A network topology self-discovery method and system based on intelligent adaptive search

Abstract

A network topology self-discovery method and system based on intelligent adaptive search, comprising: collecting indicators of each node to establish a covariance matrix, selecting several key nodes; establishing an adjacency matrix of node connection relationships, using the key node as the starting node, dividing the network into a hierarchical structure centered on the starting node for dynamic hierarchical exploration, and updating the adjacency matrix based on the exploration results; generating an optimal path based on a shortest path algorithm; dividing the node stability level; performing different frequencies of detection on nodes of different levels of stability in different layers or not performing real-time detection; updating the adjacency matrix and the optimal path based on the exploration results; predicting abnormal nodes, and performing redundant verification on these nodes during the exploration process; for abnormal nodes determined after verification, deleting the corresponding elements of the abnormal nodes in the adjacency matrix, and performing adaptive backtracking on the abnormal nodes. The present invention avoids the waste of resources caused by blind full detection and improves the reliability of the explored topology.

Description

Technical Field

[0001] The present invention belongs to the technical field of network self-discovery, and more specifically, relates to a network topology self-discovery method and system based on intelligent adaptive search. Background Art

[0002] In today's information age, network topology self-discovery technology is crucial for network management and optimization. Network topology self-discovery involves using software tools to automatically identify and map network devices, services, and the connections between them. Traditional network topology self-discovery methods typically rely on static, pre-set search strategies and path selection, which often leads to inefficiency and lack of accuracy in dynamically changing network environments.

[0003] Existing technologies primarily rely on simple network detection and data collection methods, such as ICMP-based ping scans or SNMP-based information queries, to discover network devices and services. These methods may perform well in small or relatively static network environments, but their performance is often limited in large and complex network environments, particularly in dynamic and changing scenarios such as cloud data centers and enterprise-level networks. Due to their lack of adaptability to dynamic network changes, traditional methods are inefficient when dealing with growing network scale and structural changes. They struggle to reflect the real-time status of the network, leading to blind spots in network management and maintenance.

[0004] Furthermore, existing technologies have significant limitations in path selection and node exploration strategies. Traditional methods often use pre-set paths and strategies for network exploration, which not only limits exploration flexibility and coverage but also can lead to duplicate exploration and waste of resources. Regarding network status prediction and anomaly detection, existing technologies also lack effective mechanisms to predict network changes and promptly identify potential issues, making them ineffective in guiding network optimization and adjustment. Summary of the Invention

[0005] In order to solve the deficiencies in the prior art, the present invention provides a network topology self-discovery method and system based on intelligent adaptive search.

[0006] The present invention adopts the following technical solutions.

[0007] A first aspect of this embodiment provides a network topology self-discovery method based on intelligent adaptive search, including:

[0008] Sending detection packets to the network at a set period to detect and count the nodes in the network and collect the set indicators of each node, including traffic, number of connected nodes and response time, and establishing the covariance matrix of the indicators. Based on the matrix, several key nodes are selected;

[0009] Establish an adjacency matrix of node connection relationships, use key nodes as starting nodes, divide the network into a hierarchical structure centered on the starting node for dynamic hierarchical exploration, and update the adjacency matrix based on the exploration results; generate the optimal path based on the shortest path algorithm;

[0010] Calculate the node's flow stability coefficient and structural stability coefficient based on the current adjacency matrix and the rate of change of the node and its adjacent nodes' flow; cluster the nodes based on these two coefficients and divide them into different stability levels; perform different frequency detections on nodes at different levels and different stability levels, or do not perform real-time detection; and update the adjacency matrix and optimal path based on the exploration results.

[0011] A node anomaly propagation model is established to predict abnormal nodes, and these nodes are redundantly verified during the exploration process. For abnormal nodes determined after verification, the corresponding elements of the abnormal nodes are deleted from the adjacency matrix, and adaptive backtracking is performed on the abnormal nodes to recalculate the optimal path containing the abnormal nodes.

[0012] Preferably, the selecting of several key nodes is specifically:

[0013] Normalize the traffic, number of connected nodes and response time within a set number of cycles; extract the maximum traffic, number of connected nodes and shortest response time, and form them into a one-dimensional vector ; The normalized traffic, number of connected nodes and response time of each node at the current moment are all formed into a one-dimensional vector;

[0014] Build a covariance matrix based on these one-dimensional vectors ;

[0015] Calculate the covariance distance of each node to the optimal data :

[0016]

[0017] in, Representation node i A one-dimensional vector consisting of the current traffic, number of connected nodes, and response time; express Inverse matrix; is the transpose of the matrix.

[0018] Preferably, the network is divided into a hierarchical structure centered on the starting node for dynamic hierarchical exploration, and the adjacency matrix is ​​updated according to the exploration results, specifically as follows:

[0019] When the number of network nodes is N, an N*N adjacency matrix is ​​established. For the element in the i-th row and j-th column of the matrix, when nodes i and j are not connected, it is 0. When they are connected, it is the ratio of the bandwidth to the delay of the link connecting the two nodes.

[0020] First, perform preliminary stratification based on the connection relationship. The starting node is used as the first layer, the adjacent nodes of the starting node are used as the second layer, and the adjacent nodes of these adjacent nodes that are different from the nodes in the previous layers are used as the third layer. Repeat the stratification until there are no new adjacent nodes.

[0021] When the number of nodes in any layer is greater than 1.5 times the average number of nodes in all layers, all nodes in the layer are arranged in descending order according to the number of their adjacent nodes.

[0022] Split the layer into multiple layers according to this arrangement, so that the number of nodes in all split layers is less than or equal to 50% of the average number of nodes in the layer;

[0023] Except for the first layer, when the number of nodes in two consecutive layers is less than 0.5 times the average number of nodes in all current layers, the two layers are merged into one layer.

[0024] Preferably, the flow stability coefficient and the structural stability coefficient of the computing node are used; the nodes are clustered according to the two coefficients and the stability levels of the nodes are divided as follows:

[0025] Obtain an undirected graph of the network based on the current adjacency matrix, and use the Tarjan algorithm to obtain the cut points of the network; the cut points are nodes in the undirected graph that will be classified into multiple disconnected subgraphs after being removed;

[0026] Calculate the flow stability coefficient according to the following formula and structural stability coefficient ;

[0027]

[0028] in, is the traffic change rate of the node in the set sliding window; 、 is the set coefficient; is the variance of the traffic change rate of the adjacent nodes of the node in the set sliding window; is the cut point influence coefficient, which is 1 when the node is a cut point, otherwise it is 0; is the number of adjacent nodes of the node;

[0029] Calculate the normalized flow stability coefficient and structural stability coefficient , and combined into the stability coordinates of the node , clustering is done according to the stability coordinates of the nodes, and is divided into three categories. Each category represents a stability level. The stability coordinates of the cluster center are the same as the coordinates The smaller the Euclidean distance, the higher the stability level of the cluster.

[0030] Preferably, different frequencies of detection are performed on nodes at different levels of stability, or no real-time detection is performed, specifically:

[0031] Set the three frequencies from high to low as the first, second and third frequencies respectively.

[0032] For all nodes in the first layer and the nodes with the lowest stability level among the nodes in the second to Mth layers, detection is performed at the first frequency, where M is a set value;

[0033] For the nodes with the second highest stability level among the nodes in the second to Mth layers, and the nodes with the lowest stability level among the nodes after the Mth layer, detection is performed at the second frequency;

[0034] For the nodes with the highest stability level among the nodes in the second to Mth layers, and the nodes with the second highest stability level among the nodes after the Mth layer, detection is performed at the third frequency;

[0035] For nodes with the highest stability level after the Mth layer, no real-time detection is performed.

[0036] Preferably, a node anomaly propagation model is established to predict abnormal nodes, specifically:

[0037] Obtain abnormal nodes and nodes affected by abnormal nodes in historical data, and obtain the historical adjacency matrix when the abnormal nodes appear. Train the graph neural network prediction model based on the historical adjacency matrix; predict the spontaneous abnormality rate of nodes and the probability of node abnormality propagation between every two nodes based on the current adjacency matrix;

[0038] Establish a node anomaly propagation model and predict the anomaly probability of node i based on the model :

[0039]

[0040] in, represents the set of all nodes whose hop count to node j is less than or equal to the set hop count threshold; represents the probability of node anomaly propagation between node j and node i; is the element in row i and column j in the adjacency matrix; represents the spontaneous abnormality rate of node i; Indicates the repair coefficient of the set node.

[0041] Preferably, the node affected by the abnormal node is a node whose hop count to the abnormal node is less than or equal to a set hop count threshold, the set hop count threshold is 3, and the node is normal when the abnormal node is abnormal, but also abnormal within the following 4 time periods.

[0042] For new nodes detected during the exploration process, their normalized flow stability coefficient and structural stability coefficient are calculated, and the Euclidean distance between these two coefficients and the corresponding two coefficients of each adjacent node of the node is calculated. The adjacent node with the smallest Euclidean distance is obtained, and the spontaneous anomaly rate of the adjacent node and the node anomaly propagation probability with other nodes are used as the spontaneous anomaly rate of the new node and the node anomaly propagation probability with other nodes.

[0043] Preferably, the redundant verification of these nodes is specifically performed as follows:

[0044] For the predicted abnormal node, a key node, an adjacent node of the predicted abnormal node, and an edge node are randomly selected. These nodes are all used as source nodes to send detection packets to the predicted abnormal node to obtain the packet loss rate, response time, and the number of hops between the sending node and the predicted abnormal node. If the number of hops obtained by at least two source nodes increases, the packet loss rate exceeds the set packet loss rate threshold, or the response time exceeds the set response time threshold, it means that an abnormality is determined.

[0045] Preferably, adaptive backtracking is performed on the abnormal node to recalculate the optimal path including the abnormal node, specifically:

[0046] The node with the smallest abnormal probability among all nodes with a hop count of less than or equal to 2 to the abnormal node is selected as the backtracking node, and the optimal path is generated according to the backtracking node and the shortest path algorithm. The generated optimal path includes the backtracking node.

[0047] The second aspect of the present invention provides a network topology self-discovery system based on the network topology self-discovery method of the first aspect of the present invention, comprising a key node selection module, a network node and path exploration module, a real-time exploration module of different frequencies, and an abnormal node backtracking module, specifically:

[0048] Key node selection module: Sends detection packets to the network at a set period to detect and count the nodes in the network, and collects the set indicators of each node, including traffic, number of connected nodes and response time, establishes the covariance matrix of the indicators, and selects several key nodes based on the matrix;

[0049] Network node and path exploration module: establishes an adjacency matrix of node connection relationships, takes key nodes as starting nodes, divides the network into a hierarchical structure centered on the starting nodes for dynamic layered exploration, and updates the adjacency matrix based on the exploration results; generates the optimal path based on the shortest path algorithm;

[0050] Real-time exploration module with different frequencies: Calculates the node's flow stability coefficient and structural stability coefficient based on the current adjacency matrix and the rate of change of the node and its adjacent nodes' flow; clusters nodes based on these two coefficients and divides them into different stability levels; performs detection at different frequencies or no real-time detection on nodes of different layers and stability levels; and updates the adjacency matrix and optimal path based on the exploration results.

[0051] Abnormal node backtracking module: establishes a node anomaly propagation model, predicts abnormal nodes, and performs redundant verification on these nodes during the exploration process; for abnormal nodes identified after verification, deletes the corresponding elements of the abnormal nodes in the adjacency matrix, performs adaptive backtracking on the abnormal nodes, and recalculates the optimal path containing the abnormal nodes.

[0052] Compared to existing technologies, this invention offers the following advantages: By screening key nodes and conducting layered detection, it ensures coverage of critical network paths and avoids the resource waste of blind, full-scale detection. Nodes are classified into different stability levels, with different frequencies assigned to nodes in different layers and stability levels. This dynamic detection strategy significantly reduces network load while ensuring exploration accuracy. Potential anomaly nodes are predicted, and through redundant verification, false alarm rates are reduced. Adaptive backtracking is performed, allowing for self-discovery of network topology while taking anomalies into account, ensuring the reliability of network topology detection paths. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 Flowchart of the present invention. DETAILED DESCRIPTION

[0054] The present invention adopts the following technical solutions.

[0055] A first aspect of the present invention provides a network topology self-discovery method based on intelligent adaptive search, comprising:

[0056] Sending detection packets to the network at a set period to detect and count the nodes in the network and collect the set indicators of each node, including traffic, number of connected nodes and response time, and establishing the covariance matrix of the indicators. Based on the matrix, several key nodes are selected;

[0057] Establish an adjacency matrix of node connection relationships, use key nodes as starting nodes, divide the network into a hierarchical structure centered on the starting node for dynamic hierarchical exploration, and update the adjacency matrix based on the exploration results; generate the optimal path based on the shortest path algorithm;

[0058] Calculate the node's flow stability coefficient and structural stability coefficient based on the current adjacency matrix and the rate of change of the node and its adjacent nodes' flow; cluster the nodes based on these two coefficients and divide them into different stability levels; perform different frequency detections on nodes at different levels and different stability levels, or do not perform real-time detection; and update the adjacency matrix and optimal path based on the exploration results.

[0059] A node anomaly propagation model is established to predict abnormal nodes, and these nodes are redundantly verified during the exploration process. For abnormal nodes determined after verification, the corresponding elements of the abnormal nodes are deleted from the adjacency matrix, and adaptive backtracking is performed on the abnormal nodes to recalculate the optimal path containing the abnormal nodes.

[0060] Preferably, the selecting of several key nodes is specifically:

[0061] Normalize the traffic, number of connected nodes and response time within a set number of cycles; extract the maximum traffic, number of connected nodes and shortest response time, and form them into a one-dimensional vector ; The normalized traffic, number of connected nodes and response time of each node at the current moment are all formed into a one-dimensional vector;

[0062] Build a covariance matrix based on these one-dimensional vectors ;

[0063] Calculate the covariance distance of each node to the optimal data :

[0064]

[0065] in, Representation node i A one-dimensional vector consisting of the current traffic, number of connected nodes, and response time; express Inverse matrix; is the transpose of the matrix;

[0066] Preferably, the network is divided into a hierarchical structure centered on the starting node for dynamic hierarchical exploration, and the adjacency matrix is ​​updated according to the exploration results, specifically as follows:

[0067] When the number of network nodes is N, an N*N adjacency matrix is ​​established. For the element in the i-th row and j-th column of the matrix, when nodes i and j are not connected, it is 0. When they are connected, it is the ratio of the bandwidth to the delay of the link connecting the two nodes.

[0068] First, perform preliminary stratification based on the connection relationship. The starting node is the first layer, the adjacent nodes of the starting node are the second layer, and the adjacent nodes of these adjacent nodes that are different from the nodes in the previous layers are the third layer. Repeat the stratification until there are no new adjacent nodes.

[0069] When the number of nodes in any layer is greater than 1.5 times the average number of nodes in all layers, all nodes in the layer are arranged from largest to smallest according to the number of their adjacent nodes, and the layer is split into multiple sub-layers according to this arrangement, so that the number of nodes in all sub-layers is less than or equal to 50% of the average number of nodes in the layer;

[0070] Except for the first layer, when the number of nodes in two consecutive layers is less than 0.5 times the average number of nodes in all current layers, the two layers are merged into one layer.

[0071] For example, a preliminary stratification is performed based on the connection relationship. The starting node is used as the first layer, the adjacent nodes of the starting node are used as the second layer, and the adjacent nodes of these adjacent nodes that are different from the nodes in the previous layers are used as the third layer. The stratification is repeated until there are no new adjacent nodes. For example, this embodiment is divided into six layers: the first layer, the second layer, the third layer, the fourth layer, the fifth layer, and the sixth layer. The average number of nodes per layer is 6.

[0072] Then the layers are split. In this embodiment, the third layer is greater than 9. All nodes in the third, fourth, and fifth layers are arranged from largest to smallest according to the number of their adjacent nodes and then layered. The layer is split into multiple layers. The third layer is divided into four layers. The number of nodes in all the split layers is less than or equal to 3. Then the original number of layers becomes nine, namely the first layer, the second layer, the third layer (the first layer split from the original third layer), the fourth layer (the second layer split from the original third layer), the fifth layer (the second layer split from the original third layer), the sixth layer (the third layer split from the original third layer), the seventh layer (the fourth layer split from the original third layer), the eighth layer (the fifth layer split from the original third layer), and the ninth layer (the original sixth layer). The average number of nodes in all layers is now 4. The number of nodes in the eighth and ninth layers is less than 2. The two layers are merged into one layer, which becomes eight layers, namely the first layer, the second layer, the third layer, the fourth layer, the fifth layer, the sixth layer, the seventh layer, and the eighth layer (the merged layer).

[0073] Preferably, the flow stability coefficient and the structural stability coefficient of the computing node are used; the nodes are clustered according to the two coefficients and the stability levels of the nodes are divided as follows:

[0074] Obtain an undirected graph of the network based on the current adjacency matrix, and use the Tarjan algorithm to obtain the cut points of the network; the cut points are nodes in the undirected graph that will be classified into multiple disconnected subgraphs after being removed;

[0075] Calculate the flow stability coefficient according to the following formula and structural stability coefficient ;

[0076]

[0077] in, is the traffic change rate of the node in the set sliding window; 、 is the set coefficient, 、 The coefficients are all greater than 0 and less than or equal to 1, and are adjusted according to the specific network scenario. In high-fluctuation scenarios such as video transmission networks, Take a value greater than 0.5 to strengthen the fluctuation penalty. In a network with dense adjacent nodes such as a data center network, Take a value greater than 0.5; is the variance of the traffic change rate of the adjacent nodes of the node in the set sliding window; is the cut point influence coefficient, which is 1 when the node is a cut point, otherwise it is 0; is the number of adjacent nodes of the node;

[0078] Calculate the normalized flow stability coefficient and structural stability coefficient , and combined into the stability coordinates of the node , clustering is done according to the stability coordinates of the nodes, and is divided into three categories, each category represents a stability level, and the stability coordinates of the cluster center are The smaller the Euclidean distance, the higher the stability level of the cluster.

[0079] Preferably, different frequencies of detection are performed on nodes at different levels of stability, or no real-time detection is performed, specifically:

[0080] Set the three frequencies from high to low as the first, second and third frequencies respectively.

[0081] For all nodes in the first layer and the nodes with the lowest stability level among the nodes in the second to Mth layers, detection is performed at the first frequency, where M is a set value;

[0082] For the nodes with the second highest stability level among the nodes in the second to Mth layers, and the nodes with the lowest stability level among the nodes after the Mth layer, detection is performed at the second frequency;

[0083] For the nodes with the highest stability level among the nodes in the second to Mth layers, and the nodes with the second highest stability level among the nodes after the Mth layer, detection is performed at the third frequency;

[0084] For nodes with the highest stability level after the Mth layer, no real-time detection is performed.

[0085] Preferably, a node anomaly propagation model is established to predict abnormal nodes, specifically:

[0086] Obtain abnormal nodes and nodes affected by abnormal nodes in historical data, and obtain the historical adjacency matrix when the abnormal nodes appear. Train the graph neural network prediction model based on the historical adjacency matrix; predict the spontaneous abnormality rate of nodes and the probability of node abnormality propagation between every two nodes based on the current adjacency matrix;

[0087] It should be noted that the graph neural network prediction model uses a graph neural network (GNN). The historical adjacency matrix when an abnormal node appears is used as a sample. The abnormal nodes and the nodes affected by the abnormal nodes in the corresponding historical data are obtained. The spontaneous abnormality rate of the abnormal node in the corresponding historical data is 1, and the other nodes are 0. The node abnormality propagation probability between the node affected by the abnormal node and the corresponding abnormal node in the corresponding historical data is 1, and the node abnormality propagation probability between the other two nodes is 0. The spontaneous abnormality rate of all nodes and the node abnormality propagation probability between every two nodes are used as labels.

[0088] Loss Function of Graph Neural Network (GNN) It can be but not limited to mean square error, the formula is:

[0089]

[0090] in, is the total number of nodes; is the set of all nodes connected to node i; is the predicted value of the spontaneous anomaly rate of node i during training; for The number of nodes, is the true value of the spontaneous anomaly rate of node i; is the predicted value of the node abnormality propagation probability between node j and node i during training, is the true value of the node anomaly propagation probability between node j and node i.

[0091] Establish a node anomaly propagation model and predict the anomaly probability of node i based on the model :

[0092]

[0093] in, represents the set of all nodes whose hop count to node j is less than or equal to the set hop count threshold; represents the probability of node anomaly propagation between node j and node i; is the element in row i and column j in the adjacency matrix; represents the spontaneous anomaly rate of node i; Indicates the repair coefficient of the set node. is the element in row i and column j in the adjacency matrix; represents the spontaneous anomaly rate of node i; Indicates the repair coefficient of the set node. It should be noted that the repair coefficient of the node Greater than 0 and less than or equal to 1. This repair coefficient is related to the recovery speed of abnormal nodes. For example, if it is an industrial Internet of Things, which requires regular maintenance and a fast recovery speed, the node repair coefficient is set to 0.8;

[0094] Preferably, the node affected by the abnormal node is a node whose hop count to the abnormal node is less than or equal to a set hop count threshold, the set hop count threshold is 3, and the node is normal when the abnormal node is abnormal, but also abnormal within the following 4 time periods.

[0095] Preferably, for new nodes detected during the exploration process, their normalized flow stability coefficient and structural stability coefficient are calculated, and the Euclidean distance between these two coefficients and the corresponding two coefficients of each adjacent node of the node is calculated. The adjacent node with the smallest Euclidean distance is obtained, and the spontaneous anomaly rate of the adjacent node and the node anomaly propagation probability with other nodes are used as the spontaneous anomaly rate of the new node and the node anomaly propagation probability with other nodes.

[0096] Preferably, the redundant verification of these nodes is specifically performed as follows:

[0097] For the predicted abnormal node, a key node, an adjacent node of the predicted abnormal node, and an edge node are randomly selected. These nodes are all used as source nodes to send detection packets to the predicted abnormal node to obtain the packet loss rate, response time, and the number of hops between the sending node and the predicted abnormal node. If the number of hops obtained by at least two source nodes increases, the packet loss rate exceeds the set packet loss rate threshold, or the response time exceeds the set response time threshold, it means that an abnormality is determined.

[0098] Preferably, adaptive backtracking is performed on the abnormal node to recalculate the optimal path including the abnormal node, specifically:

[0099] The node with the smallest abnormal probability among all nodes with a hop count of less than or equal to 2 to the abnormal node is selected as the backtracking node, and the optimal path is generated according to the backtracking node and the shortest path algorithm. The generated optimal path includes the backtracking node.

[0100] The second aspect of the present invention provides a network topology self-discovery system based on intelligent adaptive search and the method of the first aspect of the present invention, comprising a key node selection module, a network node and path exploration module, a real-time exploration module for different frequencies, and an abnormal node backtracking module, including:

[0101] Key node selection module: Sends detection packets to the network at a set period to detect and count the nodes in the network, and collects the set indicators of each node, including traffic, number of connected nodes and response time, establishes the covariance matrix of the indicators, and selects several key nodes based on the matrix;

[0102] Network node and path exploration module: establishes an adjacency matrix of node connection relationships, takes key nodes as starting nodes, divides the network into a hierarchical structure centered on the starting nodes for dynamic layered exploration, and updates the adjacency matrix based on the exploration results; generates the optimal path based on the shortest path algorithm;

[0103] Real-time exploration module with different frequencies: Calculates the node's flow stability coefficient and structural stability coefficient based on the current adjacency matrix and the rate of change of the node and its adjacent nodes' flow; clusters nodes based on these two coefficients and divides them into different stability levels; performs detection at different frequencies or no real-time detection on nodes of different layers and stability levels; and updates the adjacency matrix and optimal path based on the exploration results.

[0104] Abnormal node backtracking module: establishes a node anomaly propagation model, predicts abnormal nodes, and performs redundant verification on these nodes during the exploration process; for abnormal nodes identified after verification, deletes the corresponding elements of the abnormal nodes in the adjacency matrix, performs adaptive backtracking on the abnormal nodes, and recalculates the optimal path containing the abnormal nodes.

[0105] Compared to existing technologies, this invention offers the following advantages: By screening key nodes and conducting layered detection, it ensures coverage of critical network paths and avoids the resource waste of blind, full-scale detection. Nodes are classified into different stability levels, with different frequencies assigned to nodes in different layers and stability levels. This dynamic detection strategy significantly reduces network load while ensuring exploration accuracy. Potential anomaly nodes are predicted, and through redundant verification, false alarm rates are reduced. Adaptive backtracking is performed, allowing for self-discovery of network topology while taking anomalies into account, ensuring the reliability of network topology detection paths.

[0106] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the scope of protection of the claims of the present invention.

Claims

1. A network topology self-discovery method based on intelligent adaptive search, characterized in that: include: Sending detection packets to the network at a set period to detect and count the nodes in the network and collect the set indicators of each node, including traffic, number of connected nodes and response time, and establishing the covariance matrix of the indicators. Based on the matrix, multiple key nodes are selected; Establish an adjacency matrix of node connection relationships, use key nodes as starting nodes, divide the network into a hierarchical structure centered on the starting node for dynamic hierarchical exploration, and update the adjacency matrix based on the exploration results; Generate the optimal path based on the shortest path algorithm; Calculate the node's flow stability coefficient and structural stability coefficient based on the current adjacency matrix and the rate of change of the node and its adjacent nodes' flow; Cluster nodes based on these two coefficients and divide them into different stability levels; perform different frequency detections on nodes at different levels and different stability levels, or do not perform real-time detection; and update the adjacency matrix and optimal path based on the exploration results. A node anomaly propagation model is established to predict abnormal nodes, and these nodes are redundantly verified during the exploration process. For abnormal nodes determined after verification, the corresponding elements in the adjacency matrix of the abnormal nodes are deleted, and adaptive backtracking is performed on the abnormal nodes to recalculate the optimal path including the abnormal nodes.

2. The network topology self-discovery method based on intelligent adaptive search according to claim 1, characterized in that: The selection of multiple key nodes is specifically as follows: Normalize the traffic, number of connected nodes and response time within the set multiple cycles; extract the largest traffic, number of connected nodes and shortest response time, and form them into a one-dimensional vector ; The normalized traffic, number of connected nodes, and response time of each node at the current moment are combined into a one-dimensional vector; Build a covariance matrix based on these one-dimensional vectors ; Calculate the covariance distance of each node to the optimal data : in, Representation node i A one-dimensional vector consisting of the current traffic, number of connected nodes, and response time; express Inverse matrix; is the transpose of the matrix.

3. The network topology self-discovery method based on intelligent adaptive search according to claim 1, characterized in that: The network is divided into a hierarchical structure centered on the starting node for dynamic hierarchical exploration, and the adjacency matrix is ​​updated according to the exploration results, specifically: When the number of network nodes is N, an N*N adjacency matrix is ​​established. For the element in the i-th row and j-th column of the matrix, when nodes i and j are not connected, it is 0. When they are connected, it is the ratio of the bandwidth to the delay of the link connecting the two nodes. First, perform preliminary stratification based on the connection relationship. The starting node is the first layer, the adjacent nodes of the starting node are the second layer, and the adjacent nodes of these adjacent nodes that are different from the nodes in the previous layers are the third layer. Repeat the stratification until there are no new adjacent nodes. When the number of nodes in any layer is greater than 1.5 times the average number of nodes in all layers, all nodes in the layer are arranged from large to small according to the number of their adjacent nodes, and the layer is split into multiple layers according to this arrangement, so that the number of nodes in all split layers is less than or equal to 50% of the average number of nodes in the layer; Except for the first layer, when the number of nodes in two consecutive layers is less than 0.5 times the average number of nodes in all current layers, the two layers are merged into one layer.

4. The network topology self-discovery method based on intelligent adaptive search according to claim 1, characterized in that: The flow stability coefficient and structural stability coefficient of the computing node are clustered according to these two coefficients, and the stability level of the node is divided into the following levels: Obtain an undirected graph of the network based on the current adjacency matrix, and use the Tarjan algorithm to obtain the cut points of the network; the cut points are nodes in the undirected graph that will be classified into multiple disconnected subgraphs after being removed; Calculate the flow stability coefficient according to the following formula and structural stability coefficient ; in, is the traffic change rate of the node in the set sliding window; 、 is the set coefficient; is the variance of the traffic change rate of the adjacent nodes of the node in the set sliding window; is the cut point influence coefficient, which is 1 when the node is a cut point, otherwise it is 0; is the number of adjacent nodes of the node; Calculate the normalized flow stability coefficient and structural stability coefficient , and combined into the stability coordinates of the node , clustering is done according to the stability coordinates of the nodes, and is divided into three categories. Each category represents a stability level. The stability coordinates of the cluster center are the same as the coordinates The smaller the Euclidean distance, the higher the stability level of the cluster.

5. The network topology self-discovery method based on intelligent adaptive search according to claim 1, characterized in that: Nodes at different levels and different stability levels are detected at different frequencies or not detected in real time. Specifically: Set the three frequencies from high to low as the first, second and third frequencies respectively. For all nodes in the first layer and the nodes with the lowest stability level among the nodes in the second to Mth layers, detection is performed at the first frequency, where M is a set value; For the nodes with the second highest stability level among the nodes in the second to Mth layers, and the nodes with the lowest stability level among the nodes after the Mth layer, detection is performed at the second frequency; For the nodes with the highest stability level among the nodes in the second to Mth layers, and the nodes with the second highest stability level among the nodes after the Mth layer, detection is performed at the third frequency; For nodes with the highest stability level after the Mth layer, no real-time detection is performed.

6. The network topology self-discovery method based on intelligent adaptive search according to claim 1, characterized in that: Establish a node anomaly propagation model to predict abnormal nodes, specifically: Obtain abnormal nodes and nodes affected by abnormal nodes in historical data, and obtain the historical adjacency matrix when the abnormal nodes appear. Train the graph neural network prediction model based on the historical adjacency matrix; predict the spontaneous abnormality rate of nodes and the probability of node abnormality propagation between every two nodes based on the current adjacency matrix; Establish a node anomaly propagation model and predict the anomaly probability of node i based on the model : in, represents the set of all nodes whose hop count to node j is less than or equal to the set hop count threshold; represents the probability of node anomaly propagation between node j and node i; is the element in row i and column j in the adjacency matrix; represents the spontaneous anomaly rate of node i; Indicates the repair coefficient of the set node.

7. The network topology self-discovery method based on intelligent adaptive search according to claim 6, characterized in that: The node affected by the abnormal node is a node whose hop count to the abnormal node is less than or equal to a set hop count threshold, the set hop count threshold is 3, and the node is normal when the abnormal node is abnormal, but also abnormal in the following 4 time periods.

8. The network topology self-discovery method based on intelligent adaptive search according to claim 7, characterized in that: For new nodes detected during the exploration process, their normalized flow stability coefficient and structural stability coefficient are calculated, and the Euclidean distance between these two coefficients and the corresponding two coefficients of each adjacent node of the node is calculated. The adjacent node with the smallest Euclidean distance is obtained, and the spontaneous anomaly rate of the adjacent node and the node anomaly propagation probability with other nodes are used as the spontaneous anomaly rate of the new node and the node anomaly propagation probability with other nodes.

9. The network topology self-discovery method based on intelligent adaptive search according to claim 1, characterized in that: The redundant verification of these nodes is specifically as follows: For the predicted abnormal node, a key node, an adjacent node of the predicted abnormal node, and an edge node are randomly selected. These nodes are all used as source nodes to send detection packets to the predicted abnormal node to obtain the packet loss rate, response time, and the number of hops between the sending node and the predicted abnormal node. If the number of hops obtained by at least two source nodes increases, the packet loss rate exceeds the set packet loss rate threshold, or the response time exceeds the set response time threshold, it means that an abnormality is determined.

10. The network topology self-discovery method based on intelligent adaptive search according to claim 6, characterized in that: Adaptively backtrack the abnormal node and recalculate the optimal path including the abnormal node. Specifically: The node with the smallest abnormal probability among all nodes with a hop count of less than or equal to 2 to the abnormal node is selected as the backtracking node, and the optimal path is generated according to the backtracking node and the shortest path algorithm. The generated optimal path includes the backtracking node.

11. A network topology self-discovery system based on intelligent adaptive search and the method according to any one of claims 1 to 10, comprising a key node selection module, a network node and path exploration module, a different frequency real-time exploration module, and an abnormal node backtracking module, characterized in that: Key node selection module: Sends detection packets to the network at a set period to detect and count the nodes in the network, and collects the indicators of each node, including traffic, number of connected nodes and response time. It establishes the covariance matrix of the indicators and selects multiple key nodes based on the matrix. Network node and path exploration module: establishes an adjacency matrix of node connection relationships, takes key nodes as starting nodes, divides the network into a hierarchical structure centered on the starting nodes for dynamic layered exploration, and updates the adjacency matrix based on the exploration results; generates the optimal path based on the shortest path algorithm; Real-time exploration module with different frequencies: Calculates the node's flow stability coefficient and structural stability coefficient based on the current adjacency matrix and the rate of change of the node and its adjacent nodes' flow; Cluster nodes based on these two coefficients and divide them into different stability levels; perform different frequency detections on nodes at different levels and different stability levels, or do not perform real-time detection; and update the adjacency matrix and optimal path based on the exploration results. Abnormal node backtracking module: establishes a node anomaly propagation model, predicts abnormal nodes, and performs redundant verification on these nodes during the exploration process; for abnormal nodes determined after verification, deletes the corresponding elements of the abnormal nodes in the adjacency matrix, performs adaptive backtracking on the abnormal nodes, and recalculates the optimal path containing the abnormal nodes.

Images