Real-time flow analysis method and system for network routing

Abstract

The invention relates to the technical field of network routing, and provides a real-time traffic analysis method and system for network routing, and the method comprises the steps: obtaining a network data packet of the network routing, carrying out the data preprocessing, generating a traffic event atlas, generating a dynamic threat score, carrying out the feature extraction of the traffic event atlas, and generating a behavior abnormality matrix; analyzing the abnormal behavior matrix and the dynamic threat score, generating an initial network routing strategy, and analyzing the initial network routing strategy to obtain network performance and security evaluation indexes; and adjusting the network routing based on the evaluation index to obtain an adjustment strategy, carrying out iterative optimization on the adjustment strategy to obtain a target network routing strategy, and carrying out forwarding processing on the network data packet based on the target network routing strategy to obtain a real-time flow analysis result of the network routing. Through the above scheme, real-time, dynamic and accurate analysis of the network traffic is realized, and the problems of low detection precision, slow response speed and lack of real-time adjustment capability in a highly dynamic and complex network environment are improved.

Description

Technical Field

[0001] The present application relates to the technical field of network routing, and in particular to a real-time traffic analysis method and system for network routing. Background Art

[0002] With the rapid development of the Internet and communication technologies, the management and optimization of network traffic has become a very challenging and important field. Whether it is an enterprise, a public institution or an ordinary user, the stability and security of the network are directly related to the daily operation and information security. In particular, in the face of increasingly complex and diverse network threats, how to effectively perform real-time traffic analysis on network routing has become a core issue in network management.

[0003] Among the related technical means, the network traffic analysis method mainly relies on data packet capture and static rule matching. By capturing and preprocessing network data packets, they are input into the traffic analysis system to detect and classify network traffic. Such a method can achieve preliminary classification of normal traffic, suspicious traffic and abnormal traffic, and provide network administrators with basic network traffic status reports, thereby improving the efficiency and security of network management to a certain extent.

[0004] Regarding the above technical solutions, although traffic classification and threat detection can be preliminarily achieved through static rule matching and data packet analysis, there are problems such as low detection accuracy, slow response speed and lack of real-time adjustment capabilities when facing a highly dynamic and complex network environment. Summary of the invention

[0005] In order to improve the problems of low detection accuracy, slow response speed and lack of real-time adjustment capability in the face of highly dynamic and complex network environments, the present application provides a real-time traffic analysis method and system for network routing.

[0006] The present invention provides a real-time traffic analysis method for network routing, comprising: obtaining a network data packet of the network routing, performing data preprocessing on the network data packet to obtain parsed data; inputting the parsed data into a preset traffic analysis model to obtain a preliminary traffic analysis result, classifying the preliminary traffic analysis result to obtain normal traffic, suspicious traffic and abnormal traffic; performing correlation analysis and pattern evolution tracking on the suspicious traffic and abnormal traffic through cluster analysis and graph theory algorithms to generate a traffic event map, generating a dynamic threat score based on the traffic event map, performing feature extraction on the traffic event map using a convolutional neural network to obtain extracted features, and generating a behavior anomaly matrix based on the extracted features; analyzing the behavior anomaly matrix and the dynamic threat score using a fuzzy logic algorithm, generating an initial network routing strategy based on the analysis result, analyzing the initial network routing strategy using a time series analysis algorithm to obtain network performance and security evaluation indicators; adjusting the network routing based on the evaluation indicators to obtain an adjustment strategy, iteratively optimizing the adjustment strategy using a reinforcement learning algorithm to obtain a target network routing strategy; forwarding the network data packet using the target network routing strategy to obtain a real-time traffic analysis result for the network routing.

[0007] As a preferred solution, the steps of obtaining network data packets of network routes, performing data preprocessing on the network data packets, and obtaining parsed data include: parsing the network data packets through deep packet inspection, extracting packet header information and data payload, detecting the packet header information using an anomaly detection algorithm, and generating a packet header anomaly identifier; converting the data payload into analyzable feature data through a natural language processing algorithm, performing noise filtering and format standardization on the feature data using a data cleaning algorithm, and obtaining a data feature set; streamlining the data feature set according to a feature selection algorithm to obtain parsing features, integrating the packet header anomaly identifier and high-correlation parsing features, and generating parsed data.

[0008] As a preferred solution, the step of inputting the parsed data into a preset traffic analysis model to obtain preliminary traffic analysis results, classifying the preliminary traffic analysis results, and obtaining normal traffic, suspicious traffic, and abnormal traffic includes: performing preliminary analysis on the parsed data through a machine learning model to obtain a basic traffic feature vector, performing time window aggregation on the basic traffic feature vector using an aggregation function, and generating a time series feature matrix; classifying the time series feature matrix using a classifier combination method to obtain a preliminary traffic label set, performing correlation analysis on the preliminary traffic label set with historical traffic patterns, and identifying traffic deviation integrals; marking the preliminary traffic analysis results according to the traffic deviation integral to obtain an updated traffic label set, performing multi-category classification on the updated traffic label set through a support vector machine, and generating normal traffic, suspicious traffic, and abnormal traffic.

[0009] As a preferred solution, the steps of performing correlation analysis and pattern evolution tracking on the suspicious traffic and abnormal traffic through cluster analysis and graph theory algorithms to generate a traffic event map, generating a dynamic threat score based on the traffic event map, extracting features from the traffic event map using a convolutional neural network to obtain extracted features, and generating a behavior anomaly matrix based on the extracted features include: performing cluster analysis on the suspicious traffic and the abnormal traffic through a clustering algorithm to obtain a traffic cluster set, constructing a traffic association graph based on the traffic cluster set using a graph theory algorithm to generate a traffic event map; performing node association evaluation on the traffic event map using connectivity analysis to obtain a node association matrix, applying a dynamic weighted scoring method to the node association matrix to generate a dynamic threat score; performing feature extraction on nodes and edges in the traffic event map using a convolutional neural network to obtain a feature vector; and generating a behavior anomaly matrix based on the feature vector and the dynamic threat score using matrix decomposition technology.

[0010] As a preferred solution, the steps of analyzing the abnormal behavior matrix and the dynamic threat score using a fuzzy logic algorithm, generating an initial network routing strategy based on the analysis results, and analyzing the initial network routing strategy using a time series analysis algorithm to obtain network performance and security evaluation indicators include: inputting the abnormal behavior matrix into a fuzzy logic algorithm to obtain a fuzzy threat metric, applying fuzzy aggregation rules based on the fuzzy threat metric and the dynamic threat score to generate a threat assessment index; performing decision reasoning on the threat assessment index through a decision rule library to obtain an initial network routing strategy, performing multi-scale sequence analysis on the initial network routing strategy using a time series analysis algorithm to obtain sequence results; performing trend prediction on the sequence results using a preset historical data prediction model to generate performance prediction indicators, and performing comprehensive analysis on the performance prediction indicators through multivariate regression analysis to generate network performance and security evaluation indicators.

[0011] As a preferred scheme, the steps of adjusting the network routing based on the network performance and the security assessment index to obtain an adjustment strategy, iteratively optimizing the adjustment strategy using a reinforcement learning algorithm to obtain a target network routing strategy include: setting an initial environmental state according to the network performance and the security assessment index, adjusting the network routing according to the initial environmental state using an adjustment rule generator to obtain an adjustment strategy; performing policy iteration on the adjustment strategy using a policy gradient algorithm to obtain an adjustment optimization path, performing value iteration calculation on the adjustment optimization path through value function evaluation to generate a value strategy; and updating the value strategy using a reinforcement learning algorithm in combination with a preset policy exploration mechanism, and using the updated value strategy as the target network routing strategy.

[0012] As a preferred solution, the step of forwarding the network data packet using the target network routing policy to obtain real-time traffic analysis results of the network routing includes: generating a routing decision cache table based on the target network routing policy, and using a hash algorithm to map the network data packet to a specific routing rule in the routing decision cache table; updating and matching the specific routing rules in real time through a dynamic routing protocol to obtain routing path information; optimizing and selecting the routing path information using a path optimization algorithm to generate an optimal path set, using a packet forwarding engine to perform path selection and queue scheduling for the network data packet according to the optimal path set, and continuously monitoring network status parameters to obtain network status monitoring results; dynamically adjusting the path selection according to the network status monitoring results to obtain a path decision; delivering the network data packet to the target node based on the path decision to generate real-time traffic analysis results of the network routing.

[0013] The present application also provides a real-time traffic analysis system for network routing, including: an acquisition unit, used to acquire network data packets of network routing, perform data preprocessing on the network data packets, and obtain parsed data; a classification unit, used to input the parsed data into a preset traffic analysis model, obtain preliminary traffic analysis results, classify the preliminary traffic analysis results, and obtain normal traffic, suspicious traffic, and abnormal traffic; an extraction unit, used to perform correlation analysis and pattern evolution tracking on the suspicious traffic and abnormal traffic through cluster analysis and graph theory algorithms, generate a traffic event map, generate a dynamic threat score based on the traffic event map, and use a convolutional neural network to perform feature extraction on the traffic event map to obtain to extract features, and generate a behavior anomaly matrix based on the extracted features; a generating unit, used to analyze the behavior anomaly matrix and the dynamic threat score by using a fuzzy logic algorithm, and generate an initial network routing strategy based on the analysis results, and analyze the initial network routing strategy by using a time series analysis algorithm to obtain network performance and security evaluation indicators; an optimizing unit, used to adjust the network routing based on the evaluation indicators to obtain an adjustment strategy, and iteratively optimize the adjustment strategy by using a reinforcement learning algorithm to obtain a target network routing strategy; an analyzing unit, used to forward the network data packet by using the target network routing strategy to obtain a real-time traffic analysis result of the network routing.

[0014] Compared with the prior art, the present application has the following beneficial effects: high detection accuracy and fast response speed. The parsed data is obtained by acquiring network data packets and performing data preprocessing. The parsed data is then input into the preset traffic analysis model to obtain preliminary traffic analysis results, and the results are classified into normal traffic, suspicious traffic, and abnormal traffic. For suspicious traffic and abnormal traffic, cluster analysis and graph theory algorithms are used to perform correlation analysis and pattern evolution tracking to generate a traffic event map, and a dynamic threat score is generated based on the traffic event map. The convolutional neural network is used to extract features from the traffic event map to generate a behavior anomaly matrix. The fuzzy logic algorithm is used to analyze the behavior anomaly matrix and the dynamic threat score to generate an initial network routing strategy, which is analyzed by a time series analysis algorithm to obtain network performance and security evaluation indicators. Based on the evaluation indicators, the network routing is adjusted to obtain an adjustment strategy, which is iteratively optimized by a reinforcement learning algorithm to finally form a target network routing strategy. The target network routing strategy is used to forward and process network data packets to obtain real-time traffic analysis results of the network routing, realizing real-time, dynamic and accurate analysis of network traffic, providing a comprehensive and effective solution for network security and management, and improving the problems of low detection accuracy, slow response speed, and lack of real-time adjustment capabilities in the face of highly dynamic and complex network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0016] The structures, proportions, sizes, etc. illustrated in the drawings of this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with this technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantive technical significance. Any structural modification, change in proportion or adjustment of size, without affecting the effects and purposes that can be achieved by the present invention, should still fall within the scope of the technical contents disclosed by the present invention.

[0017] Figure 1 It is a flow chart of a real-time traffic analysis method for network routing provided by an embodiment of the present invention; Figure 2 It is a schematic block diagram of the structure of a real-time traffic analysis system for network routing provided by an embodiment of the present invention.

[0018] Description of reference numerals: 10. Real-time traffic analysis system for network routing; 11. Acquisition unit; 12. Classification unit; 13. Extraction unit; 14. Generation unit; 15. Optimization unit; 16. Analysis unit. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0021] It should also be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0022] It should be further understood that the term “and / or” used in the specification and appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0023] The technical solution of the present invention is further described below with reference to the accompanying drawings and through specific implementation methods.

[0024] Embodiment 1: like Figure 1 As shown, the real-time traffic analysis method for network routing provided in the embodiment of the present application includes steps S100 to S600.

[0025] Step S100: Acquire a network data packet of a network route, perform data preprocessing on the network data packet, and obtain parsed data.

[0026] In this step, firstly, a packet capture tool is used to obtain network packets routed through the network, and data preprocessing is performed on them; specifically, by parsing the header information and payload data of the network packets, useful information such as source address, destination address, protocol type and timestamp is extracted to obtain parsed data.

[0027] For example, using tools such as Wireshark to perform packet capture and analysis, the captured raw packets are converted into processable parsed data.

[0028] Step S200: input the parsed data into a preset traffic analysis model to obtain preliminary traffic analysis results, classify the preliminary traffic analysis results to obtain normal traffic, suspicious traffic and abnormal traffic.

[0029] In this step, the parsed data is input into a pre-trained traffic analysis model for processing; specifically, the parsed data is analyzed by the traffic analysis model to generate preliminary traffic analysis results, and the traffic is divided into normal traffic, suspicious traffic and abnormal traffic according to preset classification rules.

[0030] For example, machine learning algorithms such as support vector machines (SVM) or random forest algorithms are used to classify and detect parsed data.

[0031] Step S300: Perform correlation analysis and pattern evolution tracking on suspicious traffic and abnormal traffic through cluster analysis and graph theory algorithms to generate a traffic event map, generate a dynamic threat score based on the traffic event map, extract features from the traffic event map using a convolutional neural network to obtain extracted features, and generate a behavior anomaly matrix based on the extracted features.

[0032] In this step, the classified suspicious traffic and abnormal traffic are further analyzed in depth; specifically, the suspicious traffic and abnormal traffic are grouped through cluster analysis, and the traffic event map is constructed through graph theory algorithm to generate the correlation between each traffic event, and the dynamic threat score is calculated based on the traffic event map. The generated traffic event map is extracted using a convolutional neural network to obtain the extracted features, and a behavior anomaly matrix is ​​generated based on the extracted features.

[0033] For example, the K-means clustering method is used to group suspicious traffic, the traffic event map is constructed through the PageRank algorithm, and deep learning technology is used to extract features from the map.

[0034] Step S400: Analyze the behavior anomaly matrix and dynamic threat score using a fuzzy logic algorithm, generate an initial network routing strategy based on the analysis results, and analyze the initial network routing strategy using a time series analysis algorithm to obtain network performance and security evaluation indicators.

[0035] In this step, the behavior anomaly matrix and dynamic threat score are comprehensively analyzed using fuzzy logic algorithms; specifically, the input data is fuzzified through fuzzy logic rules to generate an initial network routing strategy. Then, the initial network routing strategy is analyzed through a time series analysis algorithm to obtain network performance and security evaluation indicators.

[0036] For example, the behavior anomaly matrix is ​​processed using a fuzzy logic controller, and the network routing strategy is evaluated using an ARIMA time series model.

[0037] Step S500: adjusting the network routing based on the evaluation index to obtain an adjustment strategy, and iteratively optimizing the adjustment strategy using a reinforcement learning algorithm to obtain a target network routing strategy.

[0038] In this step, the existing network routing strategy is adjusted based on the evaluation indicators; specifically, the corresponding adjustment strategy is formulated according to the network performance and security evaluation indicators, and the adjustment strategy is iteratively optimized through the reinforcement learning algorithm to finally obtain the target network routing strategy.

[0039] For example, the Q-learning algorithm is used to train and optimize the adjustment strategy to ensure that the target network routing strategy can work effectively in different network environments.

[0040] Step S600: forwarding the network data packet using the target network routing strategy to obtain a real-time traffic analysis result of the network routing.

[0041] In this step, the network data packets are forwarded according to the optimized target network routing strategy; specifically, the target network routing strategy is applied to the actual network data packet forwarding process, the network traffic is monitored and analyzed in real time, and the real-time traffic analysis results of the network routing are obtained.

[0042] For example, deploy optimized network routing policies on routers to process and monitor every network data packet passing through in real time to ensure the normal operation and security of the network.

[0043] In this embodiment, the parsed data is obtained by acquiring network data packets and performing data preprocessing, and then the parsed data is input into a preset traffic analysis model to generate preliminary traffic analysis results. Next, the preliminary traffic analysis results are classified into normal traffic, suspicious traffic, and abnormal traffic. Through cluster analysis and graph theory algorithms, correlation analysis and pattern evolution tracking are performed on suspicious traffic and abnormal traffic to generate a traffic event map, and a dynamic threat score is generated based on the traffic event map. Then, a convolutional neural network is used to extract features from the traffic event map to generate a behavior anomaly matrix. Finally, a fuzzy logic algorithm is used to analyze the behavior anomaly matrix and dynamic threat score to generate an initial network routing strategy, and the network performance and security evaluation indicators are optimized by a time series analysis algorithm. Based on this, the network routing is adjusted and the strategy is iteratively optimized and adjusted by a reinforcement learning algorithm, and finally the target network routing strategy is obtained to achieve network data packet forwarding processing and real-time traffic analysis.

[0044] By comprehensively using convolutional neural networks, fuzzy logic algorithms, cluster analysis, graph theory algorithms and reinforcement learning algorithms, real-time, dynamic and intelligent analysis of network traffic is achieved. By generating traffic event maps and dynamic threat scores, normal traffic, suspicious traffic and abnormal traffic can be accurately identified and classified, effectively improving the accuracy of network threat detection. At the same time, based on the behavior anomaly matrix and optimized network routing strategy, network routing can be quickly responded and adjusted, thereby improving the security and performance of the network, providing a comprehensive and effective network traffic analysis solution to improve the problems of low detection accuracy, slow response speed and lack of real-time adjustment capabilities in the face of highly dynamic and complex network environments.

[0045] Embodiment 2: In step S100, the network data packet is parsed through deep packet inspection to extract the packet header information and data payload, and the packet header information is detected using an anomaly detection algorithm to generate a packet header anomaly mark.

[0046] By using deep packet inspection technology to parse network data packets, the packet header information and data payload are extracted; specifically, the parsed packet header information includes the source address, destination address, protocol type and packet length, etc. The packet header information is analyzed through the anomaly detection algorithm, abnormal packet headers are detected and identified, and a packet header anomaly identifier is generated.

[0047] For example, common anomaly detection algorithms such as Isolation Forest are used to detect packet header information and generate anomaly markers to identify potential security threats.

[0048] The data load is converted into analyzable feature data through a natural language processing algorithm, and the feature data is filtered out and formatted using a data cleaning algorithm to obtain a data feature set.

[0049] During the parsing process, the data payload content is converted into analyzable feature data; specifically, a natural language processing algorithm is used to extract features from the text information in the data payload, and a data cleaning algorithm is used to filter noise and standardize the format of the extracted feature data to eliminate redundant information and inconsistencies in the data.

[0050] For example, the TF-IDF algorithm is used to extract text features in the data load, and the feature data is made consistent through standardization.

[0051] The data feature set is streamlined according to the feature selection algorithm to obtain the analytical features, and the packet header anomaly identification and high-correlation analytical features are integrated to generate analytical data.

[0052] By streamlining the data feature set, highly relevant feature data is retained; specifically, a feature selection algorithm is applied to screen the feature data, low-relevance or redundant features are removed, and the packet header anomaly identifier is integrated with the screened highly relevant feature data to generate the final parsed data.

[0053] For example, the recursive feature elimination (RFE) algorithm is used to filter feature data and integrate packet header anomaly identifiers to generate comprehensive parsed data.

[0054] In step S200, the parsed data is preliminarily analyzed through a machine learning model to obtain a basic traffic feature vector, and the basic traffic feature vector is aggregated in a time window using an aggregation function to generate a time series feature matrix.

[0055] The parsed data is preliminarily analyzed by using a machine learning model; specifically, the parsed data is input into a preset machine learning model to generate basic traffic feature vectors, and these feature vectors are aggregated by time windows through aggregation functions to form a time series feature matrix.

[0056] For example, the K-means clustering algorithm is used to generate basic traffic feature vectors, and the feature vectors are temporally aggregated using the sliding window technique.

[0057] The classifier combination method is used to classify the time series feature matrix to obtain a preliminary flow label set, which is then associated with the historical flow pattern to identify the flow deviation integral.

[0058] The time series feature matrix is ​​classified; specifically, a classifier combination method is used to perform multi-dimensional classification on the time series features to generate a preliminary flow label set, which is then compared and correlated with historical flow patterns to identify flow deviation integrals.

[0059] For example, ensemble learning methods such as random forests are used to classify time series features and identify traffic deviations compared to historical traffic data.

[0060] The preliminary traffic analysis results are marked according to the traffic deviation integral to obtain an updated traffic label set, which is then classified into multiple categories using a support vector machine to generate normal traffic, suspicious traffic, and abnormal traffic.

[0061] The preliminary traffic analysis results are marked by using the traffic deviation integral; specifically, the preliminary traffic analysis results are marked according to the traffic deviation integral to obtain an updated traffic label set, and the updated label set is classified into multiple categories through the support vector machine algorithm to generate normal traffic, suspicious traffic and abnormal traffic.

[0062] For example, the SVM algorithm is used to classify the updated traffic labels to accurately identify normal and abnormal traffic.

[0063] In step S300, cluster analysis is performed on suspicious traffic and abnormal traffic using a clustering algorithm to obtain a traffic cluster set, and a traffic association graph is constructed based on the traffic cluster set using a graph theory algorithm to generate a traffic event map.

[0064] By clustering the suspicious and abnormal traffic, specifically, clustering algorithms are used to group the traffic to form a set of traffic clusters, and graph theory algorithms are used to build a traffic association graph to generate a traffic event map.

[0065] For example, the DBSCAN algorithm is used for cluster analysis, and the shortest path algorithm is used to construct a traffic association graph.

[0066] Connectivity analysis is used to evaluate the node association of the traffic event graph and obtain the node association matrix. The dynamic weighted scoring method is applied to the node association matrix to generate a dynamic threat score.

[0067] Through the connectivity analysis of the traffic event graph; specifically, the correlation between the nodes in the graph is evaluated, a node correlation matrix is ​​generated, and the nodes are scored using a dynamic weighted scoring method to generate a dynamic threat score.

[0068] For example, the Node2Vec method is used to evaluate the node association and the scores are given through the dynamic weight adjustment method.

[0069] A convolutional neural network is used to extract features of nodes and edges in the traffic event graph to obtain feature vectors.

[0070] The traffic event graph is featured by using a convolutional neural network; specifically, the node and edge information in the network is used as input, and high-level feature vectors are extracted through convolution operations.

[0071] For example, Graph Convolutional Networks (GCN) is used to extract features from traffic event graphs.

[0072] The behavior anomaly matrix is ​​generated using matrix decomposition technology based on feature vectors and dynamic threat scores.

[0073] By integrating feature vectors and dynamic threat scores; specifically, matrix decomposition technology is used to integrate feature vectors and dynamic threat scores to generate a behavior anomaly matrix.

[0074] For example, the non-negative matrix factorization (NMF) technique is used to decompose the feature vector and generate an anomaly matrix.

[0075] In step S400, the behavior anomaly matrix is ​​input into a fuzzy logic algorithm to obtain a fuzzy threat metric, and a fuzzy aggregation rule is applied based on the fuzzy threat metric and the dynamic threat score to generate a threat assessment index.

[0076] The behavior anomaly matrix is ​​input into the fuzzy logic algorithm for processing; specifically, the anomaly matrix is ​​fuzzified through fuzzy logic rules to generate a fuzzy threat metric, and the dynamic threat score is integrated based on the fuzzy aggregation rules to generate a threat assessment index.

[0077] For example, the behavior anomaly matrix is ​​processed using fuzzy set theory to generate threat metrics.

[0078] The threat assessment index is reasoned through the decision rule library to obtain the initial network routing strategy. The time series analysis algorithm is used to perform multi-scale sequence analysis on the initial network routing strategy to obtain the sequence results.

[0079] By making decision inferences based on the threat assessment index; specifically, applying the decision rule library to perform reasoning analysis on the threat assessment index, generating an initial network routing strategy, and performing multi-scale analysis on the strategy through a time series analysis algorithm to obtain a sequence result.

[0080] For example, the Bayesian inference method is used to perform inference analysis on the threat assessment index to generate an initial strategy.

[0081] The preset historical data prediction model is used to predict the trend of the sequence results and generate performance prediction indicators. The performance prediction indicators are comprehensively analyzed through multivariate regression analysis to generate network performance and security evaluation indicators.

[0082] By performing trend prediction on the sequence results; specifically, using a preset historical data prediction model to perform trend analysis on the sequence results, generating performance prediction indicators, and performing a comprehensive analysis of these indicators through multivariate regression analysis to generate network performance and security evaluation indicators.

[0083] For example, ARIMA models are used for trend forecasting, and evaluation indicators are generated through multiple linear regression analysis.

[0084] In step S500, an initial environment state is set according to network performance and security evaluation indicators, and an adjustment rule generator is used to adjust network routing according to the initial environment state to obtain an adjustment strategy.

[0085] By setting the initial environment state based on network performance and security evaluation indicators; specifically, determining the current state parameters of network routing based on the results of the evaluation indicators, including bandwidth utilization, delay time, and packet loss rate, etc. The adjustment rule generator is used to generate corresponding network routing adjustment strategies based on these state parameters to ensure that network performance and security are optimized.

[0086] For example, a rule-based decision-making system is used to automatically generate adjustment strategies to ensure that network routing is optimized without affecting network stability.

[0087] The policy gradient algorithm is used to iterate the adjustment strategy to obtain the adjustment optimization path. The value of the adjustment optimization path is iterated through value function evaluation to generate a value strategy.

[0088] By iterating and optimizing the adjustment strategy; specifically, using the policy gradient algorithm to iteratively optimize the initial adjustment strategy, generating an optimization path, evaluating the optimization path and iteratively calculating the value through the value function, generating the final value strategy, and ensuring the optimal performance of the adjustment strategy in different environments.

[0089] For example, the REINFORCE method in the policy gradient algorithm is used to optimize the adjustment strategy, and the optimal path is found through value function evaluation.

[0090] The reinforcement learning algorithm is combined with the preset strategy exploration mechanism to update the value strategy, and the updated value strategy is used as the target network routing strategy.

[0091] The value strategy is optimized and updated through the reinforcement learning algorithm. Specifically, combined with the preset strategy exploration mechanism, the value strategy is iterated and optimized multiple times through the reinforcement learning algorithm, and the updated value strategy is used as the final target network routing strategy to ensure the optimal network performance and security in different network environments.

[0092] For example, the Q-learning algorithm is used in combination with the exploration mechanism to train and optimize the strategy multiple times to ensure that the final target network routing strategy can effectively cope with the dynamically changing network environment.

[0093] In step S600, a routing decision cache table is generated based on the target network routing policy, and a hash algorithm is used to map the network data packet to a specific routing rule in the routing decision cache table.

[0094] A routing decision cache table is generated based on the target network routing policy; specifically, the routing rules in the target network routing policy are used to generate a cache table, and a hash algorithm is used to quickly map each network data packet to the corresponding routing rule in the cache table to improve the efficiency and accuracy of data packet processing.

[0095] For example, use the MD5 or SHA-256 hash algorithm to hash the header information of the data packet and quickly find the corresponding routing rules.

[0096] The specific routing rules are updated and matched in real time through the dynamic routing protocol to obtain the routing path information.

[0097] The rules in the routing decision cache table are updated in real time by using dynamic routing protocols; specifically, dynamic routing protocols (such as OSPF or BGP) are used to update and match network routes, adjust and optimize routing path information in real time, and ensure that network traffic can be transmitted through the optimal path.

[0098] For example, the OSPF protocol is used to dynamically update routing information in the network and transmit data packets using the optimal path.

[0099] Use the path optimization algorithm to optimize the routing path information and generate the optimal path set. Use the packet forwarding engine to select the path and schedule the queue for the network data packets according to the optimal path set, and continuously monitor the network status parameters to obtain the network status monitoring results.

[0100] By optimizing the routing path information; specifically, using the path optimization algorithm to select and optimize the real-time updated routing path, generating the optimal path set, and the packet forwarding engine to select the path and schedule the queue for the network data packet according to the optimal path, ensuring the efficiency and reliability of data packet transmission, while monitoring the network status parameters to obtain real-time network status monitoring results.

[0101] For example, the Dijkstra algorithm is used to optimize routing paths, and the SDN controller manages packet forwarding and queue scheduling.

[0102] The path selection is dynamically adjusted according to the network status monitoring results to obtain the path decision.

[0103] By dynamically adjusting the path selection according to the network status monitoring results; specifically, analyzing the network status monitoring results in real time and dynamically adjusting the current path selection to ensure the optimality of the data packet transmission path and the stability of the network status.

[0104] For example, routing paths can be adjusted based on real-time monitoring data to cope with sudden network traffic and failures.

[0105] Deliver network data packets to the target node based on path decisions, and generate real-time traffic analysis results of network routing.

[0106] The network data packets are delivered to the target node based on the path decision; specifically, according to the adjusted path decision, the data packets are transmitted to the target node along the optimal path, and the real-time traffic analysis results of the network routing are generated to ensure the efficient and secure transmission of the data packets.

[0107] For example, the optimized routing strategy is used to transmit data packets to the designated server to complete traffic analysis and report generation.

[0108] In this embodiment, the network data packet is parsed by deep packet inspection technology and anomaly detection algorithm, the header information and data load are extracted, and the header anomaly mark is generated. The data load is feature extracted and standardized by natural language processing algorithm and data cleaning algorithm to obtain a data feature set. The data feature set is streamlined by feature selection algorithm, the header anomaly mark is integrated, and parsed data is generated. The machine learning model is used to perform preliminary analysis on the parsed data, generate basic traffic feature vectors, and perform time series aggregation by aggregation function to generate a time series feature matrix. The time series feature matrix is ​​classified by classifier combination method, the traffic deviation integral is identified, and the update label set is multi-classified by support vector machine to generate normal traffic, suspicious traffic and abnormal traffic. Clustering algorithm and graph theory algorithm are used to generate traffic event map, and the behavior anomaly matrix is ​​generated by convolutional neural network and matrix decomposition technology. Fuzzy logic algorithm and time series analysis algorithm are used to generate initial network routing strategy, and network performance and security evaluation indicators are generated by historical data prediction model and multivariate regression analysis. Reinforcement learning algorithm is used to perform strategy iteration and optimization on adjustment strategy to generate target network routing strategy. Generate a routing decision cache table based on the target network routing strategy, perform real-time path selection and queue scheduling through dynamic routing protocols and path optimization algorithms, generate real-time traffic analysis results of network routing, and ensure network efficiency and security.

[0109] Embodiment 3: like Figure 2 As shown, the present application also provides a real-time traffic analysis system 10 for network routing, including an acquisition unit 11, a classification unit 12, an extraction unit 13, a generation unit 14, an optimization unit 15 and an analysis unit 16.

[0110] The acquisition unit 11 is mainly used to acquire network data packets of network routes, perform data preprocessing on the network data packets, and obtain parsed data.

[0111] The classification unit 12 is mainly used to input the parsed data into a preset traffic analysis model to obtain preliminary traffic analysis results, and classify the preliminary traffic analysis results to obtain normal traffic, suspicious traffic and abnormal traffic.

[0112] The extraction unit 13 is mainly used to perform correlation analysis and pattern evolution tracking on suspicious traffic and abnormal traffic through cluster analysis and graph theory algorithms, generate a traffic event map, and generate a dynamic threat score based on the traffic event map, use a convolutional neural network to extract features from the traffic event map, obtain extracted features, and generate a behavior anomaly matrix based on the extracted features.

[0113] The generation unit 14 is mainly used to analyze the behavior anomaly matrix and the dynamic threat score using a fuzzy logic algorithm, and generate an initial network routing strategy based on the analysis results, and analyze the initial network routing strategy through a time series analysis algorithm to obtain network performance and security evaluation indicators.

[0114] The optimization unit 15 is mainly used to adjust the network routing based on the evaluation index to obtain the adjustment strategy, and iteratively optimize the adjustment strategy using the reinforcement learning algorithm to obtain the target network routing strategy.

[0115] The analysis unit 16 is mainly used to forward network data packets using the target network routing strategy to obtain real-time traffic analysis results of the network routing.

[0116] In this embodiment, the network data packets of the network route are obtained by the acquisition unit 11, and the data is preprocessed to obtain the parsed data. The classification unit 12 inputs the parsed data into the preset traffic analysis model, generates the preliminary traffic analysis results, and classifies them according to the traffic characteristics to obtain normal traffic, suspicious traffic and abnormal traffic. The extraction unit 13 performs correlation analysis and pattern evolution tracking on the suspicious traffic and abnormal traffic through cluster analysis and graph theory algorithms, generates a traffic event map, and generates a dynamic threat score based on the map. The traffic event map is feature extracted by using a convolutional neural network to obtain extracted features, and a behavior anomaly matrix is ​​generated based on the extracted features. The generation unit 14 uses a fuzzy logic algorithm to comprehensively analyze the behavior anomaly matrix and the dynamic threat score, generates an initial network routing strategy, and performs an in-depth analysis of the initial network routing strategy through a time series analysis algorithm to obtain network performance and security evaluation indicators. The optimization unit 15 adjusts the network routing based on these evaluation indicators, formulates an adjustment strategy, and iteratively optimizes the adjustment strategy through a reinforcement learning algorithm to generate the final target network routing strategy. The analysis unit 16 uses the target network routing strategy to forward the network data packets and generate real-time traffic analysis results of the network routing. Through the above method, the system of the present application can realize real-time, dynamic and accurate analysis of network traffic, ensure the efficiency and security of the network, and provide strong technical support for network management and security protection.

[0117] It should be noted that technical personnel in the relevant technical field can clearly understand that for the convenience and conciseness of description, the specific working process of the system and each unit described above can refer to the corresponding process in the aforementioned real-time traffic analysis method of network routing and system implementation example, and will not be repeated here.

[0118] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A real-time traffic analysis method for network routing, characterized in that: include: Acquire a network data packet of a network route, perform data preprocessing on the network data packet, and obtain parsed data; Inputting the analyzed data into a preset traffic analysis model to obtain preliminary traffic analysis results, and classifying the preliminary traffic analysis results to obtain normal traffic, suspicious traffic, and abnormal traffic; Perform correlation analysis and pattern evolution tracking on the suspicious traffic and abnormal traffic through cluster analysis and graph theory algorithms to generate a traffic event map, generate a dynamic threat score based on the traffic event map, extract features from the traffic event map using a convolutional neural network to obtain extracted features, and generate a behavior anomaly matrix based on the extracted features; Analyzing the behavior anomaly matrix and the dynamic threat score using a fuzzy logic algorithm, generating an initial network routing strategy based on the analysis results, and analyzing the initial network routing strategy using a time series analysis algorithm to obtain network performance and security evaluation indicators; The network routing is adjusted based on the evaluation index to obtain an adjustment strategy, and the adjustment strategy is iteratively optimized using a reinforcement learning algorithm to obtain a target network routing strategy; The target network routing strategy is used to forward the network data packet to obtain a real-time traffic analysis result of the network routing.

2. The real-time traffic analysis method of network routing according to claim 1 is characterized in that: The step of obtaining a network data packet of a network route and performing data preprocessing on the network data packet to obtain parsed data includes: Parsing the network data packet through deep packet inspection, extracting packet header information and data payload, detecting the packet header information using an anomaly detection algorithm, and generating a packet header anomaly mark; The data load is converted into analyzable feature data through a natural language processing algorithm, and the feature data is subjected to noise filtering and format standardization using a data cleaning algorithm to obtain a data feature set; The data feature set is simplified according to a feature selection algorithm to obtain analytical features, and the packet header anomaly identifier and the highly correlated analytical features are integrated to generate analytical data.

3. The real-time traffic analysis method of network routing according to claim 1 is characterized in that: The step of inputting the parsed data into a preset traffic analysis model to obtain a preliminary traffic analysis result, and classifying the preliminary traffic analysis result to obtain normal traffic, suspicious traffic, and abnormal traffic includes: Performing a preliminary analysis on the parsed data through a machine learning model to obtain a basic traffic feature vector, and performing time window aggregation on the basic traffic feature vector using an aggregation function to generate a time series feature matrix; Using a classifier combination method to classify the time series feature matrix, obtain a preliminary flow label set, perform correlation analysis on the preliminary flow label set and the historical flow pattern, and identify the flow deviation integral; The preliminary flow analysis result is marked according to the flow deviation integral to obtain an updated flow label set, and the updated flow label set is classified into multiple categories by a support vector machine to generate normal flow, suspicious flow and abnormal flow.

4. The real-time traffic analysis method of network routing according to claim 1 is characterized in that: The steps of performing correlation analysis and pattern evolution tracking on the suspicious traffic and abnormal traffic by cluster analysis and graph theory algorithms to generate a traffic event map, generating a dynamic threat score based on the traffic event map, extracting features from the traffic event map by using a convolutional neural network to obtain extracted features, and generating a behavior anomaly matrix based on the extracted features include: Performing cluster analysis on the suspicious traffic and the abnormal traffic by using a clustering algorithm to obtain a traffic cluster set, constructing a traffic association graph based on the traffic cluster set by using a graph theory algorithm, and generating a traffic event map; Using connectivity analysis to evaluate node associations on the traffic event graph to obtain a node association matrix, applying a dynamic weighted scoring method to the node association matrix to generate a dynamic threat score; A convolutional neural network is used to extract features of nodes and edges in the traffic event graph to obtain a feature vector; A behavior anomaly matrix is ​​generated based on the feature vector and the dynamic threat score using matrix decomposition technology.

5. The real-time traffic analysis method of network routing according to claim 1 is characterized in that: The steps of analyzing the behavior anomaly matrix and the dynamic threat score by using a fuzzy logic algorithm, generating an initial network routing strategy based on the analysis results, and analyzing the initial network routing strategy by using a time series analysis algorithm to obtain network performance and security evaluation indicators include: Inputting the behavior anomaly matrix into a fuzzy logic algorithm to obtain a fuzzy threat metric, applying a fuzzy aggregation rule based on the fuzzy threat metric and the dynamic threat score to generate a threat assessment index; Perform decision reasoning on the threat assessment index through a decision rule library to obtain an initial network routing strategy, and perform multi-scale sequence analysis on the initial network routing strategy using a time series analysis algorithm to obtain a sequence result; The preset historical data prediction model is used to perform trend prediction on the sequence results to generate performance prediction indicators, and the performance prediction indicators are comprehensively analyzed through multivariate regression analysis to generate network performance and security evaluation indicators.

6. The real-time traffic analysis method of network routing according to claim 1, characterized in that: The steps of adjusting the network routing based on the network performance and the security evaluation index to obtain an adjustment strategy, and iteratively optimizing the adjustment strategy using a reinforcement learning algorithm to obtain a target network routing strategy include: An initial environment state is set according to the network performance and the security evaluation index, and an adjustment rule generator is used to adjust the network routing according to the initial environment state to obtain an adjustment strategy; The policy gradient algorithm is used to perform policy iteration on the adjustment strategy to obtain an adjustment optimization path, and the value function is used to evaluate the adjustment optimization path to perform value iteration calculation to generate a value strategy; The value strategy is updated by using a reinforcement learning algorithm combined with a preset strategy exploration mechanism, and the updated value strategy is used as the target network routing strategy.

7. The real-time traffic analysis method of network routing according to claim 1, characterized in that: The step of forwarding the network data packet using the target network routing strategy to obtain a real-time traffic analysis result of the network routing includes: Generate a routing decision cache table based on the target network routing policy, and use a hash algorithm to map the network data packet to a specific routing rule in the routing decision cache table; The specific routing rules are updated and matched in real time through a dynamic routing protocol to obtain routing path information; Using a path optimization algorithm to optimize and select the routing path information, generating an optimal path set, using a packet forwarding engine to perform path selection and queue scheduling for the network data packets according to the optimal path set, and continuously monitoring network status parameters to obtain network status monitoring results; Dynamically adjusting the path selection according to the network status monitoring result to obtain a path decision; The network data packet is delivered to the target node based on the path decision, and a real-time traffic analysis result of the network route is generated.

8. A real-time traffic analysis system for network routing, characterized in that: include: An acquisition unit, used for acquiring a network data packet of a network route, performing data preprocessing on the network data packet, and obtaining parsed data; A classification unit, used for inputting the parsed data into a preset traffic analysis model to obtain a preliminary traffic analysis result, and classifying the preliminary traffic analysis result to obtain normal traffic, suspicious traffic and abnormal traffic; An extraction unit, configured to perform correlation analysis and pattern evolution tracking on the suspicious traffic and abnormal traffic through cluster analysis and graph theory algorithms, generate a traffic event map, generate a dynamic threat score based on the traffic event map, perform feature extraction on the traffic event map using a convolutional neural network to obtain extracted features, and generate a behavior anomaly matrix based on the extracted features; A generating unit, configured to analyze the abnormal behavior matrix and the dynamic threat score using a fuzzy logic algorithm, generate an initial network routing strategy based on the analysis result, and analyze the initial network routing strategy using a time series analysis algorithm to obtain network performance and security evaluation indicators; An optimization unit, configured to adjust the network routing based on the evaluation index to obtain an adjustment strategy, and iteratively optimize the adjustment strategy using a reinforcement learning algorithm to obtain a target network routing strategy; The analysis unit is used to forward the network data packet using the target network routing strategy to obtain a real-time traffic analysis result of the network routing.

Images