Artificial intelligence-based network configuration change risk assessment method and system
By using an AI-based network configuration change risk assessment method, network configuration changes are automatically analyzed and evaluated, solving the problem of low efficiency in traditional manual review. This enables rapid and accurate risk assessment, adapts to equipment from multiple vendors, and improves operational efficiency and consistency.
Patent Information
- Application Number
- CN202610750129.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-05-28
- Publication Date
- 2026-07-10
AI Technical Summary
In the traditional manual review model, network configuration changes are inefficient and cannot meet the timeliness requirements of high-frequency configuration changes in large-scale network environments. Furthermore, the configuration syntax of different manufacturers and models of equipment varies greatly, which increases the difficulty of review and the professional threshold.
An AI-based network configuration change risk assessment method is adopted. By receiving target network device information, configuration commands, and change business background, the configuration commands are parsed, a structured representation is constructed, the network topology and device status are collected, a large language model is called for semantic reasoning, a risk score is calculated, and a risk report is generated. Combined with manual review and learning mechanisms, an automated and standardized risk assessment is achieved.
It reduces the review time from hours or even days to minutes, adapts to the different configuration syntax of different manufacturers' equipment, lowers the professional threshold, improves the standardization and consistency of evaluation results, and improves operation and maintenance efficiency and accuracy.
Smart Images
Figure CN122372424A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network operation and maintenance technology, and specifically to a network configuration change risk assessment method and system based on artificial intelligence. Background Technology
[0002] As enterprise networks continue to expand, modern enterprise networks typically deploy hundreds or even thousands of network devices, including switches, routers, firewalls, load balancers, VPN gateways, etc. These devices come from different vendors such as Huawei, H3C, Cisco, and Juniper, and the different models result in significant differences in configuration command syntax. In network operations and maintenance, configuration changes (such as adding routing policies, opening / closing ports, modifying security rules, etc.) require the execution of a series of configuration commands, which, according to industry best practices, must be strictly reviewed to avoid network outages, performance degradation, or security risks.
[0003] However, the current mainstream traditional manual review model has a major technical problem: low efficiency. Specifically, human experts need to analyze configuration commands one by one, and complex change reviews can take hours or even days, which seriously slows down business response speed and makes it difficult to meet the timeliness requirements of high-frequency configuration changes in large-scale network environments. At the same time, the configuration syntax of different manufacturers and models of equipment varies greatly, and reviewers need to have comprehensive knowledge, which further exacerbates the problem of review efficiency.
[0004] Therefore, there is an urgent need for a method and system that can quickly and automatically complete the risk assessment of network configuration changes. Summary of the Invention
[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide a network configuration change risk assessment method and system based on artificial intelligence, thereby solving the technical problem of low efficiency of manual review in the prior art.
[0006] To achieve the above objectives, this invention provides a network configuration change risk assessment method based on artificial intelligence, comprising the following steps: Receive target network device information, configuration commands, change service background, and time window; Based on the manufacturer and model of the target network device, parse the configuration commands, extract configuration items, parameters and target objects, and construct a structured representation; Based on the target object, collect the network topology, current configuration, operating status, recent alarms and related security policies of the target network devices and associated devices; Based on structured representations and collected information, rule matching is performed and a large language model is invoked for semantic reasoning to calculate risk scores and identify risk scenarios and their scope of impact. Based on the risk scoring and identification results, a report is generated that includes risk level, risk point list, risk impact analysis, mitigation suggestions and assessment basis; When the risk level is high, the case is sent for manual review, feedback is collected and the assessment results are updated, and the case is included in the learning sample.
[0007] By adopting this technical solution, the entire process from change application to evaluation completion is automated by receiving target network device information, configuration commands, business background, and time windows as input, and sequentially executing parsing, collection, evaluation, report generation, and manual review. Compared to traditional manual review, this method reduces the review time from hours or even days to minutes, directly solving the technical problem of low efficiency in manual review. At the same time, by calling a large language model for semantic reasoning, it can adapt to the configuration syntax differences of different manufacturers and models of devices, lowering the professional threshold. The automatic generation of structured reports ensures the standardization and consistency of evaluation results.
[0008] Furthermore, the parsing of configuration commands is achieved through a multi-vendor configuration command parser; The multi-vendor configuration command parser consists of a vendor identification module, a model identification module, a command template library, a semantic extraction engine, and a standardized output interface. It uses regular expression matching to perform semantic extraction, parameter normalization, and dependency analysis on configuration commands from different vendors.
[0009] By adopting this technical solution, the technical problem of large differences in configuration command syntax in a mixed deployment environment of multi-brand and multi-model network devices is solved. By covering mainstream manufacturers with command template library and combining semantic extraction and parameter standardization, unified parsing and standardized representation of heterogeneous configuration commands are realized, providing a structured and processable data foundation for subsequent risk assessment.
[0010] Furthermore, the current configuration, operating status, recent alarms, and related security policies of the target network devices and associated devices are collected through the context information collection interface; The context information collection interface supports integration with network management systems, configuration management databases, monitoring systems, IT service management platforms, and configuration backup systems to achieve automatic collection of multi-source data.
[0011] By adopting this technical solution, the automatic collection of multi-source data eliminates the need for manual review and aggregation of information from various systems, significantly improving the efficiency of obtaining contextual information. At the same time, the collected information covers multiple dimensions, providing sufficient contextual basis for risk assessment, making the assessment results more accurate and comprehensive.
[0012] Furthermore, the formula for calculating the risk score is as follows: RiskScore=Σ(Wi×Si)×ContextMultiplier In the formula, Wi is the risk factor weight, Si is the risk factor score, and ContextMultiplier is the context influence coefficient; Risk factors include configuration conflict level, service impact level, security risk level, rollback capability, and timing appropriateness.
[0013] By adopting this technical solution, abstract risk assessment is transformed into quantifiable numerical calculations, eliminating the differences in subjective human judgment and ensuring the consistency of assessment results. Risk factors comprehensively assess risks from multiple dimensions such as configuration itself, business impact, security, recoverability, and timing, making the scoring results more scientific and comprehensive.
[0014] Furthermore, the risk levels are categorized as high risk, medium risk, and low risk.
[0015] By adopting this technical solution, the three-level classification is simple and clear, and conforms to the habits of operation and maintenance management.
[0016] This invention also provides an artificial intelligence-based network configuration change risk assessment system, comprising: The configuration input layer is used to receive target network device information, configuration commands, change service background, and time window. The context acquisition layer is used to collect network topology, current configuration, operating status, recent alarms and related security policies of target network devices and associated devices based on the target object. The intelligent assessment engine includes a command parser, a context fusion module, a risk identifier, and a report generator; The core of the large-scale artificial intelligence model is equipped with a domain knowledge base, a risk case base, an evaluation rule base, and a model inference engine; The user interaction layer is used to connect with the change application information and approval process interface, and provides a report display interface; The assessment results output layer is used to output risk assessment reports; The configuration input layer, context acquisition layer, core of the artificial intelligence big model, and user interaction layer are all connected to the intelligent evaluation engine, which in turn is connected to the evaluation result output layer.
[0017] By adopting this technical solution and using a hierarchical modular architecture, the responsibilities of each layer are clearly defined and they work collaboratively, thus achieving the systematic implementation of the methodology.
[0018] Furthermore, the command parser is configured for multiple vendors; The multi-vendor configuration command parser consists of a vendor identification module, a model identification module, a command template library, a semantic extraction engine, and a standardized output interface. It is used to perform semantic extraction, parameter normalization, and dependency analysis on configuration commands for devices from different vendors.
[0019] By adopting this technical solution and through modular parser design, unified parsing and standardized output of configuration commands for devices from multiple vendors are achieved, providing the system with cross-vendor adaptability.
[0020] Furthermore, the context acquisition layer is implemented through a context information acquisition interface; The context information collection interface supports integration with network management systems, configuration management databases, monitoring systems, IT service management platforms, and configuration backup systems.
[0021] By adopting this technical solution and using standardized data collection interfaces, seamless integration with existing operation and maintenance systems is achieved, reducing the difficulty and cost of system integration while ensuring the comprehensiveness and timeliness of contextual data.
[0022] Furthermore, the risk identifier calculates the risk score using the following formula: RiskScore=Σ(Wi×Si)×ContextMultiplier Where Wi is the risk factor weight, Si is the risk factor score, and ContextMultiplier is the context influence coefficient; Risk factors include configuration conflict level, service impact level, security risk level, rollback capability, and timing appropriateness.
[0023] By adopting this technical solution, a quantitative risk assessment model is embedded into the core of the system, enabling the system to automatically and objectively calculate risk scores, eliminating subjective human differences, and ensuring the scientific nature and consistency of the assessment.
[0024] Furthermore, the user interaction layer is also used to push manual review when the risk level is high, collect feedback and update the assessment results, and incorporate cases into the learning samples.
[0025] By adopting this technical solution, a human-machine collaborative working mechanism was established. For high-risk changes, a manual review process was retained, balancing the efficiency and security of automation. At the same time, by collecting feedback and incorporating cases into the learning samples, the system was able to continuously learn and optimize, enabling the system's risk assessment capabilities to continuously improve with the number of uses.
[0026] Compared with the prior art, the present invention has the following advantages: 1. In contrast to the complex configuration change assessments that traditionally take hours or even days to complete manually, this invention can automate the assessment process in minutes, significantly shortening the change approval cycle and improving business response speed.
[0027] 2. By leveraging artificial intelligence technology, junior operations and maintenance personnel can acquire advanced expert-level risk assessment capabilities, alleviating the industry pain point of scarce network expert resources.
[0028] 3. Based on a unified risk assessment model and rule base, eliminate the differences in subjective human judgment and ensure that the same type of configuration change obtains standardized assessment results.
[0029] 4. Transform experts' risk assessment experience into reusable assessment rules and models to solve the problems of difficulty in passing on experience and long training cycles for new employees.
[0030] 5. Through human-machine collaboration mechanisms and case accumulation, the system learns from each assessment, continuously improving the accuracy of risk identification and assessment.
[0031] 6. The automatically generated assessment reports, coupled with visual displays, enable management to quickly understand the risk situation and improve decision-making efficiency.
[0032] 7. Built-in compliance check rule base automatically verifies whether configuration changes comply with industry regulations and enterprise security policies, thus mitigating compliance risks from a technical perspective. Attached Figure Description
[0033] Figure 1 This is a schematic diagram of the framework of the network configuration change risk assessment system based on artificial intelligence in this invention; Figure 2 This is a schematic diagram of the network configuration change risk assessment method based on artificial intelligence in this invention. Detailed Implementation
[0034] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.
[0035] This invention provides a network configuration change risk assessment method and system based on artificial intelligence. Please refer to the appendix. Figure 1 The network configuration change risk assessment system based on artificial intelligence of the present invention has a hierarchical architecture, which includes six core parts: configuration input layer, context acquisition layer, user interaction layer, intelligent assessment engine, artificial intelligence big model core, and assessment result output layer. The modules at each level work together to achieve risk assessment.
[0036] The configuration input layer is used to receive basic configuration information such as configuration change commands, configuration files, or change scripts.
[0037] The context acquisition layer is used to collect context data related to changes, such as network topology information, device operating status, and alarm history data.
[0038] The user interaction layer is used to connect with change application information and approval process interfaces, provide report display interfaces, and realize human-computer interaction.
[0039] The intelligent assessment engine, as the core processing layer, includes a command parser, a context fusion module, a risk identifier, and a report generator, and performs operations such as command multi-vendor adaptation, semantic extraction, topology fusion, rule matching, and structured report generation.
[0040] The core of the AI big model is equipped with a domain knowledge base, a risk case library, an assessment rule base, and a model inference engine, providing domain knowledge and AI reasoning capabilities for risk assessment.
[0041] The assessment results output layer presents the assessment results in three forms: risk assessment reports, visualizations, and API interface outputs.
[0042] This system is deployed in an enterprise intranet environment, adopting a four-layer deployment architecture of server cluster + knowledge base storage + data acquisition + network device layer: The evaluation system server cluster includes Web service nodes, API service nodes, and AI inference nodes, realizing user interaction, external interfaces, and large model inference functions; the knowledge base and model storage layer stores domain knowledge bases, case libraries, rule bases, and model files, providing data and model support for evaluation; the data acquisition layer interfaces with NMS, CMDB, monitoring systems, configuration backup systems, and ITSM to complete data acquisition; the network device layer covers various network devices such as switches, routers, firewalls, load balancers, and VPN gateways, providing actual business objects for evaluation. Please refer to the appendix. Figure 2 The network configuration change risk assessment method based on artificial intelligence of the present invention follows a six-step core process of input-parsing-collection-assessment-generation-verification.
[0043] S1. Configuration Change Information Input: Receive the target network device information (including type, model, and manufacturer), the configuration command to be executed, the background of the change, and the expected implementation time window submitted by the user; in specific implementation, the configuration command can also be in the form of a change script; the background of the change can also include the urgency of the change.
[0044] S2. Configuration command parsing and standardization: Identify the target network device manufacturer and model, apply corresponding parsing rules, extract configuration items, parameters and target objects, and construct a structured representation of configuration changes.
[0045] S3. Context Information Collection: Automatically collects network topology, current configuration, operating status, recent alarms, and relevant security policies of target network devices and associated devices; in specific implementations, the collected information may also include performance indicators, change history, and compliance requirements.
[0046] S4. Multi-dimensional risk assessment: Based on the execution of rules matching by artificial intelligence models and the invocation of large language models for semantic reasoning, risk scores are calculated by comprehensively considering multiple factors to identify potential risk scenarios and their scope of impact.
[0047] S5. Risk Assessment Report Generation: Automatically generates structured reports, including risk level determination (high / medium / low), risk point list, risk impact analysis, mitigation suggestions, and assessment basis.
[0048] S6. Human-machine collaborative confirmation: High-risk items are sent to human experts for review, feedback is collected and evaluation results are updated, and cases are included in the learning samples.
[0049] The multi-vendor configuration command parser consists of a vendor identification module, a model identification module, a command template library, a semantic extraction engine, and a standardized output interface. It uses regular expression matching to perform semantic extraction, parameter normalization, and dependency analysis on configuration commands from different vendors.
[0050] The context information collection interface supports integration with network management systems (NMS), configuration management databases (CMDB), monitoring systems, IT service management platforms (ITSM), and configuration backup systems to achieve automatic collection of multi-source data.
[0051] The multi-factor weighted risk assessment model uses the formula RiskScore=Σ(Wi×Si)×ContextMultiplier to calculate the risk score, where Wi is the risk factor weight, Si is the risk factor score, and ContextMultiplier is the context influence coefficient.
[0052] Risk factors cover five dimensions: configuration conflict degree, service impact degree, security risk degree, rollbackability, and timing appropriateness. Example 1: Change of Routing Policy for Enterprise Campus Network A nine-story corporate campus has a network of approximately 300 devices. The maintenance personnel need to execute the command `ip route-static 192.168.100.0 255.255.255.0 10.1.1.1` on a Huawei S5700 switch to add a static route that forwards traffic from the specified network segment to the core router.
[0053] The maintenance personnel submit a change request containing the command, and the system receives basic information such as the device model, configuration command, change business background, and time window.
[0054] The system automatically identifies the Huawei device model, parses the command, and extracts key parameters such as the target network segment [192.168.100.0 / 24] (192.168.100.0 / 24) and the next hop [10.1.1.1] (10.1.1.1).
[0055] The system collects contextual information such as the current routing table, device port status, associated VLAN configuration, and recent alarm records.
[0056] The AI evaluation engine sequentially checks for routing conflicts, security policy blocking, next-hop reachability, and redundant paths, determining that there are no risk points.
[0057] The system automatically generates a low-risk assessment report and recommends direct implementation.
[0058] Businesses can quickly complete the approval and implementation of changes, with the entire assessment process taking less than 5 minutes, improving efficiency by over 90% compared to traditional manual review. Example 2: Firewall security policy for opening ports The operations and maintenance personnel need to execute commands such as rule name permit_web_app and source-zone trust on the H3C SecPath F1000 firewall to open TCP port 8080 for use by the new web application.
[0059] After receiving the change request, the system parses the command and identifies the operation type as security policy configuration, with the target being to open port 8080 from the trust zone to the untrust zone.
[0060] The system collects information such as firewall model, existing security policy rules, port usage, and target server network location.
[0061] AI assessment engines identify potential security risks introduced by open internet access, while also checking for conflicts with existing policies and compliance with enterprise security strategies.
[0062] The system determined the risk to be medium, generated an assessment report, and recommended adding source IP address restrictions.
[0063] After the maintenance personnel modified the configuration commands according to the suggestions, the system was reassessed as low-risk, and the change approval was completed. Example 3: Inter-VLAN Routing Change on a Layer 3 Switch Maintenance personnel need to modify the VLAN interface configuration of the enterprise's core Layer 3 switch and adjust the gateway address of a certain VLAN.
[0064] The system analyzes the configuration change content and clarifies that the target of the operation is the core switch VLAN gateway, and the operation type is routing configuration modification.
[0065] The system automatically collects the network topology, confirms the number of terminal devices and servers connected under the VLAN, and obtains related information such as DHCP server configuration and static routing table.
[0066] The AI evaluation engine analyzes the impact of gateway changes on DHCP service, static routing, and terminal device networking, and predicts the number of affected terminals.
[0067] The system determines the risk level based on the scope of impact, generates an assessment report, identifies the risk point as some terminals needing to reacquire IP addresses, and provides mitigation suggestions such as implementing and backing up configurations in advance during off-peak periods.
[0068] The company selected an implementation time based on the report and successfully completed the configuration change without causing business interruption. The present invention has been described in detail above with reference to the accompanying drawings and embodiments. Those skilled in the art can make various modifications to the present invention based on the above description. Therefore, certain details in the embodiments should not be construed as limiting the present invention, and the scope of protection of the present invention shall be defined by the appended claims.
Claims
1. A network configuration change risk assessment method based on artificial intelligence, characterized in that, Includes the following steps: Receive target network device information, configuration commands, change service background, and time window; Based on the manufacturer and model of the target network device, parse the configuration commands, extract configuration items, parameters and target objects, and construct a structured representation; Based on the target object, collect the network topology, current configuration, operating status, recent alarms and related security policies of the target network devices and associated devices; Based on structured representations and collected information, rule matching is performed and a large language model is invoked for semantic reasoning to calculate risk scores and identify risk scenarios and their scope of impact. Based on the risk scoring and identification results, a report is generated that includes risk level, risk point list, risk impact analysis, mitigation suggestions and assessment basis; When the risk level is high, the case is sent for manual review, feedback is collected and the assessment results are updated, and the case is included in the learning sample.
2. The network configuration change risk assessment method based on artificial intelligence according to claim 1, characterized in that, The configuration command parsing is achieved through a multi-vendor configuration command parser; The multi-vendor configuration command parser consists of a vendor identification module, a model identification module, a command template library, a semantic extraction engine, and a standardized output interface. It uses regular expression matching to perform semantic extraction, parameter normalization, and dependency analysis on configuration commands from different vendors.
3. The network configuration change risk assessment method based on artificial intelligence according to claim 1, characterized in that, The network topology, current configuration, operating status, recent alarms, and related security policies of target network devices and associated devices are collected through the context information collection interface. The context information collection interface supports integration with network management systems, configuration management databases, monitoring systems, IT service management platforms, and configuration backup systems to achieve automatic collection of multi-source data.
4. The network configuration change risk assessment method based on artificial intelligence according to claim 1, characterized in that, The formula for calculating the risk score is as follows: RiskScore=Σ(Wi×Si)×ContextMultiplier In the formula, Wi is the risk factor weight, Si is the risk factor score, and ContextMultiplier is the context influence coefficient; Risk factors include configuration conflict level, service impact level, security risk level, rollback capability, and timing appropriateness.
5. The network configuration change risk assessment method based on artificial intelligence according to claim 1, characterized in that, Risk levels are categorized as high, medium, and low.
6. A system for implementing the network configuration change risk assessment method based on artificial intelligence as described in any one of claims 1-5, characterized in that, include: The configuration input layer is used to receive target network device information, configuration commands, change service background, and time window. The context acquisition layer is used to collect network topology, current configuration, operating status, recent alarms and related security policies of target network devices and associated devices based on the target object. The intelligent assessment engine includes a command parser, a context fusion module, a risk identifier, and a report generator; The core of the large-scale artificial intelligence model is equipped with a domain knowledge base, a risk case base, an evaluation rule base, and a model inference engine; The user interaction layer is used to connect with the change application information and approval process interface, and provides a report display interface; The assessment results output layer is used to output risk assessment reports; The configuration input layer, context acquisition layer, core of the artificial intelligence big model, and user interaction layer are all connected to the intelligent evaluation engine, which in turn is connected to the evaluation result output layer.
7. The network configuration change risk assessment system based on artificial intelligence according to claim 6, characterized in that, The command parser is configured for multiple vendors; The multi-vendor configuration command parser consists of a vendor identification module, a model identification module, a command template library, a semantic extraction engine, and a standardized output interface. It is used to perform semantic extraction, parameter normalization, and dependency analysis on configuration commands for devices from different vendors.
8. The network configuration change risk assessment system based on artificial intelligence according to claim 6, characterized in that, The context acquisition layer is implemented through a context information acquisition interface; The context information collection interface supports integration with network management systems, configuration management databases, monitoring systems, IT service management platforms, and configuration backup systems.
9. The network configuration change risk assessment system based on artificial intelligence according to claim 6, characterized in that, The risk identifier calculates the risk score using the following formula: RiskScore=Σ(Wi×Si)×ContextMultiplier Where Wi is the risk factor weight, Si is the risk factor score, and ContextMultiplier is the context influence coefficient; Risk factors include configuration conflict level, service impact level, security risk level, rollback capability, and timing appropriateness.
10. The network configuration change risk assessment system based on artificial intelligence according to claim 6, characterized in that, The user interaction layer is also used to push manual review when the risk level is high, collect feedback and update the assessment results, and incorporate cases into the learning samples.