Network flow real-time monitoring method and system based on artificial intelligence

Abstract

The invention discloses a network flow real-time monitoring method and system based on artificial intelligence. The method comprises the steps of network node setting, node scheduling optimization, network flow data analysis, monitoring result visualization and early warning feedback. The invention belongs to the technical field of network flow management, and particularly relates to a network flow real-time monitoring method and system based on artificial intelligence, and the method comprises the steps: setting a network flow data monitoring node, calculating the completion time of a monitoring task, resources exceeding a preset available value, and the loss generated by abandoning the monitoring task, taking the performance indexes as input of a particle swarm optimization algorithm, introducing a compression factor, and updating a random inertia weight; network traffic data analysis is adopted, original signal composition is analyzed, variational mode decomposition parameters are optimized, envelope entropy and a kurtosis expression are calculated, an optimized variational mode decomposition function is utilized to decompose original signals, features are extracted through a wavelet network traffic analysis module, and a final traffic prediction result is obtained through fusion.

Description

Technical Field

[0001] The present invention belongs to the technical field of network traffic management, and in particular is a method and system for real-time monitoring of network traffic based on artificial intelligence. Background Art

[0002] The real-time network traffic monitoring method is a means of using special monitoring tools to track and analyze the flow of data traffic in the network in real time. It aims to promptly detect network anomalies and congestion, and plays an important role in network optimization, troubleshooting and security protection.

[0003] However, existing real-time monitoring methods for network traffic have technical problems such as changes in network traffic leading to changes in computing requirements and resource consumption. When the resources are exceeded, this leads to increased data transmission delays, network congestion, and increased equipment burden. There are also technical problems such as network traffic data is very large and continuously generated, containing multiple types of traffic, which increases the difficulty of analysis and makes it difficult to capture dynamic patterns. The data is highly volatile and random, and is affected by sudden peaks, making it difficult to predict future trends in network traffic data. Summary of the invention

[0004] In view of the above situation, in order to overcome the defects of the prior art, the present invention provides a real-time monitoring method and system for network traffic based on artificial intelligence. In view of the technical problem that changes in network traffic lead to changes in computing requirements and resource consumption, and when resources are exceeded, data transmission delays increase, network congestion, and equipment burden increase, a network traffic data monitoring node is set to calculate the completion time of the monitoring task, the resources exceeding the preset available value, and the loss caused by abandoning the monitoring task. These performance indicators are used as inputs of the particle swarm optimization algorithm, a compression factor is introduced, the random inertia weight is updated, and the optimal node allocation scheme is searched to ensure the monitoring effect of the network traffic data; in view of the technical problem that the network traffic data is very large and continuously generated, including multiple types of traffic, the analysis difficulty increases, it is difficult to capture dynamic laws, the data volatility and randomness are large, and there is the influence of sudden peaks, which makes it difficult to predict the future prediction trend of network traffic data, network traffic data analysis is adopted, specifically analyzing the original signal composition, optimizing the variational mode decomposition parameters, calculating the envelope entropy and kurtosis expressions to evaluate the signal processing effect, using the optimized variational mode decomposition function to decompose the original signal, extracting features through the wavelet network traffic analysis module and fusion to obtain the final traffic prediction result.

[0005] The technical solution adopted by the present invention is as follows: The present invention provides a method for real-time monitoring of network traffic based on artificial intelligence, the method comprising the following steps:

[0006] Step S1: Network node setting, specifically considering the network architecture and requirements, and clarifying the location and number of nodes;

[0007] Step S2: Node scheduling optimization, specifically calculating the completion time of the monitoring task, the resources exceeding the preset available value, and the loss caused by abandoning the monitoring task, using these performance indicators as the input of the particle swarm optimization algorithm, introducing the compression factor, updating the random inertia weight, searching for the optimal node allocation scheme, and ensuring the monitoring effect of the network traffic data;

[0008] Step S3: Network traffic data analysis, specifically analyzing the original signal composition, optimizing the variational mode decomposition parameters, calculating the envelope entropy and kurtosis expressions to evaluate the signal processing effect, using the optimized variational mode decomposition function to decompose the original signal, extracting features through the wavelet network traffic analysis module and fusing them to obtain the final traffic prediction result;

[0009] Step S4: Visualizing the monitoring results, specifically real-time monitoring data, showing them in graphs and annotating future prediction results;

[0010] Step S5: Early warning feedback, specifically, issuing an early warning signal when abnormal traffic is detected, and technical personnel take timely response measures.

[0011] Furthermore, in step S1, the network node setting includes the following steps:

[0012] Step S11: Perform network node settings, comprehensively consider network architecture and requirements, and clarify the location and number of nodes;

[0013] Step S12: Select a collection tool and determine the network range and interface to be collected;

[0014] The collection tools include network traffic monitors and network packet capture tools;

[0015] Step S13: Set acquisition parameters and start the acquisition program.

[0016] Furthermore, in step S2, the node scheduling optimization includes the following steps:

[0017] Step S21: Calculate the completion time of the monitoring task to reflect the overall time efficiency in the process of processing network traffic data. The formula used is as follows:

[0018] ;

[0019] Where T represents the sum of the completion time of all monitoring tasks for processing network traffic data, N represents the total number of node monitoring tasks, and d represents the index of the node monitoring task. Indicates the actual completion time of the dth node monitoring task, Represents a dynamic adjustment factor, which is used to reflect the weight of the impact of different tasks on the overall time efficiency;

[0020] Step S22: Calculate the excess resources. By clarifying the excess resources, evaluate the system performance, find the computing bottleneck problem in time, and grasp the resource consumption. The formula used is as follows:

[0021] ;

[0022] ;

[0023] Where EC represents the computing resources that exceed the preset available value, ED represents the memory resources that exceed the preset available value, h represents the time period index, H represents the total number of time periods, and EC h represents the total preset computing resources in the hth time period, ED h represents the total preset memory resources in the hth time period, represents the preset availability factor of computing resources, Indicates the preset available factor of memory resources, A indicates the number of resources, a indicates the resource index, It represents the quantitative representation of the computing power that the ath resource needs to occupy during execution, and q represents the total amount of memory resources;

[0024] Step S23: Calculate the loss caused by abandoning the monitoring task. When the system resources are insufficient and cannot carry all monitoring tasks at the same time, it is necessary to make a choice to minimize the total loss caused by abandoning the monitoring task, so as to reduce the risk of data loss and network traffic data monitoring interruption due to abandoning the monitoring task. The formula used is as follows:

[0025] ;

[0026] ;

[0027] In the formula, EA represents the total loss caused by abandoning the monitoring task, Indicates the weight coefficient of the dth node monitoring task abandonment, represents the specific loss value caused by the abandonment of the monitoring task of the dth node, f() represents the nonlinear weight adjustment function, R represents the multi-dimensional resource tension index, g represents the function that comprehensively considers the sub-indicators, q1 represents the CPU usage rate, q2 represents the memory usage rate, and q3 represents the network bandwidth utilization rate;

[0028] Step S24: node scheduling, using the performance indicators in the node scheduling as the input value of the fitness function of the particle swarm optimization algorithm, the performance indicators include the completion time of the monitoring task, the amount of resources exceeded, and the loss caused by abandoning the monitoring task. In the particle swarm optimization algorithm, the optimal node allocation scheme is searched by continuously iteratively updating the speed and position of the particles. After each position update, the corresponding performance indicator value is calculated according to the new node allocation scheme, and the optimal solution of the individual particle and the optimal solution of the particle group are updated. The compression factor is introduced to update the random inertia weight, including the following steps:

[0029] Step S241: define particle attributes, which include speed and position. In each iteration, the particle updates the particle speed and position by tracking two extreme values. The first extreme value is the optimal solution found by the particle itself, i.e., the optimal solution of the particle individual. The second extreme value is the current optimal solution of the entire particle group, i.e., the optimal solution of the particle group. The particle position and speed are updated using the following formula:

[0030] ;

[0031] ;

[0032] In the formula, represents the particle velocity at time t+1, represents the particle velocity at time t, w represents the non-negative inertia weight, which is used to describe the degree of inheritance of the particle velocity at the previous moment, and the range is (0, 1). The higher the value of the non-negative inertia weight, the stronger the global search capability. represents the optimal solution of the individual particle at time t, represents the optimal solution of the particle group at time t, c1 represents the weight of the particle learning from the individual optimal solution, c2 represents the weight of the particle learning from the group optimal solution, r1 and r2 represent random numbers, evenly distributed between [0, 1], to increase the randomness of the search. represents the particle position at time t, represents the particle position at time t+1;

[0033] Step S242: After each particle position update, recalculate the fitness value of each particle, and calculate the updated optimal solution of the individual particle and the optimal solution of the particle group by comparing with the value corresponding to the previous iteration. The formula used is as follows:

[0034] ;

[0035] ;

[0036] In the formula, represents the optimal solution of the individual particle at time t+1, represents the optimal solution of the particle swarm at time t+1, and F represents the fitness function, which combines the performance indicators as the specific calculation content of the fitness function, thereby integrating the performance indicators into the iteration and optimization process of the particle swarm optimization algorithm, and changing according to the specific performance of the node allocation scheme corresponding to the current particle position;

[0037] Step S243: In order to effectively control the overall flight speed of the particles, a compression factor is introduced to achieve a balance between global search and local search, and the optimized particle speed is calculated. The formula used is as follows:

[0038] ;

[0039] ;

[0040] ;

[0041] In the formula, represents the optimized particle velocity, k represents the compression factor;

[0042] Step S244: Update the random inertia weight. The random inertia weight is obtained by random distribution to avoid the loss of local search capability in the early stage of iteration and the loss of global search capability in the late stage of iteration, and improve the global search capability. The formula used is as follows:

[0043] ;

[0044] In the formula, represents the updated random inertia weight, represents the minimum value of the random inertia weight, represents the maximum value of the random inertia weight, rand(1) is a random number uniformly distributed in [0, 1], σ is the standard deviation, usually between 0.2 and 0.5, and randn(1) represents a random number with a normal distribution.

[0045] Furthermore, in step S3, the network traffic data analysis includes the following steps:

[0046] Step S31: data preparation, preliminarily preprocessing the network traffic data collected by the network monitoring node as the original signal;

[0047] Step S32: Analyze the original signal composition to understand the characteristics and patterns of network traffic. The formula used is as follows:

[0048] ;

[0049] In the formula, represents the original signal, which consists of vibration modes and residual terms, represents the wavelet coefficient, a1 represents the scale factor, b represents the translation factor, represents the kth vibration mode, which represents a specific frequency component in the original signal, represents the residual term, k represents the index of the vibration mode, and K represents the total number of vibration modes;

[0050] Step S33: Optimizing variational mode decomposition parameters, including the following:

[0051] Step S331: clarify that the mode number and penalty factor are key parameters of variational mode decomposition, which directly affect the accuracy of the results;

[0052] The appropriate number of modes can ensure that the frequency information is fully covered and avoid overfitting. The penalty factor is used to adjust the similarity between adjacent modes. If the penalty factor is too large, the decomposition process will be too smooth, and if the penalty factor is too small, it will lead to overfitting.

[0053] Step S332: Optimize the variational mode decomposition parameters, evaluate the signal processing effect of the variational mode decomposition function according to the envelope entropy and kurtosis, and adjust the mode number and penalty factor if the signal processing effect is not ideal, including the following steps:

[0054] Step S3321: Calculate the expression of envelope entropy, the formula used is as follows:

[0055] ;

[0056] In the formula, represents the envelope entropy of the i-th intrinsic mode function, i represents the index of the intrinsic mode function, N represents the total number of intrinsic mode functions, represents the probability value in the i-th intrinsic mode function at position j;

[0057] Step S3322: Calculate the expression of kurtosis, the formula used is as follows:

[0058] ;

[0059] In the formula, represents the calculated kurtosis value, represents the value of the i-th intrinsic mode function at position j, represents the mean of the i-th intrinsic mode function, represents the standard deviation of the i-th intrinsic mode function;

[0060] Step S3323: Evaluate the effect of variational mode decomposition on signal processing, and improve the variational mode decomposition parameters according to the evaluation results. The formula used is as follows:

[0061] ;

[0062] In the formula, C represents the signal processing effect evaluation value;

[0063] Step S34: Perform traffic prediction. Use the optimized variational mode decomposition function to decompose the original signal into trend term, seasonal term and random term. Then use the wavelet network traffic analysis module to extract features of these three signals. Finally, fuse the extracted features to obtain the final traffic prediction result. The process can be formalized as follows:

[0064] ;

[0065] ;

[0066] ;

[0067] In the formula, S Trend represents the trend term, S Season represents the seasonal term, S Random represents the random term, VMD represents the optimized variational mode decomposition function, WT represents the wavelet network traffic analysis module, X Trend represents the features extracted from the trend item, X Season represents the features extracted from the seasonal term, X Random represents the features extracted from the random items, Q represents the feature fusion function, Indicates the final traffic prediction result;

[0068] The trend item indicates the overall change trend of network traffic on a larger time scale, such as a continuous increase, decrease or stability over time;

[0069] The seasonal item represents the portion of network traffic that has a periodic pattern, such as periodic traffic changes that occur daily, weekly, or monthly;

[0070] The random term indicates that the traffic fluctuation is random and uncertain and cannot be explained by a clear rule;

[0071] Step S35: Verify the prediction results, measure the degree of deviation between the prediction results and the actual traffic value, continuously monitor the actual changes in network traffic, and continuously update and improve the prediction accuracy based on new data to achieve more accurate and real-time network traffic prediction.

[0072] Furthermore, in step S4, the monitoring results are visualized, specifically by displaying the real-time monitoring data of the network traffic data in an intuitive chart form, and marking the future network traffic forecast results, which helps to plan resources in advance and avoid congestion problems during traffic peaks.

[0073] Furthermore, in step S5, the early warning feedback is specifically to immediately issue an early warning signal when abnormal flow fluctuations are found through monitoring results, and to promptly and accurately feed back detailed information about the abnormal flow to technical personnel so that countermeasures can be taken.

[0074] The artificial intelligence-based real-time network traffic monitoring system provided by the present invention includes a network node setting module, a node scheduling optimization module, a network traffic data analysis module, a monitoring result visualization module and an early warning feedback module;

[0075] The network node setting module specifically considers the network architecture and requirements and specifies the location and number of nodes;

[0076] The node scheduling optimization module specifically calculates the completion time of the monitoring task, the resources exceeding the preset available value, and the loss caused by abandoning the monitoring task, and uses these performance indicators as the input of the particle swarm optimization algorithm, introduces the compression factor, updates the random inertia weight, searches for the optimal node allocation scheme, and ensures the monitoring effect of the network traffic data;

[0077] The network traffic data analysis module specifically analyzes the original signal composition, optimizes the variational mode decomposition parameters, calculates the envelope entropy and kurtosis expressions to evaluate the signal processing effect, decomposes the original signal using the optimized variational mode decomposition function, extracts features through the wavelet network traffic analysis module, and fuses them to obtain the final traffic prediction result;

[0078] The monitoring result visualization module specifically represents the real-time monitoring data in a chart and annotates the future prediction results;

[0079] The early warning feedback module specifically sends out an early warning signal when abnormal traffic is detected, and the technical personnel take corresponding measures in time.

[0080] The beneficial results achieved by the present invention using the above scheme are as follows:

[0081] (1) To address the technical issues that network traffic changes lead to changes in computing requirements and resource consumption, and when resources are exceeded, data transmission delays increase, network congestion increases, and equipment burden increases, a network traffic data monitoring node is set up to calculate the completion time of the monitoring task, the resources that exceed the preset available value, and the loss caused by abandoning the monitoring task. These performance indicators are used as inputs to the particle swarm optimization algorithm, a compression factor is introduced, the random inertia weight is updated, and the optimal node allocation scheme is searched to ensure the monitoring effect of network traffic data;

[0082] (2) In order to solve the technical problem that network traffic data is very large and continuously generated, including multiple types of traffic, the analysis is difficult, it is difficult to capture dynamic patterns, the data is highly volatile and random, and there are sudden peaks, which makes it difficult to predict the future trend of network traffic data, network traffic data analysis is used to analyze the original signal composition, optimize the variational mode decomposition parameters, calculate the envelope entropy and kurtosis expressions to evaluate the signal processing effect, and use the optimized variational mode decomposition function to decompose the original signal. The features are extracted and fused through the wavelet network traffic analysis module to obtain the final traffic prediction result. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] Figure 1 A schematic diagram of the process of the real-time network traffic monitoring method based on artificial intelligence provided by the present invention;

[0084] Figure 2 A schematic diagram of a real-time network traffic monitoring system based on artificial intelligence provided by the present invention;

[0085] Figure 3 is a schematic flow chart of step S2;

[0086] Figure 4 It is a schematic diagram of the process of step S3.

[0087] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention. DETAILED DESCRIPTION

[0088] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0089] In the description of the present invention, it should be understood that terms such as “upper”, “lower”, “front”, “back”, “left”, “right”, “top”, “bottom”, “inside” and “outside” indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore should not be understood as limiting the present invention.

[0090] Example 1, see Figure 1 The present invention provides a method for real-time monitoring of network traffic based on artificial intelligence, which comprises the following steps:

[0091] Step S1: Network node setting, specifically considering the network architecture and requirements, and clarifying the location and number of nodes;

[0092] Step S2: Node scheduling optimization, specifically calculating the completion time of the monitoring task, the resources exceeding the preset available value, and the loss caused by abandoning the monitoring task, using these performance indicators as the input of the particle swarm optimization algorithm, introducing the compression factor, updating the random inertia weight, searching for the optimal node allocation scheme, and ensuring the monitoring effect of the network traffic data;

[0093] Step S3: Network traffic data analysis, specifically analyzing the original signal composition, optimizing the variational mode decomposition parameters, calculating the envelope entropy and kurtosis expressions to evaluate the signal processing effect, using the optimized variational mode decomposition function to decompose the original signal, extracting features through the wavelet network traffic analysis module and fusing them to obtain the final traffic prediction result;

[0094] Step S4: Visualizing the monitoring results, specifically real-time monitoring data, showing them in graphs and annotating future prediction results;

[0095] Step S5: Early warning feedback, specifically, issuing an early warning signal when abnormal traffic is detected, and technical personnel take timely response measures.

[0096] Example 2, see Figure 1 This embodiment is based on the above embodiment. In step S1, the network node is set, including the following steps:

[0097] Step S11: Perform network node settings, comprehensively consider network architecture and requirements, and clarify the location and number of nodes;

[0098] Step S12: Select a collection tool and determine the network range and interface to be collected;

[0099] The collection tools include network traffic monitors and network packet capture tools;

[0100] Step S13: Set acquisition parameters and start the acquisition program.

[0101] Example 3, see Figure 1 and Figure 3 This embodiment is based on the above embodiment. In step S2, the node scheduling optimization includes the following steps:

[0102] Step S21: Calculate the completion time of the monitoring task to reflect the overall time efficiency in the process of processing network traffic data. The formula used is as follows:

[0103] ;

[0104] Where T represents the sum of the completion time of all monitoring tasks for processing network traffic data, N represents the total number of node monitoring tasks, and d represents the index of the node monitoring task. Indicates the actual completion time of the dth node monitoring task, Represents a dynamic adjustment factor, which is used to reflect the weight of the impact of different tasks on the overall time efficiency;

[0105] Step S22: Calculate the excess resources. By clarifying the excess resources, evaluate the system performance, find the computing bottleneck problem in time, and grasp the resource consumption. The formula used is as follows:

[0106] ;

[0107] ;

[0108] Where EC represents the computing resources that exceed the preset available value, ED represents the memory resources that exceed the preset available value, h represents the time period index, H represents the total number of time periods, and EC h represents the total preset computing resources in the hth time period, ED h represents the total preset memory resources in the hth time period, represents the preset availability factor of computing resources, Indicates the preset available factor of memory resources, A indicates the number of resources, a indicates the resource index, It represents the quantitative representation of the computing power that the ath resource needs to occupy during execution, and q represents the total amount of memory resources;

[0109] Step S23: Calculate the loss caused by abandoning the monitoring task. When the system resources are insufficient and cannot carry all monitoring tasks at the same time, it is necessary to make a choice to minimize the total loss caused by abandoning the monitoring task, so as to reduce the risk of data loss and network traffic data monitoring interruption due to abandoning the monitoring task. The formula used is as follows:

[0110] ;

[0111] ;

[0112] In the formula, EA represents the total loss caused by abandoning the monitoring task, Indicates the weight coefficient of the dth node monitoring task abandonment, represents the specific loss value caused by the abandonment of the monitoring task of the dth node, f() represents the nonlinear weight adjustment function, R represents the multi-dimensional resource tension index, g represents the function that comprehensively considers the sub-indicators, q1 represents the CPU usage rate, q2 represents the memory usage rate, and q3 represents the network bandwidth utilization rate;

[0113] Step S24: node scheduling, using the performance indicators in the node scheduling as the input value of the fitness function of the particle swarm optimization algorithm, the performance indicators include the completion time of the monitoring task, the amount of resources exceeded, and the loss caused by abandoning the monitoring task. In the particle swarm optimization algorithm, the optimal node allocation scheme is searched by continuously iteratively updating the speed and position of the particles. After each position update, the corresponding performance indicator value is calculated according to the new node allocation scheme, and the optimal solution of the individual particle and the optimal solution of the particle group are updated. The compression factor is introduced to update the random inertia weight, including the following steps:

[0114] Step S241: define particle attributes, which include speed and position. In each iteration, the particle updates the particle speed and position by tracking two extreme values. The first extreme value is the optimal solution found by the particle itself, i.e., the optimal solution of the particle individual. The second extreme value is the current optimal solution of the entire particle group, i.e., the optimal solution of the particle group. The particle position and speed are updated using the following formula:

[0115] ;

[0116] ;

[0117] In the formula, represents the particle velocity at time t+1, represents the particle velocity at time t, w represents the non-negative inertia weight, which is used to describe the degree of inheritance of the particle velocity at the previous moment, and the range is (0, 1). The higher the value of the non-negative inertia weight, the stronger the global search capability. represents the optimal solution of the individual particle at time t, represents the optimal solution of the particle group at time t, c1 represents the weight of the particle learning from the individual optimal solution, c2 represents the weight of the particle learning from the group optimal solution, r1 and r2 represent random numbers, evenly distributed between [0, 1], to increase the randomness of the search. represents the particle position at time t, represents the particle position at time t+1;

[0118] Step S242: After each particle position update, recalculate the fitness value of each particle, and calculate the updated optimal solution of the individual particle and the optimal solution of the particle group by comparing with the value corresponding to the previous iteration. The formula used is as follows:

[0119] ;

[0120] ;

[0121] In the formula, represents the optimal solution of the individual particle at time t+1, represents the optimal solution of the particle swarm at time t+1, and F represents the fitness function, which combines the performance indicators as the specific calculation content of the fitness function, thereby integrating the performance indicators into the iteration and optimization process of the particle swarm optimization algorithm, and changing according to the specific performance of the node allocation scheme corresponding to the current particle position;

[0122] Step S243: In order to effectively control the overall flight speed of the particles, a compression factor is introduced to achieve a balance between global search and local search, and the optimized particle speed is calculated. The formula used is as follows:

[0123] ;

[0124] ;

[0125] ;

[0126] In the formula, represents the optimized particle velocity, k represents the compression factor;

[0127] Step S244: Update the random inertia weight. The random inertia weight is obtained by random distribution to avoid the loss of local search capability in the early stage of iteration and the loss of global search capability in the late stage of iteration, and improve the global search capability. The formula used is as follows:

[0128] ;

[0129] In the formula, represents the updated random inertia weight, represents the minimum value of the random inertia weight, represents the maximum value of the random inertia weight, rand(1) is a random number uniformly distributed in [0, 1], σ is the standard deviation, usually between 0.2 and 0.5, and randn(1) represents a random number with a normal distribution.

[0130] By performing the above operations, node scheduling optimization is adopted to calculate the completion time of the monitoring task, the resources exceeding the preset available value and the loss caused by abandoning the monitoring task. These performance indicators are used as the input of the particle swarm optimization algorithm, the compression factor is introduced, the random inertia weight is updated, and the optimal node allocation scheme is searched to ensure the monitoring effect of network traffic data. The technical problem that the computing demand and resource consumption change caused by the change of network traffic, the increase of data transmission delay, network congestion and the increase of equipment burden when the resources are exceeded is solved.

[0131] Example 4, see Figure 1 and Figure 4 This embodiment is based on the above embodiment. In step S3, the network traffic data analysis includes the following steps:

[0132] Step S31: data preparation, preliminarily preprocessing the network traffic data collected by the network monitoring node as the original signal;

[0133] Step S32: Analyze the original signal composition to understand the characteristics and patterns of network traffic. The formula used is as follows:

[0134] ;

[0135] In the formula, represents the original signal, which consists of vibration modes and residual terms, represents the wavelet coefficient, a1 represents the scale factor, b represents the translation factor, represents the kth vibration mode, which represents a specific frequency component in the original signal, represents the residual term, k represents the index of the vibration mode, and K represents the total number of vibration modes;

[0136] Step S33: Optimizing variational mode decomposition parameters, including the following:

[0137] Step S331: clarify that the mode number and penalty factor are key parameters of variational mode decomposition, which directly affect the accuracy of the results;

[0138] The appropriate number of modes can ensure that the frequency information is fully covered and avoid overfitting. The penalty factor is used to adjust the similarity between adjacent modes. If the penalty factor is too large, the decomposition process will be too smooth, and if the penalty factor is too small, it will lead to overfitting.

[0139] Step S332: Optimize the variational mode decomposition parameters, evaluate the signal processing effect of the variational mode decomposition function according to the envelope entropy and kurtosis, and adjust the mode number and penalty factor if the signal processing effect is not ideal, including the following steps:

[0140] Step S3321: Calculate the expression of envelope entropy, the formula used is as follows:

[0141] ;

[0142] In the formula, represents the envelope entropy of the i-th intrinsic mode function, i represents the index of the intrinsic mode function, N represents the total number of intrinsic mode functions, represents the probability value in the i-th intrinsic mode function at position j;

[0143] Step S3322: Calculate the expression of kurtosis, the formula used is as follows:

[0144] ;

[0145] In the formula, represents the calculated kurtosis value, represents the value of the i-th intrinsic mode function at position j, represents the mean of the i-th intrinsic mode function, represents the standard deviation of the i-th intrinsic mode function;

[0146] Step S3323: Evaluate the effect of variational mode decomposition on signal processing, and improve the variational mode decomposition parameters according to the evaluation results. The formula used is as follows:

[0147] ;

[0148] In the formula, C represents the signal processing effect evaluation value;

[0149] Step S34: Perform traffic prediction. Use the optimized variational mode decomposition function to decompose the original signal into trend term, seasonal term and random term. Then use the wavelet network traffic analysis module to extract features of these three signals. Finally, fuse the extracted features to obtain the final traffic prediction result. The process can be formalized as follows:

[0150] ;

[0151] ;

[0152] ;

[0153] In the formula, S Trend represents the trend term, S Season represents the seasonal term, S Random represents the random term, VMD represents the optimized variational mode decomposition function, WT represents the wavelet network traffic analysis module, X Trend represents the features extracted from the trend item, X Season represents the features extracted from the seasonal term, X Random represents the features extracted from the random items, Q represents the feature fusion function, Indicates the final traffic prediction result;

[0154] The trend item indicates the overall change trend of network traffic on a larger time scale, such as a continuous increase, decrease or stability over time;

[0155] The seasonal item represents the portion of network traffic that has a periodic pattern, such as periodic traffic changes that occur daily, weekly, or monthly;

[0156] The random term indicates that the traffic fluctuation is random and uncertain and cannot be explained by a clear rule;

[0157] Step S35: Verify the prediction results, measure the degree of deviation between the prediction results and the actual traffic value, continuously monitor the actual changes in network traffic, and continuously update and improve the prediction accuracy based on new data to achieve more accurate and real-time network traffic prediction.

[0158] By performing the above operations, network traffic data analysis is adopted, specifically analyzing the composition of the original signal, optimizing the variational mode decomposition parameters, calculating the envelope entropy and kurtosis expressions to evaluate the signal processing effect, and using the optimized variational mode decomposition function to decompose the original signal. The features are extracted and fused through the wavelet network traffic analysis module to obtain the final traffic prediction result. This solves the technical problems that the network traffic data is very large and continuously generated, contains various types of traffic, the analysis difficulty is increased, it is difficult to capture dynamic laws, the data is highly volatile and random, and there is the influence of sudden peaks, which makes it difficult to predict the future prediction trend of network traffic data.

[0159] Example 5, see Figure 1 This embodiment is based on the above embodiment. In step S4, the monitoring results are visualized, specifically, the real-time monitoring data of the network traffic data is displayed in an intuitive chart form, and the future network traffic prediction results are marked, which helps to plan resources in advance and avoid congestion problems during traffic peaks.

[0160] Example 6, see Figure 1 This embodiment is based on the above embodiment. In step S5, the early warning feedback is specifically to immediately issue an early warning signal when abnormal flow fluctuations are found through monitoring results, and to promptly and accurately feed back detailed information about the abnormal flow to technical personnel so that countermeasures can be taken.

[0161] Embodiment 7, see Figure 2 , this embodiment is based on the above embodiment, and the network traffic real-time monitoring system based on artificial intelligence provided by the present invention includes a network node setting module, a node scheduling optimization module, a network traffic data analysis module, a monitoring result visualization module and an early warning feedback module;

[0162] The network node setting module specifically considers the network architecture and requirements and specifies the location and number of nodes;

[0163] The node scheduling optimization module specifically calculates the completion time of the monitoring task, the resources exceeding the preset available value, and the loss caused by abandoning the monitoring task, and uses these performance indicators as the input of the particle swarm optimization algorithm, introduces the compression factor, updates the random inertia weight, searches for the optimal node allocation scheme, and ensures the monitoring effect of the network traffic data;

[0164] The network traffic data analysis module specifically analyzes the original signal composition, optimizes the variational mode decomposition parameters, calculates the envelope entropy and kurtosis expressions to evaluate the signal processing effect, decomposes the original signal using the optimized variational mode decomposition function, extracts features through the wavelet network traffic analysis module, and fuses them to obtain the final traffic prediction result;

[0165] The monitoring result visualization module specifically represents the real-time monitoring data in a chart and annotates the future prediction results;

[0166] The early warning feedback module specifically sends out an early warning signal when abnormal traffic is detected, and the technical personnel take corresponding measures in time.

[0167] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0168] While the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that many changes, modifications, substitutions and variations can be made to the embodiments without departing from the principles and spirit of the invention.

[0169] The present invention and its embodiments are described above, and such description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if ordinary technicians in the field are inspired by it, without departing from the purpose of the invention, they can design a structure and embodiment similar to the technical solution without creativity, which should belong to the protection scope of the present invention.

Claims

1. A real-time network traffic monitoring method based on artificial intelligence, characterized in that: The method comprises the following steps: Step S1: network node setting, specifically performing node setting; Step S2: Node scheduling optimization, specifically calculating the completion time of the monitoring task, the resources exceeding the preset available value, and the loss caused by abandoning the monitoring task, and using these performance indicators as the input of the particle swarm optimization algorithm, introducing the compression factor, updating the random inertia weight, and searching for the optimal node allocation solution; Step S3: Network traffic data analysis, specifically analyzing the original signal composition, optimizing the variational mode decomposition parameters, calculating the envelope entropy and kurtosis expressions to evaluate the signal processing effect, using the optimized variational mode decomposition function to decompose the original signal, extracting features through the wavelet network traffic analysis module and fusing them to obtain the final traffic prediction result; Step S4: Visualizing the monitoring results, specifically real-time monitoring of traffic data, and representing and annotating future prediction results in graphs; Step S5: Early warning feedback, specifically, issuing an early warning signal when abnormal traffic is detected, and technical personnel take timely response measures.

2. The method for real-time monitoring of network traffic based on artificial intelligence according to claim 1 is characterized in that: In step S2, the node scheduling optimization includes the following steps: Step S21: Calculate the completion time of the monitoring task to reflect the overall time efficiency in the process of processing network traffic data. The formula used is as follows: ； Where T represents the sum of the completion time of all monitoring tasks for processing network traffic data, N represents the total number of node monitoring tasks, and d represents the index of the node monitoring task. Indicates the actual completion time of the dth node monitoring task, represents the dynamic adjustment factor; Step S22: Calculate excess resources using the following formula: ； ； Where EC represents the computing resources that exceed the preset available value, ED represents the memory resources that exceed the preset available value, h represents the time period index, H represents the total number of time periods, and EC h represents the total preset computing resources in the hth time period, ED h represents the total preset memory resources in the hth time period, represents the preset availability factor of computing resources, Indicates the preset available factor of memory resources, A indicates the number of resources, a indicates the resource index, It represents the quantitative representation of the computing power that the ath resource needs to occupy during execution, and q represents the total amount of memory resources; Step S23: Calculate the loss caused by abandoning the monitoring task, using the following formula: ； ； In the formula, EA represents the total loss caused by abandoning the monitoring task, Indicates the weight coefficient of the dth node monitoring task abandonment, represents the specific loss value caused by the abandonment of the monitoring task of the dth node, f() represents the nonlinear weight adjustment function, R represents the multi-dimensional resource tension index, g represents the function that comprehensively considers the sub-indicators, q1 represents the CPU usage rate, q2 represents the memory usage rate, and q3 represents the network bandwidth utilization rate; Step S24: node scheduling, using the performance indicators in the node scheduling as the input value of the fitness function of the particle swarm optimization algorithm, the performance indicators include the completion time of the monitoring task, the amount of resources exceeded, and the loss caused by abandoning the monitoring task. In the particle swarm optimization algorithm, the optimal node allocation scheme is searched by continuously iteratively updating the speed and position of the particles, including the following steps: Step S241: define particle attributes, which include speed and position. In each iteration, the particle updates the particle speed and position by tracking two extreme values. The first extreme value is the optimal solution found by the particle itself, i.e., the optimal solution of the particle individual. The second extreme value is the current optimal solution of the entire particle group, i.e., the optimal solution of the particle group. The particle position and speed are updated using the following formula: ； ； In the formula, represents the particle velocity at time t+1, represents the particle velocity at time t, w represents the non-negative inertia weight, which is used to describe the degree of inheritance of the particle velocity at the previous moment, represents the optimal solution of the individual particle at time t, represents the optimal solution of the particle group at time t, c1 represents the weight of the particle learning from the individual optimal solution, c2 represents the weight of the particle learning from the group optimal solution, r1 and r2 represent random numbers, uniformly distributed between [0, 1]. represents the particle position at time t, represents the particle position at time t+1; Step S242: After each particle position update, recalculate the fitness value of each particle, and calculate the updated optimal solution of the individual particle and the optimal solution of the particle group by comparing with the value corresponding to the previous iteration. The formula used is as follows: ； ； In the formula, represents the optimal solution of the individual particle at time t+1, represents the optimal solution of the particle swarm at time t+1, and F represents the fitness function, which combines the performance indicators as the specific calculation content of the fitness function, thereby integrating the performance indicators into the iteration and optimization process of the particle swarm optimization algorithm, and changing according to the specific performance of the node allocation scheme corresponding to the current particle position; Step S243: A compression factor is introduced to achieve a balance between global search and local search, and the optimized particle velocity is calculated using the following formula: ； ； ； In the formula, represents the optimized particle velocity, k represents the compression factor; Step S244: Update the random inertia weight to avoid the loss of local search capability in the early stage of iteration and the loss of global search capability in the late stage of iteration. The formula used is as follows: ； In the formula, represents the updated random inertia weight, represents the minimum value of the random inertia weight, represents the maximum value of the random inertia weight, rand(1) is a random number uniformly distributed in [0, 1], σ is the standard deviation, and randn(1) represents a random number with a normal distribution.

3. The method for real-time monitoring of network traffic based on artificial intelligence according to claim 1 is characterized in that: In step S3, the network traffic data analysis includes the following steps: Step S31: data preparation, preliminarily preprocessing the network traffic data collected by the network monitoring node as the original signal; Step S32: Analyze the original signal composition to understand the characteristics and patterns of network traffic. The formula used is as follows: ； In the formula, represents the original signal, which consists of a vibration mode and a residual term, represents the wavelet coefficient, a1 represents the scale factor, b represents the translation factor, represents the kth vibration mode, which represents a specific frequency component in the original signal, represents the residual term, k represents the index of the vibration mode, and K represents the total number of vibration modes; Step S33: Optimizing variational mode decomposition parameters, including the following: Step S331: clarify that the mode number and penalty factor are key parameters of variational mode decomposition, which directly affect the accuracy of the results; Step S332: Optimizing the variational mode decomposition parameters, evaluating the signal processing effect of the variational mode decomposition function according to the envelope entropy and the kurtosis, and adjusting the mode number and the penalty factor when the signal processing effect is not ideal, including the following steps: Step S3321: Calculate the expression of envelope entropy, the formula used is as follows: ； In the formula, represents the envelope entropy of the i-th intrinsic mode function, i represents the index of the intrinsic mode function, N represents the total number of intrinsic mode functions, represents the probability value in the i-th intrinsic mode function at position j; Step S3322: Calculate the expression of kurtosis, the formula used is as follows: ； In the formula, represents the calculated kurtosis value, represents the value of the i-th intrinsic mode function at position j, represents the mean of the i-th intrinsic mode function, represents the standard deviation of the i-th intrinsic mode function; Step S3323: Evaluate the effect of variational mode decomposition on signal processing, and improve the variational mode decomposition parameters according to the evaluation results. The formula used is as follows: ； In the formula, C represents the signal processing effect evaluation value; Step S34: Perform traffic prediction. Use the optimized variational mode decomposition function to decompose the original signal into trend term, seasonal term and random term. Then use the wavelet network traffic analysis module to extract features of these three signals. Finally, fuse the extracted features to obtain the final traffic prediction result. The process can be formalized as follows: ； ； ； In the formula, S Trend represents the trend term, S Season represents the seasonal term, S Random represents the random term, VMD represents the optimized variational mode decomposition function, WT represents the wavelet network traffic analysis module, X Trend represents the features extracted from the trend item, X Season represents the features extracted from the seasonal term, X Random represents the features extracted from the random items, Q represents the feature fusion function, Indicates the final traffic prediction result; Step S35: Verify the prediction results, measure the degree of deviation between the prediction results and the actual traffic value, continuously monitor the actual changes in network traffic, and continuously update and improve the prediction accuracy based on new data to achieve more accurate and real-time network traffic prediction.

4. The method for real-time monitoring of network traffic based on artificial intelligence according to claim 1 is characterized in that: In step S1, the network node setting includes the following steps: Step S11: Perform network node settings, comprehensively consider network architecture and requirements, and clarify the location and number of nodes; Step S12: Select a collection tool and determine the network range and interface to be collected; The collection tools include network traffic monitors and network packet capture tools; Step S13: Set acquisition parameters and start the acquisition program.

5. The method for real-time monitoring of network traffic based on artificial intelligence according to claim 1 is characterized in that: In step S4, the monitoring results are visualized, specifically by displaying the real-time monitoring data of the network traffic data in the form of intuitive charts, and marking the future network traffic forecast results, so as to make resource planning in advance and avoid congestion problems during traffic peaks.

6. The method for real-time monitoring of network traffic based on artificial intelligence according to claim 1 is characterized in that: In step S5, the early warning feedback is specifically to immediately send out an early warning signal when abnormal flow fluctuations are found through monitoring results, and to feed back detailed information about the abnormal flow to technical personnel in a timely and accurate manner so that countermeasures can be taken.

7. A network traffic real-time monitoring system based on artificial intelligence, used to implement a network traffic real-time monitoring method based on artificial intelligence as claimed in any one of claims 1 to 6, characterized in that: It includes network node setting module, node scheduling optimization module, network traffic data analysis module, monitoring result visualization module and early warning feedback module.

8. The artificial intelligence-based real-time network traffic monitoring system according to claim 7 is characterized in that: The network node setting module specifically considers the network architecture and requirements and specifies the location and quantity of nodes; The node scheduling optimization module specifically calculates the completion time of the monitoring task, the resources exceeding the preset available value, and the loss caused by abandoning the monitoring task, and uses these performance indicators as the input of the particle swarm optimization algorithm, introduces the compression factor, updates the random inertia weight, and searches for the optimal node allocation solution; The network traffic data analysis module specifically analyzes the original signal composition, optimizes the variational mode decomposition parameters, calculates the envelope entropy and kurtosis expressions to evaluate the signal processing effect, decomposes the original signal using the optimized variational mode decomposition function, extracts features through the wavelet network traffic analysis module, and fuses them to obtain the final traffic prediction result; The monitoring result visualization module specifically represents the real-time monitoring data in a chart and annotates the future prediction results; The early warning feedback module specifically sends out an early warning signal when abnormal traffic is detected, and the technical personnel take corresponding measures in time.

Images