A multi-level management, multi-functional IPv6 traffic monitoring platform

Abstract

This invention relates to a multi-level managed IPv6 traffic multi-functional monitoring platform, comprising a data acquisition layer, a regional monitoring layer, a core analysis layer, a control and orchestration layer, and a feedback optimization layer. The data acquisition layer, located at the network edge, is responsible for collecting real-time traffic data and performing preliminary traffic classification and anomaly detection. The regional monitoring layer is distributed across various regions, aggregating edge data to construct a regional traffic feature database, while simultaneously handling local traffic anomalies and executing response strategies. The core analysis layer contains a centralized platform core computing unit that optimizes the global AI model through federated learning and introduces a dual-stream neural network to fuse global and personalized features, providing cross-regional collaborative monitoring and global optimization. The control and orchestration layer provides dynamic resource allocation and policy adjustment, coordinating the operation of global and regional nodes. The feedback optimization layer combines digital twins and reinforcement learning to continuously optimize traffic scheduling and protection strategies.

Description

Technical Field

[0001] This invention relates to the field of technology, and in particular to a multi-level management IPv6 traffic multi-functional monitoring platform. Background Technology

[0002] The current technical challenges facing IPv6 network traffic monitoring and management are as follows:

[0003] Traffic diversity and complexity: The widespread deployment of the IPv6 protocol has brought about a variety of traffic types and complex network behaviors, making it difficult for traditional traffic monitoring technologies to meet the needs of real-time classification and anomaly detection.

[0004] The contradiction between distributed and centralized approaches: relying solely on a centralized monitoring platform is insufficient to meet the performance requirements of large-scale networks, while a fully distributed solution lacks a global perspective and makes it difficult to perform unified optimization and resource allocation.

[0005] Insufficient real-time performance and intelligence: Existing network traffic monitoring tools have limitations in real-time performance, intelligent anomaly detection, and traffic scheduling optimization, and lack accurate detection and response to complex attacks and abnormal behaviors.

[0006] Resource utilization and coordination optimization: In multi-region and multi-node environments, how to dynamically adjust resource allocation to meet node needs while avoiding resource waste or uneven distribution is a key issue.

[0007] Lack of collaborative optimization mechanism: Traditional monitoring technologies mostly focus on local optimization and lack the ability to conduct collaborative optimization based on global features, making it difficult to adapt to complex cross-regional scenarios.

[0008] Traditional anomaly detection technologies typically rely on rule matching (such as threshold-based and pattern recognition-based detection methods), which are simple to implement and easy to deploy; they can provide effective detection for some common attack patterns (such as DDoS attacks). However, traditional methods are mostly based on pre-defined rules and are difficult to handle complex and unknown anomalies in network traffic. As network attack methods continue to evolve, rule matching methods are easily bypassed. Another approach is SDN (Software-Defined Networking) based traffic monitoring solutions. Although SDN manages traffic across the entire network through a centralized controller, allowing network administrators to visualize and monitor traffic globally and detect traffic fluctuations or anomalies promptly, SDN's centralized control model has limitations in distributed network environments. As the network scales, concentrating all traffic control and monitoring on a single controller can lead to performance bottlenecks, especially as traffic at edge nodes cannot be effectively monitored. Furthermore, the effectiveness of SDN depends on the network topology design; frequent changes or complex configurations in the network topology can increase management complexity.

[0009] Therefore, this invention proposes a multi-level management IPv6 traffic multi-functional monitoring platform. Summary of the Invention

[0010] This invention addresses the technical problems existing in the prior art by providing a multi-level management, multi-functional IPv6 traffic monitoring platform.

[0011] The technical solution of this invention to solve the above-mentioned technical problems is as follows: a multi-level managed IPv6 traffic multi-functional monitoring platform; including a data acquisition layer, a regional monitoring layer, a core analysis layer, a control and orchestration layer, and a feedback optimization layer;

[0012] The data acquisition layer is located at the network edge and is responsible for collecting real-time traffic data and performing preliminary traffic classification and anomaly detection.

[0013] The regional monitoring layer is distributed across various regions, and it constructs a regional traffic feature database by aggregating edge data, while simultaneously handling local traffic anomalies and executing response strategies.

[0014] The core analysis layer contains a core computing unit of a centralized platform, which optimizes the global AI model through federated learning, and introduces a dual-stream neural network to fuse global and personalized features, providing cross-regional collaborative monitoring and global optimization.

[0015] The control and orchestration layer provides dynamic resource allocation and strategy adjustment, coordinating the operation of global and regional nodes;

[0016] The feedback optimization layer combines digital twins and reinforcement learning to continuously optimize traffic scheduling and protection strategies.

[0017] Furthermore, in the aforementioned multi-level managed IPv6 traffic multi-functional monitoring platform, the preliminary traffic classification and anomaly detection include:

[0018] Traffic classification and filtering formulas:

[0019]

[0020] Where C i For the traffic classification results, F i It is the i-th edge node, P k (F i ) represents the probability of type k, and N is the probability of type k. i,k It is the number of traffic packets of type k in the i-th edge node, and the calculation formula is the proportion of the number of traffic packets of a certain type to the total number of packets in the edge node;

[0021] Anomaly detection formula:

[0022]

[0023] Where φ j (F i ) represents the flow characteristics, w j For weighted features, A(F) i ) indicates whether it is abnormal, and τ is the abnormal threshold.

[0024] Furthermore, the aforementioned multi-level managed IPv6 traffic multi-functional monitoring platform, which aggregates edge data to construct a regional traffic feature database and simultaneously handles local traffic anomalies and executes response strategies, includes:

[0025] Region feature vector construction:

[0026]

[0027] Among them, R A F is the aggregated flow feature vector of region A. i,k Let a be the feature vector of traffic type k in the i-th edge node. i W represents the node weight. i It is the amount of traffic data collected by the i-th edge node. It is the total collection weight;

[0028] Local anomaly detection:

[0029]

[0030] in Optimize the function for the objective. These are local AI model parameters, D

[0031] It is the feature database of the current region. For parameter-based The model's predicted values, For classification error, λ is the regularization term, and λ is the weight coefficient of the regularization term.

[0032] Furthermore, the multi-level management IPv6 traffic multi-functional monitoring platform, which optimizes the global AI model through federated learning and simultaneously introduces a dual-stream neural network to fuse global and personalized features, includes:

[0033] Initialization phase: The central server initializes model parameters, including the global feature extractor θ. h Personalized encoder θ e and classifier θ c The initialized model is a globally shared model;

[0034] Client-side data preparation: Each edge node holds a private dataset D i= {(x,y)}, where x is the traffic data feature and y is the corresponding label;

[0035] Federated learning optimization phase: The server selects some edge nodes to participate in training: m edge nodes are randomly selected to participate in the t-th round of training; each edge node receives global model parameters θ. h ,θ e ,θ c Update model parameters using local data; update model parameters and Uploaded to the central server;

[0036] The central server aggregates the parameters uploaded by the edge nodes and updates the global model;

[0037] Update global model parameters and Distribute to each edge node.

[0038] Furthermore, in the aforementioned multi-level managed IPv6 traffic multi-functional monitoring platform, the method of updating model parameters using local data includes:

[0039] Feature extractor extracts global features: H i =f h (X i ,θ h );

[0040] Personalized encoders extract personalized features: B i =f e (W i ,θ e );

[0041] Integrating global and personalized features:

[0042] where X i It is global traffic data, W i Where g is the label vector distribution, and g is the feature fusion function;

[0043] The classifier outputs a predicted value based on the fused features: The classifier outputs a prediction result based on the fused features;

[0044] Optimize the loss function:

[0045]

[0046] β is the cross-entropy loss function, used to measure the predicted value. The difference between the actual value y and the true value y;

[0047] Parameter updates are performed using gradient descent to update model parameters.

[0048]

[0049] The learning rate η controls the step size of the parameter update.

[0050] Furthermore, in the aforementioned multi-level managed IPv6 traffic multi-functional monitoring platform, the central server aggregates parameters uploaded by edge nodes and updates the global model, including...

[0051] Using a weighted average method:

[0052]

[0053] Where N i This represents the amount of data at edge node i, and m is the total number of edge nodes.

[0054] Furthermore, the multi-level management IPv6 traffic multi-functional monitoring platform, in which dynamic resource allocation and policy adjustment are coordinated to ensure the operation of global and regional nodes, includes:

[0055] By leveraging the global traffic characteristics generated by the core analysis layer, the resource requirements of each node are predicted using a time series forecasting model.

[0056] R(t)=G[F(t-1),F(t-2),...,F(tn)] T +b;

[0057] R(t) is the resource demand at time t, F(t-1) is the past global flow characteristics, and G and b are the parameters of the time series model.

[0058] Based on resource forecasting demand, dynamically adjust resource allocation for regions and edge nodes:

[0059] The optimization objective is to minimize the deviation in total resource usage and allocation:

[0060]

[0061] Where R i ′ is the predicted demand for node i, R i It's a real need, C i κ represents the cost of resource usage, and κ is the weight of the resource allocation deviation.

[0062] Furthermore, the multi-level management IPv6 traffic multi-functional monitoring platform, which combines digital twins and reinforcement learning to continuously optimize traffic scheduling and protection strategies, includes:

[0063] Construct a real-time virtual mapping of the global network to simulate the effects of different control strategies: Use the global network features and regional features generated by the core analysis layer to construct a digital twin model.

[0064]

[0065] DF(t) is the state of the digital twin model at time t, F global It is a global traffic characteristic, F regional,i Traffic characteristics of node i, Θ digital twin model parameters;

[0066] Simulate the impact of different strategies on global network performance in a digital twin model; optimize strategy selection through simulation.

[0067]

[0068] P(S,DF(t)) is the performance score of policy S in the Siamese model.

[0069] The beneficial effects of this invention are:

[0070] This invention employs a multi-level architecture design comprising a data acquisition layer, a regional monitoring layer, a core analysis layer, a control and orchestration layer, and a feedback optimization layer. This architecture efficiently integrates edge, regional, and global features, improving the overall efficiency of monitoring and management. It optimizes the global AI model through federated learning and utilizes a dual-stream neural network to fuse global and personalized features, balancing cross-regional collaborative optimization and localization adaptation needs. Through a layered architecture and the integration of multiple technologies, it balances distributed high-efficiency monitoring with centralized global optimization, solving the management challenges of large-scale IPv6 networks. Attached Figure Description

[0071] Figure 1 This is a schematic diagram of the structure of a multi-level IPv6 traffic monitoring platform. Detailed Implementation

[0072] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0073] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature specified as "first" or "second" may explicitly or implicitly include one or more of the described features. In the description of this application, "plurality" means two or more, unless otherwise specifically specified.

[0074] In the description of this application, the term "for example" is used to mean "used as an example, illustration or explanation". Any embodiment described as "for example" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any person skilled in the art to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art will recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes will not be elaborated in detail to avoid obscuring the description of the present invention with unnecessary details. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in this application.

[0075] In one embodiment, a multi-level managed IPv6 traffic multi-functional monitoring platform includes a data acquisition layer, a regional monitoring layer, a core analysis layer, a control and orchestration layer, and a feedback optimization layer.

[0076] The data acquisition layer is located at the network edge and is responsible for collecting real-time traffic data and performing preliminary traffic classification and anomaly detection.

[0077] The regional monitoring layer is distributed across various regions, and it constructs a regional traffic feature database by aggregating edge data, while simultaneously handling local traffic anomalies and executing response strategies.

[0078] The core analysis layer contains a core computing unit of a centralized platform, which optimizes the global AI model through federated learning, and introduces a dual-stream neural network to fuse global and personalized features, providing cross-regional collaborative monitoring and global optimization.

[0079] The control and orchestration layer provides dynamic resource allocation and strategy adjustment, coordinating the operation of global and regional nodes;

[0080] The feedback optimization layer combines digital twins and reinforcement learning to continuously optimize traffic scheduling and protection strategies.

[0081] In this embodiment, the functions and specific operations of each layer are as follows:

[0082] Data Acquisition Layer: Located at the edge node of the network, it is mainly responsible for collecting real-time traffic data and performing preliminary traffic classification and anomaly detection. This layer is located close to the network traffic source and can respond quickly to traffic changes.

[0083] Real-time traffic collection: Collects IPv6 traffic data from different devices or users, such as the source address, destination address, protocol type, and traffic size of data packets;

[0084] Preliminary traffic classification: Traffic data is categorized into different types (such as video streams, web traffic, IoT device traffic, etc.); this helps with subsequent traffic management and analysis.

[0085] Preliminary anomaly detection: Use simple algorithms to detect abnormal traffic, such as sudden traffic spikes (which could be due to a DDoS attack) or changes in specific traffic patterns.

[0086] Regional monitoring layer: Distributed across various regions, it is responsible for aggregating traffic data from different edge nodes, building a regional traffic feature database, and executing local traffic anomaly detection and response strategies;

[0087] Regional data aggregation: This involves summarizing and integrating traffic data collected at the data acquisition layer to generate a traffic characteristic database for the region. For example, it can be used to calculate the total traffic volume and traffic type for all nodes within a region.

[0088] Local anomaly detection: In the regional monitoring layer, in addition to monitoring global traffic, it is also possible to analyze traffic anomalies in specific regions. For example, a sudden surge in traffic in a certain region may indicate a network attack.

[0089] Response policy execution: When local traffic anomalies are detected, the preset response policy is executed, such as blocking malicious traffic, limiting traffic rate, or reallocating network resources.

[0090] The core analysis layer is the brain of the entire monitoring platform. It is responsible for optimizing the global AI model using federated learning through the core computing units of the centralized platform. Simultaneously, it combines a two-stream neural network to fuse global and personalized features, providing cross-regional collaborative monitoring and global optimization.

[0091] Federated learning: Traffic data from various regions and edge nodes is not directly uploaded to the central server, but is instead used for model training through federated learning. This protects data privacy while improving the optimization performance of the global AI model.

[0092] Dual-stream neural network: This network combines global network traffic characteristics (such as the traffic patterns of the entire network) with personalized characteristics (such as the behavioral characteristics of specific regions or nodes) to achieve more accurate traffic monitoring and anomaly detection.

[0093] Control and Orchestration Layer: Responsible for coordinating the operation of global and regional nodes, ensuring that network resources can be flexibly allocated as needed through dynamic resource allocation and policy adjustment to cope with changing traffic demands;

[0094] Dynamic resource allocation: Based on the global traffic characteristics generated by the core analysis layer, predict the resource requirements of each node, such as bandwidth and computing power, and dynamically allocate resources according to the prediction results.

[0095] Strategy Adjustment: Adjust the working strategies of regions and edge nodes based on real-time network conditions and policy requirements; for example, when traffic in a certain region increases, adjust network bandwidth or computing resources to adapt to traffic fluctuations.

[0096] Feedback Optimization Layer: Combining digital twins and reinforcement learning, this layer continuously optimizes traffic scheduling and protection strategies. Digital twin technology is used to build a virtual model of the network, simulating the effects of different control strategies; while reinforcement learning is used to continuously optimize and improve strategies based on the simulation results.

[0097] Digital twins: Creating virtual models of networks for real-time monitoring and prediction of network behavior. Simulating different traffic scheduling strategies and protection measures, evaluating their effectiveness; for example, building a real-time virtual network mapping to simulate the impact of a firewall policy on overall network traffic. Testing in virtual environments to identify the most suitable traffic scheduling scheme.

[0098] Reinforcement learning: Utilizing simulation results, reinforcement learning models continuously adjust and optimize strategies. For example, when network load is high, the system automatically optimizes protection strategies based on historical data and the current network state; based on historical network traffic and attack patterns, reinforcement learning models continuously adjust traffic scheduling strategies. For instance, when a certain type of attack is detected to occur frequently, the system optimizes protection strategies through reinforcement learning, thereby effectively preventing similar attacks.

[0099] In one embodiment, the primary task of the data acquisition layer is to achieve efficient collection, preliminary classification, and anomaly detection of IPv6 traffic through distributed probes (such as those based on eBPF or XDP technology). This process includes the following steps:

[0100] Real-time traffic capture: Monitor network interfaces and capture IPv6 packets, including IPv6 header information, protocol type, source address, destination address, and other fields. Data capture tools such as eBPF and XDP have kernel-level performance advantages, enabling data filtering and forwarding with low latency.

[0101] Traffic classification: This involves categorizing data packets based on characteristics such as protocol type, port number, and traffic direction. Classification tasks can be performed using statistical models or machine learning models.

[0102] Anomaly detection: Detect abnormal traffic using rule matching (such as access frequency, port scanning behavior) or machine learning models (such as traffic feature-based classifiers).

[0103] Edge computing: Initial data processing and feature extraction are completed locally on edge devices, reducing the amount of data transmitted to the upper layers and thus reducing the pressure on the core network.

[0104] Traffic classification and filtering formulas:

[0105]

[0106] Where C i For the traffic classification results, F i It is the i-th edge node, P k (F i ) represents the probability of type k, and N is the probability of type k. i,k It is the number of traffic packets of type k in the i-th edge node, and the calculation formula is the proportion of the number of traffic packets of a certain type to the total number of packets in the edge node;

[0107] Anomaly detection formula:

[0108]

[0109] Among them, S(F i ) is the edge node F i Abnormal scores, φ j (F i ) represents the flow characteristics, w j For weighted features, A(F) i ) represents whether it is abnormal, τ is the abnormality threshold, and the detection result is S(F) i If ) > τ, then determine if data packet F i An anomaly exists.

[0110] In one embodiment, the core task of the regional monitoring layer includes constructing feature vectors from data from multiple edge nodes and performing local anomaly detection based on these feature vectors to assist the federated learning model in optimizing global and regional traffic trends.

[0111] Region feature vector construction:

[0112]

[0113] Among them, R A F is the aggregated flow feature vector of region A. i,k Let a be the feature vector of traffic type k in the i-th edge node. i W represents the node weight. i It is the amount of traffic data collected by the i-th edge node. It is the total collection weight;

[0114] Local anomaly detection:

[0115]

[0116] in Optimize the function for the objective. These are local AI model parameters, D

[0117] It is the feature database of the current region. For parameter-based The model's predicted values, For classification error, λ is the regularization term, and λ is the weight coefficient of the regularization term.

[0118] In one embodiment, the step of optimizing the global AI model through federated learning while introducing a two-stream neural network to fuse global and personalized features includes:

[0119] Initialization phase: The central server initializes model parameters, including the global feature extractor θ. h Personalized encoder θ e and classifier θ c The initialized model is a globally shared model;

[0120] Client-side data preparation: Each edge node holds a private dataset D i = {(x,y)}, where x is the traffic data feature and y is the corresponding label;

[0121] Federated learning optimization phase: The server selects some edge nodes to participate in training: m edge nodes are randomly selected to participate in the t-th round of training; each edge node receives global model parameters θ. h ,θ e ,θ c Update model parameters using local data; update model parameters and Uploaded to the central server;

[0122] The central server aggregates the parameters uploaded by the edge nodes and updates the global model;

[0123] Update global model parameters and Distribute to each edge node.

[0124] The method of updating model parameters using local data includes:

[0125] Feature extractor extracts global features: H i =f h (X i,θ h );

[0126] Personalized encoders extract personalized features: B i =f e (W i ,θ e );

[0127] Integrating global and personalized features:

[0128] where X i It is global traffic data, W i Where g is the label vector distribution, and g is the feature fusion function;

[0129] The classifier outputs a predicted value based on the fused features: The classifier outputs a prediction result based on the fused features;

[0130] Optimize the loss function:

[0131]

[0132] β is the cross-entropy loss function, used to measure the predicted value. The difference between the actual value y and the true value y;

[0133] Parameter updates are performed using gradient descent to update model parameters.

[0134]

[0135] The learning rate η controls the step size of the parameter update.

[0136] The central server aggregates the parameters uploaded by the edge nodes and updates the global model accordingly.

[0137] Using a weighted average method:

[0138]

[0139] Where N i This represents the amount of data at edge node i, and m is the total number of edge nodes.

[0140] Specific example: Suppose an IPv6 network has the following data traffic scenario:

[0141] A company has multiple subnets (subnet A, subnet B, and subnet C); these subnets are connected to the Internet through different edge nodes; suppose an attacker launches a DDoS attack on the company network through a botnet, targeting a certain web service (target IP address: 2001:db8::1), with attack traffic mainly consisting of UDP requests, 10,000 packets per second, randomly sent from multiple IP addresses; at the same time, subnets A and B are also running HTTP (TCP) traffic normally, and an internal user in subnet C is uploading a large amount of video data.

[0142] Data Acquisition Layer: Real-time Traffic Acquisition and Preliminary Detection

[0143] Deploy eBPF or XDP probes at the edge nodes of each subnet to capture and initially process traffic:

[0144] Subnet A: Traffic collected: 80% is HTTP traffic (TCP, destination port 80 / 443), 20% is abnormal UDP requests, destination address 2001:db8::1;

[0145] Preliminary classification: P A,TCP =0.8,P A,UDP =0.2;

[0146] Preliminary anomaly detection: UDP traffic frequency characteristic 2000 times / second, port concentration characteristic 1; Anomaly score calculation:

[0147] S A =0.2*2000+0.3*1=1400.3;

[0148] If the threshold is set to 1000, then subnet A is judged to have abnormal traffic.

[0149] Subnet B: Traffic collected: 60% is HTTP traffic. 40% is abnormal UDP requests, destination address 2001:db8::1.

[0150] Classification and Detection: P B,TCP =0.6, P B,UDP =0.4;

[0151] S B =0.6*4000+0.4*1=2400.3;

[0152] Subnet C: Traffic collected: 50% is video streams uploaded by internal users (TCP, destination address is the data center). 50% is abnormal UDP requests.

[0153] Classification and Detection: P C,TCP =0.5,P C,UDP =0.5

[0154] S C =0.5*5000+0.5*1=2500.3;

[0155] Regional monitoring layer: Feature vector construction and local anomaly detection; The regional monitoring layer receives the statistical results of each edge node, performs data aggregation and regional feature vector construction.

[0156] Region feature vector construction: Assume the total traffic of edge nodes is D. A =10000, D B =10000 and D C =10000, then the node weight is:

[0157] W B =0.33, D C =0.33;

[0158] Region feature vector: F = 0.33(0.8,0.2) + 0.33(0.6,0.4) + 0.33(0.5,0.5) = [0.63,0.37];

[0159] Local anomaly detection: Utilizing a local AI model to detect abnormal traffic behavior in a given area. Objective optimization function:

[0160] Assume the regional model detects an abnormal UDP traffic percentage P. UDP =0.37 is higher than the normal threshold of 0.2, indicating abnormal regional traffic; the regional monitoring layer uploads these abnormal detection results and regional characteristics to the core analysis layer.

[0161] Core analysis layer: Optimizes the global AI model through federated learning and combines it with a two-stream neural network for feature fusion and analysis.

[0162] Federated learning optimizes the global model: model parameters include the feature extractor: H i =f h (X i ,θ h Personalized encoder: B i =f e (W i ,θ e Feature fusion:

[0163] Classifier prediction: The classifier outputs a prediction result based on the fused features;

[0164] Optimize the loss function:

[0165]

[0166] β is the cross-entropy loss function, used to measure the predicted value. The difference between the actual value y and the true value y;

[0167] Parameter updates are performed using gradient descent to update model parameters.

[0168]

[0169] Global features: Extract macro-level patterns from traffic across all regions (e.g., surges in UDP traffic across multiple regions); Personalized features: Analyze the individual characteristics of subnets A, B, and C (e.g., high video traffic proportion in subnet C);

[0170] The core analysis layer identifies the characteristics of abnormal UDP traffic (such as target address 2001:db8::1 and random source address) and determines it to be a DDoS attack.

[0171] During the federal learning phase:

[0172] Suppose that the central server randomly selects all three edge nodes (nodes A, B, and C) to participate in the training;

[0173] Initialize global model parameters: θ h ,θ e ,θ c These parameters are shared among all edge nodes.

[0174] Each edge node holds private data (x) i ,y i ), x i It is a flow characteristic, y i It's a label; each node updates its local model parameters when it receives model parameters:

[0175] Feature extractor: H i =f h (X i ,θ h );

[0176] Personalized encoder: B i =f e (W i ,θ e );

[0177] For example, the global feature and personalized encoding of node A are: H A =f h ([2000,0.9],θ h );B A =f e ([2000,0.9],θ e )

[0178] Feature fusion: This is a weighted average, with weights of 0.6 and 0.4 respectively.

[0179] The classifier outputs a predicted value based on the fused features:

[0180] The error between the predicted value and the true label is calculated using the cross-entropy loss function:

[0181]

[0182] Assumption y A =0 then:

[0183] L A =-(0*log(0.2)+(1-0)*log(1-0.2))=0.223;

[0184] Parameter update, assuming a learning rate of 0.01:

[0185] Each node uploads the updated parameters and the amount of node data N.

[0186] The central server updates the global model using a weighted average based on uploaded parameters and data volume.

[0187] Example: Node A has 1000 data entries, node B has 1500 data entries, and node C has 2000 data entries.

[0188] Assumption

[0189] Global update to:

[0190]

[0191] The updated global model parameters are distributed to each edge node, and the next round of training begins.

[0192] In one embodiment, the dynamic resource allocation and strategy adjustment, coordinating the operation of global and regional nodes, includes:

[0193] By leveraging the global traffic characteristics generated by the core analysis layer, the resource requirements of each node are predicted using a time series forecasting model.

[0194] R(t)=G[F(t-1),F(t-2),...,F(tn)] T +b;

[0195] R(t) is the resource demand at time t, F(t-1) is the past global flow characteristics, and G and b are the parameters of the time series model.

[0196] Based on resource forecasting demand, dynamically adjust resource allocation for regions and edge nodes:

[0197] The optimization objective is to minimize the deviation in total resource usage and allocation:

[0198]

[0199] Where R i ′ is the predicted demand for node i, R i It's a real need, C i κ represents the cost of resource usage, and κ is the weight of the resource allocation deviation.

[0200] In this embodiment, global traffic characteristics of the network are obtained from the core analysis layer. These characteristics provide input data for the prediction model, ensuring that the model can capture dynamic changes in the network. Based on historical global traffic characteristics, a time series prediction model is used to predict the resource requirements of each node in the future. According to the predicted resource requirements, computing resources, storage resources, or bandwidth are dynamically allocated to regional and edge nodes. The optimized resource allocation scheme is applied to regional and edge nodes of the network, and the allocation effect is monitored in real time. The dynamic resource allocation and strategy adjustment technology, through the combination of time series prediction and optimization objective function, achieves accurate resource demand prediction and efficient resource allocation. This technology can significantly improve network resource utilization and performance, adapt to complex network environment requirements, and reduce resource usage costs.

[0201] In one embodiment, the method of continuously optimizing traffic scheduling and protection strategies by combining digital twins and reinforcement learning includes:

[0202] Construct a real-time virtual mapping of the global network to simulate the effects of different control strategies: Use the global network features and regional features generated by the core analysis layer to construct a digital twin model.

[0203]

[0204] DF(t) is the state of the digital twin model at time t, F global It is a global traffic characteristic, F regional,i Traffic characteristics of node i, Θ digital twin model parameters;

[0205] Simulate the impact of different strategies on global network performance in a digital twin model; optimize strategy selection through simulation.

[0206]

[0207] P(S,DF(t)) is the performance score of policy S in the Siamese model.

[0208] In this embodiment, the physical state of the network (global traffic, node characteristics, etc.) is mapped to a virtual model to achieve real-time monitoring and prediction. By training and updating the model, the effects of different strategies can be simulated in the virtual space, avoiding the risks of testing directly in the real network, achieving global and local collaborative optimization, and improving traffic scheduling efficiency and the effectiveness of protection strategies.

[0209] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0210] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A multi-level management IPv6 traffic multi-functional monitoring platform, characterized in that, It includes a data acquisition layer, a regional monitoring layer, a core analysis layer, a control and orchestration layer, and a feedback optimization layer; The data acquisition layer is located at the network edge and is responsible for collecting real-time traffic data and performing preliminary traffic classification and anomaly detection. The regional monitoring layer is distributed across various regions, and it constructs a regional traffic feature database by aggregating edge data, while simultaneously handling local traffic anomalies and executing response strategies. The core analysis layer contains a core computing unit of a centralized platform, which optimizes the global AI model through federated learning, and introduces a dual-stream neural network to fuse global and personalized features, providing cross-regional collaborative monitoring and global optimization. The control and orchestration layer provides dynamic resource allocation and strategy adjustment, coordinating the operation of global and regional nodes; The feedback optimization layer combines digital twins and reinforcement learning to continuously optimize traffic scheduling and protection strategies; The process of optimizing the global AI model through federated learning, while simultaneously introducing a two-stream neural network to fuse global and personalized features, includes: Initialization phase: The central server initializes model parameters, including the global feature extractor θ. h Personalized encoder θ e and classifier θ c The initialized model is a globally shared model; Client-side data preparation: Each edge node holds a private dataset D i = {(x,y)}, where x is the traffic data feature and y is the corresponding label; Federated learning optimization phase: The server selects some edge nodes to participate in training: m edge nodes are randomly selected to participate in the t-th round of training; each edge node receives global model parameters θ. h ,θ e ,θ c Update model parameters using local data; update model parameters and Uploaded to the central server; The central server aggregates the parameters uploaded by the edge nodes and updates the global model; Update global model parameters Distribute to each edge node; The method of updating model parameters using local data includes: Feature extractor extracts global features: H i =f h (X i ,θ h ); Personalized encoders extract personalized features: B i =f e (W i ,θ e ); Integrating global and personalized features: where X i It is global traffic data, W i Where g is the label vector distribution, and g is the feature fusion function; The classifier outputs a predicted value based on the fused features: The classifier outputs a prediction result based on the fused features, f h f represents the feature extraction function for the district / bureau. c For the classifier function, f e For personalized encoding functions; Optimize the loss function: β is the cross-entropy loss function, used to measure the predicted value. The difference between the actual value y and the true value y; Parameter updates are performed using gradient descent to update model parameters. The learning rate η controls the step size for updating the parameter. The central server aggregates the parameters uploaded by the edge nodes and updates the global model using a weighted average method: Where N i This represents the amount of data at edge node i, and m is the total number of edge nodes.

2. The multi-level management IPv6 traffic multi-functional monitoring platform according to claim 1, characterized in that, The preliminary traffic classification and anomaly detection include: Traffic classification and filtering formulas: Where C i For the traffic classification results, F i It is the i-th edge node, P k (F i ) represents the probability of type k, and N is the probability of type k. i,k N is the number of traffic packets of type k in the i-th edge node. i The total number of data packets in the i-th edge node is calculated as the proportion of a certain type of traffic data packets to the total number of data packets in the edge node. Anomaly detection formula: Where φ j (F i ) represents the flow characteristics, w j For weighted features, A(F) i ) indicates whether it is abnormal, τ is the abnormal threshold, n represents the number of traffic features, and I represents the state.

3. The multi-level management IPv6 traffic multi-functional monitoring platform according to claim 1, characterized in that, The process of constructing a regional traffic feature database by aggregating edge data, while simultaneously handling local traffic anomalies and executing response strategies, includes: Region feature vector construction: Among them, R A F is the aggregated flow feature vector of region A. i,k Let a be the feature vector of traffic type k in the i-th edge node. i W represents the node weight. i It is the amount of traffic data collected by the i-th edge node. It is the total collection weight; Local anomaly detection: Among them Objective optimization function, These are the local AI model parameters, and D is the feature database for the current region. For parameter-based The model's predicted values, For classification error, λ is the regularization term, λ is the weight coefficient of the regularization term, and x and y are the input features and classification results, respectively.

4. The multi-level management IPv6 traffic multi-functional monitoring platform according to claim 1, characterized in that, The dynamic resource allocation and strategy adjustment, coordinating the operation of global and regional nodes, includes: By leveraging the global traffic characteristics generated by the core analysis layer, the resource requirements of each node are predicted using a time series forecasting model. R(t)=G[F(t-1),F(t-2),...,F(t-n)] T +b; R(t) is the resource demand at time t, F(t-1) is the past global flow characteristics, and G and b are the parameters of the time series model. Based on resource forecasting demand, dynamically adjust resource allocation for regions and edge nodes: The optimization objective is to minimize the deviation in total resource usage and allocation: Where R′ i R is the predicted demand for node i. i It's a real need, C i κ represents the cost of resource usage, and κ is the weight of the resource allocation deviation.

5. The multi-level management IPv6 traffic multi-functional monitoring platform according to claim 1, characterized in that, The method of continuously optimizing traffic scheduling and protection strategies by combining digital twins and reinforcement learning includes: Construct a real-time virtual mapping of the global network to simulate the effects of different control strategies: Use the global network features and regional features generated by the core analysis layer to construct a digital twin model. DF(t) is the state of the digital twin model at time t, F global It is a global traffic characteristic, F regional,i Traffic characteristics of node i, Θ digital twin model parameters; Simulate the impact of different strategies on global network performance in a digital twin model; optimize strategy selection through simulation. P(S,DF(t)) is the performance score of policy S in the Siamese model.

Images