Intelligent load balancing method and system based on multipath fusion

Abstract

The invention discloses an intelligent load balancing method and system based on multipath fusion, and relates to the field of network load balancing. A distributed monitoring system is constructed to collect network performance indexes, and a Transform model is used to predict traffic; a hierarchical reinforcement learning architecture is adopted, a global strategy is generated according to a macroscopic network state, and flow distribution is optimized for a single path; kalman filtering and particle filtering are automatically switched according to the path stability; the flow is flexibly migrated based on a genetic algorithm; an index weight is calculated by using a Shapley value method and an entropy weight method, and path quality is evaluated; the distribution strategy is executed through the SDN controller, and the overall performance of the network is improved. According to the invention, network abnormity is quickly responded, the traffic migration efficiency is improved, and bandwidth waste is reduced; service differentiation scheduling is supported, the service quality is guaranteed, and the attack defense capability is enhanced; operation and maintenance efficiency is improved, fault positioning time is shortened, and efficient utilization of network resources and guarantee of service quality are realized.

Description

Technical Field

[0001] This invention relates to the field of network load balancing technology, and in particular to an intelligent load balancing method and system based on multi-path fusion. Background Technology

[0002] With the rapid development of technologies such as cloud computing, the Internet of Things, and 5G, network traffic is experiencing explosive growth and increasingly complex business types, placing higher demands on network load balancing technology. Traditional load balancing methods, such as round-robin and hash algorithms, allocate traffic based on simple rules and are difficult to adapt to dynamically changing network environments. For example, the round-robin algorithm distributes traffic evenly across paths without considering the actual load and performance differences of links, which can easily lead to some links being overloaded while others are idle, resulting in wasted resources. The hash algorithm allocates paths based on packet characteristics and cannot dynamically adjust when links fail or become congested, affecting business continuity.

[0003] While static weight-based load balancing strategies can pre-set traffic allocation ratios based on metrics such as link bandwidth and latency, they cannot cope with real-time changes in network conditions. In real-world networks, link performance fluctuates frequently due to factors such as user behavior, equipment failures, and network attacks, making it difficult for static strategies to guarantee service quality. Furthermore, traditional methods lack the ability to perceive service priorities when handling mixed traffic, failing to meet the stringent requirements of real-time services (such as video conferencing and online games) for low latency and high reliability, often resulting in issues like stuttering and packet loss.

[0004] In recent years, machine learning-based load balancing technologies have gradually emerged, but limitations still exist. For example, deep learning-based traffic prediction models struggle to effectively integrate temporal and spatial features, resulting in insufficient prediction accuracy for sudden traffic spikes. Reinforcement learning methods are prone to getting trapped in local optima in complex network environments, and their decision-making processes do not fully consider differentiated business needs and network fairness. Furthermore, existing solutions generally lack the ability to quickly respond to and adaptively handle network anomalies (such as DDoS attacks and link failures), failing to achieve efficient utilization of network resources and stable service quality assurance. Summary of the Invention

[0005] The present invention proposes an intelligent load balancing method and system based on multi-path fusion to solve the problems mentioned in the prior art.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: an intelligent load balancing method and system based on multi-path fusion, comprising: Heterogeneous network monitoring and data acquisition steps: Construct a distributed monitoring system for the entire network and obtain a global view of the network topology through an SDN controller; deploy probes on path nodes and use multi-threaded parallel acquisition technology to obtain multi-dimensional performance indicators; use sliding window technology to quantify path stability and assist in allocation decisions; Spatiotemporal fusion traffic prediction steps: Build a traffic prediction model based on the Transformer architecture and integrate spatiotemporal analysis capabilities; design multiple channels to process historical traffic data sequences, time codes, and business type labels; capture traffic feature correlations through a multi-head attention mechanism and output time-segmented traffic prediction values; The hierarchical reinforcement learning strategy optimization steps are as follows: a two-layer optimization architecture is designed for collaborative decision-making. The upper layer determines the global policy based on the macro-network state through a deep Q-network, while the lower layer optimizes the allocation for single paths by using a dual deep Q-network combined with a competitive network structure. The reward function balances the objective by adjusting the weight coefficients and introduces the Jain fairness index to calculate the fairness factor. Adaptive filtering data processing steps: The path performance data is processed using a hybrid algorithm of Kalman and particle filtering. The filtering strategy is switched between Mahalanobis distance and path stability. The sequential importance resampling algorithm is used in the particle filtering stage. Elastic traffic migration steps: A traffic migration optimization model is built based on a genetic algorithm, and a pre-allocation threshold and a fallback threshold are set. When the main path load exceeds the threshold, the pre-migration process is started. During the migration process, packet marking and hash-based traffic splitting technology are used. When the main path load falls back to the fallback threshold, the traffic fallback mechanism is triggered. Dynamic weight evaluation steps: Combine the Shapley value method and the entropy weight method to calculate the dynamic weight of performance indicators, and use a balancing coefficient to integrate the advantages of the two methods to generate a dynamic weight vector; use a weighted summation method to score path quality, and calculate the comprehensive score of performance indicators after normalization.

[0007] Furthermore, it also includes: Improved location coding steps: The Transformer model adopts an enhanced location coding scheme, which introduces a service type offset to distinguish different service traffic. The offset is dynamically adjusted according to the service type to capture the differences in characteristics of different service traffic. The steps for optimizing the competitive network structure are as follows: The dual-depth Q-network adopts a competitive architecture to decompose the Q-value function into a state value function and an advantage function, distinguishing between state value and action advantage; mean normalization is introduced to learn the traffic allocation strategy.

[0008] Furthermore, it also includes: Hybrid filtering switching steps: Based on the Mahalanobis distance adaptive switching filtering algorithm, the matching degree between the data and the prediction model is evaluated. After switching to particle filtering, the residual resampling algorithm is used to optimize particle degradation. By introducing prior knowledge of system state transition, the particle filtering accuracy is estimated. Traffic rollback control steps: Design a dynamic rollback rate control algorithm to dynamically adjust the rollback rate based on the load difference between the primary path and the backup path, and control the rollback process by introducing a rollback rate coefficient.

[0009] Furthermore, in the heterogeneous network monitoring and data acquisition steps, the isolated forest algorithm is used to construct an anomaly detection unit. A binary search tree structure is used to identify data anomalies, and the algorithm parameters are automatically optimized through grid search combined with cross-validation to filter out abnormal data from interfering with system decision-making.

[0010] Furthermore, in the spatiotemporal fusion traffic prediction step, the traffic prediction model integrates multi-source information through a feature pyramid structure, combines features at different levels of abstraction, and retains short-term traffic and long-term trend features; it also introduces an attention mechanism to weightedly fuse information from different sources and dynamically adjusts the importance of information sources according to the actual situation.

[0011] Furthermore, it also includes: Business-aware traffic scheduling steps: The traffic is parsed using a five-tuple and classified into real-time, latency-tolerant, and best-effort categories based on the business service level agreement. Real-time traffic is allocated path combinations using a weighted fair queue scheduling algorithm, while latency-tolerant traffic is selected using a bandwidth path.

[0012] Furthermore, it also includes: Network attack defense linkage steps: When sudden traffic is detected on a path, the DDoS attack identification model is triggered. If an attack is detected, the traffic on the affected path will be switched to the cleaning node. The traffic ratio will be dynamically adjusted through reinforcement learning. During the attack defense process, the cleaning effect and network performance will be continuously monitored. After the attack is resolved, the traffic will be migrated back to the original path through a smooth transition mechanism.

[0013] Furthermore, it also includes the following modules: Heterogeneous monitoring and sensing module: Deploys an SDN controller and a smart probe array to build a distributed monitoring network, and uses data sharding technology to process multi-source monitoring data in parallel; The built-in anomaly detection unit uses the isolated forest algorithm to identify network anomalies and adapts to the network environment through an adaptive threshold adjustment mechanism; Spatiotemporal prediction and decision-making module: Equipped with a Transformer traffic prediction model and a hierarchical reinforcement learning engine, it improves prediction accuracy through multi-source data fusion and collaboratively optimizes global and local traffic; it uses model quantization and knowledge distillation techniques to compress model size and respond to decision-making. Dynamic scheduling execution module: integrates adaptive Kalman filter-particle filter hybrid algorithm and genetic algorithm optimization engine, adopts zero-copy technology to forward traffic, and handles packet latency by optimizing kernel network stack parameters; Quality assessment feedback module: A dynamic assessment system is constructed based on the Shapley-entropy weight method, and the path weights are updated periodically; the built-in policy replay unit uses the Monte Carlo tree search algorithm to verify the effectiveness of the policy, evaluates the policy performance by simulating different network scenarios, and optimizes the iteration cycle; Business collaboration and adaptation module: It parses traffic business attributes, performs differentiated scheduling according to service level agreements, provides standardized RESTful API interfaces and links with security devices; it connects to upper-layer business systems through northbound interfaces and intelligently adapts business requirements and network resources.

[0014] Furthermore, the spatiotemporal prediction decision module adopts a feature pyramid structure to integrate historical traffic, topology change logs, and weather data. Based on an attention mechanism-based adaptive fusion strategy, it dynamically adjusts the weights of information sources according to different scenarios. It captures short-term fluctuations and long-term trend features of traffic through multi-scale feature extraction technology. Based on a discrete event simulation engine, it simulates different network states, generates a strategy evaluation report, and uses a parametric simulation model to test and optimize new strategies.

[0015] Furthermore, the dynamic scheduling execution module uses packet marking and hash-based traffic allocation technology to distribute traffic, leverages a pre-distribution mechanism to allocate and adjust traffic in advance during peak traffic periods, and uses hardware acceleration technology to segment traffic. It displays a comprehensive path score through a heatmap, provides three-dimensional dynamic visualization analysis of path performance, offers an interactive query interface, allows for multi-dimensional data filtering and analysis, configures visualized anomaly alarm thresholds, and intelligently recommends thresholds based on historical data.

[0016] Compared with existing technologies, the beneficial effects of this invention are: In terms of traffic prediction, the Transformer architecture, which integrates spatiotemporal features, reduces the prediction error rate of burst traffic compared to the traditional LSTM model, enabling the system to plan traffic allocation in advance and avoid congestion. The hierarchical reinforcement learning decision-making mechanism, which combines global and local optimization, not only reduces the average network latency but also improves the load fairness index between paths, effectively solving the "starved" path problem and ensuring balanced utilization of resources across all links.

[0017] In terms of dynamic adaptability, adaptive filtering algorithms and elastic traffic migration strategies significantly enhance the system's ability to cope with network anomalies. Hybrid filtering mechanisms reduce link performance estimation errors, ensuring the accuracy of decision data; intelligent migration strategies reduce traffic migration latency and bandwidth waste, achieving smooth traffic switching during link failures or congestion, ensuring service continuity. Furthermore, the service-aware scheduling function differentiates and processes different types of traffic based on Service Level Agreements (SLAs), reducing the lag rate of real-time services and improving user experience.

[0018] From a system operation and maintenance perspective, the dynamic weight evaluation system of this invention improves path selection accuracy and reduces manual configuration costs; its linkage defense mechanism with security devices shortens business interruption time under DDoS attacks and enhances network security. Visualization and intelligent alarm functions shorten fault location time and improve operation and maintenance efficiency.

[0019] Overall, this invention achieves significant optimization in terms of resource utilization, service quality, and operation and maintenance costs, and has broad application value and economic benefits. Attached Figure Description

[0020] Figure 1 This is a schematic block diagram of an intelligent load balancing method based on multi-path fusion proposed in this invention. Figure 2 This is a schematic block diagram of an intelligent load balancing system based on multi-path fusion proposed in this invention. Figure 3 A diagram comparing the defect detection rates of different detection technologies; Figure 4 This is a schematic diagram illustrating how the traffic forecasting error rate changes over a time window. Figure 5 A diagram showing the comparison of fairness indices for load balancing strategies; Figure 6 This is a diagram illustrating the difference between system response latency and data volume. Figure 7 This is a diagram showing the comparison of network anomaly repair success rates. Detailed Implementation

[0021] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0022] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," and "counterclockwise," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0023] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, features defined with "first" and "second" may explicitly or implicitly include one or more of the stated features. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified. Furthermore, the terms "installed," "connected," and "linked" should be interpreted broadly; for example, they may refer to a fixed connection, a detachable connection, or an integral connection; they may refer to a mechanical connection or an electrical connection; they may refer to a direct connection or an indirect connection through an intermediate medium; and they may refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances. The invention will now be described in further detail with reference to the accompanying drawings.

[0024] Reference Figures 1 to 7 A smart load balancing method and system based on multi-path fusion, comprising: Heterogeneous Network Monitoring and Data Acquisition Steps: The heterogeneous network monitoring system adopts a distributed architecture, consisting of an SDN controller and edge intelligent probes. The SDN controller is deployed on core network nodes and periodically (every 2 seconds by default) acquires the entire network topology information via the OpenFlow protocol, including switch connection relationships, link bandwidth configuration, and port status, constructing a dynamic network topology map. Edge intelligent probes are deployed using lightweight container technology (such as Docker), supporting cross-platform operation. Each probe has a built-in multi-threaded acquisition module: the main thread is responsible for bandwidth utilization acquisition, polling network interface traffic data every 500ms via the SNMP protocol; the secondary thread uses dual-mode latency measurement, resolving IP timestamp options for TCP traffic and sending ICMP echo requests for UDP traffic, with the weighted average of the two measurement results used as the final latency value; the packet loss rate monitoring thread calculates the packet loss rate by sending 100 consecutive test data packets and comparing the number of returned packets; the device resource monitoring thread calls the node operating system API to collect CPU and memory utilization per second. The system uses sliding window technology to analyze data stability, with the window size N dynamically configurable (default 100 sampling points). Taking bandwidth utilization monitoring as an example, when the data of 100 sampling points for a certain path within the window are [65%, 63%, ..., 67%], the system first calculates the average value. Then through the formula (where Var(X) is the variance of the performance metric, N is the sliding window size, x) i Let i be the performance index value of the i-th sampling point. The variance is calculated as the average of all sampled points within the window. If the variance is below a threshold (e.g., 0.005), the path is considered to have high stability; conversely, if the variance increases sharply, the system will initiate an anomaly detection process, comparing historical data with similar paths to eliminate short-term fluctuations. In a wide area network test at an e-commerce company, this monitoring system successfully identified a sudden increase in latency variance caused by equipment failure on a certain operator's link, triggering traffic switching 12 seconds in advance to ensure the continuity of core services.

[0025] The spatiotemporal fusion traffic prediction process involves a traffic prediction model based on the Transformer architecture, employing a three-level data preprocessing mechanism. First, historical traffic data is normalized, dividing the 0-24 hour period into 48 time slices, with the average traffic value calculated for each slice. The time encoding module transforms dates (weekdays / weekends) and time periods (morning peak, midday off-peak, etc.) into multi-dimensional vectors. Business type labels are categorized into 12 business types (e.g., live video streaming, database synchronization) using natural language processing to parse the five-tuple information. Internally, the model contains a 6-layer encoder, each layer consisting of a multi-head attention mechanism (default 8 heads) and a feedforward neural network. Residual connections and layer normalization enhance training stability. The improved location encoding scheme, based on the traditional formula, assigns a unique offset Δ to each business type. type For example, the offset for video services is set to 0.5, and for file transfer services, it's set to 0.3, enabling the model to more accurately distinguish the traffic patterns of different services. During the training phase, the AdamW optimizer is used, with the learning rate initialized to 0.001 and decaying by 10% every 1000 steps. Early stopping is employed to avoid overfitting. In actual testing by a cloud service provider, the model's prediction error rate for burst traffic was only 3.2%, a 52.9% improvement compared to the traditional LSTM model. For instance, during the Double 11 promotion, the system accurately predicted a 400% surge in traffic at a certain time, adjusting the load balancing strategy in advance to avoid network congestion. The model's prediction output formula is... =Transformer(x t ,x t－1 ,...,x t－M＋1 Time t ,Type)(where Let x be the predicted flow rate at future time t+1. t Let x be the traffic data at the current time t. t－1 ,...,x t－M＋1 For traffic data at M historical moments, Time t (Time feature encoding, Type is the business type label).

[0026] Layered reinforcement learning strategy optimization steps: The two-layer reinforcement learning architecture decouples the upper and lower layers through message queues. The upper-layer decision module collects macro-level network status every 10 seconds, including regional traffic density (divided into low, medium, and high levels), core link load percentage, and available bandwidth of backup paths. When a region's traffic density reaches "high" and the core link load exceeds 80%, a global policy adjustment is triggered, such as enabling backup paths or cross-regional traffic scheduling. The decision results are sent to the lower-layer module via the gRPC protocol. The lower-layer path-level optimization adopts a dual deep Q network (DDQN) combined with a competitive network structure. The state space contains 6-dimensional path features (bandwidth utilization, latency interval, packet loss rate, etc.), and the action space is divided into 21 traffic allocation ratios with a granularity of 5%. The reward function adopts a dynamic weighting mechanism. During peak real-time business periods, the latency weight ω1 automatically increases from 0.4 to 0.6; during network congestion, the packet loss rate weight ω2 increases to 0.5. The system maintains an experience replay buffer with a capacity of 10,000 samples. Every 10 steps, 64 samples are randomly selected for training. The target network synchronizes its parameters every 100 iterations. The reward function is calculated using the following formula: (Where R is the reward value for reinforcement learning, ω1, ω2, ω3 are weight coefficients, and D...) avg For the average delay, D min For minimum delay, Pr avg For the average packet loss rate, Pr min (This represents the minimum packet loss rate; F is the fairness factor.) The formula for calculating the fairness factor F is: (where f) i Let n be the traffic allocation ratio for the i-th path (where n is the total number of paths). In a test at a financial data center, this strategy reduced the average latency by 41.8% while increasing the fairness index from 0.82 to 0.96, effectively avoiding the "starved" path problem.

[0027] Adaptive filtering data processing steps: Adaptive filtering employs a dual-threshold switching mechanism. The system calculates the Mahalanobis distance in real time. (where D) M Let z be the Mahalanobis distance. k These are actual measured values. P is the predicted value. k The network state is determined by the covariance matrix, where the principal threshold T is used. M1 =3.0 triggers an alert, secondary threshold T M2 =4.5 Forced switching filtering algorithm. When the Mahalanobis distance of a certain path delay exceeds T M1 When this happens, the system initiates an anomaly diagnosis process, comparing data from similar paths to rule out false positives; if the time exceeds T... M2 Immediately switch from Kalman filtering to particle filtering. The particle filtering stage uses the Sequential Importance Resampling (SIR) algorithm, with an initial particle count of 1000, and is determined through the prediction equation. (in Let f be the state of the i-th particle at time k, and let f be the state transition function. i Generate new particles from Gaussian noise. Weight update formula. (in Let i be the weight of the i-th particle at time k. In the state The following observations were made of z. k The probability of a signal is used to adjust particle weights, and resampling is performed every 5 steps. In a simulated fiber optic outage experiment on a carrier backbone network, the hybrid filtering algorithm reduced the delay estimation error from 12.3ms to 4.7ms, improved the response speed by 61.8%, and ensured the accuracy of traffic scheduling decisions.

[0028] Elastic Traffic Migration Steps: Traffic migration is based on a genetic algorithm, employing an elite retention strategy and adaptive crossover / mutation probability. The population size is set at 50 individuals, each representing a traffic migration scheme (e.g., migrating 20% ​​of traffic from path A to path B). The fitness function comprehensively considers migration latency, bandwidth waste rate, and service interruption risk; for example, if a scheme mistakenly migrates critical service traffic, resulting in a 30% decrease in fitness, the crossover probability P... c With the probability of mutation P m P is dynamically adjusted based on individual fitness; when the fitness is higher than the population mean, c The threshold was reduced from 0.8 to 0.6 to decrease premature convergence caused by excessive crossover. The system was pre-assigned a threshold T. p =0.8⋅Bw max and backoff threshold T r =0.6⋅Bw max The main path load reached T p At that time, according to the formula (Where α is the proportion of traffic to be migrated, L is the current load of the main path, and T is...) r Bw is the backoff threshold. max The migration ratio is calculated based on the maximum bandwidth of the primary path. The formula for calculating the traffic fallback rate is: (Where MigrationRate is the flow backoff rate) (where β is the current load of the backup path and β is the fallback rate coefficient). In a test on a large enterprise WAN, the elastic strategy reduced the average migration latency from 85.2ms to 42.7ms, the bandwidth waste rate from 12.3% to 4.1%, and the number of migrations decreased by 57.1%, effectively reducing the risk of network instability.

[0029] Dynamic weight evaluation steps: A two-stage calculation process is used to evaluate weights. The Shapley value method is used to assess the contribution of each indicator, treating six indicators such as bandwidth and latency as game participants, and calculating the marginal contribution of each indicator to the path quality score. For example, in a certain scenario, a Shapley value of 0.3 for bandwidth utilization indicates that it contributes 30% to the path score. The entropy weight method stage objectively assigns weights based on the dispersion of indicator data. If an indicator's data fluctuates greatly (high entropy value), it is assigned a lower weight to reduce the impact of noise. The weights are calculated using the formula... (where w) i Let be the weight of the i-th indicator, and λ be the balance coefficient. For Shapley values, e i (Weights calculated using the entropy weighting method) are fused. Path quality scoring formula. (where Q is the overall path quality score, m is the number of performance indicators, and w) i Let x be the weight of the i-th indicator. i Let x be the actual value of the i-th indicator. min x is the minimum value of the i-th indicator. max The maximum value of the i-th indicator is used as the weighted sum after normalization of the indicators. In actual testing at an Internet data center, this method improved the path selection accuracy from 78.3% to 86.9% and reduced the number of business interruptions from 5 times per month to 0 times, significantly optimizing the traffic allocation strategy.

[0030] This invention also includes the following steps: Improved Location Coding Steps: An enhanced location coding scheme is adopted in the Transformer model, improving the ability to distinguish between different service traffic by introducing service type offsets. In real-world networks, service traffic patterns vary significantly, including real-time communication, file transfer, and video streaming. Real-time communication prioritizes low latency and features continuous, small-granular traffic; file transfer experiences large traffic peaks during transmission; and video streaming requires stable bandwidth. The key to enhanced location coding is the introduction of dynamically adjusted offsets based on service type. At the same location, different service traffic has different codes due to the offset. For example, when real-time communication and video streaming services coexist, the codes differ. The Transformer model can keenly capture the differences in service traffic characteristics. The model's attention mechanism can accurately focus on relevant information and learn the traffic patterns of various services. In mixed service scenarios, the model can clearly distinguish traffic trends, improve prediction accuracy, provide a reliable basis for network resource allocation and load balancing, help efficiently utilize network resources, improve service quality, and cope with complex traffic.

[0031] The competitive network structure optimization steps: The dual-depth Q-network adopts a competitive architecture to decompose the Q-value function, dividing it into two parts: the state-value function and the advantage function. The state-value function reflects the inherent value of the system in a specific state, such as the basic value of a specific load state of the network; the advantage function measures the additional advantage of a specific action in a certain state compared to the average action, such as the improvement of guiding to an alternative path compared to random allocation during congestion. This decomposition allows DDQN to clearly distinguish between state value and action advantage, accurately evaluate the merits of each action in different states, and avoid misjudgments in traditional Q-learning. Facing complex network topologies, it accurately judges the value of each path by introducing mean normalization of the advantage function. Because the magnitude of the advantage of different actions varies greatly in real networks, it affects the stability and convergence speed of the algorithm. Mean normalization adjusts the advantage function so that the advantages of actions are compared on the same scale, making parameter updates more stable and convergence faster during algorithm learning. In complex environments with dynamic traffic changes and many interferences, DDQN can quickly adapt, learn the optimal strategy, ensure efficient and stable network operation, and achieve reasonable traffic allocation and load balancing.

[0032] This invention also includes the following steps: Hybrid filtering switching steps: An adaptive switching strategy based on Mahalanobis distance accurately assesses the matching degree between the data and the prediction model by considering the covariance structure of the measurement data. Complex correlations exist between different traffic indicators in the network, such as the relationship between bandwidth utilization and latency; Mahalanobis distance incorporates this into the calculation. If the Mahalanobis distance between the actual measurement and the prediction model is small, it indicates that the current filtering algorithm is applicable; otherwise, a switch is necessary. When switching to particle filtering, a residual resampling algorithm is used to address particle degradation. The residual is calculated based on the particle weights, prioritizing the retention of particles with large weights and resampling the residuals to avoid estimation bias caused by particle degradation. Prior knowledge of system state transitions is introduced; network traffic changes exhibit patterns, such as daily periodic changes or traffic redistribution rules during topology changes. Integrating prior knowledge into particle filtering allows particles to sample and estimate within a more reasonable range, reflecting the network state. In the face of sudden traffic surges or anomalies caused by network attacks, stable scheduling decisions are maintained to ensure network operation and resource allocation.

[0033] Traffic rollback control steps: A dynamic rollback rate control algorithm is designed to dynamically adjust the rollback rate based on the load difference between the primary and backup paths. A rollback rate coefficient β (0.1-0.5) is introduced to achieve fine-grained control. When the primary path load is too high, β increases to accelerate rollback; when the load difference is small, β decreases to reduce the rollback rate and prevent the backup path from becoming overloaded. Traditional "all-or-nothing" rollback methods have problems. A large-scale rollback of traffic at once can cause sudden changes in network traffic, leading to instability, such as instantaneous overload of backup paths or idle resources on the primary path, affecting network performance and service quality. The dynamic rollback rate control algorithm uses β value adjustment to allow traffic to migrate smoothly. It acts like a precise regulator, making the rollback process smooth and orderly, avoiding network instability. Whether dealing with traffic peaks or network failures, it can ensure reasonable traffic distribution, maintain network stability, and provide users with reliable network services.

[0034] In this invention, the isolated forest algorithm is used to construct anomaly detection units in the heterogeneous network monitoring and data acquisition steps. A binary search tree is used to identify anomalies, where normal data is isolated deep within the tree, while anomalies are located shallower. To adapt to different network environments, the algorithm parameters (number of trees, subsample size) are automatically optimized through grid search combined with cross-validation. Grid search exhaustively explores parameter combinations, and cross-validation divides the dataset multiple times to evaluate performance, finding the optimal combination to ensure anomaly detection accuracy exceeding 98%. This effectively filters out interference from anomalous data, ensuring that subsequent load balancing decisions are based on reliable data, avoiding misjudgments, contributing to stable network operation and efficient load balancing, and improving network resource utilization and service quality.

[0035] In this invention, the traffic prediction model in the spatiotemporal fusion traffic prediction step integrates multi-source information through a feature pyramid structure. The feature pyramid structure integrates features at different abstract levels. The bottom layer retains fine-grained short-term traffic features, capturing short-term traffic fluctuations to meet real-time business needs; the top layer retains coarse-grained long-term trend features, helping to grasp macro-level traffic trends and providing a reference for resource planning. An attention mechanism is introduced, where the importance of different information sources changes constantly in a dynamic network environment. For example, during traffic bursts, the weight of relevant historical data increases; when the business type changes, the weight of corresponding features increases. The attention mechanism dynamically adjusts the weight of each information source according to the actual situation, allowing the model to focus on key information and further improve prediction accuracy. Through the synergy of structure and mechanism, traffic characteristics are accurately captured, providing a reliable basis for intelligent load balancing and ensuring efficient and stable network operation.

[0036] This invention also includes the following steps: The business-aware traffic scheduling process employs a three-level identification mechanism. First, it quickly distinguishes 80% of regular traffic using a five-tuple (source IP, destination IP, port, protocol). For the remaining traffic, Deep Packet Inspection (DPI) is initiated, parsing fields such as HTTPUser-Agent and RTP timestamps to identify special services like streaming media and VoIP. Finally, encrypted traffic is classified using a machine learning model (such as Random Forest), with the model's pre-trained data containing 1 million labeled samples. The scheduling policy library includes 30 preset rules. For example, real-time services (such as video conferencing) are prioritized for allocation to paths with a latency standard deviation below 5ms, using Weighted Fair Queuing (WFQ) scheduling to guarantee a minimum bandwidth utilization of 60%. File transfer services are allocated to paths with bandwidth utilization below 30%, employing a best-effort strategy. The business scheduling priority calculation formula is as follows: (where Priority is the service scheduling priority, ω) delay ,ω bandwidth ,ω critical Here, D is the weighting coefficient, and D is the current path delay. max D min B represents the maximum / minimum latency, and B represents the available bandwidth of the current path. max (where C represents the total bandwidth of the path and C represents the importance level of the service). In the application of the video live streaming platform, the system reduced the live streaming buffering rate from 8.3% to 1.2%, while improving bandwidth utilization by 15%, achieving a balance between service quality and resource efficiency.

[0037] This invention also includes the following steps: Network attack defense linkage steps: Attack defense adopts a four-stage process of "detection-isolation-cleaning-switchback". Traffic anomaly detection is based on the Isolation Forest algorithm, with a window size of 100 sampling points. An alarm is triggered when sudden traffic exceeds three times the standard deviation of the historical average and the packet loss rate exceeds 10%. The attack identification model uses 100 decision trees to vote on whether it is a DDoS attack, achieving an accuracy of 98.7%. After confirming the attack, the system redirects traffic to the cleaning node through the SDN controller. The cleaning strategy uses a dynamic blacklist / whitelist mechanism: known malicious IPs are directly blocked, and abnormal traffic is rate-limited and protocol compliance checked. The reinforcement learning module adjusts the traffic ratio between the cleaning node and the normal path in real time; for example, when the cleaning latency exceeds a threshold, the cleaning traffic is automatically reduced by 5%. After the attack ends, the system gradually switches back traffic at a rate of 10% to avoid sudden surges. The statistical calculation formula for attack detection is as follows: (Where Z is the standard score, X is the current traffic observation, μ is the historical traffic mean, and σ is the historical traffic standard deviation). An attack warning mechanism is triggered when |Z| > 3. In an e-commerce platform attack and defense exercise, the system successfully withstood a DDoS attack of 1 million QPS, reducing business interruption time from 23 minutes to 5 minutes.

[0038] This invention also includes the following modules: Heterogeneous Monitoring and Sensing Module: Deploying an SDN controller and intelligent probe array to form a distributed monitoring network covering the entire network. This module uses data sharding technology to process multi-source monitoring data in parallel, supporting the processing of over 100,000 monitoring indicators per second. The built-in anomaly detection unit uses the isolated forest algorithm to identify network anomalies in real time, and an adaptive threshold adjustment mechanism adapts to different network environments to ensure high accuracy in anomaly detection.

[0039] Spatiotemporal prediction and decision-making module: Equipped with a Transformer traffic prediction model and a hierarchical reinforcement learning engine, the former improves prediction accuracy through multi-source data fusion, while the latter achieves collaborative optimization of global and local traffic. This module uses model quantization and knowledge distillation techniques to compress model size, reducing model inference latency by 50% while maintaining prediction accuracy, and supporting millisecond-level decision response.

[0040] Dynamic scheduling execution module: Integrates an adaptive Kalman filter-particle filter hybrid algorithm and a genetic algorithm optimization engine, supporting traffic slicing with a minimum granularity of 64KB and lossless migration. This module uses zero-copy technology to achieve traffic forwarding and reduces packet processing latency to the microsecond level by optimizing kernel network stack parameters, ensuring efficient traffic scheduling execution capabilities.

[0041] Quality assessment feedback module: A dynamic evaluation system is constructed based on the Shapley-entropy weight method, and path weights are updated periodically. The built-in policy replay unit uses the Monte Carlo tree search algorithm to verify the effectiveness of the policy, evaluates the policy performance by simulating different network scenarios, and shortens the optimization iteration cycle to 10 seconds, ensuring that the system can quickly adapt to network changes.

[0042] Business Collaboration and Adaptation Module: This module parses traffic service attributes and performs differentiated scheduling based on service level agreements (SLAs). It provides a standardized RESTful API interface, supporting integration with security devices such as firewalls and intrusion detection systems. Through northbound interfaces, it connects with upper-layer business systems to achieve intelligent adaptation between business requirements and network resources, thereby improving overall network service quality.

[0043] In this invention, the spatiotemporal prediction decision module employs a feature pyramid structure to fuse multi-source information such as historical traffic, topology change logs, and weather data. This unit implements an adaptive fusion strategy based on an attention mechanism, dynamically adjusting the weights of each information source according to different scenarios. Through multi-scale feature extraction technology, it simultaneously captures both short-term fluctuations and long-term trends in traffic, further improving the accuracy of traffic prediction. A discrete event simulation engine simulates network states under different strategies, generating a strategy evaluation report including key indicators such as throughput, latency, and packet loss rate. This unit uses a parametric simulation model, supporting custom network topology and traffic patterns, enabling comprehensive testing and optimization of new strategies without affecting actual network operation.

[0044] In this invention, the dynamic scheduling execution module supports traffic slicing with a minimum granularity of 64KB and employs packet-by-packet marking and hash-based traffic splitting techniques to achieve precise traffic allocation. This unit implements a pre-split mechanism based on load prediction, enabling traffic allocation adjustments before peak traffic periods to effectively avoid link congestion. Hardware acceleration technologies (such as SmartNICs) further enhance traffic splitting and forwarding efficiency, supporting line-rate processing of 400Gbps traffic. A heatmap displays real-time comprehensive path scores, supporting three-dimensional dynamic visualization analysis of path performance. This unit provides an interactive query interface, supporting multi-dimensional data filtering and analysis, such as data mining based on time range, service type, and path type. Simultaneously, it implements a visualized configuration function for abnormal alarm thresholds, supporting intelligent threshold recommendations based on historical data to improve operational efficiency.

[0045] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A smart load balancing method based on multi-path fusion, characterized in that, The following steps are involved: Heterogeneous network monitoring and data acquisition steps: Construct a distributed monitoring system for the entire network and obtain a global view of the network topology through the SDN controller; Probes are deployed at path nodes, and multi-threaded parallel acquisition technology is used to obtain multi-dimensional performance indicators; sliding window technology is used to quantify path stability and assist in allocation decisions. Spatiotemporal fusion traffic prediction steps: Build a traffic prediction model based on the Transformer architecture and integrate spatiotemporal analysis capabilities; design multiple channels to process historical traffic data sequences, time codes, and business type labels; capture traffic feature correlations through a multi-head attention mechanism and output time-segmented traffic prediction values; The hierarchical reinforcement learning strategy optimization steps are as follows: a two-layer optimization architecture is designed for collaborative decision-making. The upper layer determines the global policy based on the macro-network state through a deep Q-network, while the lower layer optimizes the allocation for single paths by using a dual deep Q-network combined with a competitive network structure. The reward function balances the objective by adjusting the weight coefficients and introduces the Jain fairness index to calculate the fairness factor. Adaptive filtering data processing steps: The path performance data is processed using a hybrid algorithm of Kalman and particle filtering. The filtering strategy is switched between Mahalanobis distance and path stability. The sequential importance resampling algorithm is used in the particle filtering stage. Elastic traffic migration steps: Construct a traffic migration optimization model based on a genetic algorithm, set a pre-allocation threshold and a fallback threshold, and start the pre-migration process when the main path load exceeds the threshold; During the migration process, packet marking and hash-based traffic splitting techniques are used. When the load on the main path falls back to the fallback threshold, a traffic fallback mechanism is triggered. Dynamic weight evaluation steps: Combine the Shapley value method and the entropy weight method to calculate the dynamic weight of performance indicators, and use a balancing coefficient to integrate the advantages of the two methods to generate a dynamic weight vector; use a weighted summation method to score path quality, and calculate the comprehensive score of performance indicators after normalization.

2. The intelligent load balancing method based on multi-path fusion according to claim 1, characterized in that, Also includes: Improved location coding steps: The Transformer model adopts an enhanced location coding scheme, which introduces a service type offset to distinguish different service traffic. The offset is dynamically adjusted according to the service type to capture the differences in characteristics of different service traffic. The steps for optimizing the competitive network structure are as follows: The dual-depth Q-network adopts a competitive architecture to decompose the Q-value function into a state value function and an advantage function, distinguishing between state value and action advantage; mean normalization is introduced to learn the traffic allocation strategy.

3. The intelligent load balancing method based on multi-path fusion according to claim 1, characterized in that, Also includes: Hybrid filtering switching steps: Based on the Mahalanobis distance adaptive switching filtering algorithm, the matching degree between the data and the prediction model is evaluated. After switching to particle filtering, the residual resampling algorithm is used to optimize particle degradation. By introducing prior knowledge of system state transition, the particle filtering accuracy is estimated. Traffic rollback control steps: Design a dynamic rollback rate control algorithm to dynamically adjust the rollback rate based on the load difference between the primary path and the backup path, and control the rollback process by introducing a rollback rate coefficient.

4. The intelligent load balancing method based on multi-path fusion according to claim 1, characterized in that, In the heterogeneous network monitoring and data acquisition steps, the isolated forest algorithm is used to construct an anomaly detection unit. A binary search tree structure is used to identify data anomalies. The algorithm parameters are automatically optimized by combining grid search with cross-validation to filter out abnormal data that may interfere with system decision-making.

5. The intelligent load balancing method based on multi-path fusion according to claim 1, characterized in that, In the spatiotemporal fusion traffic prediction step, the traffic prediction model integrates multi-source information through a feature pyramid structure, combines features at different levels of abstraction, and retains short-term traffic and long-term trend features. An attention mechanism is introduced to weight and fuse information from different sources, dynamically adjusting the importance of information sources based on actual circumstances.

6. The intelligent load balancing method based on multi-path fusion according to claim 1, characterized in that, Also includes: Business-aware traffic scheduling steps: The traffic is parsed using a five-tuple and classified into real-time, latency-tolerant, and best-effort categories based on the business service level agreement. Real-time traffic is allocated path combinations using a weighted fair queue scheduling algorithm, while latency-tolerant traffic is selected using a bandwidth path.

7. The intelligent load balancing method based on multi-path fusion according to claim 1, characterized in that, Also includes: Network attack defense linkage steps: When sudden traffic is detected on the path, the DDoS attack identification model is triggered. The attack will switch the traffic on the affected path to the cleaning node and dynamically adjust the traffic ratio through reinforcement learning. During the attack defense process, the cleaning effect and network performance are continuously monitored, and after the attack is resolved, the traffic is migrated back to its original path through a smooth transition mechanism.

8. A system for an intelligent load balancing method based on multi-path fusion according to any one of claims 1-7, characterized in that, Includes the following modules: Heterogeneous monitoring and sensing module: Deploys an SDN controller and a smart probe array to build a distributed monitoring network, and uses data sharding technology to process multi-source monitoring data in parallel; The built-in anomaly detection unit uses the isolated forest algorithm to identify network anomalies and adapts to the network environment through an adaptive threshold adjustment mechanism; Spatiotemporal prediction and decision-making module: Equipped with a Transformer traffic prediction model and a hierarchical reinforcement learning engine, it improves prediction accuracy through multi-source data fusion and collaboratively optimizes global and local traffic; it uses model quantization and knowledge distillation techniques to compress model size and respond to decision-making. Dynamic scheduling execution module: integrates adaptive Kalman filter-particle filter hybrid algorithm and genetic algorithm optimization engine, adopts zero-copy technology to forward traffic, and handles packet latency by optimizing kernel network stack parameters; Quality assessment feedback module: A dynamic assessment system is constructed based on the Shapley-entropy weight method, and the path weights are updated periodically; the built-in policy replay unit uses the Monte Carlo tree search algorithm to verify the effectiveness of the policy, evaluates the policy performance by simulating different network scenarios, and optimizes the iteration cycle; Business collaboration and adaptation module: It parses traffic business attributes, performs differentiated scheduling according to service level agreements, provides standardized RESTful API interfaces and links with security devices; it connects to upper-layer business systems through northbound interfaces and intelligently adapts business requirements and network resources.

9. The system of the intelligent load balancing method based on multi-path fusion according to claim 8, characterized in that, The spatiotemporal prediction decision module adopts a feature pyramid structure to integrate historical traffic, topology change logs and weather data. Based on the attention mechanism adaptive fusion strategy, it dynamically adjusts the weight of information sources according to different scenarios and captures short-term fluctuations and long-term trend features of traffic through multi-scale feature extraction technology. Based on the discrete event simulation engine, different network states are simulated to generate a strategy evaluation report. The new strategy is tested and optimized using a parameterized simulation model.

10. The system of the intelligent load balancing method based on multi-path fusion according to claim 8, characterized in that, The dynamic scheduling execution module uses packet marking and hash-based traffic allocation technology to distribute traffic, leverages a pre-distribution mechanism to allocate and adjust traffic in advance during peak traffic periods, and uses hardware acceleration technology to segment traffic. The system displays a comprehensive route score using heatmaps, provides 3D dynamic visualization analysis of route performance, offers an interactive query interface, allows for multi-dimensional data filtering and analysis, configures visualized anomaly alarm thresholds, and intelligently recommends thresholds based on historical data.

Images