An edge AI model-based SD-WAN zero-contact deployment automation system

Abstract

This invention discloses an automated SD-WAN zero-contact deployment system based on an edge AI model, belonging to the field of information networks. To address the problems in existing technologies, such as single-mode system authentication, susceptibility to forgery and replay attacks, insufficient AI decision reliability, lack of a safety net, coarse configuration verification, coarse rollback granularity, and susceptibility to model training contamination, lack of gradient anomaly detection, this invention effectively resists device forgery and replay attacks by using multimodal fusion verification of hardware fingerprints, visual recognition, and digital certificates, combined with timestamps, random number anti-replay, and certificate chain verification. Furthermore, it introduces a comprehensive confidence assessment; when the confidence level falls below a threshold, it automatically switches to a safety net rule generation mode, ensuring that devices can still obtain the minimum operational configuration in unknown scenarios and preventing network paralysis due to AI misjudgment.

Description

Technical Field

[0001] This invention relates to the field of information network technology, and in particular to an automated SD-WAN zero-contact deployment system based on an edge AI model. Background Technology

[0002] Software-defined wide area network (SD-WAN) is a wide area network solution based on the software-defined concept. At its core, it integrates multiple links such as MPLS, broadband, and 5G through a centralized control plane and virtualization technology, and achieves intelligent scheduling. SD-WAN breaks the traditional wide area network's dependence on hardware. Through a core architecture that separates the control plane and the forwarding plane, it achieves virtualization and centralized management of network resources.

[0003] Current zero-contact deployments typically rely solely on device serial numbers or digital certificates for identification, lacking multi-dimensional cross-verification methods. Malicious attackers can clone hardware information or steal certificates to forge legitimate devices and access the network. Furthermore, the lack of replay protection mechanisms creates serious security vulnerabilities during deployment. Additionally, while AI models are introduced to automatically generate configurations, these models may output incorrect configurations when encountering unknown scenarios outside of the training samples (such as special network topologies or new device models). Existing systems lack confidence assessment and fallback rule generation modes; misjudgments by the model can directly lead to network outages or policy conflicts. Performing simple connectivity tests (such as Ping) cannot accurately pinpoint the specific stage of configuration failure (such as interface configuration errors, tunnel connection failures, routing policy conflicts, etc.). When verification fails, it is usually rolled back to the factory configuration or the configuration is completely cleared, resulting in long-term business interruption. Moreover, the fault logs are missing, making it difficult to conduct post-fault analysis. Finally, when using federated learning to optimize edge AI models, the model gradients uploaded by each edge node may contain outliers due to node failures, malicious attacks, or data labeling errors. The existing system does not perform anomaly detection on gradients, and abnormal gradients will pollute the global model, leading to the degradation of the entire network deployment strategy.

[0004] To address this, we propose an automated SD-WAN zero-contact deployment system based on an edge AI model. Summary of the Invention

[0005] The purpose of this invention is to provide an automated SD-WAN zero-contact deployment system based on an edge AI model, which solves the problems of the current system in the background technology, such as the single identity authentication mechanism, susceptibility to forgery and replay attacks, insufficient reliability of AI decision-making, lack of backup mechanism, coarse configuration verification, coarse rollback granularity, easy contamination of model training, and lack of gradient anomaly detection.

[0006] To achieve the above objectives, the present invention provides the following technical solution: an SD-WAN zero-contact deployment automation system based on an edge AI model, comprising: an end-side device perception and authentication module, used to automatically collect device hardware fingerprints, serial numbers, digital certificates, and GPS geographical location information when a branch-side CPE device, uCPE device, or virtual network function element is powered on and started, and report a device registration request to the edge node via a zero-contact protocol; an edge AI deployment decision module, deployed on the edge computing server of the network access node, receiving the information reported by the end-side device, using a locally pre-built lightweight edge AI model to perform real-time reasoning on the network topology, bandwidth requirements, and security policies of the end-side device's location, automatically generating an initial configuration template, tunnel parameters, and QoS policies for the end-side device, and sending them to the end-side device to complete the configuration writing; and a configuration verification and rollback module, used to automatically perform connectivity detection and tunnel construction after the end-side device has applied the configuration. The system includes a chain testing and policy matching verification module. If the verification passes, the system enters the running state; if the verification fails, it automatically triggers configuration rollback and saves fault logs. A data transmission module uploads the generated configuration records, verification results, and device operating status to the cloud orchestration and management platform via a dual-channel system consisting of an SD-WAN control channel and an out-of-band management network. A cloud-based model training and policy optimization module collects deployment data, configuration change records, and fault cases from all network branch devices using the cloud orchestration and management platform. It then uses a federated learning framework to periodically train and optimize the parameters of the edge AI model. After generating a new model, it pushes it to each edge node for hot updates via a secure channel. A closed-loop policy tuning module, based on the cloud model optimization results and network-wide deployment success rate statistics, combines a pre-set best practice policy library with a dynamic confidence threshold mechanism to perform secondary review and adjustment of the configuration generated by the edge AI model. It then generates policy update instructions and feeds them back to the edge AI deployment decision module.

[0007] Furthermore, the edge device perception and identity authentication module includes a device fingerprint acquisition unit and a geographic location compliance verification unit, wherein: the device fingerprint acquisition unit is used to read the BIOS UUID, TPM chip signature, and network card MAC address combination of the CPE device to form a unique device fingerprint; the geographic location compliance verification unit is used to cross-verify the latitude and longitude of the device through GPS and base station triangulation positioning, and compare it with the pre-authorized deployment area whitelist in the cloud, and prohibit devices in unauthorized areas from accessing the network.

[0008] Furthermore, the edge AI deployment decision module includes a lightweight graph neural network inference unit and a configuration template dynamic assembly unit. The lightweight graph neural network inference unit constructs a topology graph of branch sites, their adjacent sites, and the core gateway. Node features include bandwidth, latency, and packet loss rate; edge features include link type and cost. It calculates the optimal tunnel endpoint and routing strategy through graph convolutional layers. The configuration template dynamic assembly unit has a built-in CLI template library and a Yang model template library. It automatically fills templates based on the strategy parameters output by the edge AI model, generating a device-executable configuration script. Before calling the CLI template library and the Yang model template library, the configuration template dynamic assembly unit first converts the strategy parameters output by the edge AI model into a unified intermediate configuration description model. This unified intermediate configuration description model includes interface objects, tunnel objects, routing objects, QoS objects, and security policy objects, which are then mapped to device-executable configurations by the vendor adapter. The generated configuration script is assembled according to the dependency order of basic interface configuration, certificate import, overlay tunnel establishment, routing policy distribution, QoS rule distribution, and security policy activation.

[0009] Furthermore, the edge AI deployment decision module also includes an edge resource elastic scaling module and a model version hot standby module. The edge resource elastic scaling module is used to automatically request computing resources from adjacent nodes when the same edge node processes deployment requests from more than 100 devices simultaneously, and to shorten the deployment decision latency by using model sharding parallel inference. The model version hot standby module is used to deploy two edge AI model instances, one primary and one backup, on each edge node. When the primary instance runs, the backup instance loads synchronously. When the primary instance inference times out or experiences consecutive errors, the system automatically switches to the backup instance to ensure uninterrupted deployment services.

[0010] Furthermore, the data transmission module includes a dual-channel adaptive arbitration module and a network outage caching and retransmission module. The dual-channel adaptive arbitration module monitors the health status of the SD-WAN control channel and the out-of-band 4G / 5G management channel in real time, including the BGP session status of the control channel and the signal strength of the management channel. When the packet loss rate of the control channel is >5%, it switches critical configuration confirmation messages to the out-of-band channel for transmission, with a switching latency of <100ms. The network outage caching and retransmission module stores the status data and configuration change logs of the most recent hour in a local circular buffer on the edge node when both channels are simultaneously interrupted. After the network recovers, it retransmits the data to the cloud using incremental hash verification to ensure eventual data consistency.

[0011] Furthermore, the cloud-based model training and strategy optimization module includes a cross-site federated aggregation module, a few-shot incremental learning module, and a deployment decision interpretability module. Specifically: the cross-site federated aggregation module aggregates model gradients uploaded from various edge nodes in the cloud without collecting raw data, and uses the FedAvg algorithm to update the global model, protecting the privacy of branch network topology; the few-shot incremental learning module manually labels a small number of samples to trigger local model fine-tuning when a new deployment failure occurs on an edge node, and the fine-tuned model's differential parameters are uploaded to the cloud for merging; the deployment decision interpretability module traces and analyzes the output configuration of the edge AI model, generates a decision basis graph, marks the key factors affecting the configuration, and presents it to network operations personnel in a visual manner.

[0012] Furthermore, the closed-loop strategy optimization module includes a dual-mechanism confidence assessment module and a strategy smooth evolution module. The dual-mechanism confidence assessment module calculates the weighted confidence score of the best practice strategy library matching degree and the dynamic confidence threshold. The best practice strategy library matching degree is based on the cosine similarity between current device parameters and historical successful cases. The dynamic confidence threshold is dynamically adjusted based on the deployment success rate over the past week, and a manual review process is triggered when the overall confidence score is <70%. The strategy smooth evolution module is used to implement a canary release strategy when there is a conflict between a new cloud strategy and the current edge strategy. It first selects 5% of similar branches for verification, observes for 24 hours without failure, and then pushes the full version, avoiding large-scale network outages caused by erroneous strategies.

[0013] Furthermore, the configuration template dynamic assembly unit also includes a device manufacturer adaptation layer module, which automatically calls the corresponding CLI syntax generator or Yang netconf library based on the identification of the device model. For new device models, the template generation capability is extended by the device driver adaptation package distributed by the cloud, and a device-driver-template triplet mapping table is established. When the device model changes, the mapping table hit rate is ≥99%.

[0014] Furthermore, the cross-site federated aggregation module also includes a deployment scene-aware weighting module, which introduces scene weight correction parameters during the federated aggregation process. When a branch under a certain edge node belongs to a "high dynamic mobile scene", the gradient weight of its uploaded model is increased by 50%; when it belongs to a "low bandwidth narrowband scene", its gradient is sparsified. By constructing a scene-weight matrix, a meta-learning algorithm is used to achieve adaptive adjustment of the aggregation weight according to the scene distribution.

[0015] Furthermore, the dual-channel adaptive arbitration module also includes a service priority preemption module, which introduces deployment phase awareness parameters into the channel switching logic. When in the emergency vulnerability repair deployment phase, the bandwidth reservation ratio of the out-of-band management channel is temporarily increased from 10% to 40%, and the BGP keepalive interval of the control channel is shortened from 30 seconds to 5 seconds. When in the routine configuration backup phase, the channel switching latency is allowed to be relaxed to 500ms, and the corresponding channel policy is automatically called by identifying the phase identifier field in the deployment data frame, with a phase switching response time ≤20ms.

[0016] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention proposes an automated SD-WAN zero-contact deployment system based on an edge AI model. Existing technologies suffer from single authentication mechanisms, susceptibility to forgery and replay attacks, insufficient AI decision reliability, lack of a safety net, coarse configuration verification, coarse rollback granularity, and susceptibility to model training contamination, lacking gradient anomaly detection. In contrast, this invention effectively resists device forgery and replay attacks through multimodal fusion verification using hardware fingerprinting, visual recognition, and digital certificates, combined with timestamps, random number anti-replay measures, and certificate chain verification. Furthermore, it introduces a comprehensive confidence assessment, automatically switching when the confidence level falls below a threshold. The minimum operational configuration generation mode ensures that devices can still obtain the minimum operational configuration in unknown scenarios, avoiding network paralysis caused by AI misjudgment. In addition, a six-stage sequential verification and three-level configuration checkpoints are adopted. If any stage fails, it will only roll back to the most recent checkpoint, minimizing the scope of business interruption. At the same time, detailed fault logs support rapid location and post-event analysis, and anomaly detection is performed before gradient aggregation. Abnormal gradients are downweighted or removed to prevent global model pollution and ensure the continuous and safe evolution of edge AI models. Finally, a unified intermediate configuration description model decouples AI inference from vendor syntax. When a new device type is added, only the adaptation layer needs to be expanded, without retraining the model. Attached Figure Description

[0017] Figure 1 This is a diagram illustrating the overall architecture of the SD-WAN zero-contact deployment automation system based on an edge AI model, as described in this invention. Figure 2 This is a flowchart illustrating the edge device authentication process of the SD-WAN zero-contact deployment automation system based on an edge AI model, as described in this invention. Figure 3 This is a schematic diagram of the neural network topology encoding of the SD-WAN zero-contact deployment automation system based on the edge AI model of the present invention; Figure 4 This is a diagram of the reinforcement learning strategy unit framework of the SD-WAN zero-contact deployment automation system based on the edge AI model of this invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] To address the shortcomings of existing technologies, such as simplistic authentication mechanisms, vulnerability to forgery and replay attacks, insufficient reliability of AI decision-making, lack of fallback mechanisms, coarse-grained configuration verification, coarse rollback granularity, susceptibility to model training contamination, and lack of gradient anomaly detection, etc., Figures 1-2 As shown, the following preferred technical solutions are provided:

[0020] An automated SD-WAN zero-contact deployment system based on an edge AI model includes: an end-side device perception and authentication module, used to automatically collect device hardware fingerprints, serial numbers, digital certificates, and GPS geographical location information when a branch-side CPE device, uCPE device, or virtual network function element is powered on and started, and report a device registration request to the edge node via a zero-contact protocol; it is also used to collect images of device QR code labels, panel indicator light status, and port connection status through the camera or image sensor built into the end-side device, and use a pre-built lightweight image recognition model on the end-side for real-time identification, extracting device model, serial number, and operating status information, and performing multimodal fusion verification with the visual recognition results, hardware fingerprint, and digital certificate to achieve multi-dimensional authentication of device identity. The device registration request also includes a timestamp, random number, device capability parameters, and manufacturer certificate digest for edge nodes to perform anti-replay verification, device capability identification, and certificate chain verification; the hardware fingerprint is generated by concatenating the BIOS UUID, TPM chip public key digest, main service network port MAC address, and device serial number in a preset field order and then hashing them.

[0021] The edge AI deployment decision module, deployed on the edge computing server of the network access node, receives information reported by the end-side device. Utilizing a locally pre-built lightweight edge AI model (which employs a hybrid architecture of graph neural networks and reinforcement learning), it performs real-time reasoning on the network topology, bandwidth requirements, and security policies of the end-side device's location. It automatically generates the end-side device's initial configuration template, tunnel parameters, and QoS policies, and distributes them to the end-side device to complete the configuration writing. In the lightweight edge AI model, the graph neural network encodes the topology graph composed of branch sites, adjacent sites, edge nodes, core gateways, and cloud security gateways, outputting a set of candidate tunnel endpoints, a set of candidate paths, and a link quality score. The reinforcement learning module... The module is used to select target deployment actions from a candidate set by combining device capability parameters, security constraints, service priorities, and edge node load. The deployment actions include at least tunnel endpoint selection, primary and backup link binding, route priority setting, QoS queue weight allocation, and encryption parameter selection. Before being distributed, the policy parameters output by the edge AI model are first converted into a unified intermediate configuration description model, and then mapped by the device manufacturer's adaptation layer to the corresponding device executable configuration. When the overall confidence level output by the edge AI model is lower than a preset threshold, the edge AI deployment decision module switches to the minimum rule generation mode, calls the predefined best practice basic template to generate the minimum runnable configuration, and marks the corresponding deployment request as a sample that needs to be reviewed by the cloud.

[0022] The configuration verification and rollback module is used to automatically perform connectivity detection, tunnel link establishment test, and policy matching verification after the end-side device application configuration. If the verification passes, it enters the running state; if the verification fails, it automatically triggers configuration rollback and saves the fault scene log. The configuration verification and rollback module executes in the following order: basic reachability verification, management channel verification, overlay tunnel link establishment verification, service routing verification, security policy hit verification, and QoS behavior verification. Configuration checkpoints are created after the basic interface configuration, tunnel configuration, and routing policy configuration are completed. If the verification fails at any stage, it rolls back to the most recently verified configuration checkpoint. The fault scene log includes at least the device identifier, model version number, input feature summary, output configuration summary, verification failure stage, interface status snapshot, neighbor link establishment log, policy hit counter, and rollback result code.

[0023] The data transmission module is used to upload the generated configuration records, verification results, and device operating status to the cloud orchestration and management platform through a dual-channel system consisting of the SD-WAN control channel and the out-of-band management network.

[0024] The cloud-based model training and strategy optimization module utilizes a cloud orchestration and management platform to collect deployment data, configuration change records, and fault cases from all network branch devices (branch-side CPE devices, uCPE devices, or virtual network function elements). It periodically trains and optimizes the parameters of the edge AI model using a federated learning framework. After generating a new model, it pushes it to each edge node for hot updates via a secure channel. Each edge node uses one deployment task as a training sample unit. Sample features include at least device fingerprint summary, site topology features, link quality indicators, security policy tags, device capability parameters, and configuration generation parameters. Sample tags include at least deployment success or failure results, verification time, rollback flag, service recovery latency, and number of manual interventions. Before federated aggregation, the cloud-based model training and strategy optimization module performs anomaly detection on the model gradients or difference parameters uploaded by each edge node, downgrading or removing updates with abnormal gradient norms, excessive directional deviations, or incompatible model versions.

[0025] The closed-loop strategy optimization module, based on the cloud model optimization results and the statistics of the network-wide deployment success rate, combined with the preset best practice strategy library and dynamic confidence threshold dual mechanism, performs secondary review and adjustment on the configuration generated by the edge AI model, and generates strategy update instructions to feed back to the edge AI deployment decision module, forming a closed-loop automated deployment process of perception-decision-verification-optimization.

[0026] The edge device perception and authentication module includes a device fingerprint acquisition unit and a geographic location compliance verification unit. The device fingerprint acquisition unit reads the CPE device's BIOS UUID, TPM chip signature, and network card MAC address to form a unique device fingerprint. The geographic location compliance verification unit verifies the device's latitude and longitude using GPS and base station triangulation, comparing it with a pre-authorized deployment area whitelist in the cloud. Devices in unauthorized areas are prohibited from accessing the network. The device fingerprint acquisition unit performs normalized encoding on the BIOS UUID, TPM chip signature, network card MAC address, and device serial number, and then generates a device fingerprint digest using a hash algorithm. When the deviation between the GPS positioning coordinates obtained by the geographic location compliance verification unit and the base station triangulation coordinates is less than a preset threshold, a weighted average coordinate is used as the device's final location. If the deviation exceeds the preset threshold, an abnormal location alarm is triggered, and the process is transferred to manual review. Devices in unauthorized areas are restricted from entering the service tunnel establishment phase, with only out-of-band restricted management channels reserved for alarm reporting and remote verification.

[0027] The edge AI deployment decision module includes a lightweight graph neural network inference unit and a configuration template dynamic assembly unit. The lightweight graph neural network inference unit constructs a topology graph from branch sites, their adjacent sites, and the core gateway. Node features include bandwidth, latency, and packet loss rate; edge features include link type and cost. It calculates the optimal tunnel endpoint and routing strategy through graph convolutional layers. The configuration template dynamic assembly unit has a built-in CLI template library and Yang model template library. It automatically fills templates based on policy parameters output by the edge AI model (such as VLAN partitioning, IPsec keys, and QoS queue weights), generating a device-executable configuration script. The lightweight graph neural network inference unit uses a 2- to 3-layer graph convolutional structure to encode the topology graph. Node features also include jitter, CPU utilization, and security domain labels; edge features include link availability, historical outage count, and encryption overhead coefficient. When the lightweight graph neural network inference unit uses a 2-layer graph convolutional network structure, the node feature updates in its (1+1)th layer follow the following propagation rules: ;in: It is an adjacency matrix with added self-loop connections, where A is the physical / logical connection matrix between branch sites and the core gateway; It is a degree matrix; It is the node feature matrix of the l-th layer, and the initial features Includes normalized bandwidth Delay Packet loss rate ; This is a trainable weight parameter matrix; This is the ReLU activation function.

[0028] The edge AI deployment decision module also includes a reinforcement learning strategy unit. Its state space includes at least the device model, site role, candidate tunnel endpoints, link quality score, security policy conflict identifier, service level and current edge node load. Its action space includes at least the tunnel endpoint selection, primary and backup link binding, route priority setting, QoS queue weight allocation and encryption parameter selection. Its reward function includes at least the deployment success reward, link latency penalty, bandwidth over-allocation penalty, security policy conflict penalty and rollback penalty.

[0029] The state space of the reinforcement learning unit is defined as S, and the action space is defined as A. To balance network performance and deployment success rate, the reward function R adopts a weighted multi-objective form. ;in: Establish a positive incentive for the tunnel to succeed (value +10). The actual end-to-end average delay detected; This represents the link jitter value. This is an indicator function; it is 1 if a configuration rollback occurs, and 0 otherwise (penalty). The preset weight hyperparameters are preferably set to 1.0, 0.05, 0.02, and 5.0.

[0030] Before calling the CLI template library and the Yang model template library, the configuration template dynamic assembly unit first converts the policy parameters output by the edge AI model into a unified intermediate configuration description model. The unified intermediate configuration description model includes interface objects, tunnel objects, routing objects, QoS objects, and security policy objects. Then, the vendor adapter maps it into device executable configurations. The generated configuration script is assembled according to the dependency order of basic interface configuration, certificate import, overlay tunnel establishment, routing policy distribution, QoS rule distribution, and security policy activation.

[0031] The edge AI deployment decision module also includes an edge resource elastic scaling module and a model version hot standby module. The edge resource elastic scaling module is used to automatically request computing resources from adjacent nodes when the same edge node processes deployment requests from more than 100 devices at the same time, and to shorten the deployment decision latency by using model sharding parallel inference. The model version hot standby module is used to deploy two edge AI model instances, one primary and one backup, on each edge node. When the primary instance runs, the backup instance loads synchronously. When the primary instance inference times out (>3 seconds) or has consecutive errors (>5 times), it automatically switches to the backup instance to ensure uninterrupted deployment services.

[0032] The data transmission module includes a dual-channel adaptive arbitration module and a network outage caching and retransmission module. The dual-channel adaptive arbitration module monitors the health status of the SD-WAN control channel and the out-of-band 4G / 5G management channel in real time, including the BGP session status of the control channel and the signal strength of the management channel. When the packet loss rate of the control channel exceeds 5%, critical configuration confirmation messages are switched to the out-of-band channel for transmission, with a switching latency of <100ms. The network outage caching and retransmission module stores the status data and configuration change logs of the most recent hour in a local circular buffer on the edge node when both channels are interrupted simultaneously. After the network recovers, incremental hash verification is used to retransmit the data to the cloud, ensuring eventual data consistency.

[0033] The cloud-based model training and strategy optimization module includes a cross-site federated aggregation module, a few-shot incremental learning module, and a deployment decision interpretability module. Specifically: the cross-site federated aggregation module aggregates model gradients uploaded from various edge nodes in the cloud, without collecting raw data, and uses the FedAvg algorithm to update the global model, protecting the privacy of branch network topology; the few-shot incremental learning module manually labels a small number of samples (10-20) to trigger local model fine-tuning when a new deployment failure occurs at an edge node (such as CPE compatibility issues with a specific manufacturer), and the fine-tuned model's difference parameters are uploaded to the cloud for merging; the deployment decision interpretability module traces and analyzes the output configuration of the edge AI model, generates a decision basis graph, and marks the key factors affecting the configuration (such as...). (Insufficient bandwidth, security policy conflicts), and presented to network operations personnel in a visual manner. The cross-site federated aggregation module performs anomaly detection on the model gradients uploaded by each edge node before aggregation, and performs weight reduction or elimination on abnormal updates based on gradient norm, gradient direction similarity, and model version consistency. The few-shot incremental learning module only uploads the difference parameters or compressed gradients after local model fine-tuning to reduce bandwidth consumption during model update. The deployment decision interpretability module generates a decision basis graph corresponding to the final configuration by back-mapping the node weights, edge weights, and reinforcement learning action values ​​of the graph neural network, which is used to show the key sites, key links, and key constraint rules that affect the selection of deployment actions. The cross-site federated aggregation module aggregates the gradients uploaded by each edge node. Before proceeding, execute the following anomaly detection logic: Calculate the mean of the global gradient norm: If the gradient of a certain node satisfies If the angle between the gradient and the cosine of the global average gradient direction is less than 0.1, it is considered an anomalous gradient; the aggregate weights of anomalous gradients... The weights will be compressed to 10% of the original weights to prevent contamination of the global model.

[0034] The closed-loop strategy optimization module includes a dual-mechanism confidence assessment module and a strategy smooth evolution module. The dual-mechanism confidence assessment module is used to calculate the weighted confidence of the best practice strategy library matching degree and the dynamic confidence threshold. The best practice strategy library matching degree is based on the cosine similarity between the current device parameters and historical successful cases. The dynamic confidence threshold is dynamically adjusted according to the deployment success rate in the past week (the threshold increases by 3% for every 5% decrease in the success rate). When the overall confidence is <70%, a manual review process is triggered.

[0035] The dual-mechanism confidence assessment module calculates the current device parameter vector. Feature vectors of historical success cases When determining the matching degree, the cosine similarity algorithm is used: The feature vector dimensions include: device manufacturer code, interface bandwidth level, CPU architecture type, and deployment region code. If the overall weighted confidence level is below 70%, the system will trigger the backup rule generation mode.

[0036] The strategy smooth evolution module is used to implement a canary release strategy when there is a conflict between the new cloud strategy and the current edge strategy. It first selects 5% of similar branches for verification, observes for 24 hours without failure, and then pushes it to the whole network to avoid large-scale network outages caused by erroneous strategies. The weighted confidence score is also calculated in conjunction with the success rate of similar historical scenarios. Similar historical scenarios are clustered by device model, link type, site type, and service level. The configuration correction content, review opinions, and final deployment results triggered by manual review are recorded as high-quality labeled samples and given priority in subsequent model training. During canary release, the strategy smooth evolution module prioritizes branches with consistent device models, consistent link types, low service levels, and geographically dispersed distribution as verification objects. If any verification branch experiences a critical business interruption, exceeds the threshold for abnormal tunnel reconstruction, or triggers a strategy conflict alarm during the canary release, subsequent pushes are immediately stopped and the released branches are rolled back to the previous stable strategy version.

[0037] The configuration template dynamic assembly unit also includes a device manufacturer adaptation layer module. Based on identifying the device model (such as Cisco, Huawei, Juniper, Fortinet), it automatically calls the corresponding CLI syntax generator or Yangnetconf library. For new device models, it extends the template generation capability through the device driver adaptation package distributed from the cloud and establishes a device-driver-template triplet mapping table. When the device model changes, the mapping table hit rate is ≥99%.

[0038] The cross-site federated aggregation module also includes a deployment scenario-aware weighting module, which introduces scenario weight correction parameters during the federated aggregation process. When a branch under a certain edge node belongs to a "high-dynamic mobile scenario" (such as vehicular SD-WAN), the gradient weight of its uploaded model is increased by 50%; when it belongs to a "low-bandwidth narrowband scenario" (such as a satellite link branch), its gradient is sparsified (only the top 20% of important parameters are uploaded). By constructing a scenario-weight matrix, a meta-learning algorithm is used to achieve adaptive adjustment of aggregation weights according to scenario distribution. The deployment scenario-aware weighting module classifies branch scenarios according to site mobility, link type, bandwidth level, latency fluctuation, and business continuity requirements. The scenario-weight matrix is ​​updated according to a preset period or when the scenario distribution changes significantly. The meta-learning algorithm uses the success rate, rollback rate, and latency indicators of the global model under different deployment scenarios as optimization targets to adaptively correct the aggregation weights.

[0039] The dual-channel adaptive arbitration module also includes a service priority preemption module, which introduces deployment phase awareness parameters into the channel switching logic. When in the emergency vulnerability repair deployment phase, the bandwidth reservation ratio of the out-of-band management channel is temporarily increased from 10% to 40%, and the BGP keepalive interval of the control channel is shortened from 30 seconds to 5 seconds. When in the routine configuration backup phase, the channel switching latency is allowed to be relaxed to 500ms. The corresponding channel policy is automatically called by identifying the phase identifier field in the deployment data frame, and the phase switching response time is ≤20ms.

[0040] The system also includes a natural language interaction module, which receives deployment instructions or query requests input by operation and maintenance personnel via voice or text, uses a lightweight natural language understanding model pre-built on the device to parse the semantics of the instructions, converts them into configuration operation commands that can be executed by the device, and broadcasts deployment progress and abnormal prompts through a voice synthesis module.

[0041] The edge AI collaborative reasoning unit is deployed inside the edge device. When the edge device is powered on, it uses the lightweight AI reasoning engine built into the edge device to perform local reasoning on the device status information output by visual recognition and the semantics of the instructions parsed by the natural language interaction module, generate preliminary configuration suggestions, and upload the preliminary configuration suggestions to the edge AI deployment decision module for collaborative optimization.

[0042] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. An automated SD-WAN zero-contact deployment system based on an edge AI model, characterized in that, include: The edge device perception and authentication module automatically collects the device's hardware fingerprint, serial number, digital certificate, and GPS geographical location information when the branch-side CPE device, uCPE device, or virtual network function network element is powered on and started. It then reports the device registration request to the edge node via a zero-contact protocol. The edge AI deployment decision module, deployed on the edge computing server of the network access node, receives the information reported by the edge device and uses a locally pre-built lightweight edge AI model to perform real-time reasoning on the network topology, bandwidth requirements, and security policies of the edge device's location. It automatically generates the edge device's initial configuration template, tunnel parameters, and QoS policies, and sends them to the edge device to complete the configuration writing. The configuration verification and rollback module automatically performs connectivity detection, tunnel link establishment testing, and policy matching verification after the edge device applies the configuration. If the verification passes, it enters the running state; if the verification fails, it automatically triggers configuration rollback and saves the fault log. The data transmission module uploads the generated configuration records, verification results, and device operating status to the cloud orchestration and management platform via a dual-channel system consisting of an SD-WAN control channel and an out-of-band management network. The cloud-based model training and strategy optimization module utilizes a cloud orchestration and management platform to collect deployment data, configuration change records, and fault cases from all branch devices across the network. It employs a federated learning framework to periodically train and optimize the parameters of the edge AI model. After generating a new version of the model, it pushes it to each edge node for hot updates via a secure channel. The closed-loop strategy tuning module, based on the cloud-based model optimization results and the network-wide deployment success rate statistics, combines a pre-set best practice strategy library with a dynamic confidence threshold mechanism to conduct a secondary review and adjustment of the configuration generated by the edge AI model. It then generates strategy update instructions and feeds them back to the edge AI deployment decision module.

2. The SD-WAN zero-contact deployment automation system based on an edge AI model as described in claim 1, characterized in that: The edge device perception and identity authentication module includes a device fingerprint acquisition unit and a geographic location compliance verification unit. The device fingerprint acquisition unit is used to read the BIOS UUID, TPM chip signature, and network card MAC address of the CPE device to form a unique device fingerprint. The geographic location compliance verification unit is used to cross-verify the latitude and longitude of the device through GPS and base station triangulation and compare it with the pre-authorized deployment area whitelist in the cloud. Devices in unauthorized areas are prohibited from accessing the network.

3. The SD-WAN zero-contact deployment automation system based on an edge AI model as described in claim 2, characterized in that: The edge AI deployment decision module includes a lightweight graph neural network inference unit and a configuration template dynamic assembly unit. The lightweight graph neural network inference unit constructs a topology graph of branch sites, their adjacent sites, and the core gateway. Node features include bandwidth, latency, and packet loss rate; edge features include link type and cost. It calculates the optimal tunnel endpoint and routing strategy through graph convolutional layers. The configuration template dynamic assembly unit has a built-in CLI template library and a Yang model template library. It automatically fills templates based on the policy parameters output by the edge AI model, generating a device-executable configuration script. Before calling the CLI template library and the Yang model template library, the configuration template dynamic assembly unit first converts the policy parameters output by the edge AI model into a unified intermediate configuration description model. This unified intermediate configuration description model includes interface objects, tunnel objects, routing objects, QoS objects, and security policy objects, which are then mapped to device-executable configurations by the vendor adapter. The generated configuration script is assembled according to the dependency order of basic interface configuration, certificate import, overlay tunnel establishment, routing policy distribution, QoS rule distribution, and security policy activation.

4. The SD-WAN zero-contact deployment automation system based on an edge AI model as described in claim 3, characterized in that: The edge AI deployment decision module also includes an edge resource elastic scaling module and a model version hot standby module. The edge resource elastic scaling module is used to automatically request computing resources from adjacent nodes when the same edge node processes deployment requests from more than 100 devices simultaneously, and to shorten the deployment decision latency by using model sharding parallel inference. The model version hot standby module is used to deploy two edge AI model instances, one primary and one backup, on each edge node. When the primary instance runs, the backup instance loads synchronously. When the primary instance inference times out or experiences consecutive errors, it automatically switches to the backup instance to ensure uninterrupted deployment services.

5. The SD-WAN zero-contact deployment automation system based on an edge AI model as described in claim 4, characterized in that: The data transmission module includes a dual-channel adaptive arbitration module and a network outage caching and retransmission module. The dual-channel adaptive arbitration module monitors the health status of the SD-WAN control channel and the out-of-band 4G / 5G management channel in real time, including the BGP session status of the control channel and the signal strength of the management channel. When the packet loss rate of the control channel is >5%, critical configuration confirmation messages are switched to the out-of-band channel for transmission, with a switching latency of <100ms. The network outage caching and retransmission module stores the status data and configuration change logs of the most recent hour in a local circular buffer on the edge node when both channels are interrupted simultaneously. After the network recovers, incremental hash verification is used to retransmit the data to the cloud, ensuring eventual data consistency.

6. The SD-WAN zero-contact deployment automation system based on an edge AI model as described in claim 5, characterized in that: The cloud-based model training and strategy optimization module includes a cross-site federated aggregation module, a few-shot incremental learning module, and a deployment decision interpretability module. Specifically: the cross-site federated aggregation module aggregates model gradients uploaded from various edge nodes in the cloud without collecting raw data, and uses the FedAvg algorithm to update the global model, protecting the privacy of branch network topology; the few-shot incremental learning module manually labels a small number of samples to trigger local model fine-tuning when a new deployment failure occurs on an edge node, and the fine-tuned model's difference parameters are uploaded to the cloud for merging; the deployment decision interpretability module traces and analyzes the output configuration of the edge AI model, generates a decision basis graph, marks the key factors affecting the configuration, and presents it to network operations personnel in a visual manner.

7. The SD-WAN zero-contact deployment automation system based on an edge AI model as described in claim 6, characterized in that: The closed-loop strategy optimization module includes a dual-mechanism confidence assessment module and a strategy smooth evolution module. The dual-mechanism confidence assessment module calculates the weighted confidence score based on the best practice strategy library matching degree and a dynamic confidence threshold. The best practice strategy library matching degree is based on the cosine similarity between current device parameters and historical successful cases. The dynamic confidence threshold is dynamically adjusted based on the deployment success rate over the past week. A manual review process is triggered when the overall confidence score is <70%. The strategy smooth evolution module is used to implement a canary release strategy when there is a conflict between a new cloud strategy and the current edge strategy. It first selects 5% of similar branches for verification, observes for 24 hours without failure, and then pushes the strategy to the entire network, avoiding large-scale network outages caused by erroneous strategies.

8. The SD-WAN zero-contact deployment automation system based on an edge AI model as described in claim 7, characterized in that: The configuration template dynamic assembly unit also includes a device manufacturer adaptation layer module, which automatically calls the corresponding CLI syntax generator or Yang netconf library based on the identification of the device model. For new device models, the template generation capability is extended by the device driver adaptation package distributed by the cloud, and a device-driver-template triplet mapping table is established. When the device model changes, the mapping table hit rate is ≥99%.

9. The SD-WAN zero-contact deployment automation system based on an edge AI model as described in claim 8, characterized in that: The cross-site federated aggregation module also includes a deployment scene-aware weighting module, which introduces scene weight correction parameters during the federated aggregation process. When a branch under a certain edge node belongs to a "high dynamic mobile scene", the gradient weight of its uploaded model is increased by 50%; when it belongs to a "low bandwidth narrowband scene", its gradient is sparsified. By constructing a scene-weight matrix, a meta-learning algorithm is used to achieve adaptive adjustment of the aggregation weight according to the scene distribution.

10. The SD-WAN zero-contact deployment automation system based on an edge AI model as described in claim 9, characterized in that: The dual-channel adaptive arbitration module also includes a service priority preemption module, which introduces deployment phase awareness parameters into the channel switching logic. When in the emergency vulnerability repair deployment phase, the bandwidth reservation ratio of the out-of-band management channel is temporarily increased from 10% to 40%, and the BGP keepalive interval of the control channel is shortened from 30 seconds to 5 seconds. When in the routine configuration backup phase, the channel switching latency is allowed to be relaxed to 500ms, and the corresponding channel policy is automatically called by identifying the phase identifier field in the deployment data frame, with a phase switching response time of ≤20ms.

Images