Method, system, electronic device and medium for network structural security analysis

Abstract

The present invention relates to the technical field of network security analysis, and discloses a method, system, electronic device and medium for network structural security analysis, including S1, converting relational data about network structure into network routing information; S2, preprocessing data of big data platform, then building a network analysis model based on network structure according to the network routing information, and training, evaluating, applying and optimizing the analysis model; S3, using decision tree algorithm, configuring the network analysis model to analyze the network structure layer by layer, and obtaining the network structural security analysis result. The present invention realizes intelligent detection, analysis and positioning of network structural security risks, so as to solve the problems that the existing technology cannot solve, such as early warning, prediction and positioning of hidden dangers in complex communication networks.

Description

Technical Field

[0001] The present invention relates to the technical field of network security analysis, and in particular to a method, system, electronic equipment and medium for network structural security analysis. Background Art

[0002] With the continuous development of cloud network services and 5G services, the complexity of communication network-borne services has gradually increased, and the security risks of network structures and the scope of impact of failures have also increased. The robustness and health of communication networks have become important indicators for judging network security. Dual routing has become the networking method for many important services, and dual routing or even triple routing has also become an important networking structure for some current communication core networks.

[0003] At present, although the network management system can monitor active networks in real time, it cannot provide early warning, prediction and location of network security risks. Passive networks such as optical cable networks cannot be effectively monitored by network management systems, and network security can only be tested through time-consuming and labor-intensive regular manual inspections.

[0004] In addition, due to objective factors such as the geographical environment and construction costs, the standardization of the constructed network structure is poor, and there is a lack of effective intelligent analysis methods for detecting and locating security risks in communication networks. This leads to greater security risks in communication networks, high network failure rates, slow diagnosis and elimination of security risks, and poor customer perception.

[0005] Existing technologies are unable to solve the early warning, prediction and location of security risks in complex communication networks. Therefore, how to solve the early warning, prediction and location of security risks in complex communication networks is an issue that urgently needs to be solved. Summary of the invention

[0006] The present invention provides a method, system, electronic device and medium for network structural security analysis. By generating network routes of a communication network, a network security analysis model is constructed, and the number of network routes, whether there are logical route overlaps (i.e., hidden dangers), and whether there are physical route overlaps are analyzed, thereby realizing intelligent detection, analysis and positioning of network structural security hidden dangers, so as to solve the problems of early warning, prediction and hidden danger positioning of complex communication networks that cannot be solved by existing technologies.

[0007] The present invention is achieved through the following technical solutions:

[0008] A method for network structural security analysis, comprising:

[0009] S1, converting relational data about network structure into network routing information;

[0010] S2. Preprocess the data on the big data platform, then build a network analysis model based on the network structure according to the network routing information, and train, evaluate, apply and optimize the network analysis model;

[0011] S3. Using a decision tree algorithm, the network structure is analyzed layer by layer and level by level by configuring the network analysis model to obtain a network structural security analysis result.

[0012] As an optimization, in S1, the network element data is used as a point and the relay data is used as a line, and a deep search algorithm is used to obtain the reachable network element information and reachable path information of the network structure, and the reachable path information and reachable network element information are stored through business logic, and finally the network routing information is generated. The specific steps are as follows:

[0013] S1.1. Extract data according to network type and network element type to obtain a network element set and a relay data set;

[0014] S1.2. Setting a path search start condition and a path search end condition, and searching all network elements in the network element set based on the path search start condition and the path search end condition to obtain reachable network element information of each network element;

[0015] S1.3, recursively query and search the network elements according to the depth search algorithm: traverse each reachable network element of the network structure along the depth of the network structure to obtain a reachable path for each network element and form reachable path information;

[0016] S1.4. All the reachable paths and reachable network elements are merged through business logic, and the reachable network elements corresponding to all the reachable paths are stored as network routing information.

[0017] As an optimization, the specific steps of S2 are:

[0018] S2.1. Extract, clean, standardize, classify data clusters, select variables, and convert data on the big data platform;

[0019] S2.2. Construct network element data table, board data table, port data table, relay data table, relay and transmission circuit relationship table, optical path and office fiber relationship table, office fiber and cable core relationship table, cable core information table, cable and pole relationship table, cable and pipeline relationship table, network element and network element data relationship table, network element port and relay relationship table, ring subnet and network element relationship table, relay and optical path data relationship table, relay and cable segment data relationship table, relay and pole data relationship table, relay and pipeline data relationship table, and network security risk type data table according to business needs;

[0020] S2.3. Construct a routing quantity analysis list table, a dual uplink same wavelength division analysis list table, an uplink and interconnection same board analysis list table, a dual uplink same routing analysis list table, an interconnection and uplink same routing analysis list table, and a transmission false ring analysis list table according to business needs;

[0021] S2.4, generating a network analysis model for analyzing network security based on the network structure according to the network routing information through an intelligent algorithm;

[0022] S2.5. Obtain a universal network analysis model by selecting, training, evaluating, applying and optimizing the network analysis model.

[0023] As an optimization, the network analysis model includes:

[0024] A route quantity analysis model is used to obtain route quantity information from a starting network element to a terminal network element;

[0025] The dual uplink same wavelength division analysis model is used to analyze whether the transmission circuits corresponding to the two relays of a certain network element or a pair of mutually primary and standby network elements including the network element uplink to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end and the associated transmission topology subnets overlap, so as to obtain the dual uplink same wavelength division information of the transmission circuits corresponding to the two relays;

[0026] The upstream and interconnection same board analysis model is used to analyze whether the ports of the upstream relay and the interconnection relay of the same network element belong to the same board, so as to obtain the information of the upstream and interconnection same board of the network element;

[0027] The dual uplink same-route analysis model is used to analyze whether the optical paths, associated optical cables, or associated electric poles and pipelines corresponding to two relays of a certain network element or a pair of mutually primary and standby network elements including the network element uplink to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end overlap, so as to obtain the information of the dual uplink same-route corresponding to the two relays;

[0028] The interconnection and upstream co-routing analysis model is used to analyze whether the optical paths corresponding to multiple relays, the associated optical cables or the associated poles and pipelines overlap, and to obtain the conclusion information of interconnection and upstream co-routing;

[0029] The transmission false ring analysis model is used to analyze whether the optical cables associated with the optical paths corresponding to multiple relays in the same transmission topology subnet overlap, so as to obtain the information of the transmission false ring.

[0030] As an optimization, the construction process of the routing quantity analysis model is as follows:

[0031] Match the local / opposite NE, port, and relay by NE IP or NE name, and then analyze the number of relays between two NEs step by step, and further draw conclusions on the number of routes from the starting NE to the ending NE;

[0032] The construction process of the dual uplink same wavelength division analysis model is as follows:

[0033] Through the network element IP or network element name, the local / opposite network element, port, and relay are matched, and the number of relays from the network element or a pair of mutually primary and standby network elements including the network element to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end is analyzed to be two; then the associated transmission circuit information is queried through the network element and relay information, and the transmission topology subnet information is associated through the transmission circuit information, and finally the transmission circuits corresponding to the two relays from the network element or a pair of mutually primary and standby network elements including the network element to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end are analyzed, and whether the associated transmission topology subnets overlap, and the conclusion information of dual upstream same wavelength division is obtained;

[0034] The construction process of the upstream and interconnection same-board analysis model is as follows:

[0035] Match the local / opposite network elements, ports, and relays through the network element IP or network element name, analyze the relays between a pair of mutually active and standby network elements including the network element, and the relays from the network element or a pair of mutually active and standby network elements including the network element to the same network element at the opposite end or a pair of mutually active and standby network elements at the opposite end; then query the network element board information associated with the relay through the network element, port, and relay information, analyze whether the ports of the upstream relay and the interconnected relay of the same network element belong to the same board, and draw the conclusion that the upstream and interconnected are on the same board;

[0036] The construction process of the dual uplink same-route analysis model is as follows:

[0037] Match the local / opposite network elements, ports, and relays through the network element IP or network element name, and analyze to obtain the number of relays from the network element or a pair of mutually primary and standby network elements including the network element to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end as two. Then, query the optical path information associated with the network element through the network element and relay information, and then associate the office optical fiber through the optical path, associate the fiber core through the office optical fiber, associate the optical cable through the fiber core, associate the electric pole through the optical cable, and obtain the pipeline associated with the optical cable through the relay and pipeline data relationship table. Finally, analyze whether the optical paths, associated optical cables, or associated electric poles and pipelines corresponding to the two relays from the network element or a pair of mutually primary and standby network elements including the network element to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end overlap, and obtain the conclusion information of dual upstream same route.

[0038] The construction process of the interconnection and upstream same-route analysis model is as follows:

[0039] Match the local / opposite network elements, ports, and relays through the network element IP or network element name, analyze the relays between a pair of mutually primary and standby network elements including the network element, and the relays from the network element or a pair of mutually primary and standby network elements including the network element to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end; then query the associated optical path information through the network element and relay information, and then associate the local optical fiber through the optical path, associate the fiber core through the local optical fiber, associate the optical cable through the fiber core, associate the electric pole through the optical cable, and obtain the pipeline associated with the optical cable through the relay and pipeline data relationship table; finally, analyze whether the optical paths, associated optical cables, or associated electric poles and pipelines corresponding to the above-mentioned multiple relays overlap, and obtain the conclusion information that the interconnection and the upstream have the same route;

[0040] The construction process of the transmission pseudo-loop analysis model is as follows:

[0041] Match the topological subnet, network element, and relay through the network element name or topological subnet identifier, analyze the relay data of the topological subnet, and then query the associated optical path information through the network element and relay information. Then, associate the local optical fiber with the optical path, associate the fiber core with the local optical fiber, and associate the optical cable with the fiber core. Finally, analyze whether the optical cables associated with the optical paths corresponding to multiple relays in the same transmission topological subnet overlap, and draw conclusions about transmission false rings.

[0042] As an optimization, based on the network security risk type data table, the degree of impact of network risks on network security is defined according to the network security risk type, and the scope of impact of network risks on network security is defined according to the number of businesses and business levels affected by network risks. In combination with the degree of impact and scope of impact, the matrix method is used to construct the network security risk level.

[0043] As an optimization, the specific process of S3 is:

[0044] The number of network routes in the network structure is analyzed through the route number analysis model. The specific process is as follows:

[0045] By extracting and cleaning the network data of the network structure from the big data platform, the data is standardized and normalized, and the network security analysis rules for the route quantity analysis model are configured based on the network security risk level. A decision tree algorithm is used to set the maximum tree depth level and combine the logistic regression method to recursively analyze each network element and each branch of the network route, save the analysis and output the conclusion information of the network route quantity;

[0046] The dual uplink same wavelength division analysis model and the uplink and interconnection same board analysis model are used to analyze whether the logical routes overlap. The specific process is as follows:

[0047] By extracting and cleaning the network data of the network structure from the big data platform, the data is standardized and normalized, and the network security analysis rules for the dual uplink same wavelength division analysis model and the uplink and interconnection same board card analysis model are configured based on the network security risk level, and a decision tree algorithm is used to set the maximum tree depth level and combine the logistic regression method to recursively analyze each network element and each branch of the network route, save the analysis and output the conclusion information of whether the network has dual uplink same wavelength division and whether the uplink and interconnection are on the same board card;

[0048] Whether the physical routes overlap is analyzed by using the dual uplink same-route analysis model, the interconnection and uplink same-route analysis model, and the transmission false-ring analysis model. The specific process is as follows:

[0049] The network data of the network structure is extracted and cleaned from the big data platform to achieve data standardization and normalization. The network security analysis rules for the dual upstream same-route analysis model, the interconnection and upstream same-route analysis model, and the transmission false ring analysis model are configured based on the network security risk level. A decision tree algorithm is used to set the maximum tree depth level and combine with the logistic regression method to perform recursive analysis on each network element and each branch of the network route. The analysis is saved and the conclusion information on whether the network has dual upstream same-route, whether the interconnection and upstream have the same route, and whether a transmission false ring is present is output.

[0050] The present invention also discloses a system for network structural security analysis, which implements the above-mentioned method for network structural security analysis, including:

[0051] A conversion module, used to convert relational data about the network structure into network routing information;

[0052] A model building module is used to pre-process the data of the big data platform, then build a network analysis model based on the network structure according to the network routing information, and train, evaluate, apply and optimize the network analysis model;

[0053] The analysis module is used to adopt a decision tree algorithm to analyze the network structure layer by layer and level by level by configuring the network analysis model to obtain a network structural security analysis result.

[0054] The present invention also discloses an electronic device, comprising at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a method for network structural security analysis as described above.

[0055] The present invention also discloses a storage medium storing a computer program, wherein the computer program implements the above-mentioned method for network structural security analysis when executed by a processor.

[0056] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0057] 1. The present invention converts the relational data of the big data platform into network routing information based on the deep search algorithm, takes the network element data as the point and the relay data as the line to obtain the reachable network element information and network routing information, and stores all the point-to-point information of the path through the business logic to achieve the purpose of generating network routing information;

[0058] 2. Based on the idea of ​​big data modeling, the present invention extracts, cleans, standardizes, classifies data clusters, selects variables, and converts data on the big data platform. It uses intelligent algorithms to build an analysis model based on the network structure according to network routing information, and trains, evaluates, applies, and optimizes the analysis model.

[0059] 3. The present invention is based on a decision tree algorithm and analyzes the network structure layer by layer through a configuration analysis model to obtain the results of the network structural security analysis, thereby realizing intelligent detection, analysis and positioning of network structural security risks, so as to solve the problems that the existing technology cannot solve, such as early warning, prediction and positioning of hidden dangers in complex communication networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can be obtained based on these drawings without creative work. In the drawings:

[0061] Figure 1 A flowchart of a method for network structural security analysis according to the present invention;

[0062] Figure 2 A flow chart of the deep search algorithm for generating network routing information;

[0063] Figure 3 It is the topology diagram of the uplink routing of the IPRAN network;

[0064] Figure 4 To construct a flow chart of the analysis model based on the network structure;

[0065] Figure 5 Analyze process flow chart for network security;

[0066] Figure 6 is a transmission circuit routing topology diagram;

[0067] Figure 7 The routing topology diagram for the transmission subnet. DETAILED DESCRIPTION

[0068] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary embodiments of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention.

[0069] Example 1

[0070] like Figure 1 As shown, a method for network structural security analysis includes:

[0071] S1. Convert the relational data of the network structure into network routing information. In this embodiment, Figure 2 As shown, with network element data as points and relay data as lines, a deep search algorithm is used to obtain the reachable network element information and reachable path information of the network structure, and the reachable path information and reachable network element information are stored through business logic, and finally network routing information is generated. The specific steps are as follows:

[0072] S1.1. Extract data according to network type and network element type to obtain a network element set and a relay data set;

[0073] S1.2. Setting a path search start condition and a path search end condition, and searching all network elements in the network element set based on the path search start condition and the path search end condition to obtain reachable network element information of each network element;

[0074] Specifically, the path search start condition is to start from the starting network element, search for the routing peer network element, and then search for the next reachable network element with the peer network element as the starting point, and repeat S1.2;

[0075] The path search termination condition is: according to the network level, it is set that when the search network level reaches level three, the search is terminated. S1.3, recursively query and search the network element according to the depth search algorithm: traverse each reachable network element of the network structure along the depth of the network structure to obtain the reachable path of each network element and form reachable path information;

[0076] For example, set the starting node S, that is, the starting network element S, and search for the reachable node N. When the edges where the node N is located have been searched or the node does not meet the conditions during the search (the condition refers to the network level where the network element node is located exceeds three levels, it is excluded. This condition is designed in the algorithm to improve the search efficiency. The parameters can be adjusted in the algorithm to adapt to the search requirements of different types of networks). The search will trace back to the starting node S of the edge where the node N was found, and search the branches (paths) of the network. Through recursive query search combined with pruning and other methods, the entire search process is repeated until all nodes are visited.

[0077] S1.4. Merge the path and branch search results, merge all the reachable paths and reachable network elements through business logic, and store the reachable network elements corresponding to all the reachable paths as network routing information.

[0078] Specifically, this embodiment analyzes the network structural security of the uplink routing of the IPRAN network, takes the B device of the IPRAN network as the demarcation point, and implements the analysis of the network structural security of the B-DER-MER. The uplink routing topology of the IPRAN network is as follows: Figure 3 shown.

[0079] According to the network type, network element data, board data, port data, and relay data of the IPRAN network are extracted from the big data platform for cleaning, processing, and standardization.

[0080] According to the set path search conditions and search termination conditions, exclude network elements and relays that do not participate in building network routes, and start searching for reachable paths from device B of the IPRAN network. First search the path of B-DER, then search the paths of B-MER, DER-MER, and BB, splice the Cartesian set path information of B-DER and B-MER, and return all routing information.

[0081] By optimizing IPRAN network elements and relay data, the number of edges involved in calculation is reduced, thereby reducing the number of edge parameters involved in deep search. The path and branch search results are merged, and all point-to-point information on the path is stored through business logic to save the IPRAN network uplink routing information: B-DER-MER.

[0082] The IPRAN network uplink routing data is shown in the following table:

[0083]

[0084]

[0085] S2, preprocessing the data of the big data platform, the data of the big data platform here is the relational data in S1. Then, a network analysis model based on the network structure is constructed according to the network routing information, and the network analysis model is trained, evaluated, applied and optimized; Figure 4 As shown, the specific steps of S2 are:

[0086] S2.1. Extract, clean, standardize, classify data clusters, select variables, and convert data on the big data platform;

[0087] S2.2. Construct network element data table, board data table, port data table, relay data table, relay and transmission circuit relationship table, optical path and office fiber relationship table, office fiber and cable core relationship table, cable core information table, cable and pole relationship table, cable and pipeline relationship table, network element and network element data relationship table, network element port and relay relationship table, ring subnet and network element relationship table, relay and optical path data relationship table, relay and cable segment data relationship table, relay and pole data relationship table, relay and pipeline data relationship table, and network security risk type data table according to business needs;

[0088] S2.3. Construct a routing quantity analysis list table, a dual uplink same wavelength division analysis list table, an uplink and interconnection same board analysis list table, a dual uplink same routing analysis list table, and an interconnection and uplink same routing analysis list table according to business needs;

[0089] S2.4, generating a network analysis model for analyzing network security based on the network structure according to the network routing information through an intelligent algorithm;

[0090] S2.5. Obtain a universal network analysis model by selecting, training, evaluating, applying and optimizing the network analysis model.

[0091] Specifically, Figure 2 As shown, constructing an analysis list table is the third step in establishing an analysis model. According to the data extracted through the big data platform in the first step, based on the network security risk type data table, the network security risk type is used to define the degree of impact of network risks on network security. The number of businesses and business levels affected by network risks are used to define the scope of impact of network risks on network security. Combining the degree of impact and the scope of impact, the matrix method is used to construct the network security risk level.

[0092] In this embodiment, the network analysis model includes:

[0093] A route quantity analysis model is used to obtain route quantity information from a starting network element to a terminal network element;

[0094] The dual uplink same wavelength division analysis model is used to analyze whether the transmission circuits corresponding to the two relays of a certain network element or a pair of mutually primary and standby network elements including the network element uplink to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end and the associated transmission topology subnets overlap, so as to obtain the dual uplink same wavelength division information of the transmission circuits corresponding to the two relays;

[0095] The upstream and interconnection same board analysis model is used to analyze whether the ports of the upstream relay and the interconnection relay of the same network element belong to the same board, so as to obtain the information of the upstream and interconnection same board of the network element;

[0096] The dual uplink same-route analysis model is used to analyze whether the optical paths, associated optical cables, or associated electric poles and pipelines corresponding to two relays of a certain network element or a pair of mutually primary and standby network elements including the network element uplink to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end overlap, so as to obtain the information of the dual uplink same-route corresponding to the two relays;

[0097] The interconnection and upstream co-routing analysis model is used to analyze whether the optical paths corresponding to multiple relays, the associated optical cables or the associated poles and pipelines overlap, and to obtain the conclusion information of interconnection and upstream co-routing;

[0098] Next, the construction process of the above analysis models is introduced.

[0099] The construction process of the routing quantity analysis model is as follows:

[0100] First, match the local / opposite NE, port, and relay by NE IP or NE name;

[0101] Through the IP address or name of the network element, query the network element or port of the local or remote end of the relay respectively, and obtain the number of relays in the network element and the number of relays between two network elements through the network element and relay relationship table.

[0102] Secondly, the number of relays between two network elements is analyzed step by step, and the conclusion information of the number of routes from the starting network element to the ending network element is obtained by splicing.

[0103] The routing quantity analysis list is shown in the following table:

[0104]

[0105]

[0106] The construction process of the dual uplink same wavelength division analysis model is as follows:

[0107] First, match the local / opposite network element, port, and relay by network element IP or network element name, and analyze that the number of relays from the network element or a pair of mutually active and standby network elements including the network element to the same network element at the opposite end or a pair of mutually active and standby network elements at the opposite end is two;

[0108] Secondly, query the associated transmission circuit information through network element and relay information, and then associate the transmission topology subnet information through the transmission circuit information;

[0109] Finally, the transmission circuits corresponding to the two relays are analyzed to see whether the associated transmission topology subnets overlap, and the conclusion information of dual uplink same wavelength division is obtained.

[0110] What is described here is mainly the relationship between the relay and the transmission circuit, which can be queried through the relay and transmission circuit relationship table, and the relationship between the network element or port and the relay can be queried through the network element port and relay relationship table.

[0111] The dual uplink same wavelength division analysis list is shown in the following table:

[0112]

[0113]

[0114] The construction process of the upstream and interconnection same-board analysis model is as follows:

[0115] First, match the local / opposite network elements, ports, and relays by network element IP or network element name, and analyze the relays between a pair of mutually active and standby network elements including the network element, as well as the relays from the network element or a pair of mutually active and standby network elements including the network element to the same network element at the opposite end or a pair of mutually active and standby network elements at the opposite end;

[0116] Secondly, query the network element board information associated with the relay through the network element, port, and relay information, analyze whether the ports of the upstream relay and the interconnection relay of the same network element belong to the same board, and draw the conclusion that the upstream and interconnection are on the same board.

[0117] Here we mainly describe how to query the board to which the port carrying the relay belongs through the relay. It involves multi-table query, and the input parameter can be network element, port or relay. The data tables used include: network element port and relay relationship table or network element and relay relationship table, network element table, board table, port table. The ID in a single table helps to associate data and build a data model.

[0118] The upstream and interconnection board analysis list is shown in the following table:

[0119]

[0120]

[0121] The construction process of the dual uplink same-route analysis model is as follows:

[0122] Match the local / opposite network elements, ports, and relays through the network element IP or network element name, and analyze to obtain the number of relays from the network element or a pair of mutually primary and standby network elements including the network element to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end as two. Then, query the optical path information associated with the network element through the network element and relay information, and then associate the office optical fiber through the optical path, associate the fiber core through the office optical fiber, associate the optical cable through the fiber core, associate the electric pole through the optical cable, and obtain the pipeline associated with the optical cable through the relay and pipeline data relationship table. Finally, analyze whether the optical paths, associated optical cables, or associated electric poles and pipelines corresponding to the two relays from the network element or a pair of mutually primary and standby network elements including the network element to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end overlap, and obtain the conclusion information of dual upstream same route.

[0123] First, match the local / opposite network element, port, and relay by network element IP or network element name, and analyze that the number of relays from the network element or a pair of mutually active and standby network elements including the network element to the same network element at the opposite end or a pair of mutually active and standby network elements at the opposite end is two;

[0124] Secondly, query the associated optical path information through network elements and relay information, then associate the local optical fiber through the optical path, associate the fiber core through the local optical fiber, associate the optical cable through the fiber core, associate the electric pole through the optical cable, and associate the pipeline through the optical cable;

[0125] The associated optical path information is queried through the network element and relay information, specifically through the network element port and relay relationship table, and the relay and optical path data relationship table. Of course, multi-table query is also involved here. The input parameter can be the network element or the relay, but the optical path information is obtained through the relay and optical path data relationship table. There is a unique identifier between the relay and the optical path to associate the two.

[0126] Finally, the optical paths corresponding to the two relays, the associated optical cables, or the associated poles and pipelines are analyzed to see if they overlap, and the conclusion information of the dual uplink same route is obtained.

[0127] The dual uplink same route analysis list is shown in the following table:

[0128]

[0129]

[0130] The construction process of the interconnection and upstream same-route analysis model is as follows:

[0131] First, match the local / opposite network elements, ports, and relays through the network element IP or network element name, and analyze the relays between a pair of mutually active and standby network elements including the network element, as well as the relays from the network element or a pair of mutually active and standby network elements including the network element to the same network element on the opposite end or a pair of mutually active and standby network elements on the opposite end.

[0132] Secondly, query the associated optical path information through network elements and relay information, then associate the local optical fiber through the optical path, associate the local optical fiber with the fiber core, associate the optical cable through the fiber core, associate the optical cable with the electric pole, and associate the optical cable with the pipeline. Specifically, the association can be made through the optical path and local optical fiber relationship table, the local optical fiber and optical cable core relationship table, the optical cable core information table, the optical cable and electric pole relationship table, and the optical cable and pipeline relationship table.

[0133] Finally, the optical paths corresponding to the above-mentioned multiple relays, the associated optical cables, or the associated poles and pipelines are analyzed to see whether they overlap, and the conclusion information is obtained that the interconnection and the upstream have the same route.

[0134] The interconnection and uplink routing analysis list is shown in the following table:

[0135]

[0136]

[0137] S3. Using a decision tree algorithm, the network structure is analyzed layer by layer and level by level by configuring the network analysis model to obtain a network structural security analysis result.

[0138] like Figure 5 As shown in the figure, the number of network routes in the network structure is analyzed through the route quantity analysis model. The specific process is as follows:

[0139] Step A. Extract data

[0140] By extracting and cleaning network data from the big data platform, data standardization and normalization can be achieved.

[0141] Step B. Configure the network security analysis model

[0142] Configuring network security analysis rules based on route quantity analysis models

[0143] Step C. Select an algorithm

[0144] Adopt decision tree algorithm, set the maximum tree depth level and combine logistic regression and other methods to recursively analyze each node and each branch of network routing and save the analysis results.

[0145] Step D. Conclusion

[0146] Output conclusion information about the number of network routes.

[0147] Specifically, the system specifies a network element of a device type B of the IPRAN network as an input parameter to obtain uplink routing data of the IPRAN network.

[0148] According to business requirements, configure a network analysis model for route quantity analysis, including a route quantity analysis model.

[0149] The IPRAN network routing that starts with the network element of device type B and ends with the network element of device type MER is analyzed. The decision tree algorithm is combined with logistic regression and other methods to analyze each node and each path of the IPRAN network uplink routing B-DER-MER layer by layer. First, the number of relays between B-DER, B-MER, DER-MER, and BB network elements is analyzed respectively, and then the number of routes between B-DER-MER is analyzed. Finally, the analysis conclusion of the number of relays and routes between network elements of the IPRAN network uplink routing B-DER-MER is obtained.

[0150] like Figure 5 As shown, the dual uplink same wavelength division analysis model and the uplink and interconnection same board analysis model are used to analyze whether the logical routes overlap. The specific process is as follows:

[0151] Step A. Extract data

[0152] By extracting and cleaning network data from the big data platform, data standardization and normalization can be achieved.

[0153] Step B. Configure the network security analysis model

[0154] Configure network security analysis rules based on the dual-uplink same-WDM analysis model and the upstream and interconnection same-board analysis model.

[0155] Step C. Select an algorithm

[0156] Adopt decision tree algorithm, set the maximum tree depth level and combine logistic regression and other methods to recursively analyze each node and each branch (path) of network routing and save the analysis results.

[0157] Step D. Conclusion

[0158] The output network has dual uplink with the same wavelength division, and whether the uplink and interconnection are on the same board.

[0159] Specifically, the network element, relay or circuit of the device type B of the IPRAN network is specified by the system as an input parameter to obtain the network element port, relay or circuit routing data of the IPRAN network.

[0160] According to business needs, configure the network analysis module based on whether there is overlap in logical routes, including: dual uplink same wavelength division analysis model, uplink and interconnection same board analysis model.

[0161] For IPRAN network, the decision tree algorithm combined with logistic regression and other methods are used in the dual uplink same wavelength division analysis model to analyze whether the number of relays between B pair and DER pair, and between DER pair and MER pair is two. Analyze whether there are two IPRAN network routes starting from the network element with device type B and ending with the network element with device type MER.

[0162] In the dual uplink same wavelength division analysis process, the associated optical path information is queried through the IPRAN network element and IPRAN relay information, the associated transmission relay information is queried through the optical path information, and then the transmission wavelength division topology subnet information is associated with the transmission relay information.

[0163] Analyze the two relays between the B pair and the DER pair, and the two relays between the DER pair and the MER pair, and check whether the associated transmission wavelength division topology subnets overlap, and obtain the analysis conclusion that the dual upstream has the same wavelength division.

[0164] The associated optical path information is queried through the IPRAN circuit and IPRAN relay information, the associated transmission circuit information is queried through the optical path information, and then the transmission wavelength division topology subnet information is associated with the transmission circuit information.

[0165] Analyze the two IPRAN network routes starting from the network element with device type B and ending at the network element with device type MER to see whether the associated transmission wavelength division topology subnets overlap and obtain the analysis conclusion that dual uplinks have the same wavelength division.

[0166] The uplink and interconnection same-board analysis process, for the IPRAN network, the uplink and interconnection same-board analysis model uses a decision tree algorithm combined with logistic regression and other methods to analyze B-DER relays and BB relays.

[0167] Through the network element, port, and relay information, query the network element board information associated with the relay, analyze the B1-DER relay and the B1-B2 relay, and check whether the port information of network element B1 overlaps in the same board of network element B1, and obtain the analysis conclusion of the upstream and interconnection boards.

[0168] like Figure 5 As shown, the dual uplink same-route analysis model and the interconnection and uplink same-route analysis model are used to analyze whether the physical routes overlap. The specific process is as follows:

[0169] Step A. Extract data

[0170] By extracting and cleaning network data from the big data platform, data standardization and normalization can be achieved.

[0171] Step B. Configure the network security analysis model

[0172] Configure network security analysis rules based on the dual upstream same-route analysis model and the interconnection and upstream same-route analysis model.

[0173] Step C. Select an algorithm

[0174] Adopt decision tree algorithm, set the maximum tree depth level and combine logistic regression and other methods to recursively analyze each node and each branch of network routing and save the analysis results.

[0175] Step D. Conclusion

[0176] Output the conclusion information of whether the dual uplinks of the network have the same routing, whether they are interconnected and have the same uplink routing.

[0177] Specifically, the network element, relay or circuit of the device type B of the IPRAN network is specified by the system as an input parameter to obtain the network element port, relay or circuit routing data of the IPRAN network.

[0178] Based on business needs, configure a network analysis model based on whether physical routes overlap, including: dual uplink same-route analysis model, interconnection and uplink same-route analysis model.

[0179] In the dual uplink same-route analysis process, for the IPRAN network, the dual uplink same-route analysis model uses a decision tree algorithm combined with logistic regression and other methods to analyze whether the number of relays between B and DER, between B pairs and DER pairs, and between DER pairs and MER pairs is two. Analyze whether there are two IPRAN network routes starting with the network element of device type B and ending with the network element of device type MER.

[0180] The associated optical path information is queried through IPRAN network elements and IPRAN relay information, and then the local optical fiber is associated with the fiber core through the local optical fiber, the fiber core is associated with the optical cable, the optical cable is associated with the pole, and the optical cable is associated with the pipeline.

[0181] Analyze the two relays between the B pair and the DER pair, and the two relays between the DER pair and the MER pair, and determine whether the associated optical cables are the same cable, the same pole, or the same pipeline. Further analyze whether the routes passed by the relays overlap, and obtain the analysis conclusion that the dual uplinks have the same route.

[0182] Analyze the two IPRAN network routes starting from the network element with equipment type B and ending with the network element with equipment type MER, whether the associated optical cables are the same cable, the same pole, and the same pipeline, and further analyze whether the B-MER routes overlap, and obtain the analysis conclusion of the same route for both uplinks.

[0183] The interconnection and upstream co-routing analysis process, for the IPRAN network, the interconnection and upstream co-routing analysis model uses a decision tree algorithm combined with logistic regression and other methods to analyze B-DER relays and BB relays.

[0184] The associated optical path information is queried through IPRAN network elements and IPRAN relay information, and then the local optical fiber is associated with the fiber core through the local optical fiber, the fiber core is associated with the optical cable, the optical cable is associated with the pole, and the optical cable is associated with the pipeline.

[0185] Analyze whether the optical cables associated with the B-DER relay and the BB relay are the same cable, the same pole, or the same pipeline. Further analyze whether the routes passed by the relays overlap, and obtain the analytical conclusion that the interconnection and the upstream have the same route.

[0186] Example 2

[0187] This embodiment 2 is based on the network security analysis model of embodiment 1, and further illustrates the present invention by taking transmission circuit routing and transmission subnet routing as analysis objects. By adjusting some modeling parameters, the same network security analysis model is used for different networks and different business scenarios, and the analysis results are obtained by configuring the model using a decision tree algorithm, thereby proving the versatility of the network security analysis model constructed by the present invention.

[0188] The analysis of Example 2 includes generating network routing information, building an analysis model based on network structure, and a network structural security analysis decision tree algorithm, as follows:

[0189] like Figure 1 As shown, generating network routing information includes the following steps:

[0190] S1.1. Extract data according to network type and network element type to obtain a network element set and a relay data set;

[0191] S1.2. Setting a path search start condition and a path search end condition, and searching all network elements in the network element set based on the path search start condition and the path search end condition to obtain reachable network element information of each network element;

[0192] Specifically, the path search start condition is to start from the starting network element, search for the routing peer network element, and then search for the next reachable network element with the peer network element as the starting point, and repeat S1.2;

[0193] The path search termination condition is: according to the network level, it is set to terminate the search when the search network level reaches level three.

[0194] S1.3, recursively query and search the network elements according to the depth search algorithm: traverse each reachable network element of the network structure along the depth of the network structure to obtain a reachable path for each network element and form reachable path information;

[0195] For example, set the starting node S, that is, the starting network element S, and search for the reachable node N. When the edges where the node N is located have been searched or the node does not meet the conditions during the search, the search will backtrack to the starting node S of the edge where the node N was found, and search the branches of the network. Through recursive query search combined with pruning and other methods, the entire search process is repeated until all nodes are visited.

[0196] S1.4. Merge the path and branch search results, merge all the reachable paths and reachable network elements through business logic, and store the reachable network elements corresponding to all the reachable paths as network routing information.

[0197] Specifically, according to the network type, the transmission circuit name, transmission network metadata, transmission relay data, and transmission subnet data are extracted from the big data platform, and the data is cleaned to achieve data standardization and normalization.

[0198] Transmission circuit routing, according to the set path search conditions and search termination conditions, excludes network elements and relays that do not participate in building network routes, and starts searching for reachable paths from the transmission network element at the source end of the transmission circuit.

[0199] First, search for the path on the transmission branch, then search for the path on the transmission ring network, obtain the opposite network element, and then use the opposite transmission network element as the starting point to search for the next reachable transmission network element.

[0200] When the search level is set to be greater than three, the search is terminated. Combined with pruning and other methods, the parameters of the participating edges in the deep search are reduced, the search efficiency of the route is improved, and the amount of invalid route data is reduced. The path and branch search results are merged, and all the point-to-point information of the path is stored through business logic to save the transmission circuit routing information.

[0201] Transmission subnet routing, based on the set path search conditions and search termination conditions, excludes network elements and relays that do not participate in building network routing.

[0202] According to the transmission subnet identifier, search for a reachable path starting from the transmission network element within the transmission subnet. Search for the peer network element of the transmission route, and then search for the next reachable transmission network element starting from the peer transmission network element, and repeat the above steps. According to the setting, the search level is greater than ten levels or the search is a ring node, the search is terminated.

[0203] Combined with pruning and other methods, the parameters of the participating edges in the deep search are reduced, the search efficiency of the route is improved, and the amount of invalid route data is reduced. The path and branch search results are merged, and all the point-to-point information of the path is stored through business logic to save the transmission subnet routing information.

[0204] The data for transmission circuit routing is shown in the following table:

[0205]

[0206]

[0207] The transmission subnet routing data is shown in the following table:

[0208]

[0209] Transmission circuit routing topology such as Figure 6 As shown; the transmission subnet routing topology is as follows Figure 7 shown.

[0210] S2, preprocessing the data of the big data platform, then building an analysis model based on the network structure according to the network routing information, and training, evaluating, applying and optimizing the analysis model; Figure 4 As shown, the specific steps of S2 are:

[0211] S2.1. Extract, clean, standardize, classify data clusters, select variables, and convert data on the big data platform;

[0212] S2.2. Construct network element data table, board data table, port data table, relay data table, relay and transmission circuit relationship table, optical path and office fiber relationship table, office fiber and cable core relationship table, cable core information table, cable and pole relationship table, cable and pipeline relationship table, network element and network element data relationship table, network element port and relay relationship table, ring subnet and network element relationship table, relay and optical path data relationship table, relay and cable segment data relationship table, relay and pole data relationship table, relay and pipeline data relationship table, and network security risk type data table according to business needs;

[0213] S2.3. Construct a routing quantity analysis list table, an upstream and interconnection same board analysis list table, a dual upstream same routing analysis list table, and a transmission false ring analysis list table according to business needs;

[0214] S2.4, generating a network analysis model for analyzing network security based on the network structure according to the network routing information through an intelligent algorithm;

[0215] S2.5. Obtain a universal network analysis model by selecting, training, evaluating, applying and optimizing the network analysis model.

[0216] Specifically, Figure 2 As shown, constructing an analysis list table is the third step in establishing an analysis model. According to the data extracted through the big data platform in the first step, based on the network security risk type data table, the network security risk type is used to define the degree of impact of network risks on network security. The number of businesses and business levels affected by network risks are used to define the scope of impact of network risks on network security. Combining the degree of impact and the scope of impact, the matrix method is used to construct the network security risk level.

[0217] Since the network security analysis model in the present invention has the characteristics of universality, the analysis results of business requirements can be obtained by configuring the same network analysis model for different networks and different business scenarios. The details are as follows:

[0218] In this embodiment, the network analysis model includes:

[0219] A route quantity analysis model is used to obtain route quantity information of a transmission circuit from a source network element to a sink network element;

[0220] The upstream and interconnection same board analysis model is used to analyze whether the ports of the upstream relay and the interconnection relay of the same network element belong to the same board, so as to obtain the information of the upstream and interconnection same board of the network element;

[0221] The dual uplink same-route analysis model is used to analyze whether the optical paths, associated optical cables, or associated electric poles and pipelines corresponding to two relays of a certain network element or a pair of mutually primary and standby network elements including the network element uplink to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end overlap, so as to obtain the information of the dual uplink same-route corresponding to the two relays;

[0222] The transmission false ring analysis model is used to analyze whether the optical cables associated with the optical paths corresponding to multiple relays in the same transmission topology subnet overlap, so as to obtain the information of the transmission false ring.

[0223] Next, the construction process of the above analysis models is introduced.

[0224] The process of constructing the route quantity analysis model is as follows:

[0225] First, the source or sink network element of the circuit route is matched by the circuit name and the network element name;

[0226] Secondly, through deep search algorithms and intelligent algorithms, we search for transmission network routes starting from the source network element and ending at the sink network element, analyze the number of routes, distinguish between working routes and protection routes, and draw conclusions about the number of routes from the source network element to the sink network element of the transmission circuit.

[0227] The routing quantity analysis list is as follows:

[0228] A-side network element ID A-side network element name A-side network element type Z-side network element ID Z-side NE name Z-side network element type Relay ID Trunk Name Relay bandwidth Hidden danger type Hazard level

[0229] The process of constructing the upstream and interconnection same-board analysis model is as follows:

[0230] First, match the local / opposite network elements, ports, and relays by network element name, and analyze the relays between a pair of mutually active and standby network elements including the network element, as well as the relays from the network element or a pair of mutually active and standby network elements including the network element to the same network element on the opposite end or a pair of mutually active and standby network elements on the opposite end.

[0231] Secondly, query the network element board information associated with the relay through the network element, port, and relay information, analyze whether the ports of the upstream relay and the interconnection relay of the same network element belong to the same board, and draw the conclusion that the upstream and interconnection are on the same board.

[0232] Uplink and interconnection board analysis list

[0233]

[0234]

[0235] The process of constructing the dual uplink same-route analysis model is as follows:

[0236] First, match the local / opposite network elements, ports, and relays by network element name, and analyze that the number of relays from the network element or a pair of mutually active and standby network elements including the network element to the same network element at the opposite end or a pair of mutually active and standby network elements at the opposite end is two.

[0237] Secondly, the associated optical path information is queried through network elements and relay information, and then the local optical fiber is associated with the optical path, the local optical fiber is associated with the fiber core, the fiber core is associated with the optical cable, the optical cable is associated with the pole, and the optical cable is associated with the pipeline.

[0238] Finally, the optical paths corresponding to the two relays, the associated optical cables, or the associated poles and pipelines are analyzed to see if they overlap, and the conclusion information of the dual uplink same route is obtained.

[0239] The dual uplink same route analysis list is as follows:

[0240]

[0241]

[0242] The transmission pseudo-loop analysis model process is as follows:

[0243] First, the topology subnet, the network element, and the relay are matched by the network element name or the topology subnet identifier, and the relay data of the topology subnet is analyzed.

[0244] Secondly, the associated optical path information is queried through the network element and relay information, and then the local optical fiber is associated with the local optical fiber, the fiber core is associated with the optical cable through the fiber core.

[0245] Finally, it is analyzed whether the optical cables associated with the optical paths corresponding to multiple relays in the same transmission topology subnet overlap, and the conclusion information of the transmission false ring is obtained.

[0246] Transmission False Ring Analysis List

[0247]

[0248]

[0249] like Figure 5 As shown, the analysis of the number of network routes includes the following steps:

[0250] Step A. Extract data

[0251] By extracting and cleaning network data from the big data platform, data standardization and normalization can be achieved.

[0252] Step B. Configure the network security analysis model

[0253] Configuring network security analysis rules based on route quantity analysis models

[0254] Step C. Select an algorithm

[0255] Adopt decision tree algorithm, set the maximum tree depth level and combine logistic regression and other methods to recursively analyze each node and each branch of network routing and save the analysis results.

[0256] Step D. Conclusion

[0257] Output conclusion information about the number of network routes.

[0258] Specifically, the transmission circuit name is specified by the system as an input parameter to obtain the transmission circuit routing data.

[0259] According to business needs, configure a network analysis model for route quantity analysis, including: route quantity analysis model.

[0260] The transmission network routing with the source transmission network element as the starting point and the destination transmission network element as the end point is analyzed. The decision tree algorithm combined with logistic regression and other methods are used to analyze each node and each path of the transmission circuit routing level by level. First, it is analyzed whether there is a working route for the transmission circuit, and then it is analyzed whether there is a protection route for the transmission circuit. Finally, the analysis conclusion of the number of transmission circuit routes is obtained.

[0261] like Figure 5 As shown, the analysis of whether there is overlap in logical routes includes the following steps:

[0262] Step A. Extract data

[0263] By extracting and cleaning network data from the big data platform, data standardization and normalization can be achieved.

[0264] Step B. Configure the network security analysis model

[0265] Configure network security analysis rules based on the upstream and interconnection same-board analysis model.

[0266] Step C. Select an algorithm

[0267] Adopt decision tree algorithm, set the maximum tree depth level and combine logistic regression and other methods to recursively analyze each node and each branch of network routing and save the analysis results.

[0268] Step D. Conclusion

[0269] Output the conclusion information of whether the network is upstream and interconnected with the same board.

[0270] Specifically, the transmission circuit name is used as an input parameter to obtain the working route and protection route data of the transmission circuit.

[0271] Based on business needs, configure a network analysis model based on whether logical routes overlap, including upstream and interconnection same-board analysis models.

[0272] The uplink and interconnection same board analysis model adopts decision tree algorithm combined with logistic regression and other methods to analyze the working route and protection route of the transmission circuit. According to the transmission circuit, network element, port, and relay information, the network element board information associated with the relay is queried. The working route of the transmission circuit and the protection route of the transmission circuit are analyzed to see whether there is overlap in the same board of the same transmission network element, and the analysis conclusion of the uplink and interconnection same board is obtained.

[0273] like Figure 5 As shown, the analysis of whether there is overlap in physical routes includes the following steps:

[0274] Step A. Extract data

[0275] By extracting and cleaning network data from the big data platform, data standardization and normalization can be achieved.

[0276] Step B. Configure the network security analysis model

[0277] Configure network security analysis rules based on the dual uplink same-route analysis model and the transmission false loop analysis model.

[0278] Step C. Select an algorithm

[0279] Adopt decision tree algorithm, set the maximum tree depth level and combine logistic regression and other methods to recursively analyze each node and each branch of network routing and save the analysis results.

[0280] Step D. Conclusion

[0281] The output network has dual uplinks with the same route and whether a false ring is transmitted.

[0282] Specifically, the transmission circuit name is used as an input parameter to obtain the working route and protection route data of the transmission circuit.

[0283] Based on business needs, configure a network analysis model based on whether physical routes overlap, including: dual uplink same-route analysis model, transmission false ring analysis model.

[0284] In the dual uplink same-route analysis process, the relay information associated with the working route and protection route of the transmission circuit is queried through the transmission circuit, network element, port, and relay information, and then the optical path information is associated with the relay information, and then the optical path information is associated with the local optical fiber, the local optical fiber is associated with the fiber core, the fiber core is associated with the optical cable, the optical cable is associated with the pole, and the optical cable is associated with the pipeline.

[0285] Obtain the optical cable, pole, and pipeline information associated with the working route of the transmission circuit.

[0286] Obtain the optical cable, pole, and pipeline information associated with the protection route of the transmission circuit.

[0287] Analyze whether the optical cables associated with the working route and protection route of the transmission circuit are the same cable, the same pole, or the same pipeline. Further analyze whether the physical routes of the working route and protection route of the transmission circuit overlap, and obtain the analysis conclusion of the same route for dual uplinks.

[0288] The transmission false ring analysis process uses the transmission circuit name as an input parameter to obtain the transmission subnet information through which the working route and protection route data of the transmission circuit pass.

[0289] According to the transmission network element name and topology subnet identifier, the transmission topology subnet, network element, and relay are matched, and the relay data of the topology subnet is analyzed.

[0290] The associated optical path information is queried through the transmission network element and transmission relay information, and then the local optical fiber is associated with the local optical fiber, the fiber core is associated with the optical cable information through the fiber core.

[0291] Analyze whether the optical cables associated with the optical paths corresponding to multiple transmission relays in the same transmission topology subnet overlap, and obtain conclusion information on transmission false rings.

[0292] The overlap in the present invention, that is, hidden dangers, because the faults in the analysis results may not be explicit yet, the network structural security analysis method provided by the present invention can realize intelligent analysis of communication network security hidden danger detection and hidden danger location, and realize early warning, prediction and location of network security hidden dangers, wherein hidden danger location is reflected in that the system presents the hidden danger point information in the security analysis results in the network route constructed by data. For example, if the hidden danger type is the same board card, the analysis results will contain information such as network elements, boards, ports, relays, hidden danger types, hidden danger points, etc. Through the above analysis results, it can be known which relays in the inspected network and which board card of which network element have overlapping hidden danger information. If the board card fails, these relays and the network elements and services associated with these relays will be affected. By superimposing the hidden danger analysis results on the logical network topology diagram and the physical network topology diagram of the network by the system, the network elements and service scope affected by the hidden danger can be intuitively presented, as well as whether the networking structure of the inspected network meets the standard specifications, etc., which provides an effective means for network troubleshooting and network optimization. The above-mentioned hidden danger location capability is also one of the values ​​of this patent;

[0293] The prediction effect is reflected in the following aspects through the calculation results of the analysis model: (1) The potential fault points of the inspected network are found before the network fault occurs, and the analysis results can be used to guide troubleshooting; (2) The equipment information and irregular networking information that are prone to cause faults are obtained through model analysis, which can guide network optimization; (3) The fault impact range and business information are obtained in advance through the analysis model. The analysis results provide data basis for network hidden danger warning and data support for locating hidden danger points.

[0294] Example 3

[0295] The present invention also discloses a system for network structural security analysis, which implements the methods of Embodiment 1 and Embodiment 2, including:

[0296] A conversion module, used to convert relational data about the network structure into network routing information;

[0297] A model building module is used to pre-process the data of the big data platform, then build a network analysis model based on the network structure according to the network routing information, and train, evaluate, apply and optimize the network analysis model;

[0298] The analysis module is used to adopt a decision tree algorithm to analyze the network structure layer by layer and level by level by configuring the network analysis model to obtain a network structural security analysis result.

[0299] Example 4

[0300] The present invention also discloses an electronic device, comprising at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute methods such as those of Examples 1 and 2.

[0301] Example 5

[0302] The present invention also discloses a storage medium storing a computer program, wherein the computer program implements the methods of Embodiment 1 and Embodiment 2 when executed by a processor.

[0303] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for network structural security analysis, characterized in that: include: S1, converting relational data about network structure into network routing information; S2. Preprocess the data on the big data platform, then build a network analysis model based on the network structure according to the network routing information, and train, evaluate, apply and optimize the network analysis model; The specific steps of S2 are: S2.

1. Extract, clean, standardize, classify data clusters, select variables, and convert data on the big data platform; S2.

2. Construct network element data table, board data table, port data table, relay data table, relay and transmission circuit relationship table, optical path and office fiber relationship table, office fiber and cable core relationship table, cable core information table, cable and pole relationship table, cable and pipeline relationship table, network element and network element data relationship table, network element port and relay relationship table, ring subnet and network element relationship table, relay and optical path data relationship table, relay and cable segment data relationship table, relay and pole data relationship table, relay and pipeline data relationship table, and network security risk type data table according to business needs; S2.

3. Construct a routing quantity analysis list table, a dual uplink same wavelength division analysis list table, an uplink and interconnection same board analysis list table, a dual uplink same routing analysis list table, an interconnection and uplink same routing analysis list table, and a transmission false ring analysis list table according to business needs; S2.4, generating a network analysis model for analyzing network security based on the network structure according to the network routing information through an intelligent algorithm; The network analysis model includes: A route quantity analysis model is used to obtain route quantity information from a starting network element to a terminal network element; The dual uplink same wavelength division analysis model is used to analyze whether the transmission circuits corresponding to the two relays of a certain network element or a pair of mutually primary and standby network elements including the network element uplink to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end and the associated transmission topology subnets overlap, so as to obtain the dual uplink same wavelength division information of the transmission circuits corresponding to the two relays; The upstream and interconnection same board analysis model is used to analyze whether the ports of the upstream relay and the interconnection relay of the same network element belong to the same board, so as to obtain the information of the upstream and interconnection same board of the network element; The dual uplink same-route analysis model is used to analyze whether the optical paths, associated optical cables, or associated electric poles and pipelines corresponding to two relays of a certain network element or a pair of mutually primary and standby network elements including the network element uplink to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end overlap, so as to obtain the information of the dual uplink same-route corresponding to the two relays; The interconnection and upstream co-routing analysis model is used to analyze whether the optical paths corresponding to multiple relays, the associated optical cables or the associated poles and pipelines overlap, and to obtain the conclusion information of interconnection and upstream co-routing; The transmission false ring analysis model is used to analyze whether the optical cables associated with the optical paths corresponding to multiple relays in the same transmission topology subnet overlap, so as to obtain the information of the transmission false ring; S2.

5. Obtain a universal network analysis model by selecting, training, evaluating, applying and optimizing the network analysis model; S3. Using a decision tree algorithm, the network structure is analyzed layer by layer and level by level by configuring the network analysis model to obtain a network structural security analysis result.

2. A method for network structural security analysis according to claim 1, characterized in that: In S1, the network element data is used as a point and the relay data is used as a line. A deep search algorithm is used to obtain the reachable network element information and reachable path information of the network structure, and the reachable path information and reachable network element information are stored through business logic, and finally the network routing information is generated. The specific steps are as follows: S1.

1. Extract data according to network type and network element type to obtain a network element set and a relay data set; S1.

2. Setting a path search start condition and a path search end condition, and searching all network elements in the network element set based on the path search start condition and the path search end condition to obtain reachable network element information of each network element; S1.3, recursively query and search the network elements according to the depth search algorithm: traverse each reachable network element of the network structure along the depth of the network structure to obtain a reachable path for each network element and form reachable path information; S1.

4. All the reachable paths and reachable network elements are merged through business logic, and the reachable network elements corresponding to all the reachable paths are stored as network routing information.

3. A method for network structural security analysis according to claim 1, characterized in that: The construction process of the routing quantity analysis model is as follows: Match the local / opposite NE, port, and relay by NE IP or NE name, and then analyze the number of relays between two NEs step by step, and further draw conclusions on the number of routes from the starting NE to the ending NE; The construction process of the dual uplink same wavelength division analysis model is as follows: Through the network element IP or network element name, the local / opposite network element, port, and relay are matched, and the number of relays from the network element or a pair of mutually primary and standby network elements including the network element to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end is analyzed to be two; then the associated transmission circuit information is queried through the network element and relay information, and the transmission topology subnet information is associated through the transmission circuit information, and finally the transmission circuits corresponding to the two relays from the network element or a pair of mutually primary and standby network elements including the network element to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end are analyzed, and whether the associated transmission topology subnets overlap, and the conclusion information of dual upstream same wavelength division is obtained; The construction process of the upstream and interconnection same-board analysis model is as follows: Match the local / opposite network elements, ports, and relays through the network element IP or network element name, analyze the relays between a pair of mutually active and standby network elements including the network element, and the relays from the network element or a pair of mutually active and standby network elements including the network element to the same network element at the opposite end or a pair of mutually active and standby network elements at the opposite end; then query the network element board information associated with the relay through the network element, port, and relay information, analyze whether the ports of the upstream relay and the interconnected relay of the same network element belong to the same board, and draw the conclusion that the upstream and interconnected are on the same board; The construction process of the dual uplink same-route analysis model is as follows: Match the local / opposite network elements, ports, and relays through the network element IP or network element name, and analyze to obtain the number of relays from the network element or a pair of mutually primary and standby network elements including the network element to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end as two. Then, query the optical path information associated with the network element through the network element and relay information, and then associate the office optical fiber through the optical path, associate the fiber core through the office optical fiber, associate the optical cable through the fiber core, associate the electric pole through the optical cable, and obtain the pipeline associated with the optical cable through the relay and pipeline data relationship table. Finally, analyze whether the optical paths, associated optical cables, or associated electric poles and pipelines corresponding to the two relays from the network element or a pair of mutually primary and standby network elements including the network element to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end overlap, and obtain the conclusion information of dual upstream same route. The construction process of the interconnection and upstream same-route analysis model is as follows: Match the local / opposite network elements, ports, and relays through the network element IP or network element name, analyze the relays between a pair of mutually primary and standby network elements including the network element, and the relays from the network element or a pair of mutually primary and standby network elements including the network element to the same network element at the opposite end or a pair of mutually primary and standby network elements at the opposite end; then query the associated optical path information through the network element and relay information, and then associate the local optical fiber through the optical path, associate the fiber core through the local optical fiber, associate the optical cable through the fiber core, associate the electric pole through the optical cable, and obtain the pipeline associated with the optical cable through the relay and pipeline data relationship table; finally, analyze whether the optical paths, associated optical cables, or associated electric poles and pipelines corresponding to the above-mentioned multiple relays overlap, and obtain the conclusion information that the interconnection and the upstream have the same route; The construction process of the transmission pseudo-loop analysis model is as follows: Match the topological subnet, network element, and relay through the network element name or topological subnet identifier, analyze the relay data of the topological subnet, and then query the associated optical path information through the network element and relay information. Then, associate the local optical fiber with the optical path, associate the fiber core with the local optical fiber, and associate the optical cable with the fiber core. Finally, analyze whether the optical cables associated with the optical paths corresponding to multiple relays in the same transmission topological subnet overlap, and draw conclusions about transmission false rings.

4. A method for network structural security analysis according to claim 3, characterized in that: Based on the network security risk type data table, the degree of impact of network risks on network security is defined according to the network security risk type, and the scope of impact of network risks on network security is defined according to the number of businesses and business levels affected by network risks. In combination with the degree of impact and the scope of impact, the matrix method is used to construct the network security risk level.

5. A method for network structural security analysis according to claim 4, characterized in that: The specific process of S3 is: The number of network routes in the network structure is analyzed through the route number analysis model. The specific process is as follows: By extracting and cleaning the network data of the network structure from the big data platform, the data is standardized and normalized, and the network security analysis rules for the route quantity analysis model are configured based on the network security risk level. A decision tree algorithm is used to set the maximum tree depth level and combine the logistic regression method to recursively analyze each network element and each branch of the network route, save the analysis and output the conclusion information of the network route quantity; The dual uplink same wavelength division analysis model and the uplink and interconnection same board analysis model are used to analyze whether the logical routes overlap. The specific process is as follows: By extracting and cleaning the network data of the network structure from the big data platform, the data is standardized and normalized, and the network security analysis rules for the dual uplink same wavelength division analysis model and the uplink and interconnection same board card analysis model are configured based on the network security risk level, and a decision tree algorithm is used to set the maximum tree depth level and combine the logistic regression method to recursively analyze each network element and each branch of the network route, save the analysis and output the conclusion information of whether the network has dual uplink same wavelength division and whether the uplink and interconnection are on the same board card; Whether the physical routes overlap is analyzed by using the dual uplink same-route analysis model, the interconnection and uplink same-route analysis model, and the transmission false-ring analysis model. The specific process is as follows: The network data of the network structure is extracted and cleaned from the big data platform to achieve data standardization and normalization. The network security analysis rules for the dual upstream same-route analysis model, the interconnection and upstream same-route analysis model, and the transmission false ring analysis model are configured based on the network security risk level. A decision tree algorithm is used to set the maximum tree depth level and combine with the logistic regression method to perform recursive analysis on each network element and each branch of the network route. The analysis is saved and the conclusion information on whether the network has dual upstream same-route, whether the interconnection and upstream have the same route, and whether a transmission false ring is present is output.

6. A system for network structural security analysis, which implements a method for network structural security analysis as described in any one of claims 1 to 5, characterized in that: include: A conversion module, used to convert relational data about the network structure into network routing information; A model building module is used to pre-process the data of the big data platform, then build a network analysis model based on the network structure according to the network routing information, and train, evaluate, apply and optimize the network analysis model; The analysis module is used to adopt a decision tree algorithm to analyze the network structure layer by layer and level by level by configuring the network analysis model to obtain a network structural security analysis result.

7. An electronic device, characterized in that: It includes at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a method for network structural security analysis as described in any one of claims 1 to 5.

8. A storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, a method for network structural security analysis according to any one of claims 1 to 5 is implemented.

Images