WO2022077951A1 - 基于深度学习的sketch网络测量方法及电子设备 - Google Patents

基于深度学习的sketch网络测量方法及电子设备 Download PDF

Info

Publication number
WO2022077951A1
WO2022077951A1 PCT/CN2021/101864 CN2021101864W WO2022077951A1 WO 2022077951 A1 WO2022077951 A1 WO 2022077951A1 CN 2021101864 W CN2021101864 W CN 2021101864W WO 2022077951 A1 WO2022077951 A1 WO 2022077951A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
traffic
attribute
measured
network traffic
Prior art date
Application number
PCT/CN2021/101864
Other languages
English (en)
French (fr)
Inventor
李清
谢国锐
段光林
江勇
Original Assignee
鹏城实验室
南方科技大学
清华大学深圳国际研究生院
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 鹏城实验室, 南方科技大学, 清华大学深圳国际研究生院 filed Critical 鹏城实验室
Publication of WO2022077951A1 publication Critical patent/WO2022077951A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
    • G06F18/2415—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches based on parametric or probabilistic models, e.g. based on likelihood ratio or false acceptance rate versus a false rejection rate
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • G06N20/20—Ensemble learning
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/047—Probabilistic or stochastic networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods

Definitions

  • the invention relates to the technical field of network measurement, in particular to a sketch network measurement method and electronic equipment based on deep learning.
  • Network status detection, network fault analysis, and network security defense are important technologies to ensure the robustness and security of modern networks.
  • Network measurement provides basic information for the above technologies and is the foundation of the above technologies.
  • the measurement of massive traffic data has become a difficulty in network measurement, and it is necessary to improve the measurement accuracy as much as possible with limited resources.
  • Sketch is an approximate data structure based on hash, which is widely accepted in the field of network measurement due to its theoretical balance between accuracy and resources.
  • the traditional Sketch uses the hash main table and the hash sub table to store the network traffic with the number of data packets greater than the preset data packet threshold and less than or equal to the preset data packet threshold, respectively. Traffic is frequently exchanged between the primary hash table and the secondary hash table.
  • the hash sub-table is a hash table with no stream ID tag, which means that multiple streams will be hashed to the same location, resulting in a generally large count value.
  • the present invention provides a sketch network measurement method and electronic device based on deep learning, which aims to solve the problem that when the existing Sketch performs network measurement, the network traffic to be measured needs to be measured in the hash main table and the hash slave table. Frequent exchanges between tables lead to inaccurate counts.
  • a deep learning-based sketch network measurement method including:
  • the described deep learning-based sketch network measurement method wherein the step of training a preset network model according to the sampled traffic and the first attribute label to obtain a traffic attribute prediction model includes:
  • the model parameters of the preset network model are updated according to the predicted attribute tag and the first attribute tag, until the training situation of the preset network model satisfies preset conditions, so as to obtain a traffic attribute prediction model.
  • the deep learning-based sketch network measurement method wherein the model parameters of the preset network model are updated according to the predicted attribute label and the first attribute label, until the preset network model is
  • the steps for the training situation to meet the preset conditions include:
  • the model parameters of the preset network model are updated according to the preset parameter learning rate until the loss value is smaller than the preset threshold.
  • the described deep learning-based sketch network measurement method wherein the step of inputting the network traffic to be measured into the traffic attribute prediction model, and acquiring the attribute category of the network traffic to be measured comprises:
  • the attribute category of the network traffic to be measured is acquired.
  • the deep learning-based sketch network measurement method wherein the attribute category includes a first attribute category and a second attribute category, the sketch includes a hash main table and a hash sub-table, and the attribute category is based on the attribute category.
  • the steps of inserting the network traffic to be measured into the sketch for network measurement include:
  • the attribute category is the first attribute category, inserting the network traffic to be measured into the main hash table for network measurement; wherein, the number of data packets of the network traffic of the first attribute category is greater than a preset data packet threshold;
  • the attribute category is the second attribute category
  • the described deep learning-based sketch network measurement method wherein the step of inserting the network traffic to be measured into the hash master table for network measurement includes:
  • the described deep learning-based sketch network measurement method wherein the step of inserting the network traffic to be measured into the hash sub-table for network measurement includes:
  • the network traffic to be measured is inserted into the hash sub-table according to the counter information to perform network measurement.
  • the deep learning-based sketch network measurement method wherein after the step of inserting the network traffic to be measured into the hash sub-table for network measurement according to the counter information, the method includes:
  • the flow ID of the network traffic to be measured is mapped to the counter by the second hash function, and the number of data packets of the network traffic to be measured is obtained;
  • the network traffic to be measured is inserted into the main hash table to perform network measurement.
  • a terminal comprising: a processor and a storage medium communicatively connected to the processor, the storage medium is adapted to store a plurality of instructions; the processor is adapted to call the instructions in the storage medium to execute the The steps of the described deep learning-based sketch network measurement method.
  • a storage medium having a plurality of instructions stored thereon, wherein the instructions are adapted to be loaded and executed by a processor to perform the steps of implementing the deep learning-based sketch network measurement method.
  • the present invention trains the preset network model through the sampling traffic in the sketch, obtains a traffic attribute prediction model for predicting the attribute category of the network traffic to be measured, and calculates the network traffic to be measured according to the prediction result of the traffic attribute prediction model. Inserting into sketch for network measurement avoids frequent exchange of the network traffic to be measured between the main hash table and the secondary hash table, and improves the accuracy of network measurement.
  • Embodiment 1 is a flowchart of an embodiment of a deep learning-based sketch network measurement method provided in Embodiment 1 of the present invention
  • Figure 2 is a schematic structural diagram of an existing sketch
  • FIG. 3 is a schematic structural diagram of a preset network model provided in Embodiment 1 of the present invention.
  • FIG. 4 is a functional schematic diagram of a terminal provided in Embodiment 2 of the present invention.
  • the deep learning-based sketch network measurement method provided by the present invention can be applied to a terminal.
  • the terminal may be, but is not limited to, various personal computers, notebook computers, mobile phones, tablet computers, in-vehicle computers and portable wearable devices.
  • the terminal of the present invention adopts a multi-core processor.
  • the processor of the terminal may be at least one of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU), a video processing unit (Video Processing Unit, VPU), and the like.
  • the present invention provides a sketch network measurement method based on deep learning.
  • FIG. 1 is a flowchart of an embodiment of a deep learning-based sketch network measurement method provided by the present invention.
  • the deep learning-based sketch network measurement method has four steps:
  • Sketch is a data structure used to count the number of packets of network traffic.
  • the traditional Sketch structure is shown in Figure 2, including the main hash table and the secondary hash table.
  • the main hash table is used to count the network traffic with the number of data packets greater than the preset data packet threshold
  • the secondary hash table is used to count the data packets. Network traffic with the number of packets less than or equal to the preset packet threshold is counted.
  • the main hash table contains stream IDs and counters, while the secondary hash table is a hash table without stream ID markers.
  • the sampling traffic in the sketch and the first attribute corresponding to the sampling traffic are obtained. label, so that the traffic attribute prediction model for predicting the attributes of network traffic can be obtained in the subsequent steps.
  • the sampled traffic is the network traffic that has been measured by sketch, and the number of data packets and attribute types are known. After the sampled traffic is queried by sketch, the first attribute label corresponding to the sampled traffic can be generated, which is used for subsequent prediction. Let the network model learn.
  • a network model is preset in this embodiment.
  • the preset network model is trained to obtain a traffic attribute prediction model.
  • the attribute type of the network traffic to be measured is determined by the traffic attribute prediction model, and then the network traffic to be measured is inserted into the main hash table or hash according to the attribute type of the network traffic to be measured.
  • Network measurement is performed in the secondary table to avoid frequent exchange of traffic between the main hash table and the secondary hash table during network measurement, resulting in large measurement errors.
  • step S200 specifically includes:
  • FIG. 3 The structure of the preset network model in this embodiment is shown in FIG. 3 , which includes an embedding module, n convolution modules and a classifier.
  • Each convolution module includes a convolutional layer, an activation function ReLU and a pooling layer MaxPool, and the classifier includes a fully connected layer and a softmax function.
  • the sampled traffic is preprocessed to convert the quintuple data packets in the sampled traffic into a byte vector with a length of 13, and then the preprocessed sampled traffic is input into the preset network model.
  • the preprocessed sample traffic first passes through the embedding module, and each byte vector is mapped into a vector with a length of 256 in the embedding module.
  • the output scale is matrix. Then this matrix passes through n convolution modules, and the result output by the convolution module passes through the classifier to output the predicted attribute label corresponding to the sampling flow.
  • the model parameters of the preset network model are updated according to the predicted attribute label and the first attribute label, until the training situation of the preset network model satisfies the preset condition, so as to obtain the traffic attribute prediction model.
  • step S220 includes:
  • a threshold for judging whether the training situation of the preset network model satisfies the preset condition is preset, and after the predicted attribute label is obtained, the loss value is determined according to the predicted attribute label and the first attribute label. Generally, the smaller the loss value, the better the performance of the network model. After the loss value is obtained, it is further judged whether the loss value is less than the preset threshold; if so, it indicates that the training of the preset network model meets the preset conditions; It means that the training situation of the preset network model does not meet the preset conditions, then the model parameters of the preset network model are updated according to the preset parameter learning rate, and the step of obtaining the predicted attribute label is continued until the loss value is less than the predicted value. Set the threshold.
  • the network traffic to be measured is firstly input into the traffic attribute prediction model that has been trained in the preceding steps, the attribute category of the network traffic to be measured is predicted through the traffic attribute prediction model, and the to-be-measured network traffic is obtained.
  • the attribute category of the measured network traffic so that in the subsequent steps, the network traffic to be measured is inserted into the sketch according to the attribute category of the network traffic to be measured for network measurement, so as to avoid frequent exchange of traffic between the main hash table and the secondary hash table during network measurement. lead to large measurement errors.
  • step S300 specifically includes:
  • the preprocessed network traffic to be measured Before inputting the network traffic under test into the traffic attribute prediction model for attribute category prediction, preprocess the network traffic under test, so that the five-tuple data packets in the network traffic under test are converted into byte vectors with a length of 13, and then the preprocessing
  • the network traffic to be measured after is input into the preset network model.
  • the preprocessed network traffic to be measured first passes through the embedding module, and each byte vector is mapped into a vector with a length of 256 in the embedding module.
  • the preprocessed network traffic to be measured passes through the embedding module and the output scale is matrix. Then this matrix passes through n convolution modules.
  • the result output by the convolution module first acts on the fully connected layer in the classifier, and then outputs the predicted attribute category probability through the softmax function, and then obtains the network traffic to be tested according to the attribute category probability.
  • property category For example, when the attribute category includes the first attribute category and the second attribute category, and the probability of the first attribute category output by the traffic attribute prediction model is 0.2, and the probability of the second attribute category is 0.8, the attribute category of the network traffic to be measured is obtained. is the second attribute category.
  • sketches and sampling traffic are constructed on the data plane, and a flow table is maintained on the data plane to record the currently predicted network traffic.
  • the network traffic to be measured obtains the attribute prediction result in the traffic attribute prediction model, the attribute prediction result It will be recorded in the flow table, and the network traffic to be measured will be inserted into the sketch for network measurement according to the prediction result of this attribute.
  • step S400 includes:
  • the attribute category is the first attribute category
  • the sketch in this embodiment includes a primary hash table and a secondary hash table, and the attribute categories of network traffic include a first attribute category and a second attribute category, wherein the number of data packets of the network traffic of the first attribute category is greater than The preset data packet threshold, the number of data packets of the network traffic of the second attribute category is less than or equal to the preset data packet threshold.
  • the attribute category of the network traffic to be measured predicted by the traffic attribute prediction model is the first attribute category, it indicates that the network traffic to be measured is large traffic, and the network traffic to be measured is inserted into the main hash table for network measurement; when the traffic attribute prediction model When the attribute category of the predicted network traffic to be measured is the second attribute category, it indicates that the network traffic to be measured is small traffic, and the network traffic to be measured is inserted into the hash sub-table for network measurement.
  • the network traffic to be measured is inserted into the main hash table and the secondary hash table according to the attribute category, so as to reduce the counts brought when the network traffic to be measured is exchanged from the secondary hash table to the main hash table error and improve the accuracy of network measurement.
  • step S410 specifically includes:
  • each unit in the main hash table stores a two-tuple, and the two-tuple includes the flow ID and the flow data packet counter, and there are five first hash functions that can map network traffic to hash functions.
  • the unit of the main table After determining that the attribute category of the network traffic to be tested is the first attribute category, obtain the flow ID of the network traffic to be tested, and perform a hash operation on the flow ID of the network traffic to be tested by using the first hash function in the hash main table to obtain The location information of the network traffic to be measured in the main hash table, and then insert the network traffic to be measured into the main hash table according to the location information for network measurement.
  • step S420 specifically includes:
  • step S422 it further includes:
  • the flow ID of the network traffic to be measured is mapped to the counter through the second hash function to obtain The number of data packets of the network traffic to be measured, and determine whether the number of data packets of the network traffic to be measured is less than or equal to the preset data packet threshold. If not, it means that there is an error in the attribute category of the network traffic to be measured predicted by the traffic attribute prediction model. Then, the network traffic to be measured is inserted into the main hash table for network measurement.
  • the present invention also provides a terminal, the principle block diagram of which may be as shown in FIG. 4 .
  • the terminal includes a processor, memory, network interface, display screen and temperature sensor connected through a system bus.
  • the processor of the terminal is used to provide computing and control capabilities.
  • the memory of the terminal includes a non-volatile storage medium and an internal memory.
  • the nonvolatile storage medium stores an operating system and a computer program.
  • the internal memory provides an environment for the execution of the operating system and computer programs in the non-volatile storage medium.
  • the network interface of the terminal is used to communicate with external terminals through a network connection.
  • the computer program is executed by a processor to implement a deep learning-based sketch network measurement method.
  • the display screen of the terminal may be a liquid crystal display screen or an electronic ink display screen, and the temperature sensor of the terminal is pre-set inside the device to detect the current operating temperature of the internal equipment.
  • FIG. 4 is only a block diagram of a partial structure related to the solution of the present invention, and does not constitute a limitation on the terminal to which the solution of the present invention is applied.
  • the specific terminal may include There are more or fewer components than shown in the figures, or some components are combined, or have a different arrangement of components.
  • a terminal including a memory and a processor, a computer program is stored in the memory, and the processor can at least implement the following steps when executing the computer program:
  • the processor when the processor executes the computer program, the processor may further implement: inputting the sampled traffic into a preset network model, and acquiring a predicted attribute label output by the preset network model; according to the predicted attribute The tag and the first attribute tag update the model parameters of the preset network model until the training situation of the preset network model satisfies preset conditions, so as to obtain a traffic attribute prediction model.
  • the processor when the processor executes the computer program, the processor may further implement: determining a loss value according to the predicted attribute label and the first attribute label, and judging whether the loss value is less than a preset threshold; if not , the model parameters of the preset network model are updated according to the preset parameter learning rate until the loss value is less than the preset threshold.
  • the processor may further implement: input the network traffic to be measured into the traffic attribute prediction model, and obtain the attribute category probability output by the traffic attribute prediction model; Attribute category probability, to obtain the attribute category of the network traffic to be measured.
  • the processor when the processor executes the computer program, the processor may further implement: when the attribute category is the first attribute category, inserting the network traffic to be measured into the main hash table for network measurement; wherein, The number of data packets of the network traffic of the first attribute class is greater than the preset data packet threshold; when the attribute class is the second attribute class, the network traffic to be measured is inserted into the hash sub-table for network measurement; wherein, the first The number of data packets of the network traffic of the two attribute categories is less than or equal to the preset data packet threshold.
  • the processor when the processor executes the computer program, the processor may further implement: performing a hash operation on the flow ID of the network traffic to be measured by using the first hash function in the main hash table, and obtaining the location information of the network traffic to be measured in the main hash table; inserting the network traffic to be measured into the main hash table according to the location information to perform network measurement.
  • the processor when the processor executes the computer program, the processor may further implement: performing a hash operation on the flow ID of the network traffic to be measured by using the second hash function in the hash sub-table, and obtaining the The network traffic to be measured is corresponding to the counter information in the hash sub-table; the network traffic to be measured is inserted into the hash sub-table according to the counter information to perform network measurement.
  • the processor when the processor executes the computer program, the processor may further implement: mapping the flow ID of the network traffic under test to the counter by using the second hash function, and obtaining the network under test The number of data packets of the traffic; when the number of data packets of the network traffic to be measured is greater than the preset data packet threshold, the network traffic to be measured is inserted into the main hash table for network measurement.
  • Nonvolatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory.
  • Volatile memory may include random access memory (RAM) or external cache memory.
  • RAM is available in various forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous chain Road (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.
  • the present invention discloses a sketch network measurement method and electronic device based on deep learning.
  • the method includes: obtaining the sampling flow in the sketch and the first attribute label corresponding to the sampling flow;
  • the first attribute label trains a preset network model to obtain a traffic attribute prediction model; inputs the network traffic to be measured into the traffic attribute prediction model to obtain the attribute category of the network traffic to be tested;
  • the network traffic to be measured is inserted into sketch for network measurement.
  • the present invention trains the preset network model through the sampling traffic in the sketch, obtains the traffic attribute prediction model for predicting the attribute category of the network traffic to be measured, and inserts the network traffic to be tested into the sketch according to the prediction result of the traffic attribute prediction model Network measurement is performed to avoid frequent exchange of the network traffic to be measured between the main hash table and the secondary hash table, and to improve the accuracy of network measurement.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • Artificial Intelligence (AREA)
  • Evolutionary Computation (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Software Systems (AREA)
  • Mathematical Physics (AREA)
  • Computing Systems (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • Biophysics (AREA)
  • Computational Linguistics (AREA)
  • General Health & Medical Sciences (AREA)
  • Molecular Biology (AREA)
  • Probability & Statistics with Applications (AREA)
  • Evolutionary Biology (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Medical Informatics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了基于深度学习的sketch网络测量方法及电子设备，包括：获取sketch中的采样流量和采样流量对应的第一属性标签；根据采样流量和第一属性标签对预设网络模型进行训练，得到流量属性预测模型；将待测网络流量输入流量属性预测模型中，获取待测网络流量的属性类别；根据属性类别将所述待测网络流量插入sketch中进行网络测量。本发明通过sketch中的采样流量对预设网络模型进行训练，得到用于对待测网络流量的属性类别进行预测的流量属性预测模型，根据流量属性预测模型的预测结果将待测网络流量插入sketch中进行网络测量，避免了待测网络流量在哈希主表和哈希副表间的频繁交换，提高了网络测量的精度。

Description

基于深度学习的sketch网络测量方法及电子设备 技术领域
本发明涉及网络测量技术领域，具体涉及基于深度学习的sketch网络测量方法及电子设备。
背景技术
网络状态检测、网络故障分析、网络安全防御等是保证现代网络鲁棒性和安全性的重要技术，网络测量为上述技术提供了基本的信息，是上述技术的基础。然而，随着网络的高速发展，测量海量的流量数据成为网络测量的难点，需要在有限的资源下，尽可能提升测量的准确度。其中，Sketch是一种基于散列的近似的数据结构，由于其具备精确度和资源理论上的平衡特性，被网络测量领域广泛接受。
传统的Sketch使用哈希主表和哈希副表分别存储数据包数目大于预设数据包阈值和小于或者等于预设数据包阈值的网络流量，由于不能提前判断待测网络流量的属性，需要在哈希主表和哈希副表间频繁交换流量。而哈希副表是一个没有流ID标记的哈希表，这意味着会有多条流被哈希至同一位置，从而导致计数值普遍偏大。
因此，现有技术还有待于改进和发展。
发明内容
针对现有技术的上述缺陷，本发明提供一种基于深度学习的sketch网络测量方法及电子设备，旨在解决现有Sketch进行网络测量时，待测网络流量需要在哈希主表和哈希副表间频繁交换，导致计数值不准确的问题。
本发明解决技术问题所采用的技术方案如下：
一种基于深度学习的sketch网络测量方法，其中，包括：
获取sketch中的采样流量和所述采样流量对应的第一属性标签；
根据所述采样流量和所述第一属性标签对预设网络模型进行训练，得到流量属性预测模型；
将待测网络流量输入所述流量属性预测模型中，获取所述待测网络流量的属 性类别；
根据所述属性类别将所述待测网络流量插入sketch中进行网络测量。
所述的基于深度学习的sketch网络测量方法，其中，所述根据所述采样流量和所述第一属性标签对预设网络模型进行训练，得到流量属性预测模型的步骤包括：
将所述采样流量输入预设网络模型中，并获取所述预设网络模型输出的预测属性标签；
根据所述预测属性标签和所述第一属性标签对所述预设网络模型的模型参数进行更新，直至所述预设网络模型的训练情况满足预设条件，以得到流量属性预测模型。
所述的基于深度学习的sketch网络测量方法，其中，所述根据所述预测属性标签和所述第一属性标签对所述预设网络模型的模型参数进行更新，直至所述预设网络模型的训练情况满足预设条件的步骤包括：
根据所述预测属性标签和所述第一属性标签确定损失值，并判断所述损失值是否小于预设阈值；
若否，则根据预设的参数学习率对所述预设网络模型的模型参数进行更新，直至所述损失值小于预设阈值。
所述的基于深度学习的sketch网络测量方法，其中，所述将待测网络流量输入所述流量属性预测模型中，获取所述待测网络流量的属性类别的步骤包括：
将待测网络流量输入所述流量属性预测模型中，并获取所述流量属性预测模型输出的属性类别概率；
根据所述属性类别概率，获取所述待测网络流量的属性类别。
所述的基于深度学习的sketch网络测量方法，其中，所述属性类别包括第一属性类别和第二属性类别，所述sketch包括哈希主表和哈希副表，所述根据所述属性类别将所述待测网络流量插入sketch中进行网络测量的步骤包括：
当所述属性类别为第一属性类别时，将所述待测网络流量插入哈希主表中进行网络测量；其中，第一属性类别的网络流量的数据包数目大于预设数据包阈值；
当所述属性类别为第二属性类别时，将所述待测网络流量插入哈希副表中 进行网络测量；其中，第二属性类别的网络流量的数据包数目小于或者等于预设数据包阈值。
所述的基于深度学习的sketch网络测量方法，其中，所述将所述待测网络流量插入哈希主表中进行网络测量的步骤包括：
通过所述哈希主表中的第一哈希函数对所述待测网络流量的流ID进行哈希运算，获取所述待测网络流量在所述哈希主表中的位置信息；
根据所述位置信息将所述待测网络流量插入所述哈希主表中进行网络测量。
所述的基于深度学习的sketch网络测量方法，其中，所述将所述待测网络流量插入哈希副表中进行网络测量的步骤包括：
通过所述哈希副表中的第二哈希函数对所述待测网络流量的流ID进行哈希运算，获取所述待测网络流量在所述哈希副表对应的计数器信息；
根据所述计数器信息将所述待测网络流量插入所述哈希副表中进行网络测量。
所述的基于深度学习的sketch网络测量方法，其中，所述根据所述计数器信息将所述待测网络流量插入所述哈希副表中进行网络测量的步骤之后包括：
通过所述第二哈希函数将所述待测网络流量的流ID映射到所述计数器上，获取所述待测网络流量的数据包数目；
当所述待测网络流量的数据包数目大于预设数据包阈值时，将所述待测网络流量插入所述哈希主表中进行网络测量。
一种终端，其中，包括：处理器、与处理器通信连接的存储介质，所述存储介质适于存储多条指令；所述处理器适于调用所述存储介质中的指令，以执行实现所述的基于深度学习的sketch网络测量方法的步骤。
一种存储介质，其上存储有多条指令，其中，所述指令适于由处理器加载并执行，以执行实现所述的基于深度学习的sketch网络测量方法的步骤。
有益效果：本发明通过sketch中的采样流量对预设网络模型进行训练，得到用于对待测网络流量的属性类别进行预测的流量属性预测模型，根据流量属性预测模型的预测结果将待测网络流量插入sketch中进行网络测量，避免了待测网络流量在哈希主表和哈希副表间的频繁交换，提高了网络测量的精度。
附图说明
图1是本发明实施例一中提供的一种基于深度学习的sketch网络测量方法的一个实施例的流程图；
图2是现有sketch的结构示意图；
图3是本发明实施例一中提供的一种预设网络模型的结构示意图；
图4是本发明实施例二中提供的一种终端的功能原理图。
具体实施方式
为使本发明的目的、技术方案及优点更加清楚、明确，以下参照附图并举实施例对本发明进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。以下对至少一个示例性实施例的描述实际上仅仅是说明性的，决不作为对本发明及其应用或使用的任何限制。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明提供的基于深度学习的sketch网络测量方法，可以应用于终端中。其中，终端可以但不限于是各种个人计算机、笔记本电脑、手机、平板电脑、车载电脑和便携式可穿戴设备。本发明的终端采用多核处理器。其中，终端的处理器可以为中央处理器(Central Processing Unit，CPU)，图形处理器(Graphics Processing Unit，GPU)、视频处理单元(Video Processing Unit，VPU)等中的至少一种。
实施例一
为了解决现有Sketch在进行计数时，由于不能提前判断网络流量的属性，导致计数值不准确的问题，本发明提供了一种基于深度学习的sketch网络测量方法。
请参照图1，图1是本发明提供的一种基于深度学习的sketch网络测量方法的一个实施例的流程图。
在本发明的一个实施例中，所述基于深度学习的sketch网络测量方法有四个步骤：
S100、获取sketch中的采样流量和所述采样流量对应的第一属性标签。
Sketch是用来对网络流量的数据包数目进行计数的数据结构。传统Sketch结构如图2所示，包括哈希主表和哈希副表，哈希主表用于对数据包数目大于预设数据包阈值的网络流量进行计数，哈希副表用于对数据包数目小于或者等于预设数据包阈值的网络流量进行计数。哈希主表中包括流ID和计数器，而哈希副表是一个没有流ID标记的哈希表。
为了减少现有Sketch在进行网络测量时，网络流量从哈希副表交换到哈希主表带入的计数误差，本实施例中获取sketch中的采样流量和所述采样流量对应的第一属性标签，以便后续步骤中得到用于预测网络流量的属性的流量属性预测模型。所述采样流量为已经通过sketch进行网络测量的网络流量，其数据包数目和属性类别是已知的，采样流量经过sketch查询后即可生成采样流量对应的第一属性标签，用于后续的预设网络模型学习。
S200、根据所述采样流量和所述第一属性标签对预设网络模型进行训练，得到流量属性预测模型。
为了使网络流量输入sketch中进行计数时，能提前获悉网络流量的属性类别，本实施例中预先设置一个网络模型，获取到采样流量和第一属性标签后，根据采样流量和第一属性标签对预设网络模型进行训练，得到流量属性预测模型。在待测网络流量插入sketch中进行网络测量之前，通过流量属性预测模型确定待测网络流量的属性类别，然后根据待测网络流量的属性类别确定将待测网络流量插入哈希主表或哈希副表中进行网络测量，避免网络测量时在哈希主表和哈希副表间频繁交换流量，导致测量误差大。
在一具体实施例中，步骤S200具体包括：
S210、将所述采样流量输入预设网络模型中，并获取所述预设网络模型输出的预测属性标签；
S220、根据所述预测属性标签和所述第一属性标签对所述预设网络模型的模型参数进行更新，直至所述预设网络模型的训练情况满足预设条件，以得到流量属性预测模型。
本实施例中预设网络模型的结构如图3所示，其包括一个嵌入模块，n个卷积模块以及一个分类器。每个卷积模块都包括一个卷积层、一个激活函数ReLU和一个池化层MaxPool，分类器包括一个全连接层和一个softmax函数。
获取到采样流量后，对采样流量进行预处理，使采样流量中的五元组数据包转化成长度为13的字节向量，然后将预处理后的采样流量输入预设网络模型中。预处理后的采样流量先经过嵌入模块，各个字节向量在嵌入模块中均被映射成一个长度为256的向量，预处理后的采样流量经过嵌入模块后输出规模为
Figure PCTCN2021101864-appb-000001
的矩阵。随后这个矩阵经过n个卷积模块，卷积模块输出的结果经过分类器输出采样流量对应的预测属性标签。根据预测属性标签和第一属性标签对预设网络模型的模型参数进行更新，直至预设网络模型的训练情况满足预设条件，以得到流量属性预测模型。
在一具体实施例中，步骤S220包括：
S221、根据所述预测属性标签和所述第一属性标签确定损失值，并判断所述损失值是否小于预设阈值；
S222、若否，则根据预设的参数学习率对所述预设网络模型的模型参数进行更新，直至所述损失值小于预设阈值。
具体地，本实施例中预先设置用于判断预设网络模型的训练情况是否满足预设条件的阈值，获取到预测属性标签后，根据预测属性标签和第一属性标签确定损失值。一般损失值越小，则表明网络模型的性能越优，获取损失值后，进一步判断损失值是否小于预设阈值；若是，则表明预设网络模型的训练情况满足预设条件；若否，则说明预设网络模型的训练情况不满足预设条件，则根据预设的参数学习率对预设网络模型的模型参数进行更新，并继续执行获取预测属性标签的步骤，直至所述损失值小于预设阈值。
S300、将待测网络流量输入所述流量属性预测模型中，获取所述待测网络流量的属性类别。
当有网络流量需要进行网络测量时，首先将待测网络流量输入前述步骤中已经训练的流量属性预测模型中，通过所述流量属性预测模型对待测网络流量的属性类别进行预测，获取所述待测网络流量的属性类别，以便后续步骤中根据待测网络流量的属性类别将待测网络流量插入sketch中进行网络测量，避免网络测量 时在哈希主表和哈希副表间频繁交换流量，导致测量误差大。
在一具体实施例中，步骤S300具体包括：
S310、将待测网络流量输入所述流量属性预测模型中，并获取所述流量属性预测模型输出的属性类别概率；
S320、根据所述属性类别概率，获取所述待测网络流量的属性类别。
将待测网络流量输入流量属性预测模型进行属性类别预测前，对待测网络流量进行预处理，使待测网络流量中的五元组数据包转化成长度为13的字节向量，然后将预处理后的待测网络流量输入预设网络模型中。预处理后的待测网络流量先经过嵌入模块，各个字节向量在嵌入模块中均被映射成一个长度为256的向量，预处理后的待测网络流量经过嵌入模块后输出规模为
Figure PCTCN2021101864-appb-000002
的矩阵。随后这个矩阵经过n个卷积模块，卷积模块输出的结果在分类器内首先与全连接层作用，然后通过softmax函数输出预测的属性类别概率，然后根据属性类别概率，获取待测网络流量的属性类别。例如，当属性类别包括第一属性类别和第二属性类别，且流量属性预测模型输出的第一属性类别的概率为0.2，第二属性类别的概率为0.8，则获取待测网络流量的属性类别为第二属性类别。
S400、根据所述属性类别将所述待测网络流量插入sketch中进行网络测量。
具体地，本实施例中在数据平面构建sketch和采样流量，数据平面维护一个流表记录目前已经预测的网络流量，待测量网络流量在流量属性预测模型中得到属性预测结果后，该属性预测结果会被记录在流表中，并根据该属性预测结果将待测网络流量插入sketch中进行网络测量。
在一具体实施例中，步骤S400包括：
S410、当所述属性类别为第一属性类别时，将所述待测网络流量插入哈希主表中进行网络测量；其中，第一属性类别的网络流量的数据包数目大于预设数据包阈值；
S420、当所述属性类别为第二属性类别时，将所述待测网络流量插入哈希副表中进行网络测量；其中，第二属性类别的网络流量的数据包数目小于或者等于预设数据包阈值。
具体地，本实施例中的sketch包括哈希主表和哈希副表，网络流量的属性类别包括第一属性类别和第二属性类别，其中，第一属性类别的网络流量的数据包 数目大于预设数据包阈值，第二属性类别的网络流量的数据包数目小于或者等于预设数据包阈值。当流量属性预测模型预测的待测网络流量的属性类别为第一属性类别时，说明待测网络流量为大流量，将待测网络流量插入哈希主表中进行网络测量；当流量属性预测模型预测的待测网络流量的属性类别为第二属性类别时，说明待测网络流量为小流量，将待测网络流量插入哈希副表中进行网络测量。本实施例中进行网络测量时，根据属性类别将待测网络流量插入哈希主表和哈希副表中，减少待测网络流量从哈希副表交换到哈希主表时带入的计数误差，提高网络测量的准确性。
在一具体实施例中，步骤S410中将所述待测网络流量插入哈希主表中进行网络测量的步骤具体包括：
S411、通过所述哈希主表中的第一哈希函数对所述待测网络流量的流ID进行哈希运算，获取所述待测网络流量在所述哈希主表中的位置信息；
S412、根据所述位置信息将所述待测网络流量插入所述哈希主表中进行网络测量。
具体地，本实施例中哈希主表中每个单元存储两元组，所述两元组包括流ID和该流数据包计数器，同时有5个第一哈希函数可以映射网络流量到哈希主表的单元。在确定待测网络流量的属性类别为第一属性类别后，获取待测网络流量的流ID，通过哈希主表中的第一哈希函数对待测网络流量的流ID进行哈希运算，获取待测网络流量在哈希主表中的位置信息，然后根据位置信息将待测网络流量插入哈希主表中进行网络测量。
在一具体实施例中，步骤S420中将所述待测网络流量插入哈希副表中进行网络测量的步骤具体包括：
S421、通过所述哈希副表中的第二哈希函数对所述待测网络流量的流ID进行哈希运算，获取所述待测网络流量在所述哈希副表对应的计数器信息；
S422、根据所述计数器信息将所述待测网络流量插入所述哈希副表中进行网络测量。
具体地，本实施例中哈希副表是一个有2个哈希函数的2D数组(长w＝28672，宽d＝2)，2D数组中每一维度对应一个第二哈希函数，2D数组中每个单元对应一个流数据包计数器。在确定待测网络流量的属性类别为第二属性类别后，获取 待测网络流量的流ID，通过哈希副表中的第二哈希函数对待测网络流量的流ID进行哈希运算，获取待测网络流量在哈希副表对应的计数器信息，然后根据计数器信息将待测网络流量插入哈希副表中进行网络测量。
在一具体实施例中，步骤S422之后还包括：
S423、通过所述第二哈希函数将所述待测网络流量的流ID映射到所述计数器上，获取所述待测网络流量的数据包数目；
S424、当所述待测网络流量的数据包数目大于预设数据包阈值时，将所述待测网络流量插入所述哈希主表中进行网络测量。
考虑到流量属性预测模型存在预测误差，本实施例中在待测网络流量插入哈希副表中进行网络测量后，通过第二哈希函数将待测网络流量的流ID映射到计数器上，获得待测网络流量的数据包数目，并判断待测网络流量的数据包数目是否小于或者等于预设数据包阈值，若否，则说明流量属性预测模型预测的待测网络流量的属性类别存在误差，则将待测网络流量插入哈希主表中进行网络测量。
实施例二
基于上述实施例，本发明还提供了一种终端，其原理框图可以如图4所示。该终端包括通过系统总线连接的处理器、存储器、网络接口、显示屏和温度传感器。其中，该终端的处理器用于提供计算和控制能力。该终端的存储器包括非易失性存储介质、内存储器。该非易失性存储介质存储有操作系统和计算机程序。该内存储器为非易失性存储介质中的操作系统和计算机程序的运行提供环境。该终端的网络接口用于与外部的终端通过网络连接通信。该计算机程序被处理器执行时以实现一种基于深度学习的sketch网络测量方法。该终端的显示屏可以是液晶显示屏或者电子墨水显示屏，该终端的温度传感器是预先在装置内部设置，用于检测内部设备的当前运行温度。
本领域技术人员可以理解，图4中示出的原理框图，仅仅是与本发明方案相关的部分结构的框图，并不构成对本发明方案所应用于其上的终端的限定，具体的终端可以包括比图中所示更多或更少的部件，或者组合某些部件，或者具有不同的部件布置。
在一个实施例中，提供了一种终端，包括存储器和处理器，存储器中存储有计算机程序，该处理器执行计算机程序时至少可以实现以下步骤：
获取sketch中的采样流量和所述采样流量对应的第一属性标签；
根据所述采样流量和所述第一属性标签对预设网络模型进行训练，得到流量属性预测模型；
将待测网络流量输入所述流量属性预测模型中，获取所述待测网络流量的属性类别；
根据所述属性类别将所述待测网络流量插入sketch中进行网络测量。
在其中的一个实施例中，该处理器执行计算机程序时还可以实现：将所述采样流量输入预设网络模型中，并获取所述预设网络模型输出的预测属性标签；根据所述预测属性标签和所述第一属性标签对所述预设网络模型的模型参数进行更新，直至所述预设网络模型的训练情况满足预设条件，以得到流量属性预测模型。
在其中的一个实施例中，该处理器执行计算机程序时还可以实现：根据所述预测属性标签和所述第一属性标签确定损失值，并判断所述损失值是否小于预设阈值；若否，则根据预设的参数学习率对所述预设网络模型的模型参数进行更新，直至所述损失值小于预设阈值。
在其中的一个实施例中，该处理器执行计算机程序时还可以实现：将待测网络流量输入所述流量属性预测模型中，并获取所述流量属性预测模型输出的属性类别概率；根据所述属性类别概率，获取所述待测网络流量的属性类别。
在其中的一个实施例中，该处理器执行计算机程序时还可以实现：当所述属性类别为第一属性类别时，将所述待测网络流量插入哈希主表中进行网络测量；其中，第一属性类别的网络流量的数据包数目大于预设数据包阈值；当所述属性类别为第二属性类别时，将所述待测网络流量插入哈希副表中进行网络测量；其中，第二属性类别的网络流量的数据包数目小于或者等于预设数据包阈值。
在其中的一个实施例中，该处理器执行计算机程序时还可以实现：通过所述哈希主表中的第一哈希函数对所述待测网络流量的流ID进行哈希运算，获取所述待测网络流量在所述哈希主表中的位置信息；根据所述位置信息将所述待测网络流量插入所述哈希主表中进行网络测量。
在其中的一个实施例中，该处理器执行计算机程序时还可以实现：通过所述哈希副表中的第二哈希函数对所述待测网络流量的流ID进行哈希运算，获取所 述待测网络流量在所述哈希副表对应的计数器信息；根据所述计数器信息将所述待测网络流量插入所述哈希副表中进行网络测量。
在其中的一个实施例中，该处理器执行计算机程序时还可以实现：通过所述第二哈希函数将所述待测网络流量的流ID映射到所述计数器上，获取所述待测网络流量的数据包数目；当所述待测网络流量的数据包数目大于预设数据包阈值时，将所述待测网络流量插入所述哈希主表中进行网络测量。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的计算机程序可存储于一非易失性计算机可读取存储介质中，该计算机程序在执行时，可包括如上述各方法的实施例的流程。其中，本发明所提供的各实施例中所使用的对存储器、存储、数据库或其它介质的任何引用，均可包括非易失性和/或易失性存储器。非易失性存储器可包括只读存储器(ROM)、可编程ROM(PROM)、电可编程ROM(EPROM)、电可擦除可编程ROM(EEPROM)或闪存。易失性存储器可包括随机存取存储器(RAM)或者外部高速缓冲存储器。作为说明而非局限，RAM以多种形式可得，诸如静态RAM(SRAM)、动态RAM(DRAM)、同步DRAM(SDRAM)、双数据率SDRAM(DDRSDRAM)、增强型SDRAM(ESDRAM)、同步链路(Synchlink)DRAM(SLDRAM)、存储器总线(Rambus)直接RAM(RDRAM)、直接存储器总线动态RAM(DRDRAM)、以及存储器总线动态RAM(RDRAM)等。
综上所述，本发明公开了基于深度学习的sketch网络测量方法及电子设备，方法包括：获取sketch中的采样流量和所述采样流量对应的第一属性标签；根据所述采样流量和所述第一属性标签对预设网络模型进行训练，得到流量属性预测模型；将待测网络流量输入所述流量属性预测模型中，获取所述待测网络流量的属性类别；根据所述属性类别将所述待测网络流量插入sketch中进行网络测量。本发明通过sketch中的采样流量对预设网络模型进行训练，得到用于对待测网络流量的属性类别进行预测的流量属性预测模型，根据流量属性预测模型的预测结果将待测网络流量插入sketch中进行网络测量，避免了待测网络流量在哈希主表和哈希副表间的频繁交换，提高了网络测量的精度。
应当理解的是，本发明的应用不限于上述的举例，对本领域普通技术人员来 说，可以根据上述说明加以改进或变换，所有这些改进和变换都应属于本发明所附权利要求的保护范围。

Claims (10)

  1. 一种基于深度学习的sketch网络测量方法，其特征在于，包括：
    获取sketch中的采样流量和所述采样流量对应的第一属性标签；
    根据所述采样流量和所述第一属性标签对预设网络模型进行训练，得到流量属性预测模型；
    将待测网络流量输入所述流量属性预测模型中，获取所述待测网络流量的属性类别；
    根据所述属性类别将所述待测网络流量插入sketch中进行网络测量。
  2. 根据权利要求1所述的基于深度学习的sketch网络测量方法，其特征在于，所述根据所述采样流量和所述第一属性标签对预设网络模型进行训练，得到流量属性预测模型的步骤包括：
    将所述采样流量输入预设网络模型中，并获取所述预设网络模型输出的预测属性标签；
    根据所述预测属性标签和所述第一属性标签对所述预设网络模型的模型参数进行更新，直至所述预设网络模型的训练情况满足预设条件，以得到流量属性预测模型。
  3. 根据权利要求2所述的基于深度学习的sketch网络测量方法，其特征在于，所述根据所述预测属性标签和所述第一属性标签对所述预设网络模型的模型参数进行更新，直至所述预设网络模型的训练情况满足预设条件的步骤包括：
    根据所述预测属性标签和所述第一属性标签确定损失值，并判断所述损失值是否小于预设阈值；
    若否，则根据预设的参数学习率对所述预设网络模型的模型参数进行更新，直至所述损失值小于预设阈值。
  4. 根据权利要求1所述的基于深度学习的sketch网络测量方法，其特征在于，所述将待测网络流量输入所述流量属性预测模型中，获取所述待测网络流量的属性类别的步骤包括：
    将待测网络流量输入所述流量属性预测模型中，并获取所述流量属性预测模型输出的属性类别概率；
    根据所述属性类别概率，获取所述待测网络流量的属性类别。
  5. 根据权利要求1所述的基于深度学习的sketch网络测量方法，其特征在于，所述属性类别包括第一属性类别和第二属性类别，所述sketch包括哈希主表和哈希副表，所述根据所述属性类别将所述待测网络流量插入sketch中进行网络测量的步骤包括：
    当所述属性类别为第一属性类别时，将所述待测网络流量插入哈希主表中进行网络测量；其中，第一属性类别的网络流量的数据包数目大于预设数据包阈值；
    当所述属性类别为第二属性类别时，将所述待测网络流量插入哈希副表中进行网络测量；其中，第二属性类别的网络流量的数据包数目小于或者等于预设数据包阈值。
  6. 根据权利要求5所述的基于深度学习的sketch网络测量方法，其特征在于，所述将所述待测网络流量插入哈希主表中进行网络测量的步骤包括：
    通过所述哈希主表中的第一哈希函数对所述待测网络流量的流ID进行哈希运算，获取所述待测网络流量在所述哈希主表中的位置信息；
    根据所述位置信息将所述待测网络流量插入所述哈希主表中进行网络测量。
  7. 根据权利要求5所述的基于深度学习的sketch网络测量方法，其特征在于，所述将所述待测网络流量插入哈希副表中进行网络测量的步骤包括：
    通过所述哈希副表中的第二哈希函数对所述待测网络流量的流ID进行哈希运算，获取所述待测网络流量在所述哈希副表对应的计数器信息；
    根据所述计数器信息将所述待测网络流量插入所述哈希副表中进行网络测量。
  8. 根据权利要求7所述的基于深度学习的sketch网络测量方法，其特征在于，所述根据所述计数器信息将所述待测网络流量插入所述哈希副表中进行网络测量的步骤之后包括：
    通过所述第二哈希函数将所述待测网络流量的流ID映射到所述计数器上，获取所述待测网络流量的数据包数目；
    当所述待测网络流量的数据包数目大于预设数据包阈值时，将所述待测网络流量插入所述哈希主表中进行网络测量。
  9. 一种终端，其特征在于，包括：处理器、与处理器通信连接的存储介质，所述存储介质适于存储多条指令；所述处理器适于调用所述存储介质中的指令，以执行实现上 述权利要求1-8任一项所述的基于深度学习的sketch网络测量方法的步骤。
  10. 一种存储介质，其上存储有多条指令，其特征在于，所述指令适于由处理器加载并执行，以执行实现上述权利要求1-8任一项所述的基于深度学习的sketch网络测量方法的步骤。
PCT/CN2021/101864 2020-10-16 2021-06-23 基于深度学习的sketch网络测量方法及电子设备 WO2022077951A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011110727.7 2020-10-16
CN202011110727.7A CN112200256A (zh) 2020-10-16 2020-10-16 基于深度学习的sketch网络测量方法及电子设备

Publications (1)

Publication Number Publication Date
WO2022077951A1 true WO2022077951A1 (zh) 2022-04-21

Family

ID=74010440

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/101864 WO2022077951A1 (zh) 2020-10-16 2021-06-23 基于深度学习的sketch网络测量方法及电子设备

Country Status (2)

Country Link
CN (1) CN112200256A (zh)
WO (1) WO2022077951A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115834427A (zh) * 2022-11-08 2023-03-21 清华大学 高速网络流被动测量方法及装置
CN116471196A (zh) * 2023-06-19 2023-07-21 宏景科技股份有限公司 运维监控网络维护方法、系统及设备
CN116886433A (zh) * 2023-08-18 2023-10-13 内蒙古工业大学 一种基于深度对比学习的加密异常流量检测方法

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112200256A (zh) * 2020-10-16 2021-01-08 鹏城实验室 基于深度学习的sketch网络测量方法及电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170063893A1 (en) * 2015-08-28 2017-03-02 Cisco Technology, Inc. Learning detector of malicious network traffic from weak labels
CN109639481A (zh) * 2018-12-11 2019-04-16 深圳先进技术研究院 一种基于深度学习的网络流量分类方法、系统及电子设备
CN110149280A (zh) * 2019-05-27 2019-08-20 中国科学技术大学 网络流量分类方法和装置
CN111355671A (zh) * 2019-12-31 2020-06-30 鹏城实验室 基于自注意机制的网络流量分类方法、介质及终端设备
CN112200256A (zh) * 2020-10-16 2021-01-08 鹏城实验室 基于深度学习的sketch网络测量方法及电子设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170063893A1 (en) * 2015-08-28 2017-03-02 Cisco Technology, Inc. Learning detector of malicious network traffic from weak labels
CN109639481A (zh) * 2018-12-11 2019-04-16 深圳先进技术研究院 一种基于深度学习的网络流量分类方法、系统及电子设备
CN110149280A (zh) * 2019-05-27 2019-08-20 中国科学技术大学 网络流量分类方法和装置
CN111355671A (zh) * 2019-12-31 2020-06-30 鹏城实验室 基于自注意机制的网络流量分类方法、介质及终端设备
CN112200256A (zh) * 2020-10-16 2021-01-08 鹏城实验室 基于深度学习的sketch网络测量方法及电子设备

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
XIE, GUORUI; LI, QING; DUAN, GUANGLIN; JIANG, YONG: "Accurate Network Measurements: Deep Learning Enhanced Sketch", PENG CHENG LABORATORY COMMUNICATIONS, vol. 2021, no. 1, 31 March 2021 (2021-03-31), CN, pages 41 - 52, XP009535801 *
YANG TONG, JIANG JIE, LIU PENG, HUANG QUN, GONG JUNZHI, ZHOU YANG, MIAO RUI, LI XIAOMING, UHLIG STEVE: "Elastic Sketch: Adaptive and Fast Network-wide Measurements", PROCEEDINGS OF THE 2018 CONFERENCE OF THE ACM SPECIAL INTEREST GROUP ON DATA COMMUNICATION (SIGCOMM), 22 June 2018 (2018-06-22), pages 1 - 15, XP055818278, DOI: 10.1145/3230543.3230544 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115834427A (zh) * 2022-11-08 2023-03-21 清华大学 高速网络流被动测量方法及装置
CN116471196A (zh) * 2023-06-19 2023-07-21 宏景科技股份有限公司 运维监控网络维护方法、系统及设备
CN116471196B (zh) * 2023-06-19 2023-10-20 宏景科技股份有限公司 运维监控网络维护方法、系统及设备
CN116886433A (zh) * 2023-08-18 2023-10-13 内蒙古工业大学 一种基于深度对比学习的加密异常流量检测方法

Also Published As

Publication number Publication date
CN112200256A (zh) 2021-01-08

Similar Documents

Publication Publication Date Title
WO2022077951A1 (zh) 基于深度学习的sketch网络测量方法及电子设备
WO2021169473A1 (zh) 模型性能优化方法、装置、设备及存储介质
US11995543B2 (en) Wafer processing method and apparatus, storage medium and electronic device
CN111429482A (zh) 目标跟踪方法、装置、计算机设备和存储介质
CN110751149B (zh) 目标对象标注方法、装置、计算机设备和存储介质
WO2022027913A1 (zh) 目标检测模型生成方法、装置、设备及存储介质
EP4170662A1 (en) Methods for determining interaction information and for training prediction model, an apparatus, and medium
Artemenko et al. Bootstrap and Counter-Bootstrap approaches for formation of the cortege of Informative indicators by Results of Measurements
US20210192965A1 (en) Question correction method, device, electronic equipment and storage medium for oral calculation questions
WO2019148706A1 (zh) web入侵检测方法、装置、计算机设备和存储介质
CN111814740A (zh) 指针仪表读数的识别方法、装置、计算机设备和存储介质
CN108229494A (zh) 网络训练方法、处理方法、装置、存储介质和电子设备
CN114596302A (zh) 一种pcb板缺陷检测方法、系统、介质、设备及终端
CN111124895A (zh) 一种主次峰值比计算算法的蜕变测试方法
CN111259903A (zh) 识别表计示数方法、装置、可读存储介质和计算机设备
CN113808132A (zh) 三维网络模型质量检测方法、装置和计算机设备
WO2021036681A1 (zh) 数据验证方法、装置、计算机设备和存储介质
CN116205918B (zh) 基于图卷积的多模态融合半导体检测方法、装置及介质
CN110909804B (zh) 基站异常数据的检测方法、装置、服务器和存储介质
CN116597246A (zh) 模型训练方法、目标检测方法、电子设备及存储介质
CN116385460A (zh) 细胞图像处理方法、装置和计算机设备
EP4050560B1 (en) Wafer testing method and apparatus, and device and storage medium
CN111640096B (zh) 电子产品外观的检测方法、装置及终端
CN112379967B (zh) 模拟器检测方法、装置、设备及介质
CN113989632A (zh) 一种遥感图像桥梁检测方法、装置、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21879000

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21879000

Country of ref document: EP

Kind code of ref document: A1