A VLAN division and independent network card interface system for high-speed signal connection switch

Abstract

The present invention relates to the field of network segmentation technology, specifically a VLAN division and independent network card interface system for high-speed signal connection switch, the system includes a network status monitoring module, a graph neural network analysis module, a VLAN dynamic configuration module, a reinforcement learning optimization module, a prediction model module, an ACL rule generation module, a game theory optimization module, and an event-driven adjustment module. In the present invention, the use of a graph neural network model not only analyzes the complexity characteristics of the network structure, but also optimizes the dynamic adjustment of the VLAN configuration, so that it can match the changes in the network topology in real time. The introduction of deep reinforcement learning methods effectively improves the performance and security of the network through a reward mechanism. Time series analysis and machine learning methods enable the system to predict future network access modes and configuration requirements. The application of game theory methods provides an optimal combination solution for multi-network segmentation strategies, and complex event processing technology realizes effective monitoring and response to real-time network events.

Description

Technical Field

[0001] The invention relates to the technical field of network segmentation, and in particular to a VLAN division and independent network card interface system for a high-speed signal connection switch. Background Art

[0002] Network segmentation is a technology that divides network resources into independent segments or areas through logical or physical means to improve security, manageability and network performance. Network segmentation technology enables network administrators to effectively control data flow and ensure the isolation of sensitive information, while optimizing network traffic and avoiding unnecessary data congestion. It is widely used in enterprise networks, data centers, and cloud infrastructure to meet the needs of different user groups and services while ensuring network reliability and security.

[0003] Among them, VLAN partitioning is the process of dividing a physical network into multiple virtual local area networks (VLANs). The devices in each VLAN communicate with each other as if they were in the same physical network, but are isolated from the devices in other VLANs. This partitioning makes network management more flexible, and network resources can be organized according to departments, project groups, or data sensitivity, thereby improving security and reducing network congestion. Independent network card interface systems involve configuring multiple network interfaces for servers or other network devices, each of which can be connected to different networks or VLANs, further enhancing network isolation and performance. The purpose of these two technologies is to achieve effective allocation and secure isolation of network resources through logical and physical means, thereby achieving the effect of improving network security, enhancing network performance, and simplifying network management.

[0004] Traditional VLAN division and independent network card interface systems have obvious deficiencies in network status analysis, dynamic configuration adjustment, and security and performance optimization. Traditional systems rely on static configuration and manual intervention, which makes it difficult to reflect and adapt to rapid changes in network topology in real time, resulting in lagging network configuration and inability to effectively respond to network security threats and performance bottlenecks. The lack of deep learning and intelligent analysis methods makes it impossible for traditional systems to accurately predict network access patterns and configuration requirements, making it difficult to achieve optimal allocation of network resources. In addition, traditional systems often lack effective automated response mechanisms when dealing with complex network events, resulting in inefficient network management and extended response times, which in turn affects the stability of the entire network and user experience. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings in the prior art and to propose a VLAN division and independent network card interface system for a high-speed signal connection switch.

[0006] In order to achieve the above-mentioned purpose, the present invention adopts the following technical scheme: a VLAN division and independent network card interface system for high-speed signal connection switch includes a network status monitoring module, a graph neural network analysis module, a VLAN dynamic configuration module, a reinforcement learning optimization module, a prediction model module, an ACL rule generation module, a game theory optimization module, and an event-driven adjustment module;

[0007] The network status monitoring module uses a real-time data collection method to collect data based on network devices and connection status, analyzes the collected data through stream data processing technology, conducts a comprehensive analysis of the real-time status of the network, and generates a network status data set;

[0008] The graph neural network analysis module uses a graph neural network model based on the network status data set to encode the network topology structure, analyze the correlation and communication mode between network devices, parse the complexity characteristics of the network structure, and generate topology structure analysis results;

[0009] The VLAN dynamic configuration module adopts an automated configuration strategy based on the topology analysis result to dynamically adjust the VLAN to match the real-time changes in the network topology, automatically update the VLAN configuration, and generate the current VLAN configuration;

[0010] The reinforcement learning optimization module uses a deep reinforcement learning method based on the network status data set and the current VLAN configuration to optimize the network segmentation strategy and MPLS path selection, guides the model scheduling through the reward mechanism to improve network performance and security, and generates an optimized network strategy;

[0011] The prediction model module uses time series analysis and machine learning methods based on the network status data set to analyze historical network access data, perform predictive analysis on network access patterns and configuration requirements in future time periods, identify potential access patterns and security threats, and generate network access prediction results;

[0012] The ACL rule generation module automatically generates or adjusts ACL rules based on the network access prediction results, analyzes the prediction results, sets access control policies, and generates current ACL rules by using a dynamic rule generation method;

[0013] The game theory optimization module uses game theory methods to analyze the interaction between multiple network segmentation strategies based on the optimized network strategy and the current VLAN configuration, and captures the optimal combination of multiple network segmentation strategies by solving the Nash equilibrium, thereby optimizing the overall network performance and generating a collaborative optimization strategy.

[0014] The event-driven adjustment module uses complex event processing and stream data processing methods based on the network status data set and current ACL rules to monitor and analyze real-time network events, dynamically adjust network segmentation strategies and configurations according to the type and impact of the events, respond to changes in the network environment, and generate event response strategies.

[0015] As a further solution of the present invention, the network status data set includes device connection status, traffic size, and load ratio; the topology structure analysis results specifically include the strength of the relationship between nodes, node attribute characteristics, and network communication paths; the current VLAN configuration includes adding a new VLAN identifier, adjusting VLAN members, and deleting outdated VLAN configurations; the optimized network strategy specifically refers to adjusting network segmentation boundaries, optimizing MPLS path settings, and optimizing data transmission efficiency; the network access prediction results include peak traffic period prediction, potential security threat identification, and access mode change trends; the current ACL rules include access permission refinement, time period access control, and target service access restrictions; the collaborative optimization strategy specifically includes the optimal balance point between strategies, performance maximization configuration, and resource allocation efficiency improvement plan; the event response strategy includes real-time security incident response, automated configuration adjustment, and emergency traffic control measures.

[0016] As a further solution of the present invention, the network status monitoring module includes a data acquisition submodule, a stream data processing submodule, and a status analysis submodule;

[0017] The data acquisition submodule uses the tcpdump tool to perform network data capture based on the network device and connection status, sets the filter rule to tcp port 80 to capture only HTTP traffic, runs the tcpdump command to perform real-time data capture, and generates real-time network data;

[0018] The stream data processing submodule uses Apache Flink to process stream data based on real-time network data, configures the time window to 5 seconds for windowed processing of stream data, uses Flink's filter function to filter out data records with abnormal traffic, and uses the map function to convert the data format to generate processed network data;

[0019] The status analysis submodule uses Python's Pandas library to perform data analysis based on the processed network data, uses the DataFrame structure to store data, applies the groupby and agg functions to calculate the average traffic in each time period, uses the query method to filter high-traffic time periods, and generates a network status data set.

[0020] As a further solution of the present invention, the graph neural network analysis module includes a topological data modeling submodule, a GNN training submodule, and a topological association analysis submodule;

[0021] The topology data modeling submodule is based on the network status data set, adopts the graph neural network algorithm, and uses the PyTorch framework to define the graph structure, including nodes representing network devices, edges representing the connection relationship between devices, and assigning feature vectors to each node and edge to capture network topology information and generate a graph data model;

[0022] The GNN training submodule is based on a graph data model, adopts a graph convolutional network algorithm, uses the PyTorch framework for model training, sets training parameters, including setting the learning rate to 0.01, the batch size to 32, and the number of iterations to 100 rounds, aggregates and updates node features using the graph structure, obtains hidden patterns in the network topology, and generates a trained and optimized GNN model;

[0023] The topology association analysis submodule performs network topology association analysis based on the trained and optimized GNN model, uses the PyTorch framework and the trained model to perform predictive analysis on the current network status data, identifies the dependencies between network devices, analyzes potential communication modes and bottlenecks, and generates topology structure analysis results.

[0024] As a further solution of the present invention, the VLAN dynamic configuration module includes a VLAN configuration generation submodule, a configuration automation submodule, and a configuration update submodule;

[0025] The VLAN configuration generation submodule automatically generates VLAN configurations based on the topology analysis results using a network configuration script language, including identifying differentiated network segments in the network topology and assigning a unique VLAN ID ranging from 100 to 200 to each segment, and assigning a name to each VLAN in the format of VLAN_ plus the corresponding network segment identifier, setting access control list rules for each VLAN, and generating preliminary VLAN configurations;

[0026] The configuration automation submodule uses the Ansible network automation tool based on the preliminary VLAN configuration to write a Playbook script in YAML format, including tasks that use the ios_vlan module to specify the vlan_id and name parameters to automatically deploy the VLAN configuration on the network device. During the deployment process, the Ansible ad-hoc command ansible all-mping is used to check the connectivity of the network device and generate an automated deployment record.

[0027] The configuration update submodule automates deployment records and uses the Zabbix network monitoring tool to monitor the performance of the deployed network, including setting monitoring items to collect inlet and outlet traffic data of the VLAN interface, using data collection functions net.if.in and net.if.out to monitor the traffic of the target VLAN interface, comparing and analyzing the network performance differences before and after deployment, and generating the current VLAN configuration.

[0028] As a further solution of the present invention, the reinforcement learning optimization module includes a performance indicator analysis submodule, a reinforcement learning model training submodule, and a strategy adjustment submodule;

[0029] The performance indicator analysis submodule extracts network performance indicators based on the network status data set and the current VLAN configuration, uses Python's Pandas library to execute describe() and groupby() functions on the data set, summarizes network delay, throughput, and packet loss rate performance indicators, provides environmental status, and generates network performance indicator results;

[0030] The reinforcement learning model training submodule adopts a deep reinforcement learning method based on the network performance index results, uses the tf.keras and tf.agent libraries of the TensorFlow framework to build a model, defines the state space including network delay, throughput, and packet loss rate, and the action space is the network segmentation strategy and MPLS path selection scheme. The reward function is calculated according to the degree of improvement in network performance and security. The training parameters are set including the learning rate learning_rate=0.001 and the number of iterations epochs=200. The strategy selection is optimized through the feedback reward loop to generate a training optimized reinforcement learning model;

[0031] The policy adjustment submodule performs real-time adjustment of network policies based on the trained and optimized reinforcement learning model, uses Python scripts to apply the optimal actions output by the model, adjusts the network segmentation strategy and MPLS path selection, and uses the apply_changes() function to automatically update the network configuration and generate optimized network policies.

[0032] As a further solution of the present invention, the prediction model module includes a time series analysis submodule, a machine learning prediction submodule, and a prediction result processing submodule;

[0033] The time series analysis submodule uses the ARIMA model to perform time series analysis based on the network status data set, including using Python's statsmodels library to perform ARIMA model configuration, setting model parameters order = (2, 1, 2), predicting network traffic trends in future time periods, and generating time series prediction data;

[0034] The machine learning prediction submodule uses the random forest algorithm to perform machine learning prediction based on time series prediction data, uses the RandomForestRegressor in the Scikit-learn library, sets the number of trees n_estimators = 100 and the maximum depth of the tree max_depth = 10, and the training set features include historical traffic data and time series prediction data, refines the prediction of network access patterns and potential security threats, and generates machine learning prediction results;

[0035] The prediction result processing submodule performs data post-processing based on the machine learning prediction results, including applying a Python script to perform threshold filtering threshold=0.8 and result aggregation on the prediction results to generate network access prediction results.

[0036] As a further solution of the present invention, the ACL rule generation module includes an access mode analysis submodule, an ACL rule customization submodule, and a rule update submodule;

[0037] The access pattern analysis submodule adopts the time series analysis method based on the network access prediction results, uses Python's Pandas library to perform data serialization processing, sets the time window parameter to 30 days for access pattern recognition, applies the clustering algorithm, uses the KMeans function in the Scikit-learn library, sets the cluster number parameter to 5 to extract access behavior features, and generates an access feature summary;

[0038] The ACL rule customization submodule adopts a decision tree algorithm based on the access feature summary, uses the DecisionTreeClassifier function in the Scikit-learn library, sets the tree depth parameter to 10 for access control policy design, applies a genetic algorithm, uses the DEAP library for dynamic ACL rule customization, sets the population size parameter to 50, the crossover rate parameter to 0.8, and the mutation rate parameter to 0.05 for rule customization, and generates a customized ACL rule draft;

[0039] The rule update submodule is based on a customized ACL rule draft, adopts a simulated annealing algorithm, uses the SimPy library to set the starting temperature parameter to 100 and the cooling rate parameter to 0.95 to verify the validity of the rule, applies an incremental learning method, and uses the partial_fit function in the Scikit-learn library to automatically update and adjust the ACL rules to generate the current ACL rules.

[0040] As a further solution of the present invention, the game theory optimization module includes a strategy definition submodule, a game model construction submodule, and a Nash equilibrium solution submodule;

[0041] The strategy definition submodule performs mathematical modeling based on the optimized network strategy and the current VLAN configuration to define a game model of the network segmentation strategy, including identifying the network segmentation strategy as a participant, taking the potential decision of each strategy as a strategy set, and the utility function evaluates the impact of each decision according to network performance indicators including throughput and latency, and uses Python's numpy library to construct a utility matrix to generate a network segmentation strategy game model;

[0042] The game model construction submodule is based on the network segmentation strategy game model, uses Matlab to build the model, uses the function gametheory.createGame of Game Theory Toolbox, sets the utility function parameters of each strategy, including setting the network throughput network_throughput to 150Mbps, setting the network delay latency to 50ms, building the payment matrix between the strategies, and generating the game theory model and the payment matrix;

[0043] The Nash equilibrium solving submodule is based on the game theory model and the payoff matrix, and uses a genetic algorithm to capture the Nash equilibrium point of the strategy combination, including setting the algorithm's population size population_size to 50, the crossover rate crossover_rate to 0.7, and the mutation rate mutation_rate to 0.01. The genetic algorithm is implemented using Python's deap library. Through multiple generations of iterative optimization of the strategy combination, the optimal combination of multiple network segmentation strategies is captured to generate a collaborative optimization strategy.

[0044] As a further solution of the present invention, the event-driven adjustment module includes an event definition and detection submodule, an event processing logic construction submodule, and a stream data analysis submodule;

[0045] The event definition and detection submodule uses the Esper engine to define event patterns based on the current ACL rules, including setting the event type parameter eventType to networkAnomaly and the detection threshold parameter thresholdValue to 100 times / minute to identify and classify real-time network events, continuously monitor the network status, and detect target network events by defining event patterns and detection logic to generate event detection results;

[0046] The event processing logic construction submodule adopts the decision tree algorithm based on the event detection results, uses the DecisionTreeClassifier function in the Scikit-learn library, sets the tree depth parameter max_depth=10 to construct the event processing strategy, designs the processing logic and response measures according to the type and impact of the event, dynamically adjusts the network security strategy and configuration, and generates the event processing strategy;

[0047] The stream data analysis submodule adopts a stream data processing method based on event processing strategies and real-time network status data, uses Apache Flink to analyze real-time data streams, sets the window size parameter windowSize to 5 seconds to perform dynamic analysis and response to network events, and uses stream data analysis technology to continuously process network status data, dynamically adjust network segmentation strategies and configurations according to event processing strategies, respond to real-time changes in the network environment, and generate event response strategies.

[0048] Compared with the prior art, the advantages and positive effects of the present invention are:

[0049] In the present invention, the use of the graph neural network model not only analyzes the complexity characteristics of the network structure, but also optimizes the dynamic adjustment of the VLAN configuration so that it can match the changes in the network topology in real time. The introduction of the deep reinforcement learning method effectively improves the performance and security of the network through the reward mechanism. At the same time, the time series analysis and machine learning methods enable the system to predict future network access patterns and configuration requirements. In addition, the application of game theory methods provides an optimal combination solution for multi-network segmentation strategies, while complex event processing technology realizes effective monitoring and response to real-time network events. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 is a system flow chart of the present invention;

[0051] Figure 2 It is a schematic diagram of the system framework of the present invention;

[0052] Figure 3 It is a flow chart of the network status monitoring module of the present invention;

[0053] Figure 4 This is a flow chart of the graph neural network analysis module of the present invention;

[0054] Figure 5 It is a flow chart of the VLAN dynamic configuration module of the present invention;

[0055] Figure 6 This is a flow chart of the reinforcement learning optimization module of the present invention;

[0056] Figure 7It is a flow chart of the prediction model module of the present invention;

[0057] Figure 8 The ACL rule generation module flow chart of the present invention;

[0058] Fig. 9 It is a flow chart of the game theory optimization module of the present invention;

[0059] Fig.10 This is a flow chart of the event-driven adjustment module of the present invention. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0061] In the description of the present invention, it should be understood that the terms length, width, up, down, front, back, left, right, vertical, horizontal, top, bottom, inside, outside, etc. indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, which are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific position, be constructed and operated in a specific position, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, the meaning of multiple is two or more, unless otherwise clearly and specifically defined.

[0062] Embodiment 1

[0063] See also Figure 1 to Figure 2 , a VLAN division and independent network card interface system for high-speed signal connection switch includes a network status monitoring module, a graph neural network analysis module, a VLAN dynamic configuration module, a reinforcement learning optimization module, a prediction model module, an ACL rule generation module, a game theory optimization module, and an event-driven adjustment module;

[0064] The network status monitoring module uses real-time data collection methods to collect data based on network equipment and connection status, analyzes the collected data through stream data processing technology, conducts a comprehensive analysis of the real-time status of the network, and generates a network status data set;

[0065] The graph neural network analysis module uses a graph neural network model based on the network status data set to encode the network topology structure, analyze the correlation and communication mode between network devices, resolve the complexity characteristics of the network structure, and generate topology analysis results;

[0066] Based on the topology analysis results, the VLAN dynamic configuration module uses an automated configuration strategy to dynamically adjust VLANs to match real-time changes in network topology, automatically update VLAN configurations, and generate current VLAN configurations.

[0067] The reinforcement learning optimization module uses deep reinforcement learning methods to optimize network segmentation strategies and MPLS path selection based on the network status dataset and current VLAN configuration. It guides model scheduling through reward mechanisms to improve network performance and security and generate optimized network strategies.

[0068] The prediction model module uses time series analysis and machine learning methods based on the network status data set to analyze historical network access data, conduct predictive analysis on network access patterns and configuration requirements in the future time period, identify potential access patterns and security threats, and generate network access prediction results;

[0069] The ACL rule generation module uses a dynamic rule generation method based on network access prediction results to automatically generate or adjust ACL rules, analyze prediction results, set access control policies, and generate current ACL rules;

[0070] The game theory optimization module uses game theory methods to analyze the interaction between multiple network segmentation strategies based on the optimized network strategy and the current VLAN configuration. By solving the Nash equilibrium, it captures the optimal combination of multiple network segmentation strategies, optimizes the overall network performance, and generates a collaborative optimization strategy.

[0071] The event-driven adjustment module uses complex event processing and stream data processing methods based on the network status data set and current ACL rules to monitor and analyze real-time network events. According to the type and impact of the event, it dynamically adjusts the network segmentation strategy and configuration, responds to changes in the network environment, and generates event response strategies.

[0072] The network status data set includes device connection status, traffic size, and load ratio. The topology analysis results are specifically the strength of the relationship between nodes, node attribute characteristics, and network communication paths. The current VLAN configuration includes adding new VLAN identifiers, adjusting VLAN members, and deleting outdated VLAN configurations. The optimized network strategy specifically refers to adjusting network segmentation boundaries, optimizing MPLS path settings, and optimizing data transmission efficiency. The network access prediction results include peak traffic period prediction, potential security threat identification, and access mode change trends. The current ACL rules include access permission refinement, time period access control, and target service access restrictions. The collaborative optimization strategy is specifically the optimal balance point between strategies, performance maximization configuration, and resource allocation efficiency improvement plan. The event response strategy includes real-time security incident response, automated configuration adjustment, and emergency traffic control measures.

[0073] In the network status monitoring module, real-time data collection methods are used to monitor network devices and connection status, and the real-time collected data is analyzed through stream data processing technology. This technology mainly relies on the concepts of time windows and sliding windows to process continuous data streams. For the data in each time window, statistical analysis methods such as average calculation, variance analysis, and trend prediction algorithms are used to analyze the data in real time to identify fluctuations in network performance and potential problem points. This module analyzes the real-time status of the network by analyzing key indicators such as network traffic distribution, traffic peak, and bandwidth utilization, and generates a network status data set. This data set contains key information such as the operating status of network devices, connection quality, and traffic patterns. For network administrators, this information is an important basis for judging the health of the network and performing fault diagnosis.

[0074] In the graph neural network analysis module, a graph neural network model is used to analyze the network topology based on the network status dataset. The graph neural network encodes the network structure by representing network devices through nodes and representing the connections between devices through edges. In this process, the graph convolutional network (GCN) algorithm is used to update the representation of nodes by aggregating the feature information of adjacent nodes, thereby capturing the correlation and communication mode between network devices. The model gradually extracts high-order features of the network topology through multi-layer graph convolution operations, and can effectively analyze the complex characteristics of the network structure. The generated topology analysis results provide network administrators with an in-depth understanding of the dependencies and communication modes between devices, providing an important basis for network optimization and troubleshooting.

[0075] In the VLAN dynamic configuration module, based on the topology analysis results, an automated configuration strategy is used to dynamically adjust VLANs. This strategy analyzes real-time changes in network topology, such as the addition and removal of devices and changes in connection status, and uses scripts or automation tools, such as Ansible or Puppet, to automatically update VLAN configurations based on the analysis results. This process includes steps such as generating VLAN division recommendations, adjusting the VLAN membership of switches, and updating routing policies to ensure that VLAN configurations can match real-time changes in network topology. Through the operation of this module, the network can be quickly reorganized and adjusted, improving the flexibility and efficiency of the network.

[0076] In the reinforcement learning optimization module, based on the network status data set and the current VLAN configuration, the deep reinforcement learning method is used to optimize the network segmentation strategy and MPLS (Multi-Protocol Label Switching) path selection. Deep reinforcement learning rewards the improvement of network performance and security by designing a set of reward mechanisms, and punishes the decline in performance and the emergence of security risks. In this process, a deep neural network is used as the value function approximator of reinforcement learning. By continuously observing the network status, performing actions (such as adjusting the network segmentation strategy or MPLS path), and receiving reward signals to continuously update the strategy. In this way, the model can learn the optimal decision-making strategy under a specific network state, generate an optimized network strategy, and effectively improve the performance and security of the network.

[0077] In the prediction model module, based on the network status data set, time series analysis and machine learning methods are used to analyze historical network access data to predict network access patterns and configuration requirements in the future time period. In this process, algorithms such as the autoregressive integrated moving average (ARIMA) model and recurrent neural network (RNN) are used to analyze the time series characteristics in historical data, such as seasonal changes, trend changes, etc., as well as the periodic patterns of network access. Through these analyses, the model can identify potential access patterns and estimated security threats, and generate network access prediction results. These prediction results are crucial for network capacity planning and security policy formulation, helping administrators adjust resources and prevent potential threats in advance.

[0078] In the ACL rule generation module, based on the network access prediction results, a dynamic rule generation method is used to automatically generate or adjust the access control list (ACL) rules. In this process, the access patterns and security threats in the prediction results are analyzed, and the access requests are classified using algorithms such as decision trees. ACL rules are automatically generated or adjusted based on the classification results. These rules are designed to accurately control network access rights, prevent unauthorized access and network attacks, and improve network security. By automatically updating ACL rules, the module can quickly respond to changes in the network environment and ensure the timeliness and effectiveness of network security policies.

[0079] In the game theory optimization module, based on the optimized network strategy and the current VLAN configuration, the game theory method is used to analyze the interaction between multiple network segmentation strategies. By constructing a multi-participant game model, each participant represents a network segmentation strategy, analyzing the competition and cooperation relationship between different strategies, and capturing the optimal combination of multiple network segmentation strategies by solving the Nash equilibrium. This method can reveal the mutual influence between different network strategies and help administrators choose a strategy combination that can maximize the overall performance of the network. By implementing these collaborative optimization strategies, not only the network performance is improved, but also the resistance and stability of the network are enhanced.

[0080] In the event-driven adjustment module, complex event processing and streaming data processing methods are used to monitor and analyze real-time network events based on the network status data set and current ACL rules. This process identifies and classifies network events, such as security threats and performance degradation, and then dynamically adjusts network segmentation strategies and configurations based on the type and impact of the event. This process uses event processing engines, such as Esper or Apache Flink, to process and analyze events in real time, quickly identifying events that require response and executing corresponding adjustment measures. Through this event-driven approach, the network can respond to various emergencies in a timely manner to ensure stable operation and efficient performance of the network.

[0081] See also Figure 3 ,The network status monitoring module includes a data acquisition submodule, a stream data processing submodule, and a status analysis submodule;

[0082] The data acquisition submodule uses the tcpdump tool to perform network data capture based on the network device and connection status, sets the filter rule to tcp port 80 to capture only HTTP traffic, runs the tcpdump command to capture data in real time, and generates real-time network data;

[0083] The stream data processing submodule uses Apache Flink to process stream data based on real-time network data. The time window is configured to be 5 seconds for windowed processing of stream data. The filter function of Flink is used to filter out data records with abnormal traffic. The map function is used to convert the data format and generate processed network data.

[0084] The status analysis submodule uses Python's Pandas library to perform data analysis based on the processed network data, uses the DataFrame structure to store data, applies the groupby and agg functions to calculate the average traffic in each time period, uses the query method to filter high-traffic time periods, and generates a network status data set.

[0085] In the data acquisition submodule, the network data capture tool tcpdump is used to perform real-time capture of network data. The specific command used is to set the filtering rule to tcp port 80. This setting ensures that only HTTP traffic is captured, with the aim of reducing the interference of irrelevant data and focusing on analyzing HTTP traffic that has a greater impact on the network status. The tcpdump tool plays a key role in this link with its powerful data capture capability. By capturing data packets, network traffic is monitored in real time. In the actual execution process, tcpdump checks the data packets passing through the network interface one by one according to the set filtering rules. When a data packet that meets the tcpport 80 rule is found, it is captured and saved. In this process, tcpdump not only captures the original content of the data packet, but also includes key information such as the sending and receiving time, source and target IP addresses, and port numbers, providing rich original data for subsequent flow data processing. The data captured by this method is mainly in the form of original network data packets, including complete HTTP request and response data, and can record every detail of network communication in detail. The generated real-time network data, that is, a data set containing a large amount of detailed information, has become the basis of the flow data processing submodule, effectively supporting the real-time monitoring and analysis needs of the network status.

[0086] In the stream data processing submodule, Apache Flink is used as a stream processing framework to perform window processing on real-time network data and filter abnormal data. Apache Flink is a high-performance, easily scalable stream processing framework that supports complex data stream processing, including real-time data processing and analysis. In this submodule, the time window is first configured to be 5 seconds, which means that Flink will group continuous data according to time, and every 5 seconds of data will be used as a processing unit. This can not only process data in real time, but also capture traffic changes in a short period of time by analyzing the data in the time window, providing a basis for subsequent abnormal traffic detection. Through the filter function, abnormal data records are filtered out according to the preset traffic characteristics, such as sudden increases in traffic. This step is based on the real-time processing characteristics of stream data and can quickly respond to changes in network status. Next, the map function is used to convert the format of the filtered data, converting the original network data packet format into a format that is more suitable for analysis, such as extracting and converting the information of the data packet into a key-value pair format, which is convenient for subsequent data analysis and processing. Through this series of operations, not only the real-time processing and analysis of data flow is realized, but also the processed network data is generated. After format conversion and anomaly screening, these data provide high-quality input data for the status analysis submodule, effectively supporting the in-depth analysis of network status.

[0087] In the status analysis submodule, Python's Pandas library is used for in-depth data analysis. Pandas is a powerful data processing library that provides an efficient DataFrame structure to process and analyze data. In this submodule, the processed network data is loaded into the DataFrame structure, and the data is further analyzed with the help of Pandas' powerful data processing capabilities. The specific operations include using the groupby function to group the data in combination with the timestamp information, and then applying the agg function to calculate the average traffic in each time period. This step reveals the changing trends and characteristics of network traffic by aggregating and statistically analyzing the data in the time period. Subsequently, the query method is used to filter out the time period with high traffic. This is based on the average traffic data calculated in the previous step. By setting a threshold, the abnormal traffic peak is filtered out. Such analysis results can intuitively show the abnormal state of network traffic, providing an important basis for network management and optimization. Through the above operations, the generated network status dataset not only reflects the real-time status of the network, but also provides decision support for network management and optimization, demonstrating the powerful function of Pandas in data analysis.

[0088] See also Figure 4 ,The graph neural network analysis module includes the topological data modeling submodule, the GNN training submodule, and the topological association analysis submodule;

[0089] The topology data modeling submodule is based on the network status dataset, adopts the graph neural network algorithm, and uses the PyTorch framework to define the graph structure, including nodes representing network devices, edges representing the connection relationship between devices, and assigning feature vectors to each node and edge to capture network topology information and generate a graph data model;

[0090] The GNN training submodule is based on the graph data model and adopts the graph convolutional network algorithm. It uses the PyTorch framework for model training and sets the training parameters, including the learning rate set to 0.01, the batch size set to 32, and the number of iterations set to 100 rounds. It uses the graph structure to aggregate and update node features, obtains hidden patterns in the network topology, and generates a trained and optimized GNN model.

[0091] The topology correlation analysis submodule performs network topology correlation analysis based on the trained and optimized GNN model. It uses the PyTorch framework and the trained model to perform predictive analysis on the current network status data, identify the dependencies between network devices, analyze potential communication modes and bottlenecks, and generate topology structure analysis results.

[0092] In the topology data modeling submodule, the graph structure of the network is defined through the graph neural network (GNN) algorithm and the PyTorch framework to effectively capture and represent the key information of the network topology. This process involves converting the network status dataset into a graph data model, where nodes represent network devices and edges represent the connection relationship between devices. The specific implementation process includes assigning feature vectors to each node and edge, which comprehensively reflect the status of network devices and the relationship between devices. The operation starts with importing the network status dataset, analyzing the dataset structure, and determining the data representation method for the connection relationship between network devices. Subsequently, the PyTorch data structure, especially torch_geometric.data.Data, is used to build the graph data structure. This step includes initializing the node feature vector and the edge index list. The node feature vector is initialized based on the attributes of the network device, such as device type, status information, etc., and converted into a numerical vector; the edge initialization is determined based on the connection relationship between devices. In order to improve the performance and accuracy of the model, the feature vector is standardized to ensure the stability of model training. In addition, the introduction of edge features further enriches the model's understanding of network topology, and by encoding information such as connection type and bandwidth, the model is given the ability to identify different network connection characteristics. After completing the definition of the graph structure and the allocation of feature vectors, the graph data model can be used to reflect the network topology and the complex dependencies between devices in detail, laying the foundation for subsequent GNN model training and ensuring the efficiency and accuracy of the topology data modeling submodule. The generated graph data model serves as the basis for subsequent processing and provides strong data support for in-depth analysis of the network.

[0093] In the GNN training submodule, the graph data model generated by the previous submodule is trained using the graph convolutional network (GCN) algorithm and the PyTorch framework to reveal hidden patterns in the network topology. The training process specifically adjusts the learning rate to 0.01, the batch size to 32, and the number of iterations to 100 rounds. The careful setting of these parameters ensures the efficiency and effectiveness of model training. The graph convolutional network effectively aggregates the feature information of neighboring nodes and updates the representation of nodes by performing convolution operations on the graph structure, thereby capturing the deep-level features of the network topology. Specifically, GCN fuses the feature vector of a node with the feature vector of its neighbors according to certain rules at each layer. This fusion process involves the calculation of the adjacency matrix and the weight matrix. The weight matrix is ​​continuously updated during the training process to optimize the model performance. Through repeated iterations, the model gradually learns how to propagate and update information through the graph structure, thereby extracting features that have an important impact on the network state. The trained GNN model can accurately identify and predict hidden patterns in the network topology, including potential dependencies and communication patterns between devices, which provides a powerful tool for optimizing network structure and performance. Through an exhaustive training process, the GNN training submodule not only optimizes the performance of the graph neural network model, but also provides support for applications such as network management and fault prediction. The generated trained and optimized GNN model is the key to in-depth understanding and analysis of network topology.

[0094] In the topology association analysis submodule, based on the trained and optimized GNN model, the network topology association analysis is performed to further reveal the dependencies and potential communication patterns between network devices. Through the PyTorch framework and the trained model, the current network status data is accurately predicted and analyzed. The core of this submodule is to apply the trained GNN model to analyze real-time or near-real-time network data to identify key devices, key connections, and possible bottlenecks in the network. During the execution process, the current network status data is first converted into a graph data model in the same format as the training phase, and then the trained model is used for reasoning. The model predicts possible problem points and their causes in the network by analyzing the feature vectors of nodes and edges in the graph structure. For example, by analyzing the changes in node features, the performance bottleneck that a device may face can be predicted; through edge feature analysis, the key communication paths and potential risk points in the network can be identified. In addition, this submodule can also provide suggestions on network structure optimization based on the output of the GNN model, such as adjusting the network topology to avoid potential bottlenecks. Through the execution of the topology association analysis submodule, we not only deepen our understanding of the network topology and operating status, but also provide a scientific basis for network maintenance and optimization. The generated topology analysis results are an important decision support tool for network managers, which helps to improve the stability and efficiency of the network.

[0095] See also Figure 5 ,The VLAN dynamic configuration module includes a VLAN configuration generation submodule, a configuration automation submodule, and a configuration update submodule;

[0096] The VLAN configuration generation submodule uses the network configuration script language to automatically generate VLAN configuration based on the topology analysis results, including identifying differentiated network segments in the network topology and assigning a unique VLAN ID ranging from 100 to 200 to each segment, and assigning a name to each VLAN in the format of VLAN_ plus the corresponding network segment identifier, setting access control list rules for each VLAN, and generating preliminary VLAN configuration;

[0097] The configuration automation submodule uses the Ansible network automation tool based on the preliminary VLAN configuration to write a Playbook script in YAML format, including tasks that use the ios_vlan module to specify the vlan_id and name parameters to automatically deploy VLAN configuration on network devices. During the deployment process, the Ansible ad-hoc command ansible all-m ping is used to check the connectivity of network devices and generate automated deployment records.

[0098] The configuration update submodule is used to automatically record deployment, and the Zabbix network monitoring tool is used to monitor the performance of the deployed network, including setting monitoring items to collect the ingress and egress traffic data of the VLAN interface, using the data collection functions net.if.in and net.if.out to monitor the traffic of the target VLAN interface, comparing and analyzing the network performance differences before and after deployment, and generating the current VLAN configuration.

[0099] In the VLAN configuration generation submodule, the VLAN configuration is automatically generated through the topology analysis results and the network configuration script language. This process covers the identification of differentiated network segments in the network topology, the assignment of unique VLAN ID ranges to each network segment, and the setting of access control list rules. The network topology analysis results provide detailed information about the network structure, including the connection method between devices and the division of network segments. Based on this information, the configuration script automatically traverses the network topology, identifies different network segments, and assigns a unique VLAN ID between 100 and 200 to each segment according to predefined rules. The name corresponding to each VLAN ID adopts the format of "VLAN_" plus the network segment identifier to ensure the consistency and easy identification of VLAN names. In addition, access control list (ACL) rules are configured for each VLAN to manage and restrict data flows within and across network segments. These ACL rules are written according to network security policies and business requirements to optimize network performance and enhance security. The output of this submodule is a complete VLAN configuration file, including VLAN assignment, naming, and ACL rule settings for all network segments. This configuration file provides clear guidance for VLAN configuration of network devices, ensuring the reasonable organization of network structure and effective management of data flow.

[0100] In the configuration automation submodule, the Ansible network automation tool and the Playbook script in YAML format are used to automatically deploy the preliminary VLAN configuration on the network devices. A series of tasks are defined in the Playbook script, which uses the ios_vlan module to perform VLAN configuration on the network devices, including the specification of the vlan_id and name parameters. Ansible achieves precise control and automated execution of VLAN configuration of network devices through its modular architecture and concise YAML syntax. During the deployment process, Ansible's ad-hoc command ansible all-m ping is used to verify the connectivity of network devices to ensure that the devices are reachable before and after configuration. In this way, the configuration automation submodule not only realizes the rapid deployment of VLAN configuration, but also provides a verification mechanism for the deployment process, enhancing the reliability of network deployment. The records of automated deployment include the configuration status and connectivity test results of each device, providing important audit and traceback information for network management.

[0101] In the configuration update submodule, the Zabbix network monitoring tool is used to monitor the performance of the deployed network, involving traffic monitoring of VLAN interfaces and network performance analysis. Zabbix uses its data collection and analysis functions to monitor the ingress and egress traffic of the target VLAN interface in real time through the net.if.in and net.if.out functions. The configuration of these monitoring items is based on automated deployment records to ensure the accuracy and comprehensiveness of the monitoring scope. The collection and analysis of traffic data helps network administrators identify performance bottlenecks and abnormal traffic patterns in the network, compare and analyze the differences in network performance before and after deployment, and provide a basis for network optimization. By regularly collecting and analyzing traffic data, the configuration update submodule can not only monitor the current status of the network, but also make predictions and adjustments based on performance trends to ensure continuous performance optimization and stable operation of the network. In addition, the generated performance analysis report provides data support for network decision-making, helping management understand the network status and formulate reasonable network strategies.

[0102] See also Figure 6 ,The reinforcement learning optimization module includes the performance index analysis submodule, the reinforcement learning model training submodule, and the strategy adjustment submodule;

[0103] The performance indicator analysis submodule extracts network performance indicators based on the network status data set and the current VLAN configuration, uses Python's Pandas library to execute describe() and groupby() functions on the data set, summarizes network delay, throughput, and packet loss rate performance indicators, provides environmental status, and generates network performance indicator results;

[0104] The reinforcement learning model training submodule uses deep reinforcement learning methods based on the network performance index results, uses the tf.keras and tf.agent libraries of the TensorFlow framework to build a model, defines the state space including network delay, throughput, and packet loss rate, and the action space is the network segmentation strategy and MPLS path selection scheme. The reward function is calculated based on the degree of improvement in network performance and security. The training parameters are set including learning rate learning_rate=0.001 and number of iterations epochs=200. The strategy selection is optimized through feedback reward loop to generate a training optimized reinforcement learning model.

[0105] The policy adjustment submodule performs real-time adjustment of network policies based on the trained and optimized reinforcement learning model. It uses Python scripts to apply the optimal actions output by the model to adjust the network segmentation strategy and MPLS path selection. It uses the apply_changes() function to automatically update the network configuration and generate optimized network policies.

[0106] In the performance indicator analysis submodule, through in-depth analysis of the network status data set and the current VLAN configuration, the Python Pandas library is used to accurately extract network performance indicators. The specific operation process is to first clean and preprocess the data set to ensure data quality, and then use the describe() function to perform statistical analysis on key performance indicators such as network latency, throughput, and packet loss rate, including but not limited to mean, median, standard deviation, etc., which provides a basis for understanding the overall performance of the network. Further, through the groupby() function, the data is classified according to different network partitions (such as VLAN IDs) and time periods to explore the changes in performance indicators in different environments. This method allows administrators to identify bottlenecks or instability in network performance, and based on these analysis results, environmental status such as network traffic patterns and device performance are clearly mapped out, providing data support for network performance optimization. This process ultimately generates a report file containing comprehensive performance indicators and recommended improvement measures. The file records the current status and potential problems of the network in detail, which is crucial for the formulation of network management and optimization strategies.

[0107] In the reinforcement learning model training submodule, based on the network performance index results generated by the previous submodule, a deep reinforcement learning method is used to build a training model. The process uses the tf.keras and tf.agent libraries under the TensorFlow framework. The first step of model training is to define the state space and action space: the state space includes indicators such as network delay, throughput, and packet loss rate, while the action space consists of network segmentation strategies and MPLS path selection schemes, which ensures that the model can learn how to choose the optimal network configuration strategy based on given network performance indicators. The design of the reward function is based on the degree of improvement in network performance and security, which means that the model is trained to take actions that can significantly improve network performance and security. The setting of training parameters, such as the learning rate is set to 0.001 and the number of iterations is set to 200, is determined based on experience and pre-experimental results, aiming to balance the learning speed and model performance. Through continuous iterations, the strategies learned by the model are gradually optimized. The training process of the model is essentially a process of exploration and utilization. Through the feedback reward mechanism, the model can identify and adopt strategies that can improve network performance and security. After the training is completed, an optimized reinforcement learning model is obtained, which can propose the optimal network configuration strategy according to the current network status. This model has extremely high practical value for dynamic and changing network environments.

[0108] In the policy adjustment submodule, the real-time adjustment of network policies is performed based on the trained and optimized reinforcement learning model. This process involves applying the optimal actions output by the model to the actual network configuration. Specifically, a Python script is used to first read the network segmentation strategy and MPLS path selection scheme recommended by the reinforcement learning model. Then, through the apply_changes() function, these recommended strategies are automatically applied to the network configuration, including but not limited to the adjustment of VLAN settings, the update of routing tables, and other operations. This process not only takes into account the optimization of network performance, but also takes into account the stability and security of the network, ensuring that there is sufficient verification and testing before any changes are implemented. Through the application of automated scripts, the update of network configuration becomes efficient and accurate, greatly reducing the risk of manual configuration errors. The generated is an optimized network policy, which is directly reflected in the improvement of network performance and higher network security. The key to this process is to be able to quickly respond to changes in the network environment, adjust the network configuration in a timely manner, and ensure the continuity and reliability of network services, which is crucial to maintaining the network running in the best state.

[0109] See also Figure 7 ,The prediction model module includes a time series analysis submodule, a machine learning prediction submodule, and a prediction result processing submodule;

[0110] The time series analysis submodule uses the ARIMA model to perform time series analysis based on the network status dataset, including using Python's statsmodels library to perform ARIMA model configuration, setting the model parameter order = (2, 1, 2), predicting the network traffic trend in the future time period, and generating time series forecast data;

[0111] The machine learning prediction submodule uses the random forest algorithm for machine learning prediction based on time series prediction data. It uses the RandomForestRegressor in the Scikit-learn library, sets the number of trees n_estimators = 100 and the maximum tree depth max_depth = 10. The training set features include historical traffic data and time series prediction data. It refines the prediction of network access patterns and potential security threats, and generates machine learning prediction results.

[0112] The prediction result processing submodule performs data post-processing based on the machine learning prediction results, including applying Python scripts to filter the prediction results by threshold threshold=0.8 and aggregate the results to generate network access prediction results.

[0113] In the time series analysis submodule, the ARIMA model is used to perform time series analysis on the network status data set, and a method for accurately predicting future network traffic trends is established. The data set is first preprocessed, including null value processing, outlier removal, and time series stationarity test to ensure the quality of the model input data. Then, using Python's statsmodels library, the ARIMA model is configured as order = (2, 1, 2). This parameter configuration is selected based on the analysis results of the autocorrelation graph and partial autocorrelation graph, and the Akaike Information Criterion (AIC) minimization principle. The parameters 2, 1, and 2 in the model represent the order of the autoregressive term, the difference order, and the order of the moving average term, respectively. This configuration enables the model to capture the seasonal and trend characteristics of time series data. By training the model, the changing trend of network traffic in the future can be predicted. In order to verify the accuracy of the prediction results, a rolling prediction method is adopted, that is, using historical data to predict the value of the next time point, then comparing the predicted value with the actual value, and continuously adjusting the model parameters to optimize the prediction performance. The time series prediction data generated by this process not only provides a scientific basis for network traffic management, but also helps network administrators formulate more reasonable bandwidth allocation and network maintenance plans.

[0114] In the machine learning prediction submodule, the random forest algorithm is used to perform further machine learning predictions on the time series prediction data, and the RandomForestRegressor in the Scikit-learn library is used to build the model. The core of this model is to set the number of trees n_estimators to 100 and the maximum depth of the tree max_depth to 10. This configuration is designed to improve the prediction performance of the model while avoiding overfitting. The features of the training set not only include historical traffic data, but also integrate the prediction data generated by the time series analysis submodule. This fusion strategy increases the data dimension of the prediction model and helps capture more complex network access patterns. By training this model, the prediction of network access patterns and potential security threats can be refined, providing strong data support for network security management. The model training process includes steps such as feature selection, model parameter tuning, and cross-validation to ensure the accuracy and reliability of the prediction results. The generated machine learning prediction results are a set of data sets that predict network traffic and potential security events, which are crucial for identifying and preventing network security threats in advance.

[0115] In the prediction result processing submodule, the machine learning prediction results are subjected to refined post-processing operations, mainly including threshold filtering and result aggregation. Threshold filtering is achieved by setting a threshold value of threshold=0.8. Only when the confidence of the prediction result is higher than this threshold value, it is considered as a valid prediction. This operation greatly reduces the possibility of false positives and ensures the quality of the prediction results. Result aggregation is to merge multiple similar prediction results into one to simplify the representation of the results and facilitate analysis. These operations are implemented through Python scripts to ensure the automation and efficiency of the processing process. Through the processing of this submodule, network access prediction results are generated. These results are presented in an easy-to-understand format, helping network administrators quickly identify network access trends and potential security threats, and providing a scientific basis for formulating network strategies and security protection measures.

[0116] See also Figure 8 ,The ACL rule generation module includes an access pattern analysis submodule, an ACL rule customization submodule, and a rule update submodule;

[0117] The access pattern analysis submodule uses the time series analysis method based on the network access prediction results, uses Python's Pandas library for data serialization, sets the time window parameter to 30 days for access pattern recognition, applies the clustering algorithm, uses the KMeans function in the Scikit-learn library, sets the cluster number parameter to 5, extracts access behavior features, and generates an access feature summary;

[0118] The ACL rule customization submodule is based on the access feature summary, adopts the decision tree algorithm, uses the DecisionTreeClassifier function in the Scikit-learn library, sets the tree depth parameter to 10 for access control policy design, applies the genetic algorithm, uses the DEAP library for dynamic ACL rule customization, sets the population size parameter to 50, the crossover rate parameter to 0.8, and the mutation rate parameter to 0.05 for rule customization, and generates a customized ACL rule draft;

[0119] The rule update submodule is based on the customized ACL rule draft and adopts the simulated annealing algorithm. The SimPy library is used to set the starting temperature parameter to 100 and the cooling rate parameter to 0.95 to verify the validity of the rule. The incremental learning method is applied and the partial_fit function in the Scikit-learn library is used to automatically update and adjust the ACL rules to generate the current ACL rules.

[0120] In the access pattern analysis submodule, the goal is to extract the characteristics of access behavior from the network access prediction results. This process first requires the data to be serialized through Python's Pandas library, where the time window parameter is set to 30 days, in order to capture long-term trends and periodic patterns while excluding the interference of short-term fluctuations. Subsequently, a clustering algorithm is used to analyze the data, and clustering is performed using the KMeans function of the Scikit-learn library, with the number of clusters parameter set to 5. The purpose of this step is to group data points with similar access patterns into a group, thereby identifying the main patterns of network access behavior. By analyzing the clustering results, the center points representing each cluster can be extracted, which reflect the most typical access behavior characteristics. The generated access feature summary provides network administrators with a clear overview of access patterns, helping them understand the usage of the network, so as to better manage network resources and plan network security strategies.

[0121] In the ACL rule customization submodule, access control policies are designed based on access feature summaries using a decision tree algorithm, and dynamic ACL rules are customized using a genetic algorithm. This process first uses the DecisionTreeClassifier function of the Scikit-learn library with the tree depth parameter set to 10 to map access features to access control decisions in the form of a decision tree. The decision tree provides a clear set of rules that indicate the control measures that should be taken given a specific access feature. Subsequently, the genetic algorithm is executed using the DEAP library with a population size of 50, a crossover rate of 0.8, and a mutation rate of 0.05 to optimize the initial ACL rule set generated by the decision tree. The genetic algorithm iteratively improves the rule set by simulating the process of natural selection, and the resulting customized ACL rule draft takes into account both network security requirements and optimizes network performance. This dynamic customization process ensures that ACL rules can adapt to changes in network behavior and improves network security and flexibility.

[0122] In the rule update submodule, it is responsible for verifying and adjusting the customized ACL rules to ensure their effectiveness in practical applications. This process uses the simulated annealing algorithm, and the starting temperature parameter is set to 100 and the cooling rate parameter is set to 0.95 through the SimPy library. The simulated annealing algorithm helps to find the global optimal solution by gradually reducing the search space, avoiding stagnation at the local optimal solution. After determining the effective ACL rules, the incremental learning method is applied using the partial_fit function in the Scikit-learn library to automatically update and adjust the rules. This method allows the system to adapt to new access patterns without interrupting services, thereby continuously maintaining the optimal state of network security policies. The current ACL rules generated are the latest reflection of the network access control policy, which not only improves the security of the network, but also ensures the effective use of network resources and service quality.

[0123] See also Fig. 9 ,The game theory optimization module includes the strategy definition submodule, the game model building submodule, and the Nash equilibrium solving submodule;

[0124] The strategy definition submodule performs mathematical modeling to define the game model of the network segmentation strategy based on the optimized network strategy and the current VLAN configuration, including identifying the network segmentation strategy as a participant, taking the potential decisions of each strategy as a strategy set, and the utility function evaluates the impact of each decision based on network performance indicators including throughput and latency. The utility matrix is ​​constructed using Python's numpy library to generate the network segmentation strategy game model.

[0125] The game model construction submodule is based on the network segmentation strategy game model. Matlab is used to build the model. The function gametheory.createGame of GameTheory Toolbox is used to set the utility function parameters of each strategy, including setting the network throughput network_throughput to 150Mbps and the network delay latency to 50ms. The payment matrix between strategies is constructed to generate the game theory model and payment matrix.

[0126] The Nash equilibrium solving submodule is based on the game theory model and the payoff matrix, and uses the genetic algorithm to capture the Nash equilibrium point of the strategy combination, including setting the algorithm's population size population_size to 50, the crossover rate crossover_rate to 0.7, and the mutation rate mutation_rate to 0.01. The genetic algorithm is implemented using Python's deap library. Through multiple generations of iterative optimization of the strategy combination, the optimal combination of multiple network segmentation strategies is captured to generate a collaborative optimization strategy.

[0127] In the policy definition submodule, a game model for network segmentation strategies is formed based on the optimized network strategy and the current VLAN configuration by adopting a mathematical modeling method. The process first identifies the network segmentation strategies as game participants and defines the decision behavior of each strategy as a strategy set. In order to evaluate the impact of each decision on network performance, performance indicators including throughput and latency are incorporated into the utility function. This submodule uses the Python programming language and its powerful mathematical library numpy to model the utility function and construct a utility matrix. The specific implementation process involves defining a utility function for each strategy, which outputs different values ​​to reflect the impact of the strategy on network performance depending on the strategy decision. By writing Python scripts and using the numpy library to perform numerical calculations on these utility functions, a multi-dimensional utility matrix is ​​generated. This matrix records in detail the utility values ​​of each participating strategy under different strategy combinations, that is, the expected network performance under various network configurations. The utility matrix becomes the basis for analyzing and understanding the interaction between different network segmentation strategies, and provides data support for the subsequent game theory model construction. Through meticulous mathematical modeling and program implementation, this submodule successfully defines a basic game framework for network segmentation strategies and lays the foundation for further strategy optimization and decision analysis in the form of a utility matrix.

[0128] In the game model construction submodule, the Matlab programming environment and the gametheory.createGame function in its Game Theory Toolbox are used to further refine and construct the game theory model of the network segmentation strategy. The core task of this submodule is to set and adjust the utility function parameters of each strategy according to the utility matrix defined in the previous step, including key network performance indicators such as network throughput network_throughput and network delay latency. Through the Matlab script, the role and position of these parameters in the utility function are clarified to ensure that the utility function of each strategy can accurately reflect the performance under specific network performance indicators. On this basis, the submodule uses Matlab's matrix operation and calculation functions, combined with the gametheory.createGame function, to construct the payment matrix between strategies. The payment matrix shows in detail the benefits (or costs) of each strategy under different strategy combinations, and is a key tool for understanding and analyzing the interactions between game participants. By accurately setting the utility function parameters and using the powerful computing power of Matlab, this submodule successfully constructs a specific game theory model and its payment matrix, providing a solid analysis platform for analyzing the dynamic relationship between network segmentation strategies and finding the optimal strategy combination.

[0129] In the Nash equilibrium solution submodule, a genetic algorithm is used to analyze the aforementioned game theory model and payoff matrix to capture the Nash equilibrium point of the strategy combination. The genetic algorithm is an optimization algorithm that simulates natural selection and genetic mechanisms. It gradually finds the optimal solution or approximate optimal solution of the problem through iterative evolution. This submodule sets the algorithm population size to 50 to ensure sufficient search space; the crossover rate is set to 0.7 to ensure that the algorithm can effectively combine the advantages of different strategies during the iteration process; the mutation rate is set to 0.01 to introduce new strategy mutations to prevent the algorithm from prematurely converging to the local optimal solution. By writing Python scripts, the genetic algorithm is implemented using the deap library, which provides a set of flexible and powerful tools for developing and testing evolutionary algorithms. The implementation process of the genetic algorithm includes steps such as initializing the population, evaluating individual fitness, selection, crossover and mutation. This series of operations are performed on the population in each generation to gradually optimize the strategy combination. Through multiple generations of iterative optimization, the algorithm successfully captures the strategy combination that makes all participating strategies unable to obtain better utility by changing their own strategies alone, that is, the Nash equilibrium point of the multi-network segmentation strategy. The successful implementation of the sub-modules not only found the optimal combination of network segmentation strategies, but also provided a new method based on game theory and genetic algorithms for network management and optimization, demonstrating efficient strategy collaborative optimization effects.

[0130] See also Fig.10 ,The event-driven adjustment module includes event definition and detection submodule, event processing logic construction submodule, and stream data analysis submodule;

[0131] The event definition and detection submodule uses the Esper engine to define event patterns based on the current ACL rules, including setting the event type parameter eventType to networkAnomaly and the detection threshold parameter thresholdValue to 100 times / minute to identify and classify real-time network events, continuously monitor the network status, and detect target network events by defining event patterns and detection logic to generate event detection results;

[0132] The event processing logic construction submodule uses the decision tree algorithm based on the event detection results, uses the DecisionTreeClassifier function in the Scikit-learn library, and sets the tree depth parameter max_depth = 10 to construct the event processing strategy. According to the type and impact of the event, the processing logic and response measures are designed, the network security strategy and configuration are dynamically adjusted, and the event processing strategy is generated;

[0133] The stream data analysis submodule adopts the stream data processing method based on the event processing strategy and real-time network status data, uses Apache Flink to analyze the real-time data stream, sets the window size parameter windowSize to 5 seconds for dynamic analysis and response of network events, and uses stream data analysis technology to continuously process the network status data, dynamically adjust the network segmentation strategy and configuration according to the event processing strategy, respond to the real-time changes of the network environment, and generate event response strategies.

[0134] In the event definition and detection submodule, the Esper engine is used to define event patterns, and the current access control list (ACL) rules are combined to identify and classify real-time network events. This process relies on the powerful event processing capabilities of the Esper engine. First, the event type parameter eventType is defined as networkAnomaly, the detection of network anomaly events is specified, and the detection threshold parameter thresholdValue is set to 100 times / minute, aiming to capture network anomaly activities that frequently exceed this threshold. The Esper engine uses an event-driven approach to continuously monitor the network status. Its technology based on complex event processing (CEP) can analyze and process event stream data in real time. In the specific implementation, defining event patterns includes writing Esper EPL (EventProcessing Language) query statements, which accurately describe the characteristics and detection logic of the events of interest, such as continuous high-frequency network requests. Through these predefined patterns, Esper can detect matching event instances from continuous data streams, that is, network anomaly behaviors that meet preset thresholds and characteristics. The event detection results generated by this process include not only detailed information about the identified anomaly events, such as the time, type, and frequency of occurrence, but also related network traffic and request data. Through detailed event pattern definition and real-time detection logic, this submodule effectively identifies and classifies target network events, providing critical real-time data support and alarm functions for network security management.

[0135] In the event processing logic construction submodule, the decision tree algorithm is used to build the event processing strategy based on the event detection results. The DecisionTreeClassifier function in Python's Scikit-learn library is used, and the tree depth parameter max_depth is set to 10 to design specific processing logic and response measures for each identified network event. The decision tree algorithm automatically generates decision rules by learning the relationship between event features and expected responses. These rules are organized in a tree structure, with the root node representing all data, each internal node representing a decision rule, and the leaf node representing the decision result, that is, the event processing strategy. By training the decision tree model and analyzing the event type, frequency of occurrence and other features, the model can automatically divide the data set and form response strategies for network anomaly events of different types and levels. This process involves steps such as feature selection, tree generation and pruning to prevent overfitting and improve the generalization ability of the model. The generation of the decision tree dynamically adjusts the network security policy and configuration based on the data features in the event detection results, such as adjusting the ACL rules to block or limit abnormal traffic. In this way, this submodule not only defines clear processing logic for different events, but also dynamically adjusts the response measures according to the severity and type of the event, effectively improving the flexibility and efficiency of network security management.

[0136] In the stream data analysis submodule, Apache Flink is used to analyze real-time data streams based on event processing strategies and real-time network status data. The window size parameter windowSize is set to 5 seconds to dynamically analyze and respond to network events. Apache Flink is a high-performance, scalable stream processing framework that can handle large-scale data streams. By defining windows, Flink can collect data streams in each time window, aggregate, calculate and analyze them, thereby achieving continuous monitoring and evaluation of network status. On this basis, combined with the event processing strategy, the Flink task applies predefined processing logic to the collected data, such as dynamically adjusting the network segmentation strategy and configuration according to the type of network anomaly detected. In this process, Flink uses its built-in time window function and state management capabilities to process and analyze network data in real time to ensure that response measures can be executed in a timely and effective manner. The application of stream data analysis technology not only enhances the adaptability and flexibility of network security strategies, but also enables the network environment to respond quickly to real-time changes, effectively reducing the impact of network anomaly events on the system. In this way, the submodule generates a set of dynamically adjusted event response strategies, providing powerful real-time data support and decision-making basis for network security management.

[0137] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A VLAN division and independent network card interface system for high-speed signal connection switch, characterized in that: The system includes a network status monitoring module, a graph neural network analysis module, a VLAN dynamic configuration module, a reinforcement learning optimization module, a prediction model module, an ACL rule generation module, a game theory optimization module and an event-driven adjustment module; The network status monitoring module uses a real-time data collection method to collect data based on network devices and connection status, analyzes the collected data through stream data processing technology, conducts a comprehensive analysis of the real-time status of the network, and generates a network status data set; The graph neural network analysis module uses a graph neural network model based on the network status data set to encode the network topology structure, analyze the correlation and communication mode between network devices, parse the complexity characteristics of the network structure, and generate topology structure analysis results; The graph neural network analysis module includes a topological data modeling submodule, a GNN training submodule and a topological association analysis submodule; The topology data modeling submodule is based on the network status data set, adopts the graph neural network algorithm, and uses the PyTorch framework to define the graph structure, including nodes representing network devices, edges representing the connection relationship between devices, and assigning feature vectors to each node and edge to capture network topology information and generate a graph data model; The GNN training submodule is based on a graph data model, adopts a graph convolutional network algorithm, uses the PyTorch framework for model training, sets training parameters, including setting the learning rate to 0.01, the batch size to 32, and the number of iterations to 100 rounds, aggregates and updates node features using the graph structure, obtains hidden patterns in the network topology, and generates a trained and optimized GNN model; The topology association analysis submodule performs network topology association analysis based on the trained and optimized GNN model, uses the PyTorch framework and the trained model to perform predictive analysis on the current network status data, identifies the dependencies between network devices, analyzes potential communication modes and bottlenecks, and generates topology structure analysis results; The VLAN dynamic configuration module adopts an automated configuration strategy based on the topology analysis result to dynamically adjust the VLAN to match the real-time changes in the network topology, automatically update the VLAN configuration, and generate the current VLAN configuration; The reinforcement learning optimization module uses a deep reinforcement learning method based on the network status data set and the current VLAN configuration to optimize the network segmentation strategy and MPLS path selection, guides the model scheduling through the reward mechanism to improve network performance and security, and generates an optimized network strategy; The prediction model module uses time series analysis and machine learning methods based on the network status data set to analyze historical network access data, predict and analyze network access patterns and VLAN configuration requirements in the future time period, identify potential access patterns and security threats, and generate network access prediction results; The ACL rule generation module automatically generates or adjusts ACL rules based on the network access prediction results, analyzes the prediction results, sets access control policies, and generates current ACL rules by using a dynamic rule generation method; The game theory optimization module uses game theory methods based on the optimized network strategy and the current VLAN configuration to analyze the interaction between multiple network segmentation strategies, capture the optimal combination of multiple network segmentation strategies by solving the Nash equilibrium, perform overall optimization of network performance, and generate a collaborative optimization strategy; The event-driven adjustment module uses complex event processing and stream data processing methods based on the network status data set and current ACL rules to monitor and analyze real-time network events, dynamically adjust the network segmentation strategy and VLAN configuration according to the type and impact of the event, respond to changes in the network environment, and generate event response strategies.

2. The VLAN division and independent network card interface system of the high-speed signal connection switch according to claim 1, characterized in that: The network status data set includes device connection status, traffic size and load ratio. The topology structure analysis results are specifically the relationship strength between nodes, node attribute characteristics and network communication paths. The current VLAN configuration includes adding VLAN identifiers, adjusting VLAN members and deleting outdated VLAN configurations. The optimized network strategy specifically refers to adjusting network segmentation boundaries, optimizing MPLS path settings and optimizing data transmission efficiency. The network access prediction results include peak traffic period prediction, potential security threat identification and access mode change trends. The current ACL rules include access permission refinement, time period access control and target service access restriction. The collaborative optimization strategy is specifically the optimal balance point between strategies, performance-maximizing VLAN configuration and resource allocation efficiency improvement plan. The event response strategy includes real-time security event response, automated VLAN configuration adjustment and emergency traffic control measures.

3. The VLAN division and independent network card interface system of the high-speed signal connection switch according to claim 1, characterized in that: The network status monitoring module includes a data acquisition submodule, a stream data processing submodule and a status analysis submodule; The data acquisition submodule uses the tcpdump tool to perform network data capture based on the network device and connection status, sets the filter rule to tcp port 80 to capture only HTTP traffic, runs the tcpdump command to perform real-time data capture, and generates real-time network data; The stream data processing submodule uses Apache Flink to process stream data based on real-time network data, configures the time window to 5 seconds for windowed processing of stream data, uses Flink's filter function to filter out data records with abnormal traffic, and uses the map function to convert the data format to generate processed network data; The status analysis submodule uses Python's Pandas library to perform data analysis based on the processed network data, uses the DataFrame structure to store data, applies the groupby and agg functions to calculate the average traffic in each time period, uses the query method to filter high-traffic time periods, and generates a network status data set.

4. The VLAN division and independent network card interface system of the high-speed signal connection switch according to claim 1, characterized in that: The VLAN dynamic configuration module includes a VLAN configuration generation submodule, a configuration automation submodule and a configuration update submodule; The VLAN configuration generation submodule automatically generates VLAN configurations based on the topology analysis results using a network configuration script language, including identifying differentiated network segments in the network topology and assigning a unique VLAN ID ranging from 100 to 200 to each segment, and assigning a name to each VLAN in the format of VLAN_ plus the corresponding network segment identifier, setting access control list rules for each VLAN, and generating preliminary VLAN configurations; The configuration automation submodule uses the Ansible network automation tool based on the preliminary VLAN configuration to write a Playbook script in YAML format, including tasks that use the ios_vlan module to specify the vlan_id and name parameters to automatically deploy the VLAN configuration on the network device. During the deployment process, the Ansible ad-hoc command ansible all-m ping is used to check the connectivity of the network device and generate an automated deployment record. The configuration update submodule uses the Zabbix network monitoring tool to monitor the performance of the deployed network based on the automated deployment records, including setting monitoring items to collect the ingress and egress traffic data of the VLAN interface, using the data collection functions net.if.in and net.if.out to monitor the traffic of the target VLAN interface, comparing and analyzing the network performance differences before and after deployment, and generating the current VLAN configuration.

5. The VLAN division and independent network card interface system of the high-speed signal connection switch according to claim 1, characterized in that: The reinforcement learning optimization module includes a performance indicator analysis submodule, a reinforcement learning model training submodule and a strategy adjustment submodule; The performance indicator analysis submodule extracts network performance indicators based on the network status data set and the current VLAN configuration, uses Python's Pandas library to execute describe() and groupby() functions on the data set, summarizes network delay, throughput and packet loss rate performance indicators, provides environmental status, and generates network performance indicator results; The reinforcement learning model training submodule adopts a deep reinforcement learning method based on the network performance index results, uses the tf.keras and tf.agent libraries of the TensorFlow framework to build a model, defines the state space including network delay, throughput and packet loss rate, and the action space is the network segmentation strategy and MPLS path selection scheme. The reward function is calculated according to the degree of improvement in network performance and security. The training parameters are set including the learning rate learning_rate=0.001 and the number of iterations epochs=200. The strategy selection is optimized through the feedback reward loop to generate a training optimized reinforcement learning model; The policy adjustment submodule performs real-time adjustment of network policies based on the trained and optimized reinforcement learning model, uses Python scripts to apply the optimal actions output by the model, adjusts the network segmentation strategy and MPLS path selection, and uses the apply_changes() function to automatically update the network configuration and generate optimized network policies.

6. The VLAN division and independent network card interface system of the high-speed signal connection switch according to claim 1, characterized in that: The prediction model module includes a time series analysis submodule, a machine learning prediction submodule and a prediction result processing submodule; The time series analysis submodule uses the ARIMA model to perform time series analysis based on the network status data set, including using Python's statsmodels library to perform ARIMA model configuration, setting model parameters order = (2, 1, 2), predicting network traffic trends in future time periods, and generating time series prediction data; The machine learning prediction submodule uses the random forest algorithm to perform machine learning prediction based on time series prediction data, uses the RandomForestRegressor in the Scikit-learn library, sets the number of trees n_estimators = 100 and the maximum depth of the tree max_depth = 10, and the training set features include historical traffic data and time series prediction data, refines the prediction of network access patterns and potential security threats, and generates machine learning prediction results; The prediction result processing submodule performs data post-processing based on the machine learning prediction results, including applying a Python script to perform threshold filtering threshold=0.8 and result aggregation on the prediction results to generate network access prediction results.

7. The VLAN division and independent network card interface system of the high-speed signal connection switch according to claim 1, characterized in that: The ACL rule generation module includes an access mode analysis submodule, an ACL rule customization submodule and a rule update submodule; The access pattern analysis submodule adopts the time series analysis method based on the network access prediction results, uses Python's Pandas library to perform data serialization processing, sets the time window parameter to 30 days for access pattern recognition, applies the clustering algorithm, uses the KMeans function in the Scikit-learn library, sets the cluster number parameter to 5 to extract access behavior features, and generates an access feature summary; The ACL rule customization submodule adopts a decision tree algorithm based on the access feature summary, uses the DecisionTreeClassifier function in the Scikit-learn library, sets the tree depth parameter to 10 for access control policy design, applies a genetic algorithm, uses the DEAP library for dynamic ACL rule customization, sets the population size parameter to 50, the crossover rate parameter to 0.8, and the mutation rate parameter to 0.05 for rule customization, and generates a customized ACL rule draft; The rule update submodule is based on a customized ACL rule draft, adopts a simulated annealing algorithm, uses the SimPy library to set the starting temperature parameter to 100 and the cooling rate parameter to 0.95 to verify the validity of the rule, applies an incremental learning method, and uses the partial_fit function in the Scikit-learn library to automatically update and adjust the ACL rules to generate the current ACL rules.

8. The VLAN division and independent network card interface system of the high-speed signal connection switch according to claim 1, characterized in that: The game theory optimization module includes a strategy definition submodule, a game model construction submodule and a Nash equilibrium solution submodule; The strategy definition submodule performs mathematical modeling based on the optimized network strategy and the current VLAN configuration to define a game model of the network segmentation strategy, including identifying the network segmentation strategy as a participant, taking the potential decision of each strategy as a strategy set, and the utility function evaluates the impact of each decision according to network performance indicators including throughput and latency, and uses Python's numpy library to construct a utility matrix to generate a network segmentation strategy game model; The game model construction submodule is based on the network segmentation strategy game model, uses Matlab to build the model, uses the function gametheory.createGame of Game Theory Toolbox, sets the utility function parameters of each strategy, including setting the network throughput network_throughput to 150Mbps, setting the network delay latency to 50ms, building the payment matrix between the strategies, and generating the game theory model and the payment matrix; The Nash equilibrium solving submodule is based on the game theory model and the payoff matrix, and uses a genetic algorithm to capture the Nash equilibrium point of the strategy combination, including setting the algorithm's population size population_size to 50, the crossover rate crossover_rate to 0.7, and the mutation rate mutation_rate to 0.

01. The genetic algorithm is implemented using Python's deap library. Through multiple generations of iterative optimization of the strategy combination, the optimal combination of multiple network segmentation strategies is captured to generate a collaborative optimization strategy.

9. The VLAN division and independent network card interface system of the high-speed signal connection switch according to claim 1, characterized in that: The event-driven adjustment module includes an event definition and detection submodule, an event processing logic construction submodule and a stream data analysis submodule; The event definition and detection submodule uses the Esper engine to define event patterns based on the current ACL rules, including setting the event type parameter eventType to networkAnomaly and the detection threshold parameter thresholdValue to 100 times / minute to identify and classify real-time network events, continuously monitor the network status, and detect target network events by defining event patterns and detection logic to generate event detection results; The event processing logic construction submodule adopts the decision tree algorithm based on the event detection results, uses the DecisionTreeClassifier function in the Scikit-learn library, sets the tree depth parameter max_depth=10 to construct the event processing strategy, designs the processing logic and response measures according to the type and impact of the event, dynamically adjusts the network security strategy and VLAN configuration, and generates the event processing strategy; The stream data analysis submodule adopts a stream data processing method based on event processing strategies and real-time network status data, uses Apache Flink to analyze real-time data streams, sets the window size parameter windowSize to 5 seconds to perform dynamic analysis and response to network events, and uses stream data analysis technology to continuously process network status data, dynamically adjust network segmentation strategies and VLAN configurations according to event processing strategies, respond to real-time changes in the network environment, and generate event response strategies.

Images