Data stream identification method and apparatus

Patent metadata

Field	Value
Publication number	US-11665100-B2
Application number	US-202016894425-A
Country	US
Kind code	B2
Filing date	Jun 5, 2020
Priority date	Dec 8, 2017
Publication date	May 30, 2023
Grant date	May 30, 2023

Abstract

This application provides a data stream identification method and apparatus and belongs to the field of Internet technologies. The method includes: obtaining packet transmission attribute information of N consecutive packets in a target data stream; generating feature images of the packet transmission attribute information of the N consecutive packets based on the packet transmission attribute information of the N consecutive packets; and inputting the feature images into a pre-trained image classification model, to obtain a target application identifier corresponding to the target data stream. According to this application, accuracy of identifying an application identifier corresponding to a data stream can be improved.

First claim

What is claimed is:

1. A method, comprising:
obtaining packet transmission attribute information of N consecutive packets in a target data stream, wherein N comprises a positive integer greater than 1;
generating feature images of the packet transmission attribute information of the N consecutive packets based on probability distribution information of the packet transmission attribute information of the N consecutive packets; and
inputting the feature images into a pre-trained image classification model, to obtain a target application identifier corresponding to the target data stream.

2. The method of claim 1 , wherein packet transmission attribute information of each packet comprises at least one type of packet transmission attribute information; and
generating feature images of the packet transmission attribute information of the N consecutive packets based on the probability distribution information of the packet transmission attribute information of the N consecutive packets comprises:
organizing a same type of packet transmission attribute information in the packet transmission attribute information of the N consecutive packets into a sequence in an order of packet arrival time, to obtain at least one type of transmission attribute information sequence;
determining a static behavior feature matrix and a dynamic behavior feature matrix that are corresponding to each type of transmission attribute information sequence in the at least one type of transmission attribute information sequence, wherein the static behavior feature matrix comprises a feature matrix used to describe a marginal probability distribution p(I j ) of the transmission attribute information sequence, the dynamic behavior feature matrix comprises a feature matrix used to describe a conditional probability distribution p(I j+1 |I j ) of the transmission attribute information sequence, I j comprises packet transmission attribute information corresponding to any packet of the N consecutive packets in the transmission attribute information sequence, and I j+1 comprises packet transmission attribute information corresponding to a next packet of the any packet in the transmission attribute information sequence; and
using the static behavior feature matrix and the dynamic behavior feature matrix as the feature images of the packet transmission attribute information of the N consecutive packets.

3. The method of claim 2 , wherein the packet transmission attribute information of each packet comprises one or more of the following types of packet transmission attribute information: a packet length, a packet arrival time interval, and a packet upstream/downstream attribute.

4. The method of claim 2 , wherein the determining a static behavior feature matrix and a dynamic behavior feature matrix that are corresponding to each type of transmission attribute information sequence in the at least one type of transmission attribute information sequence comprises:
for each transmission attribute information sequence in the at least one type of transmission attribute information sequence {I 1 , I 2 , . . . , I j , . . . I n+1 }, obtaining a first subsequence {I 1 , I 2 , . . . , I j , . . . , I n } and a second subsequence {I 2 , I 3 , . . . , I j , . . . , I n+1 } in the transmission attribute information sequence, and mapping the first subsequence and the second subsequence to multidimensional feature space by using a preset mapping function φ(I j ), to obtain a first multidimensional feature matrix Φ=[φ(I 1 ), φ(I 2 ), . . . , φ(I j ), . . . , φ(I n )] corresponding to the first subsequence and a second multidimensional feature matrix Φ + =[φ(I 2 ), φ(I 3 ), . . . , φ(I j ), . . . , φ(I n+1 )] corresponding to the second subsequence, wherein n+1 comprises a sequence length of the transmission attribute information sequence;
determining, based on the first multidimensional feature matrix and a formula

s
⁢
t

=

1
n

⁢
Φ
⁢

Φ
T

,

a static behavior feature matrix corresponding to the transmission attribute information sequence, wherein st comprises the static behavior feature matrix, Φ T comprises a transpose of the first multidimensional feature matrix, and n comprises a sequence length of the first subsequence; and
determining, based on the first multidimensional feature matrix, the second multidimensional feature matrix, and a formula dn =(Φ + Φ T )(ΦΦ T +λI) −1 , a dynamic behavior feature matrix corresponding to the transmission attribute information sequence, wherein dn comprises the dynamic behavior feature matrix, λ comprises a regular term coefficient, and I comprises an identity matrix.

5. The method of claim 1 , wherein the image classification model comprises a convolutional neural network; and
the method further comprises:
when the feature images are input into the image classification model, inputting auxiliary identification information through a fully-connected layer of the image classification model, wherein
the auxiliary identification information comprises at least one or more of the following: the packet transmission attribute information of the N consecutive packets, an Internet Protocol (IP) address of a background server corresponding to the target data stream, and a port identifier of the background server.

6. An apparatus, comprising a memory and a processor operatively coupled to the memory, wherein the processor, wherein the processor is configured to:
obtain packet transmission attribute information of N consecutive packets in a target data stream, wherein N comprises a positive integer greater than 1;
generate feature images of the packet transmission attribute information of the N consecutive packets based on probability distribution information of the packet transmission attribute information of the N consecutive packets; and
input the feature images into a pre-trained image classification model, to obtain a target application identifier corresponding to the target data stream.

7. The apparatus of claim 6 , wherein packet transmission attribute information of each packet comprises at least one type of packet transmission attribute information; and
the processor is further configured to:
organize a same type of packet transmission attribute information in the packet transmission attribute information of the N consecutive packets into a sequence in an order of packet arrival time, to obtain at least one type of transmission attribute information sequence;
determine a static behavior feature matrix and a dynamic behavior feature matrix that are corresponding to each type of transmission attribute information sequence in the at least one type of transmission attribute information sequence, wherein the static behavior feature matrix comprises a feature matrix used to describe a marginal probability distribution p(I j ) of the transmission attribute information sequence, the dynamic behavior feature matrix comprises a feature matrix used to describe a conditional probability distribution p(I j+1 |I j ) of the transmission attribute information sequence, I j comprises packet transmission attribute information corresponding to any packet of the N consecutive packets in the transmission attribute information sequence, and I j+1

Assignees

• Huawei Tech Co Ltd

Inventors

• He Ke
• Chen Zhitang
• Shao Yunfeng

Classifications

• G06N3/0464

  Convolutional networks [CNN, ConvNet] · CPC title

• G06N3/09

  Supervised learning · CPC title

• G06V20/46

  Extracting features or characteristics from the video content, e.g. video fingerprints, representative shots or key frames · CPC title

• G06V10/764

  using classification, e.g. of video objects · CPC title

• H04L47/2483 Primary

  involving identification of individual flows · CPC title