Multi-modal adaptive routing device network optimization method based on artificial intelligence

Abstract

The invention belongs to the technical field of wireless communication networks, and discloses a multi-modal adaptive routing equipment network optimization method based on artificial intelligence, which comprises the following steps of: extracting network flow metadata in a data link layer by adopting deep packet inspection, and analyzing and predicting bandwidth requirements in n periods of time in the future based on a time sequence; planning channel resources by adopting a Nash equilibrium algorithm according to the bandwidth requirement, and generating a channel allocation instruction; synchronously acquiring multi-band channel state data, and constructing a three-dimensional radio frequency environment signal spectrum; analyzing the three-dimensional radio frequency environment signal spectrum, searching a frequency band combination with the minimum interference, and generating a frequency band switching instruction; integrating the channel allocation instruction and the frequency band switching instruction, generating a network QoS optimization strategy, and issuing the network QoS optimization strategy to the routing equipment for execution; and the network transmission efficiency, the security and the adaptive capacity of the routing equipment are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of wireless communication networks, and more particularly to a multi-modal adaptive routing device network optimization method based on artificial intelligence. Background Art

[0002] Patent publication number CN118301052A discloses a network routing optimization method, device, electronic device, and storage medium, belonging to the field of routing planning technology. The method obtains all network devices in the network, link data between network devices, and the weights corresponding to the link data, and constructs a network graph model based on the network devices, link data, and weights. The network graph model is pruned according to preset source nodes, preset target nodes, and weights to obtain a local network graph model. The local network graph model is then optimized for routing based on an ant colony algorithm to obtain a routing path. The present invention transforms the network routing problem into a graph problem and prunes the network graph model, which can reduce the scale of the network to be routed and reduce routing time. The ant colony algorithm is used to search and optimize routes in the local network graph model, further reducing search time, adapting to the needs of large-scale networks, and improving network performance and efficiency.

[0003] The existing AI-based multi-modal adaptive routing device network optimization methods have the following main problems:

[0004] Existing routing equipment may rely solely on shallow, rule-based traffic detection, making it difficult to analyze encrypted traffic, covert attacks, and complex protocol behaviors. The lack of comprehensive traffic metadata makes it difficult to accurately understand network traffic patterns, impacting optimized scheduling and security protection. Existing technologies may use fixed thresholds or static allocation strategies, failing to dynamically optimize based on historical traffic data and predicted bandwidth demand. Channel resources may be chronically unevenly distributed, leading to insufficient resources on some devices and wasted resources on others, causing channel conflicts and reduced throughput. Existing technologies may rely solely on local channel measurements, failing to comprehensively analyze interference conditions and bandwidth requirements in different areas. In high-density environments, it may be impossible to dynamically adjust weights to optimize channel selection, resulting in rigid channel switching, increased interference, and reduced network performance.

[0005] Existing technologies may still rely on rule-based intrusion detection systems, making them difficult to adapt to new threats and variant attacks. Failure to analyze traffic characteristics in real time leads to delayed attack detection and increased risk of network damage. Existing technologies may directly discard malicious traffic instead of directing it to an isolated environment for in-depth analysis. This results in a lack of attack signature data in the security system, making it unable to effectively adjust defense strategies and reducing subsequent proactive defense capabilities. Existing security systems may rely on centralized training, which requires collecting data from all devices and poses a risk of data privacy leakage. This results in low training efficiency and difficulty in updating models in real time. Defense capabilities are limited to a single point and lack global adaptability. Existing federated learning frameworks do not use encrypted gradient updates, which may leak sensitive data from local devices and increase privacy risks. Failure to enable strong authentication may result in key negotiation vulnerabilities, making traffic hijacking more likely.

[0006] In view of this, the present invention proposes a multi-modal adaptive routing device network optimization method based on artificial intelligence to solve the above problems. Summary of the Invention

[0007] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned objectives, the present invention provides the following technical solution: a multi-modal adaptive routing device network optimization method based on artificial intelligence, comprising:

[0008] S1. Use deep packet inspection to extract network traffic metadata at the data link layer and predict bandwidth demand over the next n time periods based on time series analysis. Use the Nash equilibrium algorithm to plan channel resources based on bandwidth demand and generate channel allocation instructions. Simultaneously collect multi-band channel status data to construct a three-dimensional RF environment signal map.

[0009] S2. Analyze the three-dimensional RF environment signal spectrum, find the frequency band combination with the least interference, and generate frequency band switching instructions; integrate channel allocation instructions and frequency band switching instructions, generate network QoS optimization policies, and send them to routing devices for execution;

[0010] S3. Deploy a 1D-CNN anomaly detection model at the data link layer to monitor network traffic feature data in real time after executing the network QoS optimization strategy. If abnormal attack behavior is detected, a virtual honeypot is triggered to introduce the attack traffic into an isolated environment, extract attack feature data, and readjust the network QoS optimization strategy.

[0011] S4. Distribute attack feature data to routing devices through the federated learning framework. Each routing device trains a local threat detection model based on local data, uses a gradient encryption aggregation algorithm to globally update the parameters of the local threat detection model, generates a joint defense model, and synchronizes it to each routing device.

[0012] Preferably, the method of extracting network traffic metadata at the data link layer using deep packet inspection includes:

[0013] A deep packet inspection engine is deployed at the data link layer. The original Ethernet frames are directly captured through the driver-level packet capture tool. By parsing the original Ethernet frame header, the network layer and transport layer data packets are extracted, and the application layer protocol is deeply analyzed to obtain network traffic metadata.

[0014] Preferably, the method for predicting bandwidth demand in the next n periods of time based on time series analysis includes:

[0015] The obtained network traffic metadata is cleaned and outliers are processed through clustering algorithms. The data is then segmented according to preset time intervals and data is aggregated within each time period to obtain network traffic feature data.

[0016] A multi-layer recurrent neural network is constructed, which includes input units, long short-term memory units, and output units. The network traffic feature data is used as the input data of the input unit, and the long short-term memory unit is used to capture the time series features in the network traffic feature data, and then the bandwidth demand in the next n time periods is predicted.

[0017] Preferably, the method for generating a channel allocation instruction includes:

[0018] A Nash equilibrium game model is constructed based on the strategies of the game participants. The strategies include: treating each channel in the router network as a game subject, with each game subject representing an independent channel; treating different channel resource allocation schemes as a set of strategies; building a Nash equilibrium game model, introducing historical traffic statistics as constraints in the Nash equilibrium game model, and constructing a utility function;

[0019] The predicted bandwidth demand for the next n periods of time is used as the input data of the Nash equilibrium game model. The strategy set of each game player is assigned probabilities to form an initial mixed strategy. For each game player, the best response strategy is solved while the strategies of other players are fixed. The best response algorithm is used to iteratively solve the problem and update the strategy distribution. The iteration is repeated until all game players reach a Nash equilibrium state. The best response strategies corresponding to all game players in the Nash equilibrium state are collected to obtain a mixed Nash equilibrium strategy. The mixed Nash equilibrium strategy is mapped to the actual channel resource allocation parameters to generate channel resource allocation instructions.

[0020] Preferably, the method for generating a three-dimensional radio frequency environment signal map includes:

[0021] Deploy RF sensors covering multiple frequency bands, use PTP for time synchronization, and collect raw multi-band channel data. Clean and denoise the collected raw multi-band channel data to obtain multi-band channel status data; multi-band channel status data includes signal strength, signal-to-noise ratio, and channel occupancy. Based on the spatial position of the deployed RF sensors, use interpolation to construct a continuous RF environment map in three-dimensional space, construct a signal strength function through inverse distance weighting, and fuse the obtained multi-band channel status data with the signal strength function through preset frequency band weight factors to obtain a unified three-dimensional RF environment signal map.

[0022] Preferably, the method for generating a frequency band switching instruction includes:

[0023] The three-dimensional RF environment signal map is separated into data layers to extract the signal strength layer, interference coefficient layer, and stability layer. Each data layer is assigned a frequency band number, spatial coordinates, and timestamp. An optimization weight is assigned to each data layer based on the predicted bandwidth demand over the next n time periods. A preset valid frequency band threshold is used to eliminate invalid frequency bands. If multiple frequency bands meet the valid frequency band threshold, the multi-objective optimization phase is entered. If no frequency band meets the valid frequency band threshold, the threshold is relaxed and the valid frequency bands are re-screened.

[0024] Based on the optimization weight of each data layer, a multi-optimization objective function is constructed, and a non-dominated sorting genetic algorithm is used to solve the Pareto optimal solution set, outputting the optimal frequency band combination that satisfies multiple objective balances. Conflict detection is performed on the optimal frequency band combination: if there is a conflict, the conflicting frequency band is eliminated and the optimal solution set is recalculated to obtain a new optimal frequency band combination. If there is no conflict, a frequency band switching instruction is generated based on the current optimal frequency band combination. After executing the frequency band switching instruction, if the cumulative number of switching failures exceeds the failure threshold, the multi-band channel status data is re-collected and the spectrum is reconstructed.

[0025] Preferably, the method of deploying a 1D-CNN anomaly detection model at the data link layer includes:

[0026] The 1D-CNN anomaly detection model consists of an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer. The network traffic feature data after executing the network QoS optimization strategy is used as the input data of the 1D-CNN anomaly detection model. The convolutional layer extracts local temporal features, and the pooling layer performs dimensionality reduction on the temporal features. The most significant local temporal features are captured and connected to the fully connected layer, and the anomaly probability is output through the softmax activation function.

[0027] Preferably, the method of triggering the virtual honeypot to introduce attack traffic into the isolated environment includes:

[0028] The output abnormal probability is compared with the preset abnormal probability threshold. If the output abnormal probability exceeds the preset abnormal probability threshold, the current traffic is determined to be attack traffic and abnormal attack behavior exists. An abnormal alarm signal is generated to automatically trigger the virtual honeypot module, and the attack traffic with abnormal attack behavior detected is marked at the data link layer. The marked traffic is redirected to an isolated virtual honeypot environment and diverted from the main network.

[0029] Preferably, the attack feature data includes protocol features, source IP distribution and data packet rate of the attack traffic.

[0030] Preferably, the method for obtaining the joint defense model includes:

[0031] Build a star topology of centralized coordination nodes and distributed routing devices, deploy secure communication tunnels, use TLS1.3 protocol to encrypt data transmission, implement a two-way identity authentication mechanism, and prevent malicious nodes from accessing the federal network; build a local training set based on the attack feature data captured by the virtual honeypot, add Gaussian noise to the local training set through differential privacy technology, use a deep learning architecture as the local threat detection model for iterative training, update the local threat detection model through backpropagation, and obtain a local gradient; use the Paillier homomorphic encryption algorithm to encrypt the local gradient to obtain an encrypted gradient; send the encrypted gradient to the centralized coordination node; the centralized coordination node securely aggregates the received encrypted gradient to obtain the securely aggregated gradient; the centralized coordination node updates the parameters of the joint defense model according to the securely aggregated gradient to obtain an updated joint defense model; synchronize the parameters of the updated joint defense model to each routing device to replace the local threat detection model.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] By deploying a deep packet inspection engine at the data link layer, the present invention can comprehensively extract network traffic metadata, covering basic information, protocol characteristics, traffic statistics, behavioral characteristics and other aspects, providing a rich and accurate data foundation for subsequent network optimization. Based on the Nash equilibrium algorithm to build a game model, taking into account historical traffic statistics and predicted bandwidth requirements, it can achieve dynamic optimal allocation of multiple channels, so that each network device can obtain appropriate channel resources at different time periods, improve the efficiency of channel utilization, reduce channel conflicts and resource waste. By constructing a three-dimensional radio frequency environment signal map and analyzing it, it is possible to find the frequency band combination with the least interference. Dynamically adjusting the weight according to the bandwidth requirements of different areas makes frequency band switching more flexible and intelligent, effectively reduces the impact of interference on network performance, and improves the stability and reliability of the network. Deploying a 1D-CNN anomaly detection model at the data link layer can monitor network traffic feature data in real time, quickly and accurately detect abnormal attack behavior, provide a guarantee for timely implementation of defensive measures, and reduce the damage caused by attacks to the network.

[0034] When attack traffic is detected, a virtual honeypot is triggered to introduce it into an isolated environment, preventing further damage to the main network. Attack signature data is also extracted, providing data support for subsequent defense strategy adjustments and model training. Using a federated learning framework, this attack signature data is distributed to each routing device. Each device trains a local threat detection model based on local data, and a gradient encryption aggregation algorithm is used to perform a global update to generate a joint defense model. This approach fully utilizes each device's local data, improving model accuracy and generalization, and enhancing the overall network's defense capabilities and system adaptability. A star-shaped topology is constructed, secure communication tunnels are deployed, and data transmission is encrypted using the TLS 1.3 protocol and a two-way authentication mechanism. This ensures data security and integrity during transmission, prevents malicious nodes from accessing the federated network, and securely protects the training and update processes of the joint defense model. This solution effectively addresses the problems of traditional routing devices, which rely on fixed rules, lack real-time awareness of terminal demand changes, lack in-depth behavioral analysis of encrypted traffic, and are difficult to defend against new APT attacks. Furthermore, the rigid multi-band switching strategy leads to increased channel contention in high-density scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a flow chart of a multi-modal adaptive routing device network optimization method based on artificial intelligence of the present invention;

[0036] Figure 2 This is a schematic diagram of the structure of the multi-modal adaptive routing device network optimization system based on artificial intelligence of the present invention;

[0037] Figure 3 This is a flowchart of the equipment network optimization technology route provided by the present invention. DETAILED DESCRIPTION

[0038] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0039] Example 1

[0040] See also Figure 1 and Figure 3 As shown, this embodiment 1 further illustrates the multi-modal adaptive routing device network optimization method based on artificial intelligence proposed by the present invention, including:

[0041] S1. Use deep packet inspection to extract network traffic metadata at the data link layer and predict bandwidth demand over the next n time periods based on time series analysis. Use the Nash equilibrium algorithm to plan channel resources based on bandwidth demand and generate channel allocation instructions. Simultaneously collect multi-band channel status data to construct a three-dimensional RF environment signal map.

[0042] S2. Analyze the three-dimensional RF environment signal spectrum, find the frequency band combination with the least interference, and generate frequency band switching instructions; integrate channel allocation instructions and frequency band switching instructions, generate network QoS optimization policies, and send them to routing devices for execution;

[0043] S3. Deploy a 1D-CNN anomaly detection model at the data link layer to monitor network traffic feature data in real time after executing the network QoS optimization strategy. If abnormal attack behavior is detected, a virtual honeypot is triggered to introduce the attack traffic into an isolated environment, extract attack feature data, and readjust the network QoS optimization strategy.

[0044] S4. Distribute attack feature data to routing devices through the federated learning framework. Each routing device trains a local threat detection model based on local data, uses a gradient encryption aggregation algorithm to globally update the parameters of the local threat detection model, generates a joint defense model, and synchronizes it to each routing device.

[0045] Methods for extracting network traffic metadata at the data link layer using deep packet inspection include:

[0046] A deep packet inspection engine is deployed at the data link layer (OSI layer 2, such as a router port). The original Ethernet frames are directly captured through driver-level packet capture tools (such as libpcap and DPDK). The network layer and transport layer packets are extracted by parsing the original Ethernet frame headers. The application layer protocol is then deeply analyzed to obtain network traffic metadata. Network traffic metadata includes basic information: source / destination MAC addresses, VLAN tags, frame lengths, and timestamps; protocol characteristics: application types (such as VoIP and video streams), protocol header fields (such as HTTP URLs and DNS queries); traffic statistics: packet size, throughput, session duration, and QoS tags (such as DSCP values); and behavioral characteristics: traffic burstiness, periodic patterns, and abnormal traffic flags (such as DDoS characteristics).

[0047] It should be noted that capturing network traffic metadata at the data link layer is like "unpacking a package" to capture data packets.

[0048] Core goal: Capture all data packets flowing through the device in real time at the data link layer, just like inspecting every package in a courier sorting center.

[0049] How to do it:

[0050] Deploy packet capture tools: Install software similar to "surveillance cameras" (such as libpcap and DPDK) at network edge nodes (network "entry / exit" points, such as router ports) to directly monitor all raw data packets entering and leaving the network (such as user devices to the Internet and cross-subnet communications);

[0051] Parsing data frames: Each original data packet is like a "courier box". Unpacking the outer packaging (Ethernet frame header) reveals the "sender / recipient information" (MAC address) and "courier number" (VLAN tag) inside.

[0052] Deeper disassembly: Continue to unpack the inner layer and extract information from the network layer (IP address, similar to "province, city, and district address") and transport layer (TCP / UDP port number, similar to "house number");

[0053] Identify content: Analyze application layer data, such as identifying whether it is web browsing (HTTP), video calling (such as the Zoom protocol), or file downloading (such as BitTorrent);

[0054] For example, if you are watching a video, the raw data packets are like trucks transporting the video clips to your phone. The role of deep packet inspection is to:

[0055] Check the origin (source MAC address) and destination (destination MAC address) of each truck (original data packet) to confirm that the truck is loaded with "video cargo" (identify protocol type), and record the size of the truck (data packet length) and arrival time (timestamp).

[0056] Methods for predicting bandwidth demand over the next n periods of time based on time series analysis include:

[0057] The obtained network traffic metadata is cleaned and outliers are processed using a clustering algorithm. The data is then segmented according to preset time intervals and data is aggregated within each time period. This means that the total traffic, traffic mean, traffic peak, traffic volatility, and average packet length within each time period are counted to obtain network traffic feature data.

[0058] A multi-layer recurrent neural network is constructed, which includes input units, long short-term memory units, and output units. The network traffic feature data is used as the input data of the input unit, and the long short-term memory unit is used to capture the time series features in the network traffic feature data, and then the bandwidth demand in the next n time periods is predicted.

[0059] The method for generating a channel allocation instruction includes:

[0060] A Nash equilibrium game model is constructed based on the strategies of the game participants. The strategies of the game participants include: treating each channel in the router network as a game subject, and each game subject represents an independent channel; treating different channel resource allocation schemes as a set of strategies, such as adjusting the power allocation level, selecting different scheduling time slots or frequency band combinations, which determine how each game subject allocates and uses channel resources under a certain power budget or time resource; constructing a Nash equilibrium game model, and introducing historical traffic statistics (reflecting the past load conditions of each channel) as a constraint condition in the Nash equilibrium game model, so that when the game subject selects the channel resource allocation scheme, it not only pays attention to the current predicted bandwidth demand, but also needs to consider the historical load to prevent channel overload or resource waste; constructing a utility function Where i is the index of the channel; The predicted bandwidth requirement for channel i; is the bandwidth actually allocated to channel i; is the square sum of the interference noise on channel i; The sum of the squares of the power required to allocate resources for channel i; ω1, ω2, and ω3 are weight coefficients;

[0061] The predicted bandwidth demand for the next n time periods is used as the input data of the Nash equilibrium game model. The strategy set of each game player is assigned probabilities to form an initial mixed strategy. For each game player, the best response strategy is solved while the strategies of other players are fixed. The best response algorithm is used to iteratively solve the problem and update the strategy distribution. Iterations are repeated until all game players reach a Nash equilibrium state, that is, no game player can improve its utility by adjusting its strategy alone. At this point, Nash equilibrium is reached. The best response strategies corresponding to all game players in the Nash equilibrium state are collected to obtain a mixed Nash equilibrium strategy. The mixed Nash equilibrium strategy is mapped to the actual channel resource allocation parameters to generate channel resource allocation instructions. These channel resource allocation instructions clearly define the channel resource allocation plan for each network device (router) in each time period, thereby achieving dynamic optimal allocation of multiple channels.

[0062] The method of three-dimensional radio frequency environment signal spectrum includes:

[0063] Deploy RF sensors covering multiple frequency bands, use PTP for time synchronization, and collect raw multi-band channel data. Clean and denoise the collected raw multi-band channel data to obtain multi-band channel status data; multi-band channel status data includes signal strength, signal-to-noise ratio, and channel occupancy. Based on the spatial position of the deployed RF sensors, use interpolation to construct a continuous RF environment map in three-dimensional space, construct a signal strength function through inverse distance weighting, and fuse the obtained multi-band channel status data with the signal strength function through preset frequency band weight factors to obtain a unified three-dimensional RF environment signal map.

[0064] The method of generating a frequency band switching instruction includes:

[0065] The 3D RF environment signal map is separated into data layers to extract the signal strength layer, interference coefficient layer, and stability layer. Each data layer is assigned a frequency band number, spatial coordinates, and timestamp. An optimization weight is assigned to each data layer based on the predicted bandwidth demand over the next n time periods. A preset valid frequency band threshold is used to eliminate invalid frequency bands. If multiple frequency bands meet the valid frequency band threshold, the multi-objective optimization phase is entered. If no frequency band meets the valid frequency band threshold, the threshold is relaxed (e.g., interference coefficient ≤ 0.4) and valid frequency bands are re-screened. The threshold is relaxed using a hierarchical relaxation strategy:

[0066] First level relaxation: interference coefficient ≤ 0.4, stability ≥ 0.6, RSSI ≥ -75dBm;

[0067] Level 2 relaxation: Interference coefficient ≤ 0.5, stability ≥ 0.5, RSSI ≥ -80dBm (emergency communications only). If there is still no valid frequency band after relaxation, the bandwidth-sacrificing connection protection mode is activated: the frequency band with the lowest interference coefficient is forcibly selected, the modulation order is reduced (such as switching to QPSK), and a channel resource alarm signal is sent to the network management terminal, suggesting expansion or adjustment of router deployment.

[0068] A multi-optimization objective function is constructed based on the optimization weight of each data layer, and a non-dominated sorting genetic algorithm is used to solve the Pareto optimal solution set, outputting the optimal frequency band combination that satisfies multiple objective balances. Conflict detection is performed on the optimal frequency band combination: checking whether the frequency bands meet the preset minimum frequency interval threshold (e.g., the 5GHz band requires a 20MHz interval), and verifying whether the spatial coverage overlap rate of the frequency bands within the optimal frequency band combination is less than or equal to 15% (to avoid signal conflicts in the same area). If there is a conflict, the conflicting frequency bands are eliminated and the optimal solution set is recalculated to obtain a new optimal frequency band combination. If there is no conflict, a frequency band switching instruction is generated based on the current optimal frequency band combination. After executing the frequency band switching instruction, if the cumulative number of switching failures exceeds the failure threshold (e.g., 3 times / hour), the multi-band channel status data is recollected and the spectrum is reconstructed.

[0069] In areas with high bandwidth requirements, priority is given to increasing signal strength weight (accounting for ≥60%); in areas with low bandwidth requirements, priority is given to reducing interference coefficient weight (accounting for ≥70%).

[0070] High bandwidth demand area determination criteria: bandwidth demand in the next n periods of time is greater than or equal to 150% of the current bandwidth utilization;

[0071] Typical scenarios: during video conferences in conference rooms; in areas with dense concentrations of IoT devices (such as sensor clusters in smart factories);

[0072] Allocation rules for high-bandwidth demand areas: signal strength weight is greater than or equal to 0.6, interference coefficient weight is less than or equal to 0.2, and stability weight is less than or equal to 0.2;

[0073] Logical basis: In high-bandwidth scenarios, signal coverage strength must be ensured (for example, to avoid video freezes), while mild interference can be tolerated appropriately. Stability is secondary.

[0074] Low-bandwidth demand area determination criteria: The bandwidth demand in the next n periods of time is less than or equal to 50% of the current bandwidth utilization, and there are no delay-sensitive services (such as background data synchronization only);

[0075] Typical scenarios: Nighttime office idle periods; Areas with sparse edge devices (such as warehouse environmental monitoring nodes);

[0076] Allocation rules for low bandwidth demand areas: signal strength weight is greater than or equal to 0.7, interference coefficient weight is less than or equal to 0.2, and stability weight is less than or equal to 0.1;

[0077] Logical basis: Low-bandwidth scenarios focus on interference suppression to avoid wasting spectrum resources while reducing the weight of signal strength and stability.

[0078] Every 5 minutes, based on the latest predicted bandwidth demand for the next n periods of time, periodic adjustments are made to the high-bandwidth demand areas and the low-bandwidth demand areas.

[0079] Methods for deploying the 1D-CNN anomaly detection model at the data link layer include:

[0080] The 1D-CNN anomaly detection model consists of an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer. The network traffic feature data after executing the network QoS optimization strategy is used as the input data of the 1D-CNN anomaly detection model. The convolutional layer extracts local temporal features, and the pooling layer performs dimensionality reduction on the temporal features. The most significant local temporal features are captured and connected to the fully connected layer, and the anomaly probability is output through the softmax activation function.

[0081] Methods for triggering the virtual honeypot to introduce attack traffic into the isolated environment include:

[0082] The output abnormal probability is compared with the preset abnormal probability threshold. If the output abnormal probability exceeds the preset abnormal probability threshold, the current traffic is determined to be attack traffic and abnormal attack behavior exists. An abnormal alarm signal is generated to automatically trigger the virtual honeypot module, and the attack traffic with abnormal attack behavior detected is marked at the data link layer. The marked traffic is redirected to an isolated virtual honeypot environment and diverted from the main network.

[0083] Attack signature data includes the protocol characteristics, source IP distribution, and packet rate of attack traffic.

[0084] The methods for obtaining the joint defense model include:

[0085] Build a star topology of centralized coordination nodes and distributed routing devices, deploy secure communication tunnels, use TLS1.3 protocol to encrypt data transmission, implement a two-way identity authentication mechanism, and prevent malicious nodes from accessing the federal network; build a local training set based on the attack feature data captured by the virtual honeypot, and use differential privacy technology to add Gaussian noise (noise ratio ≤ 5%) to the local training set to ensure that the original attack traffic cannot be reversed, use a deep learning architecture as the local threat detection model for iterative training, update the local threat detection model through back propagation, and obtain a local gradient; use the Paillier homomorphic encryption algorithm to encrypt the local gradient to obtain an encrypted gradient; send the encrypted gradient to the centralized coordination node; the centralized coordination node securely aggregates the received encrypted gradient to obtain the securely aggregated gradient; the centralized coordination node updates the parameters of the joint defense model based on the securely aggregated gradient to obtain an updated joint defense model; synchronize the parameters of the updated joint defense model to each routing device to replace the local threat detection model

[0086] The preset effective frequency band threshold is set by the staff based on the results of historical data analysis. The historical analysis process includes the system collecting the change rate of multiple data points and calculating their average value as a reference; similarly, the failure threshold and the preset abnormality probability threshold are set. These preset thresholds can be adjusted by the staff according to actual conditions during the system operation.

[0087] This embodiment, by deploying a deep packet inspection engine at the data link layer, can comprehensively extract network traffic metadata, covering basic information, protocol characteristics, traffic statistics, and behavioral characteristics, providing a rich and accurate data foundation for subsequent network optimization. Based on the Nash equilibrium algorithm, a game model is constructed, taking into account historical traffic statistics and predicted bandwidth requirements, and dynamic optimal allocation of multiple channels can be achieved, so that each network device can obtain appropriate channel resources at different times, improving channel utilization efficiency, reducing channel conflicts and resource waste. By constructing a three-dimensional RF environment signal map and analyzing it, the frequency band combination with the least interference can be found. Dynamically adjusting the weight according to the bandwidth requirements of different areas makes frequency band switching more flexible and intelligent, effectively reducing the impact of interference on network performance, and improving network stability and reliability. Deploying a 1D-CNN anomaly detection model at the data link layer can monitor network traffic feature data in real time, quickly and accurately detect abnormal attack behavior, provide a guarantee for timely implementation of defensive measures, and reduce the damage caused by attacks to the network.

[0088] When attack traffic is detected, a virtual honeypot is triggered to introduce it into an isolated environment, preventing further damage to the main network. Attack signature data is also extracted, providing data support for subsequent defense strategy adjustments and model training. Using a federated learning framework, this attack signature data is distributed to each routing device. Each device trains a local threat detection model based on local data, and a gradient encryption aggregation algorithm is used to perform a global update to generate a joint defense model. This approach fully utilizes each device's local data, improving model accuracy and generalization, and enhancing the overall network's defense capabilities and system adaptability. A star-shaped topology is constructed, secure communication tunnels are deployed, and data transmission is encrypted using the TLS 1.3 protocol and a two-way authentication mechanism. This ensures data security and integrity during transmission, prevents malicious nodes from accessing the federated network, and securely protects the training and update processes of the joint defense model. This solution effectively addresses the problems of traditional routing devices, which rely on fixed rules, lack real-time awareness of terminal demand changes, lack in-depth behavioral analysis of encrypted traffic, and are difficult to defend against new APT attacks. Furthermore, the rigid multi-band switching strategy leads to increased channel contention in high-density scenarios.

[0089] Example 2

[0090] See also Figure 2 As shown, for the parts not described in detail in this embodiment, please refer to the description of Example 1. A multi-modal adaptive routing device network optimization system based on artificial intelligence is provided, including:

[0091] The channel planning module uses deep packet inspection to extract network traffic metadata at the data link layer and predicts bandwidth demand over the next n time periods based on time series analysis. It also uses the Nash equilibrium algorithm to plan channel resources based on bandwidth demand and generates channel allocation instructions. It also simultaneously collects multi-band channel status data to construct a three-dimensional RF environment signal map.

[0092] The frequency band switching module analyzes the three-dimensional RF environment signal spectrum, finds the frequency band combination with the least interference, and generates frequency band switching instructions. It integrates channel allocation instructions and frequency band switching instructions to generate network QoS optimization policies and send them to routing devices for execution.

[0093] The security protection module deploys a 1D-CNN anomaly detection model at the data link layer to monitor network traffic feature data in real time after executing network QoS optimization policies. If abnormal attack behavior is detected, a virtual honeypot is triggered to introduce attack traffic into an isolated environment, extract attack feature data, and readjust the network QoS optimization policy.

[0094] The collaborative defense module distributes attack feature data to routing devices through a federated learning framework. Each routing device trains a local threat detection model based on local data, uses a gradient encryption aggregation algorithm to globally update the parameters of the local threat detection model, generates a joint defense model, and synchronizes it to each routing device.

[0095] Since the electronic device described in this embodiment is an electronic device used to implement the multimodal adaptive routing device network optimization method based on artificial intelligence in the embodiment of this application, based on the multimodal adaptive routing device network optimization method based on artificial intelligence described in the embodiment of this application, those skilled in the art will be able to understand the specific implementation of the electronic device of this embodiment and its various variations, so how the electronic device implements the method in the embodiment of this application will not be described in detail here. As long as those skilled in the art implement the electronic device used in the multimodal adaptive routing device network optimization method based on artificial intelligence in the embodiment of this application, it falls within the scope of protection of this application.

[0096] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters and thresholds in the formulas are set by technicians in this field according to actual conditions.

[0097] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiment. All technical solutions based on the concept of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A multi-modal adaptive routing device network optimization method based on artificial intelligence, characterized in that: include: S1. Use deep packet inspection to extract network traffic metadata at the data link layer and predict bandwidth demand in the next n time periods based on time series analysis. Use the Nash equilibrium algorithm to plan channel resources based on bandwidth demand and generate channel allocation instructions. Synchronously collect multi-band channel status data to build a three-dimensional RF environment signal map; S2. Analyze the three-dimensional RF environment signal spectrum, find the frequency band combination with the least interference, and generate frequency band switching instructions; integrate channel allocation instructions and frequency band switching instructions, generate network QoS optimization policies, and send them to routing devices for execution; S3. Deploy a 1D-CNN anomaly detection model at the data link layer to monitor network traffic feature data in real time after executing the network QoS optimization strategy. If abnormal attack behavior is detected, a virtual honeypot is triggered to introduce the attack traffic into an isolated environment, extract attack feature data, and readjust the network QoS optimization strategy. S4. Distribute attack feature data to routing devices through the federated learning framework. Each routing device trains a local threat detection model based on local data, uses a gradient encryption aggregation algorithm to globally update the parameters of the local threat detection model, generates a joint defense model, and synchronizes it to each routing device.

2. The method for optimizing a multi-modal adaptive routing device network based on artificial intelligence according to claim 1, wherein: The method for extracting network traffic metadata at the data link layer using deep packet inspection includes: A deep packet inspection engine is deployed at the data link layer. The original Ethernet frames are directly captured through the driver-level packet capture tool. By parsing the original Ethernet frame header, the network layer and transport layer data packets are extracted, and the application layer protocol is deeply analyzed to obtain network traffic metadata.

3. The method for optimizing a multi-modal adaptive routing device network based on artificial intelligence according to claim 2, wherein: The method for predicting bandwidth demand within n future time periods based on time series analysis includes: The obtained network traffic metadata is cleaned and outliers are processed through clustering algorithms. The data is then segmented according to preset time intervals and data is aggregated within each time period to obtain network traffic feature data. A multi-layer recurrent neural network is constructed, which includes input units, long short-term memory units, and output units. The network traffic feature data is used as the input data of the input unit, and the long short-term memory unit is used to capture the time series features in the network traffic feature data, and then the bandwidth demand in the next n time periods is predicted.

4. The method for optimizing a multi-modal adaptive routing device network based on artificial intelligence according to claim 3, wherein: The method for generating a channel allocation instruction comprises: A Nash equilibrium game model is constructed based on the strategies of the game participants. The strategies include: treating each channel in the router network as a game subject, with each game subject representing an independent channel; treating different channel resource allocation schemes as a set of strategies; building a Nash equilibrium game model, introducing historical traffic statistics as constraints in the Nash equilibrium game model, and constructing a utility function; The predicted bandwidth demand for the next n periods of time is used as the input data of the Nash equilibrium game model. The strategy set of each game player is assigned probabilities to form an initial mixed strategy. For each game player, the best response strategy is solved while the strategies of other players are fixed. The best response algorithm is used to iteratively solve the problem and update the strategy distribution. The iteration is repeated until all game players reach a Nash equilibrium state. The best response strategies corresponding to all game players in the Nash equilibrium state are collected to obtain a mixed Nash equilibrium strategy. The mixed Nash equilibrium strategy is mapped to the actual channel resource allocation parameters to generate channel resource allocation instructions.

5. The method for optimizing a multi-modal adaptive routing device network based on artificial intelligence according to claim 4, characterized in that: The method for mapping a three-dimensional radio frequency environment signal spectrum includes: Deploy RF sensors covering multiple frequency bands, use PTP for time synchronization, and collect raw multi-band channel data. Clean and denoise the collected raw multi-band channel data to obtain multi-band channel status data; multi-band channel status data includes signal strength, signal-to-noise ratio, and channel occupancy. Based on the spatial position of the deployed RF sensors, use interpolation to construct a continuous RF environment map in three-dimensional space, construct a signal strength function through inverse distance weighting, and fuse the obtained multi-band channel status data with the signal strength function through preset frequency band weight factors to obtain a unified three-dimensional RF environment signal map.

6. The method for optimizing a multi-modal adaptive routing device network based on artificial intelligence according to claim 5, characterized in that: The method for generating a frequency band switching instruction includes: The three-dimensional RF environment signal map is separated into data layers to extract the signal strength layer, interference coefficient layer, and stability layer. Each data layer is assigned a frequency band number, spatial coordinates, and timestamp. An optimization weight is assigned to each data layer based on the predicted bandwidth demand over the next n time periods. A preset valid frequency band threshold is used to eliminate invalid frequency bands. If multiple frequency bands meet the valid frequency band threshold, the multi-objective optimization phase is entered. If no frequency band meets the valid frequency band threshold, the threshold is relaxed and the valid frequency bands are re-screened. Based on the optimization weight of each data layer, a multi-optimization objective function is constructed, and a non-dominated sorting genetic algorithm is used to solve the Pareto optimal solution set, outputting the optimal frequency band combination that satisfies multiple objective balances. Conflict detection is performed on the optimal frequency band combination: if there is a conflict, the conflicting frequency band is eliminated and the optimal solution set is recalculated to obtain a new optimal frequency band combination. If there is no conflict, a frequency band switching instruction is generated based on the current optimal frequency band combination. After executing the frequency band switching instruction, if the cumulative number of switching failures exceeds the failure threshold, the multi-band channel status data is re-collected and the spectrum is reconstructed.

7. The method for optimizing a multi-modal adaptive routing device network based on artificial intelligence according to claim 6, wherein: The method for deploying a 1D-CNN anomaly detection model at the data link layer includes: The 1D-CNN anomaly detection model consists of an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer. The network traffic feature data after executing the network QoS optimization strategy is used as the input data of the 1D-CNN anomaly detection model. The convolutional layer extracts local temporal features, and the pooling layer performs dimensionality reduction on the temporal features. The most significant local temporal features are captured and connected to the fully connected layer, and the anomaly probability is output through the softmax activation function.

8. The method for optimizing a multi-modal adaptive routing device network based on artificial intelligence according to claim 7, wherein: The method of triggering the virtual honeypot to introduce attack traffic into the isolated environment includes: The output abnormal probability is compared with the preset abnormal probability threshold. If the output abnormal probability exceeds the preset abnormal probability threshold, the current traffic is determined to be attack traffic and abnormal attack behavior exists. An abnormal alarm signal is generated to automatically trigger the virtual honeypot module, and the attack traffic with abnormal attack behavior detected is marked at the data link layer. The marked traffic is redirected to an isolated virtual honeypot environment and diverted from the main network.

9. The method for optimizing a multi-modal adaptive routing device network based on artificial intelligence according to claim 8, characterized in that: The attack feature data includes protocol features, source IP distribution and data packet rate of the attack traffic.

10. The method for optimizing a multi-modal adaptive routing device network based on artificial intelligence according to claim 9, wherein: The method for obtaining the joint defense model includes: A star topology consisting of centralized coordination nodes and distributed routing devices was constructed, secure communication tunnels were deployed, and data transmission was encrypted using the TLS 1.3 protocol. This implemented a two-way authentication mechanism to prevent malicious nodes from accessing the federated network. A local training set was constructed based on attack signature data captured by a virtual honeypot. Gaussian noise was added to the local training set using differential privacy techniques. A deep learning architecture was used as the local threat detection model for iterative training. The local threat detection model was updated through backpropagation to obtain a local gradient. The local gradient was encrypted using the Paillier homomorphic encryption algorithm to obtain the encrypted gradient. The encrypted gradient is sent to the centralized coordination node; the centralized coordination node securely aggregates the received encrypted gradient to obtain the securely aggregated gradient; the centralized coordination node updates the parameters of the joint defense model based on the securely aggregated gradient to obtain the updated joint defense model; the parameters of the updated joint defense model are synchronized to each routing device to replace the local threat detection model.

Images