A network control and scheduling method based on traffic awareness and path optimization

Abstract

This invention discloses a network control and scheduling method based on traffic awareness and path optimization. It collects real-time traffic from network devices, extracts key features, and analyzes traffic pattern trends. Using these trends, the rule set is clustered according to the similarity of matching frequencies to form rule clusters. Within each cluster, rules are sorted based on matching frequency. The rule arrangement is analyzed to identify conflicting rule pairs. By assessing the severity of the conflicts, a conflict list with clear objectives is generated. This conflict list is then processed using a genetic algorithm to obtain an optimized rule sequence. Rigorous testing using simulated traffic yields a final rule set version. This final rule set version, passing all tests, is securely pushed to network devices, enabling real-time optimized access control list configuration. Network devices immediately operate based on the latest and optimal policies, thereby improving overall network security and data processing efficiency.

Description

Technical Field

[0001] This invention relates to the field of dynamic resource adjustment, and in particular to a network control and scheduling method based on traffic awareness and path optimization. Background Technology

[0002] In modern communication networks, subnet scheduling, as a key technology for optimizing resource allocation and improving network performance, plays a crucial role in ensuring data transmission efficiency and stability. With the rapid growth of user demands and the diversification of network applications, hotspot areas within a subnet—where traffic concentration occurs due to high-frequency access to certain nodes or regions—have become a core issue affecting overall network performance. Especially under high-load scenarios, such as large events or sudden incidents, traffic surges in hotspot areas can lead to congestion, resulting in delays or even service interruptions. Therefore, how to efficiently manage hotspot areas within a subnet and ensure dynamic resource allocation has become a major challenge that urgently needs to be addressed in the field of network scheduling. Existing methods for dealing with traffic congestion in hotspot areas often rely on static resource allocation strategies or simple real-time monitoring. These methods are typically based on fixed thresholds or rules for scheduling, making it difficult to adapt to rapid changes in traffic patterns. For example, when traffic in a hotspot area suddenly increases due to a sudden event, existing systems may not be able to identify potential risks in a timely manner and lack the ability to flexibly adjust resource allocation. Furthermore, existing methods often ignore the dynamic characteristics of time periodicity and user behavior changes when dealing with complex network environments, leading to inefficient resource allocation and frequent congestion problems in hotspot areas. In subnet scheduling, the core technical challenge lies in accurately predicting traffic changes in hotspot areas and dynamically optimizing resource allocation. The first key factor is the highly dynamic and uncertain access patterns in hotspot areas. Access patterns are not only affected by time periods (such as traffic differences between weekdays and weekends) but also fluctuate dramatically due to sudden events or changes in user behavior. For example, during a large-scale live broadcast, traffic in a specific area may surge in a short period, and existing scheduling systems struggle to quickly identify such pattern changes. The second key factor is insufficient allocation of processing capacity to remaining relay nodes. Backup relay nodes in the network are typically in standby mode, but when traffic surges in hotspot areas, quickly assessing the availability and allocation efficiency of these nodes becomes a bottleneck in resource scheduling. These two factors are interconnected: the dynamic nature of access patterns requires the system to have rapid prediction capabilities, and the accuracy of prediction directly affects the allocation efficiency of relay nodes. If traffic changes cannot be predicted in a timely manner, the activation of backup nodes and path optimization will lag, further exacerbating congestion. Therefore, how to quickly assess and allocate the processing capacity of remaining relay nodes based on the dynamic access patterns of hotspot areas in subnet scheduling becomes a key issue for network performance optimization. Summary of the Invention

[0003] The purpose of this invention is to provide a network control and scheduling method based on traffic awareness and path optimization, which solves the above-mentioned technical problems pointed out in the prior art.

[0004] This invention provides a network control and scheduling method based on traffic awareness and path optimization, comprising the following steps:

[0005] Real-time traffic data is obtained from network devices, traffic feature data is extracted from the real-time traffic data, and traffic feature distribution analysis is performed on the traffic feature data to obtain the trend of traffic pattern changes.

[0006] Obtain a preset rule set; based on the trend of traffic pattern changes, use a clustering algorithm to group the rule set into multiple rule clusters, and determine the rule arrangement sequence within each rule cluster;

[0007] Potential conflict pairs are obtained from the rule arrangement sequence. By comparing the overlap range of traffic feature data between each rule in the conflict pair, the conflict type and severity are determined, and a conflict list is obtained.

[0008] Based on the obtained conflict list, a genetic algorithm is used to iteratively optimize the rule arrangement, and the crossover and mutation positions of the rules in each generation are used to determine the optimized rule set version.

[0009] Obtain simulated traffic data, use the simulated traffic data to test the optimized rule set version, and obtain the test results, including matching time and filtering accuracy; if the test result is determined to be successful, then the optimized rule set version is confirmed as the final deployment version;

[0010] The system retrieves update instructions from the final deployment version, pushes rule sets through network device interfaces, determines the deployment completion status, and obtains real-time optimized access control list configurations.

[0011] Preferably, potential conflict pairs are obtained from the rule sequence, and the conflict type and severity are determined by comparing the overlap of conditions between the rules in each conflict pair, thus obtaining a conflict list, including the following steps:

[0012] Combine every two rules in the rule set to obtain a rule group. Traverse all rule groups in the rule overlap cluster and obtain the action information of the two rules in each rule group. Determine whether the two action information are completely identical. If the two actions are not completely identical, mark the corresponding rule group as a potential action conflict pair. Obtain the overlap degree of the potential action conflict pair.

[0013] Hierarchical clustering is used, a distance threshold is set, and each rule group is clustered according to the distance threshold to obtain multiple rule-overlapping clusters;

[0014] Temporal aliasing analysis was performed on the rule-overlapping clusters to calculate the conflict severity between each potential action conflict pair.

[0015] For each regular overlapping cluster, sort them from largest to smallest based on the severity of the maximum conflict between clusters to obtain a set of regular overlapping cluster sequences;

[0016] Within each rule-overlapping cluster, each rule pair is sorted by its approximate size based on the severity of each conflict, resulting in a set of inter-cluster rule pair sequences.

[0017] Based on the rule-overlapping cluster sequence set and the inter-cluster rule pair sequence set, each rule pair is sorted to obtain the conflict list.

[0018] Preferably, temporal aliasing analysis is performed on the regular overlapping clusters to calculate the conflict severity between each potential action conflict pair, including the following steps:

[0019] Obtain historical traffic data and extract the matching frequency time series for each rule from the historical traffic data;

[0020] Obtain business information from each historical traffic data point; obtain the importance weight value of each business information point in each time window; calculate the time-frequency aliasing conflict risk factor based on the importance weight value of each business information point in each time window and the matching frequency time series of any potential action conflict pair in the rule overlap cluster;

[0021] The severity of conflict for each potential action conflict pair is calculated based on the time-frequency aliasing conflict risk factor and the overlap of each potential action conflict pair.

[0022] Preferably, based on the obtained conflict list, a genetic algorithm is used to iteratively optimize the rule arrangement, determining the optimized rule set version by analyzing the crossover and mutation positions of rules in each generation, including the following steps:

[0023] Generate multiple regular sequences by arranging the sequence according to rules;

[0024] The average matching time for each rule sequence is obtained by simulating normal traffic tests; the rule fitness is calculated based on the average matching time for each rule sequence.

[0025] Determine if the rule fitness is greater than or equal to the rule fitness threshold. If so, determine if the corresponding rule sequence is a candidate rule sequence. Determine if there are any adjacent rules in the candidate rule sequence that belong to the conflict list. If so, perform a traffic stress test on the candidate rule sequence to filter and obtain the optimized rule set version.

[0026] If the fitness of a rule is less than the fitness threshold, then K rule sequences are randomly selected as sequences to be swapped, and the F sequences with the highest fitness are selected from the sequences to be swapped and added to the pool.

[0027] Pair each sequence to be exchanged in the mating pool to obtain parent rule sequence pairs; extract two intermediate sequences from the two sequences to be exchanged in the parent rule sequence pairs by randomly determining two intersection points; exchange the two intermediate sequences to obtain two second rule sequences; establish a mutation pool based on all second rule sequences; perform conflict-driven mutation processing on each second rule sequence in the mutation pool to obtain a third rule sequence; return the third rule sequence to the above steps for iterative execution until the optimized rule set version is output.

[0028] Preferably, the candidate rule sequence is filtered through traffic stress testing to obtain an optimized rule set version, including the following steps:

[0029] Acquire multiple traffic segments; traffic segments include normal traffic segments, burst traffic segments, periodic traffic segments, abnormal traffic segments, and mixed traffic segments; generate multiple traffic data packets for each traffic segment;

[0030] The candidate rule sequence is tested using each traffic data packet of each traffic segment to obtain test data. The test data includes the simulated matching time and the position of the simulated matching rule for each data packet. The simulated matching conflict frequency is obtained by combining the position of the simulated matching rule with the conflict list statistics. At the same time, for each rule cluster, the average simulated matching time and the standard deviation of the simulated matching time under each traffic segment are calculated based on the simulated matching time.

[0031] The traffic test fluctuation index is calculated by combining all traffic segments, rule clusters, collision frequency, average simulated matching time, and standard deviation of simulated matching time.

[0032] Determine whether the traffic test fluctuation index is less than or equal to the fluctuation index threshold; if so, determine that the candidate rule sequence is the optimized rule set version; if not, filter it out and do not perform any further processing.

[0033] Preferably, the traffic test volatility index is calculated by weighting and summing the average of the ratio of the standard deviation of the matching time of each rule cluster under each traffic segment to the average of the product of the standard deviation of the matching frequency of each conflict pair under all traffic segments and the conflict severity.

[0034] Preferably, for each second rule sequence in the mutation pool, a conflict-driven mutation process is performed to obtain a third rule sequence, including the following steps:

[0035] Traverse each second rule sequence in the mutation pool, scan all adjacent rule pairs in the second rule sequence, mark adjacent rule pairs in the conflict list as high-risk rule pairs, and record the conflict severity value of each high-risk rule pair;

[0036] The high-risk rule pairs are sorted from highest to lowest according to their conflict severity values ​​to obtain a conflict resolution sequence set;

[0037] The third rule sequence is obtained by sequentially performing rule exchange mutation processing and rule fragment exchange mutation processing operations from the conflict resolution sequence set.

[0038] In another aspect, the present invention also provides a storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-described network control and scheduling method based on traffic awareness and path optimization.

[0039] Compared with the prior art, the embodiments of the present invention have at least the following technical advantages:

[0040] Analysis of the network control and scheduling method based on traffic awareness and path optimization provided by the present invention shows that, in specific applications, real-time traffic is first collected from network devices (firewalls, routers, etc.), and key features such as source / destination addresses and protocol types are extracted to analyze traffic pattern trends. Then, using the analyzed traffic pattern trends, the rule set is clustered according to the similarity of matching frequency to form more manageable "rule clusters". Within each rule cluster, the rules are sorted according to the matching frequency to ensure that high-frequency rules are placed first, so that most data packets can be quickly matched after traversing a few rules, thereby significantly reducing the average matching latency.

[0041] Furthermore, by analyzing the rule arrangement, we identified rule pairs that might cause policy conflicts (such as one rule allowing while another denies) due to overlapping conditions (e.g., IP address, protocol). We then corrected the traffic signals that were simultaneously flashing green and red, ensuring that the behavior of data packets aligned with the administrator's design intent. Figure 1By assessing the severity of conflicts, a clearly defined conflict list is generated, providing clear targets for subsequent automated optimization and preventing security vulnerabilities or network failures caused by misconfigurations. Furthermore, using the conflict list as a guide, the system intelligently searches for rule arrangements that simultaneously satisfy high performance and low conflict by simulating selection, crossover, and mutation operations in biological evolution. This optimizes rule conflict issues and identifies globally more optimized rule sequences. Before deploying the optimized rule set to the real network, it undergoes rigorous testing using simulated traffic to ensure fast matching speed (matching time meets standards) and accurate filtering without violating existing security policies (filtering accuracy meets standards). Only rule sets that simultaneously meet both performance and accuracy criteria are confirmed, thus avoiding the deployment of flawed configurations to the production environment and improving deployment reliability. Finally, the final rule set version that passes all tests is securely pushed to network devices, enabling real-time optimized access control list configurations. Network devices immediately operate based on the latest and optimal policies, thereby improving overall network security and data processing efficiency. Attached Figure Description

[0042] Figure 1 This is a schematic diagram of the main process of a network control and scheduling method based on traffic awareness and path optimization.

[0043] Figure 2 This is a simulation diagram illustrating the matching frequency in a network control and scheduling method based on traffic awareness and path optimization.

[0044] Figure 3 This is a schematic diagram simulating rule conflicts in a network control and scheduling method based on traffic awareness and path optimization. Detailed Implementation

[0045] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0046] The present invention will now be described in further detail with reference to specific embodiments and accompanying drawings.

[0047] Example 1

[0048] like Figure 1 As shown, Embodiment 1 of the present invention provides a network control and scheduling method based on traffic awareness and path optimization, including the following steps:

[0049] Step S10: Obtain real-time traffic data from network devices, extract traffic feature data from the real-time traffic data, perform traffic feature distribution analysis on the traffic feature data, and obtain the traffic pattern change trend.

[0050] The aforementioned traffic characteristic data includes the source address, destination address, and protocol type of the data packets;

[0051] It should be noted that the above-described embodiments of this application identify the dynamic characteristics of network traffic (such as common source / destination addresses or protocol types) through real-time data parsing, revealing the changing trend of traffic patterns over time. This provides a data-driven basis for subsequent rule set adjustments, ensuring that rule optimization is based on actual network conditions rather than static assumptions. By analyzing the changing trend of traffic patterns, the transmission path characteristics of common data flows are identified, providing a foundation for subsequent rule set path optimization. This makes the rule arrangement more adaptable to the actual network traffic path patterns and reduces the path traversal overhead of data packets during the matching process.

[0052] Step S20: Obtain a preset rule set; based on the traffic pattern change trend, use a clustering algorithm to group the rule set to obtain multiple rule clusters (rule clusters are used to group rules with similar matching frequencies into the same cluster based on the traffic pattern change trend), and determine the rule arrangement sequence within the rule cluster;

[0053] It should be noted that the above embodiments of this application use clustering algorithms combined with traffic change trends to group rules according to the similarity of matching frequency, reducing the complexity of the rule set. In addition, the determination of the obtained rule arrangement sequence ensures that high-frequency rules are matched preferentially within the cluster, thereby improving the overall matching efficiency.

[0054] The rule set mentioned above is an access control list on network devices (such as firewalls, routers, and switches). It is the core policy for network traffic management and determines which traffic can be allowed and which should be blocked. Specifically, each rule in the rule set is like an "if...then..." statement, which defines the matching conditions (such as source IP address, destination IP address, protocol type, port number, etc.) and the corresponding actions (such as allow, reject and drop, log, etc.).

[0055] The processing in step S10 of the above-described embodiment of this application involves collecting real-time data packets from network devices, extracting key features (source address, destination address, protocol type), analyzing the distribution of these features, and summarizing the changing patterns of traffic (e.g., more traffic accessing internal servers during working hours, and more video protocol traffic at night). This provides a data-driven basis for the entire optimization process, allowing the system to know "what is happening" in the current network, rather than based on outdated assumptions. It also optimizes the basis and starting point for the rule set optimization, transforming it from "static, experience-driven" to "dynamic, data-driven."

[0056] Furthermore, in step S20 of this application, based on the traffic trend analyzed in S10, a clustering algorithm is used to group rules with similar matching frequencies in the rule set into the same group (rule cluster). Then, within each cluster, the rules are prioritized according to their matching frequency, the large rule set is split into smaller groups, and the most frequently matched rule is placed first in each group. This optimizes the organization of the rule set, reduces the average number of rules that a data packet needs to traverse when matching rules, thereby optimizing the matching speed (reducing latency).

[0057] For example, regarding the matching frequency mentioned above: Figure 2 As shown, the current network device firewall's access control list (ACL) contains the following rules:

[0058] Rule A: Allow IP range 192.168.1.0 / 24 to access server 10.0.0.1 (HTTP protocol);

[0059] Rule B: Deny IP address 192.168.1.100 access to any address;

[0060] Rule C: Allow IP address 172.16.0.1 to access database 10.0.0.2 (MySQL protocol);

[0061] During the statistical period (e.g., within 1 hour), the network device records the number of times each rule is hit by a data packet:

[0062] Rule A was hit 500 times (employees frequently access the web server);

[0063] Rule B was triggered twice (only specific violating IPs were involved);

[0064] Rule C was hit 50 times (occasionally by the database administrator);

[0065] Match frequency refers to the number of times a rule is matched per unit of time. For example:

[0066] Rule A: 500 times / hour

[0067] Rule B: 2 times / hour

[0068] Rule C: 50 times / hour;

[0069] High-frequency rules (such as rule A) are clustered into the same rule cluster and given higher priority, accelerating the processing of mainstream traffic. Low-frequency rules (such as rule B) are moved to the end of the cluster to avoid causing matching delays for most traffic. Through clustering and rule sorting, the matching path of data packets in the rule set is optimized, ensuring that high-frequency rules are at the beginning of the path, shortening the matching path length of most data packets, thereby reducing matching delays and improving path efficiency. Specifically, under normal circumstances, the rules are arranged in a path form. When a data packet enters the network device, it matches each rule by traversal. High-frequency rules are at the beginning of the path. At this time, after the data packet has matched the high-frequency rules, it stops traversing and performing operations, thereby shortening the matching path length of the data packet.

[0070] Step S30: Obtain potential conflict pairs from the rule arrangement sequence, determine the conflict type and severity by comparing the overlap range of traffic feature data between each rule in the conflict pair, and obtain a conflict list;

[0071] It should be noted that the aforementioned conflict pair refers to two or more rules that have conditional conflicts. In the above embodiments of this application, potential conflict pairs are obtained from the rule arrangement sequence of S30. By comparing the overlap range of conditions between rules (such as overlap of source address, destination address, or protocol), the conflict type and severity are determined, and finally a conflict list is obtained. In this process, identifying conditional conflicts between rules (such as rule overlap leading to false or missed matches) improves the accuracy and consistency of the rule set. In addition, the conflict list quantifies the severity of the conflict, providing a clear target for subsequent optimization and ensuring that the rule set is more reliable.

[0072] like Figure 3 As shown, the aforementioned conflict refers to the risk that two or more rules in a rule set may perform contradictory or unexpected actions on the same data packet due to overlapping matching conditions (such as source address, destination address, and protocol type). Conflicts represent policy logic flaws or ambiguous boundaries within the rule set, implying uncertainty in network security policies. This is like a traffic light simultaneously flashing green and red, leaving the driver (data packet) unsure whether to proceed (allow) or stop (deny). This application embodiment analyzes conflicts to obtain a conflict list. Then, in step S50, conflicts are eliminated from the conflict list, thereby eliminating network vulnerabilities. For example:

[0073] Rule 1: Deny access to any address from IP range 192.168.1.100.

[0074] Rule 2: Allow access to any address from the IP range 192.168.1.0 / 24.

[0075] Conflict Analysis: The data packet originates from 192.168.1.100. It matches both rule 1 (should be rejected) and rule 2 (should be allowed). Since the IP range of rule 2 covers the IPs of rule 1, if rule 2 precedes rule 1, the data packet will be incorrectly allowed, creating a security vulnerability. Step S40 of this application performs conflict detection. Conflict detection aims to identify this serious problem of "traffic that should be rejected being allowed," ensuring that the actual execution effect of the rule set is completely consistent with the network administrator's original design intent. Without conflict detection, the administrator's intent may be distorted by complex rule arrangements. The execution of step S40 in this embodiment of the application... The system processes and analyzes the rule sequence to identify rule pairs with potentially overlapping matching conditions (potential conflict pairs). By comparing their overlap range, it determines the conflict type (e.g., two rules with similar conditions but opposite actions) and severity, ensuring the accuracy and security of the rule set. This prevents incorrect allow or deny due to rule order or overlapping conditions, optimizes the policy consistency and logical correctness of the rule set, and avoids security vulnerabilities or network failures caused by configuration errors. Through conflict detection and elimination, it ensures that data packets do not deviate from the expected path in the rule matching path due to rule conflicts, preventing data packets from being incorrectly allowed or denied, thereby maintaining the correct path guidance of network traffic and improving path controllability.

[0076] Step S40: Based on the obtained conflict list, use a genetic algorithm to iteratively optimize the rule arrangement, crossover and mutation rule positions in each generation, and determine the optimized rule set version;

[0077] It should be noted that the above embodiments of this application use a genetic algorithm to iteratively optimize the rule arrangement and search for the optimal rule matching path, so that the data packet can quickly find the matching item when traversing the rules, while minimizing path conflicts, thereby achieving a dual improvement in path efficiency and quality.

[0078] Step S50: Obtain simulated traffic data, use the simulated traffic data to test the optimized rule set version, and obtain the test results, including matching time and filtering accuracy; if the test result is determined to be successful (successful test means that the matching time is less than or equal to the matching time threshold and the filtering accuracy is greater than or equal to the accuracy threshold), then the optimized rule set version is confirmed as the final deployment version.

[0079] It should be noted that the above embodiments of this application target the optimized rule set version of S40. Simulated traffic data is obtained for testing. By calculating the matching time and filtering accuracy, it is determined whether the accuracy is greater than or equal to the accuracy threshold and whether the matching time is less than or equal to the matching time threshold. If both of the above conditions are met, the optimized rule set version is confirmed as the final deployment version. Among them, the performance (matching time) and accuracy (filtering accuracy) of the optimized rule set version are tested and verified. Only the optimized rule set version that passes the threshold test is confirmed to ensure that it can effectively handle actual traffic after deployment and reduce network risks.

[0080] The execution process of step S50 in this embodiment uses simulated traffic data to test the new rule set optimized in S40. Two key indicators are tested: matching time (performance) and filtering accuracy (effectiveness). Only the rule set that meets both the conditions of fast speed and high accuracy will be confirmed as the final version. This ensures that the optimized rule set meets the standards in terms of performance and functionality, avoids deploying defective configurations to the production environment, and thus optimizes the reliability and risk control of the deployment.

[0081] The testing process verifies the performance of the optimized rule set path in terms of matching time and accuracy, ensuring that data packets can be matched quickly and filtered accurately when processed along this path, thereby guaranteeing the efficiency and security of network traffic paths.

[0082] Step S60: Obtain update instructions from the final deployment version, push the rule set through the network device interface, determine the deployment completion status, and obtain the real-time optimized access control list configuration.

[0083] It should be noted that, in the above embodiment of this application, the update instruction is obtained from the final deployment version obtained in S50, the rule set is pushed through the network device interface, and the deployment completion status is determined, thereby obtaining the real-time optimized access control list configuration. At this time, the rule set of the final deployment version is actually deployed to the network device to achieve dynamic optimization. The deployment completion status confirms that the configuration update is successful, enabling the network device to run based on the latest rule set, thereby improving network security and efficiency.

[0084] The rule set described in the above embodiments of this application serves as the optimization target of this application. It transforms the rule set corresponding to network traffic from an inefficient and potentially conflict-prone static policy into an efficient, accurate, and adaptive dynamic security policy. This allows for faster matching of real-time traffic data of current network devices, enabling judgment processing based on real-time network traffic data, adapting to changes in network traffic, and performing security protection management of network devices. By deploying the optimized rule set and implementing traffic-aware path optimization configuration, network devices can dynamically adjust rule paths according to real-time traffic, ensuring that data packets are always processed along the optimal path, thereby improving the overall path efficiency of network control and scheduling.

[0085] The above-described embodiments of this application first collect real-time traffic from network devices (firewalls, routers, etc.) and extract key features such as source / destination addresses and protocol types to analyze traffic pattern trends. Then, using the traffic pattern trends analyzed in S10, the massive rule set is clustered according to the similarity of matching frequencies to form more manageable "rule clusters". Within each rule cluster, rules are sorted according to matching frequency to ensure that high-frequency rules are placed first, so that most data packets can be quickly matched after traversing a few rules, thereby significantly reducing the average matching latency.

[0086] Furthermore, in step S30, the rule arrangement is analyzed to identify rule pairs that may cause policy conflicts due to overlapping conditions (such as IP address and protocol) (e.g., one rule allows while another denies). Traffic signals that are simultaneously activating green and red lights are then corrected to ensure that the behavior of data packets aligns with the administrator's design intent. Figure 1 By assessing the severity of conflicts, a clearly defined conflict list is generated, providing clear targets for subsequent automated optimization and preventing security vulnerabilities or network failures caused by misconfigurations. Furthermore, using the conflict list as a guide, the system intelligently searches for rule arrangements that simultaneously satisfy high performance and low conflict by simulating selection, crossover, and mutation operations in biological evolution. This optimizes rule conflict issues and identifies globally more optimized rule sequences. Before deploying the optimized rule set to the real network, it undergoes rigorous testing using simulated traffic to ensure fast matching speed (matching time meets standards) and accurate filtering without violating existing security policies (filtering accuracy meets standards). Only rule sets that simultaneously meet both performance and accuracy criteria are confirmed, thus avoiding the deployment of flawed configurations to the production environment and improving deployment reliability. Finally, the final rule set version that passes all tests is securely pushed to network devices, enabling real-time optimized access control list configurations. Network devices immediately operate based on the latest and optimal policies, thereby improving overall network security and data processing efficiency.

[0087] Specifically, in step S30, potential conflict pairs are obtained from the rule arrangement sequence. By comparing the overlap range of conditions between each rule in the conflict pair, the conflict type and severity are determined to obtain a conflict list, including the following steps:

[0088] Step S31: Combine every two rules in the rule set to obtain a rule group. Traverse all rule groups in the rule overlap cluster and obtain the action information of the two rules in each rule group. Determine whether the two action information are completely identical. If the two actions are not completely identical, mark the corresponding rule group as a potential action conflict pair (if the two action information are completely identical, they are not considered a conflict regardless of whether the conditions overlap, and are directly excluded without further processing). Obtain the overlap of the potential action conflict pair. The overlap includes IP address overlap, protocol overlap, and port overlap.

[0089] It should be noted that in the above embodiments of this application, the action information includes allow or deny. Typically, when a data packet enters the device terminal, a matching rule is first performed. After the rule matching is completed, the rule identifies whether the I / O request of the data packet is approved, i.e., whether the data processing of the data packet is allowed or denied. In the above embodiments of this application, the action information of the rule group is first judged to be consistent. If inconsistency occurs, it is initially determined that the two rules corresponding to the rule group will conflict when processing the data packet, and they are identified as a potential action conflict pair. Further, for the potential action conflict pair (such as rule A and rule B), the conditional overlap is calculated. Specifically, the Jaccard similarity coefficient is used to calculate the overlap between the source IP and the destination IP. For example, for the source IP overlap: ;,in and The set of IP addresses representing the rules (which may be a CIDR range); for protocol overlap, if the protocol types are the same, the protocol overlap is 1, otherwise it is 0; port overlap is calculated similarly (such as the ratio of the intersection to the union of port ranges); then, the three overlaps are combined and weighted to obtain the combined overlap of each pair of rules.

[0090] Step S32: Hierarchical clustering is used. A distance threshold is set, and each rule group is clustered according to the distance threshold to obtain multiple rule-overlapping clusters.

[0091] It should be noted that in the above embodiments of this application, by setting a distance threshold of 0.7 (rules with an overlap greater than 0.7 are grouped into the same cluster), potential action conflict pairs are clustered, and each cluster is a subset of rules, in which the overlap between rules is high;

[0092] Step S33: Perform temporal aliasing analysis on the regular overlapping clusters to calculate the conflict severity between each potential action conflict pair;

[0093] Step S34: Sort each regular overlapping cluster in descending order based on the severity of the maximum conflict between clusters to obtain a set of regular overlapping cluster sequences;

[0094] Step S35: In each rule-overlapping cluster, sort each rule pair by its degree of conflict to obtain a set of inter-cluster rule pair sequences;

[0095] Step S36: Sort each rule pair in the rule overlap cluster sequence set and the inter-cluster rule pair sequence set to obtain the conflict list.

[0096] It should be noted that the above-described embodiments of this application first determine whether the execution action information of the two rules in each rule group is consistent, and initially screen out potential action conflict pairs with potential conflicts. Then, the overlap degree of each pair of rules in the three dimensions of IP address, protocol and port is calculated by using the Jaccard similarity coefficient, providing a data foundation for subsequent conflict analysis. The comprehensive overlap degree obtained by weighted summation reflects the conditional similarity between rules, ensuring that subsequent analysis is based on accurate quantitative indicators. Then, by using a hierarchical clustering algorithm, rules with high overlap degree are grouped into the same cluster by setting a distance threshold (0.7), forming rule overlap clusters, reducing the complexity of subsequent analysis, enabling conflict detection to focus on high-risk rule combinations, and improving analysis efficiency. Furthermore, based on static conditional overlap analysis, a time-domain dimension is introduced to analyze the temporal similarity of rules. Step-by-step matching behavior is used to identify conflict pairs that may have a serious impact on actual network operation by calculating the conflict severity between potential action conflict pairs, making conflict assessment closer to the real network environment. Furthermore, the rule-overlapping clusters are sorted in descending order based on the maximum conflict severity between clusters, generating a cluster sequence set. This ensures that the rule clusters with the highest risk are prioritized and resolved in subsequent processing, optimizing resource allocation and problem handling order. Then, within each rule-overlapping cluster, rule pairs are sorted in descending order according to conflict severity, generating an inter-cluster rule pair sequence set. By combining the rule-overlapping cluster sequence set and the inter-cluster rule pair sequence set, a structured conflict list is generated, arranged from highest to lowest conflict severity, providing input for subsequent genetic algorithm optimization and ensuring that the optimization process can specifically address the most important conflict issues.

[0097] Specifically, in step S33, temporal aliasing analysis is performed on the regular overlapping clusters to calculate the conflict severity between each potential action conflict pair, including the following steps:

[0098] Step S331: Obtain historical traffic data and extract the matching frequency time series of each rule from the historical traffic data;

[0099] For example, the above embodiments of this application extract the matching frequency time series of each rule from historical traffic data, divide the historical traffic data into time windows (e.g., every 5 minutes), and record the number of times each rule matches within each window.

[0100] Step S332: Obtain business information for each historical traffic data; obtain the importance weight value of each business information in each time window; calculate the time-frequency aliasing conflict risk factor based on the importance weight value of each business information in each time window and the matching frequency time series of any potential action conflict pair in the rule overlap cluster;

[0101] The time-frequency aliasing conflict risk factor is calculated as follows:

[0102] ;

[0103] In the formula, It is the time series of matching frequencies of rule i (with a length of N time windows). It is the time series of matching frequency of rule j (with a length of N time windows). This represents the importance weight value of business information B within the time window t. The matching frequency of rule i during time window t; t represents the matching frequency of rule j within time window t; N represents the number of time windows.

[0104] Step S333: Calculate the conflict severity of each potential action conflict pair based on the time-frequency aliasing conflict risk factor and the overlap of each potential action conflict pair;

[0105] The severity of the conflict is calculated as follows:

[0106] ;

[0107] In the formula, in the formula, It is the degree of overlap between rule i and rule j in the potential action conflict pair;

[0108] It should be noted that in the above embodiments of this application, by dividing historical traffic data into fixed time windows (e.g., every 5 minutes) and recording the number of times each rule matches within each time window, a time series of rule matching frequency is formed. This transforms static rule characteristics into dynamic behavioral patterns, providing basic data support for time-domain aliasing analysis, enabling conflict analysis to examine the activity patterns of rules from a time dimension. By combining the importance weight values ​​of business information in each time window, the weighted cumulative effect of the difference in matching frequency of rule pairs during critical business periods is calculated. This factor comprehensively considers the temporal synchronicity and business criticality of rule matching behavior. When two rules are frequently triggered simultaneously during important business periods, the risk factor value increases, accurately reflecting the potential conflict risk brought about by time-domain aliasing. Then, the time-frequency aliasing conflict risk factor is multiplied by the static overlap of potential action conflict pairs to obtain the comprehensive conflict severity. This factor also considers the "spatial" factor of rule condition overlap and the "temporal" factor of time-domain aliasing, so that the evaluation result reflects both the similarity of the rules themselves and the conflict risk generated in actual operation dynamics, providing a comprehensive and accurate basis for subsequent priority ranking.

[0109] Specifically, in step S40, based on the obtained conflict list, a genetic algorithm is used to iteratively optimize the rule arrangement, determining the optimized rule set version by analyzing the crossover and mutation positions of rules in each generation, including the following steps:

[0110] Step S41: Generate multiple regular sequences using the regular permutation sequence;

[0111] It should be noted that the above embodiments of this application are based on the regular arrangement sequence of step S30 as the basic individual, and then through random perturbation processing, that is, keeping the cluster structure unchanged, the regular positions are randomly exchanged within the cluster to generate multiple regular sequences;

[0112] Step S42: Obtain the average matching time for each rule sequence by simulating normal traffic test; calculate the rule fitness for each rule sequence based on the average matching time;

[0113] It should be noted that the above embodiments of this application simulate normal traffic tests on each rule sequence, that is, they use the form of normal traffic flowing into network devices to match each rule in the rule sequence, thereby obtaining the matching time for each rule. Then, through averaging, the average matching time is obtained. The average matching time reflects the degree of matching of the rule sequence with network traffic. The average matching time is traffic data that simulates the network under normal and stable conditions and is used to evaluate the baseline performance of the rule set. However, the test processing of the embodiments of this application only simulates normal traffic and does not consider the matching situation of traffic and rules when traffic fluctuates, such as when traffic surges or decreases at a certain time. Therefore, the rule fitness in step S42 of this application only represents the matching situation of rules and traffic under normal conditions. In addition, when encountering traffic fluctuations, further analysis and processing are still required.

[0114] Step S43: Determine whether the rule fitness is greater than or equal to the rule fitness threshold. If so, determine that the corresponding rule sequence is a candidate rule sequence. Determine whether there are any adjacent rules in the candidate rule sequence that belong to the elements in the conflict list (the elements in the conflict list are the two rules corresponding to the potential action conflict pair in the process of analyzing and obtaining the conflict list in step S30; that is, determine whether there are any two adjacent rules in the candidate rule sequence that are potential action conflict pairs). If so (if not, determine the candidate rule sequence as the optimized rule set version), then the candidate rule sequence is subjected to traffic stress testing to filter and obtain the optimized rule set version.

[0115] Step S44: If the fitness of a rule is less than the fitness threshold, then randomly select K rule sequences as sequences to be exchanged, and select the F sequences with the highest fitness from the sequences to be exchanged and put them into the pool (that is, select the F sequences with high fitness from the randomly selected K sequences to be exchanged and put them into the mating pool).

[0116] Step S45: Pair each sequence to be exchanged in the mating pool to obtain parent rule sequence pairs; extract two intermediate sequences from the two sequences to be exchanged in the parent rule sequence pairs through two randomly determined crossover points; exchange the two intermediate sequences to obtain two second rule sequences; establish a mutation pool based on all second rule sequences (the mutation pool is a set composed of all second rule sequences, in which all second rule sequences are mutated to increase the population diversity processed by the genetic algorithm); perform conflict-driven mutation processing on each second rule sequence in the mutation pool to obtain a third rule sequence; return the third rule sequence to step S42 above for iterative execution until the optimized rule set version is output.

[0117] It should be noted that in the above embodiments of this application, firstly, through initialization processing, multiple rule sequences are randomly generated using the rule arrangement sequence obtained from step S30 (i.e., the rule set after clustering and priority sorting). Each sequence represents a potential optimization scheme. Then, the performance of each optimization scheme is evaluated to perform rule sequence filtering. However, for rules with conflicts, further traffic stress testing is required to perform more accurate filtering, evaluate the performance of the rule sequence in the real network environment, and avoid performance degradation after deployment.

[0118] Specifically, in step S43, the candidate rule sequences are filtered through traffic stress testing to obtain an optimized rule set version, including the following steps:

[0119] Step S431: Acquire multiple traffic segments; traffic segments include normal traffic segments, burst traffic segments, periodic traffic segments, abnormal traffic segments, and mixed traffic segments; generate multiple traffic data packets for each traffic segment;

[0120] It should be noted that in the above embodiments of this application, multiple traffic test scenarios are defined to simulate various fluctuation conditions in the real network, so as to ensure that the stress test can fully cover different network states and evaluate the robustness of candidate rule sequences under abnormal or sudden traffic. The above normal traffic segments are based on historical normal traffic patterns to simulate stable network states; sudden traffic segments simulate sudden surges in traffic, such as DDoS attacks or large-scale data transmission; periodic traffic segments simulate periodic services, such as video conferencing or scheduled backups; abnormal traffic segments simulate network attacks or misconfigurations, such as port scanning or protocol violations; mixed traffic segments combine the characteristics of the above segments to simulate complex real environments. By generating simulated traffic data packets for each traffic segment, the statistical significance of the test is ensured. The traffic data packets are generated based on real-time traffic characteristic data (such as source address, destination address, and protocol type) in step S10, and fluctuation elements (fluctuation elements are abnormal or sudden components in the traffic data, such as a sudden increase in request rate or unconventional protocol type, used to induce unstable behavior of the rule sequence) to simulate stress.

[0121] Step S432: Test the candidate rule sequence using each traffic data packet of each traffic segment to obtain test data; the test data includes the simulated matching time and the position (position or sequence number, i.e., the sequence number in the candidate rule sequence) of each data packet; obtain the simulated matching conflict frequency based on the position of the simulated matching rule and the conflict list statistics; at the same time, for each rule cluster (the rule cluster obtained by S20 clustering), calculate the average simulated matching time and the standard deviation of the simulated matching time under each traffic segment based on the simulated matching time;

[0122] It should be noted that in the above embodiments of this application, simulated traffic data is used to test the candidate rule sequence. During the test, data packets are matched against the rule sequence in sequence, and the matching time (time from the start of matching to the hit rule) and the position of the matched rule for each data packet are recorded. For each rule cluster i (i from 1 to M, where M is the total number of rule clusters, obtained from step S20), the average matching time (the average of the matching times of all rules in rule cluster i, reflecting the typical performance of the cluster in segment a) and the standard deviation of the matching time (the standard deviation of the matching times of rules in rule cluster i, reflecting the performance fluctuation of the cluster in segment a) are calculated under traffic segment a. At the same time, for adjacent rule conflicts (i.e., rule pairs belonging to the conflict list) existing in the candidate rule sequence, the matching frequency of each conflict pair under segment a is recorded.

[0123] Step S433: Calculate the traffic test fluctuation index by combining all traffic segments, rule clusters, collision frequency, average simulated matching time, and standard deviation of simulated matching time;

[0124] The calculation method for the flow test fluctuation index is as follows:

[0125] ;

[0126] In the formula, and These are the weighting coefficients. In the traffic segment Below, the standard deviation of the simulated matching time of rule cluster i (obtained from step S432) reflects the performance fluctuation of the rule cluster under traffic segment a; The average simulated matching time of rule cluster i under traffic segment a (obtained from step S432) reflects the typical performance of the rule cluster under traffic segment a; M is the total number of rule clusters, and A is the total number of traffic segments. For traffic segment a, the simulated matching collision frequency of collision pair j (obtained from step S432) is the number of times the collision pair is triggered in the test. The severity of the conflict for j (obtained from step S40 and normalized to the range [0,1]) is represented by a higher value, indicating a more severe conflict. Let K be the standard deviation of the matching frequency of conflict pair j across all traffic segments a (a statistical indicator that measures the fluctuation of the matching frequency of conflict pairs under different traffic scenarios), reflecting the degree of fluctuation in the frequency of the impact of the conflict pair, and K be the number of conflict pairs;

[0127] It should be noted that the above embodiments of this application first calculate the average coefficient of variation, that is, the above... This reflects the degree of matching time fluctuation of all rule clusters under all traffic segments, capturing the matching time stability of the rule sequence. The coefficient of variation (the ratio of standard deviation to mean) is a relative indicator that can eliminate the influence of scale differences between different rule clusters. The higher the value, the more unstable the overall performance of the rule sequence, and the more prone it is to matching delays under traffic fluctuations. Then, conflict instability is calculated, as described above. This reflects the degree of fluctuation in the matching frequency of all conflict pairs across different traffic segments, capturing the unpredictability of conflict pair behavior. The standard deviation measures the variation in conflict frequency across different traffic segments; a higher value indicates greater uncertainty in the impact of the conflict (e.g., frequent triggering in some segments, but infrequent triggering in others). Severity-weighted analysis ensures that high-risk conflicts contribute more to the volatility index. Then, weighting coefficients are used... and To balance the relative importance of matching fluctuations and conflict effects, the robustness of candidate rule sequences can be comprehensively evaluated by covering performance fluctuations and conflict effects.

[0128] Additionally, it should be noted that before calculating the traffic test fluctuation index V, it is necessary to standardize the dimensions of the aforementioned traffic segments, rule clusters, conflict frequency, average simulated matching time, and standard deviation of simulated matching time.

[0129] Step S434: Determine whether the traffic test fluctuation index is less than or equal to the fluctuation index threshold; if yes, determine that the candidate rule sequence is the optimized rule set version; if no, filter it out and do not perform any further processing.

[0130] It should be noted that the above-described embodiments of this application, by defining five traffic segments—normal, burst, periodic, abnormal, and mixed—fully cover various fluctuation conditions that may occur in a real network. Based on the real-time traffic characteristic data from step S10, traffic data packets are generated and fluctuation elements are injected, providing a realistic and reliable input environment for subsequent testing. This ensures that stress testing can comprehensively evaluate the robustness of candidate rule sequences under different network conditions. Furthermore, by simulating each traffic segment, a comprehensive test of the candidate rule sequences is conducted, recording key data such as matching time and rule location. The average matching time and standard deviation are calculated for rule clusters to reflect the performance and fluctuation of each rule cluster under different traffic scenarios. Simultaneously, conflict effects are statistically analyzed. The matching frequency provides complete performance and conflict impact data to support subsequent fluctuation index calculations. Furthermore, by using two core indicators—weighted average coefficient of variation and conflict instability—the robustness of candidate rule sequences under stress testing is quantified. The average coefficient of variation captures the matching time stability of the rule sequence, while conflict instability reflects the unpredictability of conflict impacts. Moreover, by comparing the traffic test fluctuation index with a preset threshold, a clear pass / rejection decision mechanism is formed, ensuring that only candidate rule sequences with sufficient stability are confirmed as the optimized rule set version. This prevents potential performance degradation in real network environments and improves the quality and reliability of the final deployment version.

[0131] Specifically, in step S45, each second rule sequence in the mutation pool undergoes conflict-driven mutation processing to obtain a third rule sequence, including the following steps:

[0132] Step S451: Traverse each second rule sequence in the mutation pool, scan all adjacent rule pairs in the second rule sequence, mark adjacent rule pairs in the conflict list as high-risk rule pairs, and record the conflict severity value of each high-risk rule pair;

[0133] Step S452: Sort the high-risk rule pairs according to the conflict severity value from high to low to obtain the conflict resolution sequence set;

[0134] Step S453: Perform rule exchange mutation processing (rule exchange mutation processing refers to exchanging the rule sequence number of any one of the two rules in the high-risk rule pair with any random rule before that rule sequence number) and rule fragment exchange mutation processing (rule fragment exchange mutation processing refers to exchanging the continuous L-length rule sequence number fragment in the high-risk rule pair with the L-length rule sequence number at any random sequence number position in the second rule sequence) from the conflict handling sequence set to obtain the third rule sequence.

[0135] It should be noted that in the above embodiments of this application, by traversing and scanning all adjacent rule pairs in the second rule sequence, high-risk rule pairs existing in the conflict list are identified, and their conflict severity values ​​are recorded. This ensures that the mutation operation can prioritize handling actual policy conflicts, avoiding the blindness of mutation in traditional genetic algorithms. Then, the high-risk rule pairs are sorted from high to low according to their conflict severity values, forming an ordered conflict handling sequence set. This ensures that limited computing resources are prioritized for resolving the most severe policy conflicts, optimizing processing efficiency, and providing an execution path for subsequent mutation operations. Furthermore, rule exchange mutation and rule fragment exchange mutation are used... Two methods are used to deeply process high-risk rule pairs. The first method involves rule exchange mutation, where any rule in a high-risk rule pair is swapped forward to a random position, directly disrupting the adjacency relationship of conflicting rules and eliminating local conflicts at the micro level. This resolves specific strategy conflicts while maintaining the relative stability of the overall rule sequence structure. The second method involves rule fragment exchange mutation, where a continuous L-length rule fragment containing a high-risk rule pair is swapped with an equal-length fragment at another random position in the sequence. This reorganizes the rule sequence structure at the macro level, not only resolving specific high-risk conflict pairs but also preventing potential conflicts and enhancing the overall coordination of the sequence through a complete change in the rule environment.

[0136] In summary, the network control and scheduling method based on traffic awareness and path optimization proposed in this invention collects real-time traffic from network devices (firewalls, routers, etc.) and extracts key features such as source / destination addresses and protocol types to analyze traffic pattern trends. Then, using the analyzed traffic pattern trends, the rule set is clustered according to the similarity of matching frequency to form more manageable "rule clusters". Within each rule cluster, the rules are sorted according to the matching frequency to ensure that high-frequency rules are placed first, so that most data packets can be quickly matched after traversing a few rules, thereby significantly reducing the average matching latency.

[0137] Furthermore, by analyzing the rule arrangement, we identified rule pairs that might cause policy conflicts (such as one rule allowing while another denies) due to overlapping conditions (e.g., IP address, protocol). We then corrected the traffic signals that were simultaneously flashing green and red, ensuring that the behavior of data packets aligned with the administrator's design intent. Figure 1By assessing the severity of conflicts, a clearly defined conflict list is generated, providing clear targets for subsequent automated optimization and preventing security vulnerabilities or network failures caused by misconfigurations. Furthermore, using the conflict list as a guide, the system intelligently searches for rule arrangements that simultaneously satisfy high performance and low conflict by simulating selection, crossover, and mutation operations in biological evolution. This optimizes rule conflict issues and identifies globally more optimized rule sequences. Before deploying the optimized rule set to the real network, it undergoes rigorous testing using simulated traffic to ensure fast matching speed (matching time meets standards) and accurate filtering without violating existing security policies (filtering accuracy meets standards). Only rule sets that simultaneously meet both performance and accuracy criteria are approved, thus avoiding the deployment of flawed configurations to the production environment and improving deployment reliability. Finally, the final rule set version that passes all tests is securely pushed to network devices, enabling real-time optimized access control list configurations. Network devices immediately operate based on the latest and optimal policies, thereby improving overall network security and data processing efficiency.

[0138] In the specific implementation process, temporal aliasing analysis of rule overlap clusters is introduced to obtain the conflict severity between each potential action conflict pair. At the same time, the "spatial" factor of rule condition overlap and the "temporal" factor of temporal aliasing are considered so that the evaluation results not only reflect the similarity of the rules themselves, but also include the conflict risks generated in the actual operation dynamics.

[0139] Furthermore, a comprehensive test analysis using multiple traffic patterns was conducted to calculate the traffic test fluctuation index, thereby comprehensively evaluating the robustness of candidate rule sequences under different network conditions.

[0140] In addition, during the execution of the genetic algorithm, conflict-driven mutation processing is used to not only resolve specific high-risk conflict pairs, but also to prevent the generation of potential conflicts and enhance the overall coordination of the sequence by completely changing the rule environment.

[0141] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; those skilled in the art can modify the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network control scheduling method based on traffic awareness and path optimization, characterized in that, The method comprises the following steps: Obtain real-time traffic data from a network device, extract traffic feature data from the real-time traffic data, analyze the traffic feature data to obtain a traffic pattern change trend; Obtain a preset rule set, group the rule set using a clustering algorithm based on the traffic pattern change trend to obtain a plurality of rule clusters, and determine a rule arrangement sequence in the rule clusters; Obtain potential conflict pairs from the rule arrangement sequence, determine a conflict type and a severity by comparing overlapping ranges of traffic feature data between rules in the conflict pairs, and obtain a conflict list; Iteratively optimize the rule arrangement using a genetic algorithm based on the obtained conflict list, cross and mutate rule positions in each generation, and determine an optimized rule set version; Obtain simulation traffic data, test the optimized rule set version using the simulation traffic data, and obtain a test result, which includes a matching time and a filtering accuracy; If the test result is determined to be a test success, the optimized rule set version is confirmed as a final deployment version; Obtain an update instruction from the final deployment version, push the rule set through a network device interface, determine a deployment completion state, and obtain a real-time optimized access control list configuration. 2.The network control scheduling method based on traffic awareness and path optimization of claim 1, wherein, The traffic feature data includes a source address, a destination address, and a protocol type of a data packet. 3.The network control scheduling method based on traffic awareness and path optimization of claim 2, wherein, The potential conflict pairs are obtained from the rule arrangement sequence, the conflict type and the severity are determined by comparing condition overlapping ranges between rules in the conflict pairs, and the conflict list is obtained, comprising the following steps: Combine each two rules in the rule set to obtain a rule group, traverse all rule groups in the rule overlap clustering cluster to obtain two action information of the two rules of each rule group, determine whether the two action information are completely same, mark the corresponding rule group as a potential action conflict pair when the two actions are not completely same, obtain an overlapping degree of the potential action conflict pair, and the overlapping degree includes an IP address overlapping degree, a protocol overlapping degree, and a port overlapping degree. A hierarchical clustering processing is used, a distance threshold is set, each rule group is clustered based on the distance threshold, and a plurality of rule overlap clustering clusters are obtained; Temporal aliasing analysis is performed on the rule overlap clustering cluster, and the conflict severity between each potential action conflict pair is calculated; Each rule overlap clustering cluster is sorted from large to small based on the maximum conflict severity between clusters, and a rule overlap clustering cluster sequence set is obtained; In each rule overlap clustering cluster, each rule pair is sorted from large to small based on each conflict severity, and a rule pair sequence set between clusters is obtained; Each rule pair is sorted based on the rule overlap clustering cluster sequence set and the rule pair sequence set between clusters, and a conflict list is obtained.

4. The network control scheduling method based on traffic awareness and path optimization according to claim 3, characterized in that, Temporal aliasing analysis is performed on the rule overlap clustering cluster, and the conflict severity between each potential action conflict pair is calculated, comprising the following steps: Obtain historical traffic data, and extract a matching frequency time sequence of each rule from the historical traffic data; Obtaining service information of each historical traffic data; obtaining importance weight values of each service information in each time window; obtaining time-frequency aliasing conflict risk factors according to the importance weight values of each service information in each time window combined with the matching frequency time sequence of any one potential action conflict pair in the rule overlapping clustering cluster; According to the time-frequency aliasing conflict risk factor combined with the overlapping degree of each potential action conflict pair, the conflict severity of each potential action conflict pair is calculated.

5. The network control scheduling method based on traffic awareness and path optimization according to claim 4, characterized in that, According to the obtained conflict list, the genetic algorithm is used to iteratively optimize the rule arrangement, and the rule positions are crossed and mutated in each generation to determine the optimized rule set version, including the following operation steps: A plurality of rule sequences are generated using the rule arrangement sequence; The average matching time is obtained by simulating normal traffic test for each rule sequence; the rule fitness is calculated based on the average matching time for each rule sequence; Determine whether the rule fitness is greater than or equal to the rule fitness threshold, if yes, determine the corresponding rule sequence as a candidate rule sequence; determine whether there is an adjacent rule in the candidate rule sequence that belongs to the elements in the conflict list, if yes, perform traffic pressure test on the candidate rule sequence to obtain the optimized rule set version; If the rule fitness is less than the rule fitness threshold, randomly select K rule sequences as the to-be-swapped sequences, and select the F to-be-swapped sequences with the highest fitness from the to-be-swapped sequences and put them into the pool. Each to-be-swapped sequence in the mating pool is paired to obtain a pair of parent rule sequences; the two to-be-swapped sequences in the parent rule sequence pair are cut into two intermediate sequences through two randomly determined crossover points; the two intermediate sequences are exchanged to obtain two second rule sequences; the second rule sequence is obtained according to all second rule sequences to establish a variation pool; each second rule sequence in the variation pool is subjected to mutation processing based on conflict-driven mutation to obtain a third rule sequence; the third rule sequence is returned to the above step for re-iterative execution until the optimized rule set version is output.

6. The network control scheduling method based on traffic awareness and path optimization according to claim 5, characterized in that, The candidate rule sequence is tested by traffic pressure test to obtain the optimized rule set version, including the following operation steps: Obtaining a plurality of traffic segments; the traffic segments include normal traffic segments, burst traffic segments, periodic traffic segments, abnormal traffic segments and mixed traffic segments; generating a plurality of traffic data packets for each traffic segment; Each traffic data packet of each traffic segment is used to test and process the candidate rule sequence to obtain test data; the test data includes the simulated matching time of each data packet and the position of the simulated matching rule; the simulated matching conflict frequency is calculated according to the position of the simulated matching rule combined with the conflict list; at the same time, the average simulated matching time and the simulated matching time standard deviation under each traffic segment are calculated according to the simulated matching time for each rule cluster; The traffic test fluctuation index is calculated by comprehensively considering all traffic segments, rule clusters, and conflict frequencies and average simulated matching time and simulated matching time standard deviation; Determine whether the traffic test fluctuation index is less than or equal to the fluctuation index threshold; if yes, determine the candidate rule sequence as the optimized rule set version; If not, it is screened out and no longer processed.

7. The network control scheduling method based on traffic awareness and path optimization according to claim 6, characterized in that, The traffic fragments include normal traffic fragments, burst traffic fragments, periodic traffic fragments, abnormal traffic fragments and mixed traffic fragments. 8.The network control scheduling method based on traffic awareness and path optimization of claim 7, wherein, The traffic test fluctuation index is calculated by weighted summation of the average value of the ratio of the standard deviation of the matching time of each rule cluster under each traffic fragment to the average value and the product of the standard deviation of the matching frequency of each conflict pair under all traffic fragments and the conflict severity.

9. The network control scheduling method based on traffic awareness and path optimization according to claim 8, characterized in that, The conflict-driven mutation-based mutation processing is performed on each second rule sequence in the mutation pool to obtain a third rule sequence, including the following operation steps: Each second rule sequence in the mutation pool is traversed, all adjacent rule pairs in the second rule sequence are scanned, the adjacent rule pairs in the conflict list are marked as high-risk rule pairs, and the conflict severity value of each high-risk rule pair is recorded; The high-risk rule pairs are sorted in descending order of the conflict severity value to obtain a conflict processing sequence set; Rule exchange mutation processing and rule fragment exchange mutation processing are sequentially performed on the conflict processing sequence set to obtain the third rule sequence.

10. A storage medium, characterized by The storage medium stores a computer program, and the computer program is executed by the processor to realize the steps of the network control scheduling method based on traffic awareness and path optimization in any one of claims 1-9.

Images