Self-learning algorithm and device for network configuration auditing rule

Abstract

The invention relates to the technical field of information, in particular to a self-learning algorithm and device for a network configuration auditing rule. According to the invention, intelligent auditing of network equipment configuration is realized, configuration files, historical traffic data and operation logs of the network equipment can be automatically collected and processed, key features are extracted, and a decision tree model is trained based on the features; manual participation is greatly reduced in the process, and the auditing efficiency and accuracy are improved; meanwhile, along with the continuous change of the network environment, the algorithm can continuously learn and update to adapt to new configuration problems and fault modes, and the timeliness and effectiveness of the auditing rule are ensured; the network configuration auditing rule self-learning device provided by the invention has high expandability and flexibility; each network node in the device is provided with powerful computing resources, and large-scale network configuration data can be processed.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a self-learning algorithm and device for network configuration auditing rules. Background Art

[0002] In today's highly information-based society, the network has become an indispensable infrastructure for all walks of life. As the scale of networks continues to expand and the complexity increases, the management and auditing of network configuration has become an important issue that needs to be solved urgently. Traditional network configuration auditing methods mainly rely on manual review, which is not only time-consuming and labor-intensive, but also prone to errors and cannot meet the needs of fast and accurate auditing of large-scale networks.

[0003] In the prior art, although there are some automated network configuration auditing tools, most of these tools use preset auditing rules for auditing. However, with the continuous development of network technology and the continuous changes in network environment, the preset auditing rules are often difficult to adapt to new network configuration scenarios and requirements, resulting in limited accuracy and reliability of auditing results.

[0004] In order to solve the above problems, the present invention proposes a self-learning algorithm and device for network configuration audit rules. Summary of the invention

[0005] The purpose of the present invention is to solve the problems existing in the background technology and to propose a self-learning algorithm and device for network configuration audit rules.

[0006] The purpose of the present invention can be achieved through the following technical solutions: In a first aspect, the present invention provides a self-learning algorithm for network configuration audit rules, comprising the following steps: Step 1: Data collection and preprocessing; Obtain network device configuration files, historical network traffic data, and device operation logs to obtain original configuration data. Extract abnormal configuration data through data mining of original network configuration data to locate potential network configuration problems.

[0007] Network devices including routers, switches, and firewalls are numbered with the symbol i; i=1, 2, ..., n; n is the total number of network devices.

[0008] Collect the configuration files of all network devices i and extract the configuration parameters, including the device name ID_i, device type Device_i, device enable state symbol State_i, IP address IPAddress_i, subnet mask Subnet_i, target network Destination_i, gateway Gateway_i and interface Interface_i. When the value of the device enable state symbol State_i is 1, it means that the network device is enabled; when the value of the device enable state symbol State_i is 0, it means that the network device is disabled.

[0009] Collect all fault records, device restart records and performance warnings in the device operation log of network device i, and obtain the timestamp Timestamp_i, fault type FaultID_i, affected device number DeviceID_i, fault description code Description_i and restart time RestartTime_i of the most recent fault. If no fault record is extracted from the device operation log of network device i, set the timestamp Timestamp_i, fault type FaultID_i, affected device number DeviceID_i, fault description code Description_i and restart time RestartTime_i of the most recent fault to 0.

[0010] Generate the original configuration data feature matrix of each network device at the current time t At every preset time interval, the original configuration data of each network device i is re-acquired, and the corresponding original configuration data feature matrix is ​​dynamically updated.

[0011] Statistical feature extraction is performed on the original configuration data. The specific process is as follows: Every preset statistical period, all original configuration data feature matrices obtained by dynamic updating of the same network device i are counted, and the probability distribution is estimated by the frequency distribution of elements in the matrix, and the preset formula is used to calculate the probability distribution of all original configuration data feature matrices obtained by dynamic updating of the same network device i. Calculate the joint probability distribution of each element in the original configuration data feature matrix And the marginal probability distribution and ;in is the number of original configuration data feature matrices that satisfy the conditions: x1=a and x2=b; To meet the condition: x1 = the number of original configuration data feature matrices of a; To meet the condition: x2=b, the number of original configuration data feature matrices; x1 and x2 are two elements in the original configuration data feature matrix; T is the number of original configuration data feature matrices generated by the same network device in a statistical period. a and b are the specific values ​​of the original configuration data x1 and x2 respectively.

[0012] According to the calculated joint probability distribution and marginal probability distribution, substitute into the preset formula Calculate the statistical impact value of the original configuration data when x1=a and x2=b . Where A and B are the sets of all specific values ​​of the original configuration data x1 and x2 respectively.

[0013] As a preferred embodiment of the present invention, all calculated statistical influence values ​​are sorted from large to small. The specific arrangement order reflects the statistical dependence between any two configuration parameters. According to the sorted statistical influence values, the first k components of the influence feature vector Z(i)={I1, I2, ..., Ik} are selected. Where k is a preset threshold; where I1, I2, ..., Ik are sorted statistical influence values.

[0014] Define fault labels: When it is identified that a fault or configuration problem is recorded in the device operation log of network device i in the previous statistical period, the corresponding fault label Y(i) is set to 1; otherwise, the corresponding fault label Y(i) is set to 0.

[0015] Step 2: Self-learning model training and parameter setting; Create a configuration diagnosis self-learning model based on a decision tree, and perform supervised learning based on the extracted key feature data.

[0016] The influence feature vector Z(i) = {I1, I2, ..., Ik} of each network device i generated in step 1 is used as the input feature of the model. And according to the historical network configuration problems and fault records, the configuration status of each network device is automatically labeled to prepare label data for supervised learning.

[0017] As a preferred embodiment of the present invention, the extracted feature vector and label data are used to train a decision tree model. The training process of the decision tree includes the following steps: As a preferred embodiment of the present invention, the optimal feature is selected for splitting at each node in the decision tree, and information gain is selected as the criterion for feature selection. The information gain formula is: ;in, is the entropy of the fault label Y(i); It is the subset that affects the eigenvector Z(i) when its value is v.

[0018] As a preferred method of the present invention, the decision tree is recursively split, starting from the root node of the decision tree, the influence feature vector Z(i) = {I1, I2, ..., Ik} of each network device i is input into the decision tree as initial data, and at the current node, the information gain of all the influence feature vectors is calculated. , and select the element that has the greatest impact on the information gain in the feature vector as the split feature.

[0019] The data set is divided into subsets according to the selected features, and each subset is split recursively until the stopping condition is met: the value of the information gain is less than the preset threshold or the number of recursive splits of the decision tree is greater than the preset threshold. Finally, a decision tree is generated, and each leaf node corresponds to a category, that is, network device i is normal or abnormal. When the network device i is judged to be normal, the leaf node outputs the judgment parameter U(i)=1; when the network device i is judged to be abnormal, the leaf node outputs the judgment parameter U(i)=0.

[0020] As a preferred embodiment of the present invention, after the decision tree is generated, a pruning operation is performed to obtain the final configuration diagnosis self-learning model to prevent overfitting.

[0021] Step 3: Self-learning model evaluation; Generate a validation dataset, including validation influence feature vectors and verify the fault label .

[0022] After obtaining the final configuration diagnosis self-learning model, repeat step 1 to generate the impact feature vector of each network device i again, which is recorded as the verification impact feature vector ={I1, I2, ..., Ik}; Generate the fault label of each network device i again, and record it as the verification fault label .

[0023] Use validation to influence feature vectors and verify the fault label Evaluating the trained decision tree model will affect the feature vector Input the final configuration diagnosis self-learning model, obtain the output results, and calculate the following indicators: For the same validation, the feature vector , if the output result of the configuration diagnosis self-learning model is abnormal, that is, the output Ui=0; and the verification fault label The value of is 0; then it is recorded as a true positive example; For the same validation, the feature vector , if the output result of the configuration diagnosis self-learning model is abnormal, that is, the output Ui=1; and the verification fault label The value of is 1; then it is recorded as a true negative example; For the same validation, the feature vector , if the output result of the configuration diagnosis self-learning model is abnormal, that is, the output Ui=0; and the verification fault label The value of is 1; then it is recorded as a false positive example; For the same validation, the feature vector , if the output result of the configuration diagnosis self-learning model is normal, that is, the output Ui=1; and the verification fault label The value of is 0; then it is recorded as a false negative example; Traverse all network devices i=1, 2, ..., n, and count the total number of true positives TP, the total number of true negatives TN, the number of false positives FP, and the number of false negatives FN.

[0024] By preset formula Calculate the accuracy, precision, recall, and F1 score of the final configuration diagnosis self-learning model.

[0025] When the conditions are met: the accuracy is greater than the preset threshold and the F1 score is greater than the preset threshold, the configuration diagnosis self-learning model is determined to be qualified and the process goes to step 4. Otherwise, the process returns to step 3 and the decision tree training for the configuration diagnosis self-learning model is performed again.

[0026] Step 4: Generate audit rules; Based on the trained decision tree-based configuration diagnosis self-learning model, its splitting rules and leaf node judgment conditions are extracted to generate network configuration audit rules. The network configuration audit rules are expressed as a series of logical conditions used to determine whether the configuration of the network device is normal, specifically: Whenever an impact feature vector of a network device is obtained, it is input into the root node in the configuration diagnosis self-learning model to obtain the output value U(i) of the leaf node, and the path from the root node to the leaf node is recorded as a rule.

[0027] For example, suppose a path of the decision tree is: root node: I1>0.8; internal node: I2<0.5; leaf node: U(i)=0. Then the audit rule is generated: IFI1>0.8 AND I2<0.5 THEN The configuration of network device i is abnormal.

[0028] Then generate audit rules: IFI1>0.8 AND I2<0.5 THEN Device i configuration is abnormal.

[0029] Traverse each internal node of the decision tree and record its split features and split conditions.

[0030] As a preferred embodiment of the present invention, all generated audit rules are recorded for optimization, redundant conditions are removed, and similar rules are merged by using a rule induction algorithm.

[0031] In a second aspect, the present invention provides a self-learning device for network configuration auditing rules, comprising a plurality of network nodes, each of which includes a central processing unit (CPU), a graphics processing unit (GPU), a storage device and a network interface.

[0032] The CPU is responsible for overall task scheduling, data preprocessing, rule generation, and logic control. The GPU is used to accelerate model training and reasoning, especially the split calculation and feature importance analysis of the decision tree model, and supports the deep learning acceleration library to optimize the training efficiency of the decision tree model.

[0033] All network nodes are integrated through network connections and are equipped with preset modules, including: data collection and preprocessing module, model training module, rule generation module and real-time audit module.

[0034] The data collection and preprocessing module collects configuration data and operation logs from network devices and performs preprocessing. It has built-in data cleaning and feature extraction algorithms to automatically generate impact feature vectors.

[0035] The model training module configures the diagnostic self-learning model based on the decision tree algorithm training, with built-in information gain calculation and recursive splitting algorithm to generate a decision tree model.

[0036] The rule generation module extracts audit rules from the trained decision tree model and removes redundant conditions and merges similar rules through the built-in rule optimization algorithm.

[0037] The real-time audit module applies the generated audit rules to real-time network configuration detection. It has a built-in anomaly detection and alarm mechanism. When an abnormal network configuration is identified, an alarm is triggered and an abnormal notification signal is sent to the administrator.

[0038] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention realizes intelligent auditing of network device configuration through a self-learning algorithm of network configuration auditing rules. The algorithm can automatically collect and process configuration files, historical traffic data and operation logs of network devices, extract key features, and train decision tree models based on these features. This process greatly reduces manual participation and improves the efficiency and accuracy of auditing. At the same time, as the network environment continues to change, the algorithm can continue to learn and update to adapt to new configuration problems and failure modes, ensuring the timeliness and effectiveness of auditing rules; 2. The network configuration audit rule self-learning device of the present invention is highly scalable and flexible. Each network node in the device is equipped with powerful computing resources (including CPU and GPU) and can process large-scale network configuration data. In addition, the algorithm supports a variety of feature extraction and model training methods, which can be customized and optimized according to different network environments and requirements. This scalability and flexibility enable the present invention to be widely used in network environments of various sizes and types to meet the audit needs of different users; 3. The present invention significantly improves the speed and accuracy of configuration problem diagnosis. By deeply mining the statistical dependencies between configuration data, the algorithm can accurately identify potential network configuration problems and generate corresponding audit rules. These rules are expressed in the form of logical conditions, which are easy to understand and apply, helping network administrators to quickly locate and solve configuration problems and reduce the risk of network failures. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings: Figure 1 is a flow chart of the method of the present invention; Figure 2 It is a decision tree schematic diagram of the present invention; Figure 3 A schematic diagram of a network node of a self-learning device for network configuration auditing rules of the present invention; Figure 4 A system block diagram of a self-learning device for network configuration auditing rules according to the present invention. DETAILED DESCRIPTION

[0040] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] See also Figure 1 As shown, a self-learning algorithm for network configuration auditing rules includes the following steps: Step 1: Data collection and preprocessing; Obtain network device configuration files, historical network traffic data, and device operation logs to obtain original configuration data. Extract abnormal configuration data through data mining of original network configuration data to locate potential network configuration problems.

[0042] Network devices including routers, switches, and firewalls are numbered with the symbol i; i=1, 2, ..., n; n is the total number of network devices.

[0043] Collect the configuration files of all network devices i and extract the configuration parameters, including the device name ID_i, device type Device_i, device enable state symbol State_i, IP address IPAddress_i, subnet mask Subnet_i, target network Destination_i, gateway Gateway_i and interface Interface_i. When the value of the device enable state symbol State_i is 1, it means that the network device is enabled; when the value of the device enable state symbol State_i is 0, it means that the network device is disabled.

[0044] Collect all fault records, device restart records and performance warnings in the device operation log of network device i, and obtain the timestamp Timestamp_i, fault type FaultID_i, affected device number DeviceID_i, fault description code Description_i and restart time RestartTime_i of the most recent fault. If no fault record is extracted from the device operation log of network device i, set the timestamp Timestamp_i, fault type FaultID_i, affected device number DeviceID_i, fault description code Description_i and restart time RestartTime_i of the most recent fault to 0.

[0045] Generate the original configuration data feature matrix of each network device at the current time t At every preset time interval, the original configuration data of each network device i is re-acquired, and the corresponding original configuration data feature matrix is ​​dynamically updated.

[0046] Furthermore, statistical feature extraction is performed on the original configuration data. The specific process is as follows: Every preset statistical period, all original configuration data feature matrices obtained by dynamic updating of the same network device i are counted, and the probability distribution is estimated by the frequency distribution of elements in the matrix, and the preset formula is used to calculate the probability distribution of all original configuration data feature matrices obtained by dynamic updating of the same network device i. Calculate the joint probability distribution of each element in the original configuration data feature matrix And the marginal probability distribution and ;in is the number of original configuration data feature matrices that satisfy the conditions: x1=a and x2=b; To meet the condition: x1 = the number of original configuration data feature matrices of a; To meet the condition: x2=b, the number of original configuration data feature matrices; x1 and x2 are two elements in the original configuration data feature matrix; T is the number of original configuration data feature matrices generated by the same network device in a statistical period. a and b are the specific values ​​of the original configuration data x1 and x2 respectively.

[0047] According to the calculated joint probability distribution and marginal probability distribution, substitute into the preset formula Calculate the statistical impact value of the original configuration data when x1=a and x2=b . Where A and B are the sets of all specific values ​​of the original configuration data x1 and x2 respectively.

[0048] It should be noted that the statistical impact value is an indicator to measure the nonlinear relationship between two variables, which can capture the statistical dependence between variables. The statistical impact value measures the amount of shared information between two variables. The larger the value of the statistical impact value, the stronger the correlation between the two variables. For example, when the xi subnet mask Subnet_i is 255.255.255.0 and the IP address IPAddress_i is 192.168.0.1, the calculated statistical impact value is If the value of is 0.75, it means that there is a strong correlation between the corresponding IP address and subnet mask, that is, there is a certain statistical dependence between their values.

[0049] Furthermore, all calculated statistical impact values ​​are sorted from large to small. The specific order of arrangement reflects the statistical dependence between any two configuration parameters. According to the sorted statistical impact values, the first k components are selected to form the impact feature vector Z(i) = {I1, I2, ..., Ik}. Where k is the preset threshold; where I1, I2, ..., Ik are the sorted statistical impact values.

[0050] It should be noted that the impact feature vector reflects the probability or type of occurrence of network configuration problems and can be used for subsequent machine learning model training or diagnosis of network configuration problems.

[0051] Define fault labels: When it is identified that a fault or configuration problem is recorded in the device operation log of network device i in the previous statistical period, the corresponding fault label Y(i) is set to 1; otherwise, the corresponding fault label Y(i) is set to 0.

[0052] Step 2: Self-learning model training and parameter setting; Create a configuration diagnosis self-learning model based on a decision tree, and perform supervised learning based on the extracted key feature data.

[0053] The influence feature vector Z(i) = {I1, I2, ..., Ik} of each network device i generated in step 1 is used as the input feature of the model. And according to the historical network configuration problems and fault records, the configuration status of each network device is automatically labeled to prepare label data for supervised learning.

[0054] Furthermore, the extracted feature vectors and label data are used to train the decision tree model. The training process of the decision tree includes the following steps: See also Figure 2 As shown, the optimal feature is selected for splitting at each node in the decision tree, and information gain is used as the criterion for feature selection. The information gain formula is: ;in, is the entropy of the fault label Y(i); It is the subset that affects the eigenvector Z(i) when its value is v.

[0055] Furthermore, the decision tree is recursively split, starting from the root node of the decision tree, and the influence feature vector Z(i) = {I1, I2, ..., Ik} of each network device i is input into the decision tree as the initial data. At the current node, the information gain of all the influence feature vectors is calculated. , and select the element that has the greatest impact on the information gain in the feature vector as the split feature.

[0056] The data set is divided into subsets according to the selected features, and each subset is split recursively until the stopping condition is met: the value of the information gain is less than the preset threshold or the number of recursive splits of the decision tree is greater than the preset threshold. Finally, a decision tree is generated, and each leaf node corresponds to a category, that is, network device i is normal or abnormal. When the network device i is judged to be normal, the leaf node outputs the judgment parameter U(i)=1; when the network device i is judged to be abnormal, the leaf node outputs the judgment parameter U(i)=0.

[0057] Furthermore, after the decision tree is generated, a pruning operation is performed to obtain the final configuration diagnosis self-learning model to prevent overfitting.

[0058] Step 3: Self-learning model evaluation; Generate a validation dataset, including validation influence feature vectors and verify the fault label .

[0059] After obtaining the final configuration diagnosis self-learning model, repeat step 1 to generate the impact feature vector of each network device i again, which is recorded as the verification impact feature vector ={I1, I2, ..., Ik}; Generate the fault label of each network device i again, and record it as the verification fault label .

[0060] Use validation to influence feature vectors and verify the fault label Evaluating the trained decision tree model will affect the feature vector Input the final configuration diagnosis self-learning model, obtain the output results, and calculate the following indicators: For the same validation, the feature vector , if the output result of the configuration diagnosis self-learning model is abnormal, that is, the output Ui=0; and the verification fault label The value of is 0; then it is recorded as a true positive example; For the same validation, the feature vector , if the output result of the configuration diagnosis self-learning model is abnormal, that is, the output Ui=1; and the verification fault label The value of is 1; then it is recorded as a true negative example; For the same validation, the feature vector , if the output result of the configuration diagnosis self-learning model is abnormal, that is, the output Ui=0; and the verification fault label The value of is 1; then it is recorded as a false positive example; For the same validation, the feature vector , if the output result of the configuration diagnosis self-learning model is normal, that is, the output Ui=1; and the verification fault label The value of is 0; then it is recorded as a false negative example; Traverse all network devices i=1, 2, ..., n, and count the total number of true positives TP, the total number of true negatives TN, the number of false positives FP, and the number of false negatives FN.

[0061] By preset formula Calculate the accuracy, precision, recall, and F1 score of the final configuration diagnosis self-learning model.

[0062] When the conditions are met: the accuracy is greater than the preset threshold and the F1 score is greater than the preset threshold, the configuration diagnosis self-learning model is determined to be qualified and the process goes to step 4. Otherwise, the process returns to step 3 and the decision tree training for the configuration diagnosis self-learning model is performed again.

[0063] It should be noted that accuracy measures the accuracy of the model's overall prediction; precision measures the reliability of the model's predictions as positive examples; recall measures the model's ability to find positive examples; and the F1 score is a comprehensive indicator of precision and recall, which is suitable for scenarios that need to balance the two. By calculating these indicators, the performance of the decision tree model can be comprehensively evaluated, and the model can be optimized based on the evaluation results, thereby improving the accuracy and efficiency of network configuration audits.

[0064] Step 4: Generate audit rules; Based on the trained decision tree-based configuration diagnosis self-learning model, its splitting rules and leaf node judgment conditions are extracted to generate network configuration audit rules. The network configuration audit rules are expressed as a series of logical conditions used to determine whether the configuration of the network device is normal, specifically: Whenever an impact feature vector of a network device is obtained, it is input into the root node in the configuration diagnosis self-learning model to obtain the output value U(i) of the leaf node, and the path from the root node to the leaf node is recorded as a rule.

[0065] For example, suppose a path of the decision tree is: root node: I1>0.8; internal node: I2<0.5; leaf node: U(i)=0. Then the audit rule is generated: IFI1>0.8 AND I2<0.5 THEN The configuration of network device i is abnormal.

[0066] Then generate audit rules: IFI1>0.8 AND I2<0.5 THEN Device i configuration is abnormal.

[0067] Traverse each internal node of the decision tree and record its split features and split conditions.

[0068] Furthermore, all the generated audit rules are recorded for optimization, redundant conditions are removed, and similar rules are merged by using rule induction algorithms.

[0069] It should be noted that the significance of audit rule generation is to improve the speed of network configuration diagnosis by recording fixed mapping relationships. It is not necessary to call the configuration diagnosis self-learning model based on the decision tree in each network diagnosis, reducing unnecessary waste of computing power.

[0070] See also Figure 3 and Figure 4 As shown, a self-learning device for network configuration audit rules includes a plurality of network nodes, each of which includes a central processing unit CPU, a graphics processing unit GPU, a storage device and a network interface.

[0071] The CPU is responsible for overall task scheduling, data preprocessing, rule generation, and logic control. The GPU is used to accelerate model training and reasoning, especially the split calculation and feature importance analysis of the decision tree model, and supports the deep learning acceleration library to optimize the training efficiency of the decision tree model.

[0072] All network nodes are integrated through network connections and are equipped with preset modules, including: data collection and preprocessing module, model training module, rule generation module and real-time audit module.

[0073] The data collection and preprocessing module collects configuration data and operation logs from network devices and performs preprocessing. It has built-in data cleaning and feature extraction algorithms to automatically generate impact feature vectors.

[0074] The model training module configures the diagnostic self-learning model based on the decision tree algorithm training, with built-in information gain calculation and recursive splitting algorithm to generate a decision tree model.

[0075] The rule generation module extracts audit rules from the trained decision tree model and removes redundant conditions and merges similar rules through the built-in rule optimization algorithm.

[0076] The real-time audit module applies the generated audit rules to real-time network configuration detection. It has a built-in anomaly detection and alarm mechanism. When an abnormal network configuration is identified, an alarm is triggered and an abnormal notification signal is sent to the administrator.

[0077] It should be understood that the terms “include” and “comprising” used in the specification and claims of the present disclosure indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0078] It should also be understood that the terms used in this disclosure are only for the purpose of describing specific embodiments and are not intended to limit the disclosure. As used in this disclosure and the claims, the singular forms "a", "an", and "the" are intended to include the plural forms unless the context clearly indicates otherwise. It should also be further understood that the term "and / or" used in this disclosure and the claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations; The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A self-learning algorithm for network configuration audit rules, characterized in that: The following steps are involved: Step 1: Data collection and preprocessing; Obtain network device configuration files, historical network traffic data, and device operation logs to obtain original configuration data; extract abnormal configuration data through data mining of original network configuration data, locate potential network configuration problems, generate impact feature vectors corresponding to each network device, and define fault labels for network devices; Step 2: Self-learning model training and parameter setting; Create a configuration diagnosis self-learning model based on a decision tree and perform supervised learning based on the extracted key feature data; Step 3: Self-learning model evaluation; Evaluate the configuration diagnosis self-learning model and generate a validation data set, including a validation impact feature vector and a validation fault label. Use the trained configuration diagnosis self-learning model to process the validation data set and obtain the output result. Compare the output result of the model with the validation fault label and count the number of true positives, true negatives, false positives, and false negatives. The accuracy, precision, recall and F1 score of the model are calculated by the preset formula; if the accuracy and F1 score of the model are both greater than the preset threshold, the model is judged to be qualified and the process goes to step 4; Otherwise, return to step 3 to retrain the model; Step 4: Generate audit rules; Audit rule extraction is performed. Based on the trained decision tree model, its splitting rules and leaf node judgment conditions are extracted; the extracted rules are expressed as logical conditions to determine whether the configuration of the network device is normal; specifically, the influencing feature vector is input into the root node of the decision tree, the path is traced to the leaf node, the splitting features and conditions on the path are recorded, and the audit rules are formed.

2. A self-learning algorithm for network configuration audit rules according to claim 1, characterized in that: The specific process of obtaining the original configuration data is as follows: Network devices including routers, switches, and firewalls are numbered, with the number symbol i; i = 1, 2, ..., n; n is the total number of network devices; Collect the configuration files of all network devices i and extract the configuration parameters therein, including the device name ID_i, device type Device_i, device enable state symbol State_i, IP address IPAddress_i, subnet mask Subnet_i, target network Destination_i, gateway Gateway_i and interface Interface_i of the network device; among which, when the value of the device enable state symbol State_i is 1, it means that the network device is in the enabled state; when the value of the device enable state symbol State_i is 0, it means that the network device is in the disabled state; Collect the fault records, device restart records and performance warnings in the device operation log of all network devices i, and obtain the timestamp Timestamp_i, fault type FaultID_i, affected device number DeviceID_i, fault description code Description_i and restart time RestartTime_i of the most recent fault; if no fault record is extracted from the device operation log of network device i, set the values ​​of the timestamp Timestamp_i, fault type FaultID_i, affected device number DeviceID_i, fault description code Description_i and restart time RestartTime_i of the most recent fault to 0; Generate the original configuration data feature matrix of each network device at the current time t ; At every preset time interval, the original configuration data of each network device i is re-acquired, the corresponding original configuration data feature matrix is ​​dynamically updated, and statistical features of the original configuration data are extracted.

3. A self-learning algorithm for network configuration auditing rules according to claim 2, characterized in that: The specific process of extracting statistical features from the original configuration data is as follows: Every preset statistical period, all original configuration data feature matrices obtained by dynamic updating of the same network device i are counted, and the probability distribution is estimated by the frequency distribution of elements in the matrix, and the preset formula is used to calculate the probability distribution of the original configuration data feature matrix obtained by dynamic updating of the same network device i. Calculate the joint probability distribution of each element in the original configuration data feature matrix And the marginal probability distribution and ;in is the number of original configuration data feature matrices that satisfy the conditions: x1=a and x2=b; To meet the condition: x1 = the number of original configuration data feature matrices of a; The number of original configuration data feature matrices that satisfy the condition: x2=b; where x1 and x2 are two elements in the original configuration data feature matrix; where T is the number of original configuration data feature matrices generated by the same network device within a statistical period; where a and b are the specific values ​​of the original configuration data x1 and x2 respectively; According to the calculated joint probability distribution and marginal probability distribution, substitute into the preset formula Calculate the statistical impact value of the original configuration data when x1=a and x2=b ; Where A and B are the sets of all specific values ​​of the original configuration data x1 and x2 respectively; All calculated statistical influence values ​​are sorted from large to small; the specific order of arrangement reflects the strength of statistical dependence between any two configuration parameters; according to the sorted statistical influence values, the first k components of the influence feature vector Z(i)={I1, I2, ..., Ik} are selected; k is the preset threshold; I1, I2, ..., Ik are the sorted statistical influence values.

4. A self-learning algorithm for network configuration auditing rules according to claim 1, characterized in that: The specific process of defining the fault label is as follows: when it is identified that a fault or configuration problem is recorded in the device operation log of network device i in the previous statistical period, the corresponding fault label Y(i) value is set to 1; otherwise, the corresponding fault label Y(i) value is set to 0.

5. A self-learning algorithm for network configuration auditing rules according to claim 1, characterized in that: The specific process of creating a decision tree-based configuration diagnosis self-learning model is as follows: The influence feature vector Z(i) = {I1, I2, ..., Ik} of each network device i generated in step 1 is used as the input feature of the model; Based on historical network configuration issues and fault records, the configuration status of each network device is automatically annotated to prepare labeled data for supervised learning; Train a decision tree model using the extracted feature vectors and labeled data; The decision tree training process consists of the following steps: In each node of the decision tree, the optimal feature is selected for splitting, and information gain is used as the criterion for feature selection. The information gain formula is: ;in, is the entropy of the fault label Y(i); It is the subset that affects the feature vector Z(i) when its value is v, and recursively splits the decision tree.

6. The self-learning algorithm for network configuration auditing rules according to claim 1 is characterized in that: The specific process of recursively splitting the decision tree is: Starting from the root node of the decision tree, the influence feature vector Z(i) = {I1, I2, ..., Ik} of each network device i is input into the decision tree as the initial data. At the current node, the information gain of all the influence feature vectors is calculated. , and select the element that has the largest impact on the information gain in the feature vector as the split feature; The data set is divided into subsets according to the selected features, and each subset is split recursively until the stopping condition is met: the value of the information gain is less than the preset threshold or the number of recursive splits of the decision tree is greater than the preset threshold. Finally, a decision tree is generated, and each leaf node corresponds to a category, that is, network device i is normal or abnormal; when the network device i is judged to be normal, the leaf node outputs the judgment parameter U(i)=1; when the network device i is judged to be abnormal, the leaf node outputs the judgment parameter U(i)=0.

7. A self-learning algorithm for network configuration auditing rules according to claim 1, characterized in that: The specific process of evaluating the configuration diagnosis self-learning model is as follows: Generate a validation dataset, including validation influence feature vectors and verify the fault label ; After obtaining the final configuration diagnosis self-learning model, repeat step 1 to generate the impact feature vector of each network device i again, which is recorded as the verification impact feature vector ={I1, I2, ..., Ik}; Generate the fault label of each network device i again, and record it as the verification fault label ; Use validation to influence feature vectors and verify the fault label Evaluating the trained decision tree model will affect the feature vector Input the final configuration diagnosis self-learning model, obtain the output results, and calculate the following indicators: For the same validation, the feature vector , if the output result of the configuration diagnosis self-learning model is abnormal, that is, the output Ui=0; and the verification fault label The value of is 0; then it is recorded as a true positive example; For the same validation, the feature vector , if the output result of the configuration diagnosis self-learning model is abnormal, that is, the output Ui=1; and the verification fault label The value of is 1; then it is recorded as a true negative example; For the same validation, the feature vector , if the output result of the configuration diagnosis self-learning model is abnormal, that is, the output Ui=0; and the verification fault label The value of is 1; then it is recorded as a false positive example; For the same validation, the feature vector , if the output result of the configuration diagnosis self-learning model is normal, that is, the output Ui=1; and the verification fault label The value of is 0; then it is recorded as a false negative example; Traverse all network devices i=1, 2, ..., n, and count the total number of true positives TP, the total number of true negatives TN, the number of false positives FP, and the number of false negatives FN; By preset formula Calculate the accuracy, precision, recall and F1 score of the final configuration diagnosis self-learning model; When the conditions are met: the accuracy is greater than the preset threshold and the F1 score is greater than the preset threshold, the configuration diagnosis self-learning model is determined to be qualified and the process goes to step 4. Otherwise, the process returns to step 3 and the decision tree training for the configuration diagnosis self-learning model is performed again.

8. A self-learning algorithm for network configuration auditing rules according to claim 1, characterized in that: The specific process of forming audit rules is as follows: Based on the trained decision tree-based configuration diagnosis self-learning model, its splitting rules and leaf node judgment conditions are extracted to generate network configuration audit rules; the network configuration audit rules are expressed as a series of logical conditions for judging whether the configuration of the network device is normal, specifically: Whenever the influence feature vector of a network device is obtained, it is input into the root node in the configuration diagnosis self-learning model to obtain the output value U(i) of the leaf node, and the path from the root node to the leaf node is recorded as a rule; each internal node of the decision tree is traversed to record its splitting features and splitting conditions; All generated audit rules are recorded for optimization, redundant conditions are removed, and similar rules are merged by using rule induction algorithms.

9. A self-learning device for network configuration audit rules, characterized in that: It includes several network nodes, each of which includes a central processing unit (CPU), a graphics processing unit (GPU), a storage device and a network interface; The CPU is responsible for overall task scheduling, data preprocessing, rule generation, and logic control; the GPU is used to accelerate model training and reasoning, especially the split calculation and feature importance analysis of the decision tree model, and supports the deep learning acceleration library to optimize the training efficiency of the decision tree model; All network nodes are integrated through network connections and are equipped with preset modules, including: data collection and preprocessing module, model training module, rule generation module and real-time audit module; The data collection and preprocessing module collects configuration data and operation logs from network devices and performs preprocessing. It has built-in data cleaning and feature extraction algorithms to automatically generate impact feature vectors. The model training module trains the configuration diagnosis self-learning model based on the decision tree algorithm, with built-in information gain calculation and recursive splitting algorithm to generate a decision tree model; The rule generation module extracts audit rules from the trained decision tree model and removes redundant conditions and merges similar rules through the built-in rule optimization algorithm; The real-time audit module applies the generated audit rules to real-time network configuration detection; it has a built-in anomaly detection and alarm mechanism. When a network configuration anomaly is identified, an alarm is triggered and an anomaly notification signal is sent to the administrator.

Images