Dynamic anomaly detection method and system for integrity of high-polymer dual-fiber link

Abstract

The invention discloses a dynamic anomaly detection method and system oriented to high-polymer dual-fiber link integrity, and particularly relates to the field of anomaly detection and node safety control in a computer communication network, and the method comprises the steps: constructing a behavior mapping model between input logic and output logic for each communication node in a dual-fiber link topological structure, the behavior mapping model is used for describing an expected response path and output characteristics of the node under specific data input; and executing an input logic injection operation on the target node, loading the constructed standardized test input to the target node, and collecting an output result actually generated by the node within a preset specified response time to form a current response sample of the node. By constructing a node behavior mapping model and combining path-level reverse semantic reasoning and response consistency comparison, potential abnormal nodes outputting semantic offset are dynamically recognized, so that the problems of link semantic drift and node safety failure caused by the fact that node response is not reported to be wrong but is distorted are solved.

Description

Technical Field

[0001] This invention relates to the field of anomaly detection and node security control technology in computer communication networks. More specifically, this invention relates to a dynamic anomaly detection method and system for high-density dual-fiber link integrity. Background Technology

[0002] In a high-density dual-fiber link architecture, with the increase in the number of network nodes and the parallel deployment of heterogeneous hardware devices, each node in the link gradually exhibits fine-grained behavioral differences when performing operations such as data processing, logical judgment, and result forwarding. Although most nodes do not show faults, pauses, or abnormal outputs in their functional execution, under specific data states or operation sequences, some nodes may still produce hidden faults that do not report errors due to differences in internal logical paths, caching strategies, or intermediate variable processing methods. Such nodes constitute a structural hidden danger in the link as a whole, which does not trigger any error flags but has already caused data semantic misrepresentation.

[0003] Existing technologies mostly rely on adding redundant symbols to the data for verification or fault tolerance, such as using check codes or specific operation sequences to achieve error detection and correction;

[0004] However, such mechanisms are mainly designed for explicit bit errors or coding anomalies. They often cannot accurately identify minor deviations in the logical operation path, especially when the same input data is processed at different nodes and the results are slightly disrupted but the continuity is broken.

[0005] Meanwhile, conventional functional verification methods are mostly based on the comparison of known outputs or the verification of standard operating logic, lacking the ability to dynamically reason about the consistency between actual node responses and network semantics. This makes some functionally fault-free nodes become hidden sources of pollution that cause link response drift.

[0006] Essentially, this problem reveals a structural flaw in the current node security mechanism: in multi-node collaborative computing scenarios, it is difficult to effectively identify semantic offsets in node output caused by differences in logical execution paths, which leads to inaccurate data judgment and disordered response logic within the link, and induces decision-making errors and control failures across the entire network during critical task scheduling.

[0007] Therefore, the core of this type of problem lies in the lack of a dynamic anomaly identification mechanism based on computational path redundancy comparison and output semantic consistency verification, which makes it difficult to guarantee node security under the condition of logical integrity. Summary of the Invention

[0008] To overcome the aforementioned deficiencies in the prior art, embodiments of the present invention provide a dynamic anomaly detection method and system for high-fiber optic links. By constructing a node behavior mapping model and combining path-level reverse semantic reasoning with response consistency comparison, the method dynamically identifies potential abnormal nodes with output semantic offsets, thereby solving the link semantic drift and node security failure problems caused by node responses that are not reported as errors but are distorted, as mentioned in the background art.

[0009] To achieve the above objectives, the present invention provides the following technical solution: a dynamic anomaly detection method for the integrity of high-density dual-fiber links, comprising:

[0010] S1. In a dual-fiber link topology, a behavioral mapping model between input logic and output logic is constructed for each communication node. The behavioral mapping model is used to describe the expected response path and output characteristics of the node under specific data input.

[0011] S2. Perform input logic injection operation on the target node, load the constructed standardized test input into the target node, and collect the actual output results generated by the node within the preset response time to form the current response sample of the node.

[0012] S3. Among multiple adjacent nodes that have a logical path association with the target node, based on the established behavior mapping model, perform path-level backpropagation on the standardized test input to reconstruct the theoretical output response that the target node should present under the full-link semantic constraints.

[0013] S4. Compare the current response sample of the target node with its theoretical output response for sequence consistency. Use the logical evolution trajectory comparison method to quantify the response difference between the two and obtain the consistency offset of the node output.

[0014] S5. If the consistency offset exceeds the preset offset threshold, the target node is recorded as a behavioral semantic deviation node, and the behavioral semantic deviation node is marked as a potential logical anomaly source. At the same time, the data stream output by the node is stripped from the subsequent path.

[0015] In a preferred embodiment, the method further includes S6: constructing a link consistency profile based on all marked behavioral semantic deviation nodes, identifying high-risk logical break zones in the link consistency profile, and triggering a dynamic path reconstruction mechanism in conjunction with preset link integrity maintenance rules to achieve real-time monitoring of node response behavior and local correction of link structure, thereby ensuring the continuous logical consistency and node security of dual-fiber links in high-gathering topology.

[0016] In a preferred embodiment, in S1, the input logic sequence and corresponding output logic sequence recorded by the communication node in multiple historical operating states are synchronously collected, and the collected input logic sequence and output logic sequence are format-standardized and timestamp-aligned to form a structured mapping training sample set.

[0017] Based on the mapping training sample set, the state evolution path parsing method is used to extract the state transition nodes, path evolution order and response triggering conditions involved in the transformation from input logic to output logic, and generate an initial path structure model covering the node logic evolution process.

[0018] The initial path structure model is subjected to multiple rounds of semantic consistency verification and dynamic feedback fitting operations to finally generate a complete behavior mapping model. The behavior mapping model is used to accurately describe the output logic response path and response characteristics that the communication node should present under the action of specific input logic.

[0019] In a preferred embodiment, S1 further includes constructing a behavior mapping model, which is used to characterize the output logic response path and output characteristics of a communication node under the action of specific input logic. The behavior mapping model is based on historical input logic sequences and output logic sequences, and extracts and maps the temporal, multi-path and response characteristic expression rules between the input logic and output logic of the node through three steps: state evolution path construction, semantic consistency verification and dynamic feedback fitting.

[0020] Let the behavior mapping model of communication nodes be denoted as a family of functions:

[0021]

[0022] in:

[0023]

[0024] in This represents the behavior mapping model constructed for communication node n; The i-th pair of input logic sequences x collected from the historical running data of node n i With the corresponding output logic sequence y i ; Represents a complete data sample set; This indicates that the input logic x i The result of the state evolution path transformation processing; φ k (·,·) represents the k-th state mapper, which is used to receive the current input state ψ. k (x i ) and state-space conditions Then output the state mapping result for the current stage; ψ k (x i ) is used to extract input logic x i The sub-logic segment used for the k-th state transition; K represents the number of state transition stages experienced by the input logic sequence in the behavior mapping model; J represents the number of response basis functions selected in the output logic feature expression; This is the k-th state transition subspace of the node; In the state space The state aggregation function executed above; The output logic fitting function is controlled by the parameter set Θ, and receives the input structure after state evolution transformation. ρ j (z) is the j-th output response basis function, which is used to capture the nonlinear changes of output features at the structural level; ω j For the corresponding basis function ρ j Weight parameters; For the regularization term of the model, The complexity of the parameter set Θ is used to constrain the parameters to prevent overfitting, and λ is the regularization strength factor.

[0025] In a preferred embodiment, in S2, based on the input logic structure defined in the behavior mapping model corresponding to the target node, a standardized test input with fixed structure fields, trigger logic sequence and response flag is constructed. The standardized test input is used to fully cover the input logic channel of the target node.

[0026] The standardized test input is loaded into the input logic channel of the target node, and a preset response time boundary is set. The timing control module is then activated to limit the acquisition time window for the target node to generate response logic.

[0027] Within the acquisition time window, the temporal changes of the target node's output logic are continuously sampled, and structural alignment and feature parsing operations are performed to form the target node's current response sample. The current response sample is used for subsequent response consistency comparison operations.

[0028] In a preferred embodiment, in S3, based on the logical path relationships defined in the dual-fiber link topology, all adjacent nodes that have a direct logical path connection with the target node are identified, and the path structure parameters and path constraint information from each adjacent node to the target node are obtained.

[0029] The standardized test input is subjected to structure preservation processing to ensure that the input logic satisfies the path mapping requirements in the behavior mapping model of each adjacent node, and the processed standardized test input is loaded into the input port of the behavior mapping model corresponding to each adjacent node.

[0030] In each adjacent node, its behavior mapping model is invoked, and a reverse state propagation operation based on the path direction is performed to generate a state evolution sequence pointing to the target node. The state evolution sequence is used to describe the theoretical support structure of the path segment's logical response to the target node.

[0031] Semantic fusion is performed on all state evolution sequences. Based on the weight parameters of each path segment in the link topology and semantic consistency rules, response fusion and conflict resolution operations are performed to generate the theoretical output response of the target node. The theoretical output response is written into the response reconstruction buffer of the target node as the benchmark data for subsequent sequence consistency comparison with the current response sample.

[0032] In a preferred embodiment, in S4, the logical evolution trajectory comparison method constructs a bidirectional temporal mapping matrix between the current response sample of the target node and the theoretical output response, extracts the correspondence between the two sets of response logic in temporal structure, state transition points and output semantic fragments, calculates the trajectory offset value at each corresponding position, and performs a cumulative reduction operation on the offset values ​​of the entire sequence to form a set of difference vectors characterizing the consistency of response evolution. Then, a statistical distance operation is performed on the difference vectors to output the consistency offset as the node output. The consistency offset is used to characterize the degree of deviation of the target node's response behavior from the expected semantic path.

[0033] A dynamic anomaly detection system for the integrity of high-density dual-fiber links includes a model building module, an injection acquisition module, a reverse reconstruction module, a comparison offset module, and a marker isolation module.

[0034] The model building module is used to build a behavior mapping model between input logic and output logic for each communication node in a dual-fiber link topology. The behavior mapping model is used to describe the expected response path and output characteristics of the node under specific data input.

[0035] The injection acquisition module is used to perform input logic injection operations on the target node, load the constructed standardized test input into the target node, and collect the actual output results generated by the node within a preset response time to form the current response sample of the node.

[0036] The reverse reconstruction module is used to perform path-level reverse propagation on the standardized test input based on the established behavior mapping model among multiple adjacent nodes that have a logical path association with the target node, and reconstruct the theoretical output response that the target node should present under the full-link semantic constraints.

[0037] The alignment offset module is used to perform a sequence consistency comparison between the current response sample of the target node and its theoretical output response. It adopts a logical evolution trajectory comparison method to quantify the response difference between the two and obtain the consistency offset of the node output.

[0038] The marking and isolation module includes: if the consistency offset exceeds a preset offset threshold, then the target node is recorded as a behavioral semantic deviation node, and the behavioral semantic deviation node is marked as a potential logical anomaly source, while the data stream output by the node is stripped from the subsequent path.

[0039] The technical effects and advantages of this invention are as follows:

[0040] 1. By constructing a behavior mapping model and introducing a path-level backpropagation and logical evolution trajectory comparison mechanism, the identification of nodes that do not exhibit explicit faults but have semantic offsets is realized. This solves the core problem that existing mechanisms cannot capture subtle logical offsets and ensures node security under the condition of logical integrity.

[0041] 2. By adopting standardized test input combined with response time window and feature sampling mechanism, the current response samples of nodes can be collected in real time without interrupting business, which enhances the dynamic perception of node response characteristics and improves the timeliness and coverage of abnormal behavior capture.

[0042] 3. By leveraging the path-level semantic back-inference of adjacent nodes and the fusion of multi-node responses to generate theoretical output responses, a theoretical behavioral benchmark covering the semantic constraints of the link context was constructed, realizing full-link semantic consistency analysis for anomaly detection and breaking through the limitations of the traditional single-point comparison mechanism.

[0043] 4. By introducing the logical evolution trajectory comparison and statistical difference vector calculation method, a consistency offset quantification model was established, which not only provides structural comparison basis for response differences, but also has a quantifiable and controllable judgment threshold standard, thereby improving the stability and accuracy of anomaly judgment. Attached Figure Description

[0044] Figure 1 This is a flowchart outlining the method steps of the present invention.

[0045] Figure 2 This is a schematic diagram of the system modules of the present invention. Detailed Implementation

[0046] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0047] Refer to the instruction manual appendix Figure 1-2 An embodiment of the present invention provides a dynamic anomaly detection method for the integrity of high-density dual-fiber links, comprising:

[0048] S1. In a dual-fiber link topology, a behavioral mapping model between input logic and output logic is constructed for each communication node. The behavioral mapping model is used to describe the expected response path and output characteristics of the node under specific data input.

[0049] S2. Perform input logic injection operation on the target node, load the constructed standardized test input into the target node, and collect the actual output results generated by the node within the preset response time to form the current response sample of the node.

[0050] S3. Among multiple adjacent nodes that have a logical path association with the target node, based on the established behavior mapping model, perform path-level backpropagation on the standardized test input to reconstruct the theoretical output response that the target node should present under the full-link semantic constraints.

[0051] S4. Compare the current response sample of the target node with its theoretical output response for sequence consistency. Use the logical evolution trajectory comparison method to quantify the response difference between the two and obtain the consistency offset of the node output.

[0052] S5. If the consistency offset exceeds a preset offset threshold, the target node is recorded as a behavioral semantic deviation node and marked as a potential logical anomaly source. Simultaneously, the data stream output by this node is removed from subsequent paths to prevent cascading interference to the overall link logic. Specifically, removing the data stream output by this node from subsequent paths means that after identifying the target node as a behavioral semantic deviation node and its output response consistency offset exceeding the preset offset threshold, the output logic channel status of this node is immediately updated in the link scheduling control module, marking it as a logical interruption state. All downlink logical path records originating from this node are removed from the path forwarding table, blocking the forwarding process of its output data to adjacent nodes. Simultaneously, an output cache invalidation flag is set in the link caching mechanism to ensure that the response data of this node is no longer scheduled or written to any relay or target node in subsequent paths. This achieves dynamic isolation of potential anomaly sources, preventing them from causing link-level logical propagation errors or semantic interference.

[0053] It also includes S6: Constructing a link consistency profile based on all marked behavioral semantic deviation nodes, identifying high-risk logical break zones in the link consistency profile, and triggering a dynamic path reconstruction mechanism in combination with preset link integrity maintenance rules to achieve real-time monitoring of node response behavior and local correction of link structure, in order to ensure the continuous logical consistency and node security of dual-fiber links in high-gathering topology.

[0054] In S6, the process of constructing a link consistency profile includes: traversing the entire set of nodes marked as behavioral semantic deviation nodes, mapping the consistency offset value of each node to its path position in the link topology to form a spatial distribution matrix of node offset; calculating the aggregation trend of node offset in each path segment according to the path topology hierarchy, and generating corresponding link consistency indices by combining path direction, hop count, and logical coupling density; finally, pairing and mapping node offset indices with path consistency indices on a path-by-path basis to construct a link consistency profile composed of link structure, node position, offset value distribution, and logical flow direction, which is used to express the consistency stability of the entire link semantic transmission structure.

[0055] In the constructed link consistency profile, a break detection operation is performed based on path continuity and node offset clustering features: the gradient change of offset values ​​between adjacent nodes in each path is calculated, and path segments with abrupt boundary are extracted; path regions with a continuous upward trend of offset or clustering of multiple semantically biased nodes are marked as potential break zone candidate areas.

[0056] Finally, by combining the logical importance score of the path segment with the frequency of historical interference, a weighted calculation of the fracture risk is performed to screen out the path segments whose risk value exceeds the preset safety threshold and mark them as high-risk logical fracture zones, which serve as key triggering areas for subsequent path reconstruction operations.

[0057] After identifying high-risk logical breakpoints, the preset link integrity maintenance rules are invoked for judgment. Based on the path substitutability constraints, logical hop count limits, node carrying thresholds, and delay redundancy balancing strategies defined in the rules, a set of alternative links that can be used to replace the broken paths is dynamically searched from the link topology map.

[0058] Next, based on the integrity score and reconstruction cost of each candidate path under the current link state, a path reconstruction optimization algorithm is executed to select the optimal path scheme;

[0059] Without interrupting the existing data flow, a link switching operation is performed to redistribute the data forwarding traffic in the broken path to the newly constructed path. At the same time, the path control table and behavior mapping model are updated to achieve local correction of the link structure and continuous dynamic monitoring of response behavior.

[0060] In S1, the input logic sequence and corresponding output logic sequence recorded by the communication node in multiple historical operating states are synchronously collected, and the collected input logic sequence and output logic sequence are format-standardized and timestamp-aligned to form a structured mapping training sample set.

[0061] Based on the mapping training sample set, the state evolution path parsing method is used to extract the state transition nodes, path evolution order and response triggering conditions involved in the transformation from input logic to output logic, and generate an initial path structure model covering the node logic evolution process.

[0062] The initial path structure model is subjected to multiple rounds of semantic consistency verification and dynamic feedback fitting operations to finally generate a complete behavior mapping model. The behavior mapping model is used to accurately describe the output logic response path and response characteristics that the communication node should present under the action of specific input logic.

[0063] S1 also includes constructing a behavior mapping model, which is used to characterize the output logic response path and output characteristics of a communication node under the action of specific input logic. The behavior mapping model is based on historical input logic sequences and output logic sequences, and extracts and maps the temporal, multi-path and response characteristic expression rules between the input logic and output logic of the node through three steps: state evolution path construction, semantic consistency verification and dynamic feedback fitting.

[0064] Let the behavior mapping model of communication nodes be denoted as a family of functions:

[0065]

[0066] in:

[0067]

[0068] in This represents the behavior mapping model constructed for communication node n; The i-th pair of input logic sequences x collected from the historical running data of node n i With the corresponding output logic sequence y i ; Represents a complete data sample set; This indicates that the input logic x i The result of the state evolution path transformation processing is manifested as a sequence of structural expressions after deconstruction by the node state transition rules; φ k (·,·) represents the k-th state mapper, which is used to receive the current input state ψ. k (x i ) and state-space conditions Then output the state mapping result for the current stage; ψ k (x i ) is used to extract input logic x i The sub-logic segment used for the k-th state transition, ψ k (x i K represents the local structure of the input path; K represents the number of state transition stages that the input logic sequence goes through when it is decomposed and processed in the behavior mapping model, that is, the number of different logic stages or path segments that the entire input logic goes through from the initial state to the final state; J represents the number of response basis functions selected in the output logic feature expression, that is, the number of nonlinear expression bases used to fit the output features. Let be the kth state transition subspace of the node. The state transition subspace contains the historical states and triggering conditions related to the input logic of this stage. In the state space The state aggregation function is executed above, and the state aggregation function is used to extract semantic structure conditions; The output logic fitting function is controlled by the parameter set Θ, and receives the input structure after state evolution transformation. ρ j (z) is the j-th output response basis function, which is used to capture the nonlinear changes of output features at the structural level; ω j For the corresponding basis function ρ j The weighting parameter is used to reflect its influence on the overall output expression; For the regularization term of the model, The complexity of the parameter set Θ is used to constrain the parameters to prevent overfitting, and λ is the regularization strength factor.

[0069] In S2, based on the input logic structure defined in the behavior mapping model corresponding to the target node, a standardized test input with fixed structure fields, trigger logic sequence and response flag is constructed. The standardized test input is used to fully cover the input logic channel of the target node.

[0070] The standardized test input is loaded into the input logic channel of the target node, and a preset response time boundary is set. The timing control module is then activated to limit the acquisition time window for the target node to generate response logic.

[0071] Within the acquisition time window, the temporal changes of the target node's output logic are continuously sampled, and structural alignment and feature parsing operations are performed to form the target node's current response sample. The current response sample is used for subsequent response consistency comparison operations.

[0072] In S3, based on the logical path relationships defined in the dual-fiber link topology, all adjacent nodes that have direct logical path connections to the target node are identified, and the path structure parameters and path constraint information from each adjacent node to the target node are obtained.

[0073] The standardized test input is subjected to structure preservation processing to ensure that the input logic satisfies the path mapping requirements in the behavior mapping model of each adjacent node, and the processed standardized test input is loaded into the input port of the behavior mapping model corresponding to each adjacent node.

[0074] In each adjacent node, its behavior mapping model is invoked, and a reverse state propagation operation based on the path direction is performed to generate a state evolution sequence pointing to the target node. The state evolution sequence is used to describe the theoretical support structure of the path segment's logical response to the target node.

[0075] Semantic fusion is performed on all state evolution sequences. Based on the weight parameters of each path segment in the link topology and semantic consistency rules, response fusion and conflict resolution operations are performed to generate the theoretical output response of the target node. The theoretical output response is written into the response reconstruction buffer of the target node as the benchmark data for subsequent sequence consistency comparison with the current response sample.

[0076] In S4, the logical evolution trajectory comparison method constructs a bidirectional temporal mapping matrix between the current response sample of the target node and the theoretical output response, extracts the correspondence between the two sets of response logic in temporal structure, state transition points and output semantic fragments, calculates the trajectory offset value at each corresponding position, and performs a cumulative reduction operation on the offset value of the entire sequence to form a set of difference vectors representing the consistency of response evolution. Then, a statistical distance operation is performed on the difference vectors to output the consistency offset as the node output. The consistency offset is used to characterize the degree of deviation of the target node's response behavior from the expected semantic path.

[0077] A dynamic anomaly detection system for the integrity of high-density dual-fiber links includes a model building module, an injection acquisition module, a reverse reconstruction module, a comparison offset module, and a marker isolation module.

[0078] The model building module is used to build a behavior mapping model between input logic and output logic for each communication node in a dual-fiber link topology. The behavior mapping model is used to describe the expected response path and output characteristics of the node under specific data input.

[0079] The injection acquisition module is used to perform input logic injection operations on the target node, load the constructed standardized test input into the target node, and collect the actual output results generated by the node within a preset response time to form the current response sample of the node.

[0080] The reverse reconstruction module is used to perform path-level reverse propagation on the standardized test input based on the established behavior mapping model among multiple adjacent nodes that have a logical path association with the target node, and reconstruct the theoretical output response that the target node should present under the full-link semantic constraints.

[0081] The alignment offset module is used to perform a sequence consistency comparison between the current response sample of the target node and its theoretical output response. It adopts a logical evolution trajectory comparison method to quantify the response difference between the two and obtain the consistency offset of the node output.

[0082] The marking and isolation module includes: if the consistency offset exceeds a preset offset threshold, then the target node is recorded as a behavioral semantic deviation node, and the behavioral semantic deviation node is marked as a potential logical anomaly source, while the data stream output by the node is stripped from the subsequent path.

[0083] It should be noted that the formation of this solution is based on an in-depth analysis of the need for identifying abnormal behavior of communication nodes in a high-density dual-fiber link topology. In complex topologies, nodes may exhibit logical response deviations without physical failures. Traditional anomaly detection mechanisms based on bit error rate, signal loss, or physical link breakage are difficult to effectively identify such implicit semantic deviations. Therefore, this solution constructs a layer-by-layer progressive anomaly detection mechanism around the semantic consistency of node behavior.

[0084] This anomaly detection mechanism is based on the behavior mapping model of communication nodes. It quantitatively judges the difference between the response samples generated by standardized test inputs and the theoretical output response reconstructed through path-level reverse propagation. The key is not whether the detection signal is transmitted intact, but whether the node generates the correct response under the given semantic path. This idea is directly reflected in the structural design of documents S1 to S4: from building the node behavior mapping model, injecting input logic and collecting current response samples, to reconstructing the theoretical output response, and then to calculating the consistency offset based on the comparison of logical evolution trajectory, each layer forms a closed loop. The logical path is clear, the terminology is continuous, and the semantics are without jumps, ensuring the implementation coherence and technical feasibility of the solution.

[0085] During implementation, the scheme first extracts the evolutionary pattern between the input and output logic of each communication node in historical operation data through the model building module, forming a behavior mapping model that can be used to simulate the node response behavior. Then, the injection acquisition module loads standardized test input into the target node. This input has structure fields, logic sequences and response identifier bits to ensure that it can cover the node response range and activate the corresponding behavior path. The response results are collected and standardized into the current response sample within the preset response time.

[0086] Next, the reverse reconstruction module loads the same test input into multiple adjacent nodes that have a logical path connection with the target node, calls their respective behavior mapping models for reverse propagation, and extracts the state evolution sequence. After semantic fusion processing, all sequences form a theoretical response that the target node should output under ideal conditions. The comparison and offset module performs trajectory-level mapping between the current response sample and the theoretical response, extracts jump points, sequence differences, and semantic offsets, and calculates the consistency offset through statistical methods. If the offset exceeds the set threshold, the marking and isolation module marks the node as a behavior semantic deviation node and achieves the separation and isolation of the node's output data by updating the path control information and cache state.

[0087] This solution is designed based on its ability to accurately identify the risk of semantic anomaly propagation in a high-density link environment. Traditional fault-tolerance mechanisms often cannot cope with response-level misleading caused by node logic anomalies in the context of high topology density and strong logical coupling. This solution introduces path-level reverse reconstruction and semantic trajectory comparison, without relying on physical anomaly markers, but actively checks the consistency of node logical behavior. On this basis, high-risk logical break zones are identified by constructing a link consistency profile map, and local path reconstruction is achieved by combining preset link integrity maintenance rules, thus completing a closed-loop operation from anomaly identification to structural repair.

[0088] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A dynamic anomaly detection method for the integrity of high-density dual-fiber links, characterized in that, include: S1. In a dual-fiber link topology, a behavioral mapping model between input logic and output logic is constructed for each communication node. The behavioral mapping model is used to describe the expected response path and output characteristics of the node under specific data input. S2. Perform input logic injection operation on the target node, load the constructed standardized test input into the target node, and collect the actual output results generated by the node within the preset response time to form the current response sample of the node. S3. Among multiple adjacent nodes that have a logical path association with the target node, based on the established behavior mapping model, perform path-level backpropagation on the standardized test input to reconstruct the theoretical output response that the target node should present under the full-link semantic constraints. S4. Compare the current response sample of the target node with its theoretical output response for sequence consistency. Use the logical evolution trajectory comparison method to quantify the response difference between the two and obtain the consistency offset of the node output. S5. If the consistency offset exceeds the preset offset threshold, the target node is recorded as a behavioral semantic deviation node, and the behavioral semantic deviation node is marked as a potential logical anomaly source. At the same time, the data stream output by the node is stripped from the subsequent path.

2. The dynamic anomaly detection method for the integrity of high-density dual-fiber links according to claim 1, characterized in that: It also includes S6: Constructing a link consistency profile based on all marked behavioral semantic deviation nodes, identifying high-risk logical break zones in the link consistency profile, and triggering a dynamic path reconstruction mechanism in combination with preset link integrity maintenance rules to achieve real-time monitoring of node response behavior and local correction of link structure, so as to ensure the continuous logical consistency and node security of dual-fiber links in high-gathering topology.

3. The dynamic anomaly detection method for the integrity of high-density dual-fiber links according to claim 2, characterized in that: In S1, the input logic sequence and corresponding output logic sequence recorded by the communication node in multiple historical operating states are synchronously collected, and the collected input logic sequence and output logic sequence are format-standardized and timestamp-aligned to form a structured mapping training sample set. Based on the mapping training sample set, the state evolution path parsing method is used to extract the state transition nodes, path evolution order and response triggering conditions involved in the transformation from input logic to output logic, and generate an initial path structure model covering the node logic evolution process. The initial path structure model is subjected to multiple rounds of semantic consistency verification and dynamic feedback fitting operations to finally generate a complete behavior mapping model. The behavior mapping model is used to accurately describe the output logic response path and response characteristics that the communication node should present under the action of specific input logic.

4. The dynamic anomaly detection method for the integrity of high-density dual-fiber links according to claim 3, characterized in that: S1 also includes constructing a behavior mapping model, which is used to characterize the output logic response path and output characteristics of a communication node under the action of specific input logic. The behavior mapping model is based on historical input logic sequences and output logic sequences, and extracts and maps the temporal, multi-path and response characteristic expression rules between the input logic and output logic of the node through three steps: state evolution path construction, semantic consistency verification and dynamic feedback fitting. Let the behavior mapping model of communication nodes be denoted as a family of functions: in: in This represents the behavior mapping model constructed for communication node n; The i-th pair of input logic sequences x collected from the historical running data of node n i With the corresponding output logic sequence y i ; Represents a complete data sample set; This indicates that the input logic x i The result of the state evolution path transformation processing; φ k (·,·) represents the k-th state mapper, which is used to receive the current input state ψ. k (x i ) and state-space conditions Then output the state mapping result for the current stage; ψ k (x i ) is used to extract input logic x i The sub-logic segment used for the k-th state transition; K represents the number of state transition stages experienced by the input logic sequence in the behavior mapping model; J represents the number of response basis functions selected in the output logic feature expression; This is the k-th state transition subspace of the node; In the state space The state aggregation function executed above; The output logic fitting function is controlled by the parameter set Θ, and receives the input structure after state evolution transformation. ρ j (z) is the j-th output response basis function, which is used to capture the nonlinear changes of output features at the structural level; ω j For the corresponding basis function ρ j Weight parameters; For the regularization term of the model, The complexity of the parameter set Θ is used to constrain the parameters to prevent overfitting, and λ is the regularization strength factor.

5. The dynamic anomaly detection method for the integrity of high-density dual-fiber links according to claim 4, characterized in that: In S2, based on the input logic structure defined in the behavior mapping model corresponding to the target node, a standardized test input with fixed structure fields, trigger logic sequence and response flag is constructed. The standardized test input is used to fully cover the input logic channel of the target node. The standardized test input is loaded into the input logic channel of the target node, and a preset response time boundary is set. The timing control module is then activated to limit the acquisition time window for the target node to generate response logic. Within the acquisition time window, the temporal changes of the target node's output logic are continuously sampled, and structural alignment and feature parsing operations are performed to form the target node's current response sample. The current response sample is used for subsequent response consistency comparison operations.

6. The dynamic anomaly detection method for the integrity of high-density dual-fiber links according to claim 5, characterized in that: In S3, based on the logical path relationships defined in the dual-fiber link topology, all adjacent nodes that have direct logical path connections to the target node are identified, and the path structure parameters and path constraint information from each adjacent node to the target node are obtained. The standardized test input is subjected to structure preservation processing to ensure that the input logic satisfies the path mapping requirements in the behavior mapping model of each adjacent node, and the processed standardized test input is loaded into the input port of the behavior mapping model corresponding to each adjacent node. In each adjacent node, its behavior mapping model is invoked, and a reverse state propagation operation based on the path direction is performed to generate a state evolution sequence pointing to the target node. The state evolution sequence is used to describe the theoretical support structure of the path segment's logical response to the target node. Semantic fusion is performed on all state evolution sequences. Based on the weight parameters of each path segment in the link topology and semantic consistency rules, response fusion and conflict resolution operations are performed to generate the theoretical output response of the target node. The theoretical output response is written into the response reconstruction buffer of the target node as the benchmark data for subsequent sequence consistency comparison with the current response sample.

7. A dynamic anomaly detection method for the integrity of high-density dual-fiber links according to claim 6, characterized in that: In S4, the logical evolution trajectory comparison method constructs a bidirectional temporal mapping matrix between the current response sample of the target node and the theoretical output response, extracts the correspondence between the two sets of response logic in temporal structure, state transition points and output semantic fragments, calculates the trajectory offset value at each corresponding position, and performs a cumulative reduction operation on the offset value of the entire sequence to form a set of difference vectors representing the consistency of response evolution. Then, a statistical distance operation is performed on the difference vectors to output the consistency offset as the node output. The consistency offset is used to characterize the degree of deviation of the target node's response behavior from the expected semantic path.

8. A dynamic anomaly detection system for the integrity of high-density dual-fiber links, comprising a model building module, an injection acquisition module, a reverse reconstruction module, a comparison offset module, and a marker isolation module, characterized in that: The model building module is used to build a behavior mapping model between input logic and output logic for each communication node in a dual-fiber link topology. The behavior mapping model is used to describe the expected response path and output characteristics of the node under specific data input. The injection acquisition module is used to perform input logic injection operations on the target node, load the constructed standardized test input into the target node, and collect the actual output results generated by the node within a preset response time to form the current response sample of the node. The reverse reconstruction module is used to perform path-level reverse propagation on the standardized test input based on the established behavior mapping model among multiple adjacent nodes that have a logical path association with the target node, and reconstruct the theoretical output response that the target node should present under the full-link semantic constraints. The alignment offset module is used to perform a sequence consistency comparison between the current response sample of the target node and its theoretical output response. It adopts a logical evolution trajectory comparison method to quantify the response difference between the two and obtain the consistency offset of the node output. The marking and isolation module includes: if the consistency offset exceeds a preset offset threshold, then the target node is recorded as a behavioral semantic deviation node, and the behavioral semantic deviation node is marked as a potential logical anomaly source, while the data stream output by the node is stripped from the subsequent path.

Images