Network management method, device, equipment and medium

Abstract

The invention relates to the technical field of artificial intelligence, in particular to a network management method and device, equipment and a medium, which are used for improving the network management effect and enhancing the security of a network system. The method comprises the following steps: acquiring real-time data after standardization processing, wherein the real-time data comprises current network flow data, current equipment state data and current environment data; the real-time data is input to a target zero sample classification model, a prediction result output by the zero sample classification model is obtained, the prediction result is used for indicating sub-prediction results corresponding to key network management functions, and the key network management functions comprise network anomaly detection, flow prediction and equipment management; and when the prediction result is abnormal, generating alarm information and sending the alarm information to the target object.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a network management method, device, equipment and medium. Background Art

[0002] With the rapid development of wide area networks, network management is no longer limited to ensuring file transmission, but is also about ensuring the normal operation of objects connected to the network (routing and switching equipment, security equipment, host security, etc.), while monitoring the operation of the network.

[0003] Traditional network management methods can only handle limited abnormal situations. Many abnormalities cannot be detected during network management, resulting in poor network management results and low security. Summary of the invention

[0004] The embodiments of the present application provide a network management method, apparatus, device and medium to improve network management effects and enhance the security of the network system.

[0005] The specific technical solutions provided by the embodiments of this application are as follows:

[0006] In a first aspect, the present application provides a network management method, comprising:

[0007] Obtain standardized real-time data, including current network traffic data, current device status data, and current environment data;

[0008] Input the real-time data into the target zero-shot classification model to obtain the prediction results output by the zero-shot classification model. The prediction results are used to indicate the sub-prediction results corresponding to each key network management function. The key network management functions include: network anomaly detection, traffic prediction and device management.

[0009] When the prediction result is abnormal, an alarm message is generated and sent to the target object.

[0010] In a possible embodiment, obtaining the standardized real-time data includes:

[0011] Collect real-time data based on the application programming interface API interface;

[0012] Clean real-time data;

[0013] Standardize the cleaned real-time data.

[0014] Through the above method, real-time data can be standardized to improve the effect of data analysis and machine learning.

[0015] In a possible embodiment, the target zero trust model is obtained in the following manner:

[0016] Obtain a training sample set, wherein each training sample in the training sample set includes: sample network traffic data, sample device status data, sample environment data, and a corresponding true label;

[0017] Train the zero-trust model to be trained based on the training sample set;

[0018] Test the trained zero-trust model based on the test sample set;

[0019] Integrate the tested target zero trust model into the Software as a Service (SAAS) network management platform.

[0020] Through the above method, the target zero trust model can be accurately obtained, thereby improving the effect of network management.

[0021] In a possible embodiment, training a zero-trust model to be trained based on a training sample set includes:

[0022] Extracting sample features of each training sample in the training sample set, and using a pre-trained embedding model to map the sample features of each training sample to a high-dimensional embedding space, obtaining each embedding vector, and obtaining a category prototype based on each embedding vector;

[0023] Generate virtual sample sets using generative adversarial networks and variational autoencoders, and update category prototypes based on the virtual sample sets;

[0024] Using gradient descent, adjust the model parameters to minimize the loss function.

[0025] Through the above method, new categories can be identified even without clear training data, which is suitable for quickly adapting to new situations in network management scenarios.

[0026] In a possible embodiment, testing the trained zero trust model based on the test sample set includes:

[0027] Use the trained zero-trust model to predict the test sample set, obtain the predicted label, and compare the predicted label with the true label to calculate the accuracy.

[0028] Through the above methods, the performance and reliability of the model are verified to ensure that the performance of the model in practical applications meets expectations.

[0029] In a possible embodiment, the target zero trust model that has passed the test is integrated into the software as a service SAAS network management platform, including:

[0030] Deploy the target zero trust model to the computing resources of the SAAS network management platform;

[0031] Integrate the model service of the target zero trust model into the core system of the SAAS network management platform.

[0032] Through the above method, the target zero-trust model is integrated into the SAAS network management platform, which can be flexibly applied in different scenarios and fields, expanding the application scope of the traditional network management system, enhancing the security of the system, and increasing the cost of attack.

[0033] In a possible embodiment, the method further includes:

[0034] Based on the needs of the target object, prioritize the key network management functions and obtain the target key network management functions;

[0035] When the sub-prediction result corresponding to the target key network management function is abnormal, the alarm information corresponding to the target key network management function is sent to the target object.

[0036] Through the above method, the needs of the target object are taken into consideration, and the alarm information is sent in a targeted manner, thereby improving the user experience.

[0037] In a second aspect, the present application provides a network management device, the device comprising:

[0038] The acquisition module is used to acquire the real-time data after standardization processing, and the real-time data includes: current network traffic data, current device status data and current environment data;

[0039] A prediction module is used to input real-time data into the target zero-shot classification model to obtain the prediction results output by the zero-shot classification model. The prediction results are used to indicate the sub-prediction results corresponding to each key network management function. Each key network management function includes: network anomaly detection, traffic prediction and device management;

[0040] The first processing module is used to generate an alarm message and send it to a target object when the prediction result shows that an abnormality exists.

[0041] In a possible embodiment, when acquiring the real-time data after standardization processing, the acquisition module is further used to:

[0042] Collect real-time data based on the application programming interface API interface;

[0043] Clean real-time data;

[0044] Standardize the cleaned real-time data.

[0045] In a possible embodiment, the device further includes a training module, and the training module is used to:

[0046] Obtain a training sample set, wherein each training sample in the training sample set includes: sample network traffic data, sample device status data, sample environment data, and a corresponding true label;

[0047] Train the zero-trust model to be trained based on the training sample set;

[0048] Test the trained zero-trust model based on the test sample set;

[0049] Integrate the tested target zero trust model into the Software as a Service (SAAS) network management platform.

[0050] In a possible embodiment, when training the zero-trust model to be trained based on the training sample set, the training module is further used to:

[0051] Extracting sample features of each training sample in the training sample set, and using a pre-trained embedding model to map the sample features of each training sample to a high-dimensional embedding space, obtaining each embedding vector, and obtaining a category prototype based on each embedding vector;

[0052] Generate virtual sample sets using generative adversarial networks and variational autoencoders, and update category prototypes based on the virtual sample sets;

[0053] Using gradient descent, adjust the model parameters to minimize the loss function.

[0054] In a possible embodiment, when testing the trained zero trust model based on the test sample set, the training module is further used to:

[0055] Use the trained zero-trust model to predict the test sample set, obtain the predicted label, and compare the predicted label with the true label to calculate the accuracy.

[0056] In a possible embodiment, when the target zero-trust model that has passed the test is integrated into the software as a service SAAS network management platform, the training module is also used to:

[0057] Deploy the target zero trust model to the computing resources of the SAAS network management platform;

[0058] Integrate the model service of the target zero trust model into the core system of the SAAS network management platform.

[0059] In a possible embodiment, the device further includes a second processing module, and the second processing module is used to:

[0060] Based on the needs of the target object, prioritize the key network management functions and obtain the target key network management functions;

[0061] When the sub-prediction result corresponding to the target key network management function is abnormal, the alarm information corresponding to the target key network management function is sent to the target object.

[0062] According to a third aspect, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any one of the methods described in the first aspect are implemented.

[0063] According to a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method described in any one of the first aspects are implemented.

[0064] In a fifth aspect, the present application provides a computer program product, comprising: a computer program code, when the computer program code is run on a computer, the computer executes any one of the methods described in the first aspect.

[0065] In the embodiment of the present application, the real-time data after standardization processing is obtained, and the real-time data includes: current network traffic data, current device status data and current environment data, and then the real-time data is input into the target zero-sample classification model to obtain the prediction result output by the zero-sample classification model. The prediction result is used to indicate the corresponding sub-prediction result of each key network management function. Each key network management function includes: network anomaly detection, traffic prediction and device management. When the prediction result is that there is an anomaly, an alarm message is generated and sent to the target object. In this way, based on the target zero-sample classification model, it is possible to handle anomaly types that have not been seen before, reduce dependence on labeled data, and thus significantly improve the efficiency of anomaly detection and processing, so that the system can cope with more diverse abnormal scenarios, improve the effect of network management, and combine real-time monitoring and alarm functions to improve the security and reliability of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 This is a system architecture diagram of network management in an embodiment of the present application;

[0067] Figure 2 A flowchart of an implementation of a network management method provided in an embodiment of the present application;

[0068] Figure 3 A schematic diagram of the structure of a network management device provided in an embodiment of the present application;

[0069] Figure 4 Schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0070] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0071] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0072] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0073] In the technical solution of this application, the acquisition, transmission, storage, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0074] To facilitate understanding of the technical solutions provided in the embodiments of the present application, some key terms used in the embodiments of the present application are explained here:

[0075] Network management: refers to the process of controlling a computer network and improving its efficiency and productivity. It is an inevitable product of the development of computer networks. Early computer networks were mainly local area networks, which were inseparable from network operating systems. With the rapid development of wide area networks, network management is no longer limited to ensuring file transmission, but to ensuring the normal operation of objects connected to the network, while monitoring the operation of the network and optimizing the network space.

[0076] Intelligent network management: It is an important field in modern network management. Intelligent network management refers to a network management method that manages and optimizes the network through intelligent technology. It uses artificial intelligence, machine learning, big data analysis and other technologies to improve the level of automation and intelligence of network management, thereby achieving efficient configuration, monitoring and optimization of network resources.

[0077] Software as a Service (SAAS): is a model for providing software services through the Internet, allowing users to use cloud-based applications through an Internet connection.

[0078] Zero-shot classification model: a machine learning model that can be tested on samples and category labels that have never been learned during the training phase. That is, the model has not seen certain specific categories during training, but can correctly classify or identify these unseen categories during testing.

[0079] Generative Adversarial Networks (GAN): It consists of a generative model and a discriminative model, which generate data as close to real data as possible through mutual competition and learning.

[0080] Variational Auto-Encoder (VAE): is a generative model that describes the latent space in a probabilistic way and has great potential in data generation.

[0081] Before introducing the network management method provided by the embodiment of the present application, in order to facilitate understanding, the technical background of the embodiment of the present application is first introduced in detail below.

[0082] With the rapid development of wide area networks, network management is no longer limited to ensuring file transmission, but is also about ensuring the normal operation of objects connected to the network (routing and switching equipment, security equipment, host security, etc.), while monitoring the operation of the network.

[0083] Traditional network management methods can only handle limited anomalies. Many anomalies cannot be detected during network management, resulting in poor network management results and low security. For example, when dealing with network traffic forecasting and anomaly detection, they usually rely on static thresholds and rules, which are often set based on historical experience. For example, in terms of anomaly detection, the system may determine whether the network performance indicator exceeds the normal range based on the preset threshold. It is difficult for a fixed threshold to accurately reflect all possible anomalies.

[0084] In view of this, in the embodiment of the present application, a network management method, device, equipment and medium are provided to obtain real-time data after standardization processing, the real-time data includes: current network traffic data, current equipment status data and current environment data, and then the real-time data is input into the target zero-sample classification model to obtain the prediction result output by the zero-sample classification model, and the prediction result is used to indicate the corresponding sub-prediction result of each key network management function, and each key network management function includes: network anomaly detection, traffic prediction and equipment management. When the prediction result is that there is an anomaly, an alarm message is generated and sent to the target object. In this way, based on the target zero-sample classification model, it is possible to handle anomaly types that have not been seen before, reduce the dependence on labeled data, and thus significantly improve the efficiency of anomaly detection and processing, so that the system can cope with more diverse abnormal scenarios, improve the effect of network management, and combine real-time monitoring and alarm functions to improve the security and reliability of the network. In addition, the automatic prediction and processing of anomalies does not require human intervention, which reduces the risks brought by human operation and improves management efficiency and system consistency.

[0085] The preferred implementation modes of the present application are described in detail below with reference to the accompanying drawings.

[0086] See also Figure 1 The network management system includes a target setting module 110 , a data processing module 120 , a model building module 130 , a model training module 140 , a model application module 150 , and an abnormal warning module 160 .

[0087] The target setting module 110 is used to set the key network management functions of the intelligent network management system, and the key network management functions include but are not limited to: network anomaly detection, traffic prediction and device management.

[0088] Data processing module 120: used to collect network traffic data, device status data, environmental data and other data based on the API interface, and perform standardized processing on the data.

[0089] Model building module 130: used to build a zero-sample classification model.

[0090] Model training module 140: used to train the zero-sample classification model, perform model verification, and evaluate the performance of the model.

[0091] Model application module 150: used to integrate the trained zero-sample classification model into the SAAS intelligent network management platform.

[0092] Abnormal warning module 160: used to perform abnormal prediction and warning in combination with the zero-sample classification model.

[0093] See also Figure 2 As shown, it is an implementation flow chart of a network management method provided in an embodiment of the present application. The specific implementation process of the method is as follows:

[0094] Step 20: Obtain the real-time data after standardization.

[0095] Among them, real-time data includes: current network traffic data, current device status data and current environment data. Network traffic data includes: bandwidth usage, packet loss rate, delay and other data; device status data includes: central processing unit (CPU) usage rate, memory usage rate, network interface status and other data; environment data includes: device geographic location, operating system version, device media access control address (MAC) address, SN serial number and other data.

[0096] Optionally, in the embodiment of the present application, a possible embodiment is provided to obtain the real-time data after standardization processing, and the specific steps are as follows:

[0097] Step 200: Collect real-time data based on the application programming interface API interface.

[0098] Step 201: Clean the real-time data.

[0099] In the embodiment of the present application, missing values, duplicate records and outliers in real-time data are removed.

[0100] Step 202: Standardize the cleaned real-time data.

[0101] In the embodiment of the present application, the cleaned real-time data is converted into a standard normal distribution.

[0102] The normalization formula is:

[0103]

[0104] In the formula, Z ij is the value of the jth collected data after being standardized on the i-th data feature, X ijis the original value of the jth collected data on the i-th data feature, μ i is the mean corresponding to the i-th data feature, σ i is the standard deviation corresponding to the i-th data feature, where the data features include CPU usage, bandwidth usage, packet loss rate, memory usage, etc.

[0105] The mean and standard deviation calculation formulas are:

[0106]

[0107] In the formula, μ i is the mean corresponding to the i-th data feature, N is the total number of data collected, is all values ​​X for the i-th data feature ij To sum, σ i is the standard deviation corresponding to the ith data feature, is all values ​​X for the i-th data feature ij With mean μ i The differences are squared and summed.

[0108] In this way, standardizing real-time data can improve the effectiveness of data analysis and machine learning.

[0109] Step 21: Input the real-time data into the target zero-shot classification model to obtain the prediction result output by the zero-shot classification model.

[0110] The prediction results are used to indicate the sub-prediction results corresponding to each key network management function, and each key network management function includes but is not limited to: network anomaly detection, traffic prediction and equipment management.

[0111] In an embodiment of the present application, real-time data is used as an input parameter and input into a trained target zero-sample classification model to obtain a prediction result output by the target zero-sample classification model, thereby obtaining a sub-prediction result corresponding to each key network management function.

[0112] The prediction formula is:

[0113]

[0114] In the formula, is the prediction result output by the target zero-shot classification model, x new is the input real-time data, and θ is the parameter of the target zero-shot classification model.

[0115] In the embodiment of the present application, a possible embodiment is provided to obtain the target zero trust model, and the specific steps are as follows:

[0116] Step A1: Obtain a training sample set.

[0117] Each training sample in the training sample set includes: sample network traffic data, sample device status data, sample environment data, and the corresponding real label. Network traffic data includes: bandwidth usage, packet loss rate, delay and other data; device status data includes: CPU usage, memory usage, network interface status and other data; environment data includes: device geographic location, operating system version, MAC address, SN serial number and other data.

[0118] In addition, it is worth noting that in the embodiments of the present application, the training samples are standardized.

[0119] Step A2: Train the zero-trust model to be trained based on the training sample set.

[0120] Optionally, in the embodiment of the present application, a possible embodiment is provided to obtain a training zero-trust model, and the specific steps are as follows:

[0121] Step A21: extract sample features of each training sample in the training sample set, and use a pre-trained embedding model to map the sample features of each training sample to a high-dimensional embedding space to obtain each embedding vector, and obtain a category prototype based on each embedding vector.

[0122] In the embodiment of the present application, the embedding formula is:

[0123] e=f(x)

[0124] Where e is the embedded representation, f is the embedding function, and x is the input data.

[0125] In the embodiment of the present application, the category prototype calculation formula is:

[0126]

[0127] In the formula, Pc is the prototype of category c, Sc is the training sample set of category c, and e i is the embedding vector of the i-th training sample in the training sample set of category c, x i is the i-th training sample in the training sample set of category c.

[0128] Step A22: Generate a virtual sample set using a generative adversarial network and a variational autoencoder, and update the category prototype based on the virtual sample set.

[0129] Among them, each virtual sample in the virtual sample set is an unseen sample.

[0130] In an embodiment of the present application, a variational autoencoder is used to generate samples of the latent space. The variational autoencoder is responsible for capturing the overall distribution. Different feature distributions can be obtained by sampling in the latent space. The latent vector generated by the variational autoencoder is then used as input, and a more realistic virtual sample is generated through a generative adversarial network to contain more realistic detail features. Finally, the sample features of each virtual sample are mapped to a high-dimensional embedding space to obtain each new embedding vector, and based on each new embedding vector, the category prototype is updated.

[0131] In this way, by combining the advantages of generative adversarial networks and variational autoencoders, high-quality virtual samples can be effectively generated.

[0132] Among them, the loss function of the variational autoencoder is:

[0133] L VAE =E q(z|x) [logp(x|z)]-D KL [q(z|x)‖p(z)]

[0134] In the formula, E q(z|x) It is the KL divergence between the expectation of the posterior distribution q(z|x) of the latent variable z and p(z), p(x|z) is the generative model given the latent variable z, q(z|x) is the posterior distribution of the latent variable z when the inference model is given the data |x, and p(z) is the prior distribution of the latent variable z.

[0135] Step A23: Use gradient descent to adjust model parameters to minimize the loss function.

[0136] In the embodiment of the present application, the gradient descent formula is:

[0137] θ: =θ-μΔ θ L(θ)

[0138] In the formula, θ is the initial parameter value, L(θ) is the loss function, Δ θ L(θ) is the gradient of L(θ), and μ is the learning rate, which controls the size of the step when updating the parameters.

[0139] In this way, the generative adversarial network and the variational autoencoder jointly generate synthetic data of unseen categories, simulating the distribution of real sample data. Even when there is no clear training data, they can identify new categories. This makes them suitable for quickly adapting to new situations in network management scenarios, such as discovering new types of attacks or abnormal devices, thereby improving the intelligence and adaptability of network management.

[0140] Step A3: Test the trained zero trust model based on the test sample set.

[0141] Each test sample in the test sample set includes: sample network traffic data, sample device status data, sample environment data, and a corresponding real label.

[0142] In each of the embodiments of the present application, a trained zero-trust model is used to predict the test sample set, obtain the predicted label, and compare the predicted label with the true label to calculate the accuracy.

[0143] The accuracy calculation formula is:

[0144]

[0145] In the formula, ‖(.) is the indicator function, is the predicted label, y i is the true label, N is the total number of test samples, and A is the accuracy.

[0146] Step A4: Integrate the target zero trust model that has passed the test into the Software as a Service (SAAS) network management platform.

[0147] In an embodiment of the present application, when the accuracy rate is greater than the accuracy rate threshold, it is determined that the trained zero trust model test has passed, and the target zero trust model is obtained, and the target zero trust model is integrated into the software as a service SAAS network management platform.

[0148] Optionally, in an embodiment of the present application, a possible embodiment is provided for integrating the target zero trust model into the software as a service (SAAS) network management platform, and the specific steps are as follows:

[0149] Step A41: Deploy the target zero trust model to the computing resources of the SAAS network management platform.

[0150] In an embodiment of the present application, the target zero trust model is saved as a model file, the model file is uploaded to the SAAS network management platform, and the model file is loaded in the SAAS network management platform to ensure that the SAAS network management platform can process real-time data.

[0151] Step A42: Integrate the model service of the target zero trust model into the core system of the SAAS network management platform.

[0152] In an embodiment of the present application, the model service is integrated into the core system of the SAAS network management platform and collaborates with other components of the SAAS network management platform.

[0153] In this way, the target zero trust model is integrated into the SAAS network management platform, which is applicable to various types of devices (self-developed and third-party devices), and can be flexibly applied in different scenarios and fields, expanding the application scope of traditional network management systems. In addition, since any device can be connected in the SAAS mode, the target zero trust model is used to manage the connected devices, that is, all connected devices are detected for anomalies, assuming that any device may be untrusted, and anomaly detection is performed, thereby enhancing the security of the system and increasing the cost of attack.

[0154] Step 22: When the prediction result shows that an abnormality exists, an alarm message is generated and sent to the target object.

[0155] Among them, the target object can be a network management personnel and a device management personnel, etc., which is not limited in the embodiments of the present application.

[0156] In the embodiment of the present application, when there is a sub-prediction result in the prediction result that is abnormal, it is determined that the prediction result is abnormal, and an alarm message is generated and sent to the target object.

[0157] In addition, it is worth noting that in the embodiment of the present application, when the prediction result is that there is an abnormality, the abnormal event and its detailed information are also recorded for subsequent analysis and auditing.

[0158] Optionally, in the embodiment of the present application, the alarm information may be selectively sent, and the specific steps are as follows:

[0159] Step B1: Based on the needs of the target object, prioritize the key network management functions to obtain the target key network management functions.

[0160] For example, assuming that the target object is a network management personnel and the target object's requirement is to detect network anomalies, then the target key network management function is network anomaly detection.

[0161] Step B2: When the sub-prediction result corresponding to the target key network management function is abnormal, the alarm information corresponding to the target key network management function is sent to the target object.

[0162] In the embodiment of the present application, when the alarm information corresponding to the target key network management function is sent to the target object, the alarm information corresponding to other key network management functions is not sent to the target object.

[0163] In this way, the needs of the target object are taken into consideration, and warning information is sent in a targeted manner, which improves the user experience.

[0164] Based on the same inventive concept, a network management device is also provided in the embodiment of the present application. Figure 3FIG. 1 is a schematic diagram of the structure of a network management device in an embodiment of the present application, which specifically includes:

[0165] The acquisition module 301 is used to acquire the real-time data after standardization processing, and the real-time data includes: current network traffic data, current device status data and current environment data;

[0166] A prediction module 302 is used to input real-time data into a target zero-shot classification model to obtain a prediction result output by the zero-shot classification model, wherein the prediction result is used to indicate a sub-prediction result corresponding to each key network management function, wherein each key network management function includes: network anomaly detection, traffic prediction, and device management;

[0167] The first processing module 303 is used to generate an alarm message and send it to the target object when the prediction result shows that an abnormality exists.

[0168] In a possible embodiment, when acquiring the real-time data after standardization, the acquisition module 301 is further used to:

[0169] Collect real-time data based on the application programming interface API interface;

[0170] Clean real-time data;

[0171] Standardize the cleaned real-time data.

[0172] In a possible embodiment, the apparatus further includes a training module 304, and the training module 304 is used to:

[0173] Obtain a training sample set, wherein each training sample in the training sample set includes: sample network traffic data, sample device status data, sample environment data, and a corresponding true label;

[0174] Train the zero-trust model to be trained based on the training sample set;

[0175] Test the trained zero-trust model based on the test sample set;

[0176] Integrate the tested target zero trust model into the Software as a Service (SAAS) network management platform.

[0177] In a possible embodiment, when training the zero trust model to be trained based on the training sample set, the training module 304 is further used to:

[0178] Extracting sample features of each training sample in the training sample set, and using a pre-trained embedding model to map the sample features of each training sample to a high-dimensional embedding space, obtaining each embedding vector, and obtaining a category prototype based on each embedding vector;

[0179] Generate virtual sample sets using generative adversarial networks and variational autoencoders, and update category prototypes based on the virtual sample sets;

[0180] Using gradient descent, adjust the model parameters to minimize the loss function.

[0181] In a possible embodiment, when testing the trained zero trust model based on the test sample set, the training module 304 is further used to:

[0182] Use the trained zero-trust model to predict the test sample set, obtain the predicted label, and compare the predicted label with the true label to calculate the accuracy.

[0183] In a possible embodiment, when the target zero-trust model that has passed the test is integrated into the software as a service SAAS network management platform, the training module 304 is further used to:

[0184] Deploy the target zero trust model to the computing resources of the SAAS network management platform;

[0185] Integrate the model service of the target zero trust model into the core system of the SAAS network management platform.

[0186] In a possible embodiment, the device further includes a second processing module 305, and the second processing module 305 is used to:

[0187] Based on the needs of the target object, prioritize the key network management functions and obtain the target key network management functions;

[0188] When the sub-prediction result corresponding to the target key network management function is abnormal, the alarm information corresponding to the target key network management function is sent to the target object.

[0189] Based on the above embodiments, see Figure 4 Shown is a schematic diagram of the structure of an electronic device in an embodiment of the present application.

[0190] An embodiment of the present application provides an electronic device, which may include a processor 410 (Center Processing Unit, CPU), a memory 420, an input device 430 and an output device 440, etc. The input device 430 may include a keyboard, a mouse, a touch screen, etc., and the output device 440 may include a display device, such as a liquid crystal display (Liquid Crystal Display, LCD), a cathode ray tube (Cathode Ray Tube, CRT), etc.

[0191] The memory 420 may include a read-only memory (ROM) and a random access memory (RAM), and provides the processor 410 with program instructions and data stored in the memory 420. In the embodiment of the present application, the memory 420 may be used to store the program of any network management method in the embodiment of the present application.

[0192] The processor 410 calls the program instructions stored in the memory 420, and the processor 410 is used to execute any network management method in the embodiments of the present application according to the obtained program instructions.

[0193] Based on the above embodiments, in an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the network management method in any of the above method embodiments is implemented.

[0194] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0195] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0196] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0197] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0198] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A network management method, characterized in that: include: Acquire standardized real-time data, the real-time data including: current network traffic data, current device status data and current environment data; Inputting the real-time data into a target zero-shot classification model to obtain a prediction result output by the zero-shot classification model, wherein the prediction result is used to indicate a sub-prediction result corresponding to each key network management function, wherein each key network management function includes: network anomaly detection, traffic prediction, and device management; When the prediction result shows that an abnormality exists, an alarm message is generated and sent to the target object.

2. The method according to claim 1, characterized in that The step of obtaining the standardized real-time data includes: Collect real-time data based on the application programming interface API interface; Cleaning the real-time data; The cleaned real-time data is standardized.

3. The method according to claim 1, characterized in that The target zero trust model is achieved in the following way: Acquire a training sample set, wherein each training sample in the training sample set includes: sample network traffic data, sample device status data, sample environment data, and a corresponding true label; Training the zero-trust model to be trained based on the training sample set; Test the trained zero-trust model based on the test sample set; Integrate the tested target zero trust model into the Software as a Service (SAAS) network management platform.

4. The method according to claim 3, characterized in that The training of the zero-trust model to be trained based on the training sample set includes: Extracting sample features of each training sample in the training sample set, and using a pre-trained embedding model to map the sample features of each training sample to a high-dimensional embedding space to obtain each embedding vector, and obtaining a category prototype based on each embedding vector; Generate virtual sample sets using generative adversarial networks and variational autoencoders, and update category prototypes based on the virtual sample sets; Using gradient descent, adjust the model parameters to minimize the loss function.

5. The method according to claim 4, characterized in that The testing of the trained zero trust model based on the test sample set includes: Use the trained zero-trust model to predict the test sample set, obtain the predicted label, and compare the predicted label with the true label to calculate the accuracy.

6. The method according to claim 4, characterized in that The integration of the tested target zero trust model into the Software as a Service (SAAS) network management platform includes: Deploy the target zero trust model to the computing resources of the SAAS network management platform; Integrate the model service of the target zero trust model into the core system of the SAAS network management platform.

7. The method according to claim 1, characterized in that The method further comprises: Based on the needs of the target object, the key network management functions are prioritized to obtain the target key network management functions; When the sub-prediction result corresponding to the target key network management function is abnormal, the alarm information corresponding to the target key network management function is sent to the target object.

8. A network management device, characterized in that: include: An acquisition module is used to acquire the real-time data after standardization processing, wherein the real-time data includes: current network traffic data, current device status data and current environment data; A prediction module, used to input the real-time data into a target zero-sample classification model to obtain a prediction result output by the zero-sample classification model, wherein the prediction result is used to indicate a sub-prediction result corresponding to each key network management function, wherein each key network management function includes: network anomaly detection, traffic prediction, and device management; The first processing module is used to generate an alarm message and send it to a target object when the prediction result shows that an abnormality exists.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images