Self-intelligence network evaluation method and device based on IOAM stream detection

Abstract

The invention discloses a self-intelligence network evaluation method and device based on IOAM flow detection, and relates to the technical field of network detection. According to the method, the IOAM flow detection technology is utilized, and the real-time monitoring and feature data analysis of the network flow session are combined, so that the network service quality can be accurately evaluated in the target network in real time. Compared with a traditional network quality detection scheme, the method has the advantages that higher detection precision and instantaneity can be provided, and the stability and high efficiency of network flow are ensured. By performing dynamic analysis and feature extraction on the network traffic session data, the abnormal traffic and quality problems in the network can be effectively identified, and the problems of traffic bottleneck, traffic abnormality and the like can be found in time. In combination with real-time evaluation of network load pressure, network configuration, flow control and resource allocation can be automatically adjusted, and high efficiency and reliability of network service are ensured.

Description

Technical Field

[0001] The present invention relates to the field of network detection technology, and in particular to a self-intelligent network evaluation method and device based on IOAM flow detection. Background Art

[0002] With the rapid development of Internet technology, network traffic is growing increasingly rapidly. Especially driven by applications such as cloud computing, big data, and the Internet of Things, the complexity and scale of the network are constantly expanding.

[0003] In-situ On-line Adaptive Measurement (IOAM), a new network performance monitoring technology, has gained widespread adoption in recent years. By embedding additional measurement information (such as path, timestamp, and network traffic status) in network packets, IOAM enables real-time traffic tracking and monitoring, helping network operators understand network performance, diagnose network issues, and assess service quality. IOAM provides a new approach to real-time traffic monitoring and service quality assurance, enabling more efficient and intelligent management of network traffic.

[0004] However, although IOAM technology has solved some problems in network traffic monitoring to a certain extent, existing network detection technology still faces many challenges.

[0005] Traditional network monitoring technologies rely on single network monitoring tools (such as network switches and routers). These devices typically only provide static, single-dimensional traffic data. For example, they primarily record macro indicators such as total traffic volume and bandwidth usage, but fail to accurately reflect the specific characteristics of traffic. This can lead to potential traffic anomalies or service quality issues being missed, especially when traffic status fluctuates frequently.

[0006] In view of the above problems, it is necessary to propose a self-intelligent network evaluation method and device based on IOAM flow detection. Summary of the Invention

[0007] The purpose of the present invention is to solve the problems existing in the background technology and to propose a self-intelligent network evaluation method and device based on IOAM flow detection.

[0008] The purpose of the present invention can be achieved through the following technical solutions: In a first aspect, the present invention provides a self-intelligent network evaluation method based on IOAM flow detection, comprising the following steps: Step 1: Data stream information collection and preprocessing; Based on IOAM technology, specific operation and maintenance data is collected from all flow data of the target server.

[0009] At preset time intervals t, each network traffic session is monitored in real time by network traffic monitoring hardware and software, and a unique identifier is assigned to each network traffic session, where flow_id=i; i=1, 2, ..., n; where n is the total number of network traffic sessions at the current moment.

[0010] The network traffic monitoring hardware includes: network switches, routers, traffic detectors and network traffic collection equipment; The network traffic monitoring software includes: open source traffic analysis tools, network log recording tools and network packet capture tools.

[0011] Furthermore, the session data of each network traffic session i is obtained and converted into a data field, wherein the session data includes the source IP address src_ip_i, the destination IP address dst_ip_i, the protocol type protocol_i, the packet size packet_size_i and the timestamp timestamp_i.

[0012] Integrate the session data fields of each network traffic session i to generate the corresponding session feature vector {i, src_ip_i, dst_ip_i, protocol_i, packet_size_i, timestamp_i}. The set of all traffic session feature vectors is recorded as the session data set.

[0013] Furthermore, the conversation data set is preprocessed to remove useless and noisy data, including invalid data, duplicate data, and erroneous records. The specific process of removing useless and noisy data is as follows: The session feature vectors that meet the following conditions are marked as invalid data and removed from the session data set: Condition 1: The packet size packet_size_i value is 0; Condition 2: The fields for IP address src_ip_i, destination IP address dst_ip_i, and protocol type protocol_i are empty. Condition 3: The protocol type protocol_i does not fall within the legal range of network communication protocols.

[0014] Multiple session feature vectors that meet the following conditions are marked as duplicate data, one of which is retained and the others are removed from the session data set: Condition 1: Having exactly the same unique identifier i for the network traffic session; Condition 2: The two packets have exactly the same source IP address src_ip_i, destination IP address dst_ip_i, protocol type protocol_i, and packet size packet_size_i, and the difference in timestamp timestamp_i is less than the preset time window.

[0015] Furthermore, the overall traffic characteristics are extracted from all session data sets for subsequent service status detection. The specific process is as follows: Every preset time interval t, the number Count (src_ip) of unique source IP address fields and the number Count (dst_ip_i) of unique destination IP address fields contained in the session data set are obtained.

[0016] The unique source IP address field and the unique destination IP address field refer to the same IP address being counted only once during the statistical process.

[0017] Every preset time interval t, through the preset formula Calculate the average packet flow at the current moment . Get the average packet flow The historical maximum , every preset time interval through the preset formula Calculate the flow fluctuation coefficient .

[0018] Every preset time interval t, the total traffic volume Q1 corresponding to all source IP addresses and the total traffic volume Q2 corresponding to all destination IP addresses are counted. Calculate flow direction ratio .

[0019] Every preset time interval t, identify and mark the network traffic session with the same source IP address and destination IP address, and assign it a traffic pair identifier j.

[0020] For each traffic pair j, obtain the timestamps of all network traffic sessions in each traffic pair j. = , ,..., .in , ,..., ∈i. By the preset formula Calculate the time anomaly characteristic value E(t, j) of each flow pair j. Calculate the overall temporal concentration coefficient TCE, where J is the total number of flow pairs.

[0021] Record the average packet flow rate at each preset time interval t , flow fluctuation coefficient , flow direction ratio and the overall time concentration TCE(t), generate the overall anomaly vector .

[0022] Every preset detection period T, all overall anomaly vectors generated within the detection period T are counted and arranged according to their corresponding time to generate an overall anomaly matrix: .

[0023] Furthermore, single traffic features are extracted from all session data sets for subsequent location of specific abnormal traffic sources. The specific process is as follows: Every preset time interval t, identify and mark the network traffic session with the same source IP address and destination IP address, and assign it a traffic pair identifier j.

[0024] For each traffic pair j, obtain the number of network traffic sessions Count(j) contained in each traffic pair, the sum Q(j) of all network traffic sessions contained in the traffic pair, and the time anomaly characteristic value E(t, j).

[0025] Generate a flow pair matrix every preset time interval t .

[0026] Step 2: Multi-source information fusion and quality assessment; Based on reinforcement learning, an evaluation model for network service quality is established and trained, and the network service quality evaluation model is learned and optimized to improve the detection accuracy of the model.

[0027] The specific process of establishing an evaluation model for network service quality is as follows: S201. Establish a framework formula for the evaluation model of network service quality: .

[0028] in Is in state Next, take action The expected reward value.

[0029] The status is the overall anomaly vector in the overall anomaly matrix corresponding to time t, action To evaluate the eigenvalue, When the value is 1, it means that the network service meets the service requirements; when A value of 0 indicates that the network service does not meet the demand; Where E is the expected value, which represents the expected sum of future rewards under given state and action; is the immediate reward at time step t. is a discount factor used to balance the weight of current rewards and future rewards. The closer the value is to 1, the greater the impact of future rewards. Represents the maximum expected reward value in the future when the optimal action is selected in the future state.

[0030] S202, define learning reference data and loss function, use the collected historical data set to train the model, mark the collected historical data, and use the standard detection feature value of the time when the network service does not meet the demand Set the value of to 1.

[0031] Define a reward function to provide a learning feedback mechanism for the model. The reward function is specifically: .

[0032] Define the loss function: .in is the number of samples detected correctly; at time t and When the values ​​of are all 1, let The value of is 1; is the number of samples correctly detected as normal, when time t and When the values ​​of are all 0, let The value of is 0; is the number of normal traffic samples that are misjudged as unsatisfactory. At time t The value of is 0 and When the value of is 1, let The value of is 1; is the number of traffic samples that are misjudged to be satisfied. When time t The value of is 1 and When the value of is 0, let The value is 1; k1 and k2 are preset weight coefficients, and the sum of k1 and k2 is 1, representing the accuracy tendency of the two recognition results of being detected as meeting the requirements and being detected as not meeting the requirements.

[0033] Step 3: Network service quality evaluation and resource deployment; A service evaluation calculation is performed based on the overall anomaly matrix. This matrix is ​​then fed into a trained network service quality evaluation model and the output recognition probability is used to determine whether the actual network status meets service requirements. If the output probability exceeds a preset threshold, the target network service packet traffic exceeds the server's carrying capacity, and the actual network status does not meet service requirements. Furthermore, if it is determined that the actual network status does not meet the service requirements, a service status adjustment process is initiated; By preset formula Calculate the excess traffic ratio α.

[0034] If the excess traffic ratio α is less than the first preset threshold δ1, the network load pressure is determined to be low; If the excess traffic ratio α is less than the second preset threshold δ2 and greater than or equal to the first preset threshold δ1, the network load pressure is determined to be medium; If the excess traffic ratio α is greater than or equal to the second preset threshold δ2, it is determined that the network load pressure is high.

[0035] The first preset threshold δ1 is smaller than the second preset threshold δ2.

[0036] Step 4: Intelligent feedback and automated scheduling; Adjust the network configuration based on the network quality evaluation results, including adjusting bandwidth, redistributing traffic, and adjusting transmission paths.

[0037] If the network load is low, formulate the following adjustment strategies: Enhance traffic monitoring, implement light traffic limiting or packet loss, and adopt dynamic access control list strategies based on IP addresses or ports.

[0038] If the network load pressure is determined to be medium, formulate the following adjustment strategy: Combined with the time anomaly characteristic value E(t, j), use deep packet inspection (DPI) to perform more accurate traffic filtering. Extract the source IP address src_ip_i corresponding to the traffic pair j with a time anomaly characteristic value greater than the preset threshold, mark it as a malicious user, and isolate it to the isolation area or cleaning center for processing. If the network load is determined to be high, the following adjustment strategy will be implemented: Suspend network services and temporarily deny network connections to all newly added network nodes. Initiate a high-intensity reverse proxy and WAF cleaning system to ensure normal business traffic is not affected.

[0039] In a second aspect, the present invention provides a self-intelligent network evaluation device based on IOAM (Information Management Application) flow detection, comprising a plurality of server nodes. All server nodes collect network traffic data and embed identifiers using IOAM technology for flow detection. The embedded identifiers collect network data, including but not limited to source IP addresses, destination IP addresses, protocol types, packet sizes, and timestamps.

[0040] Compared with the prior art, the present invention has the following beneficial effects: This method leverages IOAM in-flow detection technology, combined with real-time monitoring of network traffic sessions and feature data analysis, to accurately assess network service quality in real time within the target network. Compared to traditional network quality monitoring solutions, this approach offers higher accuracy and real-time performance, ensuring stable and efficient network traffic.

[0041] By dynamically analyzing and extracting features from network traffic session data, this invention can effectively identify abnormal traffic and quality issues within the network, promptly detecting traffic bottlenecks, traffic anomalies, and other issues. Combined with real-time assessment of network load pressure, it can automatically adjust network configuration, traffic control, and resource allocation to ensure the efficiency and reliability of network services. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings: Figure 1 Flow chart of the method of the present invention. DETAILED DESCRIPTION

[0043] The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0044] See also Figure 1 As shown, a self-intelligent network evaluation method based on IOAM flow detection includes the following steps: Step 1: Data stream information collection and preprocessing; Based on IOAM technology, specific operation and maintenance data is collected from all flow data of the target server.

[0045] At preset time intervals t, each network traffic session is monitored in real time by network traffic monitoring hardware and software, and a unique identifier is assigned to each network traffic session, where flow_id=i; i=1, 2, ..., n; where n is the total number of network traffic sessions at the current moment.

[0046] The network traffic monitoring hardware includes: network switches, routers, traffic detectors and network traffic collection equipment; The network traffic monitoring software includes: open source traffic analysis tools, network log recording tools and network packet capture tools.

[0047] Furthermore, the session data of each network traffic session i is obtained and converted into a data field, wherein the session data includes the source IP address src_ip_i, the destination IP address dst_ip_i, the protocol type protocol_i, the packet size packet_size_i and the timestamp timestamp_i.

[0048] Integrate the session data fields of each network traffic session i to generate the corresponding session feature vector {i, src_ip_i, dst_ip_i, protocol_i, packet_size_i, timestamp_i}. The set of all traffic session feature vectors is recorded as the session data set.

[0049] Furthermore, the conversation data set is preprocessed to remove useless and noisy data, including invalid data, duplicate data, and erroneous records. The specific process of removing useless and noisy data is as follows: The session feature vectors that meet the following conditions are marked as invalid data and removed from the session data set: Condition 1: The packet size packet_size_i value is 0; Condition 2: The fields for IP address src_ip_i, destination IP address dst_ip_i, and protocol type protocol_i are empty. Condition 3: The protocol type protocol_i does not fall within the legal range of network communication protocols.

[0050] Multiple session feature vectors that meet the following conditions are marked as duplicate data, one of which is retained and the others are removed from the session data set: Condition 1: Having exactly the same unique identifier i for the network traffic session; Condition 2: The two packets have exactly the same source IP address src_ip_i, destination IP address dst_ip_i, protocol type protocol_i, and packet size packet_size_i, and the difference in timestamp timestamp_i is less than the preset time window.

[0051] Furthermore, the overall traffic characteristics are extracted from all session data sets for subsequent service status detection. The specific process is as follows: Every preset time interval t, the number Count (src_ip) of unique source IP address fields and the number Count (dst_ip_i) of unique destination IP address fields contained in the session data set are obtained.

[0052] The unique source IP address field and the unique destination IP address field refer to the same IP address being counted only once during the statistical process.

[0053] Every preset time interval t, through the preset formula Calculate the average packet flow at the current moment . Get the average packet flow The historical maximum , every preset time interval through the preset formula Calculate the flow fluctuation coefficient .

[0054] It should be noted that the average packet flow rate reflects the overall scale of data transmission. Larger packets may indicate the presence of malicious traffic. The traffic fluctuation coefficient reflects sudden increases or decreases in traffic and is used to detect the burstiness of traffic.

[0055] Every preset time interval t, the total traffic volume Q1 corresponding to all source IP addresses and the total traffic volume Q2 corresponding to all destination IP addresses are counted. Calculate flow direction ratio .

[0056] It should be noted that the traffic direction ratio quantifies the average traffic ratio between the source IP address and the destination IP address, reflecting whether there is one-way transmission with abnormal number of sources and traffic size.

[0057] Every preset time interval t, identify and mark the network traffic session with the same source IP address and destination IP address, and assign it a traffic pair identifier j.

[0058] For each traffic pair j, obtain the timestamps of all network traffic sessions in each traffic pair j. = , ,..., .in , ,..., ∈i. By the preset formula Calculate the time anomaly characteristic value E(t, j) of each flow pair j. Calculate the overall temporal concentration coefficient TCE, where J is the total number of flow pairs.

[0059] Record the average packet flow rate at each preset time interval t , flow fluctuation coefficient , flow direction ratio and the overall time concentration TCE(t), generate the overall anomaly vector .

[0060] Every preset detection period T, all overall anomaly vectors generated within the detection period T are counted and arranged according to their corresponding time to generate an overall anomaly matrix: .

[0061] Furthermore, single traffic features are extracted from all session data sets for subsequent location of specific abnormal traffic sources. The specific process is as follows: Every preset time interval t, identify and mark the network traffic session with the same source IP address and destination IP address, and assign it a traffic pair identifier j.

[0062] For each traffic pair j, obtain the number of network traffic sessions Count(j) contained in each traffic pair, the sum Q(j) of all network traffic sessions contained in the traffic pair, and the time anomaly characteristic value E(t, j).

[0063] Generate a flow pair matrix every preset time interval t .

[0064] Step 2: Multi-source information fusion and quality assessment; Based on reinforcement learning, an evaluation model for network service quality is established and trained, and the network service quality evaluation model is learned and optimized to improve the detection accuracy of the model.

[0065] The specific process of establishing an evaluation model for network service quality is as follows: S201. Establish a framework formula for the evaluation model of network service quality: .

[0066] in Is in state Next, take action The expected reward value.

[0067] The status is the overall anomaly vector in the overall anomaly matrix corresponding to time t, action To evaluate the eigenvalue, When the value is 1, it means that the network service meets the service requirements; when A value of 0 indicates that the network service does not meet the demand; Where E is the expected value, which represents the expected sum of future rewards under given state and action; is the immediate reward at time step t. is a discount factor used to balance the weight of current rewards and future rewards. The closer the value is to 1, the greater the impact of future rewards. Represents the future state Next, choose the best action The maximum expected reward value in the future.

[0068] S202, define learning reference data and loss function, use the collected historical data set to train the model, mark the collected historical data, and use the standard detection feature value of the time when the network service does not meet the demand Set the value of to 1.

[0069] Define a reward function to provide a learning feedback mechanism for the model. The reward function is specifically: .

[0070] Define the loss function: .in is the number of samples detected correctly; at time t and When the values ​​of are all 1, let The value of is 1; is the number of samples correctly detected as normal, when time t and When the values ​​of are all 0, let The value of is 0; is the number of normal traffic samples that are misjudged as unsatisfactory. At time t The value of is 0 and When the value of is 1, let The value of is 1; is the number of traffic samples that are misjudged to be satisfied. When time t The value of is 1 and When the value of is 0, let The value is 1; k1 and k2 are preset weight coefficients, and the sum of k1 and k2 is 1, representing the accuracy tendency of the two recognition results of being detected as meeting the requirements and being detected as not meeting the requirements.

[0071] Step 3: Network service quality evaluation and resource deployment; A service evaluation calculation is performed based on the overall anomaly matrix. This matrix is ​​then fed into a trained network service quality evaluation model and the output recognition probability is used to determine whether the actual network status meets service requirements. If the output probability exceeds a preset threshold, the target network service packet traffic exceeds the server's carrying capacity, and the actual network status does not meet service requirements. Furthermore, if it is determined that the actual network status does not meet the service requirements, a service status adjustment process is initiated; By preset formula Calculate the excess traffic ratio α.

[0072] If the excess traffic ratio α is less than the first preset threshold δ1, the network load pressure is determined to be low; If the excess traffic ratio α is less than the second preset threshold δ2 and greater than or equal to the first preset threshold δ1, the network load pressure is determined to be medium; If the excess traffic ratio α is greater than or equal to the second preset threshold δ2, it is determined that the network load pressure is high.

[0073] The first preset threshold δ1 is smaller than the second preset threshold δ2.

[0074] Step 4: Intelligent feedback and automated scheduling; Adjust the network configuration based on the network quality evaluation results, including adjusting bandwidth, redistributing traffic, and adjusting transmission paths.

[0075] If the network load is low, formulate the following adjustment strategies: Enhance traffic monitoring, implement light traffic limiting or packet loss, and adopt dynamic access control list strategies based on IP addresses or ports.

[0076] If the network load pressure is determined to be medium, formulate the following adjustment strategy: Combined with the time anomaly characteristic value E(t, j), use deep packet inspection (DPI) to perform more accurate traffic filtering. Extract the source IP address src_ip_i corresponding to the traffic pair j with a time anomaly characteristic value greater than the preset threshold, mark it as a malicious user, and isolate it to the isolation area or cleaning center for processing. If the network load is determined to be high, the following adjustment strategy will be implemented: Suspend network services and temporarily deny network connections to all newly added network nodes. Initiate a high-intensity reverse proxy and WAF cleaning system to ensure normal business traffic is not affected.

[0077] A self-intelligent network evaluation device based on IOAM flow detection includes several server nodes.

[0078] All server nodes collect network traffic data and embed identifiers for in-flight detection using IOAM technology. The embedded identifiers collect network data, including but not limited to: source IP, destination IP, protocol type, packet size, and timestamp.

[0079] It should be understood that the terms “include” and “comprising” used in the specification and claims of the present disclosure indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0080] It should also be understood that the terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. As used in this disclosure and the claims, the singular forms "a," "an," and "the" are intended to include the plural forms unless the context clearly indicates otherwise. It should also be further understood that the term "and / or" used in this disclosure and the claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations; The preferred embodiments of the present invention disclosed above are intended only to help illustrate the present invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the present invention to specific embodiments. Obviously, many modifications and variations are possible based on the contents of this specification. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of the present invention, thereby enabling those skilled in the art to better understand and utilize the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A self-intelligent network evaluation method based on IOAM flow detection, characterized in that: The following steps are involved: Step 1: Data stream information collection and preprocessing; Based on IOAM technology, operation and maintenance data is collected from all flow data of the target server. Through hardware devices such as network switches, routers, and traffic detectors, as well as software such as traffic analysis tools and logging tools, each network traffic session is monitored in real time to obtain basic network data, including source IP address, destination IP address, protocol type, packet size, and timestamp. Preprocess the collected data to remove invalid and duplicate data and clean up data noise; At preset time intervals, network features including the number of source and destination IP addresses, average packet flow, flow fluctuation coefficient, and flow direction ratio are extracted for subsequent quality testing; Step 2: Multi-source information fusion and quality assessment; Based on reinforcement learning, we establish and train a network service quality evaluation model, learn and optimize the network service quality evaluation model, and improve the model's detection accuracy. Step 3: Network service quality evaluation and resource deployment; Based on the overall anomaly matrix, it is input into the trained model and the recognition probability is output to determine whether the network meets the service requirements; Step 4: Intelligent feedback and automated scheduling; if it is determined that the service does not meet the demand, targeted resource adjustments are made; based on the network quality evaluation results, the network configuration is adjusted, including adjusting bandwidth, redistributing traffic, and adjusting transmission paths.

2. The method for evaluating a self-intelligent network based on IOAM flow detection according to claim 1, characterized in that: The specific process of collecting operation and maintenance data in streaming data is as follows: Every preset time interval t, each network traffic session is monitored in real time by network traffic monitoring hardware and software, and a unique identifier is assigned to each network traffic session, where the identifier is flow_id=i; i=1, 2, ..., n; Where n is the total number of network traffic sessions at the current moment; The network traffic monitoring hardware includes: network switches, routers, traffic detectors and network traffic collection equipment; The network traffic monitoring software includes: open source traffic analysis tools, network logging tools and network packet capture tools; Obtain session data for each network traffic session i and convert it into data fields, wherein the session data includes source IP address src_ip_i, destination IP address dst_ip_i, protocol type protocol_i, packet size packet_size_i, and timestamp timestamp_i; Integrate the session data fields of each network traffic session i to generate the session feature vector {i, src_ip_i, dst_ip_i, protocol_i, packet_size_i, timestamp_i} corresponding to each network traffic session; record the set of all traffic session feature vectors as the session data set.

3. The method for evaluating a self-intelligent network based on IOAM flow detection according to claim 1, characterized in that: The specific process of preprocessing the collected data is as follows: The session feature vectors that meet the following conditions are marked as invalid data and removed from the session data set: Condition 1: The packet size packet_size_i value is 0; Condition 2: The fields for IP address src_ip_i, destination IP address dst_ip_i, and protocol type protocol_i are empty. Condition 3: The protocol type protocol_i does not fall within the legal scope of network communication protocols; Multiple session feature vectors that meet the following conditions are marked as duplicate data, one of which is retained and the others are removed from the session data set: Condition 1: Having exactly the same unique identifier i for the network traffic session; Condition 2: The two packets have exactly the same source IP address src_ip_i, destination IP address dst_ip_i, protocol type protocol_i, and packet size packet_size_i, and the difference in timestamp timestamp_i is less than the preset time window.

4. The method for evaluating a self-intelligent network based on IOAM flow detection according to claim 1, characterized in that: The specific process of extracting network features is as follows: At every preset time interval t, the number of unique source IP address fields and the number of unique destination IP address fields included in the session data set are obtained; The unique source IP address field and the unique destination IP address field refer to the same IP address being counted only once during the statistical process; At every preset time interval t, the average data packet flow at the current moment is obtained by calculating the number of unique source IP address fields, the number of unique destination IP address fields, and the data packet size contained in the session data set; Obtaining a historical maximum value of the average data packet flow; at every preset time interval, obtaining a flow fluctuation coefficient by calculating the current average data packet flow and the historical maximum value of the average data packet flow; At every preset time interval, the sum of traffic corresponding to all source IP addresses and the sum of traffic corresponding to the destination IP addresses are counted; a first characteristic traffic is obtained by calculating the sum of traffic corresponding to all source IP addresses and the number of unique source IP address fields included in the session data set; a second characteristic traffic is obtained by calculating the sum of traffic corresponding to all destination IP addresses and the number of unique destination IP address fields included in the session data set; a traffic direction ratio is obtained by dividing the first characteristic traffic and the second characteristic traffic; Every preset time interval t, identify and mark network traffic sessions with the same source IP address and destination IP address, and assign them a traffic pair identifier j; For each traffic pair j, obtain the timestamps of all network traffic sessions in each traffic pair j. Calculate the timestamp interval of each network traffic session by performing a difference operation on adjacent timestamps. Calculate the mean and standard deviation of the timestamp interval for each network traffic session. Calculate the mean and standard deviation of the timestamp interval to obtain the temporal anomaly characteristic value of each traffic pair. Calculate the temporal anomaly characteristic value of each traffic pair and the total number of traffic pairs to obtain the overall temporal concentration. Record the average packet flow, flow fluctuation coefficient, flow direction ratio and overall time concentration obtained at each preset time interval to generate an overall anomaly vector; Every preset detection period T, all overall anomaly vectors generated within the detection period T are counted and arranged according to their corresponding time to generate an overall anomaly matrix; Extract single traffic features from all session data sets for subsequent location of specific abnormal traffic sources. The specific process is as follows: Every preset time interval t, identify and mark network traffic sessions with the same source IP address and destination IP address, and assign them a traffic pair identifier j; For each traffic pair j, obtain the number of network traffic sessions contained in each traffic pair, the sum of all network traffic sessions contained in the traffic pair, and the time anomaly feature value; At every preset time interval t, a traffic pair matrix is ​​generated according to the number of network traffic sessions contained in each traffic pair of the traffic pair identifier j, the sum of all network traffic sessions contained in the traffic pair, and the time anomaly characteristic value.

5. The method for evaluating a self-intelligent network based on IOAM flow detection according to claim 1, characterized in that: The specific process of establishing and training an evaluation model for network service quality is as follows: The specific process of establishing an evaluation model for network service quality is as follows: S201. Establish a framework formula for the evaluation model of network service quality: ； in Is in state Next, take action The expected reward value of The status is the overall anomaly vector in the overall anomaly matrix corresponding to time t, action To evaluate the eigenvalue, When the value is 1, it means that the network service meets the service requirements; when A value of 0 indicates that the network service does not meet the demand; Where E is the expected value, which represents the expected sum of future rewards under a given state and action; in is the immediate reward at time step t; is a discount factor used to balance the weight of current rewards and future rewards; The closer the value is to 1, the greater the impact of future rewards; Represents the future state Next, choose the best action The maximum expected reward value in the future when Where E is the expected value, which represents the expected sum of future rewards under given state and action; is the immediate reward at time step t; is a discount factor used to balance the weight of current rewards and future rewards; The closer the value is to 1, the greater the impact of future rewards; Represents the future state Next, choose the best action The maximum expected reward value in the future.

6. The method for evaluating a self-intelligent network based on IOAM flow detection according to claim 1, characterized in that: The specific process of learning and optimizing the network service quality evaluation model is as follows: Define learning reference data and loss function, use the collected historical data set for model training, mark the collected historical data, and use the standard detection feature value when the network service does not meet the demand The value of is set to 1; Define a reward function to provide a learning feedback mechanism for the model. The reward function is specifically: ; Define the loss function: ;in is the number of samples detected correctly; at time t and When the values ​​of are all 1, let The value of is 1; is the number of samples correctly detected as normal, when time t and When the values ​​of are all 0, let The value of is 0; is the number of normal traffic samples that are misjudged as unsatisfactory. At time t The value of is 0 and When the value of is 1, let The value of is 1; is the number of traffic samples that are misjudged to be satisfied. When time t The value of is 1 and When the value of is 0, let The value of is 1; Wherein, k1 and k2 are preset weight coefficients, and the sum of k1 and k2 is 1, representing the accuracy tendency of the two recognition results of confirming that the requirements are met and confirming that the requirements are not met.

7. The method for evaluating a self-intelligent network based on IOAM flow detection according to claim 1, characterized in that: The specific process of determining that the actual network status does not meet the service requirements is as follows: A service evaluation operation is performed based on the overall anomaly matrix, which is input into a trained network service quality evaluation model. The output recognition probability is used to determine whether the actual network status meets the service requirements. When the output probability is greater than a preset threshold, it is determined that the service data packet flow in the target network exceeds the server's carrying capacity and the actual network status does not meet the service requirements. The excess traffic ratio α is obtained by calculating the sum of the packet size and traffic for all network traffic sessions involved; If the excess traffic ratio α is less than the first preset threshold δ1, the network load pressure is determined to be low; If the excess traffic ratio α is less than the second preset threshold δ2 and greater than or equal to the first preset threshold δ1, the network load pressure is determined to be medium; If the excess traffic ratio α is greater than or equal to the second preset threshold δ2, the network load pressure is determined to be high; The first preset threshold δ1 is smaller than the second preset threshold δ2.

8. The method for evaluating a self-intelligent network based on IOAM flow detection according to claim 1, characterized in that: The specific process of adjusting the network configuration based on the network quality evaluation results is as follows: If the network load pressure is determined to be low, formulate the following adjustment strategies: enhance traffic monitoring, implement mild flow restriction or packet loss; adopt dynamic access control list strategies based on IP addresses or ports; If the network load pressure is determined to be medium, formulate the following adjustment strategy: Combined with the time anomaly characteristic value E(t, j), use deep packet inspection (DPI) to perform more accurate traffic filtering. Extract the source IP address src_ip_i corresponding to the traffic pair j with a time anomaly characteristic value greater than the preset threshold, mark it as a malicious user, and isolate it to the isolation area or cleaning center for processing. If the network load pressure is determined to be high, formulate the following adjustment strategy: suspend network services and temporarily deny network connections to all newly added network nodes; start high-intensity reverse proxy and WAF cleaning systems to ensure that normal business traffic is not affected.

9. A self-intelligent network evaluation device based on IOAM in-flow detection, used to implement the self-intelligent network evaluation method based on IOAM in-flow detection according to any one of claims 1 to 8, characterized in that: It includes several server nodes; all server nodes collect network traffic data and embed identifiers through IOAM technology for flow detection; network data is collected through embedded identifiers, including but not limited to: data including source IP, destination IP, protocol type, packet size and timestamp.

Images