An intelligent network integrated optimization system

Abstract

The present invention relates to the field of network optimization technology, specifically to an intelligent network integrated optimization system, the system includes a traffic analysis module, an anomaly identification module, a response strategy definition module, a network parameter adjustment module, a topology prediction module, a topology optimization execution module, a path selection optimization module, and a monitoring and adjustment module; the traffic analysis module performs data cleaning based on network traffic data and removes irrelevant data packets. The present invention, by utilizing the combination of a deep Q network with a decision tree and a rule engine, the system can analyze network traffic in real time, identify abnormal fluctuations that are inconsistent with historical trends, and automatically mark them as potential security threats. The intelligent analysis and response mechanism is used to significantly enhance the security protection capability of the network. At the same time, by dynamically adjusting the network configuration, the efficient use of network resources is ensured, which not only improves the efficiency of data transmission, but also reduces network delays, thereby effectively improving the processing capability and security of the network environment.

Description

Technical Field

[0001] The present invention relates to the technical field of network optimization, and in particular to an intelligent network integrated optimization system. Background Art

[0002] The field of network optimization technology focuses on improving network performance through various algorithms and methods, including improving data transmission efficiency, reducing network latency, optimizing resource allocation, enhancing network security, and improving network scalability. Network optimization technology covers multiple levels from hardware adjustment at the physical level to software configuration at the application level, aiming to ensure that the network environment can efficiently and securely handle large amounts of data transmission and processing needs.

[0003] Among them, the intelligent network integrated optimization system is a system that uses computer technology, artificial intelligence algorithms and network management strategies to achieve efficient configuration and use of network resources. Its main purpose is to improve network performance, reduce operation and maintenance costs and optimize user experience by intelligently analyzing network status, predicting network needs and automatically adjusting network configuration. It aims to cope with the complexity and dynamics faced by modern networks and support more flexible and adaptive network management and maintenance strategies.

[0004] Traditional systems lack dynamic network management strategies and rely on static rules and manual intervention, which makes them not respond quickly enough when encountering network anomalies and cannot effectively cope with rapidly changing network conditions, resulting in untimely handling of network security incidents, lack of flexibility in network configuration and resource allocation, and imbalanced allocation of network resources in actual operations, affecting the overall performance of the network, aggravating network congestion and latency problems, and reducing user experience. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings in the prior art and to propose an intelligent network integrated optimization system.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: an intelligent network integrated optimization system, the system comprising:

[0007] The traffic analysis module performs data cleaning based on network traffic data, removes irrelevant data packets, and classifies the remaining data packets according to source address, destination address, port number and transmission protocol to generate a traffic feature summary;

[0008] Based on the traffic feature summary, the anomaly identification module applies a deep Q network to perform time series analysis on the data stream, identify traffic fluctuations that differ from historical data patterns, including traffic surges in a short period of time or frequent access to unconventional ports, mark traffic fluctuations as potential security threats, and obtain security threat identification records;

[0009] The response strategy definition module formulates response measures for the threat type based on the security threat identification record, according to the threat level and impact scope, including traffic reduction, session termination and abnormal traffic isolation, and generates a targeted response measure table;

[0010] The network parameter adjustment module adjusts key parameters of the network based on the targeted response measure table, including adjusting firewall rules and reconfiguring routing policies, optimizing bandwidth allocation and connection number restrictions, and establishing dynamic adjustment parameter records;

[0011] The topology prediction module predicts future traffic trends and potential bottlenecks based on the dynamic adjustment parameter records, historical traffic data and current network status, identifies optimizable network nodes and connections, and obtains network optimization guidance information;

[0012] The topology optimization execution module replans the network topology structure based on the network optimization guidance information, including adding or reducing nodes, rewiring and adjusting the connection mode between nodes, optimizing the network performance and fault tolerance, and obtaining the adjusted network structure;

[0013] The path selection optimization module uses a recurrent neural network based on the adjusted network structure to analyze the optimal data transmission path between nodes, optimizes the routing of data packets according to the path bandwidth, delay and current network load, and generates a path selection optimization strategy;

[0014] The monitoring and adjustment module deploys network monitoring tools based on the path selection optimization strategy, monitors network traffic and detects network performance indicators, dynamically adjusts network configuration and path selection according to real-time data, and establishes a network performance monitoring log.

[0015] The present invention has the following improvements: the traffic feature summary includes traffic size, connection frequency, data packet type and communication protocol type; the security threat identification record includes timestamp, threat type, affected IP address and threat level; the dynamic adjustment parameter record includes firewall rules, routing configuration, bandwidth allocation restrictions and connection number restrictions before and after adjustment; the network optimization guidance information specifically includes network traffic prediction results, potential bottleneck nodes and structural adjustment measures; the adjusted network structure includes newly added or deleted nodes, modified connection paths and optimized network layout diagram; the network performance monitoring log includes monitoring time points, performance indicator values, detected abnormal events and adjustment measure records.

[0016] The present invention is improved in that the traffic analysis module includes a data cleaning submodule, a data classification submodule, and a feature analysis submodule;

[0017] The data cleaning submodule performs data cleaning based on the network traffic data, removes irrelevant data packets, including redundant broadcast packets and invalid fragment packets, and obtains the cleaned traffic data;

[0018] The data classification submodule classifies the cleaned traffic data according to the source address, destination address, port number and transmission protocol, classifies the data packets, and generates classified traffic data;

[0019] The feature analysis submodule analyzes the frequency, traffic peak and data flow duration characteristics of each type of data packet based on the classified traffic data, performs feature processing on the network traffic, and generates a traffic feature summary.

[0020] The present invention is improved in that the anomaly identification module includes a time series analysis submodule, a fluctuation identification submodule, and a threat marking submodule;

[0021] The time series analysis submodule performs time series analysis on network traffic data based on the traffic feature summary. If a data point does not conform to the historical trend, it is marked as a potential anomaly and a time series anomaly indicator is generated;

[0022] The fluctuation identification submodule is based on the timing anomaly index and applies the deep Q network to determine whether the traffic surges in a short period of time or frequently accesses unconventional ports by setting a threshold. If it meets the requirements, the nature and potential risks of the traffic fluctuation are analyzed to obtain the traffic fluctuation analysis results;

[0023] The deep Q network, according to the formula:

[0024] Q(s,a;θ,α,β,δ,σ)=E[r(δ,σ)+γmax a′ Q(s′,a′;θ′)|s,a,α,β]

[0025] Calculate the value of the state-action pair and generate traffic fluctuation analysis results;

[0026] Where s is the current network traffic state, a is the action taken based on the state, θ is the parameter of the deep learning model, α is the fluctuation sensitivity, β is the unconventional access weight, δ is the data mutation index, σ is the port diversity index, r(δ,σ) is the instant reward adjusted based on the data mutation index and the port diversity index, and γ is the discount factor;

[0027] The threat marking submodule uses a decision tree and a rule engine based on the traffic fluctuation analysis results. If the analysis results show that the traffic fluctuation has potential malicious characteristics, including DDoS attacks or port scans, the traffic fluctuation is marked as a security threat and a security threat identification record is obtained.

[0028] The present invention is improved in that the response strategy definition module includes a threat level assessment submodule, a measure formulation submodule, and a strategy integration submodule;

[0029] The threat level assessment submodule assesses the level of each identified threat based on the security threat identification record, classifies the threat according to the threat type, potential impact range and urgency, and generates a threat level classification record;

[0030] The measures formulation submodule formulates response measures based on the threat level classification records and threat characteristics and levels, including traffic reduction, session termination and abnormal traffic isolation operations, to obtain a preliminary response measures list;

[0031] The strategy integration submodule integrates and optimizes the measures corresponding to the different threat levels based on the preliminary response measures list, verifies the pertinence of the measures, and generates a pertinent response measures table.

[0032] The present invention is improved in that the network parameter adjustment module includes a parameter analysis submodule, an adjustment strategy formulation submodule, and an execution and recording submodule;

[0033] The parameter analysis submodule analyzes the current network configuration and parameter settings based on the targeted response measures table, identifies the network parameters that need to be adjusted, including firewall rules, routing policies, bandwidth allocation and connection number limits, and generates a parameter adjustment requirements list;

[0034] The adjustment strategy formulation submodule formulates a network parameter adjustment strategy based on the parameter adjustment requirement list, including adjustment priority, expected goals and implementation steps, to obtain a network parameter adjustment strategy;

[0035] The execution and recording submodule adjusts the network parameters based on the network parameter adjustment strategy, including updating firewall rules, reconfiguring routing strategies, optimizing bandwidth allocation and connection number restrictions, and records the adjustment operations and results to establish dynamic adjustment parameter records.

[0036] The present invention is improved in that the topology structure prediction module includes a trend prediction submodule, a bottleneck identification submodule, and an optimization proposal submodule;

[0037] The trend prediction submodule predicts future traffic trends based on dynamic adjustment parameter records and historical traffic data, analyzes traffic increase and decrease trends, and generates traffic trend prediction results;

[0038] The bottleneck identification submodule analyzes the current network status based on the traffic trend prediction results, identifies the bottleneck areas that appear during the traffic peak period, including the overload of the target node or connection, and obtains a list of potential bottleneck areas;

[0039] The optimization proposal submodule formulates targeted network topology optimization measures based on the potential bottleneck area list, including adjusting network nodes and connection strategies, processing the identified bottleneck problems, and obtaining network optimization guidance information.

[0040] The present invention is improved in that the topology optimization execution module includes a node adjustment submodule, a wiring optimization submodule, and a connection adjustment submodule;

[0041] The node adjustment submodule analyzes the traffic load and connection status of nodes in the network based on the network optimization guidance information, determines which nodes need to be increased or decreased, adjusts the number of nodes, and obtains a node adjustment plan;

[0042] The wiring optimization submodule replans the wiring structure inside the network based on the node adjustment plan, optimizes the data transmission path, and generates wiring optimization results;

[0043] The connection adjustment submodule adjusts the connection mode between nodes based on the wiring optimization result, including adding redundant connections to optimize network fault tolerance or adjusting bandwidth allocation of existing connections to obtain an adjusted network structure.

[0044] The present invention is improved in that the path selection optimization module includes a path analysis submodule, a load evaluation submodule, and an optimization decision submodule;

[0045] The path analysis submodule uses a recurrent neural network based on the adjusted network structure to analyze the data transmission path in the network, and combines the path bandwidth and delay. If the path bandwidth is sufficient and the delay is low, it is marked as a candidate path, and a candidate path list is generated;

[0046] The load evaluation submodule evaluates the current network load based on the candidate path list, performs load analysis on each candidate path, and if the current load of the path is lower than the set threshold, marks it as the optimal transmission path, and obtains a low-load path list;

[0047] The optimization decision submodule uses a temporal convolutional network based on a list of low-load paths to prioritize the paths in the list, and preferentially selects the path with the best delay load as the critical path. If there are multiple paths that meet the conditions, the number of hops is used to make a judgment and generate a path selection optimization strategy.

[0048] The temporal convolutional network, according to the formula:

[0049] P′=σ(TCN(L,D,C,T)·W)

[0050] Calculate the path priority and obtain the path selection optimization strategy;

[0051] Among them, P′ represents the path priority score, σ represents the activation function, TCN refers to the temporal convolutional network, L is the delay load of the path, D represents the number of hops of the path, C represents the communication frequency, T is the stability indicator of the path, and W is the weight coefficient.

[0052] The present invention is improved in that the monitoring and adjustment module includes a flow monitoring submodule, a performance index detection submodule, and a configuration adjustment submodule;

[0053] The traffic monitoring submodule deploys network monitoring tools based on the path selection optimization strategy, monitors the network traffic status in real time, including the total traffic and traffic distribution between nodes, and obtains real-time traffic monitoring data;

[0054] The performance indicator detection submodule detects network performance indicators, including delay, bandwidth utilization and packet loss rate, based on real-time traffic monitoring data, analyzes whether the network operation status meets the preset performance requirements, and generates performance indicator records;

[0055] The configuration adjustment submodule analyzes real-time data based on performance indicator records, dynamically adjusts network configuration according to analysis results, and establishes a network performance monitoring log.

[0056] Compared with the prior art, the advantages and positive effects of the present invention are:

[0057] In the present invention, by combining the deep Q network with the decision tree and rule engine, the system can analyze network traffic in real time, identify abnormal fluctuations that are inconsistent with historical trends, and automatically mark them as potential security threats. The use of this intelligent analysis and response mechanism significantly enhances the security protection capability of the network. At the same time, by dynamically adjusting the network configuration, it ensures the efficient use of network resources, which not only improves the efficiency of data transmission, but also reduces network latency, thereby effectively improving the processing capacity and security of the network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 A module diagram of an intelligent network integrated optimization system is proposed for the present invention;

[0059] Figure 2 A system framework diagram of an intelligent network integrated optimization system is proposed for the present invention;

[0060] Figure 3 The present invention proposes a flow chart of a traffic analysis module in an intelligent network integrated optimization system;

[0061] Figure 4 The present invention proposes a flow chart of an abnormality identification module in an intelligent network integrated optimization system;

[0062] Figure 5The present invention proposes a flow chart of a response strategy definition module in an intelligent network integrated optimization system;

[0063] Figure 6 The present invention proposes a flow chart of a network parameter adjustment module in an intelligent network integrated optimization system;

[0064] Figure 7 The present invention proposes a flow chart of a topology structure prediction module in an intelligent network integrated optimization system;

[0065] Figure 8 The present invention proposes a flow chart of a topology optimization execution module in an intelligent network integrated optimization system;

[0066] Fig. 9 The present invention proposes a flow chart of a path selection optimization module in an intelligent network integrated optimization system;

[0067] Fig.10 The present invention proposes a flow chart of a monitoring and adjustment module in an intelligent network integrated optimization system. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0069] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating positions or positional relationships, are based on the positions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0070] Example

[0071] See also Figure 1 The present invention provides a technical solution: an intelligent network integrated optimization system comprising:

[0072] The traffic analysis module performs data cleaning based on network traffic data, removes irrelevant data packets, and classifies the remaining data packets according to source address, destination address, port number and transmission protocol to generate a traffic feature summary;

[0073] Based on the traffic feature summary, the anomaly identification module applies a deep Q network to perform time series analysis on the data stream, identify traffic fluctuations that differ from historical data patterns, including traffic surges in a short period of time or frequent access to unconventional ports, mark traffic fluctuations as potential security threats, and obtain security threat identification records;

[0074] The response strategy definition module formulates response measures for threat types based on security threat identification records, threat levels and impact scope, including traffic reduction, session termination and abnormal traffic isolation, and generates a targeted response measure table;

[0075] The network parameter adjustment module adjusts the key parameters of the network based on the targeted response measures table, including adjusting firewall rules and reconfiguring routing policies, optimizing bandwidth allocation and connection number limits, and establishing dynamic adjustment parameter records;

[0076] The topology prediction module is based on dynamically adjusted parameter records, historical traffic data and current network status, predicts future traffic trends and potential bottlenecks, identifies optimizable network nodes and connections, and obtains network optimization guidance information;

[0077] The topology optimization execution module replans the network topology structure based on the network optimization guidance information, including adding or reducing nodes, rewiring and adjusting the connection mode between nodes, optimizing the network performance and fault tolerance, and obtaining the adjusted network structure;

[0078] The path selection optimization module uses a recurrent neural network based on the adjusted network structure to analyze the optimal data transmission path between nodes, optimize the routing of data packets according to the path bandwidth, delay and current network load, and generate a path selection optimization strategy;

[0079] The monitoring and adjustment module deploys network monitoring tools based on the path selection optimization strategy, monitors network traffic and detects network performance indicators, dynamically adjusts network configuration and path selection according to real-time data, and establishes a network performance monitoring log.

[0080] The traffic characteristics summary includes traffic size, connection frequency, data packet type and communication protocol type. The security threat identification record includes timestamp, threat type, affected IP address and threat level. The dynamic adjustment parameter record includes firewall rules, routing configuration, bandwidth allocation restrictions and connection number restrictions before and after adjustment. The network optimization guidance information specifically includes network traffic prediction results, potential bottleneck nodes and structural adjustment measures. The adjusted network structure includes newly added or deleted nodes, modified connection paths and optimized network layout diagram. The network performance monitoring log includes monitoring time points, performance indicator values, detected abnormal events and adjustment measures records.

[0081] See also Figure 2 and Figure 3 ,The traffic analysis module includes a data cleaning submodule, a data classification submodule, and a feature analysis submodule;

[0082] The data cleaning submodule performs data cleaning based on network traffic data, removes irrelevant data packets, including redundant broadcast packets and invalid fragment packets, and obtains the cleaned traffic data;

[0083] The data classification submodule classifies the cleaned traffic data according to the source address, destination address, port number and transmission protocol, classifies the data packets and generates classified traffic data;

[0084] The feature analysis submodule analyzes the frequency, traffic peak and data flow duration characteristics of each type of data packet based on the classified traffic data, performs feature processing on the network traffic, and generates a traffic feature summary.

[0085] In the data cleaning submodule, a data filtering algorithm is adopted based on network traffic data and implemented using the pandas library of Python language. The data cleaning operation includes using Boolean indexing to filter out data packets with non-empty source and destination addresses, and using regular expressions through the str.match method of DataFrame to eliminate redundant broadcast packet addresses FF:FF:FF:FF:FF:FF and invalid fragment packets whose sizes are not within the legal range (i.e. less than 64 bytes or greater than 1500 bytes) to generate cleaned traffic data.

[0086] In the data classification submodule, a clustering algorithm is used based on the cleaned traffic data. Specifically, the KMeans method in the scikit-learn library is used. The clustering number parameter is set to be dynamically determined according to the actual data packet characteristics. The clustering operation is performed through the vector representation of the source address, destination address, port number and transmission protocol. The Euclidean distance is used to measure the similarity, and the data packets are classified to generate classified traffic data.

[0087] In the feature analysis submodule, based on the classified traffic data, statistical analysis methods are adopted to calculate the frequency, traffic peak and data flow duration of each type of data packet using the numpy and pandas libraries. Characterization processing is performed, including calculating the average packet size, maximum packet size and total traffic of each type of traffic in the time window, using the groupby method of DataFrame to group the classified data, and then applying aggregation functions such as mean, max and sum through the agg method to generate a traffic feature summary.

[0088] See also Figure 2 and Figure 4 ,The anomaly recognition module includes a time series analysis submodule, a fluctuation recognition submodule, and a threat marking submodule;

[0089] The time series analysis submodule performs time series analysis on network traffic data based on the traffic feature summary. If a data point does not conform to the historical trend, it is marked as a potential anomaly and a time series anomaly indicator is generated;

[0090] The fluctuation identification submodule uses a deep Q network based on the timing anomaly indicator to determine whether the traffic surges in a short period of time or frequently accesses unconventional ports by setting thresholds. If so, the nature and potential risks of the traffic fluctuation are analyzed to obtain the traffic fluctuation analysis results.

[0091] The threat marking submodule uses a decision tree and rule engine based on the traffic fluctuation analysis results. If the analysis results show that the traffic fluctuation has potential malicious characteristics, including DDoS attacks or port scans, the traffic fluctuation will be marked as a security threat and the security threat identification record will be obtained.

[0092] In the time series analysis submodule, based on the traffic feature summary, the autoregressive integrated moving average model (ARIMA) is adopted. The ARIMA class in the statsmodels library is used, and the model parameters are set to (5, 1, 0) to represent the autoregressive term of 5, the difference order of 1, and the moving average term of 0. Time series analysis is performed on the network traffic data, and model training is performed. By comparing the data points with the historical trends predicted by the model, if the difference is significant, it is marked as a potential anomaly and a time series anomaly indicator is generated.

[0093] In the fluctuation identification submodule, based on the timing anomaly index, the deep Q network (DQN) is adopted, and the deep learning model is built using the tensorflow and keras-rl2 libraries. The network structure is defined to include three fully connected layers, and the number of output nodes in each layer is 128, 256 and 128 respectively. The activation function uses relu, and the reward threshold is set to dynamically adjust the percentage based on the anomaly index. Model training is performed. By analyzing the change rate of traffic data and the unconventionality of the access port, if it is detected that the traffic surges in a short period of time or frequent access to unconventional ports, the nature and potential risks of the traffic fluctuation are analyzed, and the traffic fluctuation analysis results are obtained.

[0094] Deep Q network, according to the formula:

[0095] Q(s,a;θ,α,β,δ,σ)=E[r(δ,σ)+γmax a′ Q(s′,a′;θ′)|s,a,α,β]

[0096] Calculate the value of the state-action pair and generate traffic fluctuation analysis results;

[0097] Among them, s is the current network traffic state, a is the action taken based on this state, θ is the parameter of the deep learning model, α is the fluctuation sensitivity, which indicates the sensitivity of the model to traffic changes, β is the unconventional access weight, which indicates the influence of unconventional port access in the decision-making process, δ is the data mutation index, which quantifies the degree of traffic surge in a short period of time, σ is the port diversity index, which reflects the diversity of port types accessed by traffic, r(δ,σ) is the immediate reward adjusted based on the data mutation index and the port diversity index, and γ is the discount factor, which is used to measure the current value of future rewards.

[0098] Execution process:

[0099] S1: Set the network parameters θ and parameters α, β, δ, σ of the model to adjust the model's sensitivity to fluctuations and the importance attached to unconventional access, collect network traffic data, and convert it into the input state s of the model, including the traffic change rate and port access pattern;

[0100] S2: Dynamically calculate the instant reward r(δ,σ) based on the traffic mutation index δ and the port diversity index σ, use the formula to train the model, and learn the optimal action by updating the value function of the state-action pair;

[0101] S3: Based on the model performance and traffic data changes, dynamically adjust the α, β, δ, σ parameters to improve the adaptability and accuracy of the model, identify the nature of traffic fluctuations and potential risks, and output traffic fluctuation analysis results for network management and security monitoring.

[0102] In the threat marking submodule, based on the traffic fluctuation analysis results, decision trees and rule engines are used, and the DecisionTreeClassifier method in the scikit-learn library is used in combination with a custom rule engine for logical definition, including rules such as traffic surges exceeding set thresholds and unconventional port access frequencies exceeding the standard. The analysis results are evaluated. If the traffic fluctuations show potential malicious features of DDoS attacks or port scans, such traffic fluctuations are marked as security threats, and security threat identification records are obtained.

[0103] See also Figure 2 and Figure 5 ,The response strategy definition module includes the threat level assessment submodule, the ,measures formulation submodule, and the strategy integration submodule;

[0104] The threat level assessment submodule assesses the level of each identified threat based on the security threat identification record, classifies the threat according to the threat type, potential impact scope and urgency, and generates a threat level classification record;

[0105] The measures formulation submodule formulates response measures based on threat level classification records and threat characteristics and levels, including traffic reduction, session termination, and abnormal traffic isolation operations, and obtains a preliminary response measures list;

[0106] Based on the preliminary response measures list, the strategy integration submodule integrates and optimizes the measures corresponding to different threat levels, verifies the pertinence of the measures, and generates a table of targeted response measures.

[0107] In the threat level assessment submodule, based on the security threat identification record, a weighted scoring algorithm is adopted and implemented in Python. The threat type weight is defined as [DDoS: 0.4, port scan: 0.3, other: 0.3], the potential impact range weight is [global: 0.5, local: 0.3, individual: 0.2], and the urgency weight is [high: 0.5, medium: 0.3, low: 0.2]. The threat level of each identification is evaluated, the weighted sum is performed, and the threat is classified according to the final score to generate a threat level classification record.

[0108] In the measures formulation submodule, based on the threat level classification records, the rule engine method is adopted, and the if-else statement in Python language is used to define the rules. The rules include executing the flow reduction operation flow_reduction() if the threat level is high, executing the session termination operation session_termination() if the threat level is medium, and executing the abnormal traffic isolation operation traffic_isolation() if the threat level is low. Response measures are formulated according to the threat characteristics and levels to obtain a preliminary response measures list.

[0109] In the policy integration submodule, based on the preliminary response measures list, the priority queue integration method is adopted, which is implemented using the queue.PriorityQueue class in Python. The measures are integrated according to the priority of different threat levels. The priority is set to [traffic reduction: 1, session termination: 2, abnormal traffic isolation: 3]. The simulation verification function validate_measures() is used to verify the targetedness of the measures and generate a targeted response measures table.

[0110] See also Figure 2 and Figure 6 ,The network parameter adjustment module includes a parameter analysis submodule, an adjustment ,strategy formulation submodule, and an execution and recording submodule;

[0111] The parameter analysis submodule analyzes the current network configuration and parameter settings based on the targeted response measures table, identifies the network parameters that need to be adjusted, including firewall rules, routing policies, bandwidth allocation, and connection number limits, and generates a parameter adjustment requirements list;

[0112] The adjustment strategy formulation submodule formulates the network parameter adjustment strategy based on the parameter adjustment requirement list, including the adjustment priority, expected goals and implementation steps, and obtains the network parameter adjustment strategy;

[0113] The execution and recording submodule adjusts network parameters based on the network parameter adjustment strategy, including updating firewall rules, reconfiguring routing strategies, optimizing bandwidth allocation and connection number limits, and records the adjustment operations and results to establish dynamic adjustment parameter records.

[0114] In the parameter analysis submodule, based on the targeted response measure table, the decision tree algorithm is adopted, and the decision tree model is constructed using Python's Scikit-learn library. The decision tree parameters are set, including criterion as gini, max_depth as 5, and min_samples_split as 2. The current network configuration and parameter settings are analyzed, and the network parameters that need to be adjusted are identified, including firewall rules, routing policies, bandwidth allocation, and connection number limits. A list of parameter adjustment requirements is generated.

[0115] In the adjustment strategy formulation submodule, based on the parameter adjustment requirement list, the priority queue algorithm is adopted, the priority queue is implemented using Python's Queue library, and priority rules are set, including priority allocation according to the impact range of network parameters and adjustment difficulty. Network parameter adjustment strategy formulation is carried out, including adjustment priority, expected goals and implementation steps, and network parameter adjustment strategy is generated.

[0116] In the execution and recording submodule, based on the network parameter adjustment strategy, script automation is adopted, and Python's Paramiko library is used to execute SSH commands to adjust network parameters, including updating firewall rules, reconfiguring routing policies, optimizing bandwidth allocation and connection number limits, and recording adjustment operations and results to establish dynamic adjustment parameter records.

[0117] See also Figure 2 and Figure 7 ,The topology structure prediction module includes a trend prediction submodule, a bottleneck identification submodule, and an optimization proposal submodule;

[0118] The trend prediction submodule predicts future traffic trends based on dynamic adjustment parameter records and historical traffic data, analyzes traffic increase and decrease trends, and generates traffic trend prediction results;

[0119] The bottleneck identification submodule analyzes the current network status based on the traffic trend prediction results, identifies the bottleneck areas that appear during traffic peaks, including overloads of target nodes or connections, and obtains a list of potential bottleneck areas;

[0120] The optimization proposal submodule formulates targeted network topology optimization measures based on the list of potential bottleneck areas, including adjusting network nodes and connection strategies, processing identified bottleneck problems, and obtaining network optimization guidance information.

[0121] In the trend prediction submodule, based on the dynamic adjustment parameter records and combined with the historical traffic data, a time series prediction model is adopted. Specifically, the seasonal autoregressive integrated moving average model (SARIMA) in the statsmodels library of the Python language is used. The execution model parameters are set to (2, 1, 2)x(0, 1, 1, 12), representing seasonal difference, seasonal autoregressive and moving average parameters. Future traffic trends are predicted, traffic increase and decrease trends are analyzed, and traffic trend prediction results are generated.

[0122] In the bottleneck identification submodule, based on the traffic trend prediction results, network analysis tools are used, specifically using a network analysis algorithm based on graph theory, to perform network status simulation operations, including using the networkx library of the Python language to build a network topology diagram, applying the shortest path algorithm nx.shortest_path() and the traffic distribution model nx.maximum_flow(), analyzing the current network status, identifying bottleneck areas that occur during traffic peaks, such as target node overload target_node_overload() and connection traffic exceeding link_traffic_exceedance(), and obtaining a list of potential bottleneck areas.

[0123] In the optimization proposal submodule, based on the list of potential bottleneck areas, a topology optimization algorithm is used. Specifically, an algorithm for modifying the network structure is used to perform network optimization operations, including using the networkx library to reorganize the topology of the identified bottleneck area nx.restructure_topology(), adjusting network nodes and connection strategies such as adding backup paths add_backup_paths() and redistributing bandwidth redistribute_bandwidth(), processing the identified bottleneck problems, and obtaining network optimization guidance information.

[0124] See also Figure 2 and Figure 8 ,The topology optimization execution module includes a node adjustment submodule, a routing optimization submodule, and a connection adjustment submodule;

[0125] The node adjustment submodule analyzes the traffic load and connection status of nodes in the network based on the network optimization guidance information, determines which nodes need to be increased or decreased, adjusts the number of nodes, and obtains the node adjustment plan;

[0126] The wiring optimization submodule replans the wiring structure within the network based on the node adjustment plan, optimizes the data transmission path, and generates wiring optimization results;

[0127] The connection adjustment submodule adjusts the connection mode between nodes based on the wiring optimization results, including adding redundant connections to optimize network fault tolerance or adjusting the bandwidth allocation of existing connections to obtain the adjusted network structure.

[0128] In the node adjustment submodule, based on the network optimization guidance information, a network analysis algorithm is adopted. Specifically, the networkx library of Python language is used to construct and analyze the network graph, and the traffic load and connection status analysis operations of the nodes in the network are performed, including using the networkx graph algorithm to calculate the centrality of the node nx.degree_centrality() to evaluate the importance of the node in the network, determine which nodes need to be increased to disperse the traffic load or reduced to simplify the network structure according to the centrality, adjust the number of nodes, and obtain the node adjustment plan.

[0129] In the wiring optimization submodule, based on the node adjustment plan, the path optimization algorithm is adopted. Specifically, the shortest path algorithm nx.shortest_path() and the global efficiency algorithm nx.global_efficiency() in the networkx library are used to re-plan the wiring structure inside the network and perform optimization operations on the data transmission path, including calculating the network efficiency under different wiring schemes to select the most optimized data transmission path, considering the path bandwidth and delay, and generating wiring optimization results.

[0130] In the connection adjustment submodule, based on the wiring optimization results, the connection reconfiguration algorithm is adopted, and networkx is used to dynamically adjust the connection. The connection adjustment operation between nodes is performed, including adding redundant connections to improve the fault tolerance of the network add_redundant_links(), and adjusting the bandwidth allocation of existing connections to optimize network load balancing.

[0131] optimize_bandwidth_distribution(), get the adjusted network structure.

[0132] See also Figure 2 and Fig. 9 ,The path selection optimization module includes a path analysis submodule, a load evaluation submodule, and an optimization decision submodule;

[0133] The path analysis submodule uses a recurrent neural network based on the adjusted network structure to analyze the data transmission path in the network. If the path bandwidth is sufficient and the delay is low, it is marked as a candidate path and a candidate path list is generated.

[0134] The load evaluation submodule evaluates the current network load based on the candidate path list and performs load analysis on each candidate path. If the current load of the path is lower than the set threshold, it is marked as the optimal transmission path and a list of low-load paths is obtained.

[0135] The optimization decision submodule is based on the low-load path list and uses a temporal convolutional network to prioritize the paths in the list, and preferentially selects the path with the best delay load as the critical path. If there are multiple paths that meet the conditions, the number of hops is used to make a judgment and generate a path selection optimization strategy.

[0136] In the path analysis submodule, based on the adjusted network structure, a recurrent neural network (RNN) is used to build a model using the TensorFlow and Keras libraries in Python. The data transmission path analysis operations in the network are performed, including defining the recurrent layer SimpleRNN for processing time series data, setting the model parameters to the number of hidden layer units 128 and the activation function relu, and combining the path bandwidth and delay. If the path bandwidth is sufficient and the delay is low, it is marked as a candidate path and a candidate path list is generated.

[0137] In the load evaluation submodule, a load evaluation algorithm is used based on the candidate path list. It is implemented using a custom function in Python. The current network load evaluation operation includes calculating the current load of each candidate path using calculate_path_load(). If the current load of the path is lower than the set threshold threshold_value, it is marked as the optimal transmission path, and a list of low-load paths is obtained.

[0138] In the optimization decision submodule, based on the low-load path list, the temporal convolutional network (TCN) is adopted and implemented using the TensorFlow and Keras libraries. The path priority sorting operation includes defining the convolution layer Conv1D and the activation function relu, setting the model's dilation rate dilation_rate to adapt to time series prediction, and giving priority to selecting the path with the best delay load as the critical path. If there are multiple paths that meet the conditions, the hop count hop_count is used to make a judgment and generate a path selection optimization strategy.

[0139] Temporal convolutional network, according to the formula:

[0140] P′=σ(TCN(L,D,C,T)·W)

[0141] Calculate the path priority and obtain the path selection optimization strategy;

[0142] Among them, P′ represents the path priority score, σ represents the activation function, TCN refers to the temporal convolutional network method, L is the delay load of the path, which quantifies the time efficiency of data transmission, D represents the number of hops of the path, which indicates the number of nodes that need to be passed from the source to the destination, C represents the communication frequency, which measures the activeness of communication between nodes in the path, T is the stability indicator of the path, and high stability means that the path is not easily affected by network changes. W is the weight coefficient, which adjusts the influence of each parameter in the final priority score according to the network environment and business needs.

[0143] Execution process:

[0144] S1: Obtain the delay load L, number of hops D, communication frequency C and stability T of the path, and apply the temporal convolutional network (TCN) to process the above feature data;

[0145] S2: Determine the weight coefficient W of each feature by analyzing and combining the feature data and weight, calculate the path priority score P′ through TCN and activation function σ, select the optimal path according to the score P′, and generate an optimization strategy.

[0146] See also Figure 2 and Fig.10 ,The monitoring and adjustment module includes a traffic monitoring submodule, a performance indicator detection submodule, and a configuration adjustment submodule;

[0147] The traffic monitoring submodule deploys network monitoring tools based on the path selection optimization strategy to monitor the network traffic status in real time, including the total traffic and traffic distribution between nodes, and obtain real-time traffic monitoring data;

[0148] The performance indicator detection submodule detects network performance indicators based on real-time traffic monitoring data, including latency, bandwidth utilization, and packet loss rate, analyzes whether the network operation status meets the preset performance requirements, and generates performance indicator records;

[0149] The configuration adjustment submodule analyzes real-time data based on performance indicator records, dynamically adjusts network configuration according to the analysis results, and establishes a network performance monitoring log.

[0150] In the traffic monitoring submodule, based on the path selection optimization strategy, a network monitoring tool is used, specifically Zabbix is ​​used for deployment, and real-time monitoring of network traffic status is performed, including configuring Zabbix monitoring items to collect total traffic and traffic distribution information between nodes, setting threshold alerts to identify traffic anomalies set_traffic_alert_thresholds(), and obtaining real-time traffic monitoring data.

[0151] In the performance indicator detection submodule, based on real-time traffic monitoring data, a performance analysis tool, specifically Wireshark, is used to detect network performance indicators. Network operation status analysis operations include using Wireshark to capture network packets to evaluate latency evaluate_latency(), bandwidth utilization assess_bandwidth_utilization(), and packet loss rate calculate_packet_loss_rate(), analyzing whether the network operation status meets the preset performance requirements and generating performance indicator records.

[0152] In the configuration adjustment submodule, a dynamic configuration adjustment algorithm is adopted based on performance indicator records. Specifically, Ansible is used for network configuration management, and real-time data analysis and dynamic network configuration adjustment operations are performed, including analyzing performance indicator records analyze_performance_metrics(). According to the analysis results, the network configuration is automatically adjusted through Ansible scripts, such as modifying routing policies modify_routing_policies() and adjusting bandwidth allocation adjust_bandwidth_allocation(), and establishing a network performance monitoring log.

[0153] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. An intelligent network integration optimization system, characterized by: The system comprises: The traffic analysis module performs data cleaning based on network traffic data, removes irrelevant data packets, and classifies the remaining data packets according to source address, destination address, port number and transmission protocol to generate a traffic feature summary; Based on the traffic feature summary, the anomaly identification module applies a deep Q network to perform time series analysis on the data stream, identify traffic fluctuations that differ from historical data patterns, including traffic surges in a short period of time or frequent access to unconventional ports, mark traffic fluctuations as potential security threats, and obtain security threat identification records; The response strategy definition module formulates response measures for the threat type based on the security threat identification record, according to the threat level and impact scope, including traffic reduction, session termination and abnormal traffic isolation, and generates a targeted response measure table; The network parameter adjustment module adjusts key parameters of the network based on the targeted response measure table, including adjusting firewall rules and reconfiguring routing policies, optimizing bandwidth allocation and connection number restrictions, and establishing dynamic adjustment parameter records; The topology prediction module predicts future traffic trends and potential bottlenecks based on the dynamic adjustment parameter records, historical traffic data and current network status, identifies optimizable network nodes and connections, and obtains network optimization guidance information; The topology optimization execution module replans the network topology structure based on the network optimization guidance information, including adding or reducing nodes, rewiring and adjusting the connection mode between nodes, optimizing the network performance and fault tolerance, and obtaining the adjusted network structure; The path selection optimization module uses a recurrent neural network based on the adjusted network structure to analyze the optimal data transmission path between nodes, optimizes the routing of data packets according to the path bandwidth, delay and current network load, and generates a path selection optimization strategy; The monitoring and adjustment module deploys network monitoring tools based on the path selection optimization strategy, monitors network traffic and detects network performance indicators, dynamically adjusts network configuration and path selection according to real-time data, and establishes a network performance monitoring log; The traffic feature summary includes traffic size, connection frequency, data packet type and communication protocol type; the security threat identification record includes timestamp, threat type, affected IP address and threat level; the dynamic adjustment parameter record includes firewall rules, routing configuration, bandwidth allocation restrictions and connection number restrictions before and after adjustment; the network optimization guidance information specifically includes network traffic prediction results, potential bottleneck nodes and structural adjustment measures; the adjusted network structure includes newly added or deleted nodes, modified connection paths and optimized network layout diagram; the network performance monitoring log includes monitoring time points, performance indicator values, detected abnormal events and adjustment measures records; The anomaly identification module includes a time series analysis submodule, a fluctuation identification submodule, and a threat marking submodule; The time series analysis submodule performs time series analysis on network traffic data based on the traffic feature summary. If a data point does not conform to the historical trend, it is marked as a potential anomaly and a time series anomaly indicator is generated; The fluctuation identification submodule is based on the timing anomaly index and applies the deep Q network to determine whether the traffic surges in a short period of time or frequently accesses unconventional ports by setting a threshold. If it meets the requirements, the nature and potential risks of the traffic fluctuation are analyzed to obtain the traffic fluctuation analysis results; The threat marking submodule uses a decision tree and a rule engine based on the traffic fluctuation analysis results. If the analysis results show that the traffic fluctuation has potential malicious characteristics, including DDoS attacks or port scans, the traffic fluctuation is marked as a security threat and a security threat identification record is obtained.

2. The intelligent network integrated optimization system according to claim 1 is characterized in that: The traffic analysis module includes a data cleaning submodule, a data classification submodule, and a feature analysis submodule; The data cleaning submodule performs data cleaning based on the network traffic data, removes irrelevant data packets, including redundant broadcast packets and invalid fragment packets, and obtains the cleaned traffic data; The data classification submodule classifies the cleaned traffic data according to the source address, destination address, port number and transmission protocol, classifies the data packets, and generates classified traffic data; The feature analysis submodule analyzes the frequency, traffic peak and data flow duration characteristics of each type of data packet based on the classified traffic data, performs feature processing on the network traffic, and generates a traffic feature summary.

3. The intelligent network integrated optimization system according to claim 1 is characterized in that: The response strategy definition module includes a threat level assessment submodule, a measure formulation submodule, and a strategy integration submodule; The threat level assessment submodule assesses the level of each identified threat based on the security threat identification record, classifies the threat according to the threat type, potential impact range and urgency, and generates a threat level classification record; The measures formulation submodule formulates response measures based on the threat level classification records and threat characteristics and levels, including traffic reduction, session termination and abnormal traffic isolation operations, to obtain a preliminary response measures list; The strategy integration submodule integrates and optimizes the measures corresponding to the different threat levels based on the preliminary response measures list, verifies the pertinence of the measures, and generates a pertinent response measures table.

4. The intelligent network integrated optimization system according to claim 1 is characterized in that: The network parameter adjustment module includes a parameter analysis submodule, an adjustment strategy formulation submodule, and an execution and recording submodule; The parameter analysis submodule analyzes the current network configuration and parameter settings based on the targeted response measures table, identifies the network parameters that need to be adjusted, including firewall rules, routing policies, bandwidth allocation and connection number limits, and generates a parameter adjustment requirements list; The adjustment strategy formulation submodule formulates a network parameter adjustment strategy based on the parameter adjustment requirement list, including adjustment priority, expected goals and implementation steps, to obtain a network parameter adjustment strategy; The execution and recording submodule adjusts the network parameters based on the network parameter adjustment strategy, including updating firewall rules, reconfiguring routing strategies, optimizing bandwidth allocation and connection number restrictions, and records the adjustment operations and results to establish dynamic adjustment parameter records.

5. The intelligent network integrated optimization system according to claim 1 is characterized in that: The topology structure prediction module includes a trend prediction submodule, a bottleneck identification submodule, and an optimization proposal submodule; The trend prediction submodule predicts future traffic trends based on dynamic adjustment parameter records and historical traffic data, analyzes traffic increase and decrease trends, and generates traffic trend prediction results; The bottleneck identification submodule analyzes the current network status based on the traffic trend prediction results, identifies the bottleneck areas that appear during the traffic peak period, including the overload of the target node or connection, and obtains a list of potential bottleneck areas; The optimization proposal submodule formulates targeted network topology optimization measures based on the potential bottleneck area list, including adjusting network nodes and connection strategies, processing the identified bottleneck problems, and obtaining network optimization guidance information.

6. The intelligent network integrated optimization system according to claim 1 is characterized in that: The topology optimization execution module includes a node adjustment submodule, a wiring optimization submodule, and a connection adjustment submodule; The node adjustment submodule analyzes the traffic load and connection status of nodes in the network based on the network optimization guidance information, determines which nodes need to be increased or decreased, adjusts the number of nodes, and obtains a node adjustment plan; The wiring optimization submodule replans the wiring structure inside the network based on the node adjustment plan, optimizes the data transmission path, and generates wiring optimization results; The connection adjustment submodule adjusts the connection mode between nodes based on the wiring optimization result, including adding redundant connections to optimize network fault tolerance or adjusting bandwidth allocation of existing connections to obtain an adjusted network structure.

7. The intelligent network integrated optimization system according to claim 1 is characterized in that: The path selection optimization module includes a path analysis submodule, a load evaluation submodule, and an optimization decision submodule; The path analysis submodule uses a recurrent neural network based on the adjusted network structure to analyze the data transmission path in the network, and combines the path bandwidth and delay. If the path bandwidth is sufficient and the delay is low, it is marked as a candidate path, and a candidate path list is generated; The load evaluation submodule evaluates the current network load based on the candidate path list, performs load analysis on each candidate path, and if the current load of the path is lower than the set threshold, marks it as the optimal transmission path, and obtains a low-load path list; The optimization decision submodule uses a temporal convolutional network based on a list of low-load paths to prioritize the paths in the list, and preferentially selects the path with the best delay load as the critical path. If there are multiple paths that meet the conditions, the number of hops is used to make a judgment and generate a path selection optimization strategy. The temporal convolutional network, according to the formula: ； Calculate the path priority and obtain the path selection optimization strategy; in, represents the path priority score, represents the activation function, Refers to the temporal convolutional network, is the delay load of the path, Represents the number of hops in the path, Indicates the communication frequency, is the stability index of the path, is the weight coefficient.

8. The intelligent network integrated optimization system according to claim 1 is characterized in that: The monitoring and adjustment module includes a flow monitoring submodule, a performance indicator detection submodule, and a configuration adjustment submodule; The traffic monitoring submodule deploys network monitoring tools based on the path selection optimization strategy, monitors the network traffic status in real time, including the total traffic and traffic distribution between nodes, and obtains real-time traffic monitoring data; The performance indicator detection submodule detects network performance indicators, including delay, bandwidth utilization and packet loss rate, based on real-time traffic monitoring data, analyzes whether the network operation status meets the preset performance requirements, and generates performance indicator records; The configuration adjustment submodule analyzes real-time data based on performance indicator records, dynamically adjusts network configuration according to analysis results, and establishes a network performance monitoring log.

Images