Calculation method of automatic processing tool based on abnormal link identification

Abstract

The invention discloses a calculation method of an automatic processing tool based on abnormal link identification. The method comprises the steps of S1, receiving network flow data, S2, analyzing the data to determine a reference mode, S3, detecting an abnormal link in a network based on the reference mode, and S4, generating and executing a corresponding repair instruction to process the abnormal link. According to the calculation method of the automatic processing tool based on abnormal link identification, new threats can be found and dealt with in time, the defect of response lag in the face of unknown anomalies in the prior art is overcome, the safety of the system is improved, and the method is suitable for popularization and application. The problems that in the prior art, threshold adjustment is not timely, data preprocessing lags behind, multi-dimensional feature selection is inaccurate, automatic coping strategies are insufficient, and the unknown anomaly recognition capacity is limited are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of computer networks, and in particular to a calculation method of an automated processing tool based on abnormal link identification. Background Art

[0002] Among existing network monitoring technologies, automated processing tools based on abnormal link identification are a widely used solution that aims to identify and locate behaviors that deviate from normal patterns in network links through data analysis technology and handle them through automated processes. This approach has significant advantages in improving the efficiency of network monitoring and responding to network anomalies in a timely manner. However, this technology also faces some challenges in practical applications.

[0003] First, in an environment where the network topology changes frequently, the threshold that anomaly detection relies on may not be adjusted in time, resulting in false alarms. This is because the dynamic changes in the network structure will affect parameters such as link traffic and delay, and the fixed threshold cannot adapt to these changes, thereby reducing the accuracy of detection; second, in a high-concurrency data environment, the data preprocessing link may lag due to excessive data volume, resulting in delays in detection and processing. A large amount of real-time data needs to be processed in a short period of time, and traditional data preprocessing technology may not be able to respond in time, which in turn affects the real-time and response speed of the system; third, in a complex network environment, the multi-dimensional feature selection of the anomaly detection model is often not accurate enough, which can easily lead to overfitting of the model. Due to the diversity and complexity of network links, the anomaly detection model needs to select a large number of features. Representative dimensions are extracted, but incorrect or incomplete feature selection may cause the model to perform well on training data, but fail to accurately detect anomalies in actual applications; in addition, current automated processing tools often lack specific response strategies for different types of anomalies, making it impossible to effectively distinguish different types of anomalies when dealing with link anomalies, resulting in poor response effects. Each type of anomaly may require a different solution, and a single automated strategy cannot cope with complex and diverse anomalies; finally, during continuous monitoring, the system has limited ability to identify new and unknown types of anomalies, and may not be able to issue alarms or respond in a timely manner. This is because the existing detection models are mainly based on known abnormal behavior characteristics, and there is usually a lack of effective means for identifying unknown anomalies, resulting in a delayed response of the system when facing new threats. In summary, although automated processing tools based on abnormal link identification are widely used in network monitoring, there are still problems such as untimely threshold adjustment, delayed data preprocessing, inaccurate multi-dimensional feature selection, insufficient automated response strategies, and limited unknown anomaly identification capabilities. Summary of the invention

[0004] The purpose of the present invention is to provide a calculation method for an automated processing tool based on abnormal link identification, so as to solve the problems in the prior art of untimely threshold adjustment, delayed data preprocessing, inaccurate multi-dimensional feature selection, insufficient automated response strategies and limited unknown anomaly identification capability.

[0005] To achieve the above object, the present invention provides the following technical solution: a calculation method of an automated processing tool based on abnormal link identification, the method comprising: S1, receiving network traffic data; S2, analyzing data to determine the baseline model; S3, detecting abnormal links in the network based on the benchmark mode; S4, generating and executing corresponding repair instructions to handle abnormal links; Wherein, step S3 includes analyzing the high concurrent network traffic data from each node, removing noise, filtering and formatting the raw data that has not been pre-processed, performing link status analysis based on the real-time formatted data, setting conditions if Then mark the node as a potential outlier, where Indicates the average traffic on the current link. It represents the standard deviation of the historical average flow plus the average of the flow fluctuation within the normal range; The step S4 includes, before generating the repair instruction, first classifying the abnormal type according to the detected abnormal link behavior, and after classifying the abnormal type, optimizing the repair strategy using a reinforcement learning algorithm, the reinforcement learning algorithm is specifically: ; in, represents the action-value function, Indicates the current network status. Indicates time, Indicates the currently selected repair strategy. represents the learning rate, Represents the reward value, represents the discount factor, Indicates execution of an action The next state to enter is Indicates the next state All possible actions in Generate specific repair instructions based on the selected repair strategy. After the repair instructions are generated, the repair operation is automatically executed through the management interface of the network device. After the repair instructions are executed, verify whether the repair operation is effective by monitoring the real-time status of the link.

[0006] Preferably, the step S1 comprises: Network traffic data is collected from different nodes or links in the network, and the data is obtained in real time through distributed collection tools.

[0007] Preferably, the step S2 comprises: The baseline model is constructed by determining the normal range of key parameters through the historical behavior of statistical data. The description of the network baseline behavior includes calculating the expected value and standard deviation of each feature, specifically: and ; in, Represents a specific network feature, Indicates The value of sample data, Indicates the index number of the sample, express The expected value of express The standard deviation of Indicates the number of sample data.

[0008] Preferably, the step S2 further comprises: Use the time series model to predict normal network behavior and use it as a benchmark to detect anomalies. The specific formula is: ; in, Indicates at time Network traffic data, Indicates time, represents the data point at the previous time. represents the autoregressive coefficient, represents the moving average coefficient, Indicates the current time The error term, represents the error term at previous time, represents the lag coefficient of the autoregressive part, Represents the lag coefficient of the moving average part.

[0009] Preferably, step S3 comprises: Use the moving average method to smooth the network traffic and remove noise, specifically: ; in, Indicates the current flow after smoothing, Indicates time, Indicates the size of the time window, Represents the index of a time point in the time series. Indicates time The original traffic data at Based on the 3σ rule, outliers are removed and outliers exceeding three times the standard deviation of the mean are filtered out in the flow data, that is: like ,but is an outlier, in, Indicates time The original traffic data at Represents the index of a time point in the time series. represents the mean of historical traffic, Indicates the standard deviation of historical traffic.

[0010] Preferably, the step S3 further comprises: Use the sliding window method to average the traffic in the current time period, specifically: ; in, Indicates the current time point The average flow rate, Indicates the size of the time window, Indicates time, Represents the time index, Indicates the previous time point Traffic volume; If the conditions are met , the node is recorded and an alarm or automatic repair is performed.

[0011] Preferably, the repair strategy includes: When a link is overloaded or interrupted, traffic is rerouted to other backup links; Protect high-priority traffic and limit bandwidth usage for low-priority traffic; Restart or automatically reconfigure devices that have detected a failure; Distribute traffic across multiple links.

[0012] Preferably, specific repair instructions are generated according to the selected repair strategy, and these instructions are directly sent to relevant devices through an API, a command line interface or a network device management protocol.

[0013] Preferably, after the repair instruction is generated, the repair operation is automatically executed through the management interface of the network device, and the execution method includes: Directly control the device through API interface or CLI commands; Adjust routing through control plane protocols, automatically modify routing protocol configurations, and change traffic paths; Dynamically update the traffic policy or configuration file on the device and restart the service to make it take effect.

[0014] It can be seen from the above technical solution that the present invention has the following beneficial effects: The calculation method of the automatic processing tool based on abnormal link identification receives network traffic data, analyzes the data to determine a baseline mode, detects abnormal links in the network based on the baseline mode, generates and executes corresponding repair instructions to process the abnormal links, can adjust the threshold of abnormal detection in real time according to the change of the network topology structure, avoids the limitation that the traditional fixed threshold is difficult to adapt to the dynamic network environment, reduces the occurrence of false alarms, improves the accuracy of abnormal detection, significantly improves the speed of data processing, can cope with a large amount of real-time data in a high-concurrency environment, avoids the problem of overfitting, improves the accuracy and robustness of the abnormal detection model in practical applications, can take corresponding countermeasures for different abnormal types, enhances the effect of abnormal processing, significantly improves the efficiency and accuracy of network abnormal processing, and can timely discover and respond to new threats by continuously learning new abnormal features, making up for the defect of the prior art that the response is delayed when facing unknown abnormalities, improving the security of the system, and solving the problems of the prior art that the threshold adjustment is not timely, the data preprocessing is delayed, the multi-dimensional feature selection is inaccurate, the automatic response strategy is insufficient, and the unknown abnormality recognition ability is limited. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] like Figure 1 As shown, a calculation method of an automated processing tool based on abnormal link identification, the method comprising: S1, receiving network traffic data; S2, analyzing data to determine the baseline model; S3, detecting abnormal links in the network based on the benchmark mode; S4, generating and executing corresponding repair instructions to handle abnormal links; In one possible implementation, the calculation method is applied to a network operation and maintenance system, and the system uses the method to identify and process abnormal links in the network to improve the stability and security of the network. The method mainly includes four steps: S1. Receive network traffic volume. In this step, network traffic data is received in real time through multiple network nodes. The received data includes but is not limited to the source address, destination address, transmission protocol type, transmission delay, packet loss rate, etc. of network data packets. These data will serve as the basis for subsequent analysis; S2. Analyze data to determine the baseline mode. Use machine learning algorithms or rule-based analysis tools to process the received traffic data to generate a baseline mode. The baseline mode can represent the network behavior under normal circumstances, including the normal range of various network parameters, the regular changes of network traffic, etc. The system can define and optimize the baseline mode by learning from historical data or preset network performance standards; S3. Detect abnormal links in the network based on the benchmark pattern. Compare the real-time received network traffic data with the benchmark pattern. If the data is detected to deviate from the benchmark pattern, it is considered an abnormal link. For example, if the delay value of a link exceeds the normal range, or the packet loss rate is much higher than expected, it will be identified as an abnormal link. The system can improve detection accuracy by setting abnormal thresholds or using real-time dynamically adjusted abnormal detection models; S4. Generate and execute corresponding repair instructions to handle abnormal links. Once an abnormal link is detected, repair instructions will be automatically generated. These instructions may include rerouting, limiting current, restarting the device, or notifying the operation and maintenance personnel to intervene manually. The system automatically executes these repair instructions and re-checks the network status after execution to ensure that the anomaly is repaired or alleviated.

[0018] This calculation method acquires and analyzes network traffic data in real time to generate a benchmark pattern for detecting network anomalies. The core of this method is to use the benchmark pattern as a judgment standard, so that the system can accurately identify anomalies in network links and automatically handle them. Through the pre-set repair mechanism, the system can automatically generate and execute instructions after discovering anomalies to restore the normal state of the network. The dynamic adjustment function of the benchmark pattern in the system also ensures the adaptability and flexibility of the method in different network environments. Compared with traditional manual monitoring and manual troubleshooting, this automated processing tool based on abnormal link identification greatly improves the efficiency of anomaly detection and processing. Its advantages include: real-time: it can analyze network data in real time, quickly detect abnormal links, and reduce response time; accuracy: based on dynamically generated benchmark patterns, it improves the accuracy of anomaly identification and reduces false alarm rate; automation: the system automatically generates and executes repair instructions, reduces manual intervention, and improves the stability of network operation; scalability: this method can adapt to a variety of network systems of different scales and complexities, and flexibly adjusts benchmark patterns and repair strategies according to actual conditions.

[0019] In addition to receiving traffic data from network nodes, the system can also obtain data through network probes or mirror ports for more detailed analysis and detection. In addition to the baseline model generation based on machine learning, the system can also use rule-based anomaly detection models, such as preset threshold methods, traffic prediction models, etc. These models are selected or mixed according to the specific network environment. Repair instructions can take different processing methods according to different anomaly types. In addition to rerouting or current limiting, they can also include operations such as scheduling load balancing and adjusting transmission parameters. They can even be linked with external security systems for security protection operations. The detection threshold of abnormal links can be automatically adjusted by the system or manually set according to the experience of operation and maintenance personnel. Adjusting the threshold range can adapt to the needs of different network environments to improve the applicability and accuracy of detection.

[0020] Step S1 includes collecting network traffic data from different nodes or links in the network, and the data is obtained in real time through a distributed collection tool.

[0021] In a possible implementation, step S1 collects network traffic data from multiple network nodes or links through a distributed collection tool. The distributed collection tool includes collection agents installed on network nodes or link devices, which can monitor the network traffic flowing through them in real time and transmit the data to a central server or a centralized data processing module. The collected data content includes the source IP address, target IP address, port number, protocol type, data packet size, transmission delay, packet loss rate, etc. of the network packet. Specifically, the collection agent on each network node is configured to send real-time data to the central server regularly. To ensure the efficiency and accuracy of data collection, the system adopts a distributed architecture to achieve high concurrent processing capabilities for data collection. The operating mechanism of the distributed collection tool is to reduce the load pressure of a single node by extracting data from different nodes or links at the same time, and improve the real-time performance of data collection. In addition, the system also supports data slicing and aggregation, especially in a complex network environment with high traffic. The distributed collection tool can slice the collected network traffic data so as to process the data more efficiently and discover abnormal behaviors in the network.

[0022] The working principle of this step is based on the idea of ​​distributed data collection. Network data is collected in parallel through multiple nodes to ensure that the system monitors the entire network traffic in real time and accurately. The distributed collection tool works independently on each network node and uses a distributed architecture to process large-scale traffic data, solving the problem of single-node data processing bottlenecks. The collection agent of each node will periodically or continuously push the network traffic information it monitors to the central data processing system, thereby ensuring that the network operation and maintenance system can grasp the traffic status of the entire network. The distributed tool also uses deduplication, compression, and delay tolerance mechanisms to handle data synchronization issues between different network nodes, ensuring that the data collected by each node can be accurately processed and aggregated. The collection agent in the system can also adapt to different protocols and network environments, providing a flexible data collection method. Distributed collection tools enable the system to obtain data from multiple nodes in real time, ensuring rapid updating of traffic information, which helps to promptly discover and handle network anomalies. The design of the distributed architecture reduces dependence on a single node, can cope with high-concurrency data processing requirements in large-scale networks, and improves the efficiency of overall network monitoring. By collecting traffic data from multiple nodes in parallel and combining data deduplication and aggregation processing, the system can obtain more accurate network status and reduce false alarms and missed alarms. The distributed architecture allows the system to flexibly increase or adjust collection nodes according to the expansion of the network scale, ensuring the scalability and flexibility of the collection system.

[0023] In addition to the agent-based distributed collection tools, the system can also use other methods such as network probes and traffic mirroring to collect network data. Probes can be deployed on switches or routers to capture the mirror information of network traffic in real time, thereby replacing some functions of agent collection. In some scenarios with low real-time requirements, the system can use asynchronous data collection to reduce the occupation of network bandwidth. Through asynchronous collection, data can be cached locally and then sent to the central server for processing at regular intervals. Distributed collection tools can support a variety of different network protocols. In addition to the common IP, TCP / UDP protocols, they can also be compatible with processing traffic data of higher-level application protocols (such as HTTP, DNS, FTP, etc.), helping the system detect abnormal links at the specific protocol level. A variety of data processing methods can be used for optimization, such as reducing the occupation of transmission bandwidth through data compression, or using edge computing to delegate some data processing tasks to the collection node to reduce the load on the central processing system.

[0024] Step S2 includes: The baseline model is constructed by determining the normal range of key parameters through the historical behavior of statistical data. The description of the network baseline behavior includes calculating the expected value and standard deviation of each feature, specifically: and ; in, Represents a specific network feature, Indicates The value of sample data, Indicates the index number of the sample, express The expected value of express The standard deviation of Indicates the number of sample data.

[0025] In one possible implementation, the benchmark model construction in step S2 is determined by statistically analyzing the historical behavior of network data. Specifically, the system selects several key characteristic parameters (such as network delay, packet loss rate, bandwidth occupancy rate, etc.) from the received network traffic data, and calculates their expected values ​​based on the historical data of these parameters. and standard deviation These statistical parameters will be used to define the normal range and detect subsequent abnormal links. , first based on historical sample data Calculate the expected value of the feature Expected value It represents the average value of the network characteristics, reflecting the typical behavior of the network under normal circumstances. Its calculation formula is: ; The expected value is used as the central value of the characteristic parameter to measure whether the real-time data deviates from the historical normal state.

[0026] Standard Deviation Indicates the fluctuation range of a specific network feature, which is used to describe the degree of dispersion of the feature under normal circumstances. The standard deviation is obtained by calculating the mean of the square of the difference between each feature and the expected value and taking the square root: ; By calculating the standard deviation, we can determine the fluctuation range of network features and set the corresponding detection threshold. Add or subtract multiples of the standard deviation It will be regarded as abnormal behavior; By calculating the above expected value and standard deviation , can build a baseline model that reflects the upper and lower limits of normal network behavior. This baseline model can be updated over time to adapt to dynamic changes in the network environment. The establishment of the baseline model is based on long-term data collection and analysis, so the system also supports segmented data processing to cope with changes in network traffic in different time periods.

[0027] The working principle of this implementation is to build a baseline behavior of the network based on the statistical characteristics of historical data. By calculating the expected value and standard deviation of each network feature, the system can describe the behavior pattern of each feature under normal network operation. Real-time network data will be compared with these statistical models. When the network feature value exceeds the set normal range (such as ), the system will mark it as an anomaly. This method uses the discrete measurement principle in statistics to ensure that the system can not only detect extreme anomalies (such as network failures), but also detect small but significant anomalies (such as the gradual degradation of network performance), thereby ensuring the stability and predictability of the network. By building a benchmark model based on historical data, the system can accurately define the normal range of each feature, reduce false positives and false negatives, and improve the accuracy of anomaly detection. Based on statistical methods, the system can dynamically adjust the benchmark model according to the feedback of real-time data to ensure that it can adapt to changes in the network environment and improve the flexibility of the system. This method is not only suitable for the monitoring of a single network feature, but can also be extended to the joint monitoring of multiple features to provide a more comprehensive network performance evaluation. The system can automatically optimize the benchmark model as historical data increases, reduce human intervention, and improve the level of automation and response speed.

[0028] In addition to the expected value and standard deviation based methods, the system can also build more complex benchmark models through machine learning algorithms (such as cluster analysis and time series analysis) to adapt to nonlinear or complex network environments. In addition to the method, the system can also use other judgment criteria according to specific network scenarios, such as anomaly detection methods based on statistical confidence intervals, or setting anomaly detection thresholds based on the maximum and minimum values ​​of historical data. In order to improve the accuracy of the benchmark model, the system can introduce a self-learning mechanism to automatically learn new network behaviors and incorporate them into the update process of the benchmark model, thereby reducing dependence on manual adjustments. The frequency and quantity of data sampling can be adjusted according to different network environments to optimize computing efficiency and improve the ability to respond to real-time data changes. For example, in a high-traffic network, the sampling frequency is increased to capture abnormal changes in traffic more quickly.

[0029] Step S2 also includes: Use the time series model to predict normal network behavior and use it as a benchmark to detect anomalies. The specific formula is: ; in, Indicates at time Network traffic data, Indicates time, represents the data point at the previous time. represents the autoregressive coefficient, represents the moving average coefficient, Indicates the current time The error term, represents the error term at previous time, represents the lag coefficient of the autoregressive part, Represents the lag coefficient of the moving average part.

[0030] In one possible implementation, the benchmark model in step S2 predicts the normal behavior of the network through a time series model (such as an ARMA or ARIMA model). Specifically, the system builds a time series model based on historical network traffic data, uses the model to predict future network behavior, and compares the predicted value with the real-time traffic data to detect abnormal behavior that deviates from the predicted range. First, the historical network data is analyzed in time series, and the hysteresis coefficient is adjusted. and The system can flexibly adjust the complexity of the model to adapt to network environments of different scales and complexities. Represents the prediction error at the current moment. After training the model with historical data, the distribution of the error term can be obtained. The system will set the upper and lower limits of the error term based on the statistical characteristics of historical errors (such as variance, mean, etc.) to identify abnormal network behavior at future moments. When it exceeds the normal range, the system will regard it as abnormal behavior and trigger the corresponding abnormal handling mechanism. During the operation of the system, every time it receives new network traffic data, it will predict the normal traffic value at the future time based on the time series model. The actual traffic data is compared with the predicted value. If the deviation exceeds the reasonable range, the system will identify it as an abnormal link. By dynamically adjusting the autoregressive coefficient and the moving average coefficient, the system can adapt to the changes in network traffic and accurately detect various abnormal situations.

[0031] The working principle of this implementation is based on time series analysis. By building an autoregressive moving average model (ARMA or extended ARIMA model), historical data is used to predict future network behavior. The model predicts the current network traffic through the lag term and error term of historical traffic data, and compares the actual data with the predicted data in real time to detect deviation anomalies. The system first trains the model parameters based on historical data, builds a time series model, and then uses the model to predict future network traffic behavior. By using the error term Through monitoring, the system can flexibly judge the abnormal state of the network and perform corresponding processing according to different error situations. Through the time series model, the system can accurately predict the future network traffic situation based on historical behavior, so as to timely discover potential abnormal behaviors. Over time, the parameters of the model can be dynamically adjusted to adapt to changes in network traffic and improve the accuracy and flexibility of anomaly detection. The time series method is particularly suitable for application in complex network scenarios and can identify many different types of abnormal behaviors, including burst traffic, network congestion and gradual degradation. Compared with traditional threshold-based detection methods, the time series model can capture the time dependence of data, effectively reduce false alarms caused by short-term fluctuations, and provide more accurate abnormal link detection.

[0032] In addition to the ARMA model, the system can also use more complex models, such as the ARIMA model (autoregressive integrated moving average model) to process non-stationary time series network traffic data, or the SARIMA model (seasonal ARIMA) to capture periodic network traffic fluctuations. The system can be extended to a multivariate time series model to jointly analyze the relationship between multiple network characteristics (such as latency, bandwidth, and packet loss rate) to more comprehensively detect abnormal links in the network. In some more complex network scenarios, the system can also introduce deep learning models, such as time series prediction based on LSTM (long short-term memory network) or RNN (recurrent neural network), to further improve the prediction accuracy and the ability to cope with nonlinear data, for the error term. The system can use different error distribution models according to different network scenarios and adjust the upper and lower limits of the error. For example, the dynamically adjusted error tolerance mechanism enables the system to flexibly respond to anomaly detection needs in different time periods or traffic patterns. In order to improve the long-term stability of detection, the system can regularly retrain and update the time series model to ensure that the model parameters always match the latest network traffic characteristics, thereby maintaining efficient anomaly detection capabilities.

[0033] Step S3 includes analyzing the high concurrent network traffic data from each node, removing noise, filtering and formatting the raw data that has not been pre-processed, performing link status analysis based on the real-time formatted data, and setting conditions such as Then mark the node as a potential outlier, where Indicates the average traffic on the current link. It represents the standard deviation of the historical average flow plus the average flow fluctuation within the normal range.

[0034] In a possible implementation, step S3 implements the analysis of high concurrent network traffic and link status detection through the following steps. First, the system receives a large amount of high concurrent network traffic data from multiple nodes. Since the original data may contain some noise information, the system first removes the noise from these data. Common noise includes random network traffic fluctuations, incomplete data packets, duplicate data, etc. In order to ensure the accuracy of link status analysis, the system removes these invalid data through a series of filtering algorithms. After denoising, the system filters and formats the original data. The filtering step includes filtering out irrelevant or unimportant data streams based on features such as protocol type, source / destination IP address, port number, etc. Then, the retained data is formatted and link analysis is performed in a unified data format. The formatting process may involve steps such as data packet reorganization and standardization of feature fields to ensure the structural consistency of all data for subsequent analysis. After the data preprocessing is completed, the system performs link status analysis based on the formatted real-time data. The system calculates the real-time average traffic on each link and compares it with the benchmark of historical data. During the link status analysis process, the system sets a detection condition, that is, when the average traffic on the current link exceeds the historical average traffic plus the traffic fluctuation within the normal range, the node is marked as a potential anomaly. This detection formula ensures that the identification of abnormal links can be based on the statistical characteristics of historical data, reducing false alarms caused by short-term fluctuations or temporary peak traffic.

[0035] The working principle of this implementation method is to preprocess and format the high-concurrency network traffic data, and then use the statistical information (average and standard deviation) of historical traffic as a benchmark to perform link status analysis. When the real-time traffic data significantly exceeds the historical normal range, the system automatically marks the node or link as a potential abnormal point. The noise removal and data formatting steps ensure the accuracy of the data, and the statistical characteristics of the historical traffic provide a reliable benchmark for anomaly detection. During the preprocessing and analysis process, the system will also dynamically adjust the benchmark data so that it can be updated as the network conditions change. This process greatly improves the robustness and adaptability of the system when processing high-concurrency traffic data. By preprocessing and formatting high-concurrency traffic, the system can effectively process data in large-scale networks and ensure the real-time and accuracy of analysis. Through the noise removal and data filtering steps, the system reduces false alarms and ensures that the analysis results are more reliable. Especially in complex and unstable network environments, the average and standard deviation of historical traffic are used as the standard for anomaly detection, so that the system can automatically adjust the threshold according to different network conditions and reduce the false alarm rate. The system can detect and mark abnormal links in real time, and promptly discover abnormal points in the network, thereby improving the efficiency of network operation and maintenance.

[0036] In addition to standard denoising technology, the system can use a noise detection algorithm based on machine learning to automatically identify and eliminate abnormal data patterns that may cause false alarms. In addition to average traffic, it can also combine other features (such as packet loss rate, latency, bandwidth utilization, etc.) for comprehensive analysis to further improve the accuracy of anomaly detection. The system can dynamically adjust the calculation method of historical benchmarks based on changes in real-time traffic, such as updating historical averages and standard deviations on an hourly or daily basis to ensure that the benchmark always reflects the latest network behavior. Different alarm levels can be set for anomaly detection, and different response mechanisms (such as automatic repair, alarm notification, etc.) can be triggered according to the degree to which the anomaly exceeds the standard range, thereby achieving more fine-grained exception handling.

[0037] Step S3 includes: Use the moving average method to smooth the network traffic and remove noise, specifically: ; in, Indicates the current flow after smoothing, Indicates time, Indicates the size of the time window, Represents the index of a time point in the time series. Indicates time The original traffic data at Based on the 3σ rule, outliers are removed and outliers exceeding three times the standard deviation of the mean are filtered out in the flow data, that is: like ,but is an outlier, in, Indicates time The original traffic data at Represents the index of a time point in the time series. represents the mean of historical traffic, Indicates the standard deviation of historical traffic.

[0038] Apply moving average method to the raw network traffic data, using the past The traffic data within a time window calculates the smoothing value of the current time point. This moving average method can effectively remove the noise caused by short-term fluctuations, making the trend of traffic data smoother and convenient for subsequent analysis and detection. After smoothing, the system further applies the 3σ rule to filter abnormal traffic data. Specifically, the system first calculates the mean and standard deviation of historical traffic data, and then judges the original traffic data at each time point. If a data point deviates from the mean by more than three times the standard deviation, the data point is regarded as an outlier and filtered out. Through this method, the system can effectively detect extremely abnormal traffic fluctuations and prevent these outliers from interfering with link status analysis. Once the system detects that a data point is marked as an outlier, the system can choose to filter it out, or replace it with a smoothed value or other corrected value to ensure that the abnormal data will not affect subsequent analysis.

[0039] The moving average method uses Taking an average of the traffic data can effectively smooth the network traffic data and reduce the impact of short-term fluctuations and noise. The smoothed data is more stable, which is convenient for subsequent anomaly detection and link analysis. The introduction of the 3σ rule detects and filters outliers based on the degree of deviation from the mean and standard deviation through statistical analysis of historical traffic data, ensuring that the system can automatically identify and handle extreme abnormal behaviors. The moving average method provides a simple and effective denoising tool, and the 3σ rule uses the statistical deviation range to help the system filter out unreasonable abnormal data points. The combination of these two enables the system to maintain efficient monitoring and accurate analysis of traffic data in the face of complex network environments. The moving average method can effectively eliminate the noise caused by short-term fluctuations, making traffic data smoother and helping the system to better perform anomaly detection and link analysis. The 3σ rule is based on statistical principles and identifies outliers by detecting traffic fluctuations that exceed three times the standard deviation, thereby reducing false alarms and interference data in anomaly detection. By removing outliers and noise, the system can perform link status analysis based on more accurate traffic data, improving the accuracy of abnormal link detection. The system can automatically mark and process abnormal data, reducing the need for manual intervention and improving the level of automation in network operation and maintenance.

[0040] In addition to the moving average method, the system can also use exponential smoothing or weighted moving average to further improve the response speed of data smoothing processing or increase the weight of the latest data to adapt to different network application scenarios. The size of the time window can be dynamically adjusted according to the real-time changes in network traffic to ensure that the system can still effectively remove noise and accurately capture trend changes in a high-concurrency network environment. For data points marked as outliers, the system can adopt a variety of strategies for processing. In addition to direct filtering, interpolation or smoothing values ​​can be used to replace abnormal data to avoid excessive impact on subsequent analysis. The system can be combined with other network features (such as latency, packet loss rate, etc.) for joint analysis to further improve the accuracy of anomaly detection and the ability to respond to complex network conditions. In addition to the 3σ rule, the system can also be combined with other anomaly detection algorithms, such as machine learning-based anomaly detection models (such as isolation forests, DBSCAN, etc.) to handle more complex abnormal behaviors and traffic patterns.

[0041] Step S3 also includes: Use the sliding window method to average the traffic in the current time period, specifically: ; in, Indicates the current time point The average flow rate, Indicates the size of the time window, Indicates time, Represents the time index, Indicates the previous time point Traffic volume; If the conditions are met , the node is recorded and an alarm or automatic repair is performed.

[0042] The network traffic data in the current time period is averaged using the sliding window method. This method calculates the weighted average of the data at previous time points within a fixed time window. The sliding window method can smooth short-term traffic fluctuations, provide more stable traffic trend analysis, and reduce noise interference. After calculating the average traffic in the current time period each time, the system compares it with the mean and standard deviation of the historical traffic. If the current average traffic exceeds the historical mean plus three times the standard deviation, the node will be considered a potential abnormal node, and an alarm will be triggered or an automatic repair process will be started. This condition is based on the 3σ rule, which ensures that the system only triggers anomaly detection when the traffic is significantly beyond the normal fluctuation range to avoid false alarms due to normal fluctuations. When the system records that the traffic of a node exceeds the set threshold, the system will generate an alarm notification to remind network operation and maintenance personnel to pay attention to potential problems. In addition, the system can also automatically perform repair operations, such as rerouting, adjusting bandwidth configuration, or starting load balancing strategies to prevent abnormal traffic from affecting the overall stability of the network. After the repair is completed, the system will re-monitor the traffic status of the node to confirm whether it has returned to normal.

[0043] The sliding window method can effectively smooth short-term fluctuations and capture the overall trend of traffic by averaging traffic data within a fixed time window. This method ensures that the system can monitor the dynamic changes of traffic in real time. Combined with the historical mean and standard deviation, the system identifies potential abnormal nodes and issues alarms or performs automatic repair operations in a timely manner when the traffic significantly exceeds the normal fluctuation range. By setting a reasonable time window, the sliding window method provides the ability to balance short-term fluctuations and long-term trend analysis, and the anomaly detection based on the 3σ rule further ensures that the system triggers anomaly detection only when necessary, thereby improving the robustness and responsiveness of the system. The sliding window method can calculate the average traffic of the current time period in real time, effectively capture the trend changes of network traffic, and reduce the interference of short-term fluctuations on system analysis. Through 3σ anomaly detection based on historical mean and standard deviation, the system can quickly and accurately detect abnormal traffic, avoid false alarms and ensure accurate alarms. The system can automatically trigger repair operations after detecting anomalies, reduce manual intervention, improve the automation level of network operation and maintenance, and restore the normal state of the network in a timely manner. The sliding window size and detection threshold can be flexibly adjusted according to the actual needs of the network to adapt to network environments of different scales and complexities.

[0044] The system can automatically adjust the sliding window size according to the dynamic changes of network traffic to cope with the characteristics of traffic fluctuations in different time periods. Larger windows are suitable for stable network environments, while smaller windows are suitable for processing rapidly changing traffic patterns. In addition to the 3σ rule, the system can introduce a multi-level anomaly detection mechanism, such as triggering a mild warning at the 2σ level and a serious alarm at the 3σ level, to further improve the system's response flexibility. In addition to the sliding window method, the system can also combine other statistical methods or machine learning models (such as ARIMA models, LSTM neural networks) for traffic prediction and anomaly detection, thereby improving the detection accuracy in complex network environments. When an anomaly is detected, the system can select different repair strategies according to the specific situation, such as adjusting bandwidth, triggering load balancing, changing routing, or directly isolating the network to ensure that the problem node does not affect the overall network. Other network characteristics (such as latency, packet loss rate, etc.) can be considered at the same time, and multi-dimensional traffic data can be combined with the sliding window method for analysis to improve the comprehensiveness of anomaly detection.

[0045] Step S4 includes, before generating the repair instruction, first classifying the abnormal type according to the detected abnormal link behavior, and after classifying the abnormal type, optimizing the repair strategy using a reinforcement learning algorithm, the reinforcement learning algorithm is specifically: ; in, represents the action-value function, Indicates the current network status. Indicates time, Indicates the currently selected repair strategy. represents the learning rate, Represents the reward value, represents the discount factor, Indicates execution of an action The next state to enter is Indicates the next state All possible actions in Generate specific repair instructions based on the selected repair strategy. After the repair instructions are generated, the repair operation is automatically executed through the management interface of the network device. After the repair instructions are executed, verify whether the repair operation is effective by monitoring the real-time status of the link.

[0046] In one possible implementation, step S4 classifies the detected abnormal link behavior and uses a reinforcement learning algorithm to optimize the repair strategy, ensuring that the system generates appropriate repair instructions according to different abnormal situations and automatically executes these instructions. When the system detects an abnormal link, it first classifies the abnormal type. The system can distinguish the abnormal type based on the behavioral characteristics of the abnormal link (such as a sudden increase in traffic, abnormal packet loss rate, or excessive delay). For example, a sudden increase in traffic may indicate network congestion, while a high packet loss rate may be related to hardware failure. Through precise classification, the system can select appropriate repair strategies for different types of abnormalities, update the value of the repair strategy based on the feedback (reward value) of historical operations and the new state, and gradually optimize the repair effect through multiple operations. The goal of reinforcement learning is to find the optimal repair strategy so that the network state after each repair is optimally improved. After optimizing the best repair strategy, the system generates corresponding repair instructions. The instruction is automatically generated based on the selected repair strategy. For example, if the problem is link congestion, the instruction may be to adjust the bandwidth or redistribute traffic. If a hardware failure is detected, the instruction may be to restart the device or switch to a backup device. After the repair instruction is generated, the system automatically executes these repair operations through the management interface of the network device (such as SNMP, Netconf or API interface) to ensure that the anomaly is handled in a timely manner. After the repair instruction is executed, the system continues to monitor the real-time status of the link to verify the effectiveness of the repair operation. If the repair is successful, the network performance will return to the normal range. The system will record the success rate of this repair operation and continue to optimize the reinforcement learning model. If the repair fails to effectively solve the problem, the system can choose to try other repair strategies until the problem is resolved.

[0047] The core of this implementation is to continuously optimize the repair strategy through reinforcement learning algorithms. The system first accurately identifies the type of problem by classifying abnormal network behavior, and then updates the action value function based on the real-time monitoring status feedback after each repair operation. . The system gradually finds the best repair solution through repeated attempts and optimization. Ultimately, the system can generate specific repair instructions based on the selected strategy and perform repair operations in an automated manner. The reinforcement learning algorithm enables the system to have the ability to adapt and self-optimize. It can dynamically adjust the repair plan according to different network environments and historical repair experience, and improve the efficiency and intelligence level of network operation and maintenance. Through the reinforcement learning algorithm, the system can continuously optimize the strategy after each repair operation, improve the repair effect, and reduce the occurrence of repeated failures. The repair instructions are automatically generated by the system and automatically executed through the management interface, reducing manual intervention and improving the efficiency and response speed of network maintenance. After executing the repair operation, the system can monitor the network status in real time, verify the repair effect in time, and ensure that the problem is completely resolved. By classifying abnormal behaviors, the system can select the most appropriate repair strategy according to different types of abnormalities and improve the accuracy of repair.

[0048] In addition to Q-learning, the system can use other reinforcement learning algorithms (such as deep Q network (DQN), SARSA, etc.) to adapt to more complex network environments and multi-dimensional anomaly detection. The system can formulate a multi-dimensional reward mechanism based on different network performance indicators (such as traffic, latency, packet loss rate, etc.) to optimize a more comprehensive network repair strategy. The system can dynamically adjust the learning rate according to the convergence of the current repair strategy to adapt to changes in the network environment more quickly. The system can combine multiple repair strategies in complex abnormal situations (such as adjusting bandwidth and rerouting at the same time) and continuously optimize the combination effect through reinforcement learning algorithms. After the repair operation, the system can introduce more stringent verification mechanisms, such as multi-node monitoring, stress testing, etc., to ensure that the network status after repair is stable and reliable.

[0049] Repair strategies include: When a link is overloaded or interrupted, traffic is rerouted to other backup links; Protect high-priority traffic and limit bandwidth usage for low-priority traffic; Restart or automatically reconfigure devices that have detected a failure; Distribute traffic across multiple links.

[0050] In a possible implementation, the repair strategy includes the following four different operation modes. Depending on the type of network anomaly, the system automatically selects and executes the corresponding repair operation. Traffic rerouting when a link is overloaded or interrupted. When the system detects that a link is overloaded or completely interrupted, the system will automatically reroute the traffic on the link to other available backup links. The rerouting operation depends on the topology of the network. The system will select the optimal alternative path based on the real-time network load to avoid data loss caused by traffic congestion or network interruption. The implementation steps are: monitoring the link status, detecting overload or interruption, finding available backup links in the network topology, dynamically migrating traffic to backup links, ensuring business continuity, and real-time monitoring of the new routing status to ensure that traffic is successfully transferred and no new bottlenecks are generated; protection of high-priority traffic and restriction of low-priority traffic. Under certain network conditions, in order to ensure the smooth operation of critical services, the system will give priority to protecting the transmission of high-priority traffic. For example, when network bandwidth resources are tight or links are congested, the system will limit the bandwidth usage of low-priority traffic to ensure that high-priority traffic (such as voice, video or important data transmission) is not affected. The implementation steps are to identify high-priority and low-priority traffic in the network, set bandwidth limitation policies, limit the speed of low-priority traffic, monitor the real-time transmission status of traffic, ensure that high-priority traffic is not interfered with, dynamically adjust bandwidth restrictions, and allocate more resources to critical business flows based on actual network conditions; restart or automatically reconfigure faulty equipment. If the system detects that a device (such as a switch, router or server) has a fault (such as hardware failure, configuration error or abnormal response), the system will perform a device restart or automatic reconfiguration operation. Device restart can quickly restore its normal operation, while automatic reconfiguration can reload the device settings through preset configuration templates or policies to avoid persistent problems caused by configuration loss or errors. The implementation steps are to detect abnormal device status, such as device response timeout or severe performance degradation, and automatically trigger the device restart operation. If the restart cannot solve the problem, automatic reconfiguration is performed, and the preset configuration template is applied to monitor the results of device restart and configuration to confirm that the device has resumed normal working status. Traffic distribution between multiple links. In high-traffic or special application scenarios, the system can distribute traffic between multiple links to disperse the load and improve the overall efficiency of the network. This load balancing strategy can ensure that the utilization of each link remains within a reasonable range and prevent individual links from being overloaded. The load balancing operation can be dynamically adjusted based on the priority of the traffic, the application type, or the real-time status of the link. The implementation steps are to monitor the load of each link, determine whether traffic distribution is needed, and distribute the traffic to multiple links according to factors such as the link bandwidth and delay. Monitor the traffic distribution status of each link in real time, dynamically adjust the distribution ratio, ensure link load balancing, avoid overload or bandwidth waste, and ensure efficient use of link resources.

[0051] The working principle of this implementation is based on the execution and optimization of automated repair strategies. By monitoring the network status, the system can select appropriate repair strategies according to the specific abnormality type and severity when an abnormality occurs in the link. For example, in response to link overload or equipment failure, the system can automatically reroute traffic to a backup link or perform a device restart operation to ensure network stability and business continuity. At the same time, the system can also intelligently allocate bandwidth resources, protect the transmission of high-priority traffic, and prevent low-priority traffic from occupying too much bandwidth. Through load balancing and automated device management, the system can achieve rapid response, reduce the impact of network failures, and optimize the utilization efficiency of network resources. When a link is overloaded or interrupted, the system can quickly reroute traffic to other backup links to ensure that network services are not interrupted. Through intelligent traffic management, the system can effectively ensure the transmission of high-priority traffic and improve the stability of important services. In response to equipment failure, the system automatically performs restart or reconfiguration operations to reduce manual intervention and fault repair time. By allocating traffic among multiple links, the system can effectively avoid link overload and ensure efficient use of network resources, thereby improving overall network performance.

[0052] Traffic priority can be adjusted dynamically according to network conditions. For example, when some low-priority traffic becomes urgent, its priority can be temporarily adjusted to ensure the normal operation of special applications. In addition to simple high- and low-priority traffic restrictions, the system can introduce multi-level traffic management strategies, set different bandwidth usage levels, and further refine traffic management. AI prediction models can be introduced to detect potential equipment failures in advance and perform preventive maintenance before failures occur, such as restarting or adjusting device configurations in advance. In addition to allocating traffic based on link status, the system can introduce intelligent load balancing strategies based on application type, business needs, or user behavior to optimize network performance and user experience.

[0053] According to the selected repair strategy, specific repair instructions are generated, and these instructions are directly sent to the relevant devices through API, command line interface or network device management protocol. In one possible implementation, the system automatically generates repair instructions according to the selected repair strategy and sends them directly to the network device for execution through different interfaces and protocols. The following is the specific operation process, the generation of repair instructions, after abnormal link detection and repair strategy selection, the system automatically generates appropriate repair instructions according to the type of strategy and the specific needs of the network device. These instructions may be in the form of, but not limited to, API calls, command line interface (CLI) commands, or control instructions based on network management protocols (such as SNMP, Netconf). For example, traffic rerouting: generating route redistribution instructions, specifying new paths, and transferring traffic from overloaded or interrupted links to backup links. Device restart: generating device restart instructions and issuing restart commands to faulty devices. Bandwidth adjustment: generating bandwidth management instructions, limiting bandwidth usage for low-priority traffic, and allocating more resources for high-priority traffic. Interface selection for instruction issuance: the system supports a variety of device management interfaces, and can automatically select the most suitable interface to issue repair instructions based on device type and management protocol. API calls: the system sends the generated repair instructions directly to the relevant devices through the RESTful API or gRPC interface supported by the device. The use of APIs is generally applicable to modern network devices, enabling efficient remote control and automated operations. Command line interface (CLI): for traditional network devices, the system can log in to the command line interface of the device through secure channels such as SSH and execute preset repair commands. For example, the system can use CLI commands to reconfigure routing, adjust interface parameters, or restart devices. Network device management protocols: the system also supports instruction issuance based on standard protocols such as SNMP, Netconf, and RESTCONF. Through these protocols, the system can interact with devices in a structured manner to make configuration changes, status monitoring, and perform operations. For example, the Netconf protocol can be used to modify device configurations in batches, while SNMP can be used for device status monitoring and specific operations (such as restarting); device execution after the command is issued. After the command is issued to the relevant device, the system will confirm the execution result of the command through the API or protocol interface. If the device successfully receives and executes the command, the system will monitor the real-time status of the device to confirm whether the repair operation has achieved the expected effect. For example, if it is a rerouting command, the system will monitor the link status to check whether the traffic is successfully transferred. If it is a device restart command, the system will monitor the online status of the device to confirm whether the device has successfully resumed normal operation; device status feedback and repair verification. After the device executes the repair command, the system continues to monitor the status of the device through the API or management protocol to verify the effectiveness of the repair. If the device status returns to normal and the network performance improves, the system will record the success of the repair operation and optimize the corresponding repair strategy.If the problem is not resolved or the device fails to respond correctly, the system can choose to try other repair solutions or issue an alarm to prompt human intervention.

[0054] The working principle of this implementation is based on automatic instruction generation and issuance. The system first automatically generates repair instructions suitable for the current network device based on the repair strategy, and issues the instructions to the relevant devices through standard protocols such as API, CLI or SNMP, Netconf, etc. After the device executes the instruction, the system monitors its status in real time to ensure that the problem is solved. The entire process realizes a fully automated closed-loop operation from strategy selection to instruction execution to effect verification. Through API, CLI or management protocol, the system can directly control network devices, automatically generate and issue repair instructions, reduce manual operations, improve repair efficiency, support multiple device management interfaces (API, CLI, SNMP, Netconf, etc.), ensure that the system is compatible with different types of network devices, and flexibly respond to various equipment environments. After the instruction is executed, the system can monitor the operating status of the device in real time, and promptly verify the effectiveness of the repair operation to ensure that the problem is completely solved. Automated instruction generation and execution reduces the possibility of human error and improves the accuracy and reliability of the repair process.

[0055] The system can expand more management protocols or interfaces, such as supporting the OpenFlow protocol or other SDN controllers to enhance the automated control capabilities of software-defined network devices. Instruction generation can be combined with more intelligent elements, such as analyzing historical repair data through machine learning models to automatically recommend the best repair solutions and instructions. The system can automatically select the best interface to issue instructions based on different devices and scenarios. For example, when the device supports API, it will give priority to API calls, and automatically switch to CLI or other protocols if it does not support it. Complex network failures may require multiple steps of repair operations. The system can generate multiple instructions and execute them in sequence, such as restarting the device first, adjusting the configuration, and finally rerouting the traffic. Before issuing instructions, the system can automatically detect redundant resources in the current network (such as backup links or backup devices) to ensure that the normal operation of the network will not be affected when executing operations.

[0056] After the repair instruction is generated, the repair operation is automatically executed through the management interface of the network device. The execution method includes: directly controlling the device through the API interface or CLI command; adjusting the route through the control plane protocol, automatically modifying the routing protocol configuration, and changing the traffic path; dynamically updating the traffic policy or configuration file on the device, and restarting the service to make it take effect.

[0057] In a possible implementation, after the repair instruction is generated, the system sends the instruction to the network device through different execution methods and automatically executes the repair operation. The specific execution methods include directly controlling the device through the API interface or CLI command. API interface control: modern network devices usually support RESTful API or gRPC interface, and the system can communicate with the device directly through API calls. After the repair instruction is generated, the system will send control instructions through the preset API interface to complete the management operation of the device. For example, operations such as reconfiguring routing, adjusting bandwidth, or restarting the device can be directly executed through the API interface; CLI command control: for devices that do not support API, the system can log in to the command line interface (CLI) of the device through a secure channel such as SSH. The repair instruction will be converted into the corresponding CLI command, and the system will execute the operation through remote commands. For example, the routing table can be manually adjusted, the interface configuration can be modified, or a restart command can be executed through the CLI; the implementation steps are: generate a repair instruction (such as rerouting, restarting the device, etc.), select an applicable interface (API or CLI), enter the CLI through API calls or SSH, execute the corresponding repair operation, monitor the device status in real time, and ensure that the instruction is executed correctly.

[0058] Adjust routing through control plane protocols, automatically modify routing protocol configuration, and change traffic paths. The system can automatically adjust routing configuration through control plane protocols (such as OSPF, BGP, etc.). When a link is overloaded or interrupted, the system will automatically modify the routing protocol configuration and change the transmission path of traffic. For example, if a link is congested, the system can transfer traffic from the affected path to an alternative path by modifying the BGP or OSPF routing policy. The system dynamically adjusts the network traffic path by modifying the priority, weight, or metric of the routing protocol (such as the AS Path attribute in BGP or the link cost in OSPF). The implementation steps are: generate routing adjustment instructions based on the link status, modify the routing configuration through control plane protocols (such as BGP, OSPF, etc.), change the traffic path, verify whether the update of the routing table is effective, monitor whether the traffic is successfully transferred, and continue to monitor the network status to ensure the stability of the link after the routing adjustment. Dynamically update the traffic policy or configuration file on the device and restart the service to make it effective. The system can dynamically modify the traffic policy or configuration file on the device. For example, when you need to limit the bandwidth of low-priority traffic or adjust the security policy of the device, the system can directly modify the configuration file on the device, or adjust the traffic management policy through the API / CLI. In some cases, after modifying the configuration file or policy, you need to restart the relevant services for the changes to take effect. The system will automatically perform service restart operations to ensure that the new configuration is applied to the device. The implementation steps are: modify the configuration file or traffic policy on the device (such as speed limit policy, security protection rules, etc.), perform restart operations on related services (such as network services, routing processes, etc.), verify whether the new policy or configuration is applied correctly, monitor the device operation status, and ensure the normal operation of the device and services through continuous monitoring, and the repair operation is successful and effective.

[0059] The working principle of this implementation method is based on the automated operation of multiple device management methods. After the system generates a repair instruction, it directly controls the device through the API or CLI interface to perform configuration modification, restart and other operations; when the traffic path needs to be adjusted, the system automatically modifies the routing configuration through the control plane protocol; when it comes to dynamic updates of traffic policies or configuration files, the system can modify the policy configuration on the device and restart related services to ensure that the new policy takes effect. Through these automated operations, the system can efficiently and in real time execute repair instructions to ensure network stability and business continuity. The system supports direct control of devices through API interfaces or CLI commands to ensure flexible management of devices of different types and versions, improve the coverage of automated operations, and automatically modify routing configurations through control plane protocols. The system can quickly adjust traffic paths when links are overloaded or interrupted, ensure effective distribution of network traffic, and reduce network interruption time. The system can dynamically adjust traffic management policies or configuration files on the device and apply changes by automatically restarting services to ensure flexibility and real-time device configuration. After the configuration is updated, the system can automatically restart related services to ensure that the new policy takes effect, reduce the workload of manual operations and improve device management efficiency.

[0060] The system can automatically select the most suitable API interface according to the type and status of the device to ensure the highest execution efficiency. For example, for devices that support RESTful API, API is preferred, while for older devices, CLI command execution is selected. The system can combine AI algorithms to optimize the routing configuration strategy in the control plane protocol according to the real-time status and historical data of the network, further improving the intelligence level of network traffic distribution. The system can introduce version management of device configuration files, and can quickly roll back to the previous version when dynamically updating the configuration to prevent configuration errors or failures. In complex scenarios, the system can perform repair operations in stages, such as first adjusting the route through the control plane protocol, then updating the traffic policy, and finally verifying the overall network status through the API to ensure the coordination of multi-step operations. In addition to traffic policy updates, the system can automatically modify security protection policies (such as firewall rules, DDoS protection policies, etc.) and restart security services in real time to ensure network security and business continuity.

[0061] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A calculation method of an automated processing tool based on abnormal link identification, characterized in that: The method comprises: S1, receiving network traffic data; S2, analyzing data to determine the baseline model; S3, detecting abnormal links in the network based on the benchmark mode; S4, generating and executing corresponding repair instructions to handle abnormal links; Wherein, step S3 includes analyzing the high concurrent network traffic data from each node, removing noise, filtering and formatting the raw data that has not been pre-processed, performing link status analysis based on the real-time formatted data, setting conditions if Then mark the node as a potential outlier, where Indicates the average traffic on the current link. It represents the standard deviation of the historical average flow plus the average of the flow fluctuation within the normal range; The step S4 includes, before generating the repair instruction, first classifying the abnormal type according to the detected abnormal link behavior, and after classifying the abnormal type, optimizing the repair strategy using a reinforcement learning algorithm, the reinforcement learning algorithm is specifically: ； in, represents the action-value function, Indicates the current network status. Indicates time, Indicates the currently selected repair strategy. represents the learning rate, Represents the reward value, represents the discount factor, Indicates execution of an action The next state to enter is Indicates the next state All possible actions in Generate specific repair instructions based on the selected repair strategy. After the repair instructions are generated, the repair operation is automatically executed through the management interface of the network device. After the repair instructions are executed, verify whether the repair operation is effective by monitoring the real-time status of the link.

2. The calculation method of the automated processing tool based on abnormal link identification according to claim 1, characterized in that: The step S1 comprises: Network traffic data is collected from different nodes or links in the network, and the data is obtained in real time through distributed collection tools.

3. The calculation method of the automated processing tool based on abnormal link identification according to claim 1, characterized in that: The step S2 comprises: The baseline model is constructed by determining the normal range of key parameters through the historical behavior of statistical data. The description of the network baseline behavior includes calculating the expected value and standard deviation of each feature, specifically: ； in, Represents a specific network feature, Indicates The value of sample data, Indicates the index number of the sample, express The expected value of express The standard deviation of Indicates the number of sample data.

4. The calculation method of the automated processing tool based on abnormal link identification according to claim 3 is characterized in that: The step S2 further comprises: Use the time series model to predict normal network behavior and use it as a benchmark to detect anomalies. The specific formula is: ； in, Indicates at time Network traffic data, Indicates time, represents the data point at the previous time. represents the autoregressive coefficient, represents the moving average coefficient, Indicates the current time The error term, represents the error term at previous time, represents the lag coefficient of the autoregressive part, Represents the lag coefficient of the moving average part.

5. The calculation method of the automated processing tool based on abnormal link identification according to claim 4 is characterized in that: The step S3 comprises: Use the moving average method to smooth the network traffic and remove noise, specifically: ； in, Indicates the current flow after smoothing, Indicates time, Indicates the size of the time window, Represents the index of a time point in the time series. Indicates time The original traffic data at Based on the 3σ rule, outliers are removed and outliers exceeding three times the standard deviation of the mean are filtered out in the flow data, that is: like ,but is an outlier, in, Indicates time The original traffic data at Represents the index of a time point in the time series. represents the mean of historical traffic, Indicates the standard deviation of historical traffic.

6. The calculation method of the automated processing tool based on abnormal link identification according to claim 5 is characterized in that: The step S3 further comprises: Use the sliding window method to average the traffic in the current time period, specifically: ； in, Indicates the current time point The average flow rate, Indicates the size of the time window, Indicates time, Represents the time index, Indicates the previous time point Traffic volume; If the conditions are met , the node is recorded and an alarm or automatic repair is performed.

7. The calculation method of the automated processing tool based on abnormal link identification according to claim 1 is characterized in that: The repair strategy includes: When a link is overloaded or interrupted, traffic is rerouted to other backup links; Protect high-priority traffic and limit bandwidth usage for low-priority traffic; Restart or automatically reconfigure devices that have detected a failure; Distribute traffic across multiple links.

8. The calculation method of the automated processing tool based on abnormal link identification according to claim 7 is characterized in that: According to the selected repair strategy, specific repair instructions are generated, and these instructions are directly sent to relevant devices through API, command line interface or network device management protocol.

9. The calculation method of the automated processing tool based on abnormal link identification according to claim 1, characterized in that: After the repair instruction is generated, the repair operation is automatically executed through the management interface of the network device, and the execution method includes: Directly control the device through API interface or CLI commands; Adjust routing through control plane protocols, automatically modify routing protocol configurations, and change traffic paths; Dynamically update the traffic policy or configuration file on the device and restart the service to make it take effect.

Images