Dynamic network topology updating method and system based on intelligent event filtering

Abstract

The invention provides a dynamic network topology updating method based on intelligent event filtering, which comprises the following steps of: S1, monitoring network equipment and link states in real time, and realizing asynchronous event processing by using a message queue; s2, intelligently identifying and screening the collected events, filtering noise events, and classifying effective events according to priorities; s3, based on the event priority, triggering incremental topology update of a corresponding type; and S4, verifying the consistency of topological updating, and confirming the legality of the topological structure. According to the invention, through technologies of machine learning intelligent event screening, priority-driven incremental updating, consistency verification and the like, high efficiency and accuracy of dynamic updating of the network topology are realized, system resource consumption is reduced, and reliability and real-time response capability of network operation and maintenance are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security pre-management, in particular to a method and system for updating dynamic network topology based on intelligent event filtering. Background Art

[0002] As industrial networks expand in size and complexity, topology updates have become an important part of network management. Traditional topology update methods usually rely on global scanning or manual operations, which not only consumes a lot of resources, but also has high latency and is difficult to meet real-time requirements. In addition, the number of events in the network environment is huge, and the proportion of noise events is high. How to quickly screen and process key events has become a technical challenge.

[0003] In high-concurrency scenarios, traditional methods are difficult to respond in time, which may cause network status information to lag. A large number of irrelevant or low-priority events increase the burden on the system topology. The global reconstruction strategy is too cumbersome to adapt to dynamic network needs, and there is a serious waste of resources. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a dynamic network topology update method and system based on intelligent event filtering, which optimizes the network topology management process through intelligent event identification, priority classification and incremental update strategy, combined with consistency verification technology, so as to solve the problems of inefficient event processing, serious waste of resources, insufficient consistency guarantee, etc. in the prior art.

[0005] To achieve the above object, the present invention adopts the following technical solution: a dynamic network topology updating method based on intelligent event filtering, comprising the following steps:

[0006] Step S1, monitor the network device and link status in real time, and send the network device and link status to the message queue, and use the message queue to realize event asynchronous processing;

[0007] Step S2: Intelligently identify and screen the collected events, filter out noise events, and classify valid events by priority;

[0008] Step S3: triggering a corresponding type of incremental topology update based on event priority;

[0009] Step S4: Verify the consistency of the topology update and confirm the legitimacy of the topology structure.

[0010] In a preferred embodiment, in step S1, the online and offline of network devices, port enabling / disabling, link disconnection / delay anomalies, and high-frequency traffic fluctuation event data are monitored in real time.

[0011] In a preferred embodiment, in step S1, the event asynchronous processing is specifically as follows: after the event is generated, it is first placed in a message queue and processed asynchronously by multiple threads.

[0012] In a preferred embodiment, the intelligent identification and screening in step S2 specifically include rule filtering, intelligent screening and priority classification; the rule filtering is based on regular expressions and topology information to filter events that have no impact on the topology; the intelligent screening uses a machine learning model trained with historical data to evaluate the effectiveness of events affecting the topology.

[0013] In a preferred embodiment, in step S2, the valid event is specifically an event that has an impact on the network topology after rule filtering and intelligent screening and determination; the valid events are classified according to priority, and the priority levels include: emergency level, high level, medium level and low level;

[0014] Emergency level: major failure events affecting core equipment or main links;

[0015] Advanced: device addition / removal, important link recovery events;

[0016] Intermediate: minor link rate changes, port online and offline events;

[0017] Low level: Traffic fluctuation events on edge devices.

[0018] In a preferred embodiment, step S3 specifically includes: for emergency-level events, immediately triggering global topology reconstruction; for high-level events, immediately triggering local topology update; for medium-level events, introducing a sliding window mechanism to aggregate similar events within a period of time for batch update; for low-level events, triggering regular updates at preset time intervals.

[0019] In a preferred embodiment, the incremental topology update calculates the affected link set P a , only update the changed part, that is, update the affected link set P a , event E affects device N a directly connected links and their associated links; the link set P a For: Device N affected by event E a Directly connected links and their associated links.

[0020] In a preferred embodiment, the incremental topology update scope includes the addition and deletion of devices and links, and a version control mechanism is introduced to record the status changes of each incremental update.

[0021] In a preferred embodiment, in step S4, data consistency verification is performed to check isolated nodes and topological loops. The topological loop detection is performed through a depth-first search algorithm. If there are repeatedly visited nodes, a loop exists. If the verification is abnormal or the update fails, roll back to the previous topological version state.

[0022] The present invention also provides a dynamic network topology update system based on intelligent event filtering, based on the dynamic network topology update method based on intelligent event filtering, including an event monitoring and acquisition module, an event filtering and classification module, a topology update module and a topology update verification module; the event monitoring and acquisition module is used to collect events such as device online and offline, port status changes, link disconnection, delay anomalies and traffic fluctuations, and asynchronously upload the events to the time filtering and classification module;

[0023] The event filtering and classification module is used to perform rule filtering and intelligent screening on the collected events, remove noise events, use machine learning models based on historical data and topological features to screen out valid events, and classify events into emergency, high, medium and low levels according to priority; upload events and their levels to the topology update module;

[0024] The topology update module is used to trigger the corresponding type of incremental topology update based on the event priority, calculate the set of links affected by the event, and ensure that only the changed parts are updated; upload the updated topology information to the topology update verification module;

[0025] The topology update verification module is used to verify whether the updated topology structure is consistent and legal. If the verification fails or the update is abnormal, it rolls back to the previous topology version state.

[0026] Compared with the prior art, the present invention has the following beneficial effects: the present invention effectively filters noise events and reduces unnecessary event interference by introducing an intelligent event screening and classification mechanism; adopts an incremental topology update method to update only the changed devices and links to avoid frequent reconstruction of the entire network, thereby significantly improving the efficiency of topology updates and reducing system resource consumption; the incremental update strategy includes a version control mechanism to ensure that each update has a traceable record and ensure the reliability of topology data; by classifying events by priority (such as emergency, high-level, medium-level, and low-level), and triggering different types of topology updates according to the priority of the event, it is possible to flexibly respond to the processing requirements of events of different levels. The present invention not only improves the efficiency and accuracy of network topology updates, but also ensures reliability, real-time performance, and resource optimization during the update process. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 The present invention is a flowchart of a method for updating dynamic network topology based on intelligent event filtering according to a preferred embodiment of the present invention.

[0028] Figure 2 This is a structural diagram of a dynamic network topology updating method based on intelligent event filtering according to a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0029] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0030] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0031] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0032] The basic idea of ​​the present invention is to monitor the status of network devices and links in real time, use message queues to implement asynchronous event processing, intelligently identify and filter collected events, filter noise events, and classify valid events by priority, trigger corresponding types of incremental topology updates based on event priorities, verify the consistency of topology updates, and confirm the legitimacy of topology structures. Through strategies such as intelligent screening, event priority classification, and incremental updates, the consumption of computing resources during network topology updates is significantly reduced, and the real-time performance and stability of the system are improved.

[0033] like Figure 1 As shown, the present invention provides a dynamic network topology updating method based on intelligent event filtering, comprising the following steps:

[0034] S1. Monitor the status of network devices and links in real time, and send the status of network devices and links to the message queue, and use the message queue to realize asynchronous event processing; the specific asynchronous event processing is: after the event is generated, it is first placed in the message queue and processed asynchronously by multiple threads.

[0035] Real-time monitoring of events such as device online and offline, port enablement / disablement, link disconnection / delay anomalies, high-frequency traffic fluctuations, etc. n}, where e i For a single event.

[0036] S2. Intelligently identify and screen the collected events, filter out noise events, and classify valid events by priority; the valid events are specifically events that have an impact on the network topology after rule filtering and intelligent screening and determination;

[0037] Based on regular expressions and topology information, filter out events that have no impact on topology; use machine learning models trained with historical data to evaluate the effectiveness of events in affecting topology;

[0038] Combining regular expressions and topology information, filtering rules can be roughly implemented in the following steps:

[0039] 1. Receive events: The system collects various event data from the network, including link changes, device status changes, traffic changes, etc.

[0040] 2. Regular expression filtering: First, apply regular expressions to preliminarily filter the event content to determine whether the event conforms to a specific pattern. For example, whether it is a link status change (such as "link down") or a device status change (such as "device restart"), etc. If the event content does not conform to the predefined pattern, it is considered not an event of concern and is skipped.

[0041] 3. Topology information filtering: For events filtered by regular expressions, further check whether the event will affect the current network topology. For example, if the event is a link failure (such as link failure, device restart, etc.), it is necessary to check whether the link or device directly affects the current network topology. If the device or link is not in the current topology, or its failure does not cause changes in the network path, ignore this event.

[0042] 4. Event processing: Upload events that are determined by rule filtering to have an impact on the topology to intelligent filtering.

[0043] Match the priority of valid events P(e i ), with priority levels including: urgent, high, medium, and low.

[0044] Emergency level P(e i )=1: A major fault event affecting the core device or the main link.

[0045] Advanced P(e i )=2: events such as device addition / removal, important link recovery, etc.

[0046] Intermediate P(e i )=3: Secondary link rate change, port online and offline events.

[0047] Low-level P(e i )=4: Traffic fluctuation event of edge device.

[0048] S3, based on the event priority, trigger the corresponding type of incremental topology update;

[0049] For emergency events, global topology reconstruction is triggered immediately;

[0050] For high-level events, local topology updates are triggered immediately;

[0051] For intermediate events, a sliding window mechanism is introduced to aggregate similar events within a period of time for batch update. The sliding window time length W is in seconds. For medium-sized and high-frequency changing networks, preferably, 30 seconds to 300 seconds (i.e., 5 minutes) is selected as the sliding window time length. For large networks or environments with more frequent changes, preferably, 30 seconds to 60 seconds are selected to respond to events more promptly. For relatively stable networks, preferably, the window time can be set to 10 minutes (600 seconds).

[0052] For low-level events, regular updates are triggered at a preset time interval T in seconds. For low-frequency events, preferably, the update interval is 600 seconds to 1800 seconds, so that the system can trigger regular updates over a longer period of time while avoiding too frequent updates; if the network stability is high and low-level events do not occur frequently, preferably, the update interval can be set to 3600 seconds to reduce resource consumption; for high-traffic or dynamic networks, preferably, the update interval is shortened to 300 seconds to 600 seconds to improve responsiveness.

[0053] Incremental topology update, calculate the current network topology G = (N, L), N is the set of devices in the current network topology, L is all the links in the current network topology; calculate the device set F (e i ), get the affected link set L a ={l∈L|F(e i )∈l}, based on the affected link set L a Get the event-driven network topology G'.

[0054] S4. Verify the consistency of the topology update and confirm the legitimacy of the topology structure.

[0055] Check for isolated nodes, isolated node collection

[0056] The topology loop detection uses a depth-first search algorithm. If there are repeated nodes visited, there is a loop. If the verification is abnormal or the update fails, roll back to the previous topology version state G.

[0057] like Figure 2As shown, the present invention provides a structural diagram of a dynamic network topology updating method based on intelligent event filtering, including the following modules: an event monitoring and collection module, an event filtering and classification module, a topology updating module and a topology updating verification module.

[0058] The event monitoring and collection module is used to collect events such as device online and offline, port status changes, link disconnection, delay anomalies, and traffic fluctuations, and asynchronously upload the events to the time filtering and classification module;

[0059] The event filtering and classification module is used to filter and intelligently screen the collected events according to rules, remove noise events, and use machine learning models based on historical data and topological features to filter out valid events. Events are classified into emergency, high, medium, and low levels according to their priorities. Events and their levels are uploaded to the topology update module;

[0060] The topology update module is used to trigger the corresponding type of incremental topology update based on the event priority, calculate the set of links affected by the event, and ensure that only the changed parts are updated; upload the updated topology information to the topology update verification module;

[0061] The topology update verification module is used to verify whether the updated topology structure is consistent and legal. If the verification fails or the update is abnormal, it rolls back to the previous topology version state.

[0062] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A dynamic network topology updating method based on intelligent event filtering, characterized in that: The following steps are involved: Step S1, monitor the network device and link status in real time, and send the network device and link status to the message queue, and use the message queue to realize event asynchronous processing; Step S2: Intelligently identify and screen the collected events, filter out noise events, and classify valid events by priority; Step S3: triggering a corresponding type of incremental topology update based on event priority; Step S4: Verify the consistency of the topology update and confirm the legitimacy of the topology structure.

2. A method for updating dynamic network topology based on intelligent event filtering according to claim 1, characterized in that: In the step S1, the online and offline status of network devices, port enabling / disabling, link disconnection / delay anomalies, and high-frequency traffic fluctuation event data are monitored in real time.

3. A method for updating dynamic network topology based on intelligent event filtering according to claim 1, characterized in that: In step S1, the event asynchronous processing is specifically as follows: after an event is generated, it is first placed in a message queue and processed asynchronously by multiple threads.

4. A method for updating dynamic network topology based on intelligent event filtering according to claim 1, characterized in that: The intelligent identification and screening in step S2 specifically includes rule filtering, intelligent screening and priority classification; the rule filtering is based on regular expressions and topology information to filter events that have no impact on the topology; The intelligent filtering uses a machine learning model trained with historical data to evaluate the effectiveness of events in affecting topology.

5. A method for updating dynamic network topology based on intelligent event filtering according to claim 4, characterized in that: In step S2, the valid event is specifically an event that has an impact on the network topology after rule filtering and intelligent screening and determination; The valid events are classified according to priority, and the priority levels include: emergency, high, medium and low; Emergency level: major failure events affecting core equipment or main links; Advanced: device addition / removal, important link recovery events; Intermediate: minor link rate changes, port online and offline events; Low level: Traffic fluctuation events on edge devices.

6. A method for updating dynamic network topology based on intelligent event filtering according to claim 1, characterized in that: The step S3 specifically includes: for emergency events, immediately triggering global topology reconstruction; for high-level events, immediately triggering local topology update; for medium-level events, introducing a sliding window mechanism to aggregate similar events within a period of time for batch update; for low-level events, triggering regular updates at preset time intervals.

7. A method for updating dynamic network topology based on intelligent event filtering according to claim 1, characterized in that: The incremental topology update calculates the affected link set P a , only update the changed part, that is, update the affected link set P a , event E affects device N a directly connected links and their associated links; the link set P a For: Device N affected by event E a Directly connected links and their associated links.

8. The method for updating dynamic network topology based on intelligent event filtering according to claim 1, characterized in that: The incremental topology update scope includes the addition and deletion of devices and links, and a version control mechanism is introduced to record the status changes of each incremental update.

9. The method for updating dynamic network topology based on intelligent event filtering according to claim 1, characterized in that: In step S4, data consistency verification is performed to check isolated nodes and topological loops. The topological loop detection is performed through a depth-first search algorithm. If there are nodes that are repeatedly visited, there is a loop. If the verification is abnormal or the update fails, roll back to the previous topological version state.

10. A dynamic network topology updating system based on intelligent event filtering, characterized in that A dynamic network topology updating method based on intelligent event filtering according to any one of claims 1 to 9, comprising an event monitoring and collection module, an event filtering and classification module, a topology updating module and a topology updating verification module; The event monitoring and collection module is used to collect events such as device online and offline, port status changes, link disconnection, delay anomalies, and traffic fluctuations, and asynchronously upload the events to the time filtering and classification module; The event filtering and classification module is used to perform rule filtering and intelligent screening on the collected events, remove noise events, use machine learning models based on historical data and topological features to screen out valid events, and classify events into emergency, high, medium and low levels according to priority; upload events and their levels to the topology update module; The topology update module is used to trigger the corresponding type of incremental topology update based on the event priority, calculate the set of links affected by the event, and ensure that only the changed parts are updated; upload the updated topology information to the topology update verification module; The topology update verification module is used to verify whether the updated topology structure is consistent and legal. If the verification fails or the update is abnormal, it rolls back to the previous topology version state.

Images