiment of the present application;

12 is a schematic flowchart of another data packet identification method provided by an embodiment of the present application;

13 is a schematic flowchart of another data packet identification method provided by an embodiment of the present application;

14 is a schematic structural diagram of an apparatus for identifying a data packet according to an embodiment of the present application;

15 is a schematic structural diagram of another data packet identification device provided by an embodiment of the application;

16 is a schematic structural diagram of another data packet identification device provided by an embodiment of the application;

17 is a schematic structural diagram of a chip provided by an embodiment of the present application;

FIG. 18 is a schematic diagram of the composition of a data packet identification system according to an embodiment of the present application.

detailed description

The implementation of the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

The method provided by the embodiment of the present application can be applied to a federated learning scenario or a non-federated learning scenario. Among them, federated learning refers to the method of machine learning by uniting different participants (also known as data owners, or clients). In federated learning, participants do not need to expose their own data to other participants, managers or coordinators (for example, servers), so federated learning can well protect user privacy and ensure data security. While non-federated learning does not require participants, a device in a non-federated learning scenario can perform machine learning based on the data obtained by the device. The following takes a federated learning scenario as an example to introduce the data packet identification system provided by the embodiment of the present application.

As shown in FIG. 1 , it is a schematic structural diagram of a data packet identification system 10 according to an embodiment of the present application. In FIG. 1 , the data packet identification system 10 may include one or more servers 101 (only one is shown) and devices 102 - 104 that may communicate with the server 101 . FIG. 1 is only a schematic diagram, and does not constitute a limitation on the applicable scenarios of the technical solutions provided in the present application.

In FIG. 1 , the server 101 may function as a manager or a coordinator. That is, server 101 may manage or coordinate one or more participants (eg, device 102, device 103, or device 104). Exemplarily, the server 101 may determine a device that needs to perform model training (hereinafter referred to as a training device). Subsequently, the server 101 may also send information of the initial model to each training device, where the information of the initial model is used to indicate the initial model that needs to be trained by the training device. The server 101 may also receive information on the intermediate model from each training device, where the information on the intermediate model is used to indicate the intermediate model trained by the training device according to the initial model. Subsequently, the server 101 may further aggregate the received intermediate models to obtain the information of the target model, and send the information of the target model to each training device, so that each training device obtains the target model according to the information of the target model, and identifies the target model according to the information of the target model. data pack.

In FIG. 1, device 102, device 103, or device 104 may have the function of a participant. That is, device 102, device 103, or device 104 may perform machine learning or model training. Exemplarily, the device 102, the device 103 or the device 104 may receive the information of the initial model from the server 101, and obtain the intermediate model by training according to the initial model. Subsequently, the device 102, the device 103 or the device 104 may send the information of the intermediate model to the server 101, so that the server 101 aggregates the intermediate models obtained by the device 102, the device 103 and the device 104 to obtain the information of the target model. Device 102 , device 103 or device 104 may also receive information from server 101 for the target model. In this way, the device 102, the device 103 or the device 104 can obtain the target model according to the information of the target model, and identify the data packet according to the target model.

The server 101 in FIG. 1 may be a device capable of providing services such as computing or applications for participants. For example, the server 101 in FIG. 1 may be a network device, a network cloud engine (NCE), a federated learning server (FLS), or the like.

The device 102, the device 103 or the device 104 in FIG. 1 may be a device capable of receiving, sending or generating data packets and capable of performing machine learning. For example, the device 102, the device 103, or the device 104 may be a network device, a terminal, an optical network terminal (ONT), a federated learning client (federated learning client, FLC), or the like.

The above-mentioned network device may be any device with a wireless transceiver function. Including but not limited to: evolved base station (NodeB or eNB or e-NodeB, evolutional Node B) in long term evolution (long term evolution, LTE) system, base station (gNodeB or gNB) in new radio (new radio, NR) system ) or transmitting and receiving point (transmission receiving point/transmission receiving point, TRP), 3GPP subsequent evolution base station, access node in WiFi system, wireless relay node, wireless backhaul node, etc.

The above-mentioned terminal may be a device with a wireless transceiver function. For example, the above-mentioned terminal may be a mobile phone (mobile phone), a tablet computer (Pad), a computer with a wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, an industrial control (industrial control) terminal. ), in-vehicle terminals, terminals in self-driving, terminals in assisted driving, etc. A terminal may also sometimes be referred to as terminal equipment, user equipment (UE), access terminal, vehicle-mounted terminal, industrial control terminal, UE unit, UE station, mobile station, mobile station, remote station, remote terminal, mobile equipment, UE terminal equipment, wireless communication equipment, machine terminal, UE proxy or UE device, etc. Terminals can be fixed or mobile.

The data packet identification system 10 shown in FIG. 1 is only used for example, and is not used to limit the technical solution of the present application. Those skilled in the art should understand that, in the specific implementation process, the data packet identification system 10 may also include other devices, and the number of network devices and terminals may also be determined according to specific needs, which is not limited.

Optionally, each device in FIG. 1 in this embodiment of the present application, for example, the server 101 , the device 102 , the device 103 , or the device 104 , may be a functional module in an apparatus. It can be understood that the functional module can be an element in a hardware device, for example, a communication chip or a communication component in a terminal or a network device, or a software functional module running on hardware, or a platform (for example, a cloud Virtualization functions instantiated on the platform).

For example, each device in FIG. 1 can be implemented by the identification apparatus 200 in FIG. 2 . FIG. 2 is a schematic diagram of a hardware structure of an identification device applicable to an embodiment of the present application. The identification device 200 includes at least one processor 201 , a communication line 202 , a memory 203 and at least one communication interface 204 .

The processor 201 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more processors for controlling the execution of the programs of the present application. integrated circuit.

Communication line 202 may include a path, such as a bus, for transferring information between the components described above.

Communication interface 204, using any transceiver-like device for communicating with other devices or communication networks, such as Ethernet interfaces, radio access network (RAN), wireless local area networks (wireless local area networks, WLAN), etc.

Memory 203 may be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM) or other types of information and instructions It can also be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, CD-ROM storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of being executed by a computer Access any other medium without limitation. The memory may exist independently and be connected to the processor through the communication line 202 . The memory can also be integrated with the processor. The memory provided by the embodiments of the present application may generally be non-volatile. The memory 203 is used for storing the computer-executed instructions involved in executing the solution of the present application, and the execution is controlled by the processor 201 . The processor 201 is configured to execute the computer-executed instructions stored in the memory 203, thereby implementing the method provided by the embodiments of the present application.

Optionally, the computer-executed instructions in the embodiment of the present application may also be referred to as application code, which is not specifically limited in the embodiment of the present application.

In a specific implementation, as an embodiment, the processor 201 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 2 .

In a specific implementation, as an embodiment, the identification device 200 may include multiple processors, for example, the processor 201 and the processor 207 in FIG. 2 . Each of these processors can be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. A processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).

In a specific implementation, as an embodiment, the identification apparatus 200 may further include an output device 205 and an input device 206 . The output device 205 is in communication with the processor 201 and can display information in a variety of ways. For example, the output device 205 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector (projector) Wait. Input device 206 is in communication with processor 201 and can receive user input in a variety of ways. For example, the input device 206 may be a mouse, a keyboard, a touch screen device, a sensor device, or the like.

The above-mentioned identification device 200 may be a general-purpose device or a special-purpose device. In a specific implementation, the identification device 200 may be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, an embedded device, or a similar structure in FIG. 2 . equipment. This embodiment of the present application does not limit the type of the identification device 200 .

In the following, a federated learning scenario and a non-federated learning scenario are taken as examples to describe the data packet identification method provided by the embodiment of the present application in detail with reference to FIG. 1 and FIG. 2 .

It should be noted that the names of messages between devices or the names of parameters in the messages in the following embodiments of the present application are just an example, and other names may also be used in specific implementations, which are not specifically limited in the embodiments of the present application. .

It should be noted that, in this embodiment of the present application, "/" may indicate that the related objects are an "or" relationship, for example, A/B may indicate A or B; "and/or" may be used to describe There are three kinds of relationships between related objects, for example, A and/or B, which can be expressed as: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural.

In order to facilitate the description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" may be used to distinguish technical features with the same or similar functions. The words "first", "second" and the like do not limit the quantity and execution order, and the words "first", "second" and the like do not limit the difference. In the embodiments of the present application, words such as "exemplary" or "for example" are used to represent examples, illustrations or illustrations, and any embodiment or design solution described as "exemplary" or "for example" should not be construed are preferred or advantageous over other embodiments or designs. The use of words such as "exemplary" or "such as" is intended to present the relevant concepts in a specific manner to facilitate understanding.

It should be noted that, in the embodiments of the present application, for a technical feature, the "first", "second", "third", "fourth", "A", "B", "C" and "D" etc. to distinguish the technical features in this kind of technical features, the "first", "second", "third", "fourth", "A", "B", "C" and "D" "The technical features described are in no order or order of magnitude.

It can be understood that the same step or steps or messages having the same function in the embodiments of the present application may refer to each other for reference between different embodiments.

It can be understood that, in the embodiments of the present application, the server or the first device may perform some or all of the steps in the embodiments of the present application. These steps are only examples, and the embodiments of the present application may also perform other steps or variations of various steps. In addition, various steps may be performed in different orders presented in the embodiments of the present application, and it may not be necessary to perform all the steps in the embodiments of the present application.

In the embodiment of the present application, the specific structure of the execution body of the data packet identification is not particularly limited in the embodiment of the present application, as long as the program that records the code of the data packet identification method of the embodiment of the present application can be executed according to the embodiment of the present application. The data packet identification method according to the embodiment of the present application only needs to perform communication. For example, the execution body of the data packet identification method provided in this embodiment of the present application may be a server, or a component applied in the server, such as a chip, which is not limited in this application. Alternatively, the execution body of the data packet identification method provided in this embodiment of the present application may be the first device, or a component applied in the first device, such as a chip, which is not limited in this application. The following embodiments are described by taking an example that the execution bodies of the data packet identification method are the server and the first device respectively.

First, a federated learning scenario is used as an example to introduce the data packet identification method provided by the embodiment of the present application. Specifically, reference may be made to the methods shown in FIG. 3 , FIG. 5 , and FIGS. 7 to 11 below.

As shown in FIG. 3 , a method for identifying a data packet provided in an embodiment of the present application is applied to a first device. The method for identifying the data packet includes steps 301 to 303 .

Step 301: The first device acquires a first target model.

The first device may be the device 102 , the device 103 or the device 104 in FIG. 1 . The first device may be a device determined by the server that needs to perform model training. The server may be the server 101 in FIG. 1 .

The first target model is used to extract the first feature information of the first data packet, and determine the first application in the first application set corresponding to the first data packet. The first set of applications includes at least one first application. The at least one first application includes applications already installed on the server, the first device, or other devices.

The first feature information includes feature information of the first data packet. For example, the first feature information includes a keyword of an application to which the first data packet belongs. It should be understood that the first data packet is generated by the first application in the first application set.

Exemplarily, the first application set includes

and

Packet 1 is

The generated packet, packet 2 is

Taking the generated data packet as an example, the first characteristic information corresponding to the data packet 1 includes Wechat, and the first characteristic information corresponding to the data packet 2 includes Alipay.

It can be understood that each data packet generated by the first application corresponds to the first feature information. The first feature information corresponding to the data packets of the same application may be the same or different. The data packet of the application can be understood as the data packet generated by the application.

In a possible implementation manner, the first target model includes a first target feature extractor and a first target classifier. Wherein, the first target feature extractor is used to extract the first feature information of the first data packet, for example, the first feature information. The first target classifier is used to determine the first application in the first application set corresponding to the first data packet.

Exemplarily, the first target model may be as shown in FIG. 4A . In FIG. 4A , the first target model 401 includes a first target feature extractor 402 and a first target classifier 403 . The input of the first target feature extractor 402 is the input of the first target model 401, the output of the first target feature extractor 402 is the input of the first target classifier 403, and the output of the first target classifier 403 is the first target model 401 output. The first target classifier 403 has n output ports, and each output port corresponds to a first application in the first application set. n is the number of applications in the first application set. It can be understood that, among the n output ports, the application corresponding to the port with the highest output value may be determined as the application corresponding to the data packet input to the first target model 401 .

Exemplarily, the first application set includes

and

Packet 1 is

The generated packet, packet 2 is

Taking the generated data packet as an example, if the first target model is shown in FIG. 4A , the value of n is 2. Assume that port 1 corresponds to

Port 2 corresponds

Then the data packet 1 obtains the Wechat through the first target feature extractor 402, and the Wechat is input to the first target classifier 403, and it can be obtained that the output value of port 1 is greater than the output value of port 2, that is, the application corresponding to the data packet 1 is

Similarly, data packet 2 obtains Alipay through the first target feature extractor 402, and Alipay is input to the first target classifier 403, and it can be obtained that the output value of port 2 is greater than the output value of port 1, that is, the corresponding application of data packet 2 is

A possible implementation manner, where the first device acquires the first target model, includes: the first device receives the information of the third initial model from the server and the list of the first applications included in the first application set; The marked data packets of the first application obtained by the device train the third initial model to obtain the third intermediate model; the first device sends the information of the third intermediate model to the server; the first device receives the information of the first target model from the server ; The first device obtains the first target model according to the information of the first model and the third initial model. The specific process of acquiring the first target model by the first device will be described in the method shown in FIG. 5 below.

In a possible implementation manner, when the server is initialized (for example, the server is powered on for the first time, or the server is restored to factory settings), the first device acquires the first target model.

Step 302: In the case that the trigger condition is satisfied, the first device acquires the second target model.

A possible implementation manner, the trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold; or, the trigger condition is that the number of data packets applied in the second application set is greater than or equal to the second threshold; Alternatively, the trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets applied in the second application set is greater than or equal to the second threshold. Wherein, the first threshold and the second threshold are positive integers.

Wherein, the second application set includes at least one second application. The at least one second application includes an application installed on the server, the first device or other devices after the first device acquires the first target model.

Exemplarily, taking the trigger condition that the number of applications in the second application set is greater than or equal to the first threshold, and the first threshold is 5, as an example, if the number of applications in the second application set is 6, the first device obtains The second target model. If the number of applications in the second application set is 3, the first device does not acquire the second target model.

Exemplarily, taking the trigger condition that the number of data packets applied in the second application set is greater than or equal to the second threshold, and the second threshold is 30, for example, if the second application set includes two applications, the first application If the number of data packets and the number of data packets of the second application are both 20, the first device acquires the second target model. If the number of data packets of the first application is 5 and the number of data packets of the second application is 10, the first device does not acquire the second target model.

Exemplarily, the trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold, and the number of data packets applied in the second application set is greater than or equal to the second threshold, the first threshold is 3, and the first threshold is 3. For example, if the second threshold is 50, if the second application set includes two applications, and the number of data packets of the first application and the number of data packets of the second application are both 30, the first device does not obtain the first application. Two-objective model. If the second application set includes 4 applications, the number of data packets of the first application and the number of data packets of the second application are both 10, and the number of data packets of the third application and the fourth application is 10. If the numbers are all 5, the first device does not acquire the second target model. If the second application set includes 3 applications, and the number of data packets of the first application, the data packets of the second application and the data packets of the third application are all 25, the first device obtains the first Two-objective model.

It can be understood that when the trigger condition is met, the server sends the information for instructing the acquisition of the second target model to the first device, the first device receives the information from the server for instructing the acquisition of the second target model, and acquires the first device. Two-objective model. Or, when the trigger condition is satisfied, the server sends the information of the first initial model and the list of second applications included in the second application set to the first device, and the first device receives the information of the first initial model and The second application list is obtained, and the second target model is obtained, wherein the information of the first initial model and the introduction of the list of the second application can be referred to the following description in the method shown in FIG. 7 . That is to say, when the trigger condition is satisfied, the server will send the above-mentioned indication information, or the information of the first initial model and the list of the second application to the first device. After receiving the above-mentioned information, the first device will obtain the second target model.

It can be understood that the above triggering conditions may be set by the administrator, or may be set by the server as required. In one case, the server may instruct the first device to acquire the second target model after monitoring that the trigger condition is satisfied. In another case, when the administrator determines to trigger the first device to acquire the second target model, the server may instruct the first device to acquire the second target model. It should be understood that during the operation of the first device, the administrator or the server may reset the trigger condition as required.

The second target model is used to extract the second feature information of the second data packet, and determine the second application in the second application set corresponding to the second data packet. Wherein, the second characteristic information includes characteristic information of the second data packet. For example, the second feature information includes a keyword of an application to which the second data packet belongs. It should be understood that the second data packet is generated by the second application in the second application set.

Exemplarily, the second application set includes

and

Packet 1 is

The generated packet, packet 2 is

Taking the generated data packet as an example, the second characteristic information corresponding to the data packet 1 includes iQIYI, and the second characteristic information corresponding to the data packet 2 includes Tencent.

It can be understood that each data packet generated by the second application corresponds to the second feature information. The second feature information corresponding to the data packets of the same application may be the same or different.

In a possible implementation manner, the second target model includes a second target feature extractor and a second target classifier. The second target feature extractor is the same as the first target feature extractor, and can be used to extract the feature information of the data packet, for example, can be used to extract the second feature information of the second data packet. The second target classifier is configured to determine the second application in the second application set corresponding to the second data packet.

Exemplarily, the second target model may be as shown in FIG. 4B . In FIG. 4B , the second target model 404 includes a second target feature extractor 405 and a second target classifier 406 . The input of the second target feature extractor 405 is the input of the second target model 404, the output of the second target feature extractor 405 is the input of the second target classifier 406, and the output of the second target classifier 406 is the second target model 404 output. The second object classifier 406 has m output ports, and each output port corresponds to one application in the second set of applications. m is the number of applications in the second application set. It can be understood that, among the m output ports, the application corresponding to the port with the highest output value may be determined as the application corresponding to the data packet input to the second target model 404 .

Exemplarily, the second application set includes

and

Packet 1 is

The generated packet, packet 2 is

Taking the generated data packet as an example, if the second target model is shown in FIG. 4B , the value of m is 2. Assume that port 1 corresponds to

Port 2 corresponds

Then the data packet 1 obtains iQIYI through the second target feature extractor 405, and the iQIYI is input to the second target classifier 406, and it can be obtained that the output value of port 1 is greater than the output value of port 2, that is, the corresponding application of data packet 1 is

Similarly, packet 2 obtains Tencent through the second target feature extractor 405, and input Tencent into the second target classifier 406, it can be obtained that the output value of port 2 is greater than the output value of port 1, that is, the application corresponding to packet 2 is

A possible implementation manner, where the first device acquires the second target model, includes: the first device receives the information of the first initial model from the server and the list of second applications included in the second application set; The marked data packets of the second application obtained by the device train the first initial model to obtain the first intermediate model; the first device sends the information of the first intermediate model to the server; the first device receives the information of the second target model from the server ; The first device obtains the second target model according to the information of the second target model and the first initial model. The specific process of acquiring the second target model by the first device will be described in the method shown in FIG. 7 below.

It can be understood that each time the trigger condition is met, the first device will acquire the second target model. That is, before step 303, or after step 303, the first device may acquire the second target model multiple times. The difference is that the applications in the second application set corresponding to the second target model acquired each time are different. The second set of applications includes applications installed on the server, the first device or other devices after the first device acquires the target model last time.

Exemplarily, after step 301, the first device obtains the second target model three times as an example, the second application set corresponding to the second target model obtained for the first time includes the installation of the first device after obtaining the first target model. An application on a server, first device or other device. The second set of applications corresponding to the second target model acquired for the second time includes applications installed on the server, the first device, or other devices after the first device acquires the second target model for the first time. The second application set corresponding to the second target model acquired for the third time includes applications installed on the server, the first device or other devices after the first device acquires the second target model for the second time.

Step 303: The first device acquires the third data packet, and determines the first application or the second application corresponding to the third data packet according to the first target model and the second target model.

In a possible implementation manner, the first device determines the first application or the second application corresponding to the third data packet according to the first target model and the second target model, including: the first device obtains the third data packet according to the first target model. The first output entropy of the data packet; the first device obtains the second output entropy of the third data packet according to the second target model; The application predicted by the target model is determined as the application corresponding to the third data packet. In this way, the first device can identify the data packet generated by the first application or identify the data packet generated by the second application according to the first target model and the second target model.

The first output entropy is used to indicate the probability that the application corresponding to the third data packet is the application predicted by the first target model. The larger the value of the first output entropy, the smaller the probability that the application corresponding to the third data packet is the application predicted by the first target model; the smaller the value of the first output entropy, the application corresponding to the third data packet is the first target model. The greater the probability of the predicted application. The second output entropy is used to indicate the probability that the application corresponding to the third data packet is the application predicted by the second target model. The larger the value of the second output entropy, the smaller the probability that the application corresponding to the third data packet is the application predicted by the second target model; the smaller the value of the second output entropy, the application corresponding to the third data packet is the second target model The greater the probability of the predicted application.

Further, the first output entropy satisfies the following formula:

Wherein, H ₁ (p ₁ ) is the first output entropy. n is the number of output ports of the first target classifier. p ₁ (i) is the probability that the application corresponding to the data packet input to the first target model is the application corresponding to the ith port.

Similarly, the second output entropy satisfies the following formula:

Wherein, H ₂ (p ₂ ) is the second output entropy. m is the number of output ports of the second target classifier. p ₂ (i) is the probability that the application corresponding to the data packet input to the second target model is the application corresponding to the ith port.

Exemplarily, the application corresponding to the first target model prediction data package 1 is

The application corresponding to the second target model prediction data package 1 is:

For example, if the value of the first output entropy is 20 and the value of the second output entropy is 85, the first device determines that the application corresponding to the third data packet is

If the value of the first output entropy is 90 and the value of the second output entropy is 15, the first device determines that the application corresponding to the third data packet is

It can be understood that when the first device acquires the second target model multiple times, the first device determines the first application or the first application corresponding to the third data packet according to the first target model and the second target model acquired multiple times. Second application.

Further, the first device determines the first application or the second application corresponding to the third data packet according to the first target model and the second target model obtained multiple times, including: the first device obtains the third data packet according to the first target model. The first output entropy of the data packet; the first device obtains the second output entropy of the third data packet corresponding to each second target model according to the second target model obtained multiple times; the first device combines the first output entropy and the obtained In the obtained second output entropy, the application predicted by the target model corresponding to the output entropy with a low value is determined as the application corresponding to the third data packet.

In a possible implementation manner, if the first device receives the indication information from the server, the first device retrains the fourth target model for identifying the data packets of the first application and the data packets of the second application. Wherein, the indication information is used to instruct the first device to retrain the fourth target model for identifying the data packets of the first application and the data packets of the second application. The fourth target model is obtained by training according to the marked data packets of the first application and the marked data packets of the second application. For the process of the first device retraining the fourth target model for identifying the data packets of the first application and the data packets of the second application, reference may be made to the process of acquiring the first target model by the first device in the foregoing step 301 . That is to say, after the first device receives the indication information, the above steps 301 to 303 may be performed again. Wherein, the fourth target model is obtained by training according to the marked data packets of the first application and the marked data packets of the second application, and when the first device identifies the data packets according to the first target model and the second target model, is the result inferred from the output entropy. Therefore, the correct rate of identifying the data packet by the fourth target model is greater than the correct rate of the first device identifying the data packet according to the first target model and the second target model.

It can be understood that the above-mentioned indication information may be sent by the administrator triggering the server, or it may be sent to the first device when the server detects that the correct rate of the application corresponding to the third data packet determined by the first device is less than or equal to the third threshold. sent by the device.

Based on the method shown in FIG. 3 , when a new application appears after using the first target model (the new application is the application in the second application set), the first device does not need to use the marked first application Model training is performed on the set and the data packets of the applications in the second application set to obtain a model that can identify both the data packets of the applications in the first application set and the data packets of the applications in the second application set. The first device can perform model training according to the marked data packets of the second application to obtain a second target model, and subsequently, identify the data packets of the applications in the first application set according to the first target model and the second target model, or data packets of applications in the second application set. Because the number of marked data packets of the second application is much smaller than the marked number of data packets of the first application and the second application, in the method shown in FIG. 3, the calculation of the first device The volume is small and the training time is short. In addition, in the method shown in FIG. 3 , in the case of a newly added application, the first device uses the marked data packet of the second application for model training, so the marked first application can be released. data packets, reducing the cost of data storage.

In a possible implementation manner of the method shown in FIG. 3 , as shown in FIG. 5 , step 301 may include steps 3011 to 3015 .

Step 3011: The first device receives the information of the third initial model and the list of the first applications from the server.

The information of the third initial model is used to indicate the third initial model. The third initial model is determined according to the number of applications in the first application set. That is, the third initial model is an initialized model obtained according to the number of applications in the first application set. For example, the third initial model includes a third initial feature extractor and a third initial classifier. The third initial feature extractor can be updated to the first target feature extractor after training, and the third initial classifier can be updated to the first target classifier after model training.

Exemplarily, the third initial model may be as shown in FIG. 6A . In FIG. 6A , the third initial model 601 includes a third initial feature extractor 602 and a third initial classifier 603 . The input of the third initial feature extractor 602 is the input of the third initial model 601, the output of the third initial feature extractor 602 is the input of the third initial classifier 603, and the output of the third initial classifier 603 is the third initial model 601 output. The third initial classifier 603 has n output ports, and each output port corresponds to one application in the first application set. n is the number of applications in the first application set.

In a possible implementation manner, the information of the third initial model includes structural information of the third initial model and parameter information of the third initial model. The structure information of the third initial model is used to indicate the structure of the third initial model, for example, the structure information of the third initial model is used to indicate that the third initial model includes a third initial feature extractor and a third initial classifier. The parameter information of the third initial model is used to indicate parameters of the third initial model, for example, parameters of the third initial feature extractor and parameters of the third initial classifier. For the introduction of the parameters of the third initial feature extractor and the parameters of the third initial classifier, reference may be made to the explanations of the parameters of the feature extractor and the parameters of the classifier in the conventional technology, which will not be repeated.

In a possible implementation manner, the list of the first applications is used to indicate the correspondence between the first application in the first application set and the output end of the third initial model.

Exemplarily, taking the third initial model shown in FIG. 6A as an example, the correspondence between the first application in the first application set and the output end of the third initial model may be as shown in Table 1. In Table 1, the port corresponding to application 1 is port 1, the port corresponding to application 2 is port 2, ..., the port corresponding to application n-1 is port n-1, and the port corresponding to application n is port n.

Table 1

第一应用集合中的第一应用The first application in the first application set	第三初始模型的输出端The output of the third initial model

应用1Application 1	端口1 port 1
应用2 Application 2	端口2 port 2
……	……
应用n-1apply n-1	端口n-1port n-1
应用napplication n	端口nport n

Step 3012: The first device trains a third initial model according to the marked data packets of the first application obtained by the first device, and obtains a third intermediate model.

The marked data packet of the first application obtained by the first device may be marked manually or marked by a machine.

Taking manual marking as an example, the data packet may be marked by the administrator of the first device, or may be marked by the administrator of the server. If the data packet is marked by the administrator of the server, the first device can obtain the data packet of the first application, send the data packet of the first application to the server, and receive the marked data packet of the first application from the server. The data packet of the first application may be received by the first device, or generated by an application on the first device.

Taking machine labeling as an example, the data packet may be labelled by the first device, or may be labelled by the server. If the data packet is marked by the server, the first device may obtain the data packet of the first application, send the data packet of the first application to the server, and receive the marked data packet of the first application from the server.

In a possible implementation manner, the first device updates the third initial model by means of backpropagation according to the marked data packets of the first application obtained by the first device to obtain the third intermediate model. Further, the loss function used in the process of updating the third initial model by the method of backpropagation by the first device satisfies the following formula:

Wherein, L represents a loss function, and the loss function can be used to calculate the gradient of the parameters of the third initial model. N is the number of marked data packets of the first application obtained by the first device. M is the number of applications in the first application set. y _ic is an indicator variable, in the case that the real category of the i-th data packet is category c, y _ic =1, otherwise y _ic =0. _pic is the predicted probability that the ith data packet belongs to category c.

The first device uses the method of back propagation to update the third initial model, and the specific process of obtaining the third intermediate model can be referred to the explanation in the conventional technology, and will not be repeated.

Step 3013: The first device sends the information of the third intermediate model to the server.

The information of the third intermediate model includes parameters of the third intermediate model. Exemplarily, the parameters of the third intermediate model include gradients of the parameters of the third initial model.

Step 3014: The first device receives the information of the first target model from the server.

The information of the first target model is obtained by aggregating information from intermediate models of multiple first devices. The information of the first target model is used to indicate parameters of the first target model. Exemplarily, the parameters of the first target model include gradients of the updated parameters of the third initial model.

Step 3015: The first device obtains the first target model according to the information of the first target model and the third initial model.

A possible implementation manner, the first device obtains the first target model according to the information of the first target model and the third initial model, including: the first device obtains according to the parameters of the third initial model and the information of the first target model. Parameters of the first target model; the first device replaces the parameters of the third initial model in the third initial model with parameters of the first target model to obtain the first target model.

It should be noted that the above steps 3011 to 3015 are described by taking the example that the first device performs one model training to obtain the first target model as an example. In practical applications, the first device may perform model training multiple times to obtain the first target model. That is, in step 3015, the model obtained by the first device according to the information of the first target model and the third initial model may be an incomplete first target model, that is, the model obtained by the first device may not converge. Subsequently, the first device may train the unfinished first target model according to the marked data packets of the first application obtained by the first device, send the trained gradients to the server, receive the aggregated gradients from the server, and A model is obtained according to the aggregated gradient and the above-mentioned unfinished first target model. If the model converges, the model is the first target model. If the model does not converge, the above process is repeated until the model obtained by the first device converges.

Based on the method shown in FIG. 5 , a device participating in the model training, such as the first device, can receive the information of the third initial model and the list of the first applications from the server, and train the third The initial model is obtained, the third intermediate model is obtained, and the information of the third intermediate model is sent to the server, so that the server aggregates the information of the intermediate models from multiple first devices to obtain the information of the first target model. Subsequently, the first device may receive the information of the first target model from the server, and obtain the first target model according to the information of the first target model and the third initial model. In this way, all devices participating in the model training can obtain a model that can finally recognize the data packet of the first application. In addition, in the method shown in Figure 5, the server does not need to perform model training, but delegates the model training process to the equipment participating in the model training. The number is also smaller than the number of labeled data packets used by the server to train the model. For these devices, the amount of computation is not large, and it can also save model training time.

In a possible implementation manner of the method shown in FIG. 3 , as shown in FIG. 7 , step 302 may include steps 3021 to 3025 .

Step 3021: The first device receives the information of the first initial model and the list of the second applications from the server.

Wherein, the information of the first initial model is used to indicate the first initial model. The first initial model is determined according to the number of applications in the second application set. That is, the first initial model is an initialized model obtained according to the number of applications in the second application set. For example, the first initial model includes a second target feature extractor and a first initial classifier. The second target feature extractor is a feature extractor that multiplexes the first target feature extractor into the first initial model, and subsequently, the first device may not need to train the feature extractor. The first initial classifier can be updated to the second target classifier after model training.

It can be understood that the first initial model may not reuse the first target feature extractor. In this case, the first initial model includes the first initial feature extractor and the first initial classifier. The first initial feature extractor is an initialized feature extractor obtained by the first device.

Exemplarily, the first initial model may be as shown in FIG. 6B . In FIG. 6B , the first initial model 604 includes a second target feature extractor 605 and a first initial classifier 606 . The input of the second target feature extractor 605 is the input of the first initial model 604, the output of the second target feature extractor 605 is the input of the first initial classifier 606, and the output of the first initial classifier 606 is the first initial model 604 output. The first initial classifier 606 has m output ports, and each output port corresponds to an application in the second set of applications. m is the number of applications in the second application set.

In a possible implementation manner, the information of the first initial model includes structural information of the first initial model and parameter information of the first initial model. The structure information of the first initial model is used to indicate the structure of the first initial model, for example, the structure information of the first initial model is used to indicate that the first initial model includes the second target feature extractor and the first initial classifier. The parameter information of the first initial model is used to indicate parameters of the first initial model, for example, parameters of the second target feature extractor and parameters of the first initial classifier. For the introduction of the parameters of the second target feature extractor and the parameters of the first initial classifier, reference may be made to the explanations of the parameters of the feature extractor and the parameters of the classifier in the conventional technology, which will not be repeated.

In a possible implementation manner, the list of second applications is used to indicate the correspondence between the second application in the second application set and the output end of the first initial model.

Exemplarily, taking the first initial model shown in FIG. 6B as an example, the correspondence between the second application in the second application set and the output end of the first initial model may be as shown in Table 2. In Table 2, the port corresponding to application 1 is port 1, the port corresponding to application 2 is port 2, ..., the port corresponding to application m-1 is port m-1, and the port corresponding to application m is port m.

Table 2

第二应用集合中的第二应用The second application in the second set of applications	第一初始模型的输出端The output of the first initial model

应用1Application 1	端口1 port 1
应用2 Application 2	端口2 port 2
……	……
应用m-1Apply m-1	端口m-1port m-1
应用mapplication m	端口mport m

Step 3022: The first device trains the first initial model according to the marked data packet of the second application obtained by the first device, to obtain a first intermediate model.

The marked data packet of the second application obtained by the first device may be marked manually or marked by a machine.

Taking manual marking as an example, the data packet may be marked by the administrator of the first device, or may be marked by the administrator of the server. If the data packet is marked by the administrator of the server, the first device can obtain the data packet of the second application, send the data packet of the second application to the server, and receive the marked data packet of the second application from the server. The data packet of the second application may be received by the first device, or generated by an application on the first device.

Taking machine labeling as an example, the data packet may be labelled by the first device, or may be labelled by the server. If the data packet is marked by the server, the first device may obtain the data packet of the second application, send the data packet of the second application to the server, and receive the marked data packet of the second application from the server.

In a possible implementation manner, the first device updates the first initial model by means of backpropagation according to the marked data packets of the second application obtained by the first device to obtain the first intermediate model. Further, the loss function used in the process of updating the first initial model by the method of backpropagation by the first device satisfies the following formula:

Wherein, L represents the loss function, and the loss function can be used to calculate the parameters of the first initial classifier. N is the number of marked data packets of the second application obtained by the first device. M is the number of applications in the second application set. y _ic is an indicator variable, in the case that the real category of the i-th data packet is category c, y _ic =1, otherwise y _ic =0. _pic is the predicted probability that the ith data packet belongs to category c.

The first device updates the first initial model by the method of back propagation, and the specific process of obtaining the first intermediate model can be referred to the explanation in the conventional technology, and will not be repeated.

Step 3023: The first device sends the information of the first intermediate model to the server.

Wherein, the information of the first intermediate model includes parameters of the first intermediate model. Exemplarily, the parameters of the first intermediate model include gradients of parameters of the first initial classifier.

Step 3024: The first device receives the information of the second target model from the server.

The information of the second target model is obtained by aggregating information from intermediate models of multiple first devices. The information of the second target model is used to indicate the parameters of the second target model. Exemplarily, the parameters of the second target model include the updated gradients of the parameters of the first initial classifier.

Step 3025: The first device obtains the second target model according to the information of the second target model and the first initial model.

In a possible implementation manner, the first device obtains the second target model according to the information of the second target model and the first initial model, including: the first device obtains the second target model according to the parameters of the first initial classifier and the information of the second target model, Obtain the parameters of the second target classifier; the first device replaces the parameters of the first initial classifier with the parameters of the second target classifier in the first initial model to obtain the second target model.

It should be noted that the above steps 3021 to 3025 are described by taking the example that the first device performs one model training to obtain the second target model. In practical applications, the first device may perform model training multiple times to obtain the second target model. That is, in step 3025, the model obtained by the first device according to the information of the second target model and the first initial model may be an unfinished second target model, that is, the model obtained by the first device may not converge. Subsequently, the first device may train the unfinished second target model according to the marked data packets of the second application obtained by the first device, send the trained gradients to the server, receive the aggregated gradients from the server, and A model is obtained based on the aggregated gradient and the above-mentioned unfinished second target model. If the model converges, the model is the second target model. If the model does not converge, the above process is repeated until the model obtained by the first device converges.

Based on the method shown in FIG. 7 , a device participating in model training, such as a first device, can receive information about the first initial model and a list of second applications from the server, and train the first device according to the marked data packets of the second application. From the initial model, the first intermediate model is obtained, and the information of the first intermediate model is sent to the server, so that the server aggregates the information of the intermediate models from multiple first devices to obtain the information of the second target model. Subsequently, the first device may receive the information of the second target model from the server, and obtain the second target model according to the information of the second target model and the first initial model. On the one hand, all devices participating in the model training can obtain a model that can finally recognize the data packets of the second application. On the other hand, the first initial model reuses the first target feature extractor, so when training the model, there is no need to train the feature extractor, which reduces computational overhead. In addition, in the method shown in Figure 7, the server does not need to perform model training, but delegates the model training process to the equipment participating in the model training. The number is also smaller than the number of labeled data packets used by the server to train the model. For these devices, the amount of computation is not large, and it can also save model training time.

It can be understood that in the case where the first device has acquired the second target model multiple times, when the first device recognizes the third data packet, it needs to acquire the first target model and the plurality of second target models, each of which corresponds to the target model. and then determine the application corresponding to the third data packet according to the obtained multiple output entropies. Therefore, it may take a long time for the first device to identify the third data packet, which affects user experience. In this case, the first device can compress the first target model and multiple target models into one target model, and subsequently, identify the third data packet through the compressed target model, which can save the first device from identifying the third data packet time. Specifically, reference may be made to the method shown in FIG. 8 .

As shown in FIG. 8 , in a possible implementation manner of the method shown in FIG. 3 , the method shown in FIG. 3 further includes step 801 and step 802 .

Step 801: The first device acquires a second initial model.

The second initial model is determined according to the number of applications in the first application set and the number of applications in the second application set. That is, the second initial model is an initialized model obtained according to the number of applications in the first application set and the number of applications in the second application set. For example, the second initial model includes a second initial feature extractor and a second initial classifier. Wherein, the second initial feature extractor is a feature extractor that multiplexes the first target feature extractor into the second initial model, and subsequently, the first device does not need to train the feature extractor. The second initial classifier is an initialized classifier obtained by the first device.

It can be understood that the second initial model may not reuse the first target feature extractor. In this case, the feature extractor included in the second initial model is the initialized feature extractor obtained by the first device.

A possible implementation manner, the input of the second initial model is the input of the second initial feature extractor, the output of the second initial feature extractor is the input of the second initial classifier, and the output of the second initial classifier is the second initial classifier. The output of the initial model. The second initial classifier has q output ports, and each output port corresponds to an application in the first application set or the second application set. q is the sum of the number of applications in the first application set and the number of applications in the second application set.

In a possible implementation manner, the first device creates the second initial model according to the number of applications in the first application set and the number of applications in the second application set.

In another possible implementation manner, the first device sends the first information to the server, and receives the information of the second initial model from the server.

The first information is used to indicate the number of applications in the first application set and the number of applications in the second application set. The information of the second initial model is used to indicate the second initial model. For example, the information of the second initial model includes structural information of the second initial model and parameter information of the second initial model. The structure information of the second initial model is used to indicate that the second initial model includes a second initial feature extractor and a second initial classifier. The parameter information of the second initial model is used to indicate parameters of the second initial model, for example, parameters of the second initial feature extractor and parameters of the second initial classifier. For the introduction of the parameters of the second initial feature extractor and the parameters of the second initial classifier, reference may be made to the explanations of the parameters of the feature extractor and the parameters of the classifier in the conventional technology, which will not be repeated.

In a possible implementation manner, after the first device acquires the second target model for R times, step 801 is performed. where R is an integer greater than 0.

Step 802: The first device trains the second initial model to obtain the third target model according to the labeling result of the data packet obtained by the first device by the first target model and the second target model.

The labeling result of the first target model and the second target model on the data packet obtained by the first device may be that after the first device obtains the first target model and the second target model, according to the first target model and the second target model The identification result of the data packet. That is, in the process of obtaining the third target model, the first device may use the recognition result obtained by the first device in the process of using the first target model and the second target model to recognize the data packet to train the second initial model. In this way, the first device does not need to store the marked data packets used when acquiring the first target model and the second model, which saves storage overhead.

The third target model is used to extract the third feature information, and determine the application corresponding to the data packet corresponding to the third feature information according to the third feature information. The third feature information includes feature information of the data packet corresponding to the third feature information. For example, the third feature information includes a keyword of an application to which the data packet corresponding to the third feature information belongs. It should be understood that the data packet corresponding to the third feature information is the data packet applied in the first application set, or the data packet applied in the second application set.

In a possible implementation manner, the third target model includes a second initial feature extractor and a third target classifier. Wherein, the second initial feature extractor is used to extract feature information of the data packet, for example, third feature information. The third target classifier is used to determine the application corresponding to the data packet corresponding to the third feature information. The third target classifier is obtained by training the second initial classifier by the first device.

It should be noted that, for the specific process of training the second initial model to obtain the third target model by the first device according to the labeling results of the data packets obtained by the first device on the basis of the first target model and the second target model, refer to step 3022 above. The process of training the first initial model by the first device according to the marked data packet of the second application obtained by the first device to obtain the first intermediate model will not be repeated.

In a possible implementation manner, after step 802, the first device identifies the data packet of the first application or the data packet of the second application according to the third target model.

A possible implementation, after step 802, the first device trains the third device according to the marked data packet used when acquiring the first target model and/or the marked data packet used when acquiring the second target model. target model, and obtain the third target model after training. The first device trains the third target model according to the marked data packet used when acquiring the first target model, and/or the marked data packet used when acquiring the second target model, and obtains the trained third target model For the specific process, refer to the process of training the first initial model by the first device according to the marked data packet of the second application obtained by the first device in the above step 3022 to obtain the first intermediate model, which will not be repeated.

It can be understood that there may be errors in the labeling results of the data packets obtained by the first device by the first target model and the second target model, so the first device obtains the first target model according to the labeled data packets used, and/ Or, the labeled data packets used when the second target model is acquired and the third target model is trained can improve the accuracy of the model, so that the trained third target model has higher accuracy and more accurate data packet identification.

Based on the method shown in FIG. 8 , when the first device has acquired the second target model multiple times, the second initial model can be acquired, and the data packets obtained by the first device can be processed according to the first target model and the second target model. Label the results and train the second initial model to obtain the third target model. Subsequently, the first device can identify the data packet according to the third target model, which can save time for the first device to identify the data packet. In addition, by continuously compressing the model, the first device can stabilize the size of the model, which is beneficial to the deployment of the model in the system-on-chip.

The above-mentioned methods for identifying data packets shown in FIG. 3 , FIG. 5 , FIG. 7 and FIG. 8 are applied to the first device. Another method for identifying a data packet provided by an embodiment of the present application is introduced below, and the method is applied to a server.

As shown in FIG. 9 , another method for identifying a data packet provided by an embodiment of the present application is applied to a server. The method includes steps 901-904.

Step 901: The server obtains information of the first target model.

The server may be the server 101 in FIG. 1 . For the introduction of the information of the first target model, reference may be made to the above-mentioned step 3014 , and the introduction of the first target model may refer to the above-mentioned step 301 .

In a possible implementation manner, the server acquires the information of the first target model in the case of initialization (for example, the server is powered on for the first time, or the server is restored to factory settings).

In a possible implementation manner, the server acquiring the information of the first target model includes the following steps A-step E. The following steps are described by taking as an example that the devices determined by the server that need to perform model training are the first device and the second device. When the number of devices that need to perform model training determined by the server is greater than or equal to 3, the situation in which the server obtains the first target model may refer to the situation that the devices determined by the server to be subjected to model training are the first device and the second device, and details are not repeated. .

The first device and the second device may be the devices in FIG. 1 . For example, if the first device is the device 102 in FIG. 1 , the second device may be the device 103 or the device 104 in FIG. 1 . If the first device is the device 103 in FIG. 1 , the second device may be the device 102 or the device 104 in FIG. 1 . If the first device is the device 104 in FIG. 1 , the second device may be the device 102 or the device 103 in FIG. 1 .

Step A: The server sends the information of the third initial model and the list of the first applications included in the first application set to the first device.

Wherein, for the information of the third initial model and the introduction of the list of the first application, reference may be made to the above step 3011 .

Step B: The server receives the information of the third intermediate model from the first device.

For the introduction of the information of the third intermediate model, reference may be made to the description in the foregoing step 3013 .

Step C: The server sends the information of the third initial model and the list of the first applications included in the first application set to the second device.

Step D: The service receives the information of the fourth intermediate model from the second device.

For the introduction of the information of the fourth intermediate model, reference may be made to the description of the information of the third intermediate model above.

Step E: The server aggregates the information of the third intermediate model and the information of the fourth intermediate model to obtain the information of the first target model.

In a possible implementation manner, the server performs weighted summation of the information of the third intermediate model and the information of the fourth intermediate model to obtain the information of the first target model.

It should be noted that, the above steps A to E are described by taking the example that the first device and the second device perform one model training, and the server obtains the information of the first target model. In practical applications, the first device and the second device may perform model training multiple times before the server can obtain the information of the first target model. That is, according to the information of the first target model in step E, the obtained model may be an unfinished first target model, that is, according to the information of the first target model in step E, the obtained model may not converge. In this case, the server may receive information from the intermediate models of the first device and the second device multiple times, and aggregate the received intermediate models each time to obtain the aggregated information. If the obtained model converges, the model is the first target model. If it does not converge, the above steps are repeated until the obtained model converges.

It can be understood that, before step A, the server may also mark the data packet of the first application. Alternatively, the server may mark the data packet of the first application through the administrator. For example, the server receives the data packet of the first application from the first device; the server obtains the marked data packet of the first application according to the data packet of the first application; the server sends the marked data of the first application to the first device Bag.

When the server marks the data packet of the first application, the server obtains the marked data packet of the first application according to the data packet of the first application, which includes: the server marks the data packet of the first application, and obtains the marked data packet of the first application. the first application packet.

When the server marks the data packet of the first application by the administrator, the server obtains the marked data packet of the first application according to the data packet of the first application, including: in response to the input of the administrator, the server receives the marked data packet of the first application. the first application packet.

Step 902: The server sends the information of the first target model to the first device.

Step 903: In the case that the trigger condition is satisfied, the server obtains the information of the second target model.

For the introduction of the triggering condition, reference may be made to the description in step 302 above. For the introduction of the information of the second target model, reference may be made to the description in step 3024 above. For the introduction of the second target model, reference may be made to the description in step 302 above.

In a possible implementation manner, the server acquiring the information of the second target model includes the following steps a-e. The following steps are described by taking as an example that the devices determined by the server that need to perform model training are the first device and the second device. When the number of devices that need model training determined by the server is greater than or equal to 3, the information about the second target model obtained by the server may refer to the situation that the devices determined by the server that need model training are the first device and the second device. To repeat.

Step a: The server sends the information of the first initial model and the list of second applications included in the second application set to the first device.

For the introduction of the information of the first initial model and the list of the second application, reference may be made to the above step 3021 .

Step b: The server receives the information of the first intermediate model from the first device.

For the introduction of the information of the first intermediate model, reference may be made to the description in the foregoing step 3023 .

Step c: The server sends the information of the first initial model and the list of second applications included in the second application set to the second device.

Step d: The service receives the information of the second intermediate model from the second device.

For the introduction of the information of the second intermediate model, reference may be made to the description of the information of the first intermediate model above.

Step e: The server aggregates the information of the first intermediate model and the information of the second intermediate model to obtain the information of the second target model.

In a possible implementation manner, the server performs weighted summation of the information of the first intermediate model and the information of the second intermediate model to obtain the information of the second target model.

It should be noted that, the above steps a to e are described by taking the example that the first device and the second device perform a model training, and the server obtains the information of the second target model as an example. In practical applications, the first device and the second device may perform model training multiple times before the server can obtain the information of the second target model. That is, according to the information of the second target model in step e, the obtained model may be an unfinished second target model, that is, according to the information of the second target model in step e, the obtained model may not converge. In this case, the server may receive information from the intermediate models of the first device and the second device multiple times, and aggregate the received intermediate models each time to obtain the aggregated information. If the obtained model converges, the model is the second target model. If it does not converge, the above steps are repeated until the obtained model converges.

It can be understood that, before step a, the server may also mark the data packet of the second application. Alternatively, the server may mark the data packets of the second application through the administrator. For example, the server receives the data packet of the second application from the first device; the server obtains the marked data packet of the second application according to the data packet of the second application; the server sends the marked data of the second application to the first device Bag.

When the server marks the data packet of the second application, the server obtains the marked data packet of the second application according to the data packet of the second application, which includes: the server marks the data packet of the second application, and obtains the marked data packet of the second application. the data package of the second application.

When the server marks the data packet of the second application by the administrator, the server obtains the marked data packet of the second application according to the data packet of the second application, including: in response to the administrator's input, the server receives the marked data packet the data package of the second application.

Step 904: The server sends the information of the second target model to the first device.

It can be understood that the server can monitor the correct rate of the model identification data packet on the first device. If the correct rate of the model identification data packet on the first device is less than or equal to the third threshold, the server sends an indication message to the first device, indicating that The information is used to instruct the first device to retrain a fourth target model for identifying the data packets of the first application and the data packets of the second application. The fourth target model is obtained by training according to the marked data packets of the first application and the marked data packets of the second application. When the first device identifies the data packet according to the first target model and the second target model, it is the result inferred according to the output entropy. Therefore, the correct rate of identifying the data packet by the fourth target model is greater than the correct rate of identifying the data packet by the first device according to the first target model and the second target model. In this way, the correct rate of identifying the data packet by the first device can be improved.

Exemplarily, if the correct rate of identifying the data packets by the first target model and the second target model is less than or equal to the third threshold, the server sends indication information to the first device. Alternatively, if the correct rate of identifying the data packet by the third target model is less than or equal to the third threshold, the server sends the indication information to the first device. For the introduction of the third target model, reference may be made to the method shown in FIG. 8 above.

Based on the method shown in Figure 9, the server does not need to perform model training, but delegates the model training process to the devices (the first device and the second device) participating in the model training, and the server transfers the information from the intermediate models of multiple devices Aggregation can be performed, which reduces the computing overhead of the server. The number of labeled data packets used by each device participating in model training is also smaller than the number of labeled data packets used by the server when training the model. For these devices, the amount of calculation is not large, and it can save money Model training time.

The above-mentioned methods for identifying data packets shown in FIG. 3 , FIG. 5 , FIG. 7 and FIG. 8 are applied to the first device, and the method for identifying data packets shown in FIG. 9 is applied to the server. The method for identifying the data packet provided by the embodiment of the present application is described below from the perspective of the interaction between the first device, the second device and the server.

As shown in FIG. 10 , another method for identifying a data packet provided by an embodiment of the present application, the method for identifying a data packet may include steps 1001 to 1019 .

Step 1001: The server sends the information of the third initial model and the list of the first applications included in the first application set to the first device.

For the introduction of step 1001, reference may be made to the description in step A above.

Correspondingly, the first device receives the information of the third initial model from the server and the list of the first applications included in the first application set.

Step 1002: The first device trains a third initial model according to the marked data packets of the first application obtained by the first device, and obtains a third intermediate model.

Step 1003: The first device sends the information of the third intermediate model to the server.

For the introduction of steps 1002 to 1003, reference may be made to the above steps 3012 to 3013.

Correspondingly, the server receives the information of the third intermediate model from the first device.

Step 1004: The server sends the information of the third initial model and the list of the first applications included in the first application set to the second device.

For the introduction of step 1004, reference may be made to the description in step C above.

Correspondingly, the second device receives the information of the third initial model and the list of the first applications included in the first application set from the server.

Step 1005: The second device trains the third initial model according to the marked data packets of the first application obtained by the second device, and obtains a fourth intermediate model.

Step 1006: The second device sends the information of the fourth intermediate model to the server.

For the introduction of steps 1005 to 1006, reference may be made to the corresponding descriptions in the foregoing steps 3012 to 3013.

Correspondingly, the server receives the information of the fourth intermediate model from the second device.

It can be understood that the embodiments of the present application do not limit the execution order of steps 1001 to 1003 and steps 1004 to 1006 . For example, in this embodiment of the present application, steps 1001 to 1003 may be performed first, and then steps 1004 to 1006 may be performed. In this embodiment of the present application, steps 1004 to 1006 may also be performed first, and then steps 1001 to 1003 are performed. In this embodiment of the present application, steps 1004 to 1006 and steps 1001 to 1003 may also be performed simultaneously.

Step 1007: The server aggregates the information of the third intermediate model and the information of the fourth intermediate model to obtain the information of the first target model.

For the description of step 1007, reference may be made to the description of step E above.

Step 1008: The server sends the information of the first target model to the first device.

Correspondingly, the first device receives the information of the first target model from the server.

Step 1009: The first device obtains the first target model according to the information of the first target model and the third initial model.

For the introduction of step 1009, reference may be made to the description in step 3015 above.

Step 1010: The server sends the information of the first initial model and the list of second applications included in the second application set to the first device.

For the introduction of step 1010, reference may be made to the description in step a above.

Correspondingly, the first device receives information from the server of the first initial model and a list of second applications included in the second application set.

Step 1011 : The first device trains the first initial model according to the marked data packet of the second application obtained by the first device to obtain a first intermediate model.

Step 1012: The first device sends the information of the first intermediate model to the server.

For the introduction of steps 1011 to 1012, reference may be made to the above steps 3022 to 3023.

Correspondingly, the server receives the information of the first intermediate model from the first device.

Step 1013: The server sends the information of the first initial model and the list of second applications included in the second application set to the second device.

Wherein, for the introduction of step 1013, reference may be made to the description in step c above.

Correspondingly, the second device receives information from the server of the first initial model and a list of second applications included in the second application set.

Step 1014: The second device trains the first initial model according to the marked data packet of the second application obtained by the second device, to obtain a second intermediate model.

Step 1015: The second device sends the information of the second intermediate model to the server.

For the introduction of steps 1014 to 1015, reference may be made to the corresponding descriptions in the foregoing steps 3022 to 3023.

Correspondingly, the server receives the information of the second intermediate model from the second device.

It can be understood that the embodiments of the present application do not limit the execution order of steps 1010 to 1012 and steps 1013 to 1015 . For example, in this embodiment of the present application, steps 1010 to 1012 may be performed first, and then steps 1013 to 1015 may be performed. In this embodiment of the present application, steps 1013 to 1015 may also be performed first, and then steps 1010 to 1012 are performed. In this embodiment of the present application, steps 1013 to 1015 and steps 1010 to 1012 may be performed simultaneously.

Step 1016: The server aggregates the information of the first intermediate model and the information of the second intermediate model to obtain the information of the second target model.

For the description of step 1016, reference may be made to the description of step e above.

Step 1017: The server sends the information of the second target model to the first device.

Correspondingly, the first device receives the information of the second target model from the server.

Step 1018: The first device obtains the second target model according to the information of the second target model and the first initial model.

For the introduction of step 1018, reference may be made to the description in step 3025 above.

Step 1019: The first device acquires the third data packet, and determines the first application or the second application corresponding to the third data packet according to the first target model and the second target model.

For the introduction of step 1019, reference may be made to the description in step 303 above.

Based on the method shown in Figure 10, on the one hand, the server does not need to perform model training, but delegates the model training process to the devices (the first device and the second device) participating in the model training. The information of the model can be aggregated, which reduces the computing overhead of the server. On the other hand, when a new application appears after using the first target model (the new application is the application in the second application set), the first device does not need to use the marked first application set and the second Model training is performed on the data packets of the applications in the application set to obtain a model that can identify both the data packets of the applications in the first application set and the data packets of the applications in the second application set. The first device can perform model training according to the marked data packets of the second application to obtain a second target model, and subsequently, identify the data packets of the applications in the first application set according to the first target model and the second target model, or data packets of applications in the second application set. The number of marked data packets of the second application is much smaller than the number of marked data packets of the first application and the second application, so the calculation amount of the first device is small and the training time is short. . In addition, in the method shown in FIG. 10 , in the case of a newly added application, the first device uses the data package of the marked second application for model training, so the marked first application can be released. data packets, reducing the cost of data storage.

It can be understood that in the case where the first device has acquired the second target model multiple times, when the first device recognizes the third data packet, it needs to acquire the first target model and the plurality of second target models, each of which corresponds to the target model. and then determine the application corresponding to the third data packet according to the obtained multiple output entropies. Therefore, it may take a long time for the first device to identify the third data packet, which affects user experience. In this case, the first device can compress the first target model and multiple target models into one target model, and subsequently, identify the third data packet through the compressed target model, which can save the first device from identifying the third data packet time. Specifically, reference may be made to the method shown in FIG. 11 .

As shown in FIG. 11 , in a possible implementation manner of the method shown in FIG. 10 , the method shown in FIG. 10 further includes step 1101 and step 1102 .

Step 1101: The first device acquires a second initial model.

Step 1102: The first device trains the second initial model to obtain the third target model according to the labeling result of the data packet obtained by the first device by the first target model and the second target model.

For the introduction of

steps

1101 and 1102, reference may be made to the descriptions in

steps

801 and 802 above.

Based on the method shown in FIG. 11 , when the first device acquires the second target model multiple times, the second initial model can be acquired, and the data packets obtained by the first device can be processed according to the first target model and the second target model. Label the results and train the second initial model to obtain the third target model. Subsequently, the first device can identify the data packet according to the third target model, which can save time for the first device to identify the data packet. In addition, by continuously compressing the model, the first device can stabilize the size of the model, which is beneficial to the deployment of the model in the system-on-chip.

The method for identifying the data packets shown in Figure 3, Figure 5, Figure 7-Figure 11 above is introduced by taking the federated learning scenario as an example. The following takes a non-federated learning scenario as an example to introduce the data packet identification method provided by the embodiment of the present application.

As shown in FIG. 12 , another method for identifying a data packet provided by an embodiment of the present application. The method includes steps 1201-1203.

Step 1201: The first device acquires a first target model.

The first apparatus may be the server 101 , the device 102 , the device 103 or the device 104 in FIG. 1 .

For the introduction of the first target model, reference may be made to the corresponding description in the foregoing step 301 .

In a possible implementation manner, the first device acquires the first target model when the first device is initialized (for example, the first device is powered on for the first time, or the first device is restored to factory settings).

In a possible implementation manner, the acquisition of the first target model by the first device includes the following steps 1-3.

Step 1: The first device acquires a data packet of the first application in the marked first application set.

The data packet of the first application in the marked first application set obtained by the first device may be marked manually or marked by a machine.

Step 2: The first device acquires the third initial model and the list of first applications included in the first application set.

For the introduction of the third initial model and the list of the first application, reference may be made to the description in 3011 above.

Step 3: The first device trains the third initial model according to the marked data packets of the first application to obtain the first target model.

For the introduction of step 3, reference may be made to the corresponding description in step 3012 above.

Step 1202: In the case that the trigger condition is satisfied, the first device acquires the second target model.

For the introduction of the triggering condition, reference may be made to the description in step 302 above.

In a possible implementation manner, the acquisition of the second target model by the first device includes the following steps 4-6.

Step 4: The first device acquires the data packet of the second application in the marked second application set.

The data packets of the second application in the marked second application set obtained by the first device may be manually marked or machine marked.

Step 5: The first device acquires the first initial model and a list of second applications included in the second application set.

For the introduction of the list of the first initial model and the second application, reference may be made to the description in 3021 above.

Step 6: The first device trains the first initial model according to the marked data packets of the second application to obtain the second target model.

For the introduction of step 6, reference may be made to the corresponding description in step 3022 above.

It can be understood that each time the trigger condition is satisfied, the first device will acquire the second target model. That is, before step 1203, or after step 1203, the first device may acquire the second target model for multiple times. The difference is that the applications in the second application set corresponding to the second target model acquired each time are different. The second set of applications includes applications installed on the server, the first device or other devices after the first device acquires the target model last time.

Step 1203: The first device acquires the third data packet, and determines the first application or the second application corresponding to the third data packet according to the first target model and the second target model.

For the introduction of step 1203, reference may be made to the description in step 303 above.

Based on the method shown in FIG. 12 , when a new application appears after using the first target model (the new application is the application in the second application set), the first device does not need to use the marked first application Model training is performed on the set and the data packets of the applications in the second application set to obtain a model that can identify both the data packets of the applications in the first application set and the data packets of the applications in the second application set. The first device can perform model training according to the marked data packets of the second application to obtain the second target model, and subsequently, identify the data packets of the applications in the first application set according to the first target model and the second target model, or data packets of applications in the second application set. Because the number of marked data packets of the second application is much smaller than the marked number of data packets of the first application and the second application, in the method shown in FIG. 12, the calculation of the first device The volume is small and the training time is short. In addition, in the method shown in FIG. 12 , in the case of a newly added application, the first device uses the data package of the marked second application for model training, so the marked first application can be released. data packets, reducing the cost of data storage.

It can be understood that in the case where the first device has acquired the second target model multiple times, when the first device recognizes the third data packet, it needs to acquire the first target model and the plurality of second target models, each of which corresponds to the target model. Then, the application corresponding to the third data packet is determined according to the obtained multiple output entropies. Therefore, it may take a long time for the first device to identify the third data packet, which affects user experience. In this case, the first device can compress the first target model and multiple target models into one target model, and subsequently, identify the third data packet by using the compressed target model, which can save the first device from identifying the third data packet time. Specifically, reference may be made to the method shown in FIG. 13 .

As shown in FIG. 13 , in a possible implementation manner of the method shown in FIG. 12 , the method shown in FIG. 12 further includes step 1301 and step 1302 .

Step 1301: The first device acquires a second initial model.

Step 1302: The first device trains the second initial model to obtain the third target model according to the labeling results of the data packets obtained by the first device by the first target model and the second target model.

For the introduction of step 1301 and step 1302, reference may be made to the description in step 801 and step 802 above.

Based on the method shown in FIG. 13 , when the first device acquires the second target model multiple times, the second initial model can be acquired, and the data packets obtained by the first device can be processed according to the first target model and the second target model. Label the results and train the second initial model to obtain the third target model. Subsequently, the first device can identify the data packet according to the third target model, which can save time for the first device to identify the data packet. In addition, the first device can stabilize the size of the model by continuously compressing the model, which is beneficial to the deployment of the model in the system-on-chip.

It can be understood that, in order to implement the above-mentioned functions, the above-mentioned first device, server, or first apparatus, etc., include corresponding hardware structures and/or software modules for executing each function. Those skilled in the art should easily realize that the unit and algorithm operations of each example described in conjunction with the embodiments disclosed herein can be implemented in hardware or in the form of a combination of hardware and computer software. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.

In this embodiment of the present application, the first device, the server, or the first device may be divided into functional modules according to the foregoing method examples. For example, each functional module may be divided corresponding to each function, or two or more functions may be integrated into one in the processing module. The above-mentioned integrated modules can be implemented in the form of hardware, and can also be implemented in the form of software function modules. It should be noted that, the division of modules in the embodiments of the present application is schematic, and is only a logical function division, and there may be other division manners in actual implementation.

For example, in the case of dividing each functional module in an integrated manner, FIG. 14 shows a schematic structural diagram of an apparatus for identifying a data packet. The apparatus may be the first device or a chip or a system-on-chip in the first device, and the apparatus may be used to execute the functions of the first device involved in the foregoing embodiments.

As a possible implementation manner, the apparatus shown in FIG. 14 includes: an acquisition module 1401 and a determination module 1402 .

The obtaining module 1401 is used to obtain the first target model. The first target model is used to extract the first feature information of the first data packet, and determine the first application in the first application set corresponding to the first data packet. Exemplarily, with reference to FIG. 3 , the obtaining module 1401 is configured to perform step 301 .

The obtaining module 1401 is further configured to obtain the second target model when the trigger condition is satisfied. The second target model is used to extract the second feature information of the second data packet, determine the second application in the second application set corresponding to the second data packet, and the first application and the second application set in the first application set The second application in is different. Exemplarily, with reference to FIG. 2 , the obtaining module 1401 is further configured to perform step 302 .

The determining module 1402 is further configured to acquire a third data packet, and determine the first application or the second application corresponding to the third data packet according to the first target model and the second target model. Exemplarily, with reference to FIG. 3 , the determination module 1402 is configured to perform step 303 .

A possible implementation manner, the acquisition module 1401 is specifically configured to receive the information of the first initial model from the server and the list of second applications included in the second application set, where the first initial model is applied according to the second application set. If the number is determined, the list of second applications is used to indicate the correspondence between the second application in the second application set and the output end of the first initial model; the obtaining module 1401 is also specifically configured to obtain the marked second application obtained by the device. The applied data package trains the first initial model to obtain the first intermediate model; the acquisition module 1401 is also specifically used to send the information of the first intermediate model to the server; the acquisition module 1401 is also specifically used to receive the second target from the server The information of the model, the information of the second target model is obtained by aggregating the information of the intermediate models from a plurality of first devices; the obtaining module 1401 is also specifically used to obtain the information of the second target model and the first initial model according to the information of the second target model and the first initial model. Obtain the second target model.

A possible implementation manner, the acquisition module 1401 is also specifically used to acquire the data packet of the second application; the acquisition module 1401 is also specifically used to send the data packet of the second application to the server; the acquisition module 1401 is also specifically used to receive Annotated data packets of the second application from the server.

A possible implementation manner, the determination module 1402 is specifically configured to obtain the first output entropy of the third data packet according to the first target model, and the first output entropy is used to indicate that the application corresponding to the third data packet is the first target model The probability of the predicted application; the determination module 1402 is also specifically configured to obtain the second output entropy of the third data packet according to the second target model, and the second output entropy is used to indicate that the application corresponding to the third data packet is the second target model Probability of the predicted application; the determining module 1402 is further specifically configured to determine the application predicted by the target model corresponding to the output entropy with a lower value among the first output entropy and the second output entropy as the application corresponding to the third data packet.

A possible implementation manner, the device further includes: a training module; an acquisition module 1401, further configured to acquire a second initial model, where the second initial model is based on the number of applications in the first application set and the number of applications in the second application set The number is determined; the training module is used to label the data packets obtained by the device according to the first target model and the second target model, train the second initial model to obtain the third target model, and the third target model is used to extract the third characteristic information, and the application corresponding to the data packet corresponding to the third characteristic information is determined according to the third characteristic information, the third characteristic information includes characteristic information of the data packet corresponding to the third characteristic information, and the data packet corresponding to the third characteristic information is Data packets of applications in the first application set, or data packets of applications in the second application set.

In a possible implementation manner, the apparatus further includes: a receiving module; a receiving module, configured to receive indication information from the server, where the indication information is used to instruct the apparatus to retrain the data packets used to identify the first application and the data packets of the second application the fourth target model.

Wherein, all relevant contents of the operations involved in the foregoing method embodiments can be cited in the functional descriptions of the corresponding functional modules, which will not be repeated here.

In this embodiment, the apparatus is presented in the form of dividing each functional module in an integrated manner. "Module" herein may refer to a specific ASIC, circuit, processor and memory executing one or more software or firmware programs, integrated logic circuit, and/or other device that may provide the functions described above. In a simple embodiment, those skilled in the art can imagine that the device may take the form shown in FIG. 2 .

For example, the processor 201 in FIG. 2 can execute the instructions by calling the computer stored in the memory 203, so that the apparatus executes the data packet identification method in the above method embodiment.

Exemplarily, the function/implementation process of the acquisition module 1401 and the determination module 1402 in FIG. 14 may be implemented by the processor 201 in FIG. 2 calling the computer-executed instructions stored in the memory 203 .

Since the apparatus provided in this embodiment can perform the above-mentioned data packet identification method, the technical effect that can be obtained can be referred to the above-mentioned method embodiments, which will not be repeated here.

For example, in the case of dividing each functional module in an integrated manner, FIG. 15 shows a schematic structural diagram of an apparatus for identifying a data packet. The apparatus may be a server or a chip or a system-on-chip in the server, and the apparatus may be used to execute the functions of the server involved in the foregoing embodiments.

As a possible implementation manner, the apparatus shown in FIG. 15 includes: an acquiring module 1501 and a sending module 1502;

The acquiring module 1501 is used for acquiring information of the first target model. The first target model is used to extract the first feature information of the first data packet, and determine the first application in the first application set corresponding to the first data packet. Exemplarily, with reference to FIG. 9 , the obtaining module 1501 is configured to perform step 901 .

The sending module 1502 is configured to send the information of the first target model to the first device. Exemplarily, with reference to FIG. 9 , the sending module 1502 is configured to perform step 902 .

The obtaining module 1501 is further configured to obtain the information of the second target model when the trigger condition is satisfied. The second target model is used to extract the second feature information of the second data packet, determine the second application in the second application set corresponding to the second data packet, and the first application and the second application set in the first application set The second application in is different. Exemplarily, with reference to FIG. 9 , the obtaining module 1501 is further configured to perform step 903 .

The sending module 1502 is further configured to send the information of the second target model to the first device. Exemplarily, with reference to FIG. 9 , the sending module 1502 is further configured to perform step 904 .

A possible implementation manner, the acquisition module 1501 is specifically configured to send the information of the first initial model and the list of the second applications included in the second application set to the first device, where the first initial model is based on the first initial model in the second application set. The number of the second application is determined, and the list of the second application is used to indicate the corresponding relationship between the second application in the second application set and the output end of the first initial model; the obtaining module 1501 is also specifically configured to receive the information from the first device. Information of the first intermediate model, the first intermediate model is obtained by the first device training the first initial model according to the marked data packet of the second application obtained by the first device; the obtaining module 1501 is also specifically used to send the first device to the first device. The second device sends the information of the first initial model and the list of the second application; the obtaining module 1501 is also specifically configured to receive the information of the second intermediate model from the second device, and the second intermediate model is obtained by the second device according to the second device The marked data package of the second application is obtained by training the first initial model; the acquisition module 1501 is also specifically used to aggregate the information of the first intermediate model and the information of the second intermediate model to obtain the second target model Information.

A possible implementation manner, the acquisition module 1501 is also specifically used to receive the data packet of the second application from the first device; the acquisition module 1501 is also specifically used to acquire the marked second application according to the data packet of the second application. The data packet of the application; the obtaining module 1501 is further specifically configured to send the marked data packet of the second application to the first device.

A possible implementation, the sending module 1502 is further configured to send indication information to the first device if the correct rate of the identification data packets of the first target model and the second target model is less than or equal to the third threshold, and the indication information is used to indicate The first device retrains a fourth target model for identifying the data packets of the first application and the data packets of the second application.

For example, the processor 201 in FIG. 2 can execute the instructions by calling the computer stored in the memory 203, so that the apparatus executes the communication method in the above method embodiment.

Exemplarily, the function/implementation process of the acquiring module 1501 and the sending module 1502 in FIG. 15 may be implemented by the processor 201 in FIG. 2 calling the computer-executed instructions stored in the memory 203 . Alternatively, the function/implementation process of the acquiring module 1501 in FIG. 15 can be implemented by the processor 201 in FIG. 2 calling the computer execution instructions stored in the memory 203, and the function/implementation process of the sending module 1502 in FIG. 2 in the communication interface 204 to achieve.

For example, in the case of dividing each functional module in an integrated manner, FIG. 16 shows a schematic structural diagram of an apparatus for identifying a data packet. The apparatus may be a first apparatus or a chip or a system-on-chip in the first apparatus, and the apparatus may be configured to perform the functions of the first apparatus involved in the foregoing embodiments.

As a possible implementation manner, the apparatus shown in FIG. 16 includes: an acquisition module 1601 and a determination module 1602 .

The obtaining module 1601 is used to obtain the first target model. The first target model is used to extract the first feature information of the first data packet, and determine the first application in the first application set corresponding to the first data packet. Exemplarily, with reference to FIG. 12 , the obtaining module 1601 is configured to perform step 1201 .

The acquiring module 1601 is further configured to acquire the second target model when the trigger condition is satisfied. The second target model is used to extract the second feature information of the second data packet, determine the second application in the second application set corresponding to the second data packet, and the first application and the second application set in the first application set The second application in is different. Exemplarily, with reference to FIG. 12 , the obtaining module 1601 is further configured to perform step 1202 .

The determining module 1602 is configured to acquire the third data packet, and determine the first application or the second application corresponding to the third data packet according to the first target model and the second target model. Exemplarily, with reference to FIG. 12 , the determination module 1602 is configured to perform step 1203 .

A possible implementation manner, the acquisition module 1601 is specifically used to acquire the data package of the second application in the marked second application set; the acquisition module 1601 is also specifically used to acquire the first initial model and the second application set included. A list of second applications, the first initial model is determined according to the number of applications in the second application set, and the list of second applications is used to indicate the correspondence between the second application in the second application set and the output of the first initial model relationship; the obtaining module 1601 is further specifically configured to train the first initial model according to the marked data package of the second application to obtain the second target model.

A possible implementation, the determination module 1602 is specifically configured to obtain the first output entropy of the third data packet according to the first target model, and the first output entropy is used to indicate that the application corresponding to the third data packet is the first target model The probability of the predicted application; the determination module 1602 is also specifically configured to obtain the second output entropy of the third data packet according to the second target model, and the second output entropy is used to indicate that the application corresponding to the third data packet is the second target model Probability of the predicted application; the determining module 1602 is further specifically configured to determine, among the first output entropy and the second output entropy, the application predicted by the target model corresponding to the output entropy with a lower value as the application corresponding to the third data packet.

A possible implementation manner, the apparatus further includes: a training module; an acquisition module 1601, further configured to acquire a second initial model, where the second initial model is based on the number of applications in the first application set and the number of applications in the second application set The number is determined; the training module is used for the labeling results of the data packets obtained by the first device according to the first target model and the second target model, and trains the second initial model to obtain the third target model. The third target model uses is used to extract the third characteristic information, and determine the application corresponding to the data packet corresponding to the third characteristic information according to the third characteristic information. The third characteristic information includes characteristic information of the data packet corresponding to the third characteristic information, and data corresponding to the third characteristic information. The package is a data package of an application in the first application set, or a data package of an application in the second application set.

A possible implementation, the training module is also used to train the third target according to the marked data packets used when acquiring the first target model, and/or the marked data packets used when acquiring the second target model The model, after getting trained, wants the third target model.

A possible implementation, the acquisition module 1601 is also used to retrain the data packets used to identify the first application and the first target model if the correct rate of the data packets identified by the first target model and the second target model is less than or equal to the third threshold. The fourth destination model of the packet of the second application.

For example, the processor 201 in FIG. 2 may call the computer to execute the instructions stored in the memory 203, so that the apparatus executes the data packet identification method in the above method embodiment.

Exemplarily, the function/implementation process of the acquiring module 1601 and the determining module 1602 in FIG. 16 may be implemented by the processor 201 in FIG. 2 calling the computer-executed instructions stored in the memory 203 .

FIG. 17 is a schematic structural diagram of a chip provided by an embodiment of the present application. Chip 170 includes one or more processors 1701 and interface circuits 1702 . Optionally, the chip 170 may further include a bus 1703 . in:

The processor 1701 may be an integrated circuit chip with signal processing capability. In the implementation process, each step of the above-mentioned method may be completed by an integrated logic circuit of hardware in the processor 1701 or an instruction in the form of software. The aforementioned processor 1701 may be a general purpose processor, a digital communicator (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components . Various methods and steps disclosed in the embodiments of this application can be implemented or executed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The interface circuit 1702 is used to transmit or receive data, instructions or information. The processor 1701 can use the data, instructions or other information received by the interface circuit 1702 to perform processing, and can send the processing completion information through the interface circuit 1702 .

Optionally, the chip 170 further includes a memory, which may include a read-only memory and a random access memory, and provides operation instructions and data to the processor. A portion of the memory may also include non-volatile random access memory (NVRAM).

Optionally, the memory stores executable software modules or data structures, and the processor may execute corresponding operations by calling operation instructions stored in the memory (the operation instructions may be stored in the operating system).

Optionally, the chip 170 may be used in a data packet identification apparatus (including a first device, a server, or a first apparatus) involved in the embodiments of the present application. Optionally, the interface circuit 1702 may be used to output the execution result of the processor 1701 . For the identification method of the data packet provided by one or more embodiments of the present application, reference may be made to the foregoing embodiments, and details are not repeated here.

It should be noted that the respective functions of the processor 1701 and the interface circuit 1702 can be implemented by hardware design, software design, or a combination of software and hardware, which is not limited here.

FIG. 18 shows a schematic diagram of the composition of a data packet identification system. As shown in FIG. 18 , the data packet identification system 180 may include: a first device 1801 and a server 1802 . It should be noted that FIG. 18 is only an exemplary drawing, and the embodiments of the present application do not limit the devices and the number of devices included in the data packet identification system 180 shown in FIG. 18 .

Among them, the first device 1801 has the function of the device for identifying the data packet shown in FIG. 14, and is used to obtain the first target model, and when the trigger condition is satisfied, obtain the second target model, and obtain the third data packet, according to The first target model and the second target model determine the first application or the second application corresponding to the third data packet.

The server 1802 has the function of the identification device of the data packet shown in FIG. 15, and can be used to obtain the information of the first target model, send the information of the first target model to the first device 1801, obtain the information of the second target model, and send the information of the second target model to the first device 1801. The first device 1802 sends information of the second target model.

It should be noted that, all relevant contents of the steps involved in the above method embodiments can be cited in the functional description of the corresponding node of the identification system 180 of the data packet, and details are not repeated here.

From the description of the above embodiments, those skilled in the art can clearly understand that for the convenience and brevity of the description, only the division of the above functional modules is used as an example for illustration. In practical applications, the above functions can be allocated as required. It is completed by different functional modules, that is, the internal structure of the device is divided into different functional modules, so as to complete all or part of the functions described above.

In the several embodiments provided in this application, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the device embodiments described above are only illustrative. For example, the division of the modules or units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be Incorporation may either be integrated into another device, or some features may be omitted, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place, or may be distributed to multiple different places . Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, which are stored in a storage medium , including several instructions to make a device (may be a single chip microcomputer, a chip, etc.) or a processor (processor) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a removable hard disk, a ROM, a RAM, a magnetic disk, or an optical disk and other mediums that can store program codes.

The above are only specific embodiments of the present application, but the protection scope of the present application is not limited to this, and any changes or substitutions within the technical scope disclosed in the present application should be covered within the protection scope of the present application. . Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

A method for identifying a data packet, wherein the method comprises:

The first device acquires a first target model, where the first target model is used to extract the first feature information of the first data packet, and determine the first application in the first application set corresponding to the first data packet;

When the trigger condition is met, the first device acquires a second target model, where the second target model is used to extract the second feature information of the second data packet, and determine the second application corresponding to the second data packet a second application in the set, the first application in the first application set is different from the second application in the second application set;

The first device acquires a third data packet, and determines the first application or the second application corresponding to the third data packet according to the first target model and the second target model.
The method according to claim 1, wherein the obtaining, by the first device, the second target model comprises:

The first device receives information from a server about a first initial model and a list of second applications included in the second application set, where the first initial model is determined according to the number of applications in the second application set , the list of the second application is used to indicate the corresponding relationship between the second application in the second application set and the output end of the first initial model;

The first device trains the first initial model according to the marked data packet of the second application obtained by the first device to obtain a first intermediate model;

sending, by the first device, the information of the first intermediate model to the server;

The first device receives information of the second target model from the server, where the information of the second target model is obtained by aggregating information from intermediate models of multiple first devices;

The first device obtains the second target model according to the information of the second target model and the first initial model.
The method according to claim 2, wherein the first device obtains the second target model, further comprising:

obtaining, by the first device, a data packet of the second application;

sending, by the first device, the data packet of the second application to the server;

The first device receives a data packet of the tagged second application from the server.
The method according to any one of claims 1-3, wherein,

The trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold; or,

The trigger condition is that the number of data packets applied in the second application set is greater than or equal to the second threshold; or,

The trigger condition is that the number of applications in the second application set is greater than or equal to a first threshold, and the number of data packets applied in the second application set is greater than or equal to a second threshold.
The method according to any one of claims 1-4, wherein the first device determines, according to the first target model and the second target model, the The first application or the second application, including:

The first device obtains, according to the first target model, a first output entropy of the third data packet, where the first output entropy is used to indicate that an application corresponding to the third data packet is the first target the probability of application of the model prediction;

The first device obtains, according to the second target model, a second output entropy of the third data packet, where the second output entropy is used to indicate that an application corresponding to the third data packet is the second target the probability of application of the model prediction;

The first device determines, among the first output entropy and the second output entropy, the application predicted by the target model corresponding to the output entropy with a lower value as the application corresponding to the third data packet.
The method according to any one of claims 1-5, wherein the method further comprises:

The first device acquires a second initial model, where the second initial model is determined according to the number of applications in the first application set and the number of applications in the second application set;

The first device trains the second initial model to obtain a third target model according to the labeling results of the data packets obtained by the first device by the first target model and the second target model. The three-target model is used to extract third feature information, and determine the application corresponding to the data package corresponding to the third feature information according to the third feature information, where the third feature information includes data corresponding to the third feature information The feature information of the package, the data package corresponding to the third feature information is the data package applied in the first application set, or the data package applied in the second application set.
The method according to claim 6, wherein the method further comprises:

The first device trains the third target model according to the marked data packet used when acquiring the first target model, and/or the marked data packet used when acquiring the second target model, The trained third target model is obtained.
The method according to any one of claims 1-7, wherein the method further comprises:

The first device receives indication information from the server, the indication information is used to instruct the first device to retrain a fourth target for identifying the data packets of the first application and the data packets of the second application Model.
A method for identifying a data packet, wherein the method comprises:

The server obtains the information of the first target model, and the first target model is used to extract the first feature information of the first data packet, and determine the first application in the first application set corresponding to the first data packet;

The server sends the information of the first target model to the first device;

When the trigger condition is satisfied, the server obtains information of the second target model, and the second target model is used to extract the second feature information of the second data packet, and determine the second application corresponding to the second data packet a second application in the set, the first application in the first application set is different from the second application in the second application set;

The server sends the information of the second target model to the first device.
The method according to claim 9, wherein the server obtains the information of the second target model, comprising:

The server sends information of the first initial model and a list of second applications included in the second application set to the first device, where the first initial model is based on the number of applications in the second application set It is determined that the list of the second application is used to indicate the corresponding relationship between the second application in the second application set and the output end of the first initial model;

The server receives the information of the first intermediate model from the first device, where the first intermediate model is the pair of the first device to the second application according to the marked data packet of the second application obtained by the first device. obtained by training the first initial model;

The server sends the information of the first initial model and the list of the second application to the second device;

The server receives the information from the second intermediate model of the second device, where the second intermediate model is the data packet of the marked second application obtained by the second device for the second application to the second device. obtained by training the first initial model;

The server aggregates the information of the first intermediate model and the information of the second intermediate model to obtain the information of the second target model.
The method according to claim 10, wherein the server obtains the information of the second target model, further comprising:

receiving, by the server, a data packet of the second application from the first device;

obtaining, by the server, the marked data packet of the second application according to the data packet of the second application;

The server sends the marked data packet of the second application to the first device.
The method according to any one of claims 9-11, wherein,

The trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold; or,

The trigger condition is that the number of data packets applied in the second application set is greater than or equal to the second threshold; or,

The trigger condition is that the number of applications in the second application set is greater than or equal to a first threshold, and the number of data packets applied in the second application set is greater than or equal to a second threshold.
The method according to any one of claims 9-12, wherein the method further comprises:

If the correct rate of identifying data packets by the first target model and the second target model is less than or equal to a third threshold, the server sends indication information to the first device, where the indication information is used to indicate the first A device retrains a fourth target model for identifying packets of the first application and packets of the second application.
A data packet identification device, characterized in that the device comprises: an acquisition module and a determination module;

The acquisition module is used to acquire a first target model, and the first target model is used to extract the first feature information of the first data packet, and determine the first application in the first application set corresponding to the first data packet ;

The obtaining module is further configured to obtain a second target model when the trigger condition is met, and the second target model is used to extract the second feature information of the second data packet, and determine the corresponding value of the second data packet. a second application in a second application set, where the first application in the first application set is different from the second application in the second application set;

The determining module is further configured to acquire a third data packet, and determine the first application or the second application corresponding to the third data packet according to the first target model and the second target model.
The apparatus of claim 14, wherein:

The acquiring module is specifically configured to receive information from a server of a first initial model and a list of second applications included in the second application set, where the first initial model is applied according to the second application set If the number is determined, the list of the second application is used to indicate the correspondence between the second application in the second application set and the output end of the first initial model;

The obtaining module is further specifically configured to train the first initial model according to the marked data packet of the second application obtained by the device to obtain a first intermediate model;

The obtaining module is further specifically configured to send the information of the first intermediate model to the server;

The acquiring module is further specifically configured to receive information of the second target model from the server, where the information of the second target model is obtained by aggregating information from the intermediate models of a plurality of first devices;

The obtaining module is further specifically configured to obtain the second target model according to the information of the second target model and the first initial model.
The apparatus of claim 15, wherein:

The obtaining module is further specifically configured to obtain the data packet of the second application;

The obtaining module is further specifically configured to send the data packet of the second application to the server;

The acquiring module is further specifically configured to receive the marked data packet of the second application from the server.
The device according to any one of claims 14-16, characterized in that,

The trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold; or,

The trigger condition is that the number of data packets applied in the second application set is greater than or equal to a second threshold; or,

The trigger condition is that the number of applications in the second application set is greater than or equal to a first threshold, and the number of data packets applied in the second application set is greater than or equal to a second threshold.
The device according to any one of claims 14-17, characterized in that,

The determining module is specifically configured to obtain the first output entropy of the third data packet according to the first target model, where the first output entropy is used to indicate that the application corresponding to the third data packet is the the probability of the application predicted by the first target model;

The determining module is further specifically configured to obtain the second output entropy of the third data packet according to the second target model, where the second output entropy is used to indicate that the application corresponding to the third data packet is the specified one. the probability of the application predicted by the second target model;

The determining module is further specifically configured to determine, among the first output entropy and the second output entropy, the application predicted by the target model corresponding to the output entropy with a lower value as the application corresponding to the third data packet.
The apparatus according to any one of claims 14-18, wherein the apparatus further comprises: a training module;

The obtaining module is further configured to obtain a second initial model, where the second initial model is determined according to the number of applications in the first application set and the number of applications in the second application set;

The training module is configured to train the second initial model to obtain a third target model according to the labeling results of the data packets obtained by the device by the first target model and the second target model. The three-target model is used to extract third feature information, and determine the application corresponding to the data package corresponding to the third feature information according to the third feature information, where the third feature information includes data corresponding to the third feature information Feature information of the package, the data package corresponding to the third feature information is the data package applied in the first application set, or the data package applied in the second application set.
The apparatus of claim 19, wherein:

The training module is further configured to train the third target model according to the marked data packets used when acquiring the first target model and/or the marked data packets used when acquiring the second target model. target model, and obtain the third target model after training.
The device according to any one of claims 14-20, wherein the device further comprises: a receiving module;

The receiving module is configured to receive indication information from a server, the indication information is used to instruct the apparatus to retrain a fourth target for identifying the data packets of the first application and the data packets of the second application Model.
A data packet identification device, characterized in that the device comprises: an acquisition module and a transmission module;

The obtaining module is configured to obtain information of the first target model, and the first target model is used to extract the first feature information of the first data packet, and determine the first data packet in the first application set corresponding to the first data packet. an application;

the sending module, configured to send the information of the first target model to the first device;

The obtaining module is further configured to obtain the information of the second target model when the trigger condition is met, and the second target model is used to extract the second feature information of the second data packet, and determine the second data packet a second application in the corresponding second application set, where the first application in the first application set is different from the second application in the second application set;

The sending module is further configured to send the information of the second target model to the first device.
The apparatus of claim 22, wherein:

The acquiring module is specifically configured to send the information of the first initial model and the list of second applications included in the second application set to the first device, where the first initial model is based on the second application set Determined by the number of applications in the second application, the list of the second application is used to indicate the corresponding relationship between the second application in the second application set and the output of the first initial model;

The obtaining module is further specifically configured to receive information from a first intermediate model of the first device, where the first intermediate model is a marked second application obtained by the first device according to the first device obtained by training the first initial model with the data package;

The acquiring module is further specifically configured to send the information of the first initial model and the list of the second application to the second device;

The obtaining module is further specifically configured to receive information from a second intermediate model of the second device, where the second intermediate model is a marked second application obtained by the second device according to the second device The data package is obtained by training the first initial model;

The acquiring module is further specifically configured to aggregate the information of the first intermediate model and the information of the second intermediate model to obtain the information of the second target model.
The device of claim 23, wherein:

The acquiring module is further specifically configured to receive a data packet of the second application from the first device;

The obtaining module is further specifically configured to obtain the marked data packet of the second application according to the data packet of the second application;

The acquiring module is further specifically configured to send the marked data packet of the second application to the first device.
The device according to any one of claims 22-24, characterized in that,

The trigger condition is that the number of applications in the second application set is greater than or equal to the first threshold; or,

The trigger condition is that the number of data packets applied in the second application set is greater than or equal to a second threshold; or,

The trigger condition is that the number of applications in the second application set is greater than or equal to a first threshold, and the number of data packets applied in the second application set is greater than or equal to a second threshold.
The device according to any one of claims 22-25, characterized in that,

The sending module is further configured to send indication information to the first device if the correct rate of the identification data packets of the first target model and the second target model is less than or equal to a third threshold, and the indication information is used instructing the first device to retrain a fourth target model for identifying data packets of the first application and data packets of the second application.
A data packet identification device, characterized in that it comprises: a processor, wherein the processor is coupled with a memory, the memory is used for storing programs or instructions, and when the programs or instructions are executed by the processor, the The apparatus performs a method as claimed in any one of claims 1 to 8, or performs a method as claimed in any one of claims 9 to 13.
A chip, characterized in that it comprises: a processor, the processor is coupled with a memory, the memory is used to store a program or an instruction, and when the program or instruction is executed by the processor, the chip is made to execute A method as claimed in any one of claims 1 to 8 or a method as claimed in any one of claims 9 to 13.
A computer-readable medium on which a computer program or instruction is stored, characterized in that, when the computer program or instruction is executed, the computer executes the method according to any one of claims 1 to 8 or the method as claimed in claim 1. The method of any one of 9 to 13.
A data packet identification system, characterized by comprising: the device according to any one of claims 14-21, and/or the device according to any one of claims 22-26.