Multi-level management IPv6 flow multifunctional monitoring platform

Abstract

The invention relates to a multi-level management IPv6 flow multifunctional monitoring platform which comprises a data acquisition layer, a region monitoring layer, a core analysis layer, a control and arrangement layer and a feedback optimization layer. The data acquisition layer is located at the edge of a network and is responsible for acquiring real-time traffic data and completing preliminary traffic classification and anomaly detection; the area monitoring layer is distributed in each area, constructs an area flow characteristic database by aggregating edge data, and processes local flow abnormity and executes a response strategy at the same time; a core calculation unit of a centralized platform is arranged in the core analysis layer, a global AI model is optimized through federal learning, meanwhile, a double-flow neural network is introduced to fuse global features and personalized features, and cross-regional cooperative monitoring and global optimization are provided; the control and arrangement layer provides dynamic resource allocation and strategy adjustment, and coordinates the operation of global and regional nodes; and the feedback optimization layer continuously optimizes the traffic scheduling and protection strategy in combination with digital twinning and reinforcement learning.

Description

Technical Field

[0001] The present invention relates to the technical field, and in particular to a multi-functional monitoring platform for IPv6 traffic with multi-level management. Background Art

[0002] Currently, IPv6 network traffic monitoring and management face the following technical challenges: Traffic diversity and complexity: The widespread deployment of IPv6 protocol has brought about a variety of traffic types and complex network behaviors. Traditional traffic monitoring technology is difficult to meet the needs of real-time classification and anomaly detection; Distributed and centralized conflicts: Relying solely on a centralized monitoring platform is difficult to meet the performance requirements of large-scale networks, while a fully distributed solution lacks a global perspective and is difficult to perform unified optimization and resource allocation; Insufficient real-time and intelligence: Existing network traffic monitoring tools have limitations in real-time, intelligent anomaly detection, and traffic scheduling optimization, and lack accurate detection and response to complex attacks and abnormal behaviors; Resource utilization and coordination optimization problem: In a multi-region and multi-node environment, how to dynamically adjust resource allocation to meet node requirements while avoiding resource waste or uneven allocation is a key issue; Lack of collaborative optimization mechanism: Traditional monitoring technologies mostly focus on local optimization and lack collaborative optimization capabilities based on global features, making it difficult to adapt to complex cross-regional scenarios.

[0003] Traditional anomaly detection technology usually relies on rule matching (such as threshold-based and pattern recognition-based detection methods), which is simple to implement and easy to deploy; it can provide effective detection for some common attack modes (such as DDoS attacks); however, most traditional methods are based on pre-set rules and are difficult to deal with complex and unknown anomalies in network traffic; as network attack methods continue to escalate, rule matching methods are easily bypassed. Another way is a traffic monitoring solution based on SDN (software defined network). Although SDN implements traffic management for the entire network through a centralized controller. This enables network administrators to visualize and monitor traffic globally and detect traffic fluctuations or anomalies in a timely manner, but in a distributed network environment, the centralized control mode of SDN has limitations. As the scale of the network expands, the control and monitoring of all traffic is concentrated on a single controller, which may lead to performance bottlenecks, especially the traffic of edge nodes cannot be effectively monitored. At the same time, the effectiveness of SDN depends on the structural design of the network topology. If the network topology changes frequently or the configuration is complex, it may increase the difficulty of management.

[0004] To this end, the present invention proposes a multi-functional monitoring platform for IPv6 traffic with multi-level management. Summary of the invention

[0005] The present invention aims at the technical problems existing in the prior art and provides a multi-functional monitoring platform for IPv6 traffic with multi-level management.

[0006] The technical solution of the present invention to solve the above technical problems is as follows: a multi-function monitoring platform for IPv6 traffic with multi-level management; including a data collection layer, a regional monitoring layer, a core analysis layer, a control and arrangement layer, and a feedback optimization layer; The data collection layer is located at the edge of the network and is responsible for collecting real-time traffic data and completing preliminary traffic classification and anomaly detection; The regional monitoring layer is distributed in various regions, and builds a regional traffic feature database by aggregating edge data, while processing local traffic anomalies and executing response strategies; The core analysis layer is equipped with a core computing unit of a centralized platform, which optimizes the global AI model through federated learning and introduces a dual-stream neural network to fuse global features and personalized features, providing cross-regional collaborative monitoring and global optimization. The control and orchestration layer provides dynamic resource allocation and policy adjustment, coordinating the operation of global and regional nodes; The feedback optimization layer combines digital twins and reinforcement learning to continuously optimize traffic scheduling and protection strategies.

[0007] Furthermore, in the multi-level managed IPv6 traffic multi-function monitoring platform, the preliminary traffic classification and anomaly detection include: Traffic classification and filtering formula: ;

[0008] in is the traffic classification result. is the ith edge node, is the probability of type k, is the number of traffic packets of type k in the ith edge node, and is calculated as the ratio of the number of traffic packets of a certain type to the total number of packets in the edge node; Anomaly detection formula: ; ; in is the flow characteristics, is the weight feature, Is it abnormal? is the abnormal threshold.

[0009] Furthermore, the multi-level managed IPv6 traffic multi-function monitoring platform, the construction of a regional traffic feature database by aggregating edge data, and processing local traffic anomalies and executing response strategies include: Regional feature vector construction: , ; in, is the aggregated traffic feature vector of region A, is the feature vector of traffic type k in the ith edge node, is the node weight, is the amount of traffic data collected by the i-th edge node, is the total acquisition weight; Local anomaly detection: ; in is the target optimization function, is the local AI model parameter, D is the feature database of the current region, Based on parameters The model prediction value of is the classification error, is the regularization term, is the weight coefficient of the regularization term.

[0010] Furthermore, the multi-level managed IPv6 traffic multifunctional monitoring platform, wherein the global AI model is optimized through federated learning, and a dual-stream neural network is introduced to fuse global features and personalized features, includes: Initialization phase: The central server initializes the model parameters including the global feature extractor , Personalized encoder and classifier , the initialized model is a global shared model; Client prepares data: Each edge node holds a private dataset , x is the traffic data feature, y is the corresponding label; Federated learning optimization phase: The server selects some edge nodes to participate in training: m edge nodes are randomly selected to participate in the tth round of training; each edge node receives the global model parameters , , ; Update model parameters using local data; Update model parameters , and Upload to the central server; The central server aggregates the parameters uploaded by the edge nodes and updates the global model; The updated global model parameters , and Distribute to each edge node.

[0011] Furthermore, in the multi-level managed IPv6 traffic multi-function monitoring platform, the updating of model parameters using local data includes: The feature extractor extracts global features: ; The personalized encoder extracts personalized features: ; Fusion of global features and personalized features: ; in is the global traffic data, is the label vector distribution, g is the feature fusion function; The classifier outputs a prediction value based on the fused features: , the classifier outputs the prediction result based on the fusion features; Optimize the loss function: ; is the cross entropy loss function, which is used to measure the predicted value The difference between the true value y and Parameter update, use gradient descent to update model parameters: ; ; ; Learning Rate Controls the parameter update step size.

[0012] Furthermore, in the multi-level managed IPv6 traffic multi-function monitoring platform, the central server aggregates the parameters uploaded by the edge nodes and updates the global model including Using weighted average method: ; ; ; in represents the amount of data of edge node i, and m is the total number of edge nodes.

[0013] Furthermore, the multi-level managed IPv6 traffic multi-function monitoring platform, the dynamic resource allocation and policy adjustment, and the coordination of the operation of global and regional nodes include: Using the global traffic characteristics generated by the core analysis layer, the resource requirements of each node are predicted, using a time series prediction model: ; is the resource demand at time t, is the global traffic characteristic in the past, G and b dB are the parameters of the time series model; Dynamically adjust resource allocation of regions and edge nodes based on resource forecast requirements: The optimization goal is to minimize the total resource usage and allocation deviation: ; in is the predicted demand of node i, It is a practical need. is the resource usage cost, is the weight of resource allocation bias.

[0014] Furthermore, the multi-level managed IPv6 traffic multi-function monitoring platform, the combination of digital twins and reinforcement learning, and the continuous optimization of traffic scheduling and protection strategies include: Build a real-time virtual map of the global network to simulate the effects of different control strategies: Use the global network features and regional features generated by the core analysis layer to build a digital twin model: ; is the state of the digital twin model at time t, is the global traffic characteristic, Traffic characteristics of node i, Digital twin model parameters; Simulate the impact of different strategies on global network performance in the digital twin model; optimize strategy selection through simulation: ; is the performance score of strategy S in the twin model.

[0015] The beneficial effects of the present invention are:

[0016] The present invention adopts a multi-level architecture design consisting of data collection layer, regional monitoring layer, core analysis layer, control and orchestration layer, and feedback optimization layer. It can efficiently integrate edge, regional and global features, improve the overall efficiency of monitoring and management, optimize the global AI model through federated learning, and use a dual-stream neural network to fuse global and personalized features, taking into account cross-regional collaborative optimization and localized adaptation needs. Through a layered architecture and multi-technology integration, it takes into account distributed efficient monitoring and centralized global optimization, and solves the management problems of large-scale IPv6 networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a structural diagram of a multi-function monitoring platform for IPv6 traffic with multi-level management. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0019] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, "plurality" means two or more, unless otherwise clearly and specifically defined.

[0020] In the description of the present application, the term "for example" is used to mean "used as an example, illustration or description". Any embodiment described as "for example" in the present application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any technician in the field to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes will not be elaborated in detail to avoid unnecessary details to obscure the description of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present application.

[0021] In one embodiment, a multi-level managed IPv6 traffic multi-function monitoring platform includes a data collection layer, a regional monitoring layer, a core analysis layer, a control and orchestration layer, and a feedback optimization layer; The data collection layer is located at the edge of the network and is responsible for collecting real-time traffic data and completing preliminary traffic classification and anomaly detection; The regional monitoring layer is distributed in various regions, and builds a regional traffic feature database by aggregating edge data, while processing local traffic anomalies and executing response strategies; The core analysis layer is equipped with a core computing unit of a centralized platform, which optimizes the global AI model through federated learning and introduces a dual-stream neural network to fuse global features and personalized features, providing cross-regional collaborative monitoring and global optimization. The control and orchestration layer provides dynamic resource allocation and policy adjustment, coordinating the operation of global and regional nodes; The feedback optimization layer combines digital twins and reinforcement learning to continuously optimize traffic scheduling and protection strategies.

[0022] In this embodiment, the functions and specific operations of each layer are as follows: Data collection layer: Located at the edge node of the network, it is mainly responsible for collecting real-time traffic data and performing preliminary traffic classification and anomaly detection; this layer is located close to the source of network traffic and can respond quickly to traffic changes.

[0023] Real-time traffic collection: collect IPv6 traffic data from different devices or users, such as the source address, destination address, protocol type, traffic size, etc. of the data packet; Preliminary traffic classification: Classify traffic data into different types (such as video streams, web traffic, IoT device traffic, etc.); this helps with subsequent traffic management and analysis; Preliminary anomaly detection: Uses simple algorithms to detect the presence of abnormal traffic, such as a sudden increase in traffic (which may be a DDoS attack), or a change in specific traffic patterns.

[0024] Regional monitoring layer: distributed in various regions, responsible for aggregating traffic data from different edge nodes, building a regional traffic feature database, and executing local traffic anomaly detection and response strategies; Regional data aggregation: Summarize and integrate the traffic data collected by the data collection layer to generate a traffic feature database for the region. For example, statistics on the total traffic volume and traffic type of all nodes in a region; Local anomaly detection: In the regional monitoring layer, in addition to monitoring global traffic, it can also analyze traffic anomalies in specific areas. For example, a sudden surge in traffic in a certain area may indicate a network attack. Response strategy execution: When local traffic anomalies are detected, the preset response strategy is executed, such as blocking malicious traffic, limiting traffic speed, or reallocating network resources.

[0025] Core analysis layer: It is the brain of the entire monitoring platform and is responsible for optimizing the global AI model using federated learning through the core computing unit of the centralized platform. At the same time, it combines the dual-stream neural network to integrate global features and personalized features to provide cross-regional collaborative monitoring and global optimization.

[0026] Federated learning: Traffic data from each region and edge node will not be uploaded directly to the central server, but will be trained through federated learning. This can protect data privacy while improving the optimization effect of the global AI model; Two-stream neural network: This network combines global network traffic characteristics (such as the traffic pattern of the entire network) with personalized characteristics (such as the behavioral characteristics of a specific area or node) to achieve more accurate traffic monitoring and anomaly detection.

[0027] Control and orchestration layer: responsible for coordinating the operation of global and regional nodes, ensuring that network resources can be flexibly allocated as needed to cope with changing traffic demands through dynamic resource allocation and policy adjustment; Dynamic resource allocation: Based on the global traffic characteristics generated by the core analysis layer, the resource requirements of each node, such as bandwidth and computing power, are predicted, and dynamic allocation is performed based on the prediction results; Policy adjustment: Adjust the working policies of regions and edge nodes according to real-time network conditions and policy requirements; for example, when traffic in a certain area increases, adjust network bandwidth or computing resources to adapt to traffic fluctuations.

[0028] Feedback optimization layer: Combine digital twins and reinforcement learning to continuously optimize traffic scheduling and protection strategies. Digital twin technology is used to build a virtual model of the network and simulate the effects of different control strategies; while reinforcement learning is used to continuously optimize and improve strategies based on the simulation results.

[0029] Digital Twin: Create a virtual model of the network to monitor and predict network behavior in real time. Simulate different traffic scheduling strategies and protection measures to evaluate their effectiveness. For example, establish a real-time network virtual map to simulate the impact of a firewall strategy on the entire network traffic. Test in a virtual environment to find the most suitable traffic scheduling solution.

[0030] Reinforcement learning: Using simulation results, the reinforcement learning model continuously adjusts and optimizes strategies. For example, when certain network loads are high, the system automatically optimizes the protection strategy based on historical data and current network status; based on historical network traffic and attack situations, the reinforcement learning model continuously adjusts the traffic scheduling strategy. For example, when a certain type of attack is found to occur frequently, the system will optimize the protection strategy through reinforcement learning, thereby effectively preventing similar attacks.

[0031] In one embodiment, the main task of the data collection layer is to achieve efficient collection, preliminary classification and anomaly detection of IPv6 traffic through distributed probes (such as those based on eBPF or XDP technology). This process includes the following steps: Real-time traffic collection: monitor network interfaces and capture IPv6 packets, including fields such as IPv6 header information, protocol type, source address, and destination address. Data capture tools such as eBPF and XDP have kernel-level performance advantages and can filter and forward data with low latency. Traffic classification: classify data packets according to features such as protocol type, port number, and traffic direction; the classification task can be completed based on statistical models or machine learning models; Anomaly detection: Detect abnormal traffic using rule matching (such as access frequency, port scanning behavior) or machine learning models (such as classifiers based on traffic features); Edge computing: Preliminary data processing and feature extraction are completed locally on edge devices, reducing the amount of data transmitted to the upper layer, thereby reducing the pressure on the core network.

[0032] Traffic classification and filtering formula: ;

[0033] in is the traffic classification result. is the ith edge node, is the probability of type k, is the number of traffic packets of type k in the ith edge node, and is calculated as the ratio of the number of traffic packets of a certain type to the total number of packets in the edge node; Anomaly detection formula: ; ; in, It is an edge node The abnormal score of is the flow characteristics, is the weight feature, Is it abnormal? is the abnormal threshold, if the test result , then determine the data packet There is an anomaly.

[0034] In one embodiment, the core tasks of the regional monitoring layer include constructing feature vectors for data from multiple edge nodes, performing local anomaly detection based on these feature vectors, and assisting the federated learning model in optimizing global and regional traffic trends.

[0035] Regional feature vector construction: , ; in, is the aggregated traffic feature vector of region A, is the feature vector of traffic type k in the ith edge node, is the node weight, is the amount of traffic data collected by the i-th edge node, is the total acquisition weight; Local anomaly detection: ; in is the target optimization function, is the local AI model parameter, D is the feature database of the current region, Based on parameters The model prediction value of is the classification error, is the regularization term, is the weight coefficient of the regularization term.

[0036] In one embodiment, optimizing the global AI model through federated learning and introducing a two-stream neural network to fuse global features and personalized features includes: Initialization phase: The central server initializes the model parameters including the global feature extractor , Personalized encoder and classifier , the initialized model is a global shared model; Client prepares data: Each edge node holds a private dataset , x is the traffic data feature, y is the corresponding label; Federated learning optimization phase: The server selects some edge nodes to participate in training: m edge nodes are randomly selected to participate in the tth round of training; each edge node receives the global model parameters , , ; Update model parameters using local data; Update model parameters , and Upload to the central server; The central server aggregates the parameters uploaded by the edge nodes and updates the global model; The updated global model parameters , and Distribute to each edge node.

[0037] The updating of model parameters using local data includes: The feature extractor extracts global features: ; The personalized encoder extracts personalized features: ; Fusion of global features and personalized features: ; in is the global traffic data, is the label vector distribution, g is the feature fusion function; The classifier outputs a prediction value based on the fused features: , the classifier outputs the prediction result based on the fusion features; Optimize the loss function: ; is the cross entropy loss function, which is used to measure the predicted value The difference between the true value y and Parameter update, use gradient descent to update model parameters: ; ; ; Learning Rate Controls the parameter update step size.

[0038] The central server aggregates the parameters uploaded by the edge nodes and updates the global model including Using weighted average method: ; ; ; in represents the amount of data of edge node i, and m is the total number of edge nodes.

[0039] Specific example: Assume that there is the following data traffic scenario in an IPv6 network: There are multiple subnets (Subnet A, Subnet B, Subnet C) inside a company. These subnets are connected to the Internet through different edge nodes. Assume that an attacker launches a DDoS attack on the company network through a group of botnets, targeting a certain Web service (target IP address: 2001:db8::1). The attack traffic is mainly UDP requests, with 10,000 packets per second, randomly sent from multiple IP addresses. At the same time, Subnets A and B are also running HTTP (TCP) traffic normally, and there is an internal user in Subnet C who uploads a large amount of video data.

[0040] Data collection layer: real-time traffic collection and preliminary detection, Deploy eBPF or XDP probes on the edge nodes of each subnet to capture and initially process traffic: Subnet A: 80% of the collected traffic is HTTP traffic (TCP, destination port 80 / 443), and 20% is abnormal UDP requests with a destination address of 2001:db8::1; Preliminary classification: , ; Preliminary anomaly detection: UDP traffic frequency feature 2000 times / second, port concentration feature 1; anomaly score calculation: ; If the threshold is set to 1000, it is determined that subnet A has abnormal traffic.

[0041] Subnet B: The collected traffic is: 60% HTTP traffic and 40% abnormal UDP requests with the destination address 2001:db8::1.

[0042] Classification and detection: , ; ; Subnet C: The collected traffic: 50% is video streams uploaded by internal users (TCP, destination address is the data center). 50% is abnormal UDP requests.

[0043] Classification and detection: ,

[0044] ; Regional monitoring layer: feature vector construction and local anomaly detection; the regional monitoring layer receives the statistical results of each edge node, performs data aggregation and regional feature vector construction.

[0045] Construction of regional feature vector: Assume that the total traffic volume of edge nodes is , and , then the node weight is: , , ; Regional feature vector: ; Local anomaly detection: Use local AI models to detect abnormal behavior of regional traffic. The target optimization function is: ; Assume that the regional model detects abnormal UDP traffic proportion If the value is higher than the normal threshold of 0.2, the regional traffic is judged to be abnormal; the regional monitoring layer uploads these abnormal detection results and regional characteristics to the core analysis layer.

[0046] Core analysis layer: Optimize the global AI model through federated learning and combine it with a two-stream neural network for feature fusion and analysis.

[0047] Federated learning optimizes the global model: model parameters include feature extractor: ; Personalized encoder: ; Feature fusion: ; Classifier prediction: , the classifier outputs the prediction result based on the fusion features; Optimize the loss function: ; is the cross entropy loss function, which is used to measure the predicted value The difference between the true value y and Parameter update, use gradient descent to update model parameters: ; ; ; Global features: extract macro patterns from traffic in all regions (e.g., a surge in UDP traffic in multiple regions); Personalized features: analyze the characteristics of subnets A, B, and C (e.g., subnet C has a high proportion of video traffic); The core analysis layer identified the characteristics of abnormal UDP traffic (such as destination address 2001:db8::1 and random source address) and determined it to be a DDoS attack.

[0048] In the federated learning phase: Assume that the central server randomly selects all three edge nodes (nodes A, B, and C) to participate in training; Initialize global model parameters: , , ;These parameters are shared to all edge nodes; Each edge node holds private data , is the flow characteristic, is a label; each node updates its local model parameters when receiving the model parameters: Feature Extractor: ; Personalized encoder: ; For example, the global features and personalized codes of node A are: ; ; Feature Fusion: ; Here is the weighted average, with weights of 0.6 and 0.4 respectively.

[0049] The classifier outputs a prediction value based on the fused features: .

[0050] The cross entropy loss function is used to calculate the error between the predicted value and the true label: ; Assumptions , but: ; Parameter update, assuming the learning rate is 0.01: ; Each node uploads the updated parameters and node data volume N.

[0051] The central server updates the global model by weighted average based on the uploaded parameters and data volume: Example: The data volume of node A is 1000, the data volume of node B is 1500, and the data volume of node C is 2000; Assumptions , , ; The global update is: .

[0052] The updated global model parameters are distributed to each edge node and the next round of training begins.

[0053] In one embodiment, the dynamic resource allocation and policy adjustment to coordinate the operation of global and regional nodes includes: Using the global traffic characteristics generated by the core analysis layer, the resource requirements of each node are predicted, using a time series prediction model: ; is the resource demand at time t, is the global traffic characteristic in the past, G and b dB are the parameters of the time series model; Dynamically adjust resource allocation of regions and edge nodes based on resource forecast requirements: The optimization goal is to minimize the total resource usage and allocation deviation: ; in is the predicted demand of node i, It is a practical need. is the resource usage cost, is the weight of resource allocation bias.

[0054] In this embodiment, the global traffic characteristics in the network are obtained from the core analysis layer. These characteristics provide input data for the prediction model to ensure that the model can capture the dynamic changes of the network. According to the historical global traffic characteristics, the time series prediction model is used to predict the resource requirements of each node in the future; according to the predicted resource requirements, the computing resources, storage resources or bandwidth of the regional and edge nodes are dynamically allocated; the optimized resource allocation scheme is applied to the regional nodes and edge nodes of the network, and the allocation effect is monitored in real time; the dynamic resource allocation and policy adjustment technology realizes accurate resource demand prediction and efficient resource allocation through the combination of time series prediction and optimization objective function. This technology can significantly improve the resource utilization and performance of the network, adapt to the needs of complex network environments, and reduce the cost of resource use.

[0055] In one embodiment, the continuous optimization of traffic scheduling and protection strategies by combining digital twins and reinforcement learning includes: Build a real-time virtual map of the global network to simulate the effects of different control strategies: Use the global network features and regional features generated by the core analysis layer to build a digital twin model: ; is the state of the digital twin model at time t, is the global traffic characteristic, Traffic characteristics of node i, Digital twin model parameters; Simulate the impact of different strategies on global network performance in the digital twin model; optimize strategy selection through simulation: ; is the performance score of strategy S in the twin model.

[0056] In this embodiment, the physical state of the network (global traffic, node characteristics, etc.) is mapped to a virtual model to achieve real-time monitoring and prediction. By training and updating the model, the effects of different strategies can be simulated in the virtual space to avoid the risks brought by direct testing in the real network, achieve global and local coordinated optimization, and improve traffic scheduling efficiency and protection strategy effectiveness.

[0057] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0058] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A multi-function monitoring platform for IPv6 traffic with multi-level management, characterized in that: It includes data collection layer, regional monitoring layer, core analysis layer, control and orchestration layer, and feedback optimization layer; The data collection layer is located at the edge of the network and is responsible for collecting real-time traffic data and completing preliminary traffic classification and anomaly detection; The regional monitoring layer is distributed in various regions, and builds a regional traffic feature database by aggregating edge data, while processing local traffic anomalies and executing response strategies; The core analysis layer is equipped with a core computing unit of a centralized platform, which optimizes the global AI model through federated learning and introduces a dual-stream neural network to fuse global features and personalized features, providing cross-regional collaborative monitoring and global optimization. The control and orchestration layer provides dynamic resource allocation and policy adjustment, coordinating the operation of global and regional nodes; The feedback optimization layer combines digital twins and reinforcement learning to continuously optimize traffic scheduling and protection strategies.

2. A multi-function monitoring platform for IPv6 traffic with multi-level management according to claim 1, characterized in that: The preliminary traffic classification and anomaly detection include: Traffic classification and filtering formula: ; ;in is the traffic classification result. is the ith edge node, is the probability of type k, is the number of traffic packets of type k in the ith edge node, and is calculated as the ratio of the number of traffic packets of a certain type to the total number of packets in the edge node; Anomaly detection formula: ； ； in is the flow characteristics, is the weight feature, Is it abnormal? is the abnormal threshold.

3. A multi-function monitoring platform for IPv6 traffic with multi-level management according to claim 1, characterized in that: The process of building a regional traffic feature database by aggregating edge data, processing local traffic anomalies and executing response strategies includes: Regional feature vector construction: ， ； in, is the aggregated traffic feature vector of region A, is the feature vector of traffic type k in the ith edge node, is the node weight, is the amount of traffic data collected by the i-th edge node, is the total acquisition weight; Local anomaly detection: ； in is the target optimization function, is the local AI model parameter, D is the feature database of the current region, Based on parameters The model prediction value of is the classification error, is the regularization term, is the weight coefficient of the regularization term.

4. The multi-function monitoring platform for IPv6 traffic with multi-level management according to claim 1, characterized in that: The optimization of the global AI model through federated learning and the introduction of a two-stream neural network to fuse global features and personalized features include: Initialization phase: The central server initializes the model parameters including the global feature extractor , Personalized encoder and classifier , the initialized model is a global shared model; Client prepares data: Each edge node holds a private dataset , x is the traffic data feature, y is the corresponding label; Federated learning optimization phase: The server selects some edge nodes to participate in training: m edge nodes are randomly selected to participate in the tth round of training; each edge node receives the global model parameters , , ; Update model parameters using local data; Update model parameters , and Upload to the central server; The central server aggregates the parameters uploaded by the edge nodes and updates the global model; The updated global model parameters , and Distribute to each edge node.

5. A multi-function monitoring platform for IPv6 traffic with multi-level management according to claim 4, characterized in that: The updating of model parameters using local data includes: The feature extractor extracts global features: ; The personalized encoder extracts personalized features: ; Fusion of global features and personalized features: ; in is the global traffic data, is the label vector distribution, g is the feature fusion function; The classifier outputs a prediction value based on the fused features: , the classifier outputs the prediction result based on the fusion features; Optimize the loss function: ； is the cross entropy loss function, which is used to measure the predicted value The difference between the true value y and Parameter update, use gradient descent to update model parameters: ； ； ； Learning Rate Controls the parameter update step size.

6. A multi-function monitoring platform for IPv6 traffic with multi-level management according to claim 5, characterized in that: The central server aggregates the parameters uploaded by the edge nodes and updates the global model including Using weighted average method: ； ； ； in represents the amount of data of edge node i, and m is the total number of edge nodes.

7. A multi-function monitoring platform for IPv6 traffic with multi-level management according to claim 1, characterized in that: The dynamic resource allocation and policy adjustment to coordinate the operation of global and regional nodes includes: Using the global traffic characteristics generated by the core analysis layer, the resource requirements of each node are predicted, using a time series prediction model: ； is the resource demand at time t, is the global traffic characteristic in the past, G and b dB are the parameters of the time series model; Dynamically adjust resource allocation of regions and edge nodes based on resource forecast requirements: The optimization goal is to minimize the total resource usage and allocation deviation: ； in is the predicted demand of node i, It is a practical need. is the resource usage cost, is the weight of resource allocation bias.

8. The multi-function monitoring platform for IPv6 traffic with multi-level management according to claim 1, characterized in that: The combination of digital twins and reinforcement learning to continuously optimize traffic scheduling and protection strategies includes: Build a real-time virtual map of the global network to simulate the effects of different control strategies: Use the global network features and regional features generated by the core analysis layer to build a digital twin model: ； is the state of the digital twin model at time t, is the global traffic characteristic, Traffic characteristics of node i, Digital twin model parameters; Simulate the impact of different strategies on global network performance in the digital twin model; optimize strategy selection through simulation: ； is the performance score of strategy S in the twin model.

Images