Traffic identification method and traffic identification device

Patent metadata

Field	Value
Publication number	US-12531794-B2
Application number	US-202218050775-A
Country	US
Kind code	B2
Filing date	Oct 28, 2022
Priority date	Apr 30, 2020
Publication date	Jan 20, 2026
Grant date	Jan 20, 2026

Abstract

Embodiments of this application disclose a traffic identification method and a traffic identification device. The method in embodiments of this application includes: The traffic identification device obtains to-be-analyzed traffic of a target data flow. The traffic identification device obtains arrival time intervals of packets of the to-be-analyzed traffic. The traffic identification device determines a type of the to-be-analyzed traffic based on a distribution feature of probabilities of a part or all of the arrival time intervals.

First claim

What is claimed is:

1 . A method, comprising:
obtaining, by a traffic identification device, historical network traffic of a first type; obtaining, by the traffic identification device, arrival time intervals of packets of the historical network traffic of the first type and probabilities of the arrival time intervals of the packets of the historical network traffic of the first type; and establishing, by the traffic identification device, a reference time interval probability distribution model of the first type based on the arrival time intervals of the packets of the historical network traffic of the first type and the probabilities of the arrival time intervals of the packets of the historical network traffic of the first type, comprising:
determining a type of model corresponding to the historical network traffic of the first type;
computing a parameter value of the model corresponding to the historical network traffic of the first type using a maximum likelihood estimation method; and
substituting the parameter value into the model corresponding to the historical network traffic of the first type, to obtain the reference time interval probability distribution model of the first type;
obtaining, by the traffic identification device, to-be-analyzed traffic of a target data flow; measuring, by the traffic identification device, arrival time intervals of packets of the to-be-analyzed traffic; determining, by the traffic identification device, a service type of the to-be-analyzed traffic based on a similarity between a distribution feature of probabilities of a part or all of the arrival time intervals and a distribution feature of the reference time interval probability distribution model of the first type; and performing service assurance based on a priority of the service type.

2 . The method according to claim 1 , wherein determining, by the traffic identification device, the service type of the to-be-analyzed traffic based on the similarity between the distribution feature of the probabilities of the part or all of the arrival time intervals and the distribution feature of the reference time interval probability distribution model of the first type comprises:
computing, by the traffic identification device, a fitting parameter based on the part or all of the arrival time intervals, the probabilities of the part or all of the arrival time intervals, and the reference time interval probability distribution model, wherein the fitting parameter indicates a fitting degree between the distribution feature of the probabilities of the part or all of the arrival time intervals and the reference time interval probability distribution model; and determining, by the traffic identification device, the service type of the to-be-analyzed traffic based on the fitting parameter.

3 . The method according to claim 2 , wherein the fitting parameter comprises a reciprocal of relative entropy and a Kolmogorov-Smirnov (KS) test amount; and
wherein determining, by the traffic identification device, the service type of the to-be-analyzed traffic based on the fitting parameter comprises:
determining, by the traffic identification device when the traffic identification device determines that the reciprocal of the relative entropy is greater than a first preset threshold and the KS test amount is less than a second preset threshold, that the to-be-analyzed traffic is traffic of the first type.

4 . The method according to claim 3 , wherein the traffic of the first type is game traffic.

5 . The method according to claim 1 , wherein the reference time interval probability distribution model comprises a power-law distribution model.

6 . The method according to claim 5 , wherein when the traffic identification device determines the service type of the to-be-analyzed traffic based on the distribution feature of the probabilities of the part of the arrival time intervals, the part of the arrival time intervals are arrival time intervals that are less than a third preset threshold in the arrival time intervals of the packets of the to-be-analyzed traffic.

7 . The method according to claim 6 , further comprising:
determining, by the traffic identification device, first packets of the to-be-analyzed traffic, wherein an arrival time interval of the first packets is less than the third preset threshold; determining, by the traffic identification device, a ratio of a quantity of the first packets to a total quantity of packets comprised in the to-be-analyzed traffic; and when the traffic identification device determines that the ratio is greater than a fourth preset threshold, triggering performing of the determining, by the traffic identification device, the service type of the to-be-analyzed traffic based on the distribution feature of probabilities of the part or all of the arrival time intervals.

8 . The method according to claim 3 , wherein the traffic of the first type is video traffic.

9 . A device, comprising:
at least one processor; and a non-transitory computer readable storage medium storing a program that is executable by the at least one processor, the program including instructions to:
obtain historical network traffic of a first type;
obtain arrival time intervals of packets of the historical network traffic of the first type and probabilities of the arrival time intervals of the packets of the historical network traffic of the first type; and
establish a reference time interval probability distribution model of the first type based on the arrival time intervals of the packets of the historical network traffic of the first type and the probabilities of the arrival time intervals of the packets of the historical network traffic of the first type, comprising:
determining a type of model corresponding to the historical network traffic of the first type;
computing a parameter value of the model corresponding to the historical network traffic of the first type using a maximum likelihood estimation method; and
substituting the parameter value into the model corresponding to the historical network traffic of the first type, to obtain the reference time interval probability distribution model of the first type;
obtain to-be-analyzed traffic of a target data flow;
measure arrival time intervals of packets of the to-be-analyzed traffic;
determine a service type of the to-be-analyzed traffic based on a similarity between a distribution feature of probabilities of a part or all of the arrival time intervals and a distribution feature of the reference time interval probability distribution model of the first type; and
perform service assurance based on a priority of the service type.

10 . The device according to claim 9 , wherein the program includes instructions to:
compute a fitting parameter based on the part or all of the arrival time intervals, the probabilities of the part or all of the arrival time intervals, and the reference time interval probability distribution model, wherein the fitting parameter indicates a fitting degree between the distribution feature of the probabilities of the part or all of the arrival time intervals and the reference time interval probability distribution model; and determine the service type of the to-be-analyzed traffic based on the fitting parameter.

11 . The device according to claim 10 , wherein the fitting parameter comprises a reciprocal of relative entropy and a Kolmogorov-Smirnov (KS) test amount; and
wherein the program includes instructions to:
determine, when the device determines that the reciprocal of the relative entropy is greater than a first preset threshold and the KS test amount is less than a second preset thre

Assignees

• Huawei Tech Co Ltd

Inventors

• Liu Wenqian
• Hu Xinyu
• Wu Jun

Classifications

• H04L45/38

  Flow based routing · CPC title

• H04L43/08

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• H04L41/142

  using statistical or mathematical methods · CPC title

• H04L43/062

  related to network traffic · CPC title

• H04L47/2416

  Real-time traffic · CPC title