Network early warning method for ad hoc network or local area network in park

Abstract

The invention belongs to the technical field of park monitoring and early warning, and particularly relates to a network early warning method for an ad hoc network or a local area network of a park, which comprises the following steps: collecting network data of different sources in the ad hoc network or the local area network of the park in real time, and preprocessing the collected network data of the park; carrying out topological structure identification on the preprocessed network data, and constructing a graph neural network model; fusing the preprocessed network data of different sources by using a multi-source information fusion technology, constructing an early warning model, and identifying an abnormal mode or a potential risk in the network data; early warning output and response: monitoring the park network in real time by an early warning model, and dynamically adjusting the early warning model by using a gradient descent method; and when the early warning model detects an abnormal behavior or a potential fault, an early warning mechanism is triggered, and corresponding response measures are taken. According to the network early warning method for the ad hoc network or the local area network of the park, the accuracy and the efficiency of park early warning are further improved.

Description

Technical Field

[0001] The invention belongs to the field of park monitoring and early warning technology, and in particular relates to a network early warning method for a park ad hoc network or a local area network. Background Art

[0002] With the rapid development of society and the acceleration of urbanization, the park, as an important carrier of economic activities, has become increasingly prominent in terms of security management issues. Monitoring and early warning of personnel behavior in the park are crucial to ensuring the safe and stable operation of the park. However, traditional personnel monitoring methods have problems such as low efficiency and poor accuracy, which makes it difficult to meet the needs of modern park security management. The main shortcomings of existing park personnel behavior monitoring and early warning technologies include the following aspects:

[0003] 1. Privacy and ethical issues: With the widespread use of surveillance technology, the privacy rights of employees and visitors are threatened. Surveillance systems may collect a large amount of personal data, which may lead to the risk of personal information leakage and abuse.

[0004] 2. Technical limitations and false alarms: Although existing monitoring systems can monitor and identify abnormal behaviors in real time, they still have problems with false alarms and missed alarms. This is mainly because the system relies on the accuracy of algorithms and sensors, which may be affected by many factors in actual applications, such as lighting, weather conditions, etc.

[0005] 3. Cost and resource consumption: Deploying and maintaining an efficient monitoring system requires a lot of capital investment. In addition, the labor cost cannot be ignored, especially when a large amount of monitoring data needs to be manually analyzed.

[0006] 4. Complexity of technology and system: Modern surveillance systems usually integrate multiple technologies, such as face recognition, license plate recognition, etc. The integration and management of these technologies increase the complexity of the system. At the same time, the upgrade and maintenance of the system also requires professional technical support.

[0007] 5. Data security and sharing issues: The large amount of data generated by the monitoring system needs to be securely stored and processed. In addition, the effective sharing of data is crucial to improving monitoring efficiency, but many systems currently have difficulty in achieving effective data sharing due to technical and policy limitations.

[0008] Therefore, conducting research on a topological intelligent analysis and early warning system and device for ad hoc networks or local area networks has important practical significance and application value. Summary of the invention

[0009] In order to solve the above technical problems, the traditional personnel monitoring method has problems such as low efficiency and poor accuracy, which is difficult to meet the needs of modern park security management.

[0010] The present invention provides the following technical solutions:

[0011] A network early warning method for a campus ad hoc network or a local area network comprises the following steps:

[0012] Collect network data from different sources in the park's self-organizing network or local area network in real time, and clean, standardize or pre-process the collected network data;

[0013] Using graph theory and network science theory, we identify the topological structure of preprocessed network data, build a graph neural network model, and analyze network characteristics including the connection relationship between nodes, path length, and clustering coefficient;

[0014] Using multi-source information fusion technology, the pre-processed network data from different sources are integrated to build an early warning model, intelligently analyze the network topology output by the graph neural network model, set early warning thresholds, and identify abnormal patterns or potential risks in network data;

[0015] Early warning output and response: The early warning model monitors the campus network in real time and dynamically adjusts the early warning model using the gradient descent method; when the early warning model detects abnormal behavior or potential failures, the early warning mechanism is triggered and corresponding response measures are taken.

[0016] Further, constructing a graph neural network model includes the following steps:

[0017] Identify the nodes and node connection relationships in the preprocessed network data, and build the basic framework of the graph neural network model by identifying the connection relationships between nodes. The basic framework of the graph neural network includes the node embedding layer, graph convolution layer, pooling layer, and fully connected layer;

[0018] Based on the identified nodes and connection relationships, a graph neural network is selected to build a graph neural network topology model; the connection relationship between nodes is analyzed, including the closeness and directionality of the connection between nodes;

[0019] Calculate the path length between nodes in the graph to evaluate the efficiency of information transmission in the network; calculate the clustering coefficient of each node to evaluate the local density of the network;

[0020] The graph neural network model is obtained from the basic framework of the graph neural network model and the graph neural network topology model.

[0021] 3. The network early warning method according to claim 2 is characterized in that the goal of the graph neural network is to learn a function f that can receive the graph G as input, and the function f is expressed as:

[0022] f(G)=GNN(G)=GNN(V,E),

[0023] Among them, GNN represents the graph neural network model, V is the node set, and E is the edge set.

[0024] Furthermore, the node embedding layer in the graph neural network is expressed as:

[0025]

[0026] in, is the i-th node v i The initial embedding representation of x is Embed, which is the embedding function. i is the i-th node v in the node set V i eigenvector of , i=1,2,3….

[0027] Furthermore, the graph convolution layer in the graph neural network is expressed as:

[0028]

[0029] in, is the i-th node v i In the embedding representation at layer l, N(i) is the i-th node v i The set of neighbor nodes, W (l) is the weight matrix of the lth layer, b (l) is the bias term of the lth layer, represents the jth node v i In the embedding representation of the l-1th layer, j = 1, 2, 3, ..., σ is the activation function.

[0030] Furthermore, the pooling layer in the graph neural network adopts global average pooling:

[0031]

[0032] Among them, h G is the overall embedding representation of the graph G, L is the number of graph convolution layers, and |V| represents the total number of nodes in the graph G; finally, the fully connected layer embeds the overall graph into h G Mapped to the predicted result y:

[0033] y=FC(h G ),

[0034] Where y is the prediction result and FC is the fully connected layer function.

[0035] Furthermore, the multi-source information fusion technology is used to fuse the pre-processed network data from different sources to build an early warning model, including:

[0036] Collect and pre-process network data from different sources within the park, including traffic data and node status data;

[0037] Extract and select key features from the preprocessed network data. The key features can reflect the network status or abnormal behavior.

[0038] Use the variance-based feature selection method to screen out the features that contribute most to the early warning model, and evaluate the importance of the selected key features;

[0039] A simple weighted average fusion strategy is used to fuse key feature information from different sources;

[0040] The support vector machine model is used to build an early warning model, which is trained to identify normal network behaviors and abnormal behaviors in network data.

[0041] Further, the simple weighted average algorithm is:

[0042]

[0043] Among them, x1 m is the data of the mth data source, w1 m is the mth data x1 m The corresponding weight, S is the fusion result, n1 is the number of data sources, m = 1, 2, 3…n1.

[0044] Furthermore, the support vector machine aims to minimize the following objective function:

[0045]

[0046] The objective function satisfies the following constraints:

[0047] y p (w x2 p +b)≥1-ζ p and p ,

[0048] Solve the optimal hyperplane and find the optimal hyperplane to classify normal behavior and abnormal behavior;

[0049] Where w is the normal vector of the hyperplane, b is the intercept of the hyperplane, and x2 p is the feature vector of the pth sample, y p is the label of the pth sample, where +1 indicates normal and -1 indicates abnormal; n2 is the number of samples, ζ p is the pth slack variable, used to deal with the case of linear inseparability, C is the regularization parameter, used to control the complexity of the model and the degree of fit to the training data, p = 1, 2, 3...

[0050] Furthermore, the warning threshold setting formula is:

[0051]

[0052] Where: y1 represents the output of the early warning model; T represents the preset early warning threshold.

[0053] Compared with the prior art, the present invention has the following beneficial effects:

[0054] The early warning method of the present invention realizes timely discovery and early warning of abnormal behaviors and potential failures in the network by integrating different types of network data. The early warning method can comprehensively utilize multi-source information, improve the accuracy and reliability of early warning, and effectively avoid or reduce the losses caused by network failures and anomalies. At the same time, the technology can also perform adaptive adjustments according to changes in network status to maintain the real-time and effectiveness of the early warning system.

[0055] The network early warning method for a campus self-organizing network or local area network described in the present invention aims to identify and prevent potential risks and abnormal behaviors in the network through real-time data collection, graph neural network model construction, multi-source information fusion, and dynamic early warning and response mechanism, which can further improve the accuracy and efficiency of campus early warning. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 The present invention is a flow chart of the network early warning method for a campus ad hoc network or a local area network. DETAILED DESCRIPTION

[0057] The technical solution of the present invention will be clearly described below in conjunction with the accompanying drawings. Obviously, the described embodiments are not all embodiments of the present invention, and all other embodiments obtained by ordinary technicians in the field without making creative work are within the protection scope of the present invention.

[0058] Example 1

[0059] like Figure 1 As shown, the present invention provides a network early warning method for a campus ad hoc network or a local area network, and the early warning method comprises the following steps:

[0060] 1. Data collection and preprocessing: Real-time collection of network data related to personnel and equipment from different sources within the park’s self-organizing network or local area network. Data sources include personnel flow information, vehicle entry and exit information, environmental monitoring information, and equipment status information; the collected network data is cleaned, standardized, or normalized for preprocessing.

[0061] 2. Topological structure identification and modeling: Using graph theory and network science theory, the topological structure of pre-processed network data is identified, a graph neural network model is constructed, and network characteristics such as the connection relationship between nodes, path length, and clustering coefficient are analyzed.

[0062] The basic framework of the graph neural network includes the node embedding layer, graph convolution layer, pooling layer, and fully connected layer. The node embedding layer is responsible for mapping the original features of the node into a low-dimensional space for subsequent graph convolution operations. The graph convolution layer updates the representation of the node by aggregating the information of neighboring nodes to capture the connection relationship between nodes. The pooling layer is used to reduce the dimension of the graph structure and reduce the amount of calculation. The fully connected layer is used to output the final prediction result.

[0063] Let graph G = (V, E),

[0064] Where: V is a set of vertices, represented by V = {v1, v2, ..., v n}, n is the number of nodes. Each node v i (where i∈{1,2,…,n}) has an eigenvector, denoted by x i , the eigenvector x i The dimension is d, that is, x i ={x i1 ,x i2 ,...,x id}.

[0065] E is the set of edges.

[0066] The goal of a graph neural network (GNN) is to learn a function f that can receive a graph G as input and output a vector representing the overall features of the graph G or perform some kind of prediction task. Specifically, the function f is expressed as:

[0067] f(G)=GNN(G)=GNN(V,E),

[0068] GNN stands for Graph Neural Network model, which learns the representation of graphs by aggregating node features, edge information, and the topological structure of graphs.

[0069] The node embedding layer is represented as:

[0070]

[0071] in, is the i-th node v i The initial embedding representation of x, Embed is the embedding function, i is the i-th node v in the node set V i eigenvector of , i=1,2,3….

[0072] The graph convolutional layer is represented as:

[0073]

[0074] in, is the i-th node v i In the embedding representation at layer l, N(i) is the i-th node v i The set of neighbor nodes, W (l) is the weight matrix of the lth layer, b (l) is the bias term of the lth layer, represents the jth node v i In the embedding representation of the l-1th layer, j = 1, 2, 3…, σ is the activation function, such as ReLU, sigmoid, etc.

[0075] The operation of the graph convolutional layer can be explained as follows: for each node v i , firstly, the embedding vectors of its neighbor nodes are passed through the weight matrix W (l) Convert to the current layer, then perform weighted averaging on these converted embedding vectors, and finally add the bias term b (l) And through the activation function σ, a nonlinear transformation is performed to obtain the node v i The embedding vector at the current layer

[0076] The pooling layer can adopt a variety of strategies, such as global average pooling, global maximum pooling, etc. Take global average pooling as an example:

[0077]

[0078] Among them, h G is the overall embedding representation of graph G, L is the number of graph convolutional layers, |V| represents the total number of nodes in graph G, Represents node v i Embedding representation of the Lth layer (i.e. the last graph convolutional layer). It means averaging the embedding vectors of all nodes in the graph. A simple averaging strategy is used here, that is, the weight of the embedding vector of each node in the final overall embedding representation is equal. By calculating the average of the embedding vectors of all nodes, the embedding representation of the entire graph can be obtained.

[0079] Finally, the fully connected layer embeds the entire graph into representation h G Mapped to the predicted result y:

[0080] y=FC(h G ),

[0081] Where y is the prediction result, FC is the fully connected layer function, which is responsible for embedding the entire graph into h G Mapped to the predicted result y. The fully connected layer is usually a linear transformation plus a nonlinear activation function (such as softmax for classification tasks).

[0082] Building a graph neural network model includes the following steps:

[0083] Identify the nodes and node connection relationships in the preprocessed network data, and build the basic framework of the graph neural network model by identifying the connection relationships between nodes; based on the identified nodes and connection relationships, select the appropriate graph convolutional network (GCN) model to build the graph neural network topology model; analyze the connection relationship between nodes, including the tightness and directionality of the connection between nodes; calculate the path length between nodes in the graph to evaluate the efficiency of information transmission in the network; calculate the clustering coefficient of each node to evaluate the local density of the network. Network data includes node connection relationships, network traffic data, etc. Network traffic data usually contains data packet transmission information in the network, such as transmission volume, transmission rate, data packet size distribution, transmission direction, etc.

[0084] Building a graph neural network model further includes selecting appropriate loss functions and optimizers according to task requirements to update model parameters; through an iterative training process, monitoring the performance of the model during training, such as accuracy, loss value, etc.; dividing the preprocessed network data into training sets, validation sets, and test sets, evaluating the performance of the model on the validation sets and test sets, and selecting the best model parameters.

[0085] 3. Use multi-source information fusion technology to fuse network data from different sources in the park (such as traffic data, node status data, etc.), build an early warning model, intelligently analyze the network topology structure output by the graph neural network model, set early warning thresholds, and identify abnormal patterns or potential risks. By fusing this information, the shortcomings of a single data source can be made up and the accuracy and reliability of network status perception can be improved. Multi-source information fusion technology fuses network data from different sources in the park (such as traffic data, node status data, etc.), including the following steps:

[0086] Collect and pre-process network data from different sources within the park, including traffic data and node status data;

[0087] Extract key features from the preprocessed network data. The key features can reflect the network status or abnormal behavior. Use the variance-based feature selection method to select the key features that contribute most to the early warning model, and evaluate the importance of the selected key features.

[0088] A fusion strategy is used to fuse feature information from different sources;

[0089] The support vector machine model is used to build an early warning model, and the fused features are used for training. The early warning model is trained to identify normal network behaviors and abnormal behaviors in the integrated network data. Specifically,

[0090] Collect network data from different sources in the park and pre-process them. Network data includes traffic data, node status data, etc. Traffic data usually contains information about data packet transmission in the network, such as transmission volume, transmission rate, data packet size distribution, transmission direction, etc. Node status data describes the current status of network nodes, such as the online / offline status of nodes, CPU usage, memory occupancy, disk I / O, etc. Clean the collected network data to remove noise and outliers to ensure data quality. Standardize or normalize network data for subsequent analysis.

[0091] According to the application scenario and data characteristics, a simple weighted average fusion strategy is used to integrate feature information from different sources. Simple weighted average fusion strategy algorithm:

[0092]

[0093] Among them, x1 m is the data of the mth data source, w1 m is the mth data x1 m The corresponding weight, S is the fusion result, n1 is the number of data sources, m = 1, 2, 3…n1.

[0094] The support vector machine model is used to build an early warning model. The early warning model is trained to identify normal network behavior and abnormal behavior in network data. The support vector machine (SVM) is selected as the classification algorithm. For the support vector machine (SVM), the goal is to minimize the following objective function:

[0095]

[0096] The objective function satisfies the following constraints:

[0097] y p (w x2 p +b)≥1-ζ p and p ,

[0098] Solve the optimal hyperplane and find the optimal hyperplane to classify normal behavior and abnormal behavior;

[0099] Where w is the normal vector of the hyperplane, b is the intercept of the hyperplane, and x2 p is the feature vector of the pth sample, y p is the label of the pth sample, where +1 indicates normal and -1 indicates abnormal; n2 is the number of samples, ζ p is the pth slack variable, used to deal with the case of linear inseparability, C is the regularization parameter, used to control the complexity of the model and the degree of fit to the training data, p = 1, 2, 3...

[0100] 4. Warning output and response: Deploy the constructed warning model to the actual network environment for real-time monitoring and adaptive adjustment; according to the changes in the network status, use the gradient descent method to dynamically adjust the model parameters or retrain the model to maintain the accuracy and timeliness of the warning system. When the warning model detects abnormal behavior or potential failures in the network data, when the specific indicators are monitored to exceed the warning threshold, the warning mechanism is triggered and the warning information is output; according to the warning level and type, take corresponding response measures to the warning, such as notifying the administrator, automatically isolating the faulty node, etc.

[0101] The triggering of the early warning mechanism is to set one or more early warning thresholds. The early warning model calculates one or more early warning indicators by monitoring network data in real time. When these early warning indicators reach or exceed the preset early warning threshold, the early warning mechanism is triggered. According to the level and classification type of the early warning, response measures are taken. Minor early warnings may only require logging or sending notifications to administrators. Medium early warnings may require manual intervention by administrators or the launch of certain automated scripts. Severe early warnings may require immediate isolation of faulty nodes, disconnection of affected network connections, or the launch of emergency response plans.

[0102] The setting of warning threshold is a key part of the warning mechanism. The formula for setting the warning threshold is:

[0103]

[0104] Where: y1 represents the output of the early warning model, which can be the value of one or more early warning indicators. T represents the preset early warning threshold. When y1 reaches or exceeds T, the early warning mechanism is triggered.

[0105] The above technical features constitute the best embodiment of the present invention, which has strong adaptability and best implementation effect. Non-essential technical features can be added or reduced according to actual needs to meet the needs of different situations.

[0106] Finally, it should be noted that the above content is only used to illustrate the technical solution of the present invention, rather than to limit the scope of protection of the present invention. Simple modifications or equivalent substitutions of the technical solution of the present invention by ordinary technicians in this field do not deviate from the essence and scope of the technical solution of the present invention.

Claims

1. A network early warning method for a campus ad hoc network or a local area network, characterized in that: The steps include: Collect network data from different sources in the park's self-organizing network or local area network in real time, and clean, standardize or pre-process the collected network data; Using graph theory and network science theory, we identify the topological structure of preprocessed network data, build a graph neural network model, and analyze network characteristics including the connection relationship between nodes, path length, and clustering coefficient; Using multi-source information fusion technology, the pre-processed network data from different sources are integrated to build an early warning model, intelligently analyze the network topology output by the graph neural network model, set early warning thresholds, and identify abnormal patterns or potential risks in network data; Warning output and response: The warning model monitors the campus network in real time and dynamically adjusts the warning model using the gradient descent method; When the early warning model detects abnormal behavior or potential failure, the early warning mechanism is triggered and corresponding response measures are taken.

2. The network early warning method according to claim 1, characterized in that: Building a graph neural network model includes the following steps: Identify the nodes and node connection relationships in the preprocessed network data, and build the basic framework of the graph neural network model by identifying the connection relationships between nodes. The basic framework of the graph neural network includes the node embedding layer, graph convolution layer, pooling layer, and fully connected layer; Based on the identified nodes and connection relationships, a graph neural network is selected to build a graph neural network topology model; the connection relationship between nodes is analyzed, including the closeness and directionality of the connection between nodes; Calculate the path length between nodes in the graph to evaluate the efficiency of information transmission in the network; calculate the clustering coefficient of each node to evaluate the local density of the network; The graph neural network model is obtained from the basic framework of the graph neural network model and the graph neural network topology model.

3. The network early warning method according to claim 2, characterized in that: The goal of graph neural networks is to learn a function f that can receive graph G as input. Function f is expressed as: f(G)=GNN(G)=GNN(V,E), Among them, GNN represents the graph neural network model, V is the node set, and E is the edge set.

4. The network early warning method according to claim 3, characterized in that: The node embedding layer in the graph neural network is represented as: h i (0) =Embed(x i ), in, is the i-th node v i The initial embedding representation of x, Embed is the embedding function, i is the i-th node v in the node set V i eigenvector of , i=1,2,3….

5. The network early warning method according to claim 4, characterized in that: The graph convolution layer in the graph neural network is represented as: in, is the i-th node v i In the embedding representation at layer l, N(i) is the i-th node v i The set of neighbor nodes, W (l) is the weight matrix of the lth layer, b (l) is the bias term of the lth layer, represents the jth node v i In the embedding representation of the l-1th layer, j = 1, 2, 3, ..., σ is the activation function.

6. The network early warning method according to claim 5, characterized in that: The pooling layer in the graph neural network uses global average pooling, and the calculation formula is: Among them, h G is the overall embedding representation of the graph G, L is the number of graph convolution layers, and |V| represents the total number of nodes in the graph G; finally, the fully connected layer embeds the overall graph into h G Mapped to the predicted result y: y=FC(h G ), Where y is the prediction result and FC is the fully connected layer function.

7. The network early warning method according to claim 1, characterized in that: Using multi-source information fusion technology, the pre-processed network data from different sources are integrated to build an early warning model, including: Collect and pre-process network data from different sources within the park, including traffic data and node status data; Extract key features from the preprocessed network data. The key features can reflect the network status or abnormal behavior. Use the variance-based feature selection method to select the key features that contribute most to the early warning model, and evaluate the importance of the selected key features. A simple weighted average fusion strategy is used to fuse key feature information from different sources; The support vector machine model is used to build an early warning model, which is trained to identify normal network behaviors and abnormal behaviors in network data.

8. The network early warning method according to claim 7, characterized in that: The simple weighted average algorithm is: Among them, x1 m is the data of the mth data source, w1 m is the mth data x1 m The corresponding weight, S is the fusion result, n1 is the number of data sources, m = 1, 2, 3…n1.

9. The network early warning method according to claim 7, characterized in that: Support vector machine, the goal is to minimize the following objective function: The objective function satisfies the following constraints: y p (w x2 p +b)≥1-ζ p and p , Solve the optimal hyperplane and find the optimal hyperplane to classify normal behavior and abnormal behavior; Where w is the normal vector of the hyperplane, b is the intercept of the hyperplane, and x2 p is the feature vector of the pth sample, y p is the label of the pth sample, where +1 indicates normal and -1 indicates abnormal; n2 is the number of samples, ζ p is the pth slack variable, used to deal with the case of linear inseparability, C is the regularization parameter, used to control the complexity of the model and the degree of fit to the training data, p = 1, 2, 3...

10. According to the network early warning method of claim 7, the early warning threshold setting formula is: in: y1 represents the output of the early warning model; T represents the preset early warning threshold.

Images