Heterogeneous SD-WAN fusion-based monitoring method and system

Abstract

The invention relates to the technical field of communication transmission, in particular to a monitoring method and system based on heterogeneous SD-WAN fusion. The method comprises the following steps: acquiring heterogeneous SD-WAN monitoring data, analyzing a network component connection type and modeling a network topology structure model; extracting traffic statistical characteristics, analyzing traffic behavior modes, marking a network topology model according to the modes, and generating a network traffic topology structure model; constructing a performance reference according to the traffic topology model and the monitoring data, correcting the network traffic topology model to identify abnormal behaviors, and forming a network traffic correction topology structure model; extracting network component resource allocation characteristics, performing data fusion in combination with the correction model, and generating a network performance analysis report; and optimizing a resource allocation strategy based on the analysis report, and uploading the resource allocation strategy to a network management platform to execute an optimization task. The invention can improve the overall management efficiency of the network.

Description

Technical Field

[0001] The present invention relates to the field of communication transmission technology, and in particular to a heterogeneous SD-WAN-based fusion monitoring method and system. Background Art

[0002] With the rapid development of information technology, the complexity and scale of enterprise networks continue to expand. Traditional network architecture, especially traditional methods based on wide area networks (WANs), have gradually exposed their limitations. These limitations are mainly manifested in complex network management, low bandwidth utilization efficiency, unstable application performance, and difficulty in coping with diverse network needs. These problems become particularly prominent in the cross-regional and large-scale network connection needs between enterprises. In order to meet these challenges, software-defined wide area networks (SD-WANs) have emerged as an innovative network technology. SD-WAN technology decouples network functions from physical hardware through virtualization technology, thereby realizing centralized management and dynamic optimization of the network. SD-WAN can improve network reliability and performance through intelligent traffic management and optimization algorithms. However, due to the heterogeneity of the network environment (i.e., the diversity of network devices, connection types, transmission protocols, etc.), the implementation and management of SD-WAN has become more complicated. In practical applications, SD-WAN usually needs to be integrated with different types of network devices and technologies, including but not limited to traditional WAN devices, network devices from different manufacturers, and different types of connection media (such as MPLS, broadband Internet, LTE / 5G, etc.). The variety of network devices and protocols in heterogeneous environments make it impossible for traditional monitoring methods to integrate complex network monitoring parameters and make configuration difficult. Summary of the invention

[0003] Based on this, it is necessary for the present invention to provide a heterogeneous SD-WAN fusion monitoring method and system to solve at least one of the above technical problems.

[0004] To achieve the above purpose, a heterogeneous SD-WAN fusion monitoring method includes the following steps:

[0005] Step S1: Obtain heterogeneous SD-WAN environment monitoring data, and perform network component connection type analysis based on the heterogeneous SD-WAN environment monitoring data, thereby obtaining network component connection type data; perform heterogeneous SD-WAN network topology modeling based on the network component connection type data, thereby obtaining a network topology structure model;

[0006] Step S2: extracting traffic statistical features from heterogeneous SD-WAN environment monitoring data to obtain traffic statistical data, and performing traffic behavior pattern analysis based on the traffic statistical data to obtain traffic behavior pattern data; classifying and marking the network topology structure model based on the traffic behavior pattern data to obtain a network traffic topology structure model;

[0007] Step S3: constructing a performance benchmark based on the network traffic topology structure model and the heterogeneous SD-WAN environment monitoring data to obtain network performance benchmark data, and performing abnormal behavior correction on the network traffic topology structure model based on the network performance benchmark data to obtain a network traffic correction topology structure model;

[0008] Step S4: extracting network component resource allocation features from heterogeneous SD-WAN environment monitoring data to obtain network component resource allocation data; performing multi-dimensional data fusion on the network component resource allocation data through a network traffic correction topology structure model to obtain a network performance analysis report;

[0009] Step S5: Optimize the component resource allocation strategy of the network component resource allocation data based on the network performance analysis report to obtain the optimized network component resource allocation strategy, and upload it to the heterogeneous SD-WAN network management platform to perform the resource allocation optimization task.

[0010] By acquiring and analyzing the monitoring data of the heterogeneous SD-WAN environment, the present invention can accurately understand the connection status and network topology of each network component. This helps to clearly depict the actual operation of the network, thereby laying the foundation for subsequent optimization and troubleshooting. Traffic statistical feature extraction and traffic behavior pattern analysis can reveal the actual usage and behavior patterns of network traffic. This is crucial to identifying traffic anomalies and performance bottlenecks, and helps to establish a more accurate network traffic topology model to better understand and manage network traffic, solve the complex management problems caused by the diversity of network devices and connection types, and provide a clear network view through systematic topology modeling, which helps to better understand and manage the structure of the network. Building a network performance benchmark and correcting abnormal behavior of the traffic topology model helps to identify and correct anomalies and potential problems in the network. In this way, the network performance can be ensured to be within the expected range, the stability and reliability of the overall network can be improved, the problem that the traditional monitoring method cannot monitor the network performance in real time can be solved, and the accuracy of network fault detection and performance management can be improved through the dynamic correction model. By extracting the resource allocation characteristics of network components and performing multi-dimensional data fusion, a detailed network performance analysis report can be generated. It not only integrates a variety of monitoring data, but also provides in-depth performance analysis to help identify optimization opportunities for resource allocation, thereby enhancing the accuracy of network resource management, which helps to gain a deeper understanding of resource usage and provide data support for subsequent resource optimization decisions. Optimizing resource allocation strategies based on performance analysis reports can improve the utilization efficiency of network resources, reduce resource waste, and improve network performance, which makes resource allocation in SD-WAN environments more reasonable and efficient, ultimately improving the overall performance of the network, achieving intelligent optimization of resource allocation, and solving the problem of low management efficiency caused by complex configuration of traditional methods. The overall performance and management efficiency of the network are improved by implementing optimization strategies. In summary, these steps effectively solve the problem of difficult integration and configuration of complex network monitoring parameters in heterogeneous environments through systematic data analysis and model optimization.

[0011] Optionally, step S1 specifically includes:

[0012] Step S11: Obtain heterogeneous SD-WAN environment monitoring data, and extract network component connection features from the heterogeneous SD-WAN environment monitoring data, thereby obtaining network component connection data;

[0013] Step S12: classifying the network component connection data into network component connection types, thereby obtaining network component connection type data;

[0014] Step S13: integrating the network center component connection relationship according to the network component connection type data, thereby obtaining the center component connection relationship data;

[0015] Step S14: Perform network communication topology analysis based on the central component connection relationship data to obtain a network topology model.

[0016] By acquiring heterogeneous SD-WAN environment monitoring data and extracting network component connection features, the present invention can understand in detail the connection methods and characteristics between different network components, which helps to identify potential bottlenecks or anomalies in the network and provide basic data for subsequent analysis. By classifying the network component connection data into types, different types of connections can be distinguished to help understand the specific roles and functions of each component in the network, thereby providing a basis for network optimization and troubleshooting. By integrating the connection relationship of the central components according to the network component connection type data, the connection relationship of the key components in the network can be clarified to ensure the stability and efficiency of the core part of the network, and at the same time help to discover potential risks of the central node. By analyzing the network communication topology based on the central component connection relationship data, a detailed topology model of the network can be formed, which helps to fully understand the overall architecture of the network, optimize the network layout, and improve network performance and reliability.

[0017] Optionally, step S12 is specifically:

[0018] Step S121: performing component connection frequency statistics on the network component connection data, thereby obtaining high-frequency connection component data and low-frequency connection component data;

[0019] Step S122: selecting the highest frequency connection component according to the high frequency connection component data, thereby obtaining the network center component data;

[0020] Step S123: performing central component connection frequency statistics on the high-frequency connection component data and the low-frequency connection component data according to the network central component data, thereby obtaining high-frequency central component connection component data and low-frequency central component connection component data;

[0021] Step S124: extracting component network connection delay features according to the network component connection data, thereby obtaining component network connection delay data;

[0022] Step S125: classifying network delay components according to the component network connection delay data, thereby obtaining high-delay connection component data and low-delay connection component data;

[0023] Step S126: performing a connection component intersection operation on the high-frequency central component connection component data and the low-latency connection component data, thereby obtaining normal network connection component data; performing a connection component intersection operation on the low-frequency central component connection component data and the high-latency connection component data, thereby obtaining temporary network connection component data;

[0024] Step S127: Component connection merging is performed according to the network center component data, the normal network connection component data and the temporary network connection component data, so as to obtain network component connection type data.

[0025] The present invention can identify the core components in the network by counting the frequency, which are usually high-frequency connection components. In this way, the key structure of the network can be better understood. Knowing which components are frequently connected can help network administrators optimize resource allocation and ensure that these key components have sufficient bandwidth and processing power. Identifying low-frequency connection components can help find infrequently used resources, thereby optimizing or adjusting the network. Selecting the highest frequency connection components can identify the central nodes in the network. These central nodes play a key role in the network, and their analysis helps to optimize the network structure. Understanding the network center components can help enhance the robustness of the system in network design and maintenance and reduce the impact of network failures on overall performance. Through the statistics of the connection frequency of the central components, the connection mode of the network can be analyzed more deeply, and the high-frequency and low-frequency central component connections can be identified. Understanding the central components with different connection frequencies can optimize the network layout, improve the network design, and improve the overall network performance. Delay feature extraction can help identify performance bottlenecks in the network, understand which component connections have higher delays, and then optimize these connections. By reducing network delays, the user experience can be improved, especially in applications that require real-time response, such as video conferencing and online games. The classified data can help network administrators prioritize high-delay components and take measures to improve their performance. Through classification, network maintenance and optimization can be carried out more targetedly, reducing the impact on the entire network. Through intersection operations, normal network connection components and temporary network connection components can be effectively distinguished to help understand different types of connections in the network. Identifying normal and temporary connection components helps optimize network scheduling and load balancing, ensuring efficient use of network resources. By merging different types of data, a comprehensive network connection view can be formed to help understand the network structure more comprehensively. Comprehensive data merging and analysis can provide strong support for network optimization and decision-making, and improve the efficiency and effectiveness of network management.

[0026] Optionally, step S14 is specifically:

[0027] Step S141: extracting component routing protocol features from heterogeneous SD-WAN environment monitoring data, thereby obtaining component routing protocol data;

[0028] Step S142: performing component routing protocol clustering according to the component routing protocol data, thereby obtaining routing protocol clustering component data;

[0029] Step S143: performing network protocol topology structure analysis according to routing protocol cluster component data and network component connection data, thereby obtaining a network protocol topology structure model;

[0030] Step S144: Analyze the logical topology structure of the virtual local area network according to the central component connection relationship data, so as to obtain a network logical topology structure model;

[0031] Step S145: Perform topology mapping on the network protocol topology structure model and the network logic topology structure model, so as to obtain a network topology structure model.

[0032] The present invention can convert complex network monitoring data into useful component routing protocol data by extracting features from monitoring data, which is convenient for further analysis and processing. Identifying and extracting the features of routing protocols helps to understand the behaviors and characteristics of different protocols in the network, thereby laying the foundation for subsequent analysis and optimization. By analyzing specific routing protocol features, potential network performance problems or optimization points can be found, and the efficiency and stability of the overall network can be improved. Clustering can classify routing protocols with similar features into one category, thereby simplifying and organizing data, and facilitating pattern recognition and analysis. Through cluster analysis, the commonalities and differences of different protocols in the network can be identified, and the interaction modes of different components in the network can be understood, which helps to optimize network configuration. The clustering results can be used to optimize network management and monitoring strategies to ensure efficient operation and coordination of network components. Through topological structure analysis, the connection relationship and data flow of each component in the network can be fully understood, revealing the overall structure of the network. Understanding the topological structure of the network protocol helps to optimize network design and improve network performance and fault tolerance. The network topology model can help quickly locate and solve network failures and improve network reliability. Through logical topology analysis, we can deeply understand the logical structure and connection relationship in the virtual local area network (VLAN) and adapt to the management needs of the virtualized environment. The logical topology model can support flexible network configuration and management, and improve the scalability and adaptability of the network. Understanding the logical topology structure helps to optimize the allocation of virtual network resources and ensure the efficient use of network resources. By mapping the protocol topology and the logical topology model, a comprehensive network topology model can be obtained, which can more comprehensively understand the actual operation of the network. This comprehensive model provides a more accurate network view, which helps to optimize the network and diagnose problems more effectively. The network topology model can support network planning and decision-making, and help formulate network expansion and optimization strategies.

[0033] Optionally, step S2 specifically includes:

[0034] Step S21: extracting traffic statistical features from heterogeneous SD-WAN environment monitoring data to obtain traffic statistical data;

[0035] Step S22: Analyze the traffic behavior pattern of network components according to the traffic statistics data, so as to obtain the traffic behavior pattern data of network components;

[0036] Step S23: performing similarity evaluation based on the network component traffic behavior pattern data, thereby obtaining traffic behavior pattern similarity data;

[0037] Step S24: clustering the network component traffic behavior pattern data according to the traffic behavior pattern similarity data, thereby obtaining traffic behavior pattern data;

[0038] Step S25: marking the network component traffic behavior patterns of the network topology structure model according to the traffic behavior pattern data, thereby obtaining a network traffic topology structure model.

[0039] The present invention can obtain accurate traffic data by extracting traffic statistics features from monitoring data of a heterogeneous SD-WAN environment, thereby providing basic data for subsequent analysis. This helps to understand the overall pattern and trend of traffic, thereby laying the foundation for network optimization. After analyzing the traffic data, the traffic behavior patterns of network components can be identified. This helps to understand the behavioral characteristics and load conditions of each component in the network, and provides a basis for further traffic management and optimization. By evaluating the similarity of traffic behavior patterns, network components with similar traffic behaviors can be found. This process helps to identify components with similar traffic characteristics, thereby simplifying subsequent pattern clustering and management. Clustering the traffic behavior patterns of network components can group components with similar behaviors. This helps to better organize and manage network components and improve the efficiency of network monitoring and maintenance. Labeling the network topology model according to the traffic behavior pattern data can provide a detailed network traffic topology view. This helps to gain an in-depth understanding of the actual traffic patterns of the network, thereby performing more effective network design, optimization, and troubleshooting.

[0040] Optionally, step S22 is specifically:

[0041] Step S221: extracting network component traffic fluctuation characteristics from traffic statistical data, thereby obtaining network component traffic fluctuation data;

[0042] Step S222: Calculate the network component traffic benchmark based on the network component traffic fluctuation data, thereby obtaining the network component traffic benchmark data;

[0043] Step S223: dividing the network component traffic fluctuation data into traffic fluctuation stages according to the network component traffic benchmark data, thereby obtaining network component traffic fluctuation stage division data;

[0044] Step S224: performing traffic fluctuation periodicity statistics according to the network component traffic fluctuation data, thereby obtaining the network component traffic fluctuation periodicity data;

[0045] Step S225: Perform traffic behavior pattern recognition and integration based on the network component traffic fluctuation phase division data and the network component traffic fluctuation periodicity data, so as to obtain the network component traffic behavior pattern data.

[0046] The present invention extracts traffic fluctuation characteristics, which helps to gain a deeper understanding of the traffic behavior of network components under different conditions. This provides basic data for identifying traffic anomalies or potential problems, and helps to monitor the network status more accurately. By calculating the traffic benchmark, standards for the normal operation of network components can be established to help detect and diagnose abnormal situations. The benchmark data provides a reference standard for comparing and evaluating traffic fluctuations. Phased division of traffic fluctuations can decompose traffic data into different stages, thereby identifying different fluctuation patterns. This helps to understand the regularity and periodicity of traffic changes and optimize the allocation of network resources. Periodic statistics of traffic fluctuations can reveal regular changes and periodic patterns of traffic. Understanding these patterns helps predict traffic peaks and troughs and improve the efficiency of network resource use. By integrating traffic fluctuation stage division data and periodic data and performing behavioral pattern recognition, the behavioral characteristics of network components can be deeply understood. This helps to optimize network management strategies and enhance network stability and performance.

[0047] Optionally, step S3 specifically includes:

[0048] Step S31: extracting network transmission features from heterogeneous SD-WAN environment monitoring data to obtain network transmission data, and calculating network component transmission packet loss rate from the network transmission data to obtain component transmission packet loss rate data;

[0049] Step S32: Calculate the component network link traffic jitter on the network traffic topology structure model, thereby obtaining component network link traffic jitter data;

[0050] Step S33: performing traffic jitter benchmark statistics on the component network link traffic jitter data, thereby obtaining traffic jitter benchmark data; performing transmission packet loss rate benchmark statistics on the component transmission packet loss rate data, thereby obtaining transmission packet loss rate benchmark data;

[0051] Step S34: constructing a weighted average benchmark according to the traffic jitter benchmark data and the transmission packet loss rate benchmark data, thereby obtaining network performance benchmark data;

[0052] Step S35: Correct the abnormal behavior of the network traffic topology structure model according to the network performance benchmark data, so as to obtain a network traffic corrected topology structure model.

[0053] The present invention extracts network transmission characteristics and calculates the transmission packet loss rate, which can clearly understand the transmission quality of network components. This helps to identify and solve the packet loss problem in the network and improve the reliability and stability of data transmission. By calculating the flow jitter data of the component network link, the link stability and flow fluctuation can be evaluated. This helps to discover unstable factors in the network link, thereby optimizing network performance. Benchmark statistics based on flow jitter and transmission packet loss rate data can establish standard values ​​for normal operation. This provides a benchmark for evaluating network performance and helps to monitor and compare network status anomalies. By constructing network performance benchmark data through weighted average benchmarks, multiple factors (such as flow jitter and packet loss rate) can be comprehensively considered to evaluate the overall performance of the network. This helps to fully understand the health status of the network and guide network optimization. According to the network performance benchmark data, the network topology model is corrected for abnormal behavior, which can correct performance problems and abnormal behaviors in the network. This helps to improve the reliability and stability of the network and ensure the normal transmission of network traffic.

[0054] Optionally, step S35 is specifically:

[0055] Step S351: classifying the traffic behavior pattern data into abnormal traffic behavior patterns according to the network performance benchmark data, thereby obtaining abnormal traffic behavior pattern data;

[0056] Step S352: Calculating the reference error of the abnormal traffic behavior pattern data, thereby obtaining the abnormal traffic behavior pattern reference error data;

[0057] Step S353: performing low-amount benchmark error statistical analysis on the abnormal traffic behavior pattern benchmark error data, thereby obtaining low-amount benchmark error pattern data;

[0058] Step S354: removing the low-amount reference error pattern from the abnormal flow behavior pattern data according to the low-amount reference error pattern data, thereby obtaining abnormal flow behavior pattern correction data;

[0059] Step S355: remove abnormal traffic behavior pattern marks of network components from the network traffic topology structure model according to the abnormal traffic behavior pattern correction data, thereby obtaining a network traffic correction topology structure model.

[0060] The present invention can identify and isolate abnormal traffic patterns by performing abnormal classification on traffic behavior patterns. This helps to locate potential problem sources more accurately and optimize network traffic management. Calculating the baseline error of the abnormal traffic behavior pattern can quantify the deviation of the abnormal behavior. This helps to understand the severity of the abnormal pattern and provide a quantitative basis for subsequent adjustments. Low-baseline error statistical analysis can identify and focus on patterns with small errors that may affect network performance. This helps to optimize the identification of subtle but potential performance issues and improve the overall stability of the network. Eliminating low-baseline error patterns can reduce the misjudgment of abnormal traffic behavior, thereby improving the accuracy of abnormal patterns and the effect of network correction. Applying the corrected abnormal traffic behavior pattern to the network topology model helps to eliminate abnormal traffic patterns in the mark, thereby improving the reliability and performance of the network.

[0061] Optionally, step S4 is specifically:

[0062] Step S41: extracting network component resource allocation features from heterogeneous SD-WAN environment monitoring data, thereby obtaining network component resource allocation data;

[0063] Step S42: integrating the traffic behavior pattern of the network traffic correction topology structure model, thereby obtaining traffic behavior pattern correction data;

[0064] Step S43: fusing the traffic behavior pattern correction data and the network component resource allocation data in the time and space traffic dimension through the network traffic correction topology structure model, thereby obtaining a time and space traffic dimension fusion model;

[0065] Step S44: Perform network performance evaluation of network components according to the spatiotemporal traffic dimension fusion model, thereby obtaining network performance evaluation data of network components;

[0066] Step S45: Visualize the traffic-resource utilization timing correlation based on the network performance evaluation data of the network components, so as to obtain a network performance analysis report.

[0067] By extracting features, the present invention can identify resource bottlenecks or unbalanced resource allocation in the network, so as to take measures to optimize. The data provided can help network administrators make data-based decisions, optimize the allocation of network resources, improve overall network performance, and provide necessary baseline data for subsequent performance evaluation. By integrating traffic behavior patterns, the changing trends and behavioral characteristics of traffic can be more clearly understood, which is helpful to predict and manage traffic demand in advance. A deep understanding of traffic behavior patterns helps to optimize network design and configuration, ensure that the network can efficiently handle the expected traffic load, reduce network congestion and improve response speed, thereby improving the experience of end users. Through the fusion of time and space dimensions, a more comprehensive traffic analysis can be performed, and the changes in traffic at different times and spaces can be understood, providing the ability to predict future traffic demand, and measures can be taken in advance to prevent network performance degradation. By evaluating the performance of network components, the network status can be monitored in real time, performance problems can be discovered and solved in a timely manner, which is conducive to improving the stability and reliability of the network and reducing the risk of network failures and service interruptions. Through the visualization of time series association, the use of traffic and resources can be intuitively displayed, helping network administrators to better understand the data, and the generated performance analysis report can be used as a decision support tool to help formulate future network planning and resource allocation strategies.

[0068] Optionally, the present invention further provides a heterogeneous SD-WAN based fusion monitoring system, which is used to execute the above-mentioned heterogeneous SD-WAN based fusion monitoring method, and the heterogeneous SD-WAN based fusion monitoring system includes:

[0069] The network topology modeling module is used to obtain heterogeneous SD-WAN environment monitoring data, and perform network component connection type analysis based on the heterogeneous SD-WAN environment monitoring data, thereby obtaining network component connection type data; perform heterogeneous SD-WAN network topology modeling based on the network component connection type data, thereby obtaining a network topology model;

[0070] The traffic pattern classification module is used to extract traffic statistical features from heterogeneous SD-WAN environment monitoring data to obtain traffic statistical data, and to analyze traffic behavior patterns based on the traffic statistical data to obtain traffic behavior pattern data; traffic pattern classification and labeling of the network topology model based on the traffic behavior pattern data to obtain a network traffic topology model;

[0071] An abnormal behavior correction module is used to construct a performance benchmark based on a network traffic topology structure model and heterogeneous SD-WAN environment monitoring data, thereby obtaining network performance benchmark data, and to perform abnormal behavior correction on the network traffic topology structure model based on the network performance benchmark data, thereby obtaining a network traffic correction topology structure model;

[0072] The multi-dimensional data fusion module is used to extract the network component resource allocation features from the heterogeneous SD-WAN environment monitoring data, thereby obtaining the network component resource allocation data; the network component resource allocation data is multi-dimensionally fused through the network traffic correction topology structure model, thereby obtaining a network performance analysis report;

[0073] The resource allocation strategy optimization module is used to optimize the component resource allocation strategy of the network component resource allocation data based on the network performance analysis report, so as to obtain the optimized network component resource allocation strategy and upload it to the heterogeneous SD-WAN network management platform to perform resource allocation optimization tasks.

[0074] The heterogeneous SD-WAN-based fusion monitoring system of the present invention can implement any one of the heterogeneous SD-WAN-based fusion monitoring methods of the present invention, and is used to combine the operation and signal transmission media between various modules to complete the heterogeneous SD-WAN-based fusion monitoring method. The internal modules of the system cooperate with each other, thereby improving the overall network management efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments thereof made with reference to the following drawings:

[0076] Figure 1 It is a schematic diagram of the steps of the integrated monitoring method based on heterogeneous SD-WAN of the present invention;

[0077] Figure 2 Detailed step flow diagram of step S1 in the present invention;

[0078] Figure 3 Detailed step flow diagram of step S12 in the present invention;

[0079] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0080] The technical method of the present invention is described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by technicians in this field without creative work are within the scope of protection of the present invention.

[0081] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. The functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor methods and / or microcontroller methods.

[0082] It should be understood that, although the terms "first", "second", etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are used only to distinguish one unit from another unit. For example, without departing from the scope of the exemplary embodiments, the first unit may be referred to as the second unit, and similarly the second unit may be referred to as the first unit. The term "and / or" used herein includes any and all combinations of one or more of the listed associated items.

[0083] To achieve this, please refer to Figures 1 to 3 The present invention provides a heterogeneous SD-WAN fusion monitoring method, the method comprising the following steps:

[0084] Step S1: Obtain heterogeneous SD-WAN environment monitoring data, and perform network component connection type analysis based on the heterogeneous SD-WAN environment monitoring data, thereby obtaining network component connection type data; perform heterogeneous SD-WAN network topology modeling based on the network component connection type data, thereby obtaining a network topology structure model;

[0085] In this embodiment, monitoring data from a heterogeneous SD-WAN environment is first collected, such as device logs, connection status, and bandwidth usage. This data can be obtained in real time through a network monitoring system (such as SNMP, NetFlow, or sFlow). By analyzing the connection status between network components, the connection type (such as point-to-point, star, mesh, etc.) is determined. Using a network topology modeling tool (such as Graphviz or Gephi), these connection types are modeled to create a network topology model. The model may include nodes (network components) and edges (connection lines), and the connection type of each node is detailed. For example, some nodes may be connected via high-bandwidth links, while other nodes may be connected via low-bandwidth links.

[0086] Step S2: extracting traffic statistical features from heterogeneous SD-WAN environment monitoring data to obtain traffic statistical data, and performing traffic behavior pattern analysis based on the traffic statistical data to obtain traffic behavior pattern data; classifying and marking the network topology structure model based on the traffic behavior pattern data to obtain a network traffic topology structure model;

[0087] In this embodiment, traffic statistics feature data are extracted from the SD-WAN environment, such as hourly traffic volume, traffic source and destination, and traffic type (HTTP, FTP, etc.). Traffic analysis tools (such as Wireshark, NetFlowAnalyzer) are used to analyze these data to identify common traffic patterns (such as peak traffic, normal traffic patterns, and abnormal traffic patterns). These traffic behavior patterns are marked in the network topology model. For example, some network links may show high traffic patterns during working hours and low traffic patterns during non-working hours. This process helps identify traffic peaks, bottlenecks, and potential load imbalances.

[0088] Step S3: constructing a performance benchmark based on the network traffic topology structure model and the heterogeneous SD-WAN environment monitoring data to obtain network performance benchmark data, and performing abnormal behavior correction on the network traffic topology structure model based on the network performance benchmark data to obtain a network traffic correction topology structure model;

[0089] In this embodiment, a network performance benchmark is constructed based on the network traffic topology model and the heterogeneous SD-WAN environment monitoring data. This includes calculating various performance indicators, such as latency, throughput, packet loss rate, etc. Using these indicators, a network performance benchmark data model is established. Next, the benchmark data is compared with the real-time monitoring data to identify abnormal behavior. For example, if the latency of a link is significantly higher than the baseline value, this may indicate that the link is faulty or overloaded. Based on these findings, the network topology model is adjusted to correct the abnormal behavior and generate a corrected network topology model.

[0090] Step S4: extracting network component resource allocation features from heterogeneous SD-WAN environment monitoring data to obtain network component resource allocation data; performing multi-dimensional data fusion on the network component resource allocation data through a network traffic correction topology structure model to obtain a network performance analysis report;

[0091] In this embodiment, network component resource allocation feature data, such as CPU usage, memory usage, bandwidth allocation, etc., are extracted from SD-WAN monitoring data. The previous network traffic correction topology model is used to integrate these data in multiple dimensions. For example, based on the traffic behavior pattern and resource usage, determine which components' resource allocation needs to be adjusted. Generate a network performance analysis report that describes in detail the resource allocation status, traffic pattern, and its impact on performance.

[0092] Step S5: Optimize the component resource allocation strategy of the network component resource allocation data based on the network performance analysis report to obtain the optimized network component resource allocation strategy, and upload it to the heterogeneous SD-WAN network management platform to perform the resource allocation optimization task.

[0093] In this embodiment, the resource allocation of network components is optimized based on the network performance analysis report. For example, through the analysis report, it is found that the bandwidth resource allocation of some nodes is insufficient, while other nodes have idle resources. The optimization strategy may include reallocating bandwidth, adding load balancing mechanisms, etc. The optimized resource allocation strategy is formulated and uploaded to the heterogeneous SD-WAN network management platform. The platform performs policy adjustments, such as adjusting device configuration or modifying traffic routing, to ensure that network resources are optimally configured and improve overall network performance.

[0094] Optionally, step S1 specifically includes:

[0095] Step S11: Obtain heterogeneous SD-WAN environment monitoring data, and extract network component connection features from the heterogeneous SD-WAN environment monitoring data, thereby obtaining network component connection data;

[0096] In this embodiment, it is first necessary to collect various types of monitoring data from the heterogeneous SD-WAN environment, including but not limited to flow data, delay data, packet loss rate, bandwidth usage, etc. The specific operation can be achieved by configuring the management interface of the network device (such as SNMP, NetFlow or sFlow) to collect data. Then, use the data parsing tool to convert the raw monitoring data into structured network component connection data. For example, the connection status and link performance data of different network devices are extracted, and a connection feature data model is established based on the IP address and port information of the device for subsequent processing.

[0097] Step S12: classifying the network component connection data into network component connection types, thereby obtaining network component connection type data;

[0098] In this embodiment, the extracted network component connection data needs to be classified into different types of connection states, such as normal, faulty, overloaded, etc. Machine learning algorithms (such as decision trees, support vector machines, or neural networks) can be used to train and classify the connection data. In order to achieve efficient classification, the classification model needs to be trained based on the data characteristics of the connection (such as delay, packet loss rate, bandwidth occupancy, etc.). Using labeled data for training, the model can automatically classify real-time network connection data into different states and generate a report on network component connection type data.

[0099] Step S13: integrating the network center component connection relationship according to the network component connection type data, thereby obtaining the center component connection relationship data;

[0100] In this embodiment, it is first necessary to identify the network center components, such as core routers, switches, etc., and integrate the connection relationships between these center components based on the network component connection type data. This involves analyzing the network topology and integrating the connection status of each center component in the network into a comprehensive center component connection relationship diagram. For example, by summarizing the connection status of all center components, a connection matrix between center components is formed to describe their connection strength, stability and load conditions, thereby obtaining center component connection relationship data.

[0101] Step S14: Perform network communication topology analysis based on the central component connection relationship data to obtain a network topology model.

[0102] In this embodiment, it is necessary to use the obtained central component connection relationship data to build and analyze the network communication topology. First, the central component connection relationship data is input into the network topology modeling tool, which can build the network topology based on the graph theory model (such as the nodes and edges in the figure). Secondly, by analyzing the connectivity, node importance, traffic distribution, etc. of the network topology, a network topology model is generated. Network visualization tools (such as Gephi, Cytoscape) can be used to display the network topology, thereby helping to understand the overall architecture of the network and optimize network performance.

[0103] Optionally, step S12 is specifically:

[0104] Step S121: performing component connection frequency statistics on the network component connection data, thereby obtaining high-frequency connection component data and low-frequency connection component data;

[0105] In this embodiment, connection data between all network components is collected. The connection between each component pair is recorded and counted. For example, assuming that the network contains 100 components, the connection frequency data of each component with other components is obtained by recording and analyzing the number of connections between these components. The statistical results may show that the connection frequency between component A and component B is 50 times, and the connection frequency between component C and component D is 10 times. These data are sorted to determine high-frequency connection component data (component pairs with high connection times) and low-frequency connection component data (component pairs with low connection times). Connection frequency statistics should take into account the connection data of all component pairs in the network to ensure that the statistics are comprehensive and accurate. The statistical data should have a certain time window to capture the dynamic changes of the connection.

[0106] Step S122: selecting the highest frequency connection component according to the high frequency connection component data, thereby obtaining the network center component data;

[0107] In this embodiment, based on the obtained high-frequency connection component data, the component pair with the highest connection frequency is selected. For example, suppose that in the high-frequency connection component data, the connection frequency between component A and component B is the highest, which is 50 times. Therefore, component A and component B are marked as network center components. The selected component pairs will be used as network center component data for subsequent analysis. The selection criteria should be based on the connection frequency, and a threshold (such as the top 5% of component pairs) should be set to determine the highest frequency connection components. Component pairs with too low a frequency should be avoided to ensure that the selection results are representative.

[0108] Step S123: performing central component connection frequency statistics on the high-frequency connection component data and the low-frequency connection component data according to the network central component data, thereby obtaining high-frequency central component connection component data and low-frequency central component connection component data;

[0109] In this embodiment, the network center component data (such as components A and B) are used to count the connection frequencies of these center components with high-frequency connection component data and low-frequency connection component data. For example, assume that the connection frequency of component A with multiple high-frequency connection components is 60 times, and the connection frequency with low-frequency connection components is 5 times. In this way, high-frequency center component connection component data (high-frequency connection components) and low-frequency center component connection component data (low-frequency connection components) are obtained. Connection frequency statistics should be performed specifically for the data of the center components to determine their core role in the network. The statistical method should be able to accurately distinguish high-frequency and low-frequency connections.

[0110] Step S124: extracting component network connection delay features according to the network component connection data, thereby obtaining component network connection delay data;

[0111] In this embodiment, the connection delay between network components is measured and features are extracted. For example, the connection delay between component A and component B is recorded as 30 milliseconds, and the connection delay between component C and component D is 120 milliseconds. Delay data is extracted and counted to obtain component network connection delay data. For example, the connection delay between component A and B is low delay, while the connection delay between component C and D is high delay. Delay feature extraction should be performed at different time points to capture the dynamic changes of connection delay. The delay data should have a sufficient sample size to improve the reliability of the statistical results.

[0112] Step S125: classifying network delay components according to the component network connection delay data, thereby obtaining high-delay connection component data and low-delay connection component data;

[0113] In this embodiment, based on the extracted delay data, the component connections are classified according to the delay time. For example, the connection with a delay of less than 50 milliseconds is marked as a low-delay connection, and the connection with a delay of more than 100 milliseconds is marked as a high-delay connection. High-delay connection component data and low-delay connection component data are obtained. Delay classification should be based on clear thresholds, such as the dividing line of 50 milliseconds and 100 milliseconds. The actual usage of the network should be taken into account to ensure the practical significance of the classification results.

[0114] Step S126: performing a connection component intersection operation on the high-frequency central component connection component data and the low-latency connection component data, thereby obtaining normal network connection component data; performing a connection component intersection operation on the low-frequency central component connection component data and the high-latency connection component data, thereby obtaining temporary network connection component data;

[0115] In this embodiment, the high-frequency center component connection component data and the low-latency connection component data are intersected to obtain normal network connection component data. The low-frequency center component connection component data and the high-latency connection component data are intersected to obtain temporary network connection component data. For example, the high-frequency center component connection component data includes components A and B, and the low-latency connection component data includes components A and C, so the normal network connection component data is component A.

[0116] Step S127: Component connection merging is performed according to the network center component data, the normal network connection component data and the temporary network connection component data, so as to obtain network component connection type data.

[0117] In this embodiment, these data are merged according to the network center component data, the normal network connection component data and the temporary network connection component data. For example, the center component (such as component A), the normal network connection component (such as component B) and the temporary network connection component (such as component C) are merged to obtain the network component connection type data. This merger can provide a comprehensive view of the network component connection type. The merging process should be able to comprehensively consider the characteristics of each type of data to obtain a comprehensive and accurate network component connection type data. The merged result should be verified to ensure that it represents the actual network connection situation.

[0118] Optionally, step S14 is specifically:

[0119] Step S141: extracting component routing protocol features from heterogeneous SD-WAN environment monitoring data, thereby obtaining component routing protocol data;

[0120] In this embodiment, when extracting features from the monitoring data of the heterogeneous SD-WAN environment, it is first necessary to extract the routing protocol features of each component from the data, such as the packet flow, exchange rate, and link state information using protocols such as BGP, OSPF, or EIGRP. This can be achieved through network traffic analysis tools, which can parse the data and extract protocol features to generate a data table containing each routing protocol.

[0121] Step S142: performing component routing protocol clustering according to the component routing protocol data, thereby obtaining routing protocol clustering component data;

[0122] In this embodiment, when clustering component routing protocols, a clustering algorithm (such as K-means or DBSCAN) can be used to classify the extracted routing protocol data. By analyzing the characteristics of the protocol traffic pattern, delay, and bandwidth usage, protocols with similar characteristics are classified into one category, thereby obtaining routing protocol clustering component data. The key to this step is to select appropriate clustering parameters and algorithms for accurate classification.

[0123] Step S143: performing network protocol topology structure analysis according to routing protocol cluster component data and network component connection data, thereby obtaining a network protocol topology structure model;

[0124] In this embodiment, the routing protocol cluster component data and the network component connection data (such as the connection relationship between switches and routers) are used to perform network protocol topology analysis. Algorithms in graph theory (such as the shortest path algorithm or the minimum spanning tree algorithm) can be applied to construct a network topology model, which describes the connection relationship between components in the network and the data flow path.

[0125] Step S144: Analyze the logical topology structure of the virtual local area network according to the central component connection relationship data, so as to obtain a network logical topology structure model;

[0126] In this embodiment, in the analysis of the logical topology of the virtual local area network, the logical topology of the virtual local area network (VLAN) is identified and drawn based on the connection relationship data of the central component (such as the connection status of the core switch and each terminal). The connection mode of the central node can be analyzed by a logical network diagram drawing tool to draw a logical network topology model, which shows the virtual network relationship within the VLAN.

[0127] Step S145: Perform topology mapping on the network protocol topology structure model and the network logic topology structure model, so as to obtain a network topology structure model.

[0128] In this embodiment, the obtained network protocol topology model is mapped to the obtained network logical topology model. This process includes aligning the physical connection relationship in the network protocol topology with the virtual network relationship in the logical topology to obtain the final network topology model. A data mapping tool can be used to integrate the data of the two models to generate a model that fully describes the network structure, which can show the network layout at the physical and logical levels.

[0129] Optionally, step S2 specifically includes:

[0130] Step S21: extracting traffic statistical features from heterogeneous SD-WAN environment monitoring data to obtain traffic statistical data;

[0131] In this embodiment, when extracting statistical features of traffic in a heterogeneous SD-WAN environment, first collect the traffic data of each network component, including the traffic rate per second, packet size, traffic direction, etc. Use traffic monitoring tools such as NetFlow or sFlow to extract these data and calculate statistical features such as the average, variance, and peak value of the traffic. These features can help understand the traffic behavior of different network components and provide basic data for subsequent analysis.

[0132] Step S22: Analyze the traffic behavior pattern of network components according to the traffic statistics data, so as to obtain the traffic behavior pattern data of network components;

[0133] In this embodiment, based on the extracted traffic statistics data, a machine learning model (such as cluster analysis or classification model) is used to analyze the traffic behavior patterns of network components. For example, network components with similar traffic characteristics are grouped using a K-means clustering algorithm. This can identify common patterns of traffic behavior, such as traffic surges during peak hours or traffic distribution of specific applications.

[0134] Step S23: performing similarity evaluation based on the network component traffic behavior pattern data, thereby obtaining traffic behavior pattern similarity data;

[0135] In this embodiment, when evaluating the similarity of the network component traffic behavior pattern data, an appropriate similarity metric (such as Euclidean distance, cosine similarity, etc.) is selected to calculate the similarity between each traffic pattern. For example, cosine similarity is used to calculate the similarity between traffic behavior patterns of different network components, thereby identifying similar traffic behavior patterns.

[0136] Step S24: clustering the network component traffic behavior pattern data according to the traffic behavior pattern similarity data, thereby obtaining traffic behavior pattern data;

[0137] In this embodiment, the traffic behavior patterns of network components are clustered and analyzed based on the similarity data. For example, a hierarchical clustering algorithm is used to group traffic patterns with high similarity into the same group, thereby forming several major traffic pattern groups. Each group represents a specific traffic behavior pattern, which facilitates the understanding and management of network traffic.

[0138] Step S25: marking the network component traffic behavior patterns of the network topology structure model according to the traffic behavior pattern data, thereby obtaining a network traffic topology structure model.

[0139] In this embodiment, the obtained traffic behavior pattern data is marked into the network topology model. By mapping the traffic behavior pattern of each network component to the corresponding node or link on the network topology map, a marked network topology model is formed. This can help visualize the network traffic pattern and mark the characteristics of the traffic behavior in the network topology structure, which is convenient for further network optimization and troubleshooting.

[0140] Optionally, step S22 is specifically:

[0141] Step S221: extracting network component traffic fluctuation characteristics from traffic statistical data, thereby obtaining network component traffic fluctuation data;

[0142] In this embodiment, traffic statistics of network components (such as routers and switches) are collected, and the data includes information such as traffic per second, packet loss rate and delay. These data are sampled at regular intervals (for example, every minute) over a period of time. Use statistical analysis tools, such as moving average or smoothing filters, to preprocess the raw data to remove noise. Next, calculate the standard deviation, peak value and fluctuation range of the traffic. These characteristics reflect the degree of fluctuation and trend of network traffic. For example, by calculating the standard deviation of the traffic within 10 minutes, the traffic fluctuation within this period can be determined, thereby extracting the fluctuation characteristic data of the network component traffic.

[0143] Step S222: Calculate the network component traffic benchmark based on the network component traffic fluctuation data, thereby obtaining the network component traffic benchmark data;

[0144] In this embodiment, after obtaining the traffic fluctuation characteristics of the network component, a traffic benchmark calculation is performed. First, a benchmark time period (for example, one week) is defined, and then the traffic mean at each time point in the time period is calculated. These mean values ​​are used as benchmark traffic values. Statistical methods, such as moving average or linear regression, are used to smooth the traffic data and generate a benchmark traffic curve. By comparing with historical data, the benchmark value of the traffic and its deviation can be calculated. For example, if the average traffic of a network component in the past week is 100Mbps, this value is used as the traffic benchmark data for subsequent fluctuation analysis and anomaly detection.

[0145] Step S223: dividing the network component traffic fluctuation data into traffic fluctuation stages according to the network component traffic benchmark data, thereby obtaining network component traffic fluctuation stage division data;

[0146] In this embodiment, the flow fluctuation data is divided into stages based on the flow benchmark data. First, by analyzing the flow benchmark data, the range of normal flow is determined (for example, within the range of ±10% of the benchmark flow). Then, the flow fluctuation data is segmented to mark whether the flow in each time period exceeds the normal range. A clustering algorithm (such as K-means clustering) is used to divide the flow data into different stages, such as a normal stage, a slight fluctuation stage, and a violent fluctuation stage. If the flow is within ±10% of the benchmark value, it is marked as "normal", and if it exceeds ±20%, it is marked as "violent fluctuation", thereby obtaining the flow fluctuation stage division data.

[0147] Step S224: performing traffic fluctuation periodicity statistics according to the network component traffic fluctuation data, thereby obtaining the network component traffic fluctuation periodicity data;

[0148] In this embodiment, in order to analyze the periodicity of the traffic, the traffic fluctuation data is first analyzed in the frequency domain using a Fourier transform (FFT) or a periodogram analysis tool. The main periodic patterns in the traffic data are identified, such as daily peaks and valleys. The periodic characteristics of the traffic are determined by statistical analysis, such as periodic fluctuations every 24 hours, every week, and every month. For example, it is found that a certain network component has the highest traffic between 8:00-10:00 every day, and the lowest traffic between 2:00-4:00 in the middle of the night. Based on these periodic data, the length and amplitude of the cycle are calculated to obtain the periodic data of the traffic fluctuation of the network component.

[0149] Step S225: Perform traffic behavior pattern recognition and integration based on the network component traffic fluctuation phase division data and the network component traffic fluctuation periodicity data, so as to obtain the network component traffic behavior pattern data.

[0150] In this embodiment, traffic fluctuation stage division data and periodic statistical data are combined to perform traffic behavior pattern recognition. First, the stage division data is matched with the periodic data to identify the periodic patterns in different stages. Machine learning algorithms, such as decision trees or support vector machines (SVMs), are applied to train models to identify common traffic behavior patterns. For example, the model identifies the relationship between the violent fluctuation pattern of traffic during peak hours and system anomalies. These pattern data are integrated to generate traffic behavior pattern data of network components. Ultimately, the pattern recognition results can be used to optimize network management strategies, conduct early warnings, and allocate resources.

[0151] Optionally, step S3 specifically includes:

[0152] Step S31: extracting network transmission features from heterogeneous SD-WAN environment monitoring data to obtain network transmission data, and calculating network component transmission packet loss rate from the network transmission data to obtain component transmission packet loss rate data;

[0153] In this embodiment, in a heterogeneous SD-WAN environment, network transmission data needs to be collected from different types of network devices (such as routers, switches, and firewalls). These data usually include the amount of data packets transmitted per second, transmission delay, packet loss rate, etc. First, obtain detailed transmission logs of data packets through network traffic monitoring tools (such as NetFlow, sFlow) or network management systems (NMS). Then, use data analysis tools (such as the Pandas library in Python) to process these logs and calculate the transmission packet loss rate of each network component. This calculation process includes collecting the number of data packets sent and received in a specific time period, and dividing the number of lost data packets by the total number of sent data packets to obtain the component transmission packet loss rate data. For example, if a router sends 1,000 data packets in one hour, but the receiving end only receives 950 data packets, then the packet loss rate is (1000-950) / 1000=5%.

[0154] Step S32: Calculate the component network link traffic jitter on the network traffic topology structure model, thereby obtaining component network link traffic jitter data;

[0155] In this embodiment, for the network traffic topology model, it is necessary to calculate the traffic jitter of each network link. Traffic jitter refers to the fluctuation of the delay of the data packet during the transmission process. First, use the traffic monitoring tool to collect the data packet delay time of each link, and then perform statistical analysis on these delay times. In the specific implementation, a time window (such as every minute) is selected to collect the delay time of the data packet within the time window (for example, obtained through SNMP or NetFlow). The standard deviation or coefficient of variation of these delay times is calculated as the link traffic jitter data. For example, if the delay time of the data packet in a certain link is 20ms, 22ms, 19ms and 30ms respectively, then its jitter is the standard deviation of these delay times, that is, sqrt(((20-22)2+(22-19)2+(19-22)2+(30-22)2) / 4)=5.4ms.

[0156] Step S33: performing traffic jitter benchmark statistics on the component network link traffic jitter data, thereby obtaining traffic jitter benchmark data; performing transmission packet loss rate benchmark statistics on the component transmission packet loss rate data, thereby obtaining transmission packet loss rate benchmark data;

[0157] In this embodiment, benchmark statistics are performed on the traffic jitter data of the component network link. It is necessary to collect historical data within a certain time range and calculate its statistical characteristics. Select a network topology diagram containing multiple links and collect the traffic jitter data of each link in the past week. Then calculate the average value, standard deviation and other indicators of the traffic jitter as the traffic jitter benchmark data. For example, the jitter data of a certain link in the past week were 5ms, 4ms, 6ms, and 7ms, respectively. Its traffic jitter benchmark is the mean and standard deviation of these data: the mean is 5.5ms and the standard deviation is 1.2ms. At the same time, the same benchmark statistics are performed on the component transmission packet loss rate data.

[0158] Step S34: constructing a weighted average benchmark according to the traffic jitter benchmark data and the transmission packet loss rate benchmark data, thereby obtaining network performance benchmark data;

[0159] In this embodiment, the traffic jitter benchmark data and the transmission packet loss rate benchmark data are used to construct the network performance benchmark. The traffic jitter benchmark data and the transmission packet loss rate benchmark data are weighted averaged according to certain weights to obtain comprehensive network performance benchmark data. For example, it is set that the traffic jitter accounts for 60% of the total performance index and the transmission packet loss rate accounts for 40%. If the traffic jitter benchmark is 5ms and the transmission packet loss rate benchmark is 3%, the network performance benchmark is 0.65ms+0.43%=3ms+1.2% (based on the comprehensive result of relative units).

[0160] Step S35: Correct the abnormal behavior of the network traffic topology structure model according to the network performance benchmark data, so as to obtain a network traffic corrected topology structure model.

[0161] In this embodiment, after obtaining the network performance benchmark data, the network traffic topology model needs to be corrected to correct any abnormal behavior. First, by comparing the actual traffic data with the benchmark data, the links or components whose performance indicators exceed the normal range are identified. Then, a correction algorithm (such as a machine learning model or a rule engine) is applied to adjust the network traffic topology model to optimize network performance. For example, if it is found that the traffic jitter of a link is significantly higher than the benchmark value, the network topology model can be corrected by reconfiguring the link priority, adjusting the bandwidth allocation, or introducing a traffic shaping strategy. Ultimately, the updated network traffic topology model can more accurately reflect the actual performance status of the network.

[0162] Optionally, step S35 is specifically:

[0163] Step S351: classifying the traffic behavior pattern data into abnormal traffic behavior patterns according to the network performance benchmark data, thereby obtaining abnormal traffic behavior pattern data;

[0164] In this embodiment, a machine learning model (such as a K-means clustering algorithm) is used to train the network performance benchmark data to identify normal traffic patterns. Then, the real-time traffic behavior pattern data is input into the model for anomaly detection. Abnormal traffic behavior patterns are marked as data that deviates significantly from the normal pattern in the training model. For example, if the delay mean of normal traffic is 10ms and the standard deviation is 2ms, and the delay mean of some data in the real-time behavior pattern data is 30ms, which deviates from the normal pattern by more than 3 standard deviations, these data will be classified as abnormal traffic behavior pattern data.

[0165] Step S352: Calculating the reference error of the abnormal traffic behavior pattern data, thereby obtaining the abnormal traffic behavior pattern reference error data;

[0166] In this embodiment, the identified abnormal traffic behavior pattern data is compared with the network performance benchmark data. The error between the abnormal data and the normal benchmark data is calculated using statistical methods (such as mean absolute error, root mean square error, etc.). For example, if the throughput of a certain flow is 100Mbps under normal circumstances and 150Mbps under abnormal circumstances, the throughput error is 50Mbps. This calculation is performed on all abnormal traffic pattern data, and the error values ​​obtained constitute the abnormal traffic behavior pattern benchmark error data.

[0167] Step S353: performing low-amount benchmark error statistical analysis on the abnormal traffic behavior pattern benchmark error data, thereby obtaining low-amount benchmark error pattern data;

[0168] In this embodiment, the abnormal traffic behavior pattern baseline error data is statistically analyzed to identify data patterns with low errors. A statistical analysis tool (such as the ggplot2 package in the R language) is used to draw an error distribution graph, from which low error patterns are extracted. For example, suppose that through analysis, it is found that most of the error values ​​in the abnormal data are concentrated in the range of 0-10Mbps, which means that the errors of these data patterns are low. Through this analysis, low-amount baseline error pattern data can be marked and extracted as a basis for further analysis.

[0169] Step S354: removing the low-amount reference error pattern from the abnormal flow behavior pattern data according to the low-amount reference error pattern data, thereby obtaining abnormal flow behavior pattern correction data;

[0170] In this embodiment, the obtained low-baseline error pattern data is used to screen the abnormal traffic behavior pattern data. Low-baseline error pattern data usually represents patterns with smaller errors, which may be caused by short-term fluctuations or other non-major factors. Therefore, these patterns are eliminated from the overall abnormal traffic data. Data processing software (such as the Pandas library in Python) can be used to filter data according to error thresholds (such as errors less than 10Mbps). For example, create a conditional screening function to exclude data with error values ​​less than 10Mbps, and the result is the abnormal traffic behavior pattern correction data.

[0171] Step S355: remove abnormal traffic behavior pattern marks of network components from the network traffic topology structure model according to the abnormal traffic behavior pattern correction data, thereby obtaining a network traffic correction topology structure model.

[0172] In this embodiment, the network traffic topology model is adjusted according to the obtained abnormal traffic behavior pattern correction data. First, the various network components (such as routers, switches, etc.) in the topology model are identified, and then the abnormal traffic behavior patterns of these components are marked in the model. Use a computer network simulation tool (such as GNS3 or NS3) to remodel the network traffic and remove or correct the marked abnormal patterns. For example, assuming that a router shows high latency and packet loss rate in abnormal traffic, the abnormal traffic patterns of these components are removed or reduced through model adjustment to obtain a corrected network traffic topology model to optimize the overall network performance. The traffic behavior patterns that have been marked in the network traffic topology model can also be removed or corrected to identify the abnormal patterns of the components.

[0173] Optionally, step S4 is specifically:

[0174] Step S41: extracting network component resource allocation features from heterogeneous SD-WAN environment monitoring data, thereby obtaining network component resource allocation data;

[0175] In this embodiment, in a heterogeneous SD-WAN environment, network monitoring data is first collected from multiple data sources (such as routers, switches, link status monitoring systems, etc.). These data include traffic load, bandwidth utilization, latency, packet loss rate, etc. Then, data preprocessing techniques (such as data cleaning and standardization) are used to extract resource allocation features of network components (such as devices, links), such as bandwidth allocation, CPU and memory usage of each device. Feature selection algorithms (such as principal component analysis or correlation analysis) are used to identify resource allocation features that have a greater impact on network performance, and generate network component resource allocation data sets for subsequent analysis.

[0176] Step S42: integrating the traffic behavior pattern of the network traffic correction topology structure model, thereby obtaining traffic behavior pattern correction data;

[0177] In this embodiment, when constructing a network traffic correction topology model, the network traffic is first monitored and recorded in real time, including the traffic data, traffic path and traffic fluctuation of each node. A machine learning algorithm (such as cluster analysis or time series analysis) is used to identify different traffic behavior patterns, such as periodic peak traffic or burst traffic behavior. These patterns are integrated with the topology model to form traffic behavior pattern correction data. These data include the performance of various traffic patterns in the topology, such as traffic bottlenecks, abnormal traffic paths, etc. The traffic behavior patterns of each network component that has been marked by the network traffic correction topology model can also be extracted, and then these behavior patterns are integrated to obtain traffic behavior pattern correction data.

[0178] Step S43: fusing the traffic behavior pattern correction data and the network component resource allocation data in the time and space traffic dimension through the network traffic correction topology structure model, thereby obtaining a time and space traffic dimension fusion model;

[0179] In this embodiment, the generated network component resource allocation data, traffic behavior pattern correction data, and traffic type data are input into the spatiotemporal traffic dimension data fusion model. The model can perform spatiotemporal dimensional fusion analysis on the data based on a deep learning network (such as a time series convolutional network or a recurrent neural network). By combining time series features (such as temporal changes in traffic) and spatial features (such as node positions in the network topology), the model can output a comprehensive spatiotemporal traffic dimension fusion model that comprehensively reflects the changing patterns of traffic in time, space, and type and its impact on network performance. Deep learning methods such as long short-term memory networks (LSTMs) combined with convolutional neural networks (CNNs) can be used to capture the temporal and spatial dependencies in traffic data.

[0180] Step S44: Perform network performance evaluation of network components according to the spatiotemporal traffic dimension fusion model, thereby obtaining network performance evaluation data of network components;

[0181] In this embodiment, the performance of network components is comprehensively evaluated using the generated spatiotemporal traffic dimension fusion model. The fusion model is applied to actual network data to evaluate the performance indicators (such as throughput, delay, and packet loss rate) of each network component (such as routers and switches). The performance of different components is quantified using a performance evaluation algorithm (such as a weighted average method or multi-objective optimization) to generate network performance evaluation data for network components. These data reflect the actual performance and bottlenecks of each component under the current traffic pattern and resource allocation. For example, a weight is assigned to each performance indicator of the network component, and a comprehensive score is calculated. For example, the weights of throughput, delay, and packet loss rate are set to 40%, 30%, and 30%, and then the weighted average score is calculated. Based on the results of the weighted average method or multi-objective optimization, a comprehensive score for each network component is generated. For example, for a router, the comprehensive score includes its performance in throughput, delay, and packet loss rate.

[0182] Step S45: Visualize the traffic-resource utilization timing correlation based on the network performance evaluation data of the network components, so as to obtain a network performance analysis report.

[0183] In this embodiment, the obtained network performance evaluation data is input into the traffic-resource utilization time series correlation visualization tool. Data visualization techniques (such as time series graphs, heat maps, and relationship graphs) are used to display the changing trends of network performance data and resource utilization. The tool can support interactive visualization, allowing users to view detailed performance information for a specific time period or a specific network component. Through this visualization, users can identify the relationship between traffic patterns and resource allocation, understand the reasons for changes in network performance, and generate network performance analysis reports to help network administrators optimize network configuration and resource allocation strategies.

[0184] Optionally, the present invention further provides a heterogeneous SD-WAN based fusion monitoring system, which is used to execute the above-mentioned heterogeneous SD-WAN based fusion monitoring method, and the heterogeneous SD-WAN based fusion monitoring system includes:

[0185] The network topology modeling module is used to obtain heterogeneous SD-WAN environment monitoring data, and perform network component connection type analysis based on the heterogeneous SD-WAN environment monitoring data, thereby obtaining network component connection type data; perform heterogeneous SD-WAN network topology modeling based on the network component connection type data, thereby obtaining a network topology model;

[0186] The traffic pattern classification module is used to extract traffic statistical features from heterogeneous SD-WAN environment monitoring data to obtain traffic statistical data, and to analyze traffic behavior patterns based on the traffic statistical data to obtain traffic behavior pattern data; traffic pattern classification and labeling of the network topology model based on the traffic behavior pattern data to obtain a network traffic topology model;

[0187] An abnormal behavior correction module is used to construct a performance benchmark based on a network traffic topology structure model and heterogeneous SD-WAN environment monitoring data, thereby obtaining network performance benchmark data, and to perform abnormal behavior correction on the network traffic topology structure model based on the network performance benchmark data, thereby obtaining a network traffic correction topology structure model;

[0188] The multi-dimensional data fusion module is used to extract the network component resource allocation features from the heterogeneous SD-WAN environment monitoring data, thereby obtaining the network component resource allocation data; the network component resource allocation data is multi-dimensionally fused through the network traffic correction topology structure model, thereby obtaining a network performance analysis report;

[0189] The resource allocation strategy optimization module is used to optimize the component resource allocation strategy of the network component resource allocation data based on the network performance analysis report, so as to obtain the optimized network component resource allocation strategy and upload it to the heterogeneous SD-WAN network management platform to perform resource allocation optimization tasks.

[0190] The heterogeneous SD-WAN-based fusion monitoring system of the present invention can implement any one of the heterogeneous SD-WAN-based fusion monitoring methods of the present invention, and is used to combine the operation and signal transmission media between various modules to complete the heterogeneous SD-WAN-based fusion monitoring method. The internal modules of the system cooperate with each other, thereby improving the overall network management efficiency.

[0191] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0192] The above description is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but should conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A fusion monitoring method based on heterogeneous SD-WAN, characterized in that: The following steps are involved: Step S1: Obtain heterogeneous SD-WAN environment monitoring data, and perform network component connection type analysis based on the heterogeneous SD-WAN environment monitoring data, thereby obtaining network component connection type data; perform heterogeneous SD-WAN network topology modeling based on the network component connection type data, thereby obtaining a network topology structure model; Step S2: extracting traffic statistical features from heterogeneous SD-WAN environment monitoring data to obtain traffic statistical data, and performing traffic behavior pattern analysis based on the traffic statistical data to obtain traffic behavior pattern data; classifying and marking the network topology structure model based on the traffic behavior pattern data to obtain a network traffic topology structure model; Step S3: constructing a performance benchmark based on the network traffic topology structure model and the heterogeneous SD-WAN environment monitoring data to obtain network performance benchmark data, and performing abnormal behavior correction on the network traffic topology structure model based on the network performance benchmark data to obtain a network traffic correction topology structure model; Step S4: extracting network component resource allocation features from heterogeneous SD-WAN environment monitoring data to obtain network component resource allocation data; Through the network traffic correction topology structure model, multi-dimensional data fusion is performed on the network component resource allocation data to obtain a network performance analysis report; Step S5: Optimize the component resource allocation strategy of the network component resource allocation data based on the network performance analysis report to obtain the optimized network component resource allocation strategy, and upload it to the heterogeneous SD-WAN network management platform to perform the resource allocation optimization task.

2. The heterogeneous SD-WAN fusion monitoring method according to claim 1 is characterized in that: Step S1 is specifically as follows: Step S11: Obtain heterogeneous SD-WAN environment monitoring data, and extract network component connection features from the heterogeneous SD-WAN environment monitoring data, thereby obtaining network component connection data; Step S12: classifying the network component connection data into network component connection types, thereby obtaining network component connection type data; Step S13: integrating the network center component connection relationship according to the network component connection type data, thereby obtaining the center component connection relationship data; Step S14: Perform network communication topology analysis based on the central component connection relationship data to obtain a network topology model.

3. The heterogeneous SD-WAN fusion monitoring method according to claim 2 is characterized in that: Step S12 is specifically as follows: Step S121: performing component connection frequency statistics on the network component connection data, thereby obtaining high-frequency connection component data and low-frequency connection component data; Step S122: selecting the highest frequency connection component according to the high frequency connection component data, thereby obtaining the network center component data; Step S123: performing central component connection frequency statistics on the high-frequency connection component data and the low-frequency connection component data according to the network central component data, thereby obtaining high-frequency central component connection component data and low-frequency central component connection component data; Step S124: extracting component network connection delay features according to the network component connection data, thereby obtaining component network connection delay data; Step S125: classifying network delay components according to the component network connection delay data, thereby obtaining high-delay connection component data and low-delay connection component data; Step S126: performing a connection component intersection operation on the high-frequency center component connection component data and the low-latency connection component data, thereby obtaining normal network connection component data; Performing a connection component intersection operation on the low-frequency center component connection component data and the high-latency connection component data, thereby obtaining temporary network connection component data; Step S127: Component connection merging is performed according to the network center component data, the normal network connection component data and the temporary network connection component data, so as to obtain network component connection type data.

4. The heterogeneous SD-WAN fusion monitoring method according to claim 2 is characterized in that: Step S14 is specifically as follows: Step S141: extracting component routing protocol features from heterogeneous SD-WAN environment monitoring data, thereby obtaining component routing protocol data; Step S142: performing component routing protocol clustering according to the component routing protocol data, thereby obtaining routing protocol clustering component data; Step S143: performing network protocol topology structure analysis according to routing protocol cluster component data and network component connection data, thereby obtaining a network protocol topology structure model; Step S144: Analyze the logical topology structure of the virtual local area network according to the central component connection relationship data, so as to obtain a network logical topology structure model; Step S145: Perform topology mapping on the network protocol topology structure model and the network logic topology structure model, so as to obtain a network topology structure model.

5. The heterogeneous SD-WAN fusion monitoring method according to claim 1 is characterized in that: Step S2 is specifically as follows: Step S21: extracting traffic statistical features from heterogeneous SD-WAN environment monitoring data to obtain traffic statistical data; Step S22: Analyze the traffic behavior pattern of network components according to the traffic statistics data, so as to obtain the traffic behavior pattern data of network components; Step S23: performing similarity evaluation based on the network component traffic behavior pattern data, thereby obtaining traffic behavior pattern similarity data; Step S24: clustering the network component traffic behavior pattern data according to the traffic behavior pattern similarity data, thereby obtaining traffic behavior pattern data; Step S25: marking the network component traffic behavior patterns of the network topology structure model according to the traffic behavior pattern data, thereby obtaining a network traffic topology structure model.

6. The heterogeneous SD-WAN fusion monitoring method according to claim 5 is characterized in that: Step S22 is specifically as follows: Step S221: extracting network component traffic fluctuation characteristics from traffic statistical data, thereby obtaining network component traffic fluctuation data; Step S222: Calculate the network component traffic benchmark based on the network component traffic fluctuation data, thereby obtaining the network component traffic benchmark data; Step S223: dividing the network component traffic fluctuation data into traffic fluctuation stages according to the network component traffic benchmark data, thereby obtaining network component traffic fluctuation stage division data; Step S224: performing traffic fluctuation periodicity statistics according to the network component traffic fluctuation data, thereby obtaining the network component traffic fluctuation periodicity data; Step S225: Perform traffic behavior pattern recognition and integration based on the network component traffic fluctuation phase division data and the network component traffic fluctuation periodicity data, so as to obtain the network component traffic behavior pattern data.

7. The heterogeneous SD-WAN fusion monitoring method according to claim 1 is characterized in that: Step S3 is specifically as follows: Step S31: extracting network transmission features from heterogeneous SD-WAN environment monitoring data to obtain network transmission data, and calculating network component transmission packet loss rate from the network transmission data to obtain component transmission packet loss rate data; Step S32: Calculate the component network link traffic jitter on the network traffic topology structure model, thereby obtaining component network link traffic jitter data; Step S33: performing traffic jitter benchmark statistics on the component network link traffic jitter data, thereby obtaining traffic jitter benchmark data; Perform transmission packet loss rate benchmark statistics on component transmission packet loss rate data, thereby obtaining transmission packet loss rate benchmark data; Step S34: constructing a weighted average benchmark according to the traffic jitter benchmark data and the transmission packet loss rate benchmark data, thereby obtaining network performance benchmark data; Step S35: Correct the abnormal behavior of the network traffic topology structure model according to the network performance benchmark data, so as to obtain a network traffic corrected topology structure model.

8. The heterogeneous SD-WAN fusion monitoring method according to claim 1 is characterized in that: Step S35 is specifically as follows: Step S351: classifying the traffic behavior pattern data into abnormal traffic behavior patterns according to the network performance benchmark data, thereby obtaining abnormal traffic behavior pattern data; Step S352: performing a benchmark error calculation on the abnormal flow behavior pattern data, thereby obtaining abnormal flow behavior pattern benchmark error data; Step S353: performing low-amount benchmark error statistical analysis on the abnormal traffic behavior pattern benchmark error data, thereby obtaining low-amount benchmark error pattern data; Step S354: removing the low-amount reference error pattern from the abnormal flow behavior pattern data according to the low-amount reference error pattern data, thereby obtaining abnormal flow behavior pattern correction data; Step S355: remove abnormal traffic behavior pattern marks of network components from the network traffic topology structure model according to the abnormal traffic behavior pattern correction data, thereby obtaining a network traffic correction topology structure model.

9. The heterogeneous SD-WAN fusion monitoring method according to claim 1 is characterized in that: Step S4 is specifically as follows: Step S41: extracting network component resource allocation features from heterogeneous SD-WAN environment monitoring data, thereby obtaining network component resource allocation data; Step S42: integrating the traffic behavior pattern of the network traffic correction topology structure model, thereby obtaining traffic behavior pattern correction data; Step S43: fusing the traffic behavior pattern correction data and the network component resource allocation data in the time and space traffic dimension through the network traffic correction topology structure model, thereby obtaining a time and space traffic dimension fusion model; Step S44: Perform network component network performance evaluation according to the spatiotemporal traffic dimension fusion model, thereby obtaining network component network performance evaluation data; Step S45: Visualize the traffic-resource utilization timing correlation based on the network component network performance evaluation data, so as to obtain a network performance analysis report.

10. A heterogeneous SD-WAN fusion monitoring system, characterized in that: Used to execute a heterogeneous SD-WAN fusion monitoring method according to claim 1, the heterogeneous SD-WAN fusion monitoring system comprises: The network topology modeling module is used to obtain heterogeneous SD-WAN environment monitoring data, and perform network component connection type analysis based on the heterogeneous SD-WAN environment monitoring data, thereby obtaining network component connection type data; perform heterogeneous SD-WAN network topology modeling based on the network component connection type data, thereby obtaining a network topology model; The traffic pattern classification module is used to extract traffic statistical features from heterogeneous SD-WAN environment monitoring data to obtain traffic statistical data, and to analyze traffic behavior patterns based on the traffic statistical data to obtain traffic behavior pattern data; traffic pattern classification and labeling of the network topology model based on the traffic behavior pattern data to obtain a network traffic topology model; An abnormal behavior correction module is used to construct a performance benchmark based on a network traffic topology structure model and heterogeneous SD-WAN environment monitoring data, thereby obtaining network performance benchmark data, and to perform abnormal behavior correction on the network traffic topology structure model based on the network performance benchmark data, thereby obtaining a network traffic correction topology structure model; The multi-dimensional data fusion module is used to extract the network component resource allocation features from the heterogeneous SD-WAN environment monitoring data, thereby obtaining the network component resource allocation data; the network component resource allocation data is multi-dimensionally fused through the network traffic correction topology structure model, thereby obtaining a network performance analysis report; The resource allocation strategy optimization module is used to optimize the component resource allocation strategy of the network component resource allocation data based on the network performance analysis report, so as to obtain the optimized network component resource allocation strategy and upload it to the heterogeneous SD-WAN network management platform to perform resource allocation optimization tasks.

Images