Data acquisition and evaluation method for digital twin network
By building a digital twin network environment and adopting digital twin network management software and naive Bayesian classifier, the access restriction and resource consumption problems of network data collection and evaluation are solved, and safe, controllable and efficient data collection and evaluation effects are achieved.
Patent Information
- Application Number
- CN202410432143.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-04-11
- Publication Date
- 2025-10-21
AI Technical Summary
Existing network data collection methods have access restrictions and network security issues, and network evaluation methods require a lot of resources and time, making it difficult to achieve efficient and secure data collection and evaluation.
Build a digital twin network environment, design digital twin network management software, virtual switches, virtual devices, network mirror data collection and analysis terminals, and evaluation and analysis centers, and use visual network topology planning, multi-threaded parallel technology, and naive Bayesian classifiers to achieve secure, controllable, and efficient data collection and evaluation.
Simulating the actual network in a virtual environment enables safe, controllable and efficient data collection and evaluation, making up for the shortcomings of the physical network and providing a new research method.
Smart Images
Figure FT_1 
Figure FT_2 
Figure FT_3
Abstract
Description
Technical Field
[0001] The present invention relates to data acquisition and evaluation technology, and in particular to a data acquisition and evaluation method for digital twin networks. Background Art
[0002] Digital twins are a multidisciplinary, multi-physics, multi-scale, and high-probability simulation process that maximizes the utilization of existing theoretical models, physical models, sensor information, historical data, and other data. With the development of intelligent manufacturing technology, a large number of researchers have begun to study the data transmission and interaction between virtual objects and physical objects in virtual information spaces. Consequently, research on digital twins has become increasingly prominent, and researchers have begun to attach importance to the study of digital twins and attempt to apply digital twins to various fields. This includes modeling communication networks to form digital twin communication devices, and then constructing networks based on these devices, thus giving rise to digital twin networks.
[0003] Network data collection refers to the process of collecting relevant data from the internet using computer programs, tools, or other means. This data can include data, images, text, audio, and other forms of information. Network data collection plays a variety of roles in network assessment, such as network performance evaluation, user behavior analysis, and security vulnerability assessment. Future developments in network data collection are likely to move toward intelligent automation, distributed collection, multimodal extraction, and real-time data collection.
[0004] Network assessment is the process of comprehensively analyzing and evaluating the performance of a communication network, including metrics such as bandwidth, latency, and packet loss. Its purpose is to ensure the stability of communication services and improve communication quality to meet user needs. In the future, network assessment will focus more on communication traffic evaluation and the application of emerging technologies.
[0005] A complex communications network refers to a highly complex communications infrastructure consisting of a large number of interconnected devices, nodes, and systems. Its role is to support a variety of communications services and applications, including dedicated communications, mobile communications, and cloud computing, providing an efficient and reliable information communication platform under complex communication conditions.
[0006] Common methods for network data collection, such as packet capture, sensors, and web crawlers, can provide more accurate and comprehensive information, but they have disadvantages such as access restrictions and network security that make collection difficult. On the other hand, common network evaluation methods such as performance testing and anomaly testing are more comprehensive, but require a lot of resources and a long time. In response to the above problems, this patent proposes a data collection and evaluation method for digital twin networks. This method overcomes the limitations of actual physical network collection by constructing a digital twin network environment, and realizes a safe, controllable, and efficient research environment. It provides a new way for network data collection and evaluation, which can make up for the shortcomings of actual physical network data collection and evaluation. Summary of the Invention
[0007] In response to the problems raised in the background technology, the present invention discloses a data collection and evaluation method for digital twin networks, designs a data collection and evaluation system for digital twin networks, and designs digital twin network management software, virtual switches, virtual devices, network mirror data collection and analysis terminals, and network mirror data evaluation and analysis centers in the digital twin network data collection and evaluation system.
[0008] The digital twin network management software includes a network planning module, a network creation module, and a network monitoring module. It serves as a full-lifecycle management platform for orchestrating and deploying virtual devices, virtual switches, and network mirror data collection and analysis terminals to servers. The network planning module utilizes visual network topology planning technology, providing an interface where the connection relationships between virtual devices can be drawn and the parameters of each virtual device can be edited. The network creation module utilizes multi-threaded parallel computer technology to create each virtual device in parallel. The number of virtual devices created simultaneously is a system parameter value, and manual configuration changes are supported. During network creation, all virtual devices are indirectly connected using independent virtual switches. All virtual switches are configured with a one-to-one network mirror data collection and analysis terminal. The network monitoring module collects the operating status of devices, virtual switches, and network mirror data collection and analysis terminals, providing a management interface for status display and content adjustment.
[0009] The virtual switch provides virtual interface connection, data forwarding, Quality of Service (QoS), and network mirroring. Virtual interface connection provides multiple virtual network interfaces, each of which connects to a virtual device or a network mirroring data collection and analysis terminal to implement data communication channels. Data forwarding transfers data input from a virtual device through a virtual interface to other virtual devices via other virtual interfaces. QoS controls the speed and bandwidth of data forwarding on the virtual switch. Network mirroring replicates data forwarded by the data forwarding function to form mirrored data, which is then forwarded to the network mirroring data collection and analysis terminal.
[0010] The virtual switch provides four virtual interfaces. Two virtual interfaces connect to two virtual devices, and the remaining two virtual interfaces connect to two different virtual interfaces of the network mirroring data collection and analysis terminal. The two interfaces connected to the network mirroring data collection and analysis terminal each complete the mirroring transmission of data input by a virtual device.
[0011] Virtual devices are used to simulate switching, transmission, and terminal devices in complex communication networks, and use virtual network interfaces to simulate the air interfaces and wired interfaces of real devices.
[0012] The network image data collection and analysis terminal and the network image data evaluation and analysis center adopt a server / client mode and a distributed architecture, wherein the network image data collection and analysis terminal is the client and the network image data evaluation and analysis center is the server.
[0013] The network image data collection and analysis terminal has three virtual network interfaces. One virtual interface is bridged to the virtual interface of the network image data evaluation and analysis center, and the other two virtual interfaces are bridged to the two virtual interfaces of the directly connected virtual switch. Each network image data collection and analysis terminal is connected to the network image data evaluation and analysis center.
[0014] The network image data collection and analysis terminal consists of a preprocessing module, an interaction module, a classification module, and a statistics module. The preprocessing module primarily processes traffic data, eliminating incomplete or problematic traffic data. The interaction module interacts with the network image data evaluation and analysis center, uploading the terminal's classification and statistics results to the center. The center then distributes training data sets with classification strategies to the network image data collection and analysis terminal. Each terminal then classifies the collected traffic data based on the distributed training data sets.
[0015] Classification module of the network mirror data collection and analysis terminal: The core of this module is to build a naive Bayes classifier and classify network traffic based on the training data set issued by the network mirror data evaluation and analysis center.
[0016] The Naive Bayesian Classifier is a probabilistic classification algorithm based on Bayes' theorem. Its characteristics are simple principles and efficient classification. The Bayesian theorem formula is as follows:
[0017]
[0018] Among them, p(c i |x) is the posterior probability, indicating that the known sample x belongs to category c i The probability of p(c i ) is the prior probability; p(x|c) is the conditional probability; and p(x) is the likelihood probability.
[0019] Assume that the training set in the sample is D,D ci For the category c in the training set D i Since the training process of the Naive Bayes classifier is based on the training set D to calculate the prior probability. Therefore, p(c i )The formula is as follows:
[0020]
[0021] However, the conditional probability p(x|c i ) is the joint probability of all attributes, which is difficult to calculate directly from limited training samples. To avoid this obstacle, the naive Bayes classifier adopts the "attribute conditional independence assumption". This assumption assumes that all attributes in the sample have the same independent impact on the classification result. Therefore, p(x|c i )The formula is as follows:
[0022]
[0023] Where n is the number of attributes in the sample.
[0024] However, in actual classification, it is difficult for actual samples to satisfy the "attribute conditional independence assumption". Therefore, in order to weaken the impact of this assumption on the classification results, this paper introduces a weighted naive Bayes classifier, which is expressed as follows:
[0025]
[0026] Among them, w(j) is the weight of the j-th attribute in sample x, which is used to indicate the importance of this attribute on the classification result, and its value is between 0 and 1.
[0027] In this invention, the weight w(j) is solved by using the CRITIC weighting method, which is an objective weighting method based on data volatility. Its core lies in two indicators: volatility and conflict.
[0028] Assume that there are m data in the sample, and each data has n attributes. First, preprocess and normalize the sample data to obtain the data matrix X:
[0029]
[0030] The formula for calculating volatility is as follows:
[0031]
[0032] in, For each indicator, that is, the data mean of each attribute.
[0033] The calculation formula for conflict is as follows:
[0034]
[0035] Among them, r ij It represents the correlation coefficient between the i-th indicator and the j-th indicator, and its formula is:
[0036]
[0037] The calculation formula of information volume is as follows:
[0038] C j =S j ×A j
[0039] After calculating the amount of information, we can get the weight of each attribute. The calculation formula is as follows:
[0040]
[0041] The Naive Bayes classifier estimates the posterior probability that a sample belongs to a certain category by calculating the prior probability of the given category and the conditional probability of each feature under the given category. Its working principle can be simply summarized as follows: for a given input sample, the probability of it belonging to each category is calculated, and then the category with the highest probability is selected as the output, which is the calculated classification result.
[0042] The network traffic is a sample with multiple characteristic values. The network traffic data mainly includes the following contents:
[0043] Address information: source IP address and destination IP address;
[0044] Port information: source port number and destination port number;
[0045] Protocol information: protocol;
[0046] Other information: number of bytes from source address to destination address, number of packets, number of flows, number of lost bytes, lifetime, and data information.
[0047] The classification module of the network image data collection and analysis terminal classifies traffic data according to a specific strategy to generate analysis results for each traffic data entry. This strategy is determined by the training dataset distributed by the Network Image Data Evaluation and Analysis Center. Compared to network traffic samples, the data in the training dataset has an additional category. This category serves as the classification strategy. For example, if the training dataset samples include categories such as normal traffic and abnormal traffic, the classification module will classify the traffic data uploaded by the terminal into normal traffic and abnormal traffic. If other classification categories are set, classification will be performed according to the set categories.
[0048] The statistics module of the network mirror data collection and analysis terminal collects traffic statistics based on the classification results. It also supports the function of setting characteristic field statistics, such as the amount of traffic data coming from a certain port, the amount of traffic data sent to a certain port, and the amount of traffic data using a certain network protocol.
[0049] The network image data evaluation and analysis center primarily consists of a data management module, a display module, and an interaction module. The data management module's primary function is data management, including basic addition, deletion, modification, and query operations on traffic data, as well as the import of external datasets. Since the classification module uses a naive Bayesian classifier, a machine learning framework, to classify traffic data, this process requires a certain number of training sets. Therefore, importing the corresponding dataset from an external source to construct the naive Bayesian classifier is essential. In addition to the feature values, each sample in the imported training dataset also has a class label. In the classification module of the network image data collection and analysis terminal, the constructed naive Bayesian classifier classifies samples based on the class labels in the training dataset. The display module's primary function is to display the statistical analysis results of the network image data collection and analysis terminal. The interaction module primarily interacts with the network image data collection and analysis terminal, receiving data reported by each terminal and also distributing training datasets to each terminal.
[0050] The process of network traffic collection, evaluation and analysis is as follows:
[0051] Step 1: Import the pre-prepared training set data into the data management module of the network image data evaluation and analysis center, and distribute it to each network image data collection and analysis terminal through the interactive module;
[0052] Step 2: The network mirror data collection and analysis terminal will first pre-process the traffic data to form processed traffic data;
[0053] Step 3: The classification module of the network image data collection and analysis terminal will classify the traffic data collected in step 2 according to the training data set issued by the network image data evaluation and analysis center;
[0054] Step 4: The statistics module of the network image data collection and analysis terminal will collect statistics on the results of the previous classification according to the set strategy. If the network image data evaluation and analysis center has issued a specific field statistics function, network traffic statistics for the specific field will be carried out simultaneously;
[0055] Step 5: The interactive module of the network image data collection and analysis terminal will upload the terminal classification and statistical results to the network image data evaluation and analysis center;
[0056] Step 6: The image data evaluation and analysis center displays the results uploaded by each network image data collection and analysis terminal in the display module.
[0057] The beneficial technical effect of the present invention is: a digital virtual environment consistent with the actual network is established in a digital twin network-oriented manner. By constructing an acquisition terminal in the virtual environment and designing data transmission, replication, acquisition, analysis and other processes, the simulation of the actual network is completed, and the data collection and analysis are completed, achieving the same effect as the actual communication network data collection and evaluation, meeting the collection and evaluation needs, and realizing a safe, controllable and efficient virtual environment research test field, providing a new way for network data collection and evaluation, which can make up for the shortcomings of actual physical network data collection and evaluation. BRIEF DESCRIPTION OF THE DRAWINGS
[0058] The drawings described herein are used to provide further understanding of the present invention and constitute a part of this application. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.
[0059] Attachment Figure 1 、 one Schematic diagram of data transmission relationship of a data acquisition and evaluation method for digital twin networks;
[0060] Attachment Figure 2 、 one A data transfer step diagram of a data acquisition and evaluation method for digital twin networks;
[0061] Attachment Figure 3 、 one Schematic diagram of a virtual network link construction method for data collection and evaluation methods for digital twin networks;
[0062] Attachment Figure 4 、 oneA schematic diagram of the relationship between the network mirror data evaluation and analysis center and the terminal in a data collection and evaluation method for digital twin networks;
[0063] Attachment Figure 5 、 one Internal module diagram of a network mirror data acquisition and analysis terminal for a data acquisition and evaluation method for digital twin networks;
[0064] Attachment Figure 6 、 one Internal module diagram of a network mirror data evaluation and analysis center for a data collection and evaluation method for digital twin networks;
[0065] Attachment Figure 7 、 one A classification flowchart of a data collection and evaluation method for digital twin networks;
[0066] Attachment Figure 8 、 one Schematic diagram of network traffic samples for a data collection and evaluation method for digital twin networks;
[0067] Attachment Figure 9 、 one Information diagram of training datasets for a data collection and evaluation method for digital twin networks. DETAILED DESCRIPTION
[0068] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.
[0069] A data collection and evaluation system for digital twin networks is designed. Digital twin network management software, virtual switches, virtual devices, network mirror data collection and analysis terminals, and network mirror data evaluation and analysis centers are designed in the digital twin network data collection and evaluation system.
[0070] See attached Figure 1As shown, this embodiment provides a data transmission relationship diagram for a data collection and evaluation method for a digital twin network. Virtual device A and virtual device B are both connected through a virtual network interface and a virtual network interface of a virtual switch, and transmit business data to the virtual switch and receive business data from the virtual switch. The virtual switch forwards the data input from virtual device A to virtual device B, and copies the data into a mirror image and forwards it to the network mirror data collection and analysis terminal. The virtual switch forwards the data input from virtual device B to virtual device A, and copies the data into a mirror image and forwards it to the network mirror data collection and analysis terminal. The virtual switch also forwards the mirror data of virtual devices A and virtual devices B through two different virtual network interfaces to two different virtual network interfaces of the network mirror data collection and analysis terminal. In this way, resource isolation is achieved and efficiency is improved.
[0071] See attached Figure 2 As shown, this embodiment provides a data transmission step diagram of a data collection and evaluation method for a digital twin network, which is as follows:
[0072] Step 1: The virtual device transmits service data to the virtual switch;
[0073] Step 2: The virtual switch forwards the data transmitted by the virtual device to other virtual devices connected to the virtual machine.
[0074] Step 3: The virtual machine copies the data sent in step 2 into mirror data and forwards the mirror data to the network mirror data collection terminal.
[0075] See attached Figure 3 As shown, this embodiment provides a schematic diagram of a virtual network link construction method for a data collection and evaluation method for a digital twin network. Virtual devices are connected through virtual switches. Virtual switches cannot directly skip virtual switches for communication. Each group of virtual devices is connected to virtual devices using different virtual switches. The virtual switch is connected to a network mirror data collection and analysis terminal. The virtual switch and the network mirror data collection and analysis terminal are deployed in a 1:1 configuration.
[0076] See attached Figure 4 As shown in FIG, this embodiment provides a schematic diagram of the relationship between a network image data evaluation and analysis center and terminals for a data collection and evaluation method for a digital twin network. The network image data evaluation and analysis center and the network image data collection and analysis terminals use a server / client software design architecture, supporting communication between multiple network image data collection and analysis terminals and the network image data evaluation center.
[0077] See attached Figure 5As shown, this embodiment provides an internal module diagram of a network mirror data collection and analysis terminal for a data collection and evaluation method for a digital twin network. The network mirror data collection and analysis terminal consists of a preprocessing module, an interaction module, a classification module, and a statistics module. The preprocessing module mainly functions to preprocess traffic data and eliminate incomplete or problematic traffic data. The interaction module mainly functions to interact with the network mirror data evaluation and analysis center and upload the terminal classification and statistics results to the network mirror data evaluation and analysis center. The network mirror data evaluation and analysis center then sends the training set data with the classification strategy to the network mirror data collection and analysis terminal. Each terminal classifies the collected traffic data based on the sent training data set. The core of the classification module is to construct a naive Bayes classifier and classify network traffic based on the training data set sent by the network mirror data evaluation and analysis center.
[0078] See attached Figure 6 As shown, this embodiment provides an internal module diagram of a network mirror data evaluation and analysis center for a data collection and evaluation method for digital twin networks. The network mirror data evaluation and analysis center primarily includes a data management module, a display module, and an interaction module. The data management module's primary function is data management, including basic addition, deletion, modification, and query operations on traffic data, as well as the import of external datasets. Since the classification module uses a naive Bayesian classifier from the field of machine learning to classify traffic data, this process requires a certain number of training sets. Therefore, it is necessary to import the corresponding dataset from an external source to construct the naive Bayesian classifier. In addition to the feature value, each sample in the imported training dataset also has a category label. In the classification module of the network mirror data collection and analysis terminal, the constructed naive Bayesian classifier is classified according to the category label in the training dataset. The display module's primary function is to display the statistical analysis results of the network mirror data collection and analysis terminal. The interaction module primarily interacts with the network mirror data collection and analysis terminal, receiving data reported by each terminal and also distributing training datasets to each terminal.
[0079] See attached Figure 7 As shown, this embodiment provides a classification flow chart of a data collection and evaluation method for a digital twin network, which is as follows:
[0080] Step 1: Classification begins;
[0081] Step 2: The network image data evaluation and analysis center imports the data set and sends it to the network image data collection and analysis terminal;
[0082] Step 3: Collect and analyze terminal evaluation data from network mirror data and calculate prior probability;
[0083] Step 4: Collect and analyze terminal evaluation data from network mirror data and calculate the maximum a posteriori probability;
[0084] Step 5: The network mirror data collection and analysis terminal evaluates the data and determines whether the data classification is complete;
[0085] Step 6: After the classification is completed, the classification results are output.
[0086] See attached Figure 8 As shown, this embodiment provides a network traffic sample diagram of a data collection and evaluation method for a digital twin network. The network traffic data mainly includes the following contents:
[0087] Address information: source IP address and destination IP address;
[0088] Port information: source port number and destination port number;
[0089] Protocol information: protocol;
[0090] Other information: number of bytes from source address to destination address, number of packets, number of flows, number of lost bytes, lifetime, and data information.
[0091] See attached Figure 9 As shown, this embodiment provides a training data set information diagram of a data collection and evaluation method for a digital twin network. The training data set consists of multiple data samples, and each data sample is a network traffic sample.
Claims
1. A data collection and evaluation method for digital twin networks, characterized in that: The system comprises a data collection and evaluation system for digital twin networks, which includes digital twin network management software, virtual switches, virtual devices, network mirror data collection and analysis terminals, and network mirror data evaluation and analysis centers. The digital twin network management software includes a network planning module, a network creation module, and a network monitoring module. The digital twin network management software is a full life cycle management platform that orchestrates and deploys virtual devices, virtual switches, and network mirror data acquisition and analysis terminals to servers; the network planning module of the digital twin network management software adopts visual network topology planning technology to provide an interface on which the connection relationship between each virtual device can be drawn and the parameters of each virtual device can be edited; the network creation module of the digital twin network management software adopts computer multi-threaded parallel technology to create each virtual device in parallel, and the number of virtual devices created at the same time is the parameter value of the system, supporting manual configuration changes; the network monitoring module collects the operating status of the equipment, virtual switches, and network mirror data acquisition and analysis terminals, and provides a management interface for status display and content adjustment; The virtual switch provides virtual interface connection, data forwarding, QOS and network mirroring functions. The virtual interface connection provides multiple virtual network interfaces, each of which is connected to a virtual device or a network mirroring data acquisition and analysis terminal to realize a data communication channel. The data forwarding function is to transfer the data input from the virtual device from the virtual interface to other virtual devices through other virtual interfaces. The QOS function is to control the speed and bandwidth of the virtual switch forwarding data. The network mirroring is to copy the data forwarded by the data forwarding function to form mirror data, and forward the mirror data to the network mirroring data acquisition and analysis terminal. The virtual device is used to simulate the switching, transmission and terminal devices of a complex communication network, and uses a virtual network interface to simulate the air interface and wired interface of a real device; The network image data collection and analysis terminal and the network image data evaluation and analysis center adopt a server / client mode and a distributed architecture, wherein the network image data collection and analysis terminal is the client and the network image data evaluation and analysis center is the server.
2. A data collection and evaluation method for digital twin networks according to claim 1, characterized in that: When the network creation module of the digital twin network management software is created, all virtual devices are indirectly interconnected using independent virtual switches, and all virtual switches are configured with a 1:1 network mirror data collection and analysis terminal interconnection.
3. The data collection and evaluation method for digital twin networks according to claim 1, characterized in that: The network mirror data collection and analysis terminal has three virtual network interfaces. One virtual interface is bridged with the virtual interface of the network mirror data evaluation and analysis center, and the other two virtual interfaces are bridged with the two virtual interfaces of the directly connected virtual switch respectively. Each network mirror data collection and analysis terminal is connected to the network mirror data evaluation and analysis center.
4. The data collection and evaluation method for digital twin networks according to claim 1, characterized in that: The network mirror data collection and analysis terminal consists of a preprocessing module, an interaction module, a classification module, and a statistics module; the preprocessing module is used to preprocess the traffic data and eliminate incomplete or problematic traffic data; the interaction module is used to interact with the network mirror data evaluation and analysis center and upload the terminal classification and statistics results to the network mirror data evaluation and analysis center. The network mirror data evaluation and analysis center will send the training set data with the classification strategy to the network mirror data collection and analysis terminal. Each terminal will classify the collected traffic data according to the sent training data set.
5. The data collection and evaluation method for digital twin networks according to claim 1, characterized in that: Classification module of the network mirror data collection and analysis terminal: The core of this module is to build a naive Bayes classifier and classify network traffic based on the training data set issued by the network mirror data evaluation and analysis center.
6. The data collection and evaluation method for digital twin networks according to claim 1, characterized in that: The network image data evaluation and analysis center includes a data management module, a display module, and an interaction module. The data management module manages data, including basic addition, deletion, modification, and query of traffic data, as well as the import of external data sets. Display module, which is used to display the statistical analysis results of the network mirror data collection and analysis terminal; The interactive module interacts with the network mirror data collection and analysis terminal to receive data reported by each terminal and can also send training data sets to each terminal.
7. The data collection and evaluation method for digital twin networks according to claim 1, characterized in that: The virtual switch provides four virtual interfaces. Two virtual interfaces connect to two virtual devices, and the remaining two virtual interfaces connect to two different virtual interfaces of the network mirroring data collection and analysis terminal. The two interfaces connected to the network mirroring data collection and analysis terminal each mirror the data input by one virtual device.
8. The data collection and evaluation method for digital twin networks according to claim 1, characterized in that: The process of network traffic collection, evaluation and analysis is as follows: Step 1: Import the pre-prepared training set data into the data management module of the network image data evaluation and analysis center, and distribute it to each network image data collection and analysis terminal through the interactive module; Step 2: The network mirror data collection and analysis terminal will first pre-process the traffic data to form processed traffic data; Step 3: The classification module of the network image data collection and analysis terminal will classify the traffic data collected in step 2 according to the training data set issued by the network image data evaluation and analysis center; Step 4: The statistics module of the network image data collection and analysis terminal will perform statistics based on the classification results of the previous step. If the network image data evaluation and analysis center has issued a specific field statistics function, network traffic statistics for the specific field will be performed simultaneously. Step 5: The interactive module of the network image data collection and analysis terminal will upload the terminal classification and statistical results to the network image data evaluation and analysis center; Step 6: The image data evaluation and analysis center displays the results uploaded by each network image data collection and analysis terminal in the display module.