Risk network positioning method, system and computer equipment based on community mining

Abstract

The present invention discloses a method, system and computer equipment for locating a risk network based on community mining. The method includes that each of a plurality of sensor acquisition subnetworks obtains a subnetwork operation indicator subset according to a preset acquisition strategy and sends it to a cloud server; if the cloud server detects a risk network mining and locating instruction, it obtains a subnetwork operation indicator set; the cloud server determines the risk network identification result for each subnetwork operation indicator subset in the subnetwork operation indicator set based on the risk network identification strategy and the subnetwork similarity information and subnetwork structure quality information in the subnetwork operation indicator subset; and obtains the risk network positioning result composed of the sensor acquisition subnetwork corresponding to the risk network identification result that meets the preset risk result condition. In the embodiment of the present invention, the cloud server can quickly locate and warn the sensor acquisition subnetwork with risks based on the risk network identification strategy and the subnetwork operation indicator subset of each sensor acquisition subnetwork.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a risk network positioning method, system and computer equipment based on community mining. Background Art

[0002] At present, the self-propagation sniffing technology based on the sensor process has been applied to the network expansion scenario. In the process of self-propagation sniffing by the sensor process, a sensor collection network is dynamically formed, and the sensor collection network includes multiple sub-networks.

[0003] The traditional monitoring and analysis system used for sensor collection networks uses a recognition method for the identification alarm threshold of a single resource node (i.e., a single sensor collection node). When a regional network failure occurs, the alarm threshold of a single node is often reached only when the network risk failure has already occurred on a large scale. This results in the traditional monitoring and analysis system used for sensor collection networks being unable to detect regional network failures in a timely manner and issue early warnings. Summary of the invention

[0004] The embodiments of the present invention provide a risk network positioning method, system and computer equipment based on community mining, aiming to solve the problem that the traditional monitoring and analysis system used for the sensor collection network in the prior art cannot timely discover regional-level network failures and issue early warnings.

[0005] In a first aspect, an embodiment of the present invention provides a risk network positioning method based on community mining, which is applied to a sensor collection network, which includes a cloud server and a plurality of sensor collection sub-networks, wherein the plurality of sensor collection sub-networks are communicatively connected to the cloud server; the risk network positioning method based on community mining includes:

[0006] Each of the plurality of sensor collection subnetworks acquires a subset of subnetwork operation indicators according to a preset collection strategy and sends the subset to the cloud server;

[0007] If the cloud server detects a risk network mining and positioning instruction, it obtains a sub-network operation indicator set corresponding to the risk network mining and positioning instruction; wherein the sub-network operation indicator subset included in the sub-network operation indicator set corresponds one-to-one to the sensor collection sub-network in the plurality of sensor collection sub-networks;

[0008] The cloud server determines, for each subnetwork operation indicator subset in the subnetwork operation indicator set, a risk network identification result corresponding to the subnetwork operation indicator subset based on a preset risk network identification strategy and subnetwork similarity information and subnetwork structure quality information in the subnetwork operation indicator subset;

[0009] If the cloud server determines that there is a risk network identification result of a subnetwork operation indicator subset in the subnetwork operation indicator set that meets the preset risk result condition, the corresponding subnetwork operation indicator subset is obtained as the target subnetwork operation indicator subset, and the risk network positioning result is composed of the sensor collection subnetwork corresponding to the target subnetwork operation indicator subset.

[0010] In a second aspect, an embodiment of the present invention further provides a risk network positioning system based on community mining, which is applied to a sensor collection network, wherein the sensor collection network includes a cloud server and a plurality of sensor collection sub-networks, and the plurality of sensor collection sub-networks are communicatively connected with the cloud server;

[0011] Each of the plurality of sensor collection subnetworks is used to obtain a subset of subnetwork operation indicators according to a preset collection strategy and send the subset to the cloud server;

[0012] The cloud server is used to obtain a sub-network operation indicator set corresponding to the risk network mining and positioning instruction if a risk network mining and positioning instruction is detected; wherein the sub-network operation indicator subset included in the sub-network operation indicator set corresponds one-to-one to the sensor collection sub-network in the plurality of sensor collection sub-networks;

[0013] The cloud server is further used to determine, for each subnetwork operation indicator subset in the subnetwork operation indicator set, a risk network identification result corresponding to the subnetwork operation indicator subset based on a preset risk network identification strategy and subnetwork similarity information and subnetwork structure quality information in the subnetwork operation indicator subset;

[0014] The cloud server is also used to obtain the corresponding subnetwork operation indicator subset as the target subnetwork operation indicator subset if it is determined that the risk network identification result of the subnetwork operation indicator subset in the subnetwork operation indicator set meets the preset risk result condition, and to form the risk network positioning result with the sensor collection subnetwork corresponding to the target subnetwork operation indicator subset.

[0015] In a third aspect, an embodiment of the present invention further provides a computer device, which includes a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the method described in the first aspect is implemented.

[0016] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the method described in the first aspect above can be implemented.

[0017] The embodiment of the present invention provides a risk network positioning method, system and computer device based on community mining, the method comprising: each of a plurality of sensor collection subnetworks obtains a subnetwork operation indicator subset according to a preset collection strategy and sends it to a cloud server; if the cloud server detects a risk network mining positioning instruction, it obtains a subnetwork operation indicator set corresponding to the risk network mining positioning instruction; wherein the subnetwork operation indicator subset included in the subnetwork operation indicator set corresponds one-to-one to the sensor collection subnetwork in the plurality of sensor collection subnetworks; the cloud server determines, for each subnetwork operation indicator subset in the subnetwork operation indicator set, a risk network identification result corresponding to the subnetwork operation indicator subset based on a preset risk network identification strategy and subnetwork similarity information and subnetwork structure quality information in the subnetwork operation indicator subset; if the cloud server determines that there is a risk network identification result of a subnetwork operation indicator subset in the subnetwork operation indicator set that meets a preset risk result condition, then the corresponding subnetwork operation indicator subset is obtained as a target subnetwork operation indicator subset, and the sensor collection subnetwork corresponding to the target subnetwork operation indicator subset constitutes the risk network positioning result. In the embodiment of the present invention, the cloud server can quickly locate and warn the risky sensor collection subnetwork based on the risk network identification strategy and the subnetwork operation indicator subset of each sensor collection subnetwork. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0019] Figure 1 A schematic diagram of an application scenario of a risk network positioning method based on community mining provided by an embodiment of the present invention;

[0020] Figure 2 A schematic diagram of a process of a risk network location method based on community mining provided by an embodiment of the present invention;

[0021] Figure 3 A schematic diagram of a sensor collection network in a risk network positioning method based on community mining provided in an embodiment of the present invention;

[0022] Figure 4 A schematic diagram of a sub-process of a risk network positioning method based on community mining provided by an embodiment of the present invention;

[0023] Figure 5 A schematic diagram of a sub-process of a risk network positioning method based on community mining provided by an embodiment of the present invention;

[0024] Figure 6 A schematic diagram of a sub-process of a risk network positioning method based on community mining provided by an embodiment of the present invention;

[0025] Figure 7 A schematic diagram of a sub-process of a risk network positioning method based on community mining provided by an embodiment of the present invention;

[0026] Figure 8 A schematic diagram of a sensor collection network with risk network positioning results in a risk network positioning method based on community mining provided in an embodiment of the present invention;

[0027] Fig. 9 A schematic block diagram of a risk network positioning device based on community mining provided by an embodiment of the present invention;

[0028] Fig.10 A schematic block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0031] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0032] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0033] Please also refer to Figure 1 and Figure 2 ,in Figure 1 Schematic diagram of a scenario of a risk network positioning method based on community mining according to an embodiment of the present invention. Figure 2FIG. 1 is a flow chart of a risk network location method based on community mining provided by an embodiment of the present invention. Figure 1 As shown, the risk network positioning method based on community mining provided by the embodiment of the present invention is applied to a sensor collection network 1, wherein the sensor collection network 1 includes a cloud server 10 and a plurality of sensor collection sub-networks 20, and the plurality of sensor collection sub-networks 20 are communicatively connected to the cloud server 10. The cloud server 10 in the present application can be regarded as an artificial intelligence analysis center platform (i.e., an AI analysis center), which can perform network mining and positioning on whether a plurality of sensor collection sub-networks 20 have risk sensor collection sub-networks.

[0034] like Figure 2 As shown, the method includes the following steps S110-S140.

[0035] S110. Each of the plurality of sensor collection subnetworks obtains a subnetwork operation indicator subset according to a preset collection strategy, and sends the subset to the cloud server.

[0036] In this embodiment, reference can also be made to Figure 3 , each of the several sensor acquisition subnetworks 20 can obtain a subset of subnetwork operation indicators according to a preset acquisition strategy and send it to the cloud server 10. Among them, the sensor acquisition subnetwork 21 includes multiple sensor acquisition nodes, each of which is used to collect equipment status indicators at the equipment it deploys (the equipment deployed by the sensor acquisition node can be a server, user terminal, etc.), for example, equipment status indicators include CPU load rate (i.e., the load rate of the central processing unit), communication delay and other indicators. The preset acquisition strategy is a timed acquisition strategy when it is implemented, that is, each sensor acquisition node obtains equipment status indicators according to the timed acquisition cycle corresponding to the timed acquisition strategy.

[0037] After the sensor collection subnetwork 21 includes multiple sensor collection nodes that collect the equipment status indicators according to the preset collection strategy, one of the sensor collection nodes in the sensor collection subnetwork 21 can summarize and form a subnetwork operation indicator subset, and then send it to the cloud server 10. Of course, in the specific implementation, if the number of sensor collection nodes in each sensor collection subnetwork 21 is large, other methods can be considered to improve the summary to obtain the subnetwork operation indicator subset before sending it to the cloud server 10.

[0038] In one embodiment, as a sensor collection sub-network, each sub-network obtains a sub-network operation indicator subset according to a preset collection strategy and sends it to the first embodiment of the cloud server, such as Figure 4 As shown, step S110 includes:

[0039] S1101, the sensor collection sub-network acquires a plurality of sensor collection nodes, and determines a main sensor collection node among the plurality of sensor collection nodes;

[0040] S1102, the multiple sensor collection nodes all obtain subnet similarity indicators according to the first collection strategy in the preset collection strategy, and send them to the main sensor collection node, so that the main sensor collection node counts the subnet similarity indicators of the multiple sensor collection nodes to obtain subnet similarity information; wherein the similarity between the subnet similarity indicators of each sensor collection node in the sensor collection subnetwork is greater than or equal to the first similarity threshold;

[0041] S1103, the main sensor collection node determines the subnet structure quality information according to the subnet similarity index of each sensor collection node and the second collection strategy in the preset collection strategy;

[0042] S1104. The main sensor collection node combines the subnet similarity information and the subnet structure quality information into the subnet operation indicator subset, and sends it to the cloud server.

[0043] In this embodiment, when no edge gateway is set in the sensor collection network, after each sensor collection sub-network first determines all the sensor collection nodes included, a sensor collection node is determined from them and used as the main sensor collection node. For example, a main sensor collection node can be determined in the sensor collection sub-network with reference to the voting mechanism of the blockchain, or a sensor collection node with the best hardware performance in the sensor collection sub-network can be determined as the main sensor collection node. However, no matter how a main sensor collection node is determined in the sensor collection sub-network, it will subsequently serve as the data collection center in the sensor collection sub-network.

[0044] For example, a sensor collection subnetwork is recorded as the No. 1 sensor collection subnetwork, which includes N1 sensor collection nodes (N1 is a positive integer), and they are recorded as the No. 1 sensor collection node to the No. N1 sensor collection node, and the No. 1 sensor collection node is used as the main sensor collection node. After the No. 1 sensor collection node to the No. N1 sensor collection node in the No. 1 sensor collection subnetwork obtain the subnetwork similarity index according to the first collection strategy in the preset collection strategy, the No. 2 sensor collection node to the No. N1 sensor collection node sends the collected subnetwork similarity index to the No. 1 sensor collection node, and finally the No. 1 sensor collection node summarizes and counts the subnetwork similarity indicators corresponding to the No. 1 sensor collection node to the No. N1 sensor collection node, and obtains the subnetwork similarity information of the No. 1 sensor collection subnetwork. Among them, the subnet similarity index collected by each sensor collection node at least includes the CPU load rate of the current sensor collection node, the communication delay time between the current sensor collection node and the main sensor collection node (for example, its unit is ms), the time interval for the last data return from the current sensor collection node to the main sensor collection node, the node ID number of the current sensor collection node and the network ID number of the sensor collection subnetwork to which the current sensor collection node belongs, etc.

[0045] It should be noted that the reason why each sensor collection node in the No. 1 sensor collection subnetwork in the above example can form a sensor collection subnetwork is that the similarity between the subnetwork similarity indexes of each sensor collection node in the No. 1 sensor collection subnetwork is greater than or equal to the first similarity threshold. For example, when the subnetwork similarity index of the No. 2 sensor collection node in the No. 1 sensor collection subnetwork is similar to the subnetwork similarity index of the No. 3 sensor collection node, the communication delay time between the current sensor collection node and the main sensor collection node, and the time interval of the last data transmission from the current sensor collection node to the main sensor collection node can be regarded as the same features. At this time, the two sensor collection nodes are grouped into the same sensor collection subnetwork (that is, the network ID number of the sensor collection subnetwork to which the above two sensor collection nodes belong is the same). In addition, a unique node ID number is set for each sensor collection node in the No. 1 sensor collection subnetwork.

[0046] Afterwards, since the subnet similarity index of each sensor collection node in the No. 1 sensor collection subnetwork has been obtained in the No. 1 sensor collection node in the No. 1 sensor collection subnetwork, the No. 1 sensor collection node can perform analysis from the following dimensions based on the second collection strategy:

[0047] The network ID number of the current sensor collection sub-network;

[0048] The number of surviving nodes in the current sensor collection sub-network (which can be understood as the number of sensor collection nodes that have transmitted data back to the main sensor collection node within 1 minute);

[0049] The number of surviving subnet nodes 1 minute ago (which can be understood as the number of surviving subnet nodes in the current sensor collection subnet 1 minute ago. For similar descriptions below, please refer to the understanding here);

[0050] The number of subnet nodes alive 5 minutes ago;

[0051] The number of surviving subnet nodes 30 minutes ago;

[0052] The number of surviving subnet nodes 60 minutes ago;

[0053] The number of surviving subnet nodes 12 hours ago;

[0054] The number of surviving subnet nodes 24 hours ago;

[0055] The number of sensor nodes with a delay greater than 200ms in the previous minute;

[0056] The number of sensor nodes with a delay greater than 200ms in the previous 5th minute;

[0057] The number of sensor nodes with a delay greater than 200ms in the previous 30th minute;

[0058] The number of sensor nodes with a delay greater than 200ms in the previous 60th minute;

[0059] After the No. 1 sensor acquisition subnetwork performs the above analysis and processing on the subnetwork similarity index of each sensor acquisition node in the No. 1 sensor acquisition subnetwork based on the second acquisition strategy, the subnetwork structure quality information including the specific values ​​of the above dimensional parameters can be obtained.

[0060] Finally, in the main sensor acquisition node No. 1 in the sensor acquisition subnetwork No. 1, the subnetwork similarity information and the subnetwork structure quality information are combined into the subnetwork operation index subset corresponding to the sensor acquisition subnetwork No. 1, and sent to the cloud server. The above example is a process in which one sensor acquisition subnetwork acquires a subnetwork operation index subset and sends it to the cloud server. The process in which other multiple sensor acquisition subnetworks acquire subnetwork operation index subsets and send them to the cloud server also refers to the above process. It can be seen that through the above process, it is realized that after obtaining the subnetwork operation index subset in each sensor acquisition subnetwork according to the preset acquisition strategy, it is sent to the cloud server for summary data analysis.

[0061] In one embodiment, as a second embodiment in which the sensor acquisition subnetworks obtain a subset of subnetwork operation indicators according to a preset acquisition strategy and send the subset to the cloud server, the sensor acquisition network further includes an edge gateway, and the cloud server and the plurality of sensor acquisition subnetworks are all connected to the edge gateway in communication, such as Figure 5 As shown, step S110 includes:

[0062] S1111, the sensor collection sub-network acquires a plurality of sensor collection nodes included therein, and determines the edge gateway corresponding to the sensor collection sub-network;

[0063] S1112, the multiple sensor collection nodes all obtain subnet similarity indicators according to the third collection strategy in the preset collection strategy, and send them to the edge gateway, so that the edge gateway counts the subnet similarity indicators of the multiple sensor collection nodes to obtain subnet similarity information; wherein the similarity between the subnet similarity indicators of each sensor collection node in the sensor collection subnetwork is greater than or equal to the second similarity threshold;

[0064] After step S1112, the method further includes:

[0065] S1113, the edge gateway determines the subnet structure quality information according to the subnet similarity index of each sensor collection node in the sensor collection subnet and the fourth collection strategy in the preset collection strategy;

[0066] S1114. The edge gateway combines the subnet similarity information and the subnet structure quality information into the subnet operation indicator subset, and sends it to the cloud server.

[0067] In this embodiment, when an edge gateway is set in the sensor acquisition network, after the sensor acquisition subnetwork first determines all the sensor acquisition nodes included, it can also determine the edge gateway corresponding to the sensor acquisition subnetwork for communication connection as the data collection center in the sensor acquisition subnetwork. The edge gateway has the same function as the main sensor acquisition node in the first embodiment of step S110, and the specific data collection processing process can also refer to the above process. The above embodiment is a process in which a sensor acquisition subnetwork collects a subset of subnetwork operation indicators based on the edge gateway and sends it to the cloud server. The process in which other multiple sensor acquisition subnetworks collect a subset of subnetwork operation indicators based on the edge gateway and send it to the cloud server also refers to the above process. It can be seen that through the above process, the subnet similarity index and the subnet structure quality index are obtained in each sensor acquisition subnetwork according to the preset acquisition strategy, and the subnetwork operation indicator subset is obtained after being aggregated and processed in the edge gateway, and then sent to the cloud server for aggregated data analysis.

[0068] Among them, the third acquisition strategy in the second embodiment of step S110 may be the same as the first acquisition strategy in the first embodiment of step S110, and the fourth acquisition strategy in the second embodiment of step S110 may be the same as the second acquisition strategy in the first embodiment of step S110.

[0069] S120: If the cloud server detects a risk network mining and locating instruction, it obtains a sub-network operation indicator set corresponding to the risk network mining and locating instruction.

[0070] The sub-network operation indicator subsets included in the sub-network operation indicator set correspond one-to-one to the sensor collection sub-networks in the plurality of sensor collection sub-networks.

[0071] In this embodiment, since the cloud server is continuously receiving the sub-network operation indicator subsets uploaded by each sensor collection sub-network, after the risk network mining and positioning instruction is triggered in the cloud server, it means that it is necessary to perform network mining and positioning in the cloud server to determine whether there are risky sensor collection sub-networks in the several sensor collection sub-networks. Since the sub-network operation indicator subsets corresponding to the several sensor collection sub-networks have been pre-transmitted to the cloud server for summary storage, the server can form the sub-network operation indicator set with the sub-network operation indicator subsets corresponding to the several sensor collection sub-networks, which is used as all the data for subsequent data analysis.

[0072] There are many ways to generate risk network mining and locating instructions in the cloud server. For example, the first way is to set a mining and locating instruction generation cycle in the cloud service. When the time interval between the current system time and the last time a risk network mining and locating instruction was generated is equal to the mining and locating instruction generation cycle, the risk network mining and locating instruction is automatically triggered; the second way is to generate risk network mining and locating instructions in response to manual operations of cloud server operation and maintenance personnel. Of course, in specific implementation, other ways can also be flexibly set to trigger the generation of risk network mining and locating instructions, which is not limited to the above examples.

[0073] In one embodiment, step S120 includes:

[0074] If it is determined that each of the plurality of sensor acquisition subnetworks has a connection relationship with the cloud server that currently maintains a communication connection or has historically established a communication connection, then a subnetwork operation indicator subset of each of the plurality of sensor acquisition subnetworks is obtained to form the subnetwork operation indicator set.

[0075] In this embodiment, if it is determined that each of the several sensor acquisition subnetworks has a connection relationship with the cloud server that currently maintains a communication connection or has historically established a communication connection, it means that risk network mining and positioning can be performed on each of the above-mentioned types of sensor acquisition subnetworks in the cloud server. At this time, the cloud server needs to form the subnetwork operation indicator set with the subset of subnetwork operation indicators of each of the above-mentioned types of sensor acquisition subnetworks that have been sent to the cloud server, which will be used as all the data for subsequent data analysis.

[0076] S130. The cloud server determines, for each subnetwork operation indicator subset in the subnetwork operation indicator set, a risk network identification result corresponding to the subnetwork operation indicator subset based on a preset risk network identification strategy and subnetwork similarity information and subnetwork structure quality information in the subnetwork operation indicator subset.

[0077] In this embodiment, since the process of determining the risk network identification result based on the risk network identification strategy for each sub-network operation indicator subset in the cloud server is the same, the process of determining the risk network identification result based on the risk network identification strategy for a sub-network operation indicator subset by the cloud server is taken as an example to illustrate.

[0078] Still referring to the above example, after the cloud server obtains the No. 1 subnetwork operation indicator subset corresponding to the No. 1 sensor acquisition subnetwork, it can specifically obtain the subnetwork similarity information and subnetwork structure quality information in the No. 1 subnetwork operation indicator subset, and use them as input parameters of the risk network identification strategy to obtain the No. 1 risk network identification result corresponding to the No. 1 subnetwork operation indicator subset. It can be seen that the risk network identification strategy can be intelligently called in the cloud server to detect and locate the risk network through the above method.

[0079] In one embodiment, as a first embodiment of step S130, as Figure 6 As shown, step S130 includes:

[0080] S1301, obtaining subnetwork similarity information and subnetwork structure quality information in the subnetwork operation indicator subset to form subnetwork feature data corresponding to the subnetwork operation indicator subset;

[0081] S1302: Input the sub-network characteristic data into the risk network identification strategy to obtain a risk network identification result corresponding to the sub-network operation indicator subset.

[0082] In this embodiment, if the risk network identification strategy is a convolutional neural network with classification and identification functions as an example, the subnetwork similarity information and the subnetwork structure quality information in the subnetwork operation indicator subset can be obtained first to form subnetwork feature data corresponding to the subnetwork operation indicator subset.

[0083] Specifically, the CPU load rate of the current sensor acquisition node, the communication delay time between the current sensor acquisition node and the main sensor acquisition node, and the time interval for the last data transmission from the current sensor acquisition node to the main sensor acquisition node in the subnet similarity information can be obtained, and the number of surviving nodes of the current sensor acquisition subnetwork, the number of surviving subnet nodes 1 minute ago, the number of surviving subnet nodes 5 minutes ago, the number of surviving subnet nodes 30 minutes ago, the number of surviving subnet nodes 60 minutes ago, the number of surviving subnet nodes 12 hours ago, the number of surviving subnet nodes 24 hours ago, the number of sensor nodes with a delay greater than 200ms in the previous 1 minute, the number of sensor nodes with a delay greater than 200ms in the previous 5th minute, the number of sensor nodes with a delay greater than 200ms in the previous 30th minute, and the number of sensor nodes with a delay greater than 200ms in the previous 60th minute in the subnet structure quality information can be obtained, so as to form subnetwork feature data corresponding to the subnetwork operation indicator subset using the above indicator parameters (specifically, it can be in the form of a row vector, and each vector included therein corresponds to one of the above indicator parameters). Then, the sub-network feature data is input into the risk network identification strategy to obtain the risk network identification result corresponding to the sub-network operation indicator subset. It can be seen that the risk network identification strategy based on the above neural network form can quickly determine the risk network identification result corresponding to the sub-network operation indicator subset.

[0084] In one embodiment, as a second embodiment of step S130, as Figure 7 As shown, step S130 includes:

[0085] S1311, obtaining risk network warning indicator items in the risk network identification strategy;

[0086] S1312. Based on the subnet similarity information and subnet structure quality information in the subnet operation indicator subset, determine the value of each risk network warning indicator item in the risk network identification strategy to form a risk network identification result corresponding to the subnet operation indicator subset.

[0087] In this embodiment, if multiple risk network warning indicator items are specifically set in the risk network identification strategy as an example, the subnet similarity information and subnet structure quality information in the subnet operation indicator subset can be obtained, and then the value of each risk network warning indicator item is obtained according to the specific calculation formula of each risk network warning indicator item in the risk network identification strategy, and a risk network identification result corresponding to the subnet operation indicator subset is formed.

[0088] For example, the risk network identification strategy specifically sets a number of risk network warning indicators as follows:

[0089] Whether the CPU load rate of the current sensor collection node exceeds 80%;

[0090] Whether the communication delay between the current sensor collection node and the main sensor collection node (or edge gateway) exceeds 5000ms;

[0091] Whether the last data transmission time interval of the current sensor collection node exceeds 60000ms;

[0092] Whether the 1-minute survival rate of the subnet nodes of the sensor collection subnet is less than 95% (wherein, the 1-minute survival rate of the subnet nodes of the sensor collection subnet = the current number of surviving subnet nodes of the sensor collection subnet / the number of surviving subnet nodes 1 minute ago);

[0093] Whether the continuous node survival rate of the subnet nodes of the sensor collection subnet is less than 90% (wherein, the continuous node survival rate of the subnet nodes of the sensor collection subnet = the current number of surviving subnet nodes of the sensor collection subnet / the number of surviving subnet nodes 5 minutes ago);

[0094] Whether the 30-minute node survival rate of the subnet nodes of the sensor collection subnet is less than 80% (wherein, the 30-minute node survival rate of the subnet nodes of the sensor collection subnet = the current number of surviving subnet nodes of the sensor collection subnet / the number of surviving subnet nodes 30 minutes ago);

[0095] Whether the 60-minute node survival rate of the subnet nodes of the sensor collection subnet is less than 75% (wherein, the 60-minute node survival rate of the subnet nodes of the sensor collection subnet = the current number of surviving subnet nodes of the sensor collection subnet / the number of surviving subnet nodes 60 minutes ago);

[0096] Whether the 12-hour node survival rate of the subnet nodes of the sensor collection subnet is less than 60% (wherein, the 12-hour node survival rate of the subnet nodes of the sensor collection subnet = the current number of surviving subnet nodes of the sensor collection subnet / the number of surviving subnet nodes 12 hours ago);

[0097] Whether the 24-hour node survival rate of the subnet nodes of the sensor collection subnet is less than 50% (wherein, the 24-hour node survival rate of the subnet nodes of the sensor collection subnet = the current number of surviving subnet nodes of the sensor collection subnet / the number of surviving subnet nodes 24 hours ago);

[0098] Whether the coverage rate of the number of nodes with a one-minute delay in the subnet nodes of the sensor collection subnet is greater than 2% (wherein, the coverage rate of the number of nodes with a one-minute delay in the subnet nodes of the sensor collection subnet = the number of sensor nodes with a delay greater than 200ms in the previous minute of the sensor collection subnet / the number of surviving subnet nodes in the current sensor collection subnet);

[0099] Whether the coverage rate of the number of nodes with a 5-minute delay in the subnet nodes of the sensor collection subnet is greater than 5% (wherein, the coverage rate of the number of nodes with a 5-minute delay in the subnet nodes of the sensor collection subnet = the number of sensor nodes with a delay greater than 200ms in the previous 5 minutes of the sensor collection subnet / the number of surviving subnet nodes in the current sensor collection subnet);

[0100] Whether the coverage rate of the number of nodes with a 30-minute delay in the subnet nodes of the sensor collection subnet is greater than 10% (wherein, the coverage rate of the number of nodes with a 30-minute delay in the subnet nodes of the sensor collection subnet = the number of sensor nodes with a delay greater than 200ms in the previous 30 minutes of the sensor collection subnet / the number of surviving subnet nodes in the current sensor collection subnet);

[0101] Whether the coverage rate of the number of nodes with a 60-minute delay in the subnet nodes of the sensor collection subnet is greater than 15% (wherein, the coverage rate of the number of nodes with a 60-minute delay in the subnet nodes of the sensor collection subnet = the number of sensor nodes with a delay greater than 200ms in the previous 60 minutes of the sensor collection subnet / the number of surviving subnet nodes in the current sensor collection subnet);

[0102] The values ​​of each risk network warning indicator item in the risk network identification strategy are determined separately (for example, the values ​​of the risk network warning indicator items are all one of 0 or 1, when the value of the risk network warning indicator item is 1, it means that the risk network warning indicator item meets the corresponding judgment condition, and when the value of the risk network warning indicator item is 0, it means that the risk network warning indicator item does not meet the corresponding judgment condition), to form a risk network identification result corresponding to the sub-network operation indicator subset. It can be seen that based on the risk network identification strategy in the form of the above-mentioned risk network warning indicator items, the risk network identification result corresponding to the sub-network operation indicator subset can be quickly determined.

[0103] S140. If the cloud server determines that there is a risk network identification result of a subnetwork operation indicator subset in the subnetwork operation indicator set that meets the preset risk result condition, the corresponding subnetwork operation indicator subset is obtained as the target subnetwork operation indicator subset, and the risk network positioning result is composed of the sensor collection subnetwork corresponding to the target subnetwork operation indicator subset.

[0104] In this embodiment, when it is determined in the cloud server that the risk network identification result corresponding to the subnetwork operation indicator subset of at least one sensor collection subnetwork among several sensor collection subnetworks meets the preset risk result condition, it means that the sensor collection subnetwork is a risk network detected by the cloud server, and the risk network positioning result is directly formed with the sensor collection subnetwork. Figure 8 As shown, in Figure 3The risk network positioning result obtained by performing risk network positioning in the sensor collection network shown can be output and displayed in the cloud server. Among them, the preset risk result condition is that the risk network identification result is greater than the preset risk identification result threshold, or the risk network identification result is the same as the preset risk network early warning indicator standard item. It can be seen that based on the above method, the cloud server can quickly locate the sensor collection subnetwork with risks. Moreover, through the subnet-level group analysis method, it is possible to analyze the change trend in advance and realize the early discovery of subnet risks.

[0105] In one embodiment, after step S140, the method further includes:

[0106] The cloud server disconnects the sensor collection subnetworks included in the risk network positioning result respectively;

[0107] The cloud server obtains subnetwork recovery information for each of the sensor collection subnetworks included in the risk network positioning result, and if the subnetwork recovery information of the sensor collection subnetwork is a successful recovery result, the connection relationship with the corresponding sensor collection subnetwork is restored.

[0108] In this embodiment, after the sensor acquisition sub-network included in the risk network positioning result is determined in the cloud server, not only does the cloud server need to be disconnected from the above sensor acquisition sub-network to ensure the network security of the cloud server, but the sensor acquisition sub-network that does not belong to the risk network positioning result can also be disconnected from the above sensor acquisition sub-network to ensure the network security of the sub-network.

[0109] Afterwards, the cloud server can also continue to monitor whether the sensor collection sub-network included in the risk network positioning result has returned to normal. If the cloud server has successfully restored the normal information of the sub-network with the sensor collection sub-network, it will restore the connection relationship with the corresponding sensor collection sub-network. Through the above method, the cloud server can not only disconnect the risky sensor collection sub-network in time, but also quickly restore the connection relationship after it returns to normal.

[0110] It can be seen that the embodiment of the method can enable the cloud server to quickly locate and warn the risky sensor collection subnetwork based on the risk network identification strategy and the subnetwork operation indicator subset of each sensor collection subnetwork.

[0111] Fig. 9 FIG. 1 is a schematic block diagram of a risk network positioning system based on community mining provided by an embodiment of the present invention. Fig. 9As shown, corresponding to the above risk network positioning method based on community mining, the present invention also provides a risk network positioning system 100 based on community mining. The risk network positioning system 100 based on community mining includes: a cloud server 10 and a plurality of sensor collection sub-networks 20, wherein the plurality of sensor collection sub-networks 20 are communicatively connected with the cloud server 10.

[0112] Each of the plurality of sensor collection sub-networks 20 is used to obtain a subset of sub-network operation indicators according to a preset collection strategy and send the subset to the cloud server.

[0113] In this embodiment, reference can also be made to Figure 3 , each of the several sensor acquisition subnetworks 20 can obtain a subset of subnetwork operation indicators according to a preset acquisition strategy and send it to the cloud server 10. Among them, the sensor acquisition subnetwork 21 includes multiple sensor acquisition nodes, each of which is used to collect equipment status indicators at the equipment it deploys (the equipment deployed by the sensor acquisition node can be a server, user terminal, etc.), for example, equipment status indicators include CPU load rate (i.e., the load rate of the central processing unit), communication delay and other indicators. The preset acquisition strategy is a timed acquisition strategy when it is implemented, that is, each sensor acquisition node obtains equipment status indicators according to the timed acquisition cycle corresponding to the timed acquisition strategy.

[0114] After the sensor collection subnetwork 21 includes multiple sensor collection nodes that collect the equipment status indicators according to the preset collection strategy, one of the sensor collection nodes in the sensor collection subnetwork 21 can summarize and form a subnetwork operation indicator subset, and then send it to the cloud server 10. Of course, in the specific implementation, if the number of sensor collection nodes in each sensor collection subnetwork 21 is large, other methods can be considered to improve the summary to obtain the subnetwork operation indicator subset before sending it to the cloud server 10.

[0115] In one embodiment, as a first embodiment in which the sensor collection subnetworks obtain a subset of subnetwork operation indicators according to a preset collection strategy and send the subset to the cloud server, the sensor collection subnetwork is specifically used for:

[0116] The sensor collection sub-network acquires a plurality of sensor collection nodes included therein, and determines a main sensor collection node among the plurality of sensor collection nodes;

[0117] The multiple sensor acquisition nodes all obtain subnet similarity indicators according to the first acquisition strategy in the preset acquisition strategy, and send them to the main sensor acquisition node, so that the main sensor acquisition node counts the subnet similarity indicators of the multiple sensor acquisition nodes to obtain subnet similarity information; wherein the similarity between the subnet similarity indicators of each sensor acquisition node in the sensor acquisition subnetwork is greater than or equal to the first similarity threshold;

[0118] The main sensor collection node determines the subnet structure quality information according to the subnet similarity index of each sensor collection node and the second collection strategy in the preset collection strategy;

[0119] The main sensor collection node combines the subnet similarity information and the subnet structure quality information into the subnet operation indicator subset, and sends it to the cloud server.

[0120] In this embodiment, when no edge gateway is set in the sensor collection network, after each sensor collection sub-network first determines all the sensor collection nodes included, a sensor collection node is determined from them and used as the main sensor collection node. For example, a main sensor collection node can be determined in the sensor collection sub-network with reference to the voting mechanism of the blockchain, or a sensor collection node with the best hardware performance in the sensor collection sub-network can be determined as the main sensor collection node. However, no matter how a main sensor collection node is determined in the sensor collection sub-network, it will subsequently serve as the data collection center in the sensor collection sub-network.

[0121] For example, a sensor collection subnetwork is recorded as the No. 1 sensor collection subnetwork, which includes N1 sensor collection nodes (N1 is a positive integer), and they are recorded as the No. 1 sensor collection node to the No. N1 sensor collection node, and the No. 1 sensor collection node is used as the main sensor collection node. After the No. 1 sensor collection node to the No. N1 sensor collection node in the No. 1 sensor collection subnetwork obtain the subnetwork similarity index according to the first collection strategy in the preset collection strategy, the No. 2 sensor collection node to the No. N1 sensor collection node sends the collected subnetwork similarity index to the No. 1 sensor collection node, and finally the No. 1 sensor collection node summarizes and counts the subnetwork similarity indicators corresponding to the No. 1 sensor collection node to the No. N1 sensor collection node, and obtains the subnetwork similarity information of the No. 1 sensor collection subnetwork. Among them, the subnet similarity index collected by each sensor collection node at least includes the CPU load rate of the current sensor collection node, the communication delay time between the current sensor collection node and the main sensor collection node (for example, its unit is ms), the time interval for the last data return from the current sensor collection node to the main sensor collection node, the node ID number of the current sensor collection node and the network ID number of the sensor collection subnetwork to which the current sensor collection node belongs, etc.

[0122] It should be noted that the reason why each sensor collection node in the No. 1 sensor collection subnetwork in the above example can form a sensor collection subnetwork is that the similarity between the subnetwork similarity indexes of each sensor collection node in the No. 1 sensor collection subnetwork is greater than or equal to the first similarity threshold. For example, when the subnetwork similarity index of the No. 2 sensor collection node in the No. 1 sensor collection subnetwork is similar to the subnetwork similarity index of the No. 3 sensor collection node, the communication delay time between the current sensor collection node and the main sensor collection node, and the time interval of the last data transmission from the current sensor collection node to the main sensor collection node can be regarded as the same features. At this time, the two sensor collection nodes are grouped into the same sensor collection subnetwork (that is, the network ID number of the sensor collection subnetwork to which the above two sensor collection nodes belong is the same). In addition, a unique node ID number is set for each sensor collection node in the No. 1 sensor collection subnetwork.

[0123] Afterwards, since the subnet similarity index of each sensor collection node in the No. 1 sensor collection subnetwork has been obtained in the No. 1 sensor collection node in the No. 1 sensor collection subnetwork, the No. 1 sensor collection node can perform analysis from the following dimensions based on the second collection strategy:

[0124] The network ID number of the current sensor collection sub-network;

[0125] The number of surviving nodes in the current sensor collection sub-network (which can be understood as the number of sensor collection nodes that have transmitted data back to the main sensor collection node within 1 minute);

[0126] The number of surviving subnet nodes 1 minute ago (which can be understood as the number of surviving subnet nodes in the current sensor collection subnet 1 minute ago. For similar descriptions below, please refer to the understanding here);

[0127] The number of subnet nodes alive 5 minutes ago;

[0128] The number of surviving subnet nodes 30 minutes ago;

[0129] The number of surviving subnet nodes 60 minutes ago;

[0130] The number of surviving subnet nodes 12 hours ago;

[0131] The number of surviving subnet nodes 24 hours ago;

[0132] The number of sensor nodes with a delay greater than 200ms in the previous minute;

[0133] The number of sensor nodes with a delay greater than 200ms in the previous 5th minute;

[0134] The number of sensor nodes with a delay greater than 200ms in the previous 30th minute;

[0135] The number of sensor nodes with a delay greater than 200ms in the previous 60th minute;

[0136] After the No. 1 sensor acquisition subnetwork performs the above analysis and processing on the subnetwork similarity index of each sensor acquisition node in the No. 1 sensor acquisition subnetwork based on the second acquisition strategy, the subnetwork structure quality information including the specific values ​​of the above dimensional parameters can be obtained.

[0137] Finally, in the main sensor acquisition node No. 1 in the sensor acquisition subnetwork No. 1, the subnetwork similarity information and the subnetwork structure quality information are combined into the subnetwork operation index subset corresponding to the sensor acquisition subnetwork No. 1, and sent to the cloud server. The above example is a process in which one sensor acquisition subnetwork acquires a subnetwork operation index subset and sends it to the cloud server. The process in which other multiple sensor acquisition subnetworks acquire subnetwork operation index subsets and send them to the cloud server also refers to the above process. It can be seen that through the above process, it is realized that after obtaining the subnetwork operation index subset in each sensor acquisition subnetwork according to the preset acquisition strategy, it is sent to the cloud server for summary data analysis.

[0138] In one embodiment, as a second embodiment in which the sensor acquisition subnetworks all obtain a subset of subnetwork operation indicators according to a preset acquisition strategy and send them to the cloud server, the sensor acquisition network also includes an edge gateway, the cloud server and the plurality of sensor acquisition subnetworks are all connected to the edge gateway in communication, and the sensor acquisition subnetwork is specifically used for:

[0139] The sensor collection sub-network acquires a plurality of sensor collection nodes included therein, and determines the edge gateway corresponding to the sensor collection sub-network;

[0140] The multiple sensor collection nodes all obtain subnet similarity indicators according to the third collection strategy in the preset collection strategy, and send them to the edge gateway, so that the edge gateway counts the subnet similarity indicators of the multiple sensor collection nodes to obtain subnet similarity information; wherein the similarity between the subnet similarity indicators of each sensor collection node in the sensor collection subnetwork is greater than or equal to the second similarity threshold;

[0141] The edge gateway is also specifically used for:

[0142] The edge gateway determines the subnet structure quality information according to the subnet similarity index of each sensor collection node in the sensor collection subnet and the fourth collection strategy in the preset collection strategy;

[0143] The edge gateway combines the subnet similarity information and the subnet structure quality information into the subnet operation indicator subset and sends it to the cloud server.

[0144] In this embodiment, when an edge gateway is set in the sensor acquisition network, after the sensor acquisition subnetwork first determines all the sensor acquisition nodes included, it can also determine the edge gateway corresponding to the communication connection of the sensor acquisition subnetwork as the data collection center in the sensor acquisition subnetwork. The edge gateway has the same function as the main sensor acquisition node, and the specific data collection processing process can also refer to the above process. The above embodiment is a process in which a sensor acquisition subnetwork collects a subset of subnetwork operation indicators based on the edge gateway and sends it to the cloud server. The process in which other multiple sensor acquisition subnetworks collect a subset of subnetwork operation indicators based on the edge gateway and send it to the cloud server also refers to the above process. It can be seen that through the above process, the subnet similarity index and the subnet structure quality index are obtained in each sensor acquisition subnetwork according to the preset acquisition strategy, and the subnetwork operation indicator subset is obtained after being aggregated and processed in the edge gateway, and then sent to the cloud server for aggregated data analysis.

[0145] The third acquisition strategy may be the same as the first acquisition strategy, and the fourth acquisition strategy may be the same as the second acquisition strategy.

[0146] The cloud server 10 is used to obtain a sub-network operation indicator set corresponding to the risk network mining and positioning instruction if a risk network mining and positioning instruction is detected.

[0147] The sub-network operation indicator subsets included in the sub-network operation indicator set correspond one-to-one to the sensor collection sub-networks in the plurality of sensor collection sub-networks.

[0148] In this embodiment, since the cloud server is continuously receiving the sub-network operation indicator subsets uploaded by each sensor collection sub-network, after the risk network mining and positioning instruction is triggered in the cloud server, it means that it is necessary to perform network mining and positioning in the cloud server to determine whether there are risky sensor collection sub-networks in the several sensor collection sub-networks. Since the sub-network operation indicator subsets corresponding to the several sensor collection sub-networks have been pre-transmitted to the cloud server for summary storage, the server can form the sub-network operation indicator set with the sub-network operation indicator subsets corresponding to the several sensor collection sub-networks, which is used as all the data for subsequent data analysis.

[0149] There are many ways to generate risk network mining and locating instructions in the cloud server. For example, the first way is to set a mining and locating instruction generation cycle in the cloud service. When the time interval between the current system time and the last time a risk network mining and locating instruction was generated is equal to the mining and locating instruction generation cycle, the risk network mining and locating instruction is automatically triggered; the second way is to generate risk network mining and locating instructions in response to manual operations of cloud server operation and maintenance personnel. Of course, in specific implementation, other ways can also be flexibly set to trigger the generation of risk network mining and locating instructions, which is not limited to the above examples.

[0150] In one embodiment, the cloud server 10 is specifically used for:

[0151] If it is determined that each of the plurality of sensor acquisition subnetworks has a connection relationship with the cloud server that currently maintains a communication connection or has historically established a communication connection, then a subnetwork operation indicator subset of each of the plurality of sensor acquisition subnetworks is obtained to form the subnetwork operation indicator set.

[0152] In this embodiment, if it is determined that each of the several sensor acquisition subnetworks has a connection relationship with the cloud server that currently maintains a communication connection or has historically established a communication connection, it means that risk network mining and positioning can be performed on each of the above-mentioned types of sensor acquisition subnetworks in the cloud server. At this time, the cloud server needs to form the subnetwork operation indicator set with the subset of subnetwork operation indicators of each of the above-mentioned types of sensor acquisition subnetworks that have been sent to the cloud server, which will be used as all the data for subsequent data analysis.

[0153] The cloud server 10 is also used to determine, for each subnetwork operation indicator subset in the subnetwork operation indicator set, a risk network identification result corresponding to the subnetwork operation indicator subset based on a preset risk network identification strategy and subnetwork similarity information and subnetwork structure quality information in the subnetwork operation indicator subset.

[0154] In this embodiment, since the process of determining the risk network identification result based on the risk network identification strategy for each sub-network operation indicator subset in the cloud server is the same, the process of determining the risk network identification result based on the risk network identification strategy for a sub-network operation indicator subset by the cloud server is taken as an example to illustrate.

[0155] Still referring to the above example, after the cloud server obtains the No. 1 subnetwork operation indicator subset corresponding to the No. 1 sensor acquisition subnetwork, it can specifically obtain the subnetwork similarity information and subnetwork structure quality information in the No. 1 subnetwork operation indicator subset, and use them as input parameters of the risk network identification strategy to obtain the No. 1 risk network identification result corresponding to the No. 1 subnetwork operation indicator subset. It can be seen that the risk network identification strategy can be intelligently called in the cloud server to detect and locate the risk network through the above method.

[0156] In one embodiment, the cloud server 10 is specifically used for:

[0157] Acquire the subnetwork similarity information and the subnetwork structure quality information in the subnetwork operation indicator subset to form subnetwork feature data corresponding to the subnetwork operation indicator subset;

[0158] The sub-network characteristic data is input into the risk network identification strategy to obtain a risk network identification result corresponding to the sub-network operation indicator subset.

[0159] In this embodiment, if the risk network identification strategy is a convolutional neural network with classification and identification functions as an example, the subnetwork similarity information and the subnetwork structure quality information in the subnetwork operation indicator subset can be obtained first to form subnetwork feature data corresponding to the subnetwork operation indicator subset.

[0160] Specifically, the CPU load rate of the current sensor acquisition node, the communication delay time between the current sensor acquisition node and the main sensor acquisition node, and the time interval for the last data transmission from the current sensor acquisition node to the main sensor acquisition node in the subnet similarity information can be obtained, and the number of surviving nodes of the current sensor acquisition subnetwork, the number of surviving subnet nodes 1 minute ago, the number of surviving subnet nodes 5 minutes ago, the number of surviving subnet nodes 30 minutes ago, the number of surviving subnet nodes 60 minutes ago, the number of surviving subnet nodes 12 hours ago, the number of surviving subnet nodes 24 hours ago, the number of sensor nodes with a delay greater than 200ms in the previous 1 minute, the number of sensor nodes with a delay greater than 200ms in the previous 5th minute, the number of sensor nodes with a delay greater than 200ms in the previous 30th minute, and the number of sensor nodes with a delay greater than 200ms in the previous 60th minute in the subnet structure quality information can be obtained, so as to form subnetwork feature data corresponding to the subnetwork operation indicator subset using the above indicator parameters (specifically, it can be in the form of a row vector, and each vector included therein corresponds to one of the above indicator parameters). Then, the sub-network feature data is input into the risk network identification strategy to obtain the risk network identification result corresponding to the sub-network operation indicator subset. It can be seen that the risk network identification strategy based on the above neural network form can quickly determine the risk network identification result corresponding to the sub-network operation indicator subset.

[0161] In one embodiment, the cloud server 10 is specifically used for:

[0162] Obtain risk network warning indicator items in the risk network identification strategy;

[0163] Based on the subnet similarity information and subnet structure quality information in the subnet operation indicator subset, the value of each risk network early warning indicator item in the risk network identification strategy is determined to form a risk network identification result corresponding to the subnet operation indicator subset.

[0164] In this embodiment, if multiple risk network warning indicator items are specifically set in the risk network identification strategy as an example, the subnet similarity information and subnet structure quality information in the subnet operation indicator subset can be obtained, and then the value of each risk network warning indicator item is obtained according to the specific calculation formula of each risk network warning indicator item in the risk network identification strategy, and a risk network identification result corresponding to the subnet operation indicator subset is formed.

[0165] For example, the risk network identification strategy specifically sets a number of risk network warning indicators as follows:

[0166] Whether the CPU load rate of the current sensor collection node exceeds 80%;

[0167] Whether the communication delay between the current sensor collection node and the main sensor collection node (or edge gateway) exceeds 5000ms;

[0168] Whether the last data transmission time interval of the current sensor collection node exceeds 60000ms;

[0169] Whether the 1-minute survival rate of the subnet nodes of the sensor collection subnet is less than 95% (wherein, the 1-minute survival rate of the subnet nodes of the sensor collection subnet = the current number of surviving subnet nodes of the sensor collection subnet / the number of surviving subnet nodes 1 minute ago);

[0170] Whether the continuous node survival rate of the subnet nodes of the sensor collection subnet is less than 90% (wherein, the continuous node survival rate of the subnet nodes of the sensor collection subnet = the current number of surviving subnet nodes of the sensor collection subnet / the number of surviving subnet nodes 5 minutes ago);

[0171] Whether the 30-minute node survival rate of the subnet nodes of the sensor collection subnet is less than 80% (wherein, the 30-minute node survival rate of the subnet nodes of the sensor collection subnet = the current number of surviving subnet nodes of the sensor collection subnet / the number of surviving subnet nodes 30 minutes ago);

[0172] Whether the 60-minute node survival rate of the subnet nodes of the sensor collection subnet is less than 75% (wherein, the 60-minute node survival rate of the subnet nodes of the sensor collection subnet = the current number of surviving subnet nodes of the sensor collection subnet / the number of surviving subnet nodes 60 minutes ago);

[0173] Whether the 12-hour node survival rate of the subnet nodes of the sensor collection subnet is less than 60% (wherein, the 12-hour node survival rate of the subnet nodes of the sensor collection subnet = the current number of surviving subnet nodes of the sensor collection subnet / the number of surviving subnet nodes 12 hours ago);

[0174] Whether the 24-hour node survival rate of the subnet nodes of the sensor collection subnet is less than 50% (wherein, the 24-hour node survival rate of the subnet nodes of the sensor collection subnet = the current number of surviving subnet nodes of the sensor collection subnet / the number of surviving subnet nodes 24 hours ago);

[0175] Whether the coverage rate of the number of nodes with a one-minute delay in the subnet nodes of the sensor collection subnet is greater than 2% (wherein, the coverage rate of the number of nodes with a one-minute delay in the subnet nodes of the sensor collection subnet = the number of sensor nodes with a delay greater than 200ms in the previous minute of the sensor collection subnet / the number of surviving subnet nodes in the current sensor collection subnet);

[0176] Whether the coverage rate of the number of nodes with a 5-minute delay in the subnet nodes of the sensor collection subnet is greater than 5% (wherein, the coverage rate of the number of nodes with a 5-minute delay in the subnet nodes of the sensor collection subnet = the number of sensor nodes with a delay greater than 200ms in the previous 5 minutes of the sensor collection subnet / the number of surviving subnet nodes in the current sensor collection subnet);

[0177] Whether the coverage rate of the number of nodes with a 30-minute delay in the subnet nodes of the sensor collection subnet is greater than 10% (wherein, the coverage rate of the number of nodes with a 30-minute delay in the subnet nodes of the sensor collection subnet = the number of sensor nodes with a delay greater than 200ms in the previous 30 minutes of the sensor collection subnet / the number of surviving subnet nodes in the current sensor collection subnet);

[0178] Whether the coverage rate of the number of nodes with a 60-minute delay in the subnet nodes of the sensor collection subnet is greater than 15% (wherein, the coverage rate of the number of nodes with a 60-minute delay in the subnet nodes of the sensor collection subnet = the number of sensor nodes with a delay greater than 200ms in the previous 60 minutes of the sensor collection subnet / the number of surviving subnet nodes in the current sensor collection subnet);

[0179] The values ​​of each risk network warning indicator item in the risk network identification strategy are determined separately (for example, the values ​​of the risk network warning indicator items are all one of 0 or 1, when the value of the risk network warning indicator item is 1, it means that the risk network warning indicator item meets the corresponding judgment condition, and when the value of the risk network warning indicator item is 0, it means that the risk network warning indicator item does not meet the corresponding judgment condition), to form a risk network identification result corresponding to the sub-network operation indicator subset. It can be seen that based on the risk network identification strategy in the form of the above-mentioned risk network warning indicator items, the risk network identification result corresponding to the sub-network operation indicator subset can be quickly determined.

[0180] The cloud server 10 is also used to obtain the corresponding subnetwork operation indicator subset as the target subnetwork operation indicator subset if it is determined that the risk network identification result of the subnetwork operation indicator subset in the subnetwork operation indicator set meets the preset risk result condition, and to form the risk network positioning result with the sensor collection subnetwork corresponding to the target subnetwork operation indicator subset.

[0181] In this embodiment, when it is determined in the cloud server that the risk network identification result corresponding to the subnetwork operation indicator subset of at least one sensor collection subnetwork among several sensor collection subnetworks meets the preset risk result condition, it means that the sensor collection subnetwork is a risk network detected by the cloud server, and the risk network positioning result is directly formed with the sensor collection subnetwork. Figure 8 As shown, in Figure 3 The risk network positioning result obtained by performing risk network positioning in the sensor collection network shown can be output and displayed in the cloud server. Among them, the preset risk result condition is that the risk network identification result is greater than the preset risk identification result threshold, or the risk network identification result is the same as the preset risk network early warning indicator standard item. It can be seen that based on the above method, the cloud server can quickly locate the sensor collection subnetwork with risks. Moreover, through the subnet-level group analysis method, it is possible to analyze the change trend in advance and realize the early discovery of subnet risks.

[0182] In one embodiment, the cloud server 10 is further used for:

[0183] Disconnecting the sensor collection sub-networks included in the risk network positioning result respectively;

[0184] Subnetwork restoration information is obtained for each of the sensor collection subnetworks included in the risk network positioning result, and if the subnetwork restoration information of the sensor collection subnetwork is a successful restoration result, the connection relationship with the corresponding sensor collection subnetwork is restored.

[0185] In this embodiment, after the sensor acquisition sub-network included in the risk network positioning result is determined in the cloud server, not only does the cloud server need to be disconnected from the above sensor acquisition sub-network to ensure the network security of the cloud server, but the sensor acquisition sub-network that does not belong to the risk network positioning result can also be disconnected from the above sensor acquisition sub-network to ensure the network security of the sub-network.

[0186] Afterwards, the cloud server can also continue to monitor whether the sensor collection sub-network included in the risk network positioning result has returned to normal. If the cloud server has successfully restored the normal information of the sub-network with the sensor collection sub-network, it will restore the connection relationship with the corresponding sensor collection sub-network. Through the above method, the cloud server can not only disconnect the risky sensor collection sub-network in time, but also quickly restore the connection relationship after it returns to normal.

[0187] It can be seen that the implementation example of the system can enable the cloud server to quickly locate and warn risky sensor collection subnetworks based on risk network identification strategies and a subset of subnetwork operation indicators of each sensor collection subnetwork.

[0188] The risk network positioning system based on community mining can be implemented in the form of a computer program. Fig.10 Runs on the computer device shown.

[0189] See also Fig.10 , Fig.10 The present invention is a schematic block diagram of a computer device provided by an embodiment of the present invention. The computer device integrates any risk network positioning system based on community mining provided by an embodiment of the present invention.

[0190] See also Fig.10 The computer device 400 includes a processor 402 , a memory and a network interface 405 connected via a system bus 401 , wherein the memory may include a storage medium 403 and an internal memory 404 .

[0191] The storage medium 403 can store an operating system 4031 and a computer program 4032. The computer program 4032 includes program instructions, and when the program instructions are executed, the processor 402 can execute the risk network positioning method based on community mining.

[0192] The processor 402 is used to provide computing and control capabilities to support the operation of the entire computer device.

[0193] The internal memory 404 provides an environment for the operation of the computer program 4032 in the storage medium 403. When the computer program 4032 is executed by the processor 402, the processor 402 can execute the above-mentioned risk network positioning method based on community mining.

[0194] The network interface 405 is used to communicate with other devices over the network. Fig.10 The structure shown in the figure is only a block diagram of a part of the structure related to the scheme of the present invention, and does not constitute a limitation on the computer device to which the scheme of the present invention is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0195] The processor 402 is used to run the computer program 4032 stored in the memory to implement the risk network positioning method based on community mining as described above.

[0196] It should be understood that in the embodiment of the present invention, the processor 402 may be a central processing unit (CPU), and the processor 402 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0197] It can be understood by those skilled in the art that all or part of the processes in the method for implementing the above embodiment can be completed by instructing the relevant hardware through a computer program. The computer program includes program instructions, and the computer program can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiment of the above method.

[0198] Therefore, the present invention also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions. When the program instructions are executed by a processor, the processor executes the risk network positioning method based on community mining as described above.

[0199] The computer-readable storage medium may be a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk, etc., which are computer-readable storage media that can store program codes.

[0200] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0201] In the several embodiments provided by the present invention, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of each unit is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0202] The steps in the method of the embodiment of the present invention can be adjusted in order, combined and deleted according to actual needs. The units in the system of the embodiment of the present invention can be combined, divided and deleted according to actual needs. In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0203] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, terminal, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention.

[0204] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A risk network positioning method based on community mining, applied to sensor collection network, characterized in that: The sensor collection network includes a cloud server and a plurality of sensor collection sub-networks, and the plurality of sensor collection sub-networks are communicatively connected with the cloud server; the risk network positioning method based on community mining includes: Each of the plurality of sensor collection subnetworks acquires a subset of subnetwork operation indicators according to a preset collection strategy and sends the subset to the cloud server; If the cloud server detects a risk network mining and positioning instruction, it obtains a sub-network operation indicator set corresponding to the risk network mining and positioning instruction; wherein the sub-network operation indicator subset included in the sub-network operation indicator set corresponds one-to-one to the sensor collection sub-network in the plurality of sensor collection sub-networks; The cloud server determines, for each subnetwork operation indicator subset in the subnetwork operation indicator set, a risk network identification result corresponding to the subnetwork operation indicator subset based on a preset risk network identification strategy and subnetwork similarity information and subnetwork structure quality information in the subnetwork operation indicator subset; If the cloud server determines that there is a risk network identification result of a subnetwork operation indicator subset in the subnetwork operation indicator set that meets the preset risk result condition, the corresponding subnetwork operation indicator subset is obtained as the target subnetwork operation indicator subset, and the sensor collection subnetwork corresponding to the target subnetwork operation indicator subset is used to form the risk network positioning result; The sensor acquisition nodes included in the sensor acquisition subnetwork obtain the subnetwork similarity index according to the preset acquisition strategy and then summarize the subnetwork similarity information. The subnetwork similarity index collected by each sensor acquisition node at least includes the CPU load rate of the current sensor acquisition node, the communication delay time between the current sensor acquisition node and the main sensor acquisition node, the time interval of the last data transmission from the current sensor acquisition node to the main sensor acquisition node, the node ID number of the current sensor acquisition node and the network ID number of the sensor acquisition subnetwork to which the current sensor acquisition node belongs; The subnet structure quality information of the sensor collection subnet at least includes the network ID number of the current sensor collection subnet, the number of surviving nodes of the current sensor collection subnet, the number of surviving subnet nodes 1 minute ago, and the number of sensor nodes with a delay greater than 200ms within 1 minute.

2. The method according to claim 1, characterized in that In the step of obtaining a sub-network operation indicator subset according to a preset acquisition strategy for each of the plurality of sensor acquisition sub-networks, and sending the subset to the cloud server, obtaining a sub-network operation indicator subset according to a preset acquisition strategy for each sensor acquisition sub-network, and sending the subset to the cloud server, includes: The sensor collection sub-network acquires a plurality of sensor collection nodes included therein, and determines a main sensor collection node among the plurality of sensor collection nodes; The multiple sensor acquisition nodes all obtain subnet similarity indicators according to the first acquisition strategy in the preset acquisition strategy, and send them to the main sensor acquisition node, so that the main sensor acquisition node counts the subnet similarity indicators of the multiple sensor acquisition nodes to obtain subnet similarity information; wherein the similarity between the subnet similarity indicators of each sensor acquisition node in the sensor acquisition subnetwork is greater than or equal to the first similarity threshold; The main sensor collection node determines the subnet structure quality information according to the subnet similarity index of each sensor collection node and the second collection strategy in the preset collection strategy; The main sensor collection node combines the subnet similarity information and the subnet structure quality information into the subnet operation indicator subset, and sends it to the cloud server.

3. The method according to claim 1, characterized in that The sensor collection network also includes an edge gateway, and the cloud server and the plurality of sensor collection sub-networks are all communicatively connected to the edge gateway; In the step of obtaining a sub-network operation indicator subset according to a preset acquisition strategy for each of the plurality of sensor acquisition sub-networks, and sending the subset to the cloud server, obtaining a sub-network operation indicator subset according to a preset acquisition strategy for each sensor acquisition sub-network, and sending the subset to the cloud server, includes: The sensor collection sub-network acquires a plurality of sensor collection nodes included therein, and determines the edge gateway corresponding to the sensor collection sub-network; The multiple sensor collection nodes all obtain subnet similarity indicators according to the third collection strategy in the preset collection strategy, and send them to the edge gateway, so that the edge gateway counts the subnet similarity indicators of the multiple sensor collection nodes to obtain subnet similarity information; wherein the similarity between the subnet similarity indicators of each sensor collection node in the sensor collection subnetwork is greater than or equal to the second similarity threshold; After the plurality of sensor collection nodes obtain subnet similarity indicators according to the third collection strategy in the preset collection strategy and send the indicators to the edge gateway, so that the edge gateway obtains subnet similarity information by counting the subnet similarity indicators of the plurality of sensor collection nodes, the method further includes: The edge gateway determines the subnet structure quality information according to the subnet similarity index of each sensor collection node in the sensor collection subnet and the fourth collection strategy in the preset collection strategy; The edge gateway combines the subnet similarity information and the subnet structure quality information into the subnet operation indicator subset and sends it to the cloud server.

4. The method according to claim 1, characterized in that: The obtaining of a sub-network operation indicator set corresponding to the risk network mining and positioning instruction includes: If it is determined that each of the plurality of sensor acquisition subnetworks has a connection relationship with the cloud server that currently maintains a communication connection or has historically established a communication connection, then a subnetwork operation indicator subset of each of the plurality of sensor acquisition subnetworks is obtained to form the subnetwork operation indicator set.

5. The method according to claim 1, characterized in that The step of determining the risk network identification result corresponding to the subnetwork operation indicator subset based on the preset risk network identification strategy and the subnetwork similarity information and subnetwork structure quality information in the subnetwork operation indicator subset comprises: Acquire the subnetwork similarity information and the subnetwork structure quality information in the subnetwork operation indicator subset to form subnetwork feature data corresponding to the subnetwork operation indicator subset; The sub-network characteristic data is input into the risk network identification strategy to obtain a risk network identification result corresponding to the sub-network operation indicator subset.

6. The method according to claim 1, characterized in that The step of determining the risk network identification result corresponding to the subnetwork operation indicator subset based on the preset risk network identification strategy and the subnetwork similarity information and subnetwork structure quality information in the subnetwork operation indicator subset comprises: Obtain risk network warning indicator items in the risk network identification strategy; Based on the subnet similarity information and subnet structure quality information in the subnet operation indicator subset, the value of each risk network early warning indicator item in the risk network identification strategy is determined to form a risk network identification result corresponding to the subnet operation indicator subset.

7. The method according to claim 1, characterized in that If the cloud server determines that there is a risk network identification result of a subnetwork operation indicator subset in the subnetwork operation indicator set that meets the preset risk result condition, then the corresponding subnetwork operation indicator subset is obtained as the target subnetwork operation indicator subset, and the sensor acquisition subnetwork corresponding to the target subnetwork operation indicator subset is used to form the risk network positioning result, after the step, the method further includes: The cloud server disconnects the sensor collection subnetworks included in the risk network positioning result respectively; The cloud server obtains subnetwork recovery information for each of the sensor collection subnetworks included in the risk network positioning result, and if the subnetwork recovery information of the sensor collection subnetwork is a successful recovery result, the connection relationship with the corresponding sensor collection subnetwork is restored.

8. A risk network positioning system based on community mining, applied to sensor collection network, characterized in that: The sensor acquisition network includes a cloud server and a plurality of sensor acquisition sub-networks, and the plurality of sensor acquisition sub-networks are communicatively connected with the cloud server; Each of the plurality of sensor collection subnetworks is used to obtain a subset of subnetwork operation indicators according to a preset collection strategy and send the subset to the cloud server; The cloud server is used to obtain a sub-network operation indicator set corresponding to the risk network mining and positioning instruction if a risk network mining and positioning instruction is detected; wherein the sub-network operation indicator subset included in the sub-network operation indicator set corresponds one-to-one to the sensor collection sub-network in the plurality of sensor collection sub-networks; The cloud server is further used to determine, for each subnetwork operation indicator subset in the subnetwork operation indicator set, a risk network identification result corresponding to the subnetwork operation indicator subset based on a preset risk network identification strategy and subnetwork similarity information and subnetwork structure quality information in the subnetwork operation indicator subset; The cloud server is further used for obtaining the corresponding subnetwork operation indicator subset as the target subnetwork operation indicator subset if it is determined that the risk network identification result of the subnetwork operation indicator subset in the subnetwork operation indicator set meets the preset risk result condition, and forming the risk network positioning result with the sensor collection subnetwork corresponding to the target subnetwork operation indicator subset; The sensor acquisition nodes included in the sensor acquisition subnetwork obtain the subnetwork similarity index according to the preset acquisition strategy and then summarize the subnetwork similarity information. The subnetwork similarity index collected by each sensor acquisition node at least includes the CPU load rate of the current sensor acquisition node, the communication delay time between the current sensor acquisition node and the main sensor acquisition node, the time interval of the last data transmission from the current sensor acquisition node to the main sensor acquisition node, the node ID number of the current sensor acquisition node and the network ID number of the sensor acquisition subnetwork to which the current sensor acquisition node belongs; The subnet structure quality information of the sensor collection subnet at least includes the network ID number of the current sensor collection subnet, the number of surviving nodes of the current sensor collection subnet, the number of surviving subnet nodes 1 minute ago, and the number of sensor nodes with a delay greater than 200ms within 1 minute.

9. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the risk network positioning method based on community mining as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which includes program instructions. When the program instructions are executed by a processor, the risk network positioning method based on community mining as described in any one of claims 1 to 7 can be implemented.

Images