Machine learning based digital twin dynamic optimization method, device and medium

Abstract

The application discloses a machine learning-based digital twin dynamic optimization method, device and medium, relates to the technical field of network security, and solves the problem that a to-be-optimized node in a network cannot be accurately screened based on an influence degree. The method comprises the following steps: acquiring network structure data and historical abnormal data of a target network, and mapping the target network to a digital network space according to the network structure data and the historical abnormal data; analyzing different transmission nodes in the digital network space; analyzing different transmission nodes in the digital network space according to the historical abnormal data, to obtain a first transmission node and a second transmission node; analyzing the first transmission node and the second transmission node, to obtain a to-be-optimized node in the digital network space; and optimizing a corresponding network node in the target network according to the to-be-optimized node in the digital network space. The application realizes accurate screening of a to-be-optimized node in a network based on an influence degree.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically a method, device, and medium for dynamic optimization of digital twins based on machine learning. Background Technology

[0002] With the acceleration of digitalization, cyberspace has become an important carrier of critical infrastructure, core business of enterprises and personal information assets in different regions. As the cornerstone of ensuring the healthy development of the digital economy, cybersecurity has become increasingly prominent in strategic position. The core objective of cybersecurity is to protect network systems, terminal devices, data resources and business processes from unauthorized access, tampering, damage or disclosure, covering multiple dimensions from perimeter protection to terminal security, data security and identity authentication.

[0003] In existing technologies, network security analysis is based on the integrity and security of data during data transmission. However, as a crucial component of modern networks, network nodes have varying degrees of influence on network security. Furthermore, the lack of analysis on the impact of different network nodes means that an anomaly in one network node can cause an anomaly in the entire network security. Additionally, it is impossible to accurately prioritize and optimize the most influential network nodes among numerous network nodes.

[0004] To this end, the present invention proposes a dynamic optimization method, device and medium for digital twins based on machine learning. Summary of the Invention

[0005] In view of the shortcomings of existing technologies, the purpose of this invention is to provide a method, device and medium for dynamic optimization of digital twins based on machine learning.

[0006] The technical problem to be solved by this invention is:

[0007] How to accurately select nodes in the network that need optimization based on their degree of influence.

[0008] To achieve the above objectives, the present invention adopts the following technical solution:

[0009] The first aspect is a dynamic optimization method for digital twins based on machine learning, which includes the following steps:

[0010] Step S1: Obtain the network structure data and historical anomaly data of the target network, and map the target network to the digital network space based on the network structure data and historical anomaly data;

[0011] Step S2: Analyze different transmission nodes in the digital network space to obtain the number of directly connected nodes corresponding to different transmission nodes.

[0012] Step S3: Analyze different transmission nodes in the digital network space based on historical abnormal data to obtain the first transmission node and the second transmission node.

[0013] Step S4: Analyze the first transmission node and the second transmission node to obtain the nodes to be optimized in the digital network space.

[0014] Step S5: Optimize the corresponding network nodes in the target network based on the nodes to be optimized in the digital network space.

[0015] Furthermore, the network structure data includes the number of network nodes in the target network, the data transmission direction between different network nodes, and the location of different network nodes; the historical anomaly data includes the historical attack time and historical crash time of different network nodes.

[0016] Furthermore, the acquisition process in step S2 includes the following sub-steps:

[0017] Step S21: The network nodes in the digital network space are denoted as analog nodes, and the analog nodes that only send data are denoted as sending nodes, the analog nodes that only receive data are denoted as receiving nodes, and the analog nodes that both send and receive data are denoted as transmission nodes.

[0018] Step S22: For any transmission node, the simulated node that has a communication connection with the transmission node is recorded as the first-level direct connection node of the transmission node, and the simulated node that has a communication connection with the first-level direct connection node is recorded as the second-level direct connection node of the transmission node.

[0019] Similarly, the simulated node that has a communication connection with the n-1 level direct connection node is denoted as the n-level direct connection node of the transmission node; where n is the number of the direct connection node.

[0020] Step S23: Count the number of directly connected nodes corresponding to different transmission nodes and record it as the number of directly connected nodes.

[0021] Furthermore, the analysis process in step S3 includes the following sub-steps:

[0022] Step S31: Record the time when the transmission node is attacked as the historical attack time, and record the time when the transmission node crashes as the historical crash time, and obtain historical abnormal data of different transmission nodes.

[0023] Step S32: Obtain the historical attack time and historical crash time of different transmission nodes, and use the historical attack time as the left endpoint and the historical crash time as the right endpoint to form a time period and record it as the historical attack time period of the transmission node.

[0024] Step S33: Count the number of historical attack times corresponding to different transmission nodes and record them as the number of historical attacks. Count the number of historical crash times corresponding to different transmission nodes and record them as the number of historical crashes. Divide the number of crashes by the number of attacks to obtain the historical crash ratio of the corresponding transmission node.

[0025] Step S34: Iterate through the historical crash ratios of different transmission nodes to obtain the maximum value of the historical crash ratio, and record the transmission node corresponding to the maximum value of the historical crash ratio as the first transmission node.

[0026] Furthermore, the analysis process in step S3 includes the following sub-steps:

[0027] Step S35: Obtain historical abnormal data of the directly connected nodes corresponding to the transmission nodes during the historical attack period;

[0028] When a historical crash time exists in the corresponding historical abnormal data, the working status of the corresponding directly connected node is recorded as a crash state.

[0029] When there is no historical crash time in the corresponding historical data, the working status of the corresponding directly connected node is recorded as normal.

[0030] Step S36: If all directly connected nodes corresponding to the transmission node are in normal condition during the historical attack period, no operation is performed.

[0031] If any directly connected node corresponding to the transmission node is in a crashed state during the historical attack period, the corresponding directly connected node is recorded as the affected node of the transmission node.

[0032] Step S37: Obtain the number of directly connected nodes of the transmission node, count the number of affected nodes corresponding to the transmission node during the historical attack period, and record it as the number of affected nodes. Divide the number of affected nodes by the number of directly connected nodes to obtain the affected ratio of the corresponding transmission node.

[0033] Step S38: Iterate through and compare the sweep ratios of different transmission nodes to obtain the maximum sweep ratio, and record the transmission node corresponding to the maximum sweep ratio as the second transmission node.

[0034] Furthermore, the analysis process in step S4 includes the following sub-steps:

[0035] Step S41: If the first transmission node and the second transmission node are the same transmission node, then the first transmission node and the second transmission node are collectively recorded as nodes to be optimized in the digital network space.

[0036] If the first transmission node and the second transmission node are different transmission nodes, proceed to step S42;

[0037] Step S42: Obtain the different directly connected nodes corresponding to the first transmission node, and form the first node sequence by combining the different directly connected nodes corresponding to the first transmission node;

[0038] Similarly, obtain the different sweeping nodes corresponding to the second transmission node, and construct the second node sequence from the different sweeping nodes corresponding to the second transmission node;

[0039] Step S43: If the second transmission node belongs to the sequence of the first node, proceed to step S44.

[0040] If the first transmission node belongs to the second node sequence, proceed to step S45;

[0041] If the first transmission node is not in the second node sequence and the second transmission node is not in the first node sequence, then the first transmission node and the second transmission node are respectively recorded as nodes to be optimized in the digital network space.

[0042] Step S44: Analyze the affected nodes of the second transmission node under different conditions;

[0043] Step S45: Analyze the failure rate of the first transmission node under different conditions.

[0044] Furthermore, the analysis process in step S44 includes the following sub-steps:

[0045] Step S441: Perform a simulated network attack on the first transmission node until the first transmission node crashes, and obtain the affected nodes of the second transmission node during the simulated network attack and record them as the first affected node.

[0046] Similarly, a simulated network attack is performed on the second transmission node until the second transmission node crashes, and the affected nodes of the second transmission node during the simulated network attack are obtained and recorded as the second affected nodes.

[0047] Step S442: Count the number of nodes in the first wave and record it as the number of nodes in the first wave; count the number of nodes in the second wave and record it as the number of nodes in the second wave.

[0048] Step S443: Compare the number of nodes in the first wave with the number of nodes in the second wave;

[0049] If the number of nodes in the first wave is greater than or equal to the number of nodes in the second wave, then the first transmission node is recorded as the node to be optimized in the digital network space.

[0050] If the number of nodes in the first wave is less than the number of nodes in the second wave, then the second transmission node is recorded as the node to be optimized in the digital network space.

[0051] Furthermore, the analysis process in step S45 includes the following sub-steps:

[0052] Step S451: Perform multiple simulated network attacks on the second transmission node until the second transmission node crashes. Record the number of simulated network attacks as the number of simulated attacks, record the time when the second transmission node crashes as the simulated crash time, and record the start time of the simulated network attacks as the simulated attack time.

[0053] Step S452: Subtract the simulated attack time from the simulated crash time to obtain the simulated attack duration of the second transmission node;

[0054] Step S453: Obtain the number of times the first transmission node crashes during multiple simulated network attacks and record it as the first simulated crash number. Divide the first simulated crash number by the number of simulated attacks to obtain the first simulated crash ratio of the corresponding first transmission node.

[0055] Step S454: Perform the same number of simulated network attacks on the first transmission node for the same duration, count the number of times the first transmission node crashes during the multiple simulated network attacks, and record it as the second simulated crash count.

[0056] Step S455: Divide the second number of simulated crashes by the number of simulated attacks to obtain the second simulated crash ratio corresponding to the first transmission node;

[0057] Step S456: Compare the first simulated crash ratio with the second simulated crash ratio;

[0058] If the first simulated crash ratio is greater than or equal to the second simulated crash ratio, then the second transmission node is recorded as a node to be optimized in the digital network space.

[0059] If the first simulated crash ratio is less than the second simulated crash ratio, then the first transmission node is recorded as the node to be optimized in the digital network space.

[0060] Secondly, an electronic device, the electronic device comprising:

[0061] A memory that stores a computer program;

[0062] The processor is communicatively connected to the memory. When the computer program is executed by the processor, it implements the machine learning-based digital twin dynamic optimization method.

[0063] Thirdly, a computer-readable storage medium having a computer program stored thereon, characterized in that the program, when executed by a processor, implements the aforementioned machine learning-based digital twin dynamic optimization method.

[0064] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0065] 1. This invention first maps the target network to a digital network space using digital twin technology. At the same time, it analyzes different simulated nodes in different digital network spaces to obtain the connection relationship between different simulated nodes. Then, it uses historical anomaly data to analyze different transmission nodes and obtains the first transmission node with the largest historical collapse ratio and the second transmission node with the largest impact ratio. This invention achieves the preliminary screening of different simulated nodes.

[0066] 2. The present invention then determines the inclusion relationship between the first transmission node and the second transmission node, and performs simulated attacks on the first transmission node and the second transmission node under different inclusion relationships. Based on the results of the simulated attacks, the first transmission node and the second transmission node are analyzed, thereby obtaining the nodes to be optimized in the digital network space. The present invention achieves accurate screening of the nodes to be optimized in the network based on the degree of influence. Attached Figure Description

[0067] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0068] Figure 1 This is a flowchart of the method of the present invention;

[0069] Figure 2 This is a schematic diagram of different simulation nodes in this invention;

[0070] Figure 3 This is a schematic diagram of the electronic device in this invention. Detailed Implementation

[0071] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0072] Example 1: Please refer to Figure 1 and Figure 2As shown, the technical solution provided by this invention is: a dynamic optimization method for digital twins based on machine learning. This method denotes the network to be analyzed as the target network. The target network contains different network nodes. First, the target network is mapped to a digital network space using digital twin technology. Network nodes in the digital network space are mapped as simulated nodes. Simultaneously, different simulated nodes in different digital network spaces are analyzed to obtain the connection relationships between them. Then, historical anomaly data is used to analyze different transmission nodes, identifying the first transmission node with the highest historical collapse ratio and the second transmission node with the highest impact ratio. Next, the inclusion relationship between the first and second transmission nodes is determined, and simulated attacks are performed on the first and second transmission nodes under different inclusion relationships. Based on the results of the simulated attacks, the first and second transmission nodes are analyzed to obtain the nodes to be optimized in the digital network space. The method includes the following steps:

[0073] Step S1: Obtain the network structure data and historical anomaly data of the target network, and map the target network to the digital network space based on the network structure data and historical anomaly data;

[0074] Specifically, network structure data includes the number of network nodes in the target network, the direction of data transmission between different network nodes, and the location of different network nodes; historical anomaly data includes the historical attack time and historical crash time of different network nodes.

[0075] In the specific implementation process, digital twin technology can be used to map the target network into the digital network space based on network structure data and historical anomaly data.

[0076] Step S2: Analyze different transmission nodes in the digital network space to obtain the number of directly connected nodes corresponding to different transmission nodes.

[0077] In this embodiment, the acquisition process in step S2 includes the following sub-steps:

[0078] Step S21, please refer to Figure 2 As shown, network nodes in the digital network space are denoted as analog nodes, analog nodes that only send data are denoted as sending nodes, analog nodes that only receive data are denoted as receiving nodes, and analog nodes that both send and receive data are denoted as transmission nodes.

[0079] It should be explained that there are multiple analog nodes in the digital network space, and the analog nodes in the digital network space correspond to the network nodes in the target network. In the specific implementation process, the sending node is used to send data to different network nodes, corresponding to the sending terminal in the target network; the receiving node is used to finally receive the data, corresponding to the receiving terminal in the target network; and the transmission node is used to relay the data, corresponding to the relay terminal in the target network.

[0080] Step S22: For any transmission node, the simulated node that has a communication connection with the transmission node is recorded as the first-level direct connection node of the transmission node, and the simulated node that has a communication connection with the first-level direct connection node is recorded as the second-level direct connection node of the transmission node.

[0081] Similarly, the simulated node that has a communication connection with the n-1 level direct connection node is denoted as the n-level direct connection node of the transmission node; where n is the number of the direct connection node.

[0082] Step S23: Count the number of directly connected nodes corresponding to different transmission nodes and record it as the number of directly connected nodes;

[0083] It needs to be explained that data transmission between different simulation nodes is unidirectional. A directly connected node is defined as a communication connection in the transmission direction. For example, if there is a communication connection between transmission node A and transmission node B, but the data transmission direction is from transmission node A to transmission node B, then transmission node B is defined as a directly connected node of transmission node A, while transmission node A is not a directly connected node of transmission node B. Each transmission node must have at least one directly connected node; otherwise, the transmission node cannot send and receive data with other simulation nodes, which contradicts the definition of a transmission node.

[0084] Step S3: Analyze different transmission nodes in the digital network space based on historical abnormal data to obtain the first transmission node and the second transmission node.

[0085] In this embodiment, the analysis process in step S3 includes the following sub-steps:

[0086] Step S31: Record the time when the transmission node is attacked as the historical attack time, and record the time when the transmission node crashes as the historical crash time, and obtain historical abnormal data of different transmission nodes.

[0087] In this embodiment, the transmission node can be used normally before it crashes. When the transmission node crashes, it means that the attack on the transmission node was successful and ended at the historical crash time. At this time, the transmission node can no longer be used normally. If the transmission node has no historical crash time, it means that the attack on the transmission node was unsuccessful.

[0088] Step S32: Obtain the historical attack time and historical crash time of different transmission nodes, and use the historical attack time as the left endpoint and the historical crash time as the right endpoint to form a time period and record it as the historical attack time period of the transmission node.

[0089] It should be explained that, for any transmission node, because there is a distinction between successful and unsuccessful attacks, although the transmission node may be attacked, it may not crash. Therefore, the number of historical attack times and the number of historical crash times may not be equal. In this embodiment, the time before the historical crash time and the time closest to the historical crash time is taken as the corresponding historical attack time.

[0090] Step S33: Count the number of historical attack times corresponding to different transmission nodes and record them as the number of historical attacks. Count the number of historical crash times corresponding to different transmission nodes and record them as the number of historical crashes. Divide the number of crashes by the number of attacks to obtain the historical crash ratio of the corresponding transmission node.

[0091] For example, if there are ten sets of historical attack times for transmission node A in the database and two sets of historical crash times for transmission node A, then the number of historical attacks on transmission node A is recorded as ten times, the number of historical crashes is recorded as two times, and the historical crash ratio is 0.2.

[0092] Step S34: Iterate through the historical crash ratios of different transmission nodes to obtain the maximum value of the historical crash ratio, and record the transmission node corresponding to the maximum value of the historical crash ratio as the first transmission node.

[0093] Step S35: Obtain historical abnormal data of the directly connected nodes corresponding to the transmission nodes during the historical attack period;

[0094] When a historical crash time exists in the corresponding historical abnormal data, the working status of the corresponding directly connected node is recorded as a crash state.

[0095] When there is no historical crash time in the corresponding historical data, the working status of the corresponding directly connected node is recorded as normal.

[0096] Step S36: If all directly connected nodes corresponding to the transmission node are in normal condition during the historical attack period, no operation is performed.

[0097] If any directly connected node corresponding to the transmission node is in a crashed state during the historical attack period, the corresponding directly connected node is recorded as the affected node of the transmission node.

[0098] Step S37: Obtain the number of directly connected nodes of the transmission node, count the number of affected nodes corresponding to the transmission node during the historical attack period, and record it as the number of affected nodes. Divide the number of affected nodes by the number of directly connected nodes to obtain the affected ratio of the corresponding transmission node.

[0099] Step S38: Iterate through and compare the sweep ratios of different transmission nodes to obtain the maximum sweep ratio, and record the transmission node corresponding to the maximum sweep ratio as the second transmission node.

[0100] Step S4: Analyze the first transmission node and the second transmission node to obtain the nodes to be optimized in the digital network space.

[0101] In this embodiment, the analysis process in step S4 includes the following sub-steps:

[0102] Step S41: If the first transmission node and the second transmission node are the same transmission node, then the first transmission node and the second transmission node are collectively recorded as nodes to be optimized in the digital network space.

[0103] If the first transmission node and the second transmission node are different transmission nodes, proceed to step S42;

[0104] Step S42: Obtain the different directly connected nodes corresponding to the first transmission node, and form the first node sequence by combining the different directly connected nodes corresponding to the first transmission node;

[0105] Similarly, obtain the different sweeping nodes corresponding to the second transmission node, and construct the second node sequence from the different sweeping nodes corresponding to the second transmission node;

[0106] Step S43: If the second transmission node belongs to the sequence of the first node, proceed to step S44.

[0107] If the first transmission node belongs to the second node sequence, proceed to step S45;

[0108] If the first transmission node is not in the second node sequence and the second transmission node is not in the first node sequence, then the first transmission node and the second transmission node are respectively recorded as nodes to be optimized in the digital network space.

[0109] It should be explained that when the first transmission node is the same as any transmission node in the second node sequence, the first transmission node is determined to belong to the second node sequence. In this case, the first transmission node is the affected node corresponding to the second transmission node. Similarly, when the second transmission node is the same as any transmission node in the first node sequence, the second transmission node is determined to belong to the first node sequence. In this case, the second transmission node is a directly connected node of the first transmission node. When neither the first nor the second transmission node belongs to the second node sequence, the first and second transmission nodes are not related to each other.

[0110] Step S44: Analyze the affected nodes of the second transmission node under different conditions;

[0111] In this embodiment, the analysis process in step S44 includes the following sub-steps:

[0112] Step S441: Perform a simulated network attack on the first transmission node until the first transmission node crashes, and obtain the affected nodes of the second transmission node during the simulated network attack and record them as the first affected node.

[0113] Similarly, a simulated network attack is performed on the second transmission node until the second transmission node crashes, and the affected nodes of the second transmission node during the simulated network attack are obtained and recorded as the second affected nodes.

[0114] Step S442: Count the number of nodes in the first wave and record it as the number of nodes in the first wave; count the number of nodes in the second wave and record it as the number of nodes in the second wave.

[0115] Step S443: Compare the number of nodes in the first wave with the number of nodes in the second wave;

[0116] If the number of nodes in the first wave is greater than or equal to the number of nodes in the second wave, then the first transmission node is recorded as the node to be optimized in the digital network space.

[0117] If the number of nodes in the first wave is less than the number of nodes in the second wave, then the second transmission node is recorded as the node to be optimized in the digital network space.

[0118] It needs to be explained that when the number of nodes in the first wave is greater than or equal to the number of nodes in the second wave, it means that the impact of the collapse of the first transmission node on the second transmission node is greater than the impact of the collapse of the second transmission node itself. When the number of nodes in the first wave is less than the number of nodes in the second wave, it means that the impact of the collapse of the first transmission node on the second transmission node is less than the impact of the collapse of the second transmission node itself.

[0119] Step S45: Analyze the failure rate of the first transmission node under different conditions;

[0120] In this embodiment, the analysis process in step S45 includes the following sub-steps:

[0121] Step S451: Perform multiple simulated network attacks on the second transmission node until the second transmission node crashes. Record the number of simulated network attacks as the number of simulated attacks, record the time when the second transmission node crashes as the simulated crash time, and record the start time of the simulated network attacks as the simulated attack time.

[0122] Step S452: Subtract the simulated attack time from the simulated crash time to obtain the simulated attack duration of the second transmission node;

[0123] Step S453: Obtain the number of times the first transmission node crashes during multiple simulated network attacks and record it as the first simulated crash number. Divide the first simulated crash number by the number of simulated attacks to obtain the first simulated crash ratio of the corresponding first transmission node.

[0124] Step S454: Perform the same number of simulated network attacks on the first transmission node for the same duration, count the number of times the first transmission node crashes during the multiple simulated network attacks, and record it as the second simulated crash count.

[0125] Step S455: Divide the second number of simulated crashes by the number of simulated attacks to obtain the second simulated crash ratio corresponding to the first transmission node;

[0126] Step S456: Compare the first simulated crash ratio with the second simulated crash ratio;

[0127] If the first simulated crash ratio is greater than or equal to the second simulated crash ratio, then the second transmission node is recorded as a node to be optimized in the digital network space.

[0128] If the first simulated crash ratio is less than the second simulated crash ratio, then the first transmission node is recorded as the node to be optimized in the digital network space.

[0129] It needs to be explained that when the first simulated crash ratio is greater than or equal to the second simulated crash ratio, it means that the impact of the second transmission node crash on the first transmission node is greater than the impact of the first transmission node itself being attacked by the network. When the first simulated crash ratio is less than the second simulated crash ratio, it means that the impact of the second transmission node crash on the first transmission node is less than the impact of the first transmission node itself being attacked by the network.

[0130] Step S5: Optimize the corresponding network nodes in the target network based on the nodes to be optimized in the digital network space.

[0131] Example 2: This embodiment of the invention also provides an electronic device for running the aforementioned machine learning-based digital twin dynamic optimization method; see [link to previous example]. Figure 3 The schematic diagram shown in this embodiment of the invention provides an electronic device, which includes a memory and a processor. The memory is used to store one or more computer instructions, which are executed by the processor to realize the above-mentioned machine learning-based digital twin dynamic optimization method, device and medium.

[0132] Furthermore, Figure 3 The electronic device shown also includes a communication bus and a communication interface, with the processor, communication interface and memory connected via the communication bus;

[0133] The memory may include high-speed random access memory (RAM) and may also include non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc. The communication bus can be an ISA bus, PCI bus, or EISA bus, etc. The communication bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 3 The symbol is represented by only one double-headed arrow, but this does not mean that there is only one communication bus or one type of communication bus.

[0134] The processor may be an integrated circuit chip with signal processing capabilities. In implementation, the steps of the above methods can be completed by integrated logic circuits in the processor's hardware or by software instructions. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this invention can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in the memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the method described in the foregoing embodiments.

[0135] In embodiment three, this invention also provides a computer storage medium storing computer-executable instructions. When these computer-executable instructions are called and executed by a processor, they cause the processor to implement the aforementioned machine learning-based digital twin dynamic optimization method, device, and medium. For specific implementation details, please refer to the method embodiment, which will not be repeated here.

[0136] The computer program product of the machine learning-based digital twin dynamic optimization method, device and medium provided in the embodiments of the present invention includes a computer storage medium storing program code. The instructions included in the program code can be used to execute the methods in the preceding method embodiments. For specific implementation, please refer to the method embodiments, which will not be repeated here.

[0137] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system and / or device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0138] Furthermore, in the description of the embodiments of the present invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in the present invention based on the specific circumstances.

[0139] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0140] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A dynamic optimization method for digital twins based on machine learning, characterized in that, The method includes the following steps: Step S1: Obtain network structure data and historical anomaly data of the target network, and map the target network to the digital network space based on the network structure data and the historical anomaly data; wherein, the network structure data includes the number of network nodes in the target network, the data transmission direction between different network nodes, and the location of different network nodes; the historical anomaly data includes the historical attack time and historical crash time of different network nodes; Step S2 involves analyzing different transmission nodes in the digital network space to obtain the number of directly connected nodes corresponding to different transmission nodes; wherein, step S2 includes: Step S21: The network nodes in the digital network space are denoted as simulated nodes, and the simulated nodes that only send data are denoted as sending nodes, the simulated nodes that only receive data are denoted as receiving nodes, and the simulated nodes that both send and receive data are denoted as transmission nodes. Step S22: For any transmission node, the simulated node that has a communication connection with the transmission node is denoted as the first-level direct-connected node of the transmission node, and the simulated node that has a communication connection with the first-level direct-connected node is denoted as the second-level direct-connected node of the transmission node; similarly, the simulated node that has a communication connection with the n-1 level direct-connected nodes is denoted as the n-level direct-connected node of the transmission node; where n is the number of the direct-connected node. Step S23: Count the number of directly connected nodes corresponding to different transmission nodes and record it as the number of directly connected nodes; Step S3 involves analyzing different transmission nodes in the digital network space based on the historical anomaly data to obtain a first transmission node and a second transmission node; wherein, step S3 includes: Step S31: Record the time when the transmission node is attacked as the historical attack time, and record the time when the transmission node crashes as the historical crash time, and obtain historical abnormal data of different transmission nodes. Step S32: Obtain the historical attack time and historical crash time of different transmission nodes, and use the historical attack time as the left endpoint and the historical crash time as the right endpoint to form a time period and record it as the historical attack time period of the transmission node. Step S33: Count the number of historical attack times corresponding to different transmission nodes and record them as the number of historical attacks. Count the number of historical crash times corresponding to different transmission nodes and record them as the number of historical crashes. Divide the number of crashes by the number of attacks to obtain the historical crash ratio of the corresponding transmission node. Step S34: Iterate through the historical crash ratios of different transmission nodes to obtain the maximum value of the historical crash ratio, and record the transmission node corresponding to the maximum value of the historical crash ratio as the first transmission node. Step S35: Obtain historical abnormal data of the directly connected nodes corresponding to the transmission nodes during the historical attack period; when there is a historical crash time in the corresponding historical abnormal data, record the working status of the corresponding directly connected node as a crash state; when there is no historical crash time in the corresponding historical data, record the working status of the corresponding directly connected node as a normal state. Step S36: If all directly connected nodes corresponding to the transmission node are in normal condition during the historical attack period, no operation is performed; if any directly connected node corresponding to the transmission node is in a crashed state during the historical attack period, the corresponding directly connected node is recorded as the affected node of the transmission node. Step S37: Obtain the number of directly connected nodes of the transmission node, count the number of affected nodes corresponding to the transmission node during the historical attack period, and record it as the number of affected nodes. Divide the number of affected nodes by the number of directly connected nodes to obtain the affected ratio of the corresponding transmission node. Step S38: Iterate through and compare the sweep ratios of different transmission nodes to obtain the maximum sweep ratio, and record the transmission node corresponding to the maximum sweep ratio as the second transmission node. Step S4 involves analyzing the first transmission node and the second transmission node to obtain the nodes to be optimized in the digital network space; wherein, step S4 includes: Step S41: If the first transmission node and the second transmission node are the same transmission node, then the first transmission node and the second transmission node are collectively recorded as nodes to be optimized in the digital network space; if the first transmission node and the second transmission node are different transmission nodes, then proceed to step S42. Step S42: Obtain the different directly connected nodes corresponding to the first transmission node, and form a first node sequence by combining the different directly connected nodes corresponding to the first transmission node; similarly, obtain the different ripple nodes corresponding to the second transmission node, and form a second node sequence by combining the different ripple nodes corresponding to the second transmission node. Step S43: If the second transmission node belongs to the first node sequence, proceed to step S44; if the first transmission node belongs to the second node sequence, proceed to step S45; if the first transmission node does not belong to the second node sequence and the second transmission node does not belong to the first node sequence, then record the first transmission node and the second transmission node as nodes to be optimized in the digital network space. Step S44 involves analyzing the affected nodes of the second transmission node under different conditions. Step S44 includes: performing a simulated network attack on the first transmission node until it crashes, acquiring the affected nodes of the second transmission node during the simulated network attack and recording them as the first affected node; similarly, performing a simulated network attack on the second transmission node until it crashes, acquiring the affected nodes of the second transmission node during the simulated network attack and recording them as the second affected node; counting the number of the first affected nodes and recording them as the first affected node count, counting the number of the second affected nodes and recording them as the second affected node count; comparing the first affected node count with the second affected node count; if the first affected node count is greater than or equal to the second affected node count, then the first transmission node is recorded as a node to be optimized in the digital network space; if the first affected node count is less than the second affected node count, then the second transmission node is recorded as a node to be optimized in the digital network space. Step S45 involves analyzing the failure rate of the first transmission node under different conditions. Step S45 includes: performing multiple simulated network attacks on the second transmission node until it crashes; recording the number of simulated network attacks as the simulated attack count; recording the time of the second transmission node's crash as the simulated crash time; and recording the start time of the simulated network attacks as the simulated attack time. The simulated attack duration of the second transmission node is obtained by subtracting the simulated attack time from the simulated crash time. The number of crashes of the first transmission node during the multiple simulated network attacks is obtained and recorded as the first simulated crash count. The first simulated crash count is divided by the number of simulated attacks to obtain the first modulo operation of the first transmission node. Simulated crash ratio; Simulated network attacks of the same number of times and duration are performed on the first transmission node, and the number of crashes of the first transmission node during the multiple simulated network attacks is counted and recorded as the second simulated crash count; the second simulated crash count is divided by the number of simulated attacks to obtain the second simulated crash ratio of the corresponding first transmission node; the first simulated crash ratio is compared with the second simulated crash ratio; if the first simulated crash ratio is greater than or equal to the second simulated crash ratio, the second transmission node is recorded as a node to be optimized in the digital network space; if the first simulated crash ratio is less than the second simulated crash ratio, the first transmission node is recorded as a node to be optimized in the digital network space. Step S5: Optimize the corresponding network nodes in the target network based on the nodes to be optimized in the digital network space.

2. An electronic device, characterized in that, The electronic device includes: a memory storing a computer program; and a processor communicatively connected to the memory, wherein when the computer program is executed by the processor, it implements the machine learning-based digital twin dynamic optimization method of claim 1.

3. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the machine learning-based digital twin dynamic optimization method of claim 1.

Images