Network optimization method and system, electronic equipment and medium

Abstract

The invention provides a network optimization method and system, electronic equipment, a chip and a medium, and the method comprises the steps: obtaining communication data of a plurality of communication nodes, and determining a network time delay distance matrix based on the communication data of the plurality of communication nodes; based on the network delay distance matrix, determining a target network path through an ant colony algorithm; and performing intrusion detection on the target network path by using an intrusion detection model, the intrusion detection model being obtained by training an initial model by using a training data sample, and the training data sample being obtained by marking an initial data sample by using a sample model. The network is optimized through the ant colony algorithm, the target path is searched to improve the performance and reliability of the network, intrusion detection is performed on the target path through the trained intrusion detection model, and the efficiency of intelligent detection of network intrusion behaviors is further improved.

Description

Technical Field

[0001] The present disclosure relates to the field of core network technology, and in particular to a network optimization method, system, electronic device and medium. Background Art

[0002] Mobile communication network refers to a communication network that connects mobile terminal devices through wireless technology. In the mobile communication network, users can use mobile devices such as mobile phones and tablets to make voice calls, send text messages, and transmit data. Mobile communication networks usually consist of three parts: base stations, core networks, and user terminals. Mobile communication network optimization refers to the process of improving network performance and user experience by adjusting network parameters, optimizing coverage, and increasing data transmission rates. When the network is in poor condition, data transmission will be affected, thereby reducing the overall network security. Summary of the invention

[0003] In order to solve the problems existing in the related art, the present disclosure proposes a network optimization method to solve the problem that the current optimization method is not set up for intrusion detection during use, thereby solving the problem of low security of the overall system.

[0004] The first aspect of the present disclosure proposes a network optimization method, which includes: acquiring communication data of multiple communication nodes, and determining a network delay distance matrix based on the communication data of the multiple communication nodes; determining a target network path through an ant colony algorithm based on the network delay distance matrix; and performing intrusion detection on the target network path using an intrusion detection model, wherein the intrusion detection model is obtained by training an initial model using training data samples, and the training data samples are obtained by labeling initial data samples using the sample model.

[0005] In some embodiments of the present disclosure, determining a network delay distance matrix based on communication data of multiple communication nodes includes: constructing a network node distance matrix based on distance information of any two communication nodes among the multiple communication nodes, the communication data including at least one of node position and network delay; constructing a network delay vector based on the network delay of each communication node; and determining a network delay distance matrix based on the network node distance matrix and the network delay vector.

[0006] In some embodiments of the present disclosure, determining a network delay distance matrix according to a network node distance matrix and a network delay vector includes: determining a transmission vector of a first communication node among multiple communication nodes based on a network delay vector and an optical fiber propagation speed; determining a first element value between the first communication node and the second communication node in the network node distance matrix; determining a second element between the first communication node and the second communication node in the network delay distance matrix based on the first element value and a weighted node transmission vector sum, the weighted node transmission vector sum including a weighted node transmission vector of the first communication node and a weighted node transmission vector of the second communication node, the weighted node transmission vector being a calculated value of a transmission vector and a corresponding weighting coefficient.

[0007] In some embodiments of the present disclosure, based on the network delay distance matrix, determining the target network path through the ant colony algorithm includes: initializing and assigning initial parameters and an initial weight coefficient matrix of the ant colony algorithm, and determining the network monitoring result, the initial parameters including at least one of the number of ants, the pheromone importance factor, the heuristic function importance factor, and the pheromone evaporation coefficient; when the network monitoring result meets the preset conditions, increasing or decreasing the initial weight coefficient by a first adjustment value to obtain a first weight coefficient matrix; based on the first weight coefficient matrix, performing a cyclic search on the network delay distance matrix through the ant colony algorithm, and determining the network performance, until the network performance reaches the expected performance, terminating the cyclic search, and obtaining the target network path.

[0008] In some embodiments of the present disclosure, based on the first weight coefficient matrix, a network delay distance matrix is ​​cyclically searched by an ant colony algorithm, including: after each ant completes a path search for the network delay distance matrix, and after all ants complete all path searches for the network delay distance matrix, updating pheromones to obtain a first network path, the first network path being a path whose distance values ​​of all searched paths satisfy a distance condition; determining the network performance of the first network path; when the network performance of the first network path does not reach the expected performance, based on the network monitoring results of the first network path and preset conditions, increasing or decreasing the first weight coefficient by a first adjustment value to obtain a second weight coefficient matrix; based on the second weight coefficient matrix, a network delay distance matrix is ​​cyclically searched by an ant colony algorithm until the network performance of the second network path reaches the expected performance, the second network path is determined as the target network path, and the third weight coefficient matrix is ​​determined as the target weight coefficient matrix, the third weight coefficient matrix being the weight coefficient matrix when the network performance reaches the expected performance.

[0009] In some embodiments of the present disclosure, the method also includes: obtaining an initial data sample set, the initial data sample set including a probability difference, a marking result, and communication data of the initial data sample, the marking result being obtained by evaluating using a sample model based on the probability difference of the initial data sample and a probability difference threshold; preprocessing the initial data sample to obtain a first data sample; and adaptively adjusting the probability difference threshold based on the probability difference of the first data sample and the marking result and the current performance indicator of the sample model.

[0010] In some embodiments of the present disclosure, the method further includes: determining a training data sample based on the first data sample, the training data sample including sample features and labeling results; and using the training data sample to train the initial model to obtain an intrusion detection model.

[0011] A second aspect embodiment of the present disclosure proposes a network optimization system, which includes: an acquisition module, used to acquire communication data of multiple communication nodes, and determine a network delay distance matrix based on the communication data of the multiple communication nodes; a determination module, used to determine a target network path based on the network delay distance matrix through an ant colony algorithm; a detection module, used to perform intrusion detection on the target network path using an intrusion detection model, the intrusion detection model is obtained by training an initial model using training data samples, and the training data samples are obtained by marking the initial data samples using the sample model.

[0012] The third aspect embodiment of the present disclosure proposes an electronic device, comprising: one or more processors; a storage device communicatively connected to the one or more processors, on which one or more programs are stored; when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in the first aspect embodiment of the present disclosure.

[0013] The fourth aspect embodiment of the present disclosure proposes a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the method described in the first aspect embodiment of the present disclosure.

[0014] The fifth aspect embodiment of the present disclosure proposes a chip, which includes one or more interface circuits and one or more processors; the interface circuit is used to receive signals from a memory of an electronic device and send signals to the processor, the signals including computer instructions stored in the memory, and when the processor executes the computer instructions, the electronic device executes the method described in the first aspect embodiment of the present disclosure.

[0015] The sixth aspect embodiment of the present disclosure proposes a computer program product, including a computer program, and the computer program implements the method described in the first aspect embodiment of the present disclosure after being executed.

[0016] In summary, according to the network optimization method proposed in the present invention, by acquiring the communication data of multiple communication nodes and using the ant colony algorithm to search for the target network path, the network performance and reliability are improved; further, artificial intelligence technology is used to perform intrusion detection on the target network path using a trained intrusion detection model to further improve network security.

[0017] The network optimization method, system, electronic device and medium provided by the present disclosure can improve the performance and reliability of mobile communication networks.

[0018] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0020] Figure 1 A flowchart of a network optimization method proposed in an embodiment of the present disclosure;

[0021] Figure 2 A schematic diagram of a process for determining a network delay distance matrix according to an embodiment of the present disclosure;

[0022] Figure 3 A schematic diagram of a process for determining a target network path proposed in an embodiment of the present disclosure;

[0023] Figure 4 A flowchart of a network optimization method proposed in an embodiment of the present disclosure;

[0024] Figure 5 A flowchart of a network optimization method proposed in an embodiment of the present disclosure;

[0025] Fig. 6A A schematic diagram of the network optimization system;

[0026] Figure 6B It is a schematic diagram of the intrusion detection module;

[0027] Figure 7 A schematic diagram of the structure of a network optimization system provided by an embodiment of the present disclosure;

[0028] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0029] Embodiments of the present disclosure are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. Embodiments are described below with reference to the accompanying drawings.

[0030] The method proposed in the present disclosure sets up intrusion detection and uses artificial intelligence technology to select items with multiple information attributes from the data source to terminate the automatic detection system samples and perform marking processing to intelligently identify and distinguish network abnormal data, thereby realizing network security detection and estimating the probability of network intrusion behavior.

[0031] The method proposed in the present invention obtains the communication data of multiple communication nodes, uses the ant colony algorithm to search for the target network path, uses artificial intelligence technology, and uses a trained intrusion detection model to detect intrusion behaviors occurring in the target network path, thereby improving network security.

[0032] The network optimization method provided by the present application is described in detail below with reference to the accompanying drawings.

[0033] Figure 1 This is a flow chart of a network optimization method proposed in an embodiment of the present disclosure. Figure 1 As shown, the network optimization method includes steps 101-103.

[0034] Step 101: Acquire communication data of multiple communication nodes, and determine a network delay distance matrix based on the communication data of the multiple communication nodes.

[0035] In an embodiment of the present disclosure, the communication data includes at least one of node location and network delay. In some embodiments, the communication data also includes user location, network traffic, signal strength, device information, etc.

[0036] In an embodiment of the present disclosure, each communication node includes at least one user.

[0037] In an embodiment of the present disclosure, various data of the mobile communication network can be collected through the data collection module, for example, communication data of multiple communication nodes are collected from sources such as base stations, core network equipment, network management systems, etc. Each communication node includes multiple users, and the communication data includes network traffic, signal strength, user location, device information, etc.

[0038] For example, the data acquisition module can use the comprehensively collected information to establish a data network, and at the same time perform hierarchical centralized management of all user terminals connected to the network. Adhering to the principle of "tiered construction, centralized management, full network service, and prior upgrade", it provides users with network performance monitoring, terminal remote control and other operations, and supports the push of multiple programs.

[0039] In the embodiments of the present disclosure, a data switch module may be used for data transmission. The model of the switch is not limited, and a suitable core switch may be selected according to actual conditions.

[0040] In an embodiment of the present disclosure, determining a network delay distance matrix based on communication data of multiple communication nodes includes: constructing a network node distance matrix based on distance information of any two communication nodes among the multiple communication nodes; constructing a network delay vector based on the network delay of each communication node; and determining a network delay distance matrix based on the network node distance matrix and the network delay vector.

[0041] In an embodiment of the present disclosure, based on the distance information of any two communication nodes among multiple communication nodes, a network node distance matrix can be constructed by obtaining the distance information of every two communication nodes through the node position in the communication data corresponding to each node. The distance information between nodes refers to the topological distance between the nodes. Through the topological distance of every two communication nodes, a network node distance matrix of multiple communication nodes can be obtained, wherein each element in the matrix represents the distance between the corresponding two nodes.

[0042] For example, the intelligent optimization module plans and calculates the distance information of each communication network node in the network path system, and constructs a network node distance matrix.

[0043] In an embodiment of the present disclosure, based on the network delay of each communication node, a network delay vector can be constructed. According to the network delay in the communication data of each communication node, the network delay vectors corresponding to multiple communication nodes can be obtained, and the network delay vector represents the delay information of each node.

[0044] For example, the intelligent optimization module obtains network delay information of information transmission of each communication network node in the network path system, and defines a network delay vector.

[0045] In an embodiment of the present disclosure, according to the network node distance matrix and the network delay vector, determining the network delay distance matrix can be performed by determining the value of the corresponding element in the network delay distance matrix through the calculated value between the element value in the network node distance matrix and the network delay vector.

[0046] For example, the intelligent optimization module plans and constructs a network delay distance matrix according to the network node distance matrix and the network delay vector.

[0047] Step 102: Determine the target network path based on the network delay distance matrix by using an ant colony algorithm.

[0048] In an embodiment of the present disclosure, based on the network delay distance matrix, the target network path is determined by an ant colony algorithm. The target network path can be determined by performing a cyclic search on the network delay distance matrix by locally updating pheromones through the ant colony algorithm.

[0049] In an embodiment of the present disclosure, based on the network delay distance matrix, the target network path is determined by an ant colony algorithm. The target network path can be determined by performing a cyclic search on the network delay distance matrix in a globally updated pheromone manner by using the ant colony algorithm.

[0050] In an embodiment of the present disclosure, based on the network delay distance matrix, the target network path is determined by an ant colony algorithm. The target network path can be determined by performing a cyclic search on the network delay distance matrix by combining local and global updates of pheromones through the ant colony algorithm.

[0051] In an embodiment of the present disclosure, based on the network delay distance matrix, the target network path is determined by an ant colony algorithm. The network delay distance matrix can be cyclically searched based on the ant colony algorithm. The target network path is determined based on the distance of the path and the network performance, so that the target network path satisfies the shortest distance in the ant colony algorithm and can also take into account network status factors. The obtained target network path can reduce network congestion, reduce delay, and improve data transmission efficiency, thereby improving network performance and reliability.

[0052] Step 103: Use the intrusion detection model to perform intrusion detection on the target network path.

[0053] In the embodiment of the present disclosure, the intrusion detection model is obtained by training the initial model using the training data samples, and the training data samples are obtained by labeling the initial data samples using the sample model.

[0054] In the embodiments of the present disclosure, the trained intrusion detection model can be used to detect intrusion behaviors existing in the target network path, and the probability value of the occurrence of intrusion behaviors can be obtained. Further, a two-dimensional rule linked list can be obtained, and the two-dimensional rule linked list is used to represent the correspondence between intrusion behaviors and sample features.

[0055] In the embodiments of the present disclosure, the intrusion detection model is used to perform intrusion detection on the target network path, and the probability value of the occurrence of intrusion behavior can be obtained. Specifically, the data packets in the target network path can be captured, and the parsing function can be used to call and parse the data packets. When the parsed data packets successfully match the characteristics of the intrusion behavior, it indicates that there is an intrusion behavior.

[0056] In an embodiment of the present disclosure, when the intrusion detection model detects an intrusion behavior, an alarm function may be activated to generate an alarm.

[0057] For example, after the intrusion detection execution module is officially running, it is necessary to perform all initialization work and interpret relevant passwords to achieve the purpose of accurately reading the system database data and forming a two-dimensional rule chain table to provide a basis and guidance for the constraints and specifications of the subsequent network detection behavior. At the same time, it is also necessary to cyclically execute operations such as packet capture, rule setting, and rule matching. First, with the help of the data packet capture library function, random acquisition of data packets can be achieved; secondly, the parsing function is used to call and parse the required data packets. Finally, when the data packet is parsed, the two-dimensional rule chain is compared. If the rule entry is successfully matched, it means that there is an intrusion behavior.

[0058] For example, when the alarm responder module detects an intrusion, it activates the alarm function to intelligently monitor and control the external intrusion of the system. The number of relays contained in the alarm responder can be customized. When determining the address of a single group of relay cameras, the operator needs to manually set it.

[0059] In the above embodiment, based on the target network path, the trained intrusion detection model is used to perform intrusion detection, which realizes network path optimization, improves the overall performance and stability of the network, and provides a better environment for intrusion detection. At the same time, intrusion detection ensures the security of the network, and the two together improve the robustness of the network.

[0060] In summary, according to the network optimization method proposed in the present invention, the target network path can be determined through the ant colony algorithm, the network path can be planned, the target network path can be found, the optimal distribution of network traffic, the adjustment of base station power, and the optimization of coverage can be achieved, the performance and reliability of the network can be improved, and artificial intelligence technology can be used to perform intrusion detection on the target network path using a trained intrusion detection model to intelligently identify and distinguish network anomalies, and realize functions such as detection of network intrusion behavior.

[0061] based on Figure 1 The embodiment shown, Figure 2 The following is a schematic diagram of a process for determining a network delay distance matrix proposed in the present disclosure. Figure 2 based on Figure 1 The embodiment shown, Figure 1 Step 101 in is further described as follows: Figure 2 As shown, the following steps are included:

[0062] Step 201: determine a transmission vector of a first communication node among a plurality of communication nodes based on a network delay vector and a fiber propagation speed of the first communication node.

[0063] In the embodiments of the present disclosure, the optical fiber propagation speed may be the speed at which information propagates in the optical fiber.

[0064] In the embodiment of the present disclosure, the first communication node may be any one of a plurality of communication nodes.

[0065] In an embodiment of the present disclosure, determining the transmission vector of the first communication node based on the network delay vector and the optical fiber propagation speed of the first communication node may be determining the transmission vector of each communication node based on the product of the network delay vector and the optical fiber propagation speed of each communication node.

[0066] For example, the product of the network delay vector of the first communication node and the fiber propagation speed is used as the transmission vector of the first communication node, and the product of the network delay vector of the second communication node and the fiber propagation speed is used as the transmission vector of the second communication node.

[0067] For example, the intelligent optimization module uses the product of the network delay vector Delay1 of the communication node and the information propagation speed in the optical fiber as the transmission vector Delay1' of the communication node in the network node distance matrix.

[0068] Step 202: Determine a first element value between the first communication node and the second communication node in a network node distance matrix.

[0069] In an embodiment of the present disclosure, the second communication node is any one of the plurality of communication nodes except the first communication node.

[0070] In the embodiment of the present disclosure, determining the first element value of the first communication node and the second communication node in the network node distance matrix may be determining the element values ​​corresponding to any two communication nodes in the network node distance matrix.

[0071] For example, the intelligent optimization module sets the value of the element nst (corresponding to the node s and the node t) in the network node distance matrix to Distance1.

[0072] Step 203: Determine a second element value in a network delay distance matrix between the first communication node and the second communication node based on the first element value and the weighted node transmission vector sum.

[0073] In an embodiment of the present disclosure, a weighted node transmission vector includes a weighted node transmission vector of a first communication node and a weighted node transmission vector of a second communication node, and the weighted node transmission vector is a calculated value of a transmission vector and a corresponding weighting coefficient.

[0074] In an embodiment of the present disclosure, the weighted node transmission vector of the first communication node is the product of the transmission vector of the first communication node and the corresponding weighting coefficient, and the weighted node transmission vector of the second communication node is the product of the transmission vector of the second communication node and the corresponding weighting coefficient.

[0075] In an embodiment of the present disclosure, the weighted node transmission vector sum is the sum of the weighted node transmission vector of the first communication node and the transmission vector of the second communication node. In other words, the weighted node transmission vector sum of any two communication nodes can be obtained based on the weighted node transmission vectors of any two communication nodes.

[0076] In the embodiment of the present disclosure, any communication node transmission vector corresponds to a weighting coefficient, and a weighting coefficient matrix corresponding to the network node distance matrix is ​​constructed, and the weighting coefficient range may be [0.2, 0.6].

[0077] In an embodiment of the present disclosure, based on the first element value and the weighted node transmission vector sum, determining the second element value of the first communication node and the second communication node in the network delay distance matrix can be to use the product of the first element value and the weighted node transmission vector sum as the second element value corresponding to the first communication node and the second communication node in the network delay distance matrix.

[0078] For example, the intelligent optimization module multiplies the element nst in the network node distance matrix with the corresponding weighted node transmission vector sum as the element n'st of the network delay distance matrix; wherein the weighted node transmission vector sum is the sum of the node transmission vector weighted value of node s and the node transmission vector weighted value of node t in the network node distance matrix; wherein the node transmission vector weighted value corresponding to the element nst = the node transmission vector Delay1'×the corresponding weighting coefficient, any network node transmission vector corresponds to a weighting coefficient, and the weighting coefficient matrix corresponding to the network node distance matrix is ​​constructed, and the weighting coefficient range is [0.2,0.6].

[0079] In the above embodiment, a network delay distance matrix corresponding to multiple communication nodes is constructed through information in the communication data, so as to select a network path through the network delay distance matrix and provide a search target for the subsequent ant colony algorithm.

[0080] based on Figure 1 , Figure 2 The embodiment shown, Figure 3 The following further illustrates a flow chart of determining a target network path proposed in the present disclosure. Figure 3 based on Figure 1 In the embodiment shown, step 102 is further defined. Figure 3 As shown, the method comprises the following steps:

[0081] Step 301, initializing and assigning values ​​to the initial parameters and initial weight coefficient matrix of the ant colony algorithm, and determining the network monitoring result.

[0082] In an embodiment of the present disclosure, the initial parameters include at least one of the number of ants, the pheromone importance factor, the heuristic function importance factor, and the pheromone evaporation coefficient.

[0083] In the embodiments of the present disclosure, the initialization assignment of the initial parameters and the initial weight coefficient matrix of the ant colony algorithm can be defined according to actual needs and network conditions, which is not limited by the present disclosure.

[0084] In the embodiments of the present disclosure, pheromones represent information remaining on a path, which affects the probability of ants choosing a path. The higher the concentration of pheromones, the greater the probability that ants will choose the path.

[0085] In the embodiments of the present disclosure, the heuristic function is usually related to problem characteristics, such as distance, delay, etc., and is used to guide ants to select paths. The heuristic function provides intuitive guidance to help ants find the optimal path.

[0086] In the embodiment of the present disclosure, the initial parameters may also include initial pheromone concentration, number of iterations, etc.

[0087] For example, the number of ants may be 100, the pheromone importance factor α=1, the heuristic function importance factor β=5, the pheromone evaporation coefficient ρ=0.5, the initial pheromone concentration may be 1, and the number of iterations may be 1000.

[0088] For example, the intelligent optimization module initializes and assigns values ​​to initial parameters of the ant colony algorithm.

[0089] In an embodiment of the present disclosure, determining the network monitoring result may be real-time monitoring of the network's operating status, including but not limited to indicators such as network congestion level, data packet loss rate, and link bandwidth utilization.

[0090] Step 302: When the network monitoring result meets a preset condition, the initial weighting coefficient is increased or decreased by a first adjustment value to obtain a first weighting coefficient matrix.

[0091] In the embodiments of the present disclosure, the preset condition may be defined according to actual conditions, and the first adjustment value may be a preset value, which is not limited by the present disclosure.

[0092] In the embodiments of the present disclosure, the adjustment strategy of the weighting coefficient can be designed according to the actual situation to avoid unstable oscillation behavior of the algorithm. The adjustment method of the weighting coefficient listed in the present disclosure is only an example, and different adjustment methods can be used in different embodiments.

[0093] In an embodiment of the present disclosure, the preset condition may be that the degree of network congestion in the network monitoring results is greater than or equal to a congestion threshold, or the packet loss rate is greater than or equal to a loss rate threshold, or the link bandwidth utilization is less than a utilization threshold, etc. That is, when the network monitoring results meet the preset conditions, it may be that the current network status is congested or performance is degraded.

[0094] In the above embodiment, when the network monitoring results meet the preset conditions, increasing the initial weighting coefficient by the first adjustment value can be increasing the weighting coefficient when network congestion or performance degradation occurs, wherein the adjustment value can be a pre-set fixed value, which can be determined based on the network conditions and optimization goals.

[0095] In the above embodiment, when the network monitoring result does not meet the preset condition, the initial weighting coefficient is reduced by the first adjustment value.

[0096] In an embodiment of the present disclosure, the preset condition may be that the network congestion level is less than a congestion threshold, or the packet loss rate is less than a loss rate threshold, or the link bandwidth utilization is greater than or equal to a utilization threshold, etc., that is, the current network status is good or has spare capacity.

[0097] In the above embodiment, when the network monitoring results meet the preset conditions, reducing the initial weighting coefficient by the first adjustment value can be to reduce the weighting coefficient when the network is in good condition or has spare capacity to encourage the ant colony algorithm to explore these paths, wherein the adjustment value can be a pre-set fixed value, which can be determined based on the network condition and the optimization goal.

[0098] In the above embodiment, when the network monitoring result does not meet the preset condition, the initial weighting coefficient is increased by the first adjustment value.

[0099] In the above embodiment, the weighting coefficients are dynamically adjusted according to the network monitoring results to obtain the first weighting coefficient matrix.

[0100] Step 303, based on the first weighted coefficient matrix, the network delay distance matrix is ​​cyclically searched by using an ant colony algorithm, and the network performance is determined until the network performance reaches the expected performance, and then the cyclic search is terminated to obtain the target network path.

[0101] In an embodiment of the present disclosure, based on the first weight coefficient matrix, a cyclic search of the network delay distance matrix through an ant colony algorithm can be performed by running the ant colony algorithm on the adjusted weight coefficient matrix and the network delay distance matrix, and the ants select paths according to pheromones and heuristic functions, and update the pheromones.

[0102] In the embodiments of the present disclosure, the network performance can be determined by evaluating the network performance by simulating or actually running the path after searching for a path each time. Specifically, the network performance can be determined by using a network simulation tool or testing the performance of the path in an actual network, and collecting indicators such as latency, packet loss rate, and bandwidth utilization to evaluate the performance of the network.

[0103] In the embodiments of the present disclosure, each time a path is obtained in the ant colony algorithm, the network performance needs to be determined, so as to determine the end point of the loop iteration based on the comparison result between the network performance and the expected performance, that is, when the network performance reaches the expected performance, the loop search is terminated and the target network path is obtained.

[0104] For example, the intelligent optimization module uses an ant colony algorithm to perform a cyclic search within a network delay distance matrix to obtain the shortest path matrix and the total length of the shortest path of the current network path system.

[0105] In an embodiment of the present disclosure, after each ant completes a path search for the network delay distance matrix, and after all ants complete all path searches for the network delay distance matrix, pheromones are updated to obtain a first network path, where the distance values ​​of all searched paths satisfy a distance condition; the network performance of the first network path is determined; when the network performance of the first network path does not reach the expected performance, based on the network monitoring results of the first network path and preset conditions, the first weighting coefficient is increased or decreased by a first adjustment value to obtain a second weighting coefficient matrix; based on the second weighting coefficient matrix, the network delay distance matrix is ​​cyclically searched through an ant colony algorithm until the network performance of the second network path reaches the expected performance, the second network path is determined as the target network path, and the third weighting coefficient matrix is ​​determined as the target weighting coefficient matrix, where the third weighting coefficient matrix is ​​the weighting coefficient matrix corresponding to when the network performance reaches the expected performance.

[0106] In the embodiments of the present disclosure, pheromones are updated after each ant completes a path search for the network delay distance matrix, and after all ants complete all path searches for the network delay distance matrix. The pheromones may be updated by adopting a strategy combining local updates and global updates, wherein local updates may be performed after each ant completes a path search, and global updates may be performed after all ants complete an iteration.

[0107] In an embodiment of the present disclosure, the path that meets the distance condition can be that after all ants complete one iteration, the path with the shortest total path length among all paths is determined as the first network path, and the network performance of the first network path is determined. It should be understood that the distance value can be the total length of the path.

[0108] In the embodiments of the present disclosure, the network performance may be obtained by simulating or actually running the first network path. Specifically, the performance of the first network path may be tested using a network simulation tool or in an actual network, and indicators such as latency, packet loss rate, and bandwidth utilization may be collected to evaluate the network performance.

[0109] In the embodiments of the present disclosure, the expected performance may be a pre-set network performance, which may be set according to network requirements and optimization goals. Specifically, the expected performance may be set according to factors such as network service requirements, user expectations, and industry standards.

[0110] In an embodiment of the present disclosure, when the network performance of the first network path does not reach the expected performance, based on the network monitoring result of the first network path and the preset conditions, the first weighting coefficient is increased or decreased by the first adjustment value to obtain a second weighting coefficient matrix. It can be that when the network performance of the currently obtained first network path does not reach the expected performance, the first weighting coefficient in the first weighting coefficient matrix is ​​adjusted according to the network monitoring result. The adjustment method can refer to the process in step 302 and will not be repeated here.

[0111] In an embodiment of the present disclosure, based on the second weighting coefficient matrix, a network delay distance matrix is ​​cyclically searched through an ant colony algorithm. The pheromone is updated based on the second weighting coefficient matrix and the network delay distance matrix after each ant completes a path search of the network delay distance matrix and after all ants complete all path searches of the network delay distance matrix. After multiple rounds of cyclic iterations, a second network path is obtained. The second network path is a path in which the distance values ​​of all search paths meet the distance conditions and the network performance of the second network path reaches the expected performance. The second network path is the target network path, and the corresponding third weighting coefficient matrix at this time is the target weighting coefficient matrix.

[0112] For example, the intelligent optimization module finally outputs the network path configuration and the corresponding weight coefficient matrix. The results are used for network management and optimization, such as routing policy adjustment, bandwidth allocation, etc., wherein the weight coefficient matrix is ​​used to adjust the probability of path selection in the ant colony algorithm to optimize the network path configuration.

[0113] For example, when the intelligent optimization module obtains the target network path through the ant colony algorithm, the decision and execution module converts the target network path into actual operation instructions, such as adjusting the power of the base station, switching frequency, optimizing the coverage, etc.

[0114] In the above embodiment, the network delay distance matrix is ​​cyclically searched through an ant colony algorithm combining local update and global update to obtain a target network path that meets the expected performance. The algorithm can better adapt to changes in network status and improve network performance and reliability.

[0115] In the above embodiment, the target network path obtained by the ant colony algorithm can optimize path selection, reduce congestion, reduce latency, and improve data transmission efficiency. Network path optimization improves the overall performance and stability of the network while providing a better environment for intrusion detection. Intrusion detection also further ensures the security of the network. The two together improve the robustness of the network.

[0116] based on Figure 1 , Figure 2 , Figure 3 The embodiment shown, Figure 4 The following is a flow chart of the network optimization method proposed in the present disclosure. Figure 4 based on Figure 1 , Figure 2 , Figure 3 The embodiment shown. Figure 4 As shown, the method also includes the following steps:

[0117] Step 401, obtaining an initial data sample set.

[0118] In an embodiment of the present disclosure, the initial data sample set includes probability differences, labeling results, and communication data of the initial data samples.

[0119] In an embodiment of the present disclosure, the initial data sample set may be obtained from historical data, wherein the marking result may be a normal mark or an abnormal mark.

[0120] In the embodiments of the present disclosure, communication data includes network traffic, signal strength, user location, device information, etc. Each type of data in the communication data is a sample feature. In other words, the sample features include network traffic features, signal strength features, user location features, device information features, etc. These features describe the characteristics of the communication data from different dimensions.

[0121] In an embodiment of the present disclosure, the initial data sample set includes multiple initial data samples, each of which includes corresponding probability differences, marking results, and communication data, wherein the probability difference can be the difference between the maximum probability attribute value and the second probability attribute value, and the maximum probability attribute value and the second probability attribute value can be obtained by predicting the initial data sample through a trained sample model, reflecting the confidence of the model in the sample allocation.

[0122] In the embodiments of the present disclosure, the labeling result is obtained by evaluating the probability difference and probability difference threshold of the initial data sample using the sample model. The probability difference threshold is a pre-set value, which can be a fixed value or can be adaptively adjusted, and the present disclosure does not limit this.

[0123] For example, the artificial intelligence optimization detection module avoids using individual samples in a large amount of data under the premise of referring to active learning, selects items with multiple information attributes from the data source to terminate the automatic detection system samples, and marks these samples. The processing formula is:

[0124]

[0125] Among them, M represents whether the sample needs to be marked, n1 represents the maximum probability attribute value, n2 represents the second probability attribute value, θ represents the probability difference threshold between n1 and n2, and m is a binary indicator (0 or 1), where 1 indicates that the sample should be marked and 0 indicates that the sample should be ignored. From the above formula, it can be concluded that: when the probability difference is less than or equal to θ, the abnormal sample M is automatically marked, otherwise, when the probability difference is greater than θ, the sample M (normal sample) is automatically discarded.

[0126] In the above embodiment, the process of labeling the initial data samples by the sample model can label abnormal samples and automatically discard normal samples, so as to reduce the number of normal samples and improve the efficiency of abnormality detection.

[0127] In an embodiment of the present disclosure, the probability difference distribution in the initial data sample set is analyzed to obtain the change trend over time, and the distribution of the probability difference can be modeled using a statistical method or a machine learning method.

[0128] Step 402: preprocess the initial data sample to obtain a first data sample.

[0129] In the embodiments of the present disclosure, the preprocessing may be cleaning, removal of outliers, standardization, and the like.

[0130] In an embodiment of the present disclosure, the initial data sample is preprocessed to obtain a first data sample, and the first data sample can be used for subsequent sample processing and model training processes.

[0131] In an embodiment of the present disclosure, the first data sample may be obtained by removing samples with abnormal values ​​or errors from the initial data sample.

[0132] In an embodiment of the present disclosure, the first data sample may be obtained by removing samples with outliers or errors in the initial data sample and retaining samples marked as abnormal samples, so as to obtain the first data sample.

[0133] Step 403: Adaptively adjust the probability difference threshold according to the probability difference and the marking result of the first data sample and the current performance index of the sample model.

[0134] In an embodiment of the present disclosure, the current performance indicator of the sample model may be a real-time evaluation of the model performance under the current probability difference threshold, and the performance indicator may include accuracy, recall rate, F1 score, etc.

[0135] In an embodiment of the present disclosure, based on the probability difference and labeling results of the training data samples and the current performance indicators of the sample model, the relationship between the model performance and the probability difference threshold can be determined, and the threshold range for optimal performance can be obtained, so that the probability difference threshold can be adjusted according to the current performance indicators of the sample model.

[0136] In an embodiment of the present disclosure, a mechanism for adaptively adjusting the probability difference threshold of a sample model can dynamically adjust the threshold θ according to changes in the probability difference distribution. Specifically, a sliding window, exponentially weighted moving average, or other method can be used to track changes in the probability difference distribution.

[0137] In an embodiment of the present disclosure, a mechanism for adaptively adjusting the probability difference threshold is determined based on changes in the probability difference distribution and the current performance indicators of the sample model, which may include increasing or decreasing the value of θ, or introducing a new threshold dynamic adjustment algorithm, which is not limited by the present disclosure.

[0138] In an embodiment of the present disclosure, each time the probability difference threshold is adjusted, the adjusted sample model can be used to predict the training data sample to obtain the prediction result, and the current performance index of the model can be determined. According to the current performance index and the adaptive adjustment mechanism, the probability difference threshold is adjusted, and the performance index of the sample model after the probability difference threshold is adjusted is monitored to ensure system stability and accuracy.

[0139] In the embodiments of the present disclosure, new data and processing results are collected, feedback is given and the adaptive adjustment mechanism is optimized, the probability difference distribution and model performance are re-evaluated regularly, and the adaptive adjustment mechanism is adjusted when necessary. The adaptive adjustment mechanism should take into account the real-time performance and computing resources of the system to ensure the efficiency and feasibility of the adjustment process.

[0140] In the embodiments of the present disclosure, it is necessary to record the threshold adjustment and the change of the current performance indicator after each adjustment for tracking and auditing, and to generate reports regularly to summarize the effect of the threshold adjustment and the overall performance of the system.

[0141] In the above embodiment, the optimal performance of the system can be maintained by adaptively adjusting the probability difference threshold.

[0142] In the above embodiment, by marking the initial data samples through the sample model, the system can mark all the data when processing massive data, thereby reducing the burden of the system in processing data and improving the system operation performance.

[0143] based on Figure 1-Figure 4The embodiment shown, Figure 5 The flowchart of the network optimization method proposed in the present disclosure is further shown. Figure 5 As shown, the method also includes the following steps:

[0144] Step 501: determine a training data sample based on a first data sample.

[0145] In the embodiment of the present disclosure, the training data sample includes sample features and labeling results, wherein the sample features include network traffic features, signal strength features, user location features, device information features, etc.

[0146] In an embodiment of the present disclosure, based on the first data sample, a training data sample is determined by collecting the first data sample that has been labeled by a sample model, preprocessing the first data sample, and selecting features that are helpful for the prediction task through feature engineering, thereby determining the training data sample.

[0147] For example, the artificial intelligence optimization module collects available historical data, including sample characteristics, labeling results, etc., and preprocesses the data; through feature engineering, it performs feature engineering based on the nature of the problem and available data to select or construct features that are helpful for the prediction task.

[0148] Step 502: Use training data samples to train the initial model to obtain an intrusion detection model.

[0149] In the embodiments of the present disclosure, the initial model may select a machine learning model suitable for situations where data is insufficient, such as a rule-based model or an integrated learning method, etc., which is not limited by the present disclosure.

[0150] In an embodiment of the present disclosure, the initial model is trained using training data samples, and the performance of the model, such as accuracy, recall rate, F1 score, etc., is evaluated using methods such as cross-validation. Based on the evaluation results, the parameters or structure of the model are adjusted to improve the predictive performance of the model, thereby obtaining an intrusion detection model.

[0151] In the embodiments of the present disclosure, the intrusion detection model can be used to predict new communication data, and corresponding decisions or operations can be made according to the prediction results.

[0152] In the embodiments of the present disclosure, new data samples and detection results may also be collected to provide feedback and optimize the intrusion detection model, and the model may be retrained and evaluated regularly to improve the prediction performance of the model.

[0153] In the above embodiment, by training the initial model to obtain the intrusion detection model, it is possible to use artificial intelligence technology to make predictions even when the data is insufficient, and to improve the accuracy and reliability of the predictions as the data accumulates and the model is optimized.

[0154] In summary, the network optimization method proposed in the present invention determines the network delay distance matrix based on the communication data of the communication nodes, and finds the target network path through the ant colony algorithm to improve the performance and reliability of the network; and based on artificial intelligence technology, uses the trained intrusion detection model to perform real-time detection of the target network path to obtain the probability of network intrusion behavior, thereby further improving the efficiency of intelligent detection of network intrusion behavior.

[0155] The following is a detailed introduction to a specific implementation of a network optimization method provided by an embodiment of the present disclosure.

[0156] Fig. 6A Schematic diagram of a network optimization system, which includes a power supply module 1, a data acquisition module 2, a data switch module 3, an intelligent optimization module 4, a decision and execution module 5, an intrusion detection module 6, and an alarm responder module 7. The intrusion detection module 6 is provided with: an artificial intelligence optimization detection module 8, a subject movement analysis module 9, and an intrusion detection execution module 10.

[0157] Power supply module 1: provides power supply for the entire system.

[0158] Data collection module 2: collects various data of mobile communication network, such as network traffic, signal strength, user location, device information, etc. Data can be collected from base stations, core network equipment, network management system and other sources. Data collection module 2 uses the comprehensive collected information to establish a data network, and at the same time conducts hierarchical centralized management of all user terminals connected to the network. Adhering to the principle of "hierarchical construction, centralized management, full network service, online upgrade", it provides users with network performance monitoring, terminal remote control and other operations, and supports multiple program push work.

[0159] Data switch module 3: The selected core switch is divided into the following components: ① Access layer. Network users can directly access the system network layer by using the access layer. With the help of the aggregation layer, the access layer can be effectively connected to the core layer. The design and application of the access layer can help network users access the system terminal network safely and quickly. The switches located in the access layer have the characteristics of low cost, high security and high density. ② Aggregation layer. The aggregation layer is mainly used for the effective aggregation and processing of network data. At the same time, the application of the aggregation layer can realize the efficient and secure analysis and processing of the access layer data, and send and transmit the final processing results to the uplink. ③ Core layer. The application of the core layer can not only safely transmit and share relevant important communication data, but also safely and quickly transmit the relevant communication data to the backbone structure, maximizing the data throughput of the switch, so that the communication network intrusion detection system shows good operating performance.

[0160] Intelligent optimization module 4: Use ant colony algorithm to optimize network path. The specific steps include planning and calculating the distance information of each communication network node in the network path system, constructing the network node distance matrix; obtaining the network delay information of information transmission of each communication network node in the network path system, and defining the network delay vector; planning and constructing the network delay distance matrix according to the network node distance matrix and the network delay vector; initializing and assigning the initial parameters of the ant colony algorithm; using the ant colony algorithm to search cyclically in the network delay distance matrix to obtain the shortest path matrix and the total length of the shortest path of the current network path system.

[0161] The optimization method steps of intelligent optimization module 4 include:

[0162] S01: Plan and calculate the distance information of each communication network node in the network path system, and construct a network node distance matrix;

[0163] S02: Obtain network delay information of information transmission of each communication network node in the network path system, and define a network delay vector;

[0164] S03: According to the network node distance matrix and the network delay vector, plan and construct the network delay distance matrix; use the product of the network delay vector of the communication network node and the information propagation speed in the optical fiber as the network node transmission vector in the network node distance matrix; multiply the element nst in the network node distance matrix with the corresponding weighted node transmission vector sum, as the element n'st of the network delay distance matrix; wherein the weighted node transmission vector sum is the sum of the node transmission vector weight value of the sth node and the node transmission vector weight value of the tth node in the network node distance matrix; wherein the node transmission vector weight value corresponding to the element nst = node transmission vector * weight coefficient; any network node transmission vector corresponds to a weight coefficient; construct a weight-coefficient matrix corresponding to the network node distance matrix; the weight coefficient range is: [0.2-0.6];

[0165] S04: Initialize and assign values ​​to the initial parameters of the ant colony algorithm;

[0166] S05: Adopting the ant colony algorithm to search cyclically in the network delay distance matrix, obtain the shortest path matrix and the total length of the shortest path of the current network path system.

[0167] The specific steps of the ant colony algorithm in steps S04-S05 may be:

[0168] 101 Initialization: Initialize the distance matrix and weighted coefficient matrix of the network nodes. Set the initial parameters of the ant colony algorithm, such as the number of ants, pheromone importance factor, heuristic function importance factor, pheromone evaporation coefficient, etc.

[0169] 102 Network status monitoring: Real-time monitoring of the network's operating status, including but not limited to key indicators such as network congestion level, packet loss rate, and link bandwidth utilization.

[0170] 103 Adaptive adjustment of weight coefficients: Dynamically adjust the weight coefficients according to the network status monitoring results. For critical paths that are congested or have performance degradation, increase their weight coefficients to reduce the probability that the ant colony algorithm will select the path. For paths that are in good condition or have spare capacity, the weight coefficients can be appropriately reduced to encourage the ant colony algorithm to explore these paths.

[0171] 104 Ant Colony Algorithm Iteration: Run the Ant Colony Algorithm on the adjusted weight coefficient matrix and network delay distance matrix. Ants select paths based on pheromones and heuristic functions, and update pheromones after each iteration.

[0172] 105Pheromone update strategy: A combination of local update and global update is used to update pheromones. Local update can be performed after each ant completes a path search, while global update is performed after all ants complete an iteration.

[0173] 106 Path selection and optimization: Based on the iterative results of the ant colony algorithm, select the shortest path of the current network path system. Calculate the total length of the shortest path and evaluate the performance of the network.

[0174] 107 Feedback and adjustment: Compare the actual network performance with the expected performance, and further adjust the weighting coefficient based on the comparison results. If the network performance does not meet expectations, repeat steps 3 to 6 until a satisfactory network path configuration is found.

[0175] 108 Output results: The optimal network path configuration and the corresponding weight coefficient matrix are finally output. These results can be used for network management and optimization, such as routing policy adjustment, bandwidth allocation, etc. Among them, the weight coefficient matrix is ​​an important intermediate output result in this scheme. It is used to adjust the probability of path selection in the ant colony algorithm to optimize the network path configuration. Although it is not directly mentioned below, its role is indirect. The weight coefficient matrix will affect the path selection of the ant colony algorithm, thereby affecting the final network path configuration and performance. The decision-making and execution module 5, intrusion detection module 6, alarm responder module 7, etc. mentioned below are all running on the optimized network path configuration, so the weight coefficient matrix is ​​indirectly related to these modules.

[0176] Through such a process, the network path selection algorithm can better adapt to changes in network status and improve network performance and reliability. It should be noted that the adjustment strategy of the weighted coefficient should be carefully designed to avoid unstable oscillating behavior of the algorithm.

[0177] Decision-making and execution module 5: After the intelligent optimization algorithm module comes up with an optimization plan, a decision-making and execution module is needed to convert the optimization plan into actual operation instructions, such as adjusting the power of the base station, switching frequency, optimizing coverage, etc.

[0178] Intrusion Detection Module 6: Figure 6B It is a schematic diagram of the intrusion detection module. Figure 6B As shown, it includes an artificial intelligence optimization detection module 8, a subject movement analysis module 9 and an intrusion detection execution module 10. The artificial intelligence optimization detection module 8 uses artificial intelligence technology to select items of multiple information attributes from the data source to terminate the automatic detection system samples and perform marking processing; when designing the communication protocol, the subject movement analysis module 9 uses XML files to accurately describe the data communication model to ensure the communication capability of the exchange protocol; after the formal operation, the intrusion detection execution module 10 performs all initialization work and interprets the relevant passwords to form a two-dimensional rule list, which provides a basis and guidance for the constraints and specifications of the subsequent network detection behavior.

[0179] The specific settings in the intrusion detection module 6 are:

[0180] In specific applications, the artificial intelligence optimization detection module 8 needs to avoid using individual samples in a large amount of data under the premise of referring to active learning, but selects items with multiple information attributes from the data source to terminate the automatic detection system samples, and marks these samples. The processing formula is:

[0181]

[0182] In the above formula, M represents whether the sample needs to be marked, n1 represents the maximum probability attribute value, n2 represents the second probability attribute value, θ represents the threshold of the difference between n1 and n2, and m is a binary indicator (0 or 1), where 1 indicates that the sample should be marked, and 0 indicates that the sample should be ignored. From the above formula, it can be concluded that when the probability difference is less than or equal to θ, the artificial intelligence automatically marks the operation sample M, otherwise, when the probability difference is greater than θ, the artificial intelligence automatically discards the processing sample M.

[0183] The specific methods of sample processing include:

[0184] 201 Data collection and preprocessing: Collect historical data, including sample probability differences, labeling results, and model performance indicators. Preprocess the data, such as cleaning, removing outliers, and standardizing.

[0185] 202 Probability difference distribution analysis: Analyze the probability difference distribution in historical data to understand its changing trend over time. Use statistical methods or machine learning methods to model the distribution of probability differences.

[0186] 203 Performance evaluation: Evaluate the model performance under different threshold settings, such as accuracy, recall, F1 score, etc. Determine the relationship between performance and threshold, and find the threshold range for optimal performance.

[0187] 204 Adaptive Mechanism Design: Design an adaptive mechanism that can dynamically adjust the threshold θ according to the change of the probability difference distribution. You can use methods such as sliding windows and exponentially weighted moving averages to track changes in the distribution.

[0188] 205 Threshold adjustment strategy: According to the changes in the probability difference distribution and the performance evaluation results, a threshold adjustment strategy is formulated. The strategy may include increasing or decreasing the value of θ, or introducing a new threshold dynamic adjustment algorithm. In this scheme, the application of the threshold adjustment strategy is mainly reflected in the artificial intelligence optimization detection module 8. This module analyzes the probability difference distribution in historical data and evaluates the model performance under different threshold settings, such as accuracy, recall rate, F1 score, etc. Then, according to the changes in the probability difference distribution and the performance evaluation results, a threshold adjustment strategy is formulated, which may include increasing or decreasing the value of θ, or introducing a new threshold dynamic adjustment algorithm. Such a strategy enables the artificial intelligence optimization detection module 8 to dynamically adjust the threshold according to changes in the network environment and data distribution to maintain the best performance.

[0189] 206 Implementation and Monitoring: Implement the adaptive threshold adjustment mechanism in the actual application. Monitor the model performance after threshold adjustment to ensure system stability and accuracy.

[0190] 207 Feedback and Optimization: Collect new data and processing results for feedback and optimization of the adaptive mechanism. Regularly re-evaluate the probability difference distribution and model performance, and adjust the adaptive strategy when necessary.

[0191] 208 Recording and reporting: Record all threshold adjustments and performance changes for tracking and auditing. Generate reports regularly to summarize the effects of threshold adjustments and the overall performance of the system.

[0192] Through such a process, the system can automatically adapt to changes in the network environment and data distribution to maintain optimal performance. It should be noted that the design of the adaptive mechanism should take into account the real-time performance and computing resources of the system to ensure the efficiency and feasibility of the adjustment process.

[0193] In the context of the application of artificial intelligence technology, when this system processes massive amounts of data, it needs to label all of this data to reduce the burden of the system processing data and improve the system's operating performance. In addition, even if there is insufficient data for detecting network intrusion behavior, artificial intelligence can still be used to intelligently identify and distinguish network anomaly data and estimate the probability of network intrusion behavior. Specifically: (1) Data collection and preprocessing: Collect available historical data, including sample characteristics, labeling results, etc. Preprocess the data, such as cleaning, removing outliers, and standardizing. (2) Feature engineering: Perform feature engineering based on the nature of the problem and available data to select or construct features that are helpful for the prediction task. (3) Model selection and training: Select a machine learning model suitable for insufficient data, such as a rule-based model, ensemble learning method, etc. Use available data sets to train the model. (4) Model evaluation and tuning: Use methods such as cross-validation to evaluate the performance of the model, such as accuracy, recall, F1 score, etc. Based on the evaluation results, adjust the model's parameters or structure to improve the model's prediction performance. (5) Prediction and decision-making: Use the trained model to predict new data and make corresponding decisions or operations based on the prediction results. (6) Feedback and optimization: Collect new data and process results for feedback and model optimization. Regularly retrain and evaluate the model to improve its predictive performance.

[0194] Through the above steps, even when the data is insufficient, artificial intelligence technology can be used for prediction, and the accuracy and reliability of the prediction can be improved as the data accumulates and the model is optimized.

[0195] When designing the communication protocol, the subject mobility analysis module 9 should use XML files and the message format to accurately describe the data communication model to ensure that the system exhibits a high exchange protocol communication capability. In order to protect the feature information and avoid the risk of feature information loss and leakage, it is necessary to authenticate the encrypted intrusion detection exchange protocol to ensure the confidentiality and security of the protocol.

[0196] After the intrusion detection execution module 10 is officially running, it is necessary to perform all initialization work and interpret relevant passwords to achieve the purpose of accurately reading the system database data, and then form a two-dimensional rule chain list to provide a basis and guidance for the constraints and specifications of the later network detection behavior. At the same time, it is also necessary to cyclically execute operations such as packet capture, rule setting, and rule matching. First, with the help of the data packet capture library function, random acquisition of data packets can be achieved; secondly, the parsing function is used to call and parse the required data packets. Finally, when the data packet is parsed, the two-dimensional rule chain is compared. If the rule entry is successfully matched, it means that there is an intrusion behavior.

[0197] Through the above modules and steps, the artificial intelligence-based mobile communication network optimization method can improve the performance and reliability of the network, realize the optimal allocation of network traffic, adjustment of base station power, optimization of coverage, detection and alarm of network intrusion behavior, and other functions.

[0198] Alarm responder module 7: When the alarm function is activated and the relevant images are called, the alarm responder is used to intelligently monitor and control the external intrusion behavior of the system. The responder can be used to intelligently monitor and control the external intrusion behavior of the system. The number of relays contained in the alarm responder reaches 32. When determining the address of a single group of relay cameras, the operator needs to set it manually.

[0199] like Figure 7 As shown, the present disclosure provides a schematic diagram of the structure of a network optimization system 700. The system 700 includes an acquisition module 701, a determination module 702, and a detection module 703.

[0200] The acquisition module 701 is used to acquire communication data of multiple communication nodes, and determine a network delay distance matrix based on the communication data of the multiple communication nodes;

[0201] The determination module 702 is used to determine the target network path based on the network delay distance matrix through an ant colony algorithm;

[0202] The detection module 703 is used to perform intrusion detection on the target network path using an intrusion detection model. The intrusion detection model is obtained by training an initial model using training data samples. The training data samples are obtained by marking initial data samples using the sample model.

[0203] In an embodiment of the present disclosure, the determination module is also used to construct a network node distance matrix based on the distance information of any two communication nodes among multiple communication nodes, and the communication data includes at least one of the node position and the network delay; based on the network delay of each communication node, a network delay vector is constructed; according to the network node distance matrix and the network delay vector, the network delay distance matrix is ​​determined.

[0204] In an embodiment of the present disclosure, the determination module is also used to determine the transmission vector of the first communication node among multiple communication nodes based on the network delay vector and the optical fiber propagation speed of the first communication node; determine the first element value between the first communication node and the second communication node in the network node distance matrix; determine the second element in the network delay distance matrix between the first communication node and the second communication node based on the first element value and the weighted node transmission vector sum, the weighted node transmission vector sum includes the weighted node transmission vector of the first communication node and the weighted node transmission vector of the second communication node, the weighted node transmission vector is the calculated value of the transmission vector and the corresponding weighting coefficient.

[0205] In an embodiment of the present disclosure, the determination module is also used to initialize and assign values ​​to initial parameters and an initial weighting coefficient matrix of the ant colony algorithm, and determine network monitoring results, wherein the initial parameters include at least one of the number of ants, a pheromone importance factor, a heuristic function importance factor, and a pheromone evaporation coefficient; when the network monitoring results meet preset conditions, the initial weighting coefficient is increased or decreased by a first adjustment value to obtain a first weighting coefficient matrix; based on the first weighting coefficient matrix, the network delay distance matrix is ​​cyclically searched through the ant colony algorithm, and the network performance is determined until the network performance reaches the expected performance, the cyclic search is terminated, and the target network path is obtained.

[0206] In an embodiment of the present disclosure, the determination module is also used to update the pheromone after each ant completes a path search for the network delay distance matrix, and after all ants complete all path searches for the network delay distance matrix, to obtain a first network path, where the first network path is a path whose distance values ​​of all searched paths meet the distance condition; determine the network performance of the first network path; when the network performance of the first network path does not reach the expected performance, based on the network monitoring results of the first network path and preset conditions, increase or decrease the first weighting coefficient by a first adjustment value to obtain a second weighting coefficient matrix; based on the second weighting coefficient matrix, perform a cyclic search on the network delay distance matrix through an ant colony algorithm until the network performance of the second network path reaches the expected performance, determine the second network path as the target network path, and determine the third weighting coefficient matrix as the target weighting coefficient matrix, where the third weighting coefficient matrix is ​​the weighting coefficient matrix when the network performance reaches the expected performance.

[0207] In an embodiment of the present disclosure, the detection module is also used to obtain an initial data sample set, which includes a probability difference, a marking result, and communication data of the initial data sample, wherein the marking result is obtained by evaluating the probability difference and the probability difference threshold of the initial data sample using a sample model; the initial data sample is preprocessed to obtain a first data sample; and the probability difference threshold is adaptively adjusted based on the probability difference and the marking result of the first data sample and the current performance indicator of the sample model.

[0208] In an embodiment of the present disclosure, the detection module is also used to determine a training data sample based on the first data sample, the training data sample including sample features and labeling results; and use the training data sample to train the initial model to obtain an intrusion detection model.

[0209] In summary, the network optimization system proposed in the embodiment of the present disclosure obtains communication data of multiple communication nodes, uses the ant colony algorithm to search for the target network path, uses artificial intelligence technology, and uses a trained intrusion detection model to detect intrusion behaviors occurring in the target network path, thereby improving network security.

[0210] In the embodiments provided in the present application, the methods and systems provided in the embodiments of the present application are introduced. In order to implement the functions in the methods provided in the embodiments of the present application, the electronic device may include a hardware structure and a software module, and implement the functions in the form of a hardware structure, a software module, or a hardware structure plus a software module. A function in the functions may be executed in the form of a hardware structure, a software module, or a hardware structure plus a software module.

[0211] Figure 8 is a block diagram of an electronic device 800 for implementing the above network optimization method according to an exemplary embodiment.

[0212] Reference Figure 8 The electronic device 800 may include a communication interface 801, which can interact with other devices; a processor 802, which is connected to the communication interface 801 to interact with other devices and is used to execute the method provided by one or more of the above technical solutions when running a computer program; and a memory 803, on which the computer program is stored. Specifically, the specific processing process of the processor 802 can refer to the network optimization method described in the above embodiment of the present disclosure.

[0213] Of course, in actual application, the various components in the electronic device 800 are coupled together through the bus system 804. It can be understood that the bus system 804 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 804 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 8 Various buses are labeled as bus system 804 .

[0214] The memory 803 in the embodiment of the present application is used to store various types of data to support the operation of the electronic device 800. Examples of such data include: any computer program used to operate on the electronic device 800.

[0215] The method disclosed in the above embodiment of the present application can be applied to the processor 802, or implemented by the processor 802. The processor 802 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 802. The above processor 802 may be a general processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 802 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 803, and the processor 802 reads the information in the memory 803 and completes the steps of the above method in combination with its hardware.

[0216] In an exemplary embodiment, the electronic device 800 can be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), field programmable gate array (FPGA), general processor, controller, microcontroller (MCU), microprocessor, or other electronic components to execute the aforementioned method.

[0217] The embodiments of the present disclosure further provide a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the network optimization method described in the above embodiments of the present disclosure.

[0218] An embodiment of the present disclosure further provides a computer program product, including a computer program, which executes the network optimization method described in the above embodiment of the present disclosure when a processor is used to execute the computer program.

[0219] An embodiment of the present disclosure also proposes a chip, which includes one or more interface circuits and one or more processors; the interface circuit is used to receive signals from a memory of an electronic device and send signals to the processor, the signals include computer instructions stored in the memory, and when the processor executes the computer instructions, the electronic device executes the network optimization method described in the above embodiments of the present disclosure.

[0220] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0221] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiments or examples are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0222] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention belong.

[0223] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processing module, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (control method), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or otherwise processing in a suitable manner if necessary, and then stored in a computer memory.

[0224] It should be understood that the various parts of the embodiments of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0225] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0226] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium. The above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0227] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A network optimization method, characterized in that: The method comprises: Acquire communication data of a plurality of communication nodes, and determine a network delay distance matrix based on the communication data of the plurality of communication nodes; Based on the network delay distance matrix, determine the target network path through an ant colony algorithm; An intrusion detection model is used to perform intrusion detection on the target network path. The intrusion detection model is obtained by training an initial model using training data samples. The training data samples are obtained by marking initial data samples using a sample model.

2. The method according to claim 1, characterized in that Determining a network delay distance matrix based on the communication data of the plurality of communication nodes comprises: Based on the distance information of any two communication nodes among the plurality of communication nodes, construct a network node distance matrix, wherein the communication data includes at least one of a node position and a network delay; Based on the network delay of each communication node, a network delay vector is constructed; The network delay distance matrix is ​​determined according to the network node distance matrix and the network delay vector.

3. The method according to claim 2, characterized in that The determining the network delay distance matrix according to the network node distance matrix and the network delay vector comprises: Determining a transmission vector of a first communication node among the plurality of communication nodes based on a network delay vector and an optical fiber propagation speed of the first communication node; Determine a first element value between the first communication node and the second communication node in the network node distance matrix; Based on the first element value and the weighted node transmission vector sum, the second elements of the first communication node and the second communication node in the network delay distance matrix are determined, and the weighted node transmission vector sum includes the weighted node transmission vector of the first communication node and the weighted node transmission vector of the second communication node, and the weighted node transmission vector is the calculated value of the transmission vector and the corresponding weighting coefficient.

4. The method according to claim 1, characterized in that: The determining of the target network path based on the network delay distance matrix by using an ant colony algorithm includes: Initializing and assigning initial parameters and initial weighted coefficient matrix of the ant colony algorithm, and determining network monitoring results, wherein the initial parameters include at least one of the number of ants, pheromone importance factor, heuristic function importance factor, and pheromone evaporation coefficient; When the network monitoring result meets the preset condition, the initial weighting coefficient is increased or decreased by a first adjustment value to obtain a first weighting coefficient matrix; Based on the first weight coefficient matrix, the network delay distance matrix is ​​cyclically searched through the ant colony algorithm, and the network performance is determined until the network performance reaches the expected performance, and then the cyclic search is terminated to obtain the target network path.

5. The method according to claim 4, characterized in that The step of performing a cyclic search on the network delay distance matrix by using the ant colony algorithm based on the first weight coefficient matrix includes: After each ant completes a path search for the network delay distance matrix, and after all ants complete all path searches for the network delay distance matrix, the pheromone is updated to obtain a first network path, where the first network path is a path where the distance values ​​of all searched paths meet the distance condition; determining a network performance of the first network path; When the network performance of the first network path does not reach the expected performance, based on the network monitoring result of the first network path and the preset condition, the first weighting coefficient is increased or decreased by the first adjustment value to obtain a second weighting coefficient matrix; Based on the second weighting coefficient matrix, the network delay distance matrix is ​​cyclically searched through the ant colony algorithm until the network performance of the second network path reaches the expected performance, the second network path is determined as the target network path, and the third weighting coefficient matrix is ​​determined as the target weighting coefficient matrix, and the third weighting coefficient matrix is ​​the weighting coefficient matrix when the network performance reaches the expected performance.

6. The method according to claim 1, characterized in that The method further comprises: Acquire the initial data sample set, the initial data sample set including the probability difference of the initial data sample, the marking result, and the communication data, the marking result being obtained by evaluating the probability difference of the initial data sample and the probability difference threshold using the sample model; Preprocessing the initial data sample to obtain a first data sample; The probability difference threshold is adaptively adjusted according to the probability difference and the marking result of the first data sample and the current performance index of the sample model.

7. The method according to claim 6, characterized in that The method further comprises: Based on the first data sample, determine a training data sample, wherein the training data sample includes sample features and labeling results; The initial model is trained using the training data samples to obtain the intrusion detection model.

8. A network optimization system, characterized in that: The system includes an acquisition module, a determination module, and a detection module. The acquisition module is used to acquire communication data of multiple communication nodes, and determine a network delay distance matrix based on the communication data of the multiple communication nodes; The determination module is used to determine the target network path based on the network delay distance matrix through an ant colony algorithm; The detection module is used to perform intrusion detection on the target network path using an intrusion detection model, wherein the intrusion detection model is obtained by training an initial model using training data samples, and the training data samples are obtained by marking initial data samples using a sample model.

9. An electronic device, characterized in that: include: one or more processors; A storage device communicatively connected to the one or more processors, on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the method according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 7.

Images