Association prediction method and device of network link, electronic equipment and storage medium

Abstract

The invention discloses a network link association prediction method and device, electronic equipment and a storage medium. The method comprises the steps that link information of each network link in a to-be-predicted network link pair is acquired, feature data of multiple dimensions of each network link is determined based on the link information of each network link, and the multiple dimensions comprise a protocol space dimension, an address space dimension, an autonomous domain space dimension, an account space dimension and a comprehensive space dimension; determining a target feature matrix based on the multi-dimensional feature data of each network link in the to-be-predicted network link pair; and through a pre-trained association prediction model, performing association relationship type prediction on the to-be-predicted network link pair based on the target feature matrix, and determining the association relationship type of the to-be-predicted network link pair. According to the scheme, the association relationship between the network links is predicted through the prediction model according to the feature data of the network links in multiple dimensions, and the accuracy and rapidity of association relationship type prediction are improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, device, electronic device and storage medium for predicting the association of a network link. Background Art

[0002] In a wide area network environment, network links connect multiple geographically dispersed nodes and data centers. In order to better ensure network security and reliability, network links need to be monitored and analyzed. As the demand for global business expansion of enterprises and organizations continues to grow, network traffic on network links is growing exponentially, and the complexity of wide area networks is also increasing. The difficulty of monitoring and analyzing network traffic on network links is also increasing.

[0003] For network traffic analysis on network links, how to accurately determine the association relationship between links is a key issue. Currently, the association relationship between links is usually determined by the Hop-Distance algorithm based on path similarity, or the association relationship between links is determined by calculating the difference in the number of hops of different network links, or the link association relationship is determined based on delay characteristics. The existing technology is unable to mine and analyze network traffic data more deeply and has limitations, making it impossible to accurately determine the association relationship between network links, especially for link association relationships in network scenarios such as multi-channel access and multi-port access. It is even more difficult to determine. Summary of the invention

[0004] The present invention provides a network link association prediction method, device, electronic device and storage medium to solve the problem that the association relationship between network links cannot be accurately and efficiently predicted.

[0005] According to one aspect of the present invention, a method for predicting the association of network links is provided, comprising:

[0006] Acquire link information of each network link in the network link pair to be predicted, and determine feature data of multiple dimensions of each network link based on the link information of each network link, wherein the multiple dimensions include a protocol space dimension, an address space dimension, an autonomous domain space dimension, an account space dimension, and a comprehensive space dimension;

[0007] Determine a target feature matrix based on feature data of multiple dimensions of each network link in the network link pair to be predicted;

[0008] Through the pre-trained association prediction model, the association relationship type of the network link pair to be predicted is predicted based on the target feature matrix, and the association relationship type of the network link pair to be predicted is determined.

[0009] Optionally, characteristic data of multiple dimensions of each network link is determined based on the link information of each network link, including: for each network link, characteristic description information based on multiple dimensions is matched in the link information corresponding to the network link, and characteristic data of multiple dimensions of the network link is determined based on the link information that matches the characteristic description information of multiple dimensions; wherein the characteristic description information of each dimension includes multiple field information.

[0010] Optionally, a target feature matrix is ​​determined based on feature data of multiple dimensions of each network link in the network link pair to be predicted, including: determining a feature matrix corresponding to each dimension based on the feature data of each dimension, wherein the feature matrix satisfies a first matrix size; and determining a target feature matrix based on feature matrices corresponding to the multiple dimensions, wherein the target feature matrix satisfies a second matrix size, and the first matrix size is smaller than the second matrix size.

[0011] Optionally, the association relationship type includes a main partner type, a self or multi-link type, a same network type and other types; the main partner type is a type that characterizes that two links form a pair of transceiver relationships; the self or multi-link type is a type that characterizes the same transmission / reception between two links, or a complementary relationship in a multi-link scenario; the same network type is a type that characterizes that two links belong to the same network; other types are types that characterize that they do not belong to any of the main partner type, self or multi-link type and same network type.

[0012] Optionally, a training method for an association prediction model includes: obtaining a network link sample data set, determining feature data of multiple dimensions of each network link sample based on the link information of each network link sample in the network link sample data set; for any two network link samples, determining a calibrated association relationship type between the two network link samples based on the feature data of multiple dimensions corresponding to the two network link samples; training the association prediction model to be trained based on the feature data of multiple dimensions of any two network link samples and the corresponding calibrated association relationship types until the model training stop condition is met, thereby obtaining a trained association prediction model.

[0013] Optionally, for any two network link samples, the calibrated association relationship type of the two network link samples is determined based on feature data of multiple dimensions corresponding to the two network link samples, including: for any two network link samples, based on the feature data of each dimension corresponding to the two network link samples, calculating similarity data corresponding to the feature data of each dimension; determining similarity results corresponding to the two network link samples based on the similarity data corresponding to the feature data of each dimension; and determining the calibrated association relationship type of the two network link samples based on the similarity results.

[0014] Optionally, after determining the calibrated association relationship type of the two network link samples based on the similarity results, it also includes: transmitting the calibrated association relationship type of the two network link samples to the verification end for display; in response to an editing operation on the calibrated association relationship type of the two network link samples, updating the calibrated association relationship type of the two network link samples based on the edited information.

[0015] According to another aspect of the present invention, there is provided a network link association prediction device, comprising:

[0016] A feature data determination module, used to obtain link information of each network link in the network link pair to be predicted, and determine feature data of multiple dimensions of each network link based on the link information of each network link, wherein the multiple dimensions include a protocol space dimension, an address space dimension, an autonomous domain space dimension, an account space dimension, and a comprehensive space dimension;

[0017] A target feature matrix determination module, used to determine a target feature matrix based on feature data of multiple dimensions of each network link in the network link pair to be predicted;

[0018] The prediction result determination module is used to predict the association relationship type of the network link pair to be predicted based on the target feature matrix through a pre-trained association prediction model, and determine the association relationship type of the network link pair to be predicted.

[0019] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0020] at least one processor; and

[0021] a memory communicatively connected to at least one processor; wherein,

[0022] The memory stores a computer program that can be executed by at least one processor. The computer program is executed by at least one processor so that the at least one processor can execute the network link association prediction method of any embodiment of the present invention.

[0023] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network link association prediction method of any embodiment of the present invention when executed.

[0024] The technical solution of the embodiment of the present invention obtains the link information of each network link in the network link pair to be predicted, determines the feature data of multiple dimensions of each network link based on the link information of each network link, wherein the multiple dimensions include protocol space dimension, address space dimension, autonomous domain space dimension, account space dimension and comprehensive space dimension; determines the target feature matrix based on the feature data of multiple dimensions of each network link in the network link pair to be predicted; predicts the type of association relationship of the network link pair to be predicted based on the target feature matrix through a pre-trained association prediction model, and determines the type of association relationship of the network link pair to be predicted. This solution predicts the association relationship between network links through an association prediction model based on the feature data of network links of multiple dimensions corresponding to the network link pair to be predicted, obtains accurate prediction results of the association relationship corresponding to the network link pair to be predicted, realizes a method for predicting the association relationship of the network link to be predicted through multi-dimensional network link data, solves the problem of being unable to accurately and efficiently predict the association relationship between network links, and improves the accuracy and efficiency of association relationship type prediction.

[0025] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 It is a flowchart of a method for predicting the association of network links provided by the first embodiment of the present invention;

[0028] Figure 2 is a flow chart of a method for predicting the association of network links provided by Embodiment 2 of the present invention;

[0029] Figure 3 It is a structural diagram of a network link association prediction device provided by Embodiment 3 of the present invention;

[0030] Figure 4 It is a structural schematic diagram of an electronic device for implementing the network link association prediction method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] Embodiment 1

[0034] Figure 1 This is a flowchart of a network link association prediction method provided by the first embodiment of the present invention. This embodiment is applicable to the case of predicting the association relationship between network links. The method can be executed by a network link association prediction device. The network link association prediction device can be implemented in the form of hardware and / or software. The network link association prediction device can be configured in electronic devices such as computers and servers. Figure 1 As shown, the method includes:

[0035] S110. Obtain link information of each network link in the network link pair to be predicted, and determine feature data of multiple dimensions of each network link based on the link information of each network link, wherein the multiple dimensions include a protocol space dimension, an address space dimension, an autonomous domain space dimension, an account space dimension, and a comprehensive space dimension.

[0036] Among them, the network link pair to be predicted can be specifically understood as the network link pair to be predicted for association between the links, including any two network links that need to be predicted for association. A network link refers to a physical or logical path connecting two or more network devices, which is specifically used to transmit data packets from a source device to a target device. The link information of a network link can be specifically understood as information that characterizes the traffic data on the network link, including but not limited to the source address information, destination address information, network protocol information, account information and autonomous domain information of the network link, which can be collected by the data acquisition device configured on the network link. Multiple dimensions can be specifically understood as link description angles set for accurately describing the network link, and a certain number of dimensions can be pre-set by analyzing the characteristics of the traffic data on the network link. The multiple dimensions include but are not limited to the protocol space dimension, the address space dimension, the autonomous domain space dimension, the account space dimension and the comprehensive space dimension. The protocol space dimension refers to the dimension of describing the network link through the protocol information extracted from the link information of the network link, and the protocol information includes but is not limited to the type of protocol and the frequency of occurrence of the protocol; the address space dimension refers to the dimension of describing the network link through the address information extracted from the link information of the network link, and the address information includes but is not limited to the source IP (Internet The autonomous domain space dimension refers to the dimension of the network link described by the autonomous domain number information extracted from the link information of the network link, and the autonomous domain number information includes but is not limited to the source autonomous domain number, the destination autonomous domain number and the frequency of occurrence of the autonomous domain number; the account space dimension refers to the dimension of the network link described by the account information extracted from the link information of the network link, and the account information includes but is not limited to the email account, WeChat account, Facebook account and the frequency of occurrence of the corresponding account; the comprehensive space dimension specifically refers to the dimension of the network link described by the combined information corresponding to the protocol space dimension, address space dimension, autonomous domain space dimension and account space dimension extracted from the link information of the network link. The feature data of multiple dimensions can be specifically understood as the feature data required to characterize the network link, and the corresponding necessary features can be set for each dimension according to actual needs, and the corresponding data can be extracted from the link information of the network link according to the corresponding necessary features set for each dimension, so as to obtain the feature data of each dimension, and the multiple dimensions and the necessary features corresponding to each dimension can be stored in the target storage space in advance to form a data model that can accurately reflect the network link, which can better mine the effective feature data of the network link and improve the accuracy of the association prediction of the network link.

[0037] Specifically, the link information of each network link of the network link pair to be predicted can be collected in real time by a data collection device configured on the network link, or the link information of each network link of the network link pair to be predicted can be read from a server. Based on reading multiple dimensions and necessary features corresponding to each dimension from the target storage space, feature extraction is performed in the link information of each network link, and feature data matching the necessary features corresponding to each dimension are extracted, thereby obtaining feature data corresponding to each dimension.

[0038] In this embodiment, by obtaining feature data of multiple dimensions that can accurately describe the network link pair to be predicted, and using it to subsequently determine the type of association relationship of the network link pair to be predicted, deeper information mining from multiple dimensions is achieved, which is used to predict the type of association relationship, and helps to improve the accuracy of the prediction of the type of association relationship.

[0039] S120: Determine a target feature matrix based on feature data of multiple dimensions of each network link in the network link pair to be predicted.

[0040] It should be noted that, since the feature data corresponding to the network link to be predicted includes feature data of multiple dimensions, a feature matrix equal to the preset matrix size of a single dimension can be constructed based on the feature data of each dimension, and the feature matrices corresponding to each dimension are integrated to construct a target feature matrix corresponding to multiple dimensions. It is also possible to construct a feature matrix equal to the preset matrix size of multiple dimensions based on the feature data of multiple dimensions, and determine the target feature matrix from the feature matrices of the preset matrix sizes of multiple dimensions. If the matrix size of the feature matrix constructed by the feature data of each dimension is smaller than the preset matrix size of the corresponding single dimension, or the matrix size of the feature matrix constructed by the feature data of multiple dimensions is smaller than the preset matrix size of multiple dimensions, the mean filling method is used for filling processing, so that the matrix size of the feature matrix constructed by the feature data of each dimension is equal to the preset matrix size of the corresponding single dimension, and correspondingly, the matrix size of the feature matrix constructed by the feature data of multiple dimensions is equal to the preset matrix size of multiple dimensions; if the matrix size of the feature matrix constructed by the feature data of each dimension is larger than the preset matrix size of the corresponding single dimension, or the matrix size of the feature matrix constructed by the feature data of multiple dimensions is larger than the preset matrix size of multiple dimensions, the principal component analysis method is used for dimensionality reduction processing, so that the matrix size of the feature matrix constructed by the feature data of each dimension is equal to the preset matrix size of the corresponding single dimension, and correspondingly, the matrix size of the feature matrix constructed by the feature data of multiple dimensions is equal to the preset matrix size of multiple dimensions. The target feature matrix can be specifically understood as the feature matrix corresponding to the network link pair to be predicted.

[0041] Specifically, feature data corresponding to each dimension is constructed from feature data of multiple dimensions of each network link in the network link pair to be predicted, and then feature aggregation processing is performed on the feature data corresponding to each dimension to obtain a target feature matrix.

[0042] In some specific embodiments, feature data of multiple dimensions may be linearly transformed, and feature data of multiple dimensions may be processed using matrix operations to obtain a feature matrix that can be processed by the prediction model. Matrix operations may be performed on feature data of each dimension to obtain a feature matrix corresponding to each dimension, and then a target feature matrix may be constructed from the feature matrix corresponding to each dimension. Feature data of each dimension may also be processed using a pre-constructed transformation matrix to obtain a target feature matrix corresponding to the network link pair to be predicted. Among them, the transformation matrix required for the linear transformation of each dimension or the linear transformation of multiple dimensions may be solved in advance, and may be directly called when the target feature matrix is ​​determined.

[0043] Optionally, a target feature matrix is ​​determined based on feature data of multiple dimensions of each network link in the network link pair to be predicted, including: determining a feature matrix corresponding to each dimension based on the feature data of each dimension, wherein the feature matrix satisfies a first matrix size; and determining a target feature matrix based on feature matrices corresponding to the multiple dimensions, wherein the target feature matrix satisfies a second matrix size, and the first matrix size is smaller than the second matrix size.

[0044] Among them, the first matrix size and the second matrix size can be specifically understood as the size of the feature matrix that characterizes the construction. The feature matrix of a single dimension needs to satisfy the first matrix size. Exemplarily, the first matrix size is set to an 8×8 matrix. The feature matrices corresponding to multiple dimensions need to satisfy the second matrix size, that is, the target feature matrix needs to satisfy the second matrix size. Exemplarily, the second matrix size is set to a 64×64 matrix, wherein the first matrix size is smaller than the second matrix size.

[0045] It can be understood that the feature data of each dimension includes at least one feature data, and feature data satisfying the first matrix size is constructed based on the feature data of each dimension. If the feature data of each dimension cannot construct feature data satisfying the first matrix size, the feature data of this dimension is filled by the mean filling method, so that feature data satisfying the first matrix size can be obtained in each dimension. If the feature matrix constructed by the feature data of each dimension is larger than the first matrix size, it is necessary to use the principal component analysis method to reduce the dimension of the feature data of this dimension, so that feature data satisfying the first matrix size can be obtained in each dimension. After determining the feature matrix corresponding to each dimension based on the feature data of each dimension, the feature data of each dimension is subjected to feature aggregation processing to obtain a target feature matrix satisfying the second matrix size.

[0046] In this embodiment, feature data of multiple dimensions are processed to obtain a target feature matrix, thereby achieving data consistency processing of feature data of multiple dimensions. At the same time, a feature matrix that can be used for model prediction is also obtained, which helps to improve model prediction efficiency.

[0047] S130 , predicting the association relationship type of the network link pair to be predicted based on the target feature matrix through the pre-trained association prediction model, and determining the association relationship type of the network link pair to be predicted.

[0048] Among them, the association relationship type can be specifically understood as being used to describe the association relationship between network links, and can be customized according to business scenario requirements. Optionally, the association relationship type includes a primary counterpart type, a self or multi-link type, a same network type, and other types; the primary counterpart type is a type that characterizes that two links constitute a pair of transceiver relationships; the self or multi-link type is a type that characterizes the same transmission / reception between two links, or a complementary relationship in a multi-link scenario; the same network type is a type that characterizes that two links belong to the same network; other types are types that characterize that they do not belong to any of the primary counterpart type, self or multi-link type, and same network type.

[0049] Specifically, the target feature matrix is ​​used as input data of the pre-trained association prediction model, and the association relationship prediction model processes the target feature matrix to predict the association relationship type of the network link pair to be predicted.

[0050] Optionally, a training method for an association prediction model includes: obtaining a network link sample data set, determining feature data of multiple dimensions of each network link sample based on the link information of each network link sample in the network link sample data set; for any two network link samples, determining a calibrated association relationship type between the two network link samples based on the feature data of multiple dimensions corresponding to the two network link samples; training the association prediction model to be trained based on the feature data of multiple dimensions of any two network link samples and the corresponding calibrated association relationship types until the model training stop condition is met, thereby obtaining a trained association prediction model.

[0051] In this embodiment, the association prediction model specifically refers to a deep learning model, which is a hybrid deep learning model combining a convolutional neural network and a long short-term memory network, and can simultaneously utilize the feature extraction capability of the convolutional neural network and the sequence processing capability of the long short-term memory network. Among them, the convolutional neural network part includes a multi-layer convolution layer and a pooling layer for feature extraction and dimensionality reduction, and nonlinearity is introduced into the convolution layer by ReLU or other activation functions. After feature extraction by the convolutional neural network, the long short-term memory network uses the extracted features as the input of the time step, and can learn the temporal dependency or sequential information in the data. After the convolutional neural network and the long short-term memory network, a fully connected layer is added to map the extracted temporal and spatial features to a specific output space (such as a classification label or regression value). The output layer uses a Softmax or Sigmoid activation function, selects a cross entropy loss function for classification, and a mean square error is used for regression. The optimizer uses Adam, RMSprop or SGD to update the weights of the network, and the output layer finally outputs the association relationship prediction results between the network links.

[0052] Specifically, to construct an association prediction model to be trained, a network link sample data set can be obtained from a server, the network link sample data set including link information of multiple network link samples, feature data of multiple dimensions of each network link sample can be extracted from the link information of each network link sample in the network link sample data set, any two network link samples can be selected from the network link sample data set, the similarity between any two network link samples can be calculated, and the calibrated association relationship type of the two network link samples can be determined according to the similarity, the feature data of multiple dimensions of any two network link samples and the corresponding calibrated association relationship type can be used as training samples, the feature data of multiple dimensions of any two network link samples and the corresponding calibrated association relationship type can be used as input data of the association prediction model to be trained, and the calibrated association relationship type can be used as a training label to train the association prediction model to be trained until the training times of the association prediction model to be trained meet the preset training times, or the loss function value no longer decreases significantly or starts to fluctuate, then the model training is stopped to obtain a trained association prediction model.

[0053] In this embodiment, the corresponding calibration association relationship type is determined by the link information of any two links in the network link sample data set, and a training set of the prediction model is constructed based on the feature data of multiple dimensions of any two network link samples and the corresponding calibration association relationship type, which is used to complete the training of the prediction model, thereby improving the speed and accuracy of model training.

[0054] Optionally, for any two network link samples, the calibrated association relationship type of the two network link samples is determined based on feature data of multiple dimensions corresponding to the two network link samples, including: for any two network link samples, based on the feature data of each dimension corresponding to the two network link samples, calculating similarity data corresponding to the feature data of each dimension; determining similarity results corresponding to the two network link samples based on the similarity data corresponding to the feature data of each dimension; and determining the calibrated association relationship type of the two network link samples based on the similarity results.

[0055] Specifically, the similarity between the feature data of each dimension corresponding to the two network link samples is calculated by a similarity algorithm to obtain the similarity data corresponding to each dimension, wherein the similarity algorithm includes but is not limited to the Euclidean distance algorithm and the cosine similarity algorithm. The similarity results corresponding to the two network link samples are calculated based on the similarity data corresponding to the feature data of each dimension, and a corresponding weight coefficient can be set for the similarity data of each dimension, and a weighted summation process is performed based on the similarity data of each dimension and the corresponding weight coefficient to obtain the similarity results corresponding to the two network link samples. The mean of the similarity data can also be calculated based on the similarity data corresponding to the feature data of each dimension, and the calculated mean is used as the similarity result corresponding to the two network link samples. Other calculation methods can also be set according to actual needs to determine the similarity results, which are not limited here. It should be noted that a corresponding similarity threshold is set for each calibration association relationship type. Therefore, after obtaining the similarity results corresponding to the two network link samples, the mapping relationship between each pre-set calibration association relationship type and the corresponding similarity threshold can be called up, and the similarity results corresponding to the two network link samples can be matched with the similarity threshold in the mapping relationship. The calibration association relationship type corresponding to the similarity threshold that matches the similarity result is determined, and the successfully matched calibration association relationship type is used as the calibration association relationship type of the two network link samples.

[0056] Optionally, after determining the calibrated association relationship type of the two network link samples based on the similarity results, it also includes: transmitting the calibrated association relationship type of the two network link samples to the verification end for display; in response to an editing operation on the calibrated association relationship type of the two network link samples, updating the calibrated association relationship type of the two network link samples based on the edited information.

[0057] Among them, the verification end can be specifically understood as an intelligent terminal device with visualization function, and the received information can be displayed on the verification end. In this embodiment, the verification end can receive and display the calibrated association relationship type of two network link samples. At the same time, the verification end also has an interactive function, and editing and submission operations can be performed on the visualization page of the verification end.

[0058] Specifically, after determining the calibrated association relationship types of the two network link samples based on the similarity results, the calibrated association relationship types of the two network link samples can be transmitted to the verification end for display, and the user can view the calibrated association relationship types of the two network link samples at the verification end. If it is found that the calibrated association relationship types of the two network link samples are inaccurate, the corresponding calibrated association relationship types can be edited, and the user submits the edited information. In response to the editing operation on the calibrated association relationship types of the two network link samples, the calibrated association relationship types of the corresponding two network link samples in the training set of the prediction model can be modified to the received user-edited information, so as to continue training according to the updated calibrated association relationship types.

[0059] In this embodiment, the calibrated association relationship types of two network link samples are verified to improve the accuracy of the calibrated association relationship types corresponding to the two network link samples, thereby improving the accuracy of the training sample set of the prediction model, helping to improve the accuracy of the prediction model training, and helping to improve the accuracy of the association relationship type prediction results.

[0060] The technical solution of this embodiment obtains the link information of each network link in the network link pair to be predicted, determines the feature data of multiple dimensions of each network link based on the link information of each network link, wherein the multiple dimensions include the protocol space dimension, the address space dimension, the autonomous domain space dimension, the account space dimension and the comprehensive space dimension; determines the target feature matrix based on the feature data of multiple dimensions of each network link in the network link pair to be predicted; predicts the type of association relationship of the network link pair to be predicted based on the target feature matrix through a pre-trained association prediction model, and determines the type of association relationship of the network link pair to be predicted. This solution predicts the association relationship between network links based on the feature data of multiple dimensions of network links corresponding to the network link pair to be predicted through an association prediction model, obtains accurate prediction results of the association relationship corresponding to the network link pair to be predicted, realizes a method for predicting the association relationship of the network link to be predicted through multi-dimensional network link data, solves the problem of being unable to accurately and efficiently predict the association relationship between network links, and improves the accuracy and efficiency of the prediction of the association relationship type.

[0061] Embodiment 2

[0062] Figure 2This is a flowchart of a network link association prediction method provided by the second embodiment of the present invention. This embodiment is a further optimization of the method of the above embodiment. Optionally, for each network link, feature description information based on multiple dimensions is matched in the link information corresponding to the network link, and feature data of multiple dimensions of the network link is determined based on the link information matching the feature description information of multiple dimensions; wherein the feature description information of each dimension includes multiple field information. Figure 2 As shown, the method includes:

[0063] S210: Obtain link information of each network link in the network link pair to be predicted.

[0064] S220. For each network link, feature description information based on multiple dimensions is matched in link information corresponding to the network link, and feature data of multiple dimensions of the network link is determined based on the link information that matches the feature description information of multiple dimensions; wherein the feature description information of each dimension includes multiple field information.

[0065] Among them, the feature description information can be specifically understood as the feature information used to characterize the network link, which can be pre-set according to the characteristics of the network link. The feature description information of each dimension may include multiple field information. Multiple dimensions and their corresponding feature description information can be stored in the target storage space in advance, that is, multiple dimensions and their corresponding multiple field information are stored in the target storage space, and can be directly called when determining the feature data of multiple dimensions of the network link. It can be understood that the feature description information corresponding to each dimension can be adjusted according to actual needs such as different network environments and changes in business needs, and multiple dimensions can also be adjusted according to actual needs, thereby improving the flexibility and applicability of determining the feature data of multiple dimensions of the network link. Exemplarily, the field information of the protocol space dimension includes but is not limited to the protocol bearer path, CDP four-tuple set, LLDP five-tuple set, BGP four-tuple set, OSPF five-tuple set and RSVP five-tuple set; the field information of the address space dimension includes but is not limited to IP subnet session, MAC session traffic, source IP dispersion, destination IP dispersion, source IP private address ratio and destination IP private address ratio; the field information of the autonomous domain space dimension includes but is not limited to the source AS number, destination AS number and the total IP session group ratio; the field information of the account space dimension includes but is not limited to SNMP server traffic, HTTP server traffic, FTP server traffic, IMAP server traffic and POP3 server traffic.

[0066] Specifically, for each network link, feature description information of multiple dimensions is read from the target storage space, the feature description information of multiple dimensions is traversed, and matching is performed in the link information corresponding to the network link according to the feature description information of multiple dimensions, that is, multiple field information in the feature description information of multiple dimensions is matched in the link information corresponding to the network link, and link information matching the field information in the feature description information of multiple dimensions is obtained, and the successfully matched link information is used as the feature data of multiple dimensions of the network link.

[0067] In this embodiment, corresponding feature description information is set according to multiple feature dimensions, which is convenient for direct calling when determining the feature data of the network link, so as to quickly obtain feature data of multiple dimensions that can more accurately characterize the actual situation of the network link, and can adapt to changes in different network environments and business needs, and improve the accuracy and applicability of the prediction of the association relationship type of the network link pair.

[0068] S230: Determine a target feature matrix based on feature data of multiple dimensions of each network link in the network link pair to be predicted.

[0069] S240 , predicting the association relationship type of the network link pair to be predicted based on the target feature matrix through the pre-trained association prediction model, and determining the association relationship type of the network link pair to be predicted.

[0070] The technical solution of this embodiment is to obtain the link information of each network link in the network link pair to be predicted; for each network link, the feature description information of multiple dimensions is matched in the link information corresponding to the network link, and the feature data of multiple dimensions of the network link is determined based on the link information matching the feature description information of multiple dimensions; wherein the feature description information of each dimension includes multiple field information; the target feature matrix is ​​determined based on the feature data of multiple dimensions of each network link in the network link pair to be predicted; through the pre-trained association prediction model, the association relationship type of the network link pair to be predicted is predicted based on the target feature matrix, and the association relationship type of the network link pair to be predicted is determined. This solution extracts feature data from the link information of each network link in the network link pair to be predicted, obtains feature data of multiple dimensions of the network links of the network link pair to be predicted, determines the target feature matrix corresponding to the feature data of the network links of multiple dimensions, predicts the association relationship between the network links through the association prediction model and the target feature matrix corresponding to the network link pair to be predicted, and obtains accurate association relationship prediction results, thereby solving the problem of being unable to accurately and efficiently predict the association relationship between network links and improving the accuracy and efficiency of association relationship type prediction.

[0071] Embodiment 3

[0072] Figure 3 FIG. 1 is a schematic diagram of the structure of a network link association prediction device provided by Embodiment 3 of the present invention. Figure 3 As shown, the device comprises:

[0073] The feature data determination module 310 is used to obtain link information of each network link in the network link pair to be predicted, and determine feature data of multiple dimensions of each network link based on the link information of each network link, wherein the multiple dimensions include a protocol space dimension, an address space dimension, an autonomous domain space dimension, an account space dimension, and a comprehensive space dimension;

[0074] A target feature matrix determination module 320, configured to determine a target feature matrix based on feature data of multiple dimensions of each network link in the network link pair to be predicted;

[0075] The prediction result determination module 330 is used to predict the association relationship type of the network link pair to be predicted based on the target feature matrix through the pre-trained association prediction model, and determine the association relationship type of the network link pair to be predicted.

[0076] The technical solution of this embodiment obtains the link information of each network link in the network link pair to be predicted through the feature data determination module, and determines the feature data of multiple dimensions of each network link based on the link information of each network link, wherein the multiple dimensions include the protocol space dimension, the address space dimension, the autonomous domain space dimension, the account space dimension and the comprehensive space dimension; the target feature matrix determination module determines the target feature matrix based on the feature data of multiple dimensions of each network link in the network link pair to be predicted; the prediction result determination module predicts the type of association relationship of the network link pair to be predicted based on the target feature matrix through the pre-trained association prediction model. This solution predicts the association relationship between network links based on the feature data of multiple dimensions of network links corresponding to the network link pair to be predicted through the association prediction model, obtains accurate association relationship prediction results corresponding to the network link pair to be predicted, realizes the method of predicting the association relationship of the network link to be predicted through multi-dimensional network link data, solves the problem of being unable to accurately and efficiently predict the association relationship between network links, and improves the accuracy and efficiency of association relationship type prediction.

[0077] Based on the above embodiment, optionally, a feature data determination module 310 is specifically used to match, for each network link, feature description information based on multiple dimensions in link information corresponding to the network link, and determine feature data of multiple dimensions of the network link based on the link information that matches the feature description information of multiple dimensions; wherein the feature description information of each dimension includes multiple field information.

[0078] Optionally, the target feature matrix determination module 320 is specifically used to determine the feature matrix corresponding to each dimension based on the feature data of each dimension, wherein the feature matrix satisfies a first matrix size; and determine the target feature matrix based on the feature matrices corresponding to multiple dimensions, wherein the target feature matrix satisfies a second matrix size, and the first matrix size is smaller than the second matrix size.

[0079] Optionally, the association relationship type includes a main partner type, a self or multi-link type, a same network type and other types; the main partner type is a type that characterizes that two links form a pair of transceiver relationships; the self or multi-link type is a type that characterizes the same transmission / reception between two links, or a complementary relationship in a multi-link scenario; the same network type is a type that characterizes that two links belong to the same network; other types are types that characterize that they do not belong to any of the main partner type, self or multi-link type and same network type.

[0080] Optionally, the prediction result determination module 330 includes an association prediction model training unit, which is used to obtain a network link sample data set, determine the feature data of multiple dimensions of each network link sample based on the link information of each network link sample in the network link sample data set; for any two network link samples, determine the calibration association relationship type of the two network link samples based on the feature data of multiple dimensions corresponding to the two network link samples; train the association prediction model to be trained based on the feature data of multiple dimensions of any two network link samples and the corresponding calibration association relationship type until the model training stop condition is met to obtain a trained association prediction model. The association prediction model training unit is specifically used to calculate the similarity data corresponding to the feature data of each dimension for any two network link samples based on the feature data of each dimension corresponding to the two network link samples; determine the similarity results corresponding to the two network link samples based on the similarity data corresponding to the feature data of each dimension; and determine the calibration association relationship type of the two network link samples based on the similarity results. After determining the calibrated association relationship types of the two network link samples based on the similarity results, the association prediction model training unit is also specifically used to transmit the calibrated association relationship types of the two network link samples to the verification end for display; in response to an editing operation on the calibrated association relationship types of the two network link samples, the calibrated association relationship types of the two network link samples are updated based on the edited information.

[0081] The network link association prediction device provided in the embodiment of the present invention can execute the network link association prediction method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0082] Embodiment 4

[0083] Figure 41 is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0084] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0085] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0086] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the association prediction method of the network link.

[0087] In some embodiments, the association prediction method of the network link can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the association prediction method of the network link described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute the association prediction method of the network link by any other appropriate means (for example, by means of firmware).

[0088] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0089] The computer program for implementing the network link association prediction method of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program can be executed entirely on the machine, partially on the machine, partially on the machine as an independent software package and partially on a remote machine, or completely on a remote machine or server.

[0090] Embodiment 5

[0091] Embodiment 5 of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to execute a network link association prediction method, the method comprising:

[0092] Acquire link information of each network link in the network link pair to be predicted, and determine feature data of multiple dimensions of each network link based on the link information of each network link, wherein the multiple dimensions include a protocol space dimension, an address space dimension, an autonomous domain space dimension, an account space dimension, and a comprehensive space dimension;

[0093] Determine a target feature matrix based on feature data of multiple dimensions of each network link in the network link pair to be predicted;

[0094] Through the pre-trained association prediction model, the association relationship type of the network link pair to be predicted is predicted based on the target feature matrix, and the association relationship type of the network link pair to be predicted is determined.

[0095] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0096] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0097] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0098] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0099] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0100] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A network link association prediction method, characterized in that: include: Acquire link information of each network link in the network link pair to be predicted, and determine feature data of multiple dimensions of each network link based on the link information of each network link, wherein the multiple dimensions include a protocol space dimension, an address space dimension, an autonomous domain space dimension, an account space dimension, and a comprehensive space dimension; Determine a target feature matrix based on feature data of multiple dimensions of each of the network links in the network link pair to be predicted; The association relationship type of the network link pair to be predicted is predicted based on the target feature matrix through a pre-trained association prediction model, and the association relationship type of the network link pair to be predicted is determined.

2. The method according to claim 1, characterized in that The determining of the characteristic data of multiple dimensions of each of the network links based on the link information of each of the network links includes: For each of the network links, feature description information based on multiple dimensions is matched in link information corresponding to the network link, and feature data of multiple dimensions of the network link is determined based on the link information matching the feature description information of the multiple dimensions; wherein the feature description information of each dimension includes multiple field information.

3. The method according to claim 1, characterized in that The determining of the target feature matrix based on the feature data of multiple dimensions of each of the network links in the network link pair to be predicted includes: Determine a feature matrix corresponding to each dimension based on the feature data of each dimension, wherein the feature matrix satisfies a first matrix size; The target feature matrix is ​​determined based on the feature matrices corresponding to the multiple dimensions respectively, wherein the target feature matrix satisfies a second matrix size, and the first matrix size is smaller than the second matrix size.

4. The method according to claim 1, characterized in that: The association relationship types include main partner type, self or multi-link type, same network type and other types; the main partner type is a type that characterizes that two links form a pair of transceiver relationships; the self or multi-link type is a type that characterizes the same transmission / reception between two links, or a complementary relationship in a multi-link scenario; the same network type is a type that characterizes that two links belong to the same network; the other types are types that characterize that they do not belong to any of the main partner type, the self or multi-link type and the same network type.

5. The method according to claim 1, characterized in that The training method of the association prediction model comprises: Acquire a network link sample data set, and determine feature data of multiple dimensions of each network link sample based on link information of each network link sample in the network link sample data set; For any two of the network link samples, determining the calibration association relationship type of the two network link samples based on the feature data of multiple dimensions corresponding to the two network link samples; The association prediction model to be trained is trained based on the feature data of multiple dimensions of any two of the network link samples and the corresponding calibrated association relationship types until the model training stop condition is met, thereby obtaining a trained association prediction model.

6. The method according to claim 5, characterized in that For any two of the network link samples, determining the calibration association relationship type of the two network link samples based on the feature data of multiple dimensions corresponding to the two network link samples includes: For any two of the network link samples, based on the feature data of each dimension corresponding to the two network link samples, calculate the similarity data corresponding to the feature data of each dimension; Determine the similarity results corresponding to the two network link samples based on the similarity data corresponding to the feature data of each dimension; Based on the similarity result, a calibrated association relationship type between the two network link samples is determined.

7. The method according to claim 6, characterized in that After determining the calibrated association relationship type of the two network link samples based on the similarity result, the method further includes: Transmitting the calibrated association relationship types of the two network link samples to the verification end for display; In response to an editing operation on the calibrated association relationship types of the two network link samples, the calibrated association relationship types of the two network link samples are updated based on the edited information.

8. A network link association prediction device, characterized in that: include: A feature data determination module, used to obtain link information of each network link in the network link pair to be predicted, and determine feature data of multiple dimensions of each network link based on the link information of each network link, wherein the multiple dimensions include a protocol space dimension, an address space dimension, an autonomous domain space dimension, an account space dimension, and a comprehensive space dimension; A target feature matrix determination module, configured to determine a target feature matrix based on feature data of multiple dimensions of each of the network links in the network link pair to be predicted; The prediction result determination module is used to predict the association relationship type of the network link pair to be predicted based on the target feature matrix through a pre-trained association prediction model, and determine the association relationship type of the network link pair to be predicted.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network link association prediction method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network link association prediction method according to any one of claims 1 to 7 when executed.

Images