Process layer network flow monitoring and early warning method and device based on intelligent switch
By dynamically modeling network traffic data using deep learning-based time series analysis technology, multi-dimensional time-series dependencies are captured, solving the problems of insufficient monitoring accuracy and poor real-time performance in existing technologies. This enables intelligent switches to provide accurate early warning and decision support in network traffic management.
Patent Information
- Application Number
- CN202511138284.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-14
- Publication Date
- 2025-11-11
AI Technical Summary
Existing network traffic monitoring methods lack sufficient monitoring accuracy and early warning capabilities when faced with complex traffic patterns. They also lack real-time performance, struggle to accurately identify the specific sources of traffic anomalies, and fail to fully utilize the hardware advantages of intelligent switches.
We employ deep learning-based time series analysis techniques to dynamically model network traffic data, capturing multidimensional temporal dependencies in traffic characteristics. We extract short-term fluctuations and long-term trend features through time embedding layers, time convolutional neural networks, and bidirectional long short-term memory networks, and generate early warning signals by combining weighted fusion.
It achieves efficient traffic monitoring and early warning capabilities, accurately identifies abnormal traffic patterns and generates intelligent early warning signals in complex network environments, thereby improving network reliability and real-time response capabilities.
Smart Images
Figure CN120935128A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network communication and information security technology, specifically a method and device for monitoring and early warning of network traffic at the process layer of an intelligent switch. Background Technology
[0002] In modern communication networks, intelligent switches, as core devices in the process layer network, undertake critical tasks such as data traffic forwarding, control, and management. Especially in industrial automation, smart grids, and other scenarios with high reliability requirements, the stability and real-time performance of the process layer network are crucial to the operation of the entire system. However, with the expansion of network scale and the increase in business complexity, the traffic distribution in the process layer network often exhibits nonlinear and dynamically changing characteristics, which places higher demands on network traffic monitoring and early warning.
[0003] Existing network traffic monitoring methods are typically based on traditional statistical analysis or simple threshold judgment mechanisms. While these methods can reflect the network's operational status to some extent, their monitoring accuracy and early warning capabilities are significantly insufficient when faced with complex traffic patterns. For example, traditional methods struggle to accurately identify the specific source of traffic anomalies and cannot provide early warnings of potential network congestion or failures. Furthermore, when processing large-scale traffic data, existing technologies often rely on offline analysis or post-processing methods, lacking real-time capabilities and resulting in an inability to respond promptly to sudden network anomalies.
[0004] From a technical perspective, the mathematical models of existing traffic monitoring methods are usually quite simple, such as linear formulas based on a single indicator:
[0005] in, This represents the total traffic load. For the first The size of the traffic class, These are their weighting coefficients. While such models are easy to implement, they ignore the correlation between traffic flows and the dynamic changes over time, making them difficult to adapt to the needs of complex network environments.
[0006] More importantly, current technologies lack an efficient monitoring and early warning solution that can leverage the hardware characteristics of intelligent switches. While intelligent switches possess powerful data processing capabilities and flexible programmable interfaces, there are currently no technological means to fully exploit their potential for accurate monitoring and early warning of process-layer network traffic. This not only limits the functionality of intelligent switches but also leaves network maintenance personnel without effective technical support when facing potential risks.
[0007] In summary, given the shortcomings of existing technologies in process layer network traffic monitoring, such as poor real-time performance, insufficient accuracy, and limited early warning capabilities, there is an urgent need to develop a novel traffic monitoring and early warning method based on intelligent switches to improve network reliability and intelligence. Furthermore, this method should incorporate advanced mathematical modeling techniques and fully utilize the hardware advantages of intelligent switches to provide strong support for the secure operation of process layer networks. Summary of the Invention
[0008] To address the aforementioned technical problems, this application is proposed. Embodiments of this application provide a method for monitoring and early warning of network traffic at the process layer of an intelligent switch. This method employs deep learning-based time series analysis technology to dynamically model network traffic data, capture multidimensional temporal dependencies in traffic characteristics, and uncover potential abnormal traffic patterns. This intelligently generates early warning signals and implements corresponding traffic control strategies. In this way, efficient traffic monitoring and early warning capabilities are achieved, providing accurate decision support for intelligent switches in network traffic management.
[0009] Accordingly, according to one aspect of this application, a method for monitoring and early warning of process layer network traffic based on a smart switch is provided, comprising: receiving a traffic acquisition instruction, wherein the traffic acquisition instruction includes a target network device identifier; determining a target switch based on the target network device identifier, wherein the target switch is located in the process layer network corresponding to the target network device identifier; sending a traffic monitoring request message to the target switch; receiving real-time traffic data returned by the target switch; determining whether the target switch is in an abnormal state based on the traffic acquisition instruction and the real-time traffic data; in response to the target switch being in an abnormal state, transmitting the real-time traffic data to an early warning analysis module; the early warning analysis module generating a corresponding early warning signal based on the real-time traffic data, wherein the early warning analysis module generating the corresponding early warning signal based on the real-time traffic data includes: In response to the target switch being in an abnormal state, the feature sequence of the real-time traffic data is obtained; The feature sequence is embedded and encoded to obtain a sequence of traffic feature granularity embedding and encoding vectors; The short-term fluctuation features and long-term trend features of the sequence of the traffic feature granularity embedding encoding vector are extracted respectively to obtain the first traffic feature understanding vector and the second traffic feature understanding vector; The first traffic feature understanding vector and the second traffic feature understanding vector are weighted and fused to obtain a multi-scale traffic feature understanding vector; Based on the multi-scale traffic feature understanding vector, a warning level label is generated for the target switch.
[0010] In the above-mentioned intelligent switch process layer network traffic monitoring and early warning method, the sequence of traffic feature granularity embedding encoding to obtain the feature sequence includes: dividing the feature sequence into time windows and then passing it through a feature granularity encoder based on a time embedding layer to obtain the sequence of traffic feature granularity embedding encoding vector.
[0011] In the above-mentioned method for monitoring and early warning of network traffic based on the process layer of intelligent switches, the short-term fluctuation features and long-term trend features of the sequence of traffic feature granularity embedding encoding vectors are extracted to obtain the first traffic feature understanding vector and the second traffic feature understanding vector, respectively. This includes: performing local fluctuation encoding on the sequence of traffic feature granularity embedding encoding vectors to obtain the first traffic feature understanding vector; and performing global trend encoding on the sequence of traffic feature granularity embedding encoding vectors to obtain the second traffic feature understanding vector.
[0012] In the above-mentioned method for monitoring and early warning of network traffic based on the process layer of intelligent switches, performing local fluctuation encoding on the sequence of traffic feature granularity embedding encoding vectors to obtain the first traffic feature understanding vector includes: passing the sequence of traffic feature granularity embedding encoding vectors through a first feature encoder based on a time convolutional neural network model to obtain the first traffic feature understanding vector.
[0013] In the above-mentioned intelligent switch process layer network traffic monitoring and early warning method, the sequence of traffic feature granularity embedding encoding vectors is subjected to global trend encoding to obtain the second traffic feature understanding vector, including: passing the sequence of traffic feature granularity embedding encoding vectors through a second feature encoder based on a bidirectional long short-term memory network to obtain the second traffic feature understanding vector.
[0014] In the above-mentioned intelligent switch process layer network traffic monitoring and early warning method, the first traffic feature understanding vector and the second traffic feature understanding vector are weighted and fused to obtain a multi-scale traffic feature understanding vector, including: using a weighted layer-based multi-scale feature fusion device to perform feature fusion on the first traffic feature understanding vector and the second traffic feature understanding vector to obtain the multi-scale traffic feature understanding vector.
[0015] In the above-mentioned intelligent switch-based process layer network traffic monitoring and early warning method, a multi-scale feature fusion fusion molecule based on a weighted layer is used to fuse the first traffic feature understanding vector and the second traffic feature understanding vector to obtain the multi-scale traffic feature understanding vector. This includes: fusing the first traffic feature understanding vector and the second traffic feature understanding vector using the following weighted fusion formula to obtain the multi-scale traffic feature understanding vector; wherein the weighted fusion formula is:
[0016] in, It is the first traffic feature understanding vector. It is the second flow feature understanding vector. It is the multi-scale flow feature understanding vector. It is a weighting coefficient, representing the weight allocation for short-term fluctuation characteristics and long-term trend characteristics, with a value range of [0,1].
[0017] In the above-mentioned method for monitoring and warning network traffic based on the process layer of intelligent switches, generating a warning level label for the target switch based on the multi-scale traffic feature understanding vector includes: optimizing the distribution of the multi-scale traffic feature understanding vector to obtain an optimized multi-scale traffic feature understanding vector; passing the optimized multi-scale traffic feature understanding vector through a classifier to obtain a classification result, the classification result being used to represent the warning level label.
[0018] In the above-mentioned method for monitoring and early warning of network traffic based on the process layer of intelligent switches, the distribution optimization of the multi-scale traffic feature understanding vector to obtain the optimized multi-scale traffic feature understanding vector includes: performing regularization processing on the first traffic feature understanding vector and the second traffic feature understanding vector to obtain the optimized feature vector; and fusing the optimized feature vector with the multi-scale traffic feature understanding vector to obtain the optimized multi-scale traffic feature understanding vector.
[0019] In the above-mentioned intelligent switch-based process layer network traffic monitoring and early warning method, the optimized multi-scale traffic feature understanding vector is passed through a classifier to obtain a classification result. The classification result is used to represent the early warning level label, including: using the fully connected layer of the classifier to perform nonlinear mapping on the optimized multi-scale traffic feature understanding vector to obtain a mapped feature vector; inputting the mapped feature vector into the Softmax function of the classifier to obtain the probability value of the optimized multi-scale traffic feature understanding vector belonging to each early warning level, the early warning level including all possible traffic anomaly levels; and determining the early warning level corresponding to the largest probability value as the classification result.
[0020] An apparatus includes a processor and a memory, wherein the memory stores a computer-executable program, which, when executed by the processor, implements a method for monitoring and warning network traffic at the process layer of an intelligent switch.
[0021] Compared with existing technologies, the network traffic monitoring and early warning method based on the process layer of intelligent switches provided in this application uses deep learning-based time series analysis technology to dynamically model network traffic data, capture multi-dimensional temporal dependencies in traffic characteristics, and uncover potential abnormal traffic patterns. This allows for the intelligent generation of early warning signals and the implementation of corresponding traffic control strategies. Thus, it achieves efficient traffic monitoring and early warning capabilities, providing accurate decision support for intelligent switches in network traffic management. Attached Figure Description
[0022] Figure 1 A flowchart of a process layer network traffic monitoring and early warning method based on a smart switch provided in an embodiment of this application is shown.
[0023] Figure 2 This is a schematic diagram illustrating the process of embedding and encoding a feature sequence to obtain a traffic feature granularity embedding and encoding vector sequence in an embodiment of this application.
[0024] Figure 3 This is a processing logic diagram for extracting short-term fluctuation features and long-term trend features to generate a first flow feature understanding vector and a second flow feature understanding vector in the embodiments of this application.
[0025] Figure 4 This is a schematic diagram illustrating the feature fusion of the first traffic feature understanding vector and the second traffic feature understanding vector using a weighted fusion formula in an embodiment of this application.
[0026] Figure 5 This is a diagram of the classifier structure for generating warning level labels based on the optimized multi-scale traffic feature understanding vector in this embodiment of the application. Detailed Implementation
[0027] This application provides a method for monitoring and early warning of network traffic at the process layer of an intelligent switch. Its core lies in dynamically modeling network traffic data using deep learning time series analysis technology, capturing multidimensional temporal dependencies in traffic characteristics, mining potential abnormal traffic patterns, and intelligently generating early warning signals. The following, in conjunction with the appendix... Figure 1 To be continued Figure 5 The technical solution of the present invention will be described in detail with specific embodiments.
[0028] First, as attached Figure 1As shown, the overall process of this method includes receiving traffic acquisition instructions, identifying the target switch, sending a traffic monitoring request message, receiving real-time traffic data, determining whether the target switch is in an abnormal state, transmitting real-time traffic data to the early warning analysis module, and generating an early warning signal. In practical applications, this method can be deployed in intelligent switch systems in industrial automation scenarios for efficient monitoring and early warning of process layer network traffic. For example, in the substation network of a power system, the process layer network carries a large number of real-time data transmission tasks, which may contain critical information such as equipment operating status and sensor monitoring information. To ensure network stability and security, rapid detection and response to traffic anomalies are necessary.
[0029] Specifically, in the first step, the system receives a traffic collection command containing the target network device identifier. This identifier can be the device's IP address, MAC address, or other unique identifier. Based on this identifier, the system can locate the target switch within the process layer network. For example, if the target network device identifier is the IP address of a sensor, the system will determine the location of the switch corresponding to that IP address by querying the network topology or device management database. The key to this step is ensuring the accurate location of the target switch so that subsequent traffic monitoring and analysis operations can be performed on the correct device.
[0030] After identifying the target switch, the system sends a traffic monitoring request message to that switch. This message is typically sent using a standard network protocol (such as SNMP or NetFlow), requesting the switch to return its real-time traffic data. Upon receiving the request, the switch encapsulates its current traffic statistics and returns them to the system. This traffic data may include, but is not limited to, metrics such as packet count, byte count, connection count, and packet loss rate. It is worth noting that the frequency of real-time traffic data collection can be adjusted according to actual needs. For example, in high-load scenarios, a higher collection frequency can be set to capture more granular traffic changes; while in low-load scenarios, the collection frequency can be reduced to decrease system overhead.
[0031] Next, the system determines whether the target switch is in an abnormal state based on the traffic collection instructions and the received real-time traffic data. This determination process can be implemented in various ways, such as setting threshold rules or using machine learning models. In this embodiment, a deep learning-based method is used to analyze the traffic data. Specifically, the system first obtains the feature sequences of the real-time traffic data. These feature sequences are the results obtained after preprocessing the raw traffic data. For example, the traffic data can be divided into several segments according to time windows, and each segment corresponds to a statistical feature within a time window, such as the average, variance, maximum value, and minimum value. These feature sequences form the basis for subsequent analysis.
[0032] As attached Figure 2 As shown, the embedding encoding process of the feature sequence is a crucial step in this method. During this process, the system uses a feature granularity encoder based on a temporal embedding layer to process the feature sequence, thereby obtaining a sequence of traffic feature granularity embedding encoded vectors. The role of the temporal embedding layer is to introduce temporal dimension information into the feature representation, enabling the model to better capture the temporal characteristics of the traffic data. For example, assuming the feature sequence contains data from 10 time windows, each with 5 statistical features, after processing by the temporal embedding layer, an embedding encoded vector sequence of shape (10, d) will be generated, where d represents the embedding dimension. This embedding encoded vector sequence not only retains the numerical information of the original features but also adds temporal contextual information, providing richer input for subsequent feature extraction.
[0033] Subsequently, as attached Figure 3 As shown, the system extracts short-term fluctuation features and long-term trend features from the traffic feature granularity embedded encoding vector sequence to generate a first traffic feature understanding vector and a second traffic feature understanding vector. Short-term fluctuation features reflect the changing patterns of traffic data over a short period (e.g., minutes or seconds), while long-term trend features reveal the changing trends of traffic data over a longer time scale (e.g., hours or days). These two feature extractions are achieved through different neural network models. For short-term fluctuation features, the system uses a first feature encoder based on a Temporal Convolutional Neural Network (TCN) to encode local fluctuations in the embedded encoding vector sequence. The TCN model captures local change patterns within a time window through one-dimensional convolution operations, and its advantage lies in its ability to effectively handle non-stationary time series data. For long-term trend features, the system uses a second feature encoder based on a Bidirectional Long Short-Term Memory Network (BiLSTM) to encode global trends in the embedded encoding vector sequence. The BiLSTM model captures dependencies over a long time span through a bidirectional recurrent structure, and its output reflects the overall changing trend of the traffic data.
[0034] After extracting short-term fluctuation features and long-term trend features, the system uses a weighted fusion formula to fuse the first and second flow feature understanding vectors, thereby obtaining a multi-scale flow feature understanding vector. (See attached image) Figure 4 As shown, the weighted fusion formula is:
[0035] in, It is the first traffic feature understanding vector. It is the second flow feature understanding vector. It is the multi-scale flow feature understanding vector. These are weighting coefficients, representing the weighting allocation between short-term fluctuation characteristics and long-term trend characteristics. Their values range from [0,1]. In practical applications, The value can be adjusted according to the specific scenario. For example, in scenarios where short-term fluctuations need to be closely monitored, the value can be adjusted. Set it to a larger value; however, in scenarios where long-term trends need to be considered, it can be set to a smaller value. Set it to a smaller value. In this way, the system can flexibly adapt to the needs of different application scenarios.
[0036] After obtaining the multi-scale flow feature understanding vector, the system performs distribution optimization to generate an optimized multi-scale flow feature understanding vector. This optimization process includes regularizing the first and second flow feature understanding vectors to eliminate dimensional differences and redundant information between features. Subsequently, the system fuses the optimized feature vector with the multi-scale flow feature understanding vector to obtain the final optimized multi-scale flow feature understanding vector. The significance of this optimization step lies in improving the quality of feature representation and providing more reliable input for subsequent classification tasks.
[0037] Finally, as attached Figure 5 As shown, the system processes the optimized multi-scale traffic feature understanding vector through a classifier to generate warning level labels. The classifier structure includes a fully connected layer and a softmax function. The fully connected layer performs a non-linear mapping on the input features, generating a mapped feature vector. The softmax function converts the mapped feature vector into a probability distribution, representing the probability value of the optimized multi-scale traffic feature understanding vector belonging to each warning level. Warning levels typically include multiple levels, such as "normal," "minor anomaly," and "severe anomaly." The system determines the final classification result based on the warning level corresponding to the highest probability value and outputs this result as a warning signal.
[0038] In practical applications, this method can be validated in the following scenario: Assume that multiple intelligent switches are deployed in the process layer network of a substation. These switches are responsible for transmitting real-time data from sensors and control equipment. When the traffic data of a switch becomes abnormal, the system will collect, analyze, and issue an early warning for the switch's traffic data according to the above process. For example, if the traffic of a switch suddenly surges, the system will detect this change through short-term fluctuation characteristics and determine whether it belongs to an abnormal mode by combining long-term trend characteristics. If it is confirmed to be abnormal, the system will generate a corresponding early warning signal and notify the operation and maintenance personnel to take measures. In addition, the system can also automatically trigger traffic control strategies according to the early warning level, such as limiting the bandwidth of specific traffic or reallocating network resources, thereby ensuring the stable operation of the network.
[0039] In summary, the network traffic monitoring and early warning method based on the process layer of intelligent switches provided in this application dynamically models network traffic data using deep learning time series analysis technology, captures multidimensional temporal dependencies in traffic characteristics, mines potential abnormal traffic patterns, and intelligently generates early warning signals. This method enables efficient traffic monitoring and early warning capabilities, providing accurate decision support for intelligent switches in network traffic management.
Claims
1. A method for monitoring and early warning of network traffic at the process layer based on an intelligent switch, comprising: The system receives a traffic acquisition instruction, wherein the traffic acquisition instruction includes a target network device identifier; determines a target switch based on the target network device identifier, wherein the target switch is located in the process layer network corresponding to the target network device identifier; sends a traffic monitoring request message to the target switch; receives real-time traffic data returned by the target switch; determines whether the target switch is in an abnormal state based on the traffic acquisition instruction and the real-time traffic data; and, in response to the target switch being in an abnormal state, transmits the real-time traffic data to an early warning analysis module; the early warning analysis module generates a corresponding early warning signal based on the real-time traffic data, characterized in that it includes: In response to the target switch being in an abnormal state, the feature sequence of the real-time traffic data is obtained; The feature sequence is embedded and encoded to obtain a sequence of traffic feature granularity embedding and encoding vectors; The short-term fluctuation features and long-term trend features of the sequence of the traffic feature granularity embedding encoding vector are extracted respectively to obtain the first traffic feature understanding vector and the second traffic feature understanding vector; The first traffic feature understanding vector and the second traffic feature understanding vector are weighted and fused to obtain a multi-scale traffic feature understanding vector; Based on the multi-scale traffic feature understanding vector, a warning level label is generated for the target switch.
2. The method for monitoring and early warning of network traffic at the process layer based on an intelligent switch according to claim 1, characterized in that, The process of embedding and encoding the feature sequence to obtain a sequence of traffic feature granularity embedding and encoding vectors includes: dividing the feature sequence into time windows and then using a feature granularity encoder based on a time embedding layer to obtain a sequence of traffic feature granularity embedding and encoding vectors.
3. The method for monitoring and early warning of network traffic at the process layer based on an intelligent switch according to claim 1, characterized in that, Extracting short-term fluctuation features and long-term trend features from the sequence of the traffic feature granularity embedding encoding vector to obtain a first traffic feature understanding vector and a second traffic feature understanding vector includes: performing local fluctuation encoding on the sequence of the traffic feature granularity embedding encoding vector to obtain the first traffic feature understanding vector; and performing global trend encoding on the sequence of the traffic feature granularity embedding encoding vector to obtain the second traffic feature understanding vector.
4. The method for monitoring and early warning of network traffic at the process layer based on an intelligent switch according to claim 3, characterized in that, Performing local fluctuation encoding on the sequence of the traffic feature granularity embedding encoding vector to obtain the first traffic feature understanding vector includes: passing the sequence of the traffic feature granularity embedding encoding vector through a first feature encoder based on a time convolutional neural network model to obtain the first traffic feature understanding vector.
5. The method for monitoring and early warning of network traffic at the process layer based on an intelligent switch according to claim 3, characterized in that, Performing global trend encoding on the sequence of the traffic feature granularity embedding encoding vector to obtain the second traffic feature understanding vector includes: passing the sequence of the traffic feature granularity embedding encoding vector through a second feature encoder based on a bidirectional long short-term memory network to obtain the second traffic feature understanding vector.
6. The method for monitoring and early warning of network traffic at the process layer based on an intelligent switch according to claim 1, characterized in that, The weighted fusion of the first traffic feature understanding vector and the second traffic feature understanding vector to obtain a multi-scale traffic feature understanding vector includes: using a weighted multi-scale feature fusion fusion device to fuse the first traffic feature understanding vector and the second traffic feature understanding vector to obtain the multi-scale traffic feature understanding vector.
7. The method for monitoring and early warning of network traffic at the process layer based on an intelligent switch according to claim 6, characterized in that, Using a weighted multi-scale feature fusion fusion molecule to fuse the first traffic feature understanding vector and the second traffic feature understanding vector to obtain the multi-scale traffic feature understanding vector, the method includes: fusing the first traffic feature understanding vector and the second traffic feature understanding vector using the following weighted fusion formula to obtain the multi-scale traffic feature understanding vector.
8. The method for monitoring and early warning of network traffic at the process layer based on an intelligent switch according to claim 1, characterized in that, Based on the multi-scale traffic feature understanding vector, a warning level label for the target switch is generated, including: optimizing the distribution of the multi-scale traffic feature understanding vector to obtain an optimized multi-scale traffic feature understanding vector; passing the optimized multi-scale traffic feature understanding vector through a classifier to obtain a classification result, the classification result being used to represent the warning level label.
9. The method for monitoring and early warning of network traffic at the process layer based on an intelligent switch according to claim 8, characterized in that, The optimized multi-scale traffic feature understanding vector is passed through a classifier to obtain a classification result, including: using the fully connected layer of the classifier to perform a nonlinear mapping on the optimized multi-scale traffic feature understanding vector to obtain a mapped feature vector; inputting the mapped feature vector into the Softmax function of the classifier to obtain the probability value of the optimized multi-scale traffic feature understanding vector belonging to each warning level; and determining the warning level corresponding to the largest probability value as the classification result.
10. An apparatus comprising: A processor and a memory, wherein the memory stores a computer-executable program, which, when executed by the processor, implements the method for monitoring and early warning of network traffic based on the process layer of a smart switch, as described in any one of claims 1-9.