Network cutover control method and device, electronic equipment and medium

Abstract

The invention provides a network cutover control method and device, electronic equipment and a medium, and relates to the technical field of network security. The network cutover control method comprises the following steps: in response to a cutover command issued by a network administrator, verifying the cutover command according to a historical cutover command to obtain a first cutover command; based on the context of the first cutover command and a preset command template, generating a target command set through a large language model; and predicting target execution time of the target cutover command in the target command set, and controlling the target cutover command to run at the target execution time. Through the technical scheme provided by the invention, the problems of high security risk, low flexibility and low efficiency of network cutover in related technologies are solved, and the security, flexibility and efficiency of network cutover are improved.

Description

Technical Field

[0001] This disclosure relates to the field of network security, and in particular to a network cutover control method, apparatus, electronic device, and medium. Background Technology

[0002] In related technologies, the erroneous issuance of commands not included in cutover solutions during network upgrades or maintenance increases operational risks and impacts network stability. Secondly, existing management systems lack automatic adaptation to different cutover scenarios and cannot provide customized command sets for specific scenarios. Furthermore, there is a correlation between cutover time and cutover commands, while cutover management solutions lack consideration of the time factor. In short, network cutover in related technologies suffers from high security risks, low flexibility, and low efficiency. Summary of the Invention

[0003] This disclosure provides a network cutover control method, apparatus, electronic device, and medium to address the problems of high security risks, low flexibility, and low efficiency in network cutover in related technologies. It prevents the issuance of unauthorized commands through command verification, improves operational adaptability and accuracy by customizing command sets based on scenarios using cutover commands, and achieves intelligent control of operation time by learning the correlation rules between cutover commands and execution time. This ensures that operation requests outside of specified times can be effectively managed and controlled, guaranteeing the security and compliance of network operations and enhancing the security management capabilities of network cutover operations.

[0004] A first aspect of this disclosure provides a network cutover control method, the method comprising:

[0005] In one embodiment of this disclosure, verifying the cutover command to obtain a first cutover command based on historical cutover commands includes:

[0006] Extract the first feature vector of the cutover command;

[0007] Determine the similarity between the second feature vector and the first feature vector of the historical cutover command;

[0008] Determine if the similarity is greater than or equal to a preset threshold. If it is, set the cutover command as a valid command; otherwise, set the cutover command as an invalid command.

[0009] Set the valid command as the first cutover command.

[0010] In one embodiment of this disclosure, a target command set is generated using a large language model based on the context of a first cutover command and a preset command template, including:

[0011] The prompts are built based on the large language model of the cutover documents and communication records. The cutover scenarios are identified from the preset scenarios. The cutover documents include the context of the historical cutover commands and the first cutover command. The communication records include the interaction information between the historical cutover commands and the device to be cut over.

[0012] Based on the first command template corresponding to the cutover scenario, a second command template is constructed through a knowledge graph. The second command template has a higher adaptability to the cutover scenario than the first command template.

[0013] Based on the second command template, the target command set is generated using a large language model.

[0014] In one embodiment of this disclosure, predicting the target execution time of a target cutover command in a target command set includes:

[0015] Based on the cutover instructions and their corresponding execution times in the historical cutover commands, determine the association rules between cutover instructions and execution times;

[0016] Based on the target command set and association rules, the target execution time of the target cutover command is predicted using a long short-term memory network.

[0017] In one embodiment of this disclosure, after setting the valid command as the first cutover command, the method further includes:

[0018] Anomaly detection is performed on illegal commands. If an illegal command is found to be abnormal, its feature vector is extracted and added to the second feature vector.

[0019] Based on the target cutover command, we visualize the weighted heatmap of the target cutover command in the current network state through attention mechanism and gradient weighted class activation mapping.

[0020] In one embodiment of this disclosure, the control target cutover command runs at execution time, including:

[0021] Control the execution of the target cutover command during execution time, and provide feedback on the execution status of the target cutover command through the TACACS+ protocol.

[0022] In one embodiment of this disclosure, the method further includes:

[0023] Based on the network administrator's historical operation records and network status, reinforcement learning is used to determine the target cutover permissions for the network administrator. The target cutover command is executed by the network administrator with the target cutover permission.

[0024] A second aspect of this disclosure provides a network cutover control device, the device comprising:

[0025] The verification module is used to respond to the cutover command issued by the network administrator, and to verify the cutover command based on the historical cutover commands to obtain the first cutover command;

[0026] The generation module is used to generate the target command set based on the context of the first cutover command and the preset command template through a large language model;

[0027] The execution module is used to predict the target execution time of the target cutover commands in the target command set and control the target cutover commands to run at the target execution time.

[0028] A third aspect of this disclosure provides an electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform any of the methods described in the first aspect of this disclosure.

[0029] A fourth aspect of this disclosure provides a non-transitory computer-readable storage medium storing computer instructions, characterized in that the computer instructions are used to cause a computer to perform the method described in the first aspect of this disclosure.

[0030] In summary, the network cutover control method proposed in this disclosure achieves the following beneficial effects: In response to a cutover command issued by the network administrator, a first cutover command is obtained by verifying the command based on historical cutover commands, thus improving the security of network cutover; based on the context of the first cutover command and a preset command template, a target command set is generated through a large language model, and a customized target command set is generated according to the cutover scenario, improving the flexibility of network cutover; the target execution time of the target cutover command in the target command set is predicted, and the target cutover command is controlled to run at the target execution time, i.e., the target cutover command is automatically executed at the target execution time, improving the efficiency of network cutover. This enhances the security control capabilities of network cutover operations.

[0031] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0032] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0033] Figure 1 This is a flowchart of a network cutover control method according to an embodiment of the present disclosure;

[0034] Figure 2This is a flowchart illustrating how a first cutover command is obtained by verifying a cutover command based on historical cutover commands, according to an embodiment of this disclosure.

[0035] Figure 3 This is a flowchart illustrating how a target command set is generated using a large language model based on the context of a first cutover command and a preset command template, according to an embodiment of this disclosure.

[0036] Figure 4 This is a flowchart illustrating the target execution time of a target cutover command in a target command set according to an embodiment of the present disclosure.

[0037] Figure 5 This is a schematic diagram of the structure of a network cutover control device according to an embodiment of the present disclosure;

[0038] Figure 6 This is a block diagram illustrating an electronic device for implementing the network cutover control method of this disclosure, according to an exemplary embodiment.

[0039] Figure 7 This is a schematic diagram of the chip structure according to an embodiment of the present disclosure. Detailed Implementation

[0040] Embodiments of this disclosure are described in detail below, with examples of embodiments shown in the accompanying drawings, wherein the same or similar reference numerals identify the same or similar originals or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this disclosure, and should not be construed as limiting this disclosure.

[0041] First, let's briefly introduce the relevant terms used in this disclosure:

[0042] Network cutover: In this disclosure, it refers to operations performed on network lines or equipment that are in use and that may affect the services carried on them. Network cutover typically involves physical or logical changes, such as replacing switch ports or reconnecting lines.

[0043] Large Language Models (LLMs): In this disclosure, LLMs refer to deep learning-based artificial intelligence models designed to understand and generate natural language. These models are trained on massive amounts of text data to learn the structure and semantics of language, enabling them to perform various natural language processing tasks such as text generation, translation, and sentiment analysis. Large language models typically have billions of parameters and employ advanced architectures such as the Transformer, making them excellent at handling complex language patterns. Notable examples include OpenAI's GPT-3 and Google's BERT, which have garnered significant attention for their powerful language understanding capabilities.

[0044] Long Short-Term Memory (LSTM): In this disclosure, LSTM refers to a special type of Recurrent Neural Network (RNN) designed to address the shortcomings of traditional RNNs in handling long-term dependencies. LSTM effectively manages the storage and transmission of information by introducing memory units and multiple gating mechanisms (such as forget gates, input gates, and output gates), thus retaining important information while ignoring irrelevant information. The core of LSTM lies in its cell state, which allows information to remain unchanged over long periods of time. The forget gate determines which information needs to be discarded, the input gate controls the addition of new information, and the output gate determines which information to extract from the cell state as output. This structure makes LSTM perform exceptionally well in tasks such as natural language processing and time series prediction, capable of capturing complex patterns and long-range dependencies in data.

[0045] Terminal Access Controller Access-Control System Plus (TACACS+): In this disclosure, it refers to a protocol used for network security. It is primarily used for centralized management of authentication, authorization, and accounting (AAA) functions of network devices, and is widely used in the security management of devices such as routers, switches, and firewalls. TACACS+ is an evolution of the earlier TACACS protocol, providing more powerful functionality and flexibility.

[0046] In current network security management practices, Splunk is used to collect and index network device log data in real time, and search and analysis engines are used to quickly retrieve and analyze key information. Baselines and thresholds need to be set in the system to monitor cutover operations and trigger alarms when abnormal behavior is detected. By displaying cutover data, monitoring personnel can understand the network status and cutover progress. This disclosure focuses on using Simple Network Management Protocol (SNMP) technology to collect network change information for network devices, providing only information on changes from unauthorized operations, allowing maintenance personnel to identify and resolve operational problems afterward.

[0047] While various technologies and methods have been applied to improve network operation security, shortcomings remain. First, existing technologies often fail to effectively prevent cutover personnel or network administrators from mistakenly issuing commands not included in the cutover plan during network upgrades or maintenance. This not only increases operational risks but may also negatively impact network stability. Second, existing management systems often lack the ability to intelligently identify different cutover scenarios and cannot provide customized command sets based on specific scenarios, resulting in a lack of flexibility and adaptability in cutover operation management solutions. Furthermore, existing technologies lack necessary learning and control mechanisms when handling the correlation between cutover time and commands, failing to intelligently adjust operation permissions and command execution based on time factors. Finally, existing permission settings and authentication model adjustment mechanisms are not flexible enough to adapt to rapidly changing network operation needs, especially in the face of emergencies or special operational requirements, failing to respond and adjust in a timely manner.

[0048] To address the aforementioned issues, this disclosure proposes a network cutover control method that aims to overcome the limitations of existing technologies by combining the TACACS protocol with advanced artificial intelligence technology. This disclosure not only learns and identifies commands in the cutover scheme to prevent the issuance of unauthorized commands, but also intelligently adjusts the command set according to different cutover scenarios, improving the adaptability and accuracy of operations. By learning the association rules between cutover time and commands, intelligent control of operation time is achieved, ensuring that operation requests outside the specified time are effectively managed and controlled. This disclosure also provides flexible permission settings and authentication model adjustment functions, enabling rapid adjustment of permission policies based on real-time network status and operational needs, ensuring the security and compliance of network operations. This disclosure can improve the security and efficiency of high-value bearer networks during cutover operations.

[0049] The method proposed in this disclosure is applied to network cutover control tasks, and its application scenarios are diverse, mainly including the following aspects:

[0050] In network security management scenarios, especially in high-value bearer networks, this proposal addresses the security shortcomings of existing technologies during network cutover operations by combining AI technology and the TACACS+ protocol. It significantly improves network operational security and efficiency, requiring only low hardware specifications—network devices must support TACACS+ and interface with a management server. It is universally applicable to almost all networks in the market. It greatly enhances the daily maintenance security of carrier networks and large and medium-sized enterprise networks, effectively helping relevant enterprises prevent and mitigate substantial economic losses caused by network cutover failures. In communication and network operation scenarios, it can be used for network cutover and convergence. In the communications industry, this solution can be used to upgrade, expand, and transform network equipment, supporting seamless cutovers and uninterrupted user service, improving user experience and satisfaction. In data center management scenarios, it can be used for equipment replacement and configuration changes. In data center environments, this solution effectively manages equipment replacement and configuration changes, improving management efficiency and reducing the risk of human error through intelligent command set generation. In carrier network optimization scenarios, this solution can be used for network simulation and evaluation. It is suitable for network cutover simulation, evaluating and optimizing cutover solutions by simulating different cutover scenarios, reducing risks in actual operation, and improving delivery quality and efficiency. In automated operation and maintenance scenarios, it can be used in intelligent operation and maintenance systems. Combined with natural language processing technology, this solution can automatically understand and process complex text commands, suitable for operation and maintenance scenarios requiring efficient command issuance and feedback. In the field of education and training, it can be used in training simulation systems to train engineers in actual cutover operations. Through a simulation environment, it helps them become familiar with cutover procedures and risk control measures, improving their ability to cope with emergencies. Through these application scenarios, this technical solution not only improves the security and efficiency of network cutover operations but also has wide applicability to various industries and technical fields. The application scenarios are not limited in the embodiments disclosed herein.

[0051] The network cutover control method provided in this disclosure will be described in detail below with reference to the accompanying drawings.

[0052] Figure 1 This is a flowchart illustrating a network cutover control method according to an embodiment of this disclosure. This method can be executed in the control device of a network device. Figure 1 The network cutover control method shown in the embodiment includes:

[0053] Step 101: In response to the network administrator issuing a cutover command, verify the cutover command based on historical cutover commands to obtain the first cutover command.

[0054] A cutover command is a command issued by a network administrator when performing a network cutover task. Historical cutover commands are those used in previous cutover tasks. The first cutover command is a command that can be used for network cutover without causing cutover problems.

[0055] After the network administrator issues the cutover command, the network device analyzes the cutover command based on the feature database of normal cutover commands formed from historical cutover commands to verify whether the cutover command is a valid instruction. If it is, the valid cutover command is used as the first cutover command.

[0056] Step 102: Based on the context of the first cutover command and the preset command template, generate the target command set through the large language model.

[0057] The preset command template refers to the cutover command template pre-designed by the network administrator and corresponding to the target scenario associated with the context of the first cutover command. The target command set refers to the set of cutover commands used to complete the network cutover task. Based on the context of the first cutover command, the target cutover scenario can be analyzed. Using the target cutover scenario and the preset command template as prompts for the large language model, the target command set is generated through the large language model.

[0058] Step 103: Predict the target execution time of the target cutover command in the target command set, and control the target cutover command to run at the target execution time.

[0059] A target cutover command refers to any cutover command in the target command set. The target execution time refers to the time period within which the target cutover command can successfully perform the cutover. For example, data migration in large networks preferentially uses the early morning as the target execution time.

[0060] In summary, the network cutover control method proposed in this disclosure, in response to a cutover command issued by the network administrator, verifies the cutover command based on historical cutover commands to obtain a first cutover command, thereby improving the security of network cutover; based on the context of the first cutover command and a preset command template, a target command set is generated through a large language model, and a customized target command set is generated according to the cutover scenario, improving the flexibility of network cutover; the target execution time of the target cutover command in the target command set is predicted, and the target cutover command is controlled to run at the target execution time, that is, the target cutover command is automatically executed at the target execution time, improving the efficiency of network cutover. This enhances the security control capabilities of network cutover operations.

[0061] Figure 2 This is a flowchart illustrating how a first cutover command is obtained by verifying a cutover command based on historical cutover commands, according to an embodiment of this disclosure. Figure 2 Yes Figure 1 Further explanation of step 101, based on Figure 2The illustrated embodiment includes the following steps:

[0062] Step 201: Extract the first feature vector of the cutover command.

[0063] The first feature vector refers to the features extracted from the cutover command through a feature extraction network. Optionally, a vector representation of the features can be extracted from the cutover command using a word embedding model such as Word2Vec or GloVe.

[0064] Step 202: Determine the similarity between the second feature vector and the first feature vector of the historical cutover command.

[0065] The second feature vector refers to the feature library composed of feature vectors extracted from historical cutover commands using the same feature extraction network as the one used to extract the first feature vector. The historical cutover commands consist of normal cutover commands. The similarity between the first and second feature vectors is calculated to determine the degree of similarity with normal cutover commands.

[0066] Step 203: Determine whether the similarity is greater than or equal to the preset threshold. If yes, set the cutover command as a valid command; otherwise, set the cutover command as an invalid command.

[0067] Legitimate commands are those permitted and approved during the cutover process. Legitimate commands typically possess characteristics such as conforming to equipment operating specifications, undergoing testing and verification, and having a rollback mechanism. Illegitimate commands, on the other hand, are those that could affect the normal operation of the cutover. To determine whether a cutover command is legitimate, it is necessary to check if the similarity value is greater than or equal to a preset threshold. If the similarity is greater than or equal to the preset threshold, the cutover command is set as legitimate; if the similarity is less than the preset threshold, the cutover command is set as illegitimate.

[0068] Step 204: Set the valid command as the first cutover command.

[0069] If the cutover command is a valid command, then set the valid command as the first cutover command.

[0070] In this embodiment, the security of the cutover command was verified by comparing the feature similarity between the cutover command and historical cutover commands.

[0071] In one embodiment of this invention, deep learning algorithms, particularly convolutional neural networks and recurrent neural networks in supervised learning, are used to perform pattern recognition and feature extraction on historical cutover schemes. By constructing a multi-dimensional feature space F = {f1, f2, ..., fn} containing historical cutover commands, the inherent patterns of legitimate commands are learned. For new command issuance requests, the system verifies their legitimacy using a feature matching metric M(x, F), where x is the command to be verified and M is the matching function. This cutover scenario library can continuously update itself to adapt to new cutover strategies and changes in the network environment. Specifically, it consists of the following four execution steps:

[0072] (1) Data Preprocessing and Feature Engineering: Before model training, the cutover command data is cleaned, standardized, and normalized to eliminate data inconsistencies and noise. The most representative command features are selected using the Mutual Information (MIS) and Recursive Feature Emission (RFE) algorithms. A deep neural network with multiple hidden layers is trained using a large amount of labeled data (labeled data contains information about each cutover command in the text data, such as the semantics and implementation effects of the cutover commands) to learn the complex nonlinear relationships between commands. The network weights are optimized and the loss function L is minimized using the backpropagation algorithm and gradient descent. The loss function can be expressed using the mean squared error formula: Among them, y * y and y represent the annotation cutover command and the cutover command to be identified, respectively.

[0073] (2) Command Verification Process: When the cutover personnel initiate a command issuance request, the system first extracts the feature vector x of the command. Then, using a pre-trained deep learning model, it calculates the similarity score between the command and the legal commands in the feature library F. If the similarity exceeds a preset threshold θ, the command is considered legal; otherwise, the command will be rejected and an alarm will be issued.

[0074] This invention employs a deep neural network-based cutover scheme learning and command verification mechanism. The input data to the deep neural network model is set to text data containing cutover commands, and the output data is the similarity score between each cutover command and existing legitimate commands. This disclosure effectively prevents the issuance of unauthorized commands, ensuring the security and accuracy of cutover operations. It also provides adaptive learning and anomaly detection capabilities to address the ever-changing network environment and potential network cutover security threats.

[0075] Figure 3 This is a flowchart illustrating how a target command set is generated using a large language model based on the context of a first cutover command and a preset command template, as an embodiment of this disclosure. Figure 3 Yes Figure 1Further explanation of step 102, based on Figure 3 The illustrated embodiment includes the following steps:

[0076] Step 301: Construct prompts for a large language model based on cutover documents and communication records, identify cutover scenarios from preset scenarios, the cutover documents include historical cutover commands and the context of the first cutover command, and the communication records include interaction information between historical cutover commands and the device to be cut over.

[0077] A cutover document refers to the document that must be followed to complete the cutover, including command information such as historical cutover commands and the context of the first cutover command. Communication records refer to the interaction information between the network device controlling the cutover task and the device to be cut over. Based on the cutover document and communication records, prompts for a large language model can be constructed. These prompts can then be used to identify cutover scenarios from multiple preset scenarios using the large language model.

[0078] Step 302: Based on the first command template corresponding to the cutover scenario, a second command template is constructed using a knowledge graph. The second command template has a higher adaptability to the cutover scenario than the first command template.

[0079] The first command template is designed by the network administrator based on a preset cutover scenario. The second command template is obtained by removing logical conflicts and duplicates from the first command template for the device controlling the network cutover.

[0080] Different cutover scenarios have different command templates. Based on a defined cutover scenario, the corresponding first command template is indexed. Based on the first command template, the commands in the first command template are reconstructed into a second command template using a knowledge graph. The second command template has a higher adaptability to the cutover scenario compared to the first command template.

[0081] Step 303: Generate the target command set using the large language model based on the second command template.

[0082] Using the second command template, construct prompt words for the large language model, and generate the target command set through the large language model.

[0083] This disclosure generates customized target command sets based on the cutover scenario, improving the flexibility of network cutover. It also enables intelligent management of network cutover operations, eliminating the need for large-scale, scenario-specific pre-built cutover command libraries. Commands can be automatically converted from plans into usable commands, improving cutover management efficiency. Because it can adapt to any scenario without pre-setting, it increases the system's applicability and allows for large-scale deployment, significantly reducing the risk of human error. Furthermore, the adaptive learning capability and interpretable decision-making of this proposal further enhance the system's compatibility and universal applicability.

[0084] Figure 4 This is a flowchart illustrating the target execution time of a target cutover command in a target command set according to an embodiment of the present disclosure. Figure 4 Yes Figure 1 The specific explanation of step 103 is based on Figure 4 The illustrated embodiment includes the following steps:

[0085] Step 401: Determine the association rules between cutover instructions and execution times based on the cutover instructions and their corresponding execution times in the historical cutover commands.

[0086] Based on the cutover instructions and their execution times in the historical cutover commands, determine the association rules between cutover instructions and execution times. For example, start cutover instructions are usually triggered in the early morning or at night.

[0087] Step 402: Based on the target command set and association rules, predict the target execution time of the target cutover command using a long short-term memory network.

[0088] Based on the target command set ultimately used for the cutover task and the association rules related to the execution time of the cutover commands, the target execution time of the target cutover commands is predicted using LSTM.

[0089] In one embodiment of this invention, time series analysis is used, optionally employing an LSTM model, to learn the correlation between cutover time and instructions. By defining a time window W and an instruction set I, the system can predict and control the probability P(i|W) of instruction issuance within a given time window, where i is the instruction and P is a conditional probability function. The time series feature extraction algorithm uses time series analysis methods, such as Time Decomposition or Empirical Mode Decomposition (EMD), to extract features from the time data of the cutover operation. These features include timestamps, durations, periodic patterns, etc., providing a foundation for subsequent correlation analysis. Specifically, the following three dimensions are used for correlation analysis.

[0090] (1) Temporal association rule mining: Using the PrefixSpan sequence mining technique, association rules between time patterns and cutover instructions are discovered. These rules are used to define the tendency and suitability of executing certain instructions within a specific time window.

[0091] (2) LSTM-based time series prediction model: Considering the continuity and dynamism of time data, an LSTM-based time series prediction model is constructed. This model can capture long-term dependencies in time series and predict cutover instruction requirements at future time points. Combining the prediction results of the LSTM model with real-time time data, the system can intelligently recommend instructions suitable for execution at the current or future specific time points. This recommendation mechanism considers the impact of time factors on network operation security and efficiency.

[0092] (3) Real-time monitoring and dynamic adjustment: The system monitors the current network status and cutover progress in real time and dynamically adjusts the command execution plan. When a time delay or early completion is detected, the system can update the control command library in a timely manner to adapt to the actual cutover operation process. At the same time, by analyzing the time data of the cutover operation, it automatically identifies abnormal time patterns, such as unexpected delays or operations occurring during abnormal periods. Combining anomaly detection algorithms in machine learning, the system can intelligently identify potential risks and take preventive measures, maximizing cutover safety without delaying unexpected operations.

[0093] By associating cutover time with cutover commands using a learning algorithm, not only is the time efficiency of network cutover operations improved, but the security and adaptability of the operations are also enhanced. The algorithm's adaptive learning capability and real-time monitoring mechanism ensure that cutover operations can be executed safely and on time, in accordance with control requirements, even in complex and ever-changing network operating environments.

[0094] In one possible embodiment of this disclosure, anomaly detection is performed on illegal commands. If an illegal command is found to be abnormal, its feature vector is extracted and added to a second feature vector. To facilitate more accurate and continuous detection of abnormal commands, anomaly detection is performed on illegal commands. If the illegal command differs from existing illegal instructions, it is treated as an abnormal command, its feature vector is extracted, and added to the second feature vector.

[0095] In one embodiment of this invention, to enhance the system's robustness, an anomaly detection mechanism based on Isolation Forest is integrated to identify and handle abnormal or malicious command requests. Simultaneously, the system possesses adaptive learning capabilities, enabling it to continuously adjust and optimize the illegal signature database based on the latest cutover practices.

[0096] In this context, "isolated forest" refers to a forest where the number of anomalous samples is small and requires fewer steps to isolate them. Normal samples are spatially distributed and have a high density, thus requiring more segmentation steps. Anomalous samples, on the other hand, are not only fewer in number but also scattered, requiring fewer segmentation steps. In cutover command anomaly detection, isolated tree segmentation training is performed on the cutover command. A smaller number of segmentation steps allows the cutover command to be identified as an anomalous command.

[0097] In one possible embodiment of this disclosure, a weighted heatmap of the target cutover command in the current network state is visualized based on the target cutover command using an attention mechanism and a gradient-weighted class activation mapping (Grad-CAM) method. To improve the interpretability of the system, we employ an attention mechanism and gradient-weighted class activation mapping (Grad-CAM) to visualize the model's decision-making process, enabling network administrators to understand the basis of the model's predictions.

[0098] In one embodiment of this invention, an attention mechanism can be used to identify key and important command symbols in the cutover command, enabling better identification of the function and scenario of the cutover command. By combining the attention mechanism and the Grad-CAM algorithm, network administrators can view the feature heatmap of the cutover command output at a specific convolutional layer in the deep neural network in real time, thus intuitively seeing the system's decision-making basis and process. The key idea of ​​this visualization principle, Grad-CAM, is to multiply the gradient of the output class (relative to the output of a specific convolutional layer) with the output of that layer, and then take the average to obtain a "coarse" heatmap Q. This heatmap can be magnified and superimposed on the original image to show the region that the model focuses on most during classification.

[0099] The specific implementation steps are as follows:

[0100] 1. Select a convolutional layer as the source of interpretation. The last convolutional layer in the network is usually chosen because it contains both high-level features and preserves spatial information.

[0101] 2. Propagate the image forward to the network to obtain the score of the category to be explained.

[0102] 3. Calculate the gradient of this score relative to the output of the selected convolutional layer.

[0103] 4. For each channel of this convolutional layer, the channel is weighted using the global average of the gradients described above.

[0104] 5. Obtain a weighted heatmap Q with the same spatial dimensions as the convolutional layer.

[0105] In one possible embodiment of this disclosure, Figure 4 Building upon step 402, the target cutover command is executed during the specified time, and its execution status is fed back via the TACACS+ protocol. When the network device supports the TACACS+ protocol, the execution status of the target cutover command and the authorization result for the network administrator are fed back in real time through this protocol.

[0106] In one possible embodiment of this disclosure, target cutover permissions are determined for the network administrator based on the network administrator's historical operation records and network status through reinforcement learning, wherein the target cutover command is executed by the network administrator with the target cutover permissions.

[0107] In one embodiment of this invention, an access control framework based on network administrators is designed, combining attributes and access control policies to achieve fine-grained permission management. Utilizing reinforcement learning algorithms from machine learning, the system can dynamically adjust the authentication model based on network status and operation history, optimizing the permission allocation policy π = h(H, A), where H is the operation history, A is the network status, and h is the policy update function.

[0108] Corresponding to the methods provided in the above embodiments, this disclosure also provides a network cutover control device. Since the device provided in this disclosure corresponds to the methods provided in the above embodiments, the implementation of the methods is also applicable to the device provided in this embodiment, and will not be described in detail in this embodiment.

[0109] Figure 5 This is a schematic diagram of the structure of a network cutover control device 500 according to an embodiment of this disclosure. Figure 5 As shown, the network cutover control device includes:

[0110] The verification module 510 is used to respond to the cutover command issued by the network administrator, and verify the cutover command to obtain the first cutover command based on the historical cutover commands.

[0111] The generation module 520 is used to generate a target command set based on the context of the first cutover command and a preset command template through a large language model.

[0112] The execution module 530 is used to predict the target execution time of the target cutover command in the target command set and control the target cutover command to run at the target execution time.

[0113] In some embodiments, the verification module 510 is used for:

[0114] Extract the first feature vector of the cutover command;

[0115] Determine the similarity between the second feature vector and the first feature vector of the historical cutover command;

[0116] Determine if the similarity is greater than or equal to a preset threshold. If it is, set the cutover command as a valid command; otherwise, set the cutover command as an invalid command.

[0117] Set the valid command as the first cutover command.

[0118] In some embodiments, the generation module 520 is used for:

[0119] The prompts are built based on the large language model of the cutover documents and communication records. The cutover scenarios are identified from the preset scenarios. The cutover documents include the context of the historical cutover commands and the first cutover command. The communication records include the interaction information between the historical cutover commands and the device to be cut over.

[0120] Based on the first command template corresponding to the cutover scenario, a second command template is constructed through a knowledge graph. The second command template has a higher adaptability to the cutover scenario than the first command template.

[0121] Based on the second command template, the target command set is generated using a large language model.

[0122] In some embodiments, the execution module 530 predicts the target execution time of the target cutover command in the target command set in the following manner:

[0123] Based on the cutover instructions and their corresponding execution times in the historical cutover commands, determine the association rules between cutover instructions and execution times;

[0124] Based on the target command set and association rules, the target execution time of the target cutover command is predicted using a long short-term memory network.

[0125] In some embodiments, after setting the valid command as the first cutover command, the verification module 510 is further configured to:

[0126] Anomaly detection is performed on illegal commands. If an illegal command is found to be abnormal, its feature vector is extracted and added to the second feature vector.

[0127] Based on the target cutover command, we visualize the weighted heatmap of the target cutover command in the current network state through attention mechanism and gradient weighted class activation mapping method.

[0128] In some embodiments, the execution module 530 controls the target cutover command to run at execution time in the following manner:

[0129] Control the execution of the target cutover command during execution time, and provide feedback on the execution status of the target cutover command through the TACACS+ protocol.

[0130] In some embodiments, the device 500 is further configured to:

[0131] Based on the network administrator's historical operation records and network status, reinforcement learning is used to determine the target cutover permissions for the network administrator. The target cutover command is executed by the network administrator with the target cutover permission.

[0132] In summary, the network cutover control device responds to cutover commands issued by the network administrator, verifies the commands based on historical cutover commands to obtain a first cutover command, generates a target command set based on the context of the first cutover command and a preset command template, and predicts the target execution time of the target cutover commands in the target command set, controlling the target cutover commands to run at the target execution time. This device solves the problems of high security risks, low flexibility, and low efficiency in network cutover in related technologies, improving the security, flexibility, and efficiency of network cutover.

[0133] The methods and apparatus provided in the embodiments of this disclosure have been described above. To implement the functions of the methods provided in the embodiments of this disclosure, the electronic device may include a hardware structure and software modules, and may implement the above functions in the form of a hardware structure, software modules, or a hardware structure plus software modules. One of the above functions may be executed in the form of a hardware structure, software modules, or a hardware structure plus software modules.

[0134] Figure 6 This is a block diagram illustrating an electronic device 600 for implementing the network cutover control method described above, according to an exemplary embodiment.

[0135] For example, electronic device 600 can be a mobile phone, computer, messaging device, game console, tablet device, medical device, fitness equipment, personal digital assistant, etc.

[0136] Reference Figure 6 The electronic device 600 may include one or more of the following components: a processing component 602, a memory 604, a power supply component 606, a multimedia component 608, an audio component 610, an input / output (I / O) interface 612, a sensor component 614, and a communication component 616.

[0137] Processing component 602 typically controls the overall operation of electronic device 600, such as operations associated with display, telephone calls, data communication, camera operation, and recording operations. Processing component 602 may include one or more processors 620 to execute instructions to perform all or part of the steps of the methods described above. Furthermore, processing component 602 may include one or more modules to facilitate interaction between processing component 602 and other components. For example, processing component 602 may include a multimedia module to facilitate interaction between multimedia component 608 and processing component 602.

[0138] Memory 604 is configured to store various types of data to support the operation of electronic device 600. Examples of this data include instructions for any application or method operating on electronic device 600, contact data, phonebook data, messages, pictures, videos, etc. Memory 604 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0139] Power supply component 606 provides power to various components of electronic device 600. Power supply component 606 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to electronic device 600.

[0140] Multimedia component 608 includes a screen that provides an output interface between electronic device 600 and user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 608 includes a front-facing camera and / or a rear-facing camera. When electronic device 600 is in an operating mode, such as a shooting mode or video mode, the front-facing camera and / or rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

[0141] Audio component 610 is configured to output and / or input audio signals. For example, audio component 610 includes a microphone (MIC) configured to receive external audio signals when electronic device 600 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 604 or transmitted via communication component 616. In some embodiments, audio component 610 also includes a speaker for outputting audio signals.

[0142] I / O interface 612 provides an interface between processing component 602 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.

[0143] Sensor assembly 614 includes one or more sensors for providing state assessments of various aspects of electronic device 600. For example, sensor assembly 614 may detect the on / off state of electronic device 600, the relative positioning of components such as the display and keypad of electronic device 600, changes in position of electronic device 600 or a component of electronic device 600, the presence or absence of user contact with electronic device 600, orientation or acceleration / deceleration of electronic device 600, and temperature changes of electronic device 600. Sensor assembly 614 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 614 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, sensor assembly 614 may also include an accelerometer, gyroscope, magnetometer, pressure sensor, or temperature sensor.

[0144] Communication component 616 is configured to facilitate wired or wireless communication between electronic device 600 and other devices. Electronic device 600 can access wireless networks based on communication standards, such as WiFi, 2G or 3G, 4G LTE, 5G NR (NewRadio), or combinations thereof. In one exemplary embodiment, communication component 616 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 616 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0145] In an exemplary embodiment, the electronic device 600 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.

[0146] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 604 including instructions, which can be executed by a processor 620 of an electronic device 600 to perform the above-described method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0147] Embodiments of this disclosure also propose a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute the network cutover control method described in the above embodiments of this disclosure.

[0148] Embodiments of this disclosure also provide a computer program product, including a computer program that is executed by a processor using the network cutover control method described in the above embodiments of this disclosure.

[0149] Figure 7 This is a schematic diagram of the structure of a chip 700 for implementing the above-described network cutover control method, according to an exemplary embodiment.

[0150] Reference Figure 7 The chip 700 includes at least one communication interface 701 and a processor 702; the communication interface 701 is used to receive signals input to the chip 700 or signals output from the chip 700, and the processor 702 communicates with the communication interface 701 and implements the network cutover control method described in the above embodiments through logic circuits or executing code instructions.

[0151] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0152] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in at least one embodiment or example of this disclosure. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0153] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of preferred embodiments of this disclosure includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the function involved, as will be understood by those skilled in the art to which embodiments of this disclosure pertain.

[0154] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processing module, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (control method), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic device, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0155] It should be understood that various parts of the embodiments of this disclosure can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0156] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0157] Furthermore, the functional units in the various embodiments of this disclosure can be integrated into a single processing module, or each unit can exist physically separately, or two or more units can be integrated into a single module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. The aforementioned storage medium can be a read-only memory, a hard disk, or an optical disk, etc.

[0158] Although embodiments of the present disclosure have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present disclosure. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present disclosure.

Claims

1. A network slicing control method, characterized by, The method comprises: in response to a network administrator issuing a cut-off command, verifying the cut-off command to obtain a first cut-off command according to historical cut-off commands; based on the context of the first cut-off command and a preset command template, generating a target command set through a large language model; predicting a target execution time of a target cut-off command in the target command set, and controlling the target cut-off command to run at the target execution time.

2. The method of claim 1, wherein, The verification of the cut-off command to obtain the first cut-off command according to the historical cut-off commands comprises: extracting a first feature vector of the cut-off command; determining the similarity between a second feature vector of the historical cut-off commands and the first feature vector; determining whether the similarity is greater than or equal to a preset threshold, if yes, setting the cut-off command as a legal command, otherwise, setting the cut-off command as an illegal command; setting the legal command as the first cut-off command.

3. The method of claim 1, wherein, The generation of the target command set based on the context of the first cut-off command and the preset command template through the large language model comprises: based on a cut-off document and a communication record, constructing a prompt of the large language model, identifying a cut-off scene from a preset scene, the cut-off document comprising the context of the historical cut-off commands and the first cut-off command, and the communication record comprising interaction information between the historical cut-off commands and a device to be cut off; based on a first command template corresponding to the cut-off scene, constructing a second command template through a knowledge graph, the adaptation degree of the second command template to the cut-off scene being higher than that of the first command template; generating the target command set through the large language model according to the second command template.

4. The method of claim 1, wherein, The prediction of the target execution time of the target cut-off command in the target command set comprises: determining an association rule between a cut-off instruction and an execution time in the historical cut-off commands according to the cut-off instruction and the execution time; predicting the target execution time of the target cut-off command through a long short-term memory network according to the target command set and the association rule.

5. The method of claim 2, wherein, After setting the legal command as the first cut-off command, the method further comprises: abnormality detection on the illegal command, if the illegal command is an abnormal command, extracting a feature vector of the illegal command and adding the feature vector to the second feature vector; based on the target cut-off command, visualizing a weighted heat map of the target cut-off command in a current network state through an attention mechanism and a gradient weighted class activation mapping method.

6. The method of claim 4, wherein, The control of the target cut-off command to run at the execution time comprises: controlling the target cut-off command to run at the execution time, and feeding back an execution state of the target cut-off command through a TACACS+ protocol.

7. The method of claim 1, wherein, The method further comprises: determining a target cut-off permission for the network administrator through reinforcement learning according to historical operation records and a network state of the network administrator, wherein the target cut-off command is executed by the network administrator with the target cut-off permission.

8. A network slicing control apparatus characterized by comprising: The device comprises: a verification module configured to verify a cut-off command to obtain a first cut-off command according to historical cut-off commands in response to a network administrator issuing the cut-off command. The generating module is configured to generate, by a large language model, a target command set based on a context of the first switchover command and a preset command template. The executing module is configured to predict a target execution time of a target switchover command in the target command set, and control the target switchover command to run at the target execution time.

9. An electronic device, comprising: Comprise: at least one processor; and a memory connected in communication with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-7.

10. A non-transitory computer-readable storage medium having stored thereon computer instructions, wherein, The computer instructions are used to enable the computer to perform the method of any one of claims 1-7.

Images