A forwarding control method and security detection method for multimodal networks

Abstract

This invention discloses a forwarding control method and a security detection method for multimodal networks, belonging to the field of network security. The forwarding control method includes: data plane switches sending modal data packets corresponding to service requirements to the control plane; the control plane parsing the modal data packets to obtain modal identifiers; the control plane writing the corresponding modal data packets into a forwarding queue in the message queue based on the modal identifiers; the control plane retrieving the modal identifiers from the forwarding queues and calculating the shortest forwarding path for the modal data packets based on the network topology of the multimodal network currently controlled by the control plane; simultaneously, retrieving the corresponding flow table entries based on the modal identifiers and issuing the flow table entries to switches along the shortest forwarding path; and the data plane switches forwarding the modal data packets according to the contents of the flow table entries along the shortest forwarding path. This achieves unified communication and control of multimodal networks, with complete functionality and stable performance.

Description

Technical Field

[0001] This invention belongs to the field of network security, and more specifically, relates to a forwarding control method and a security detection method for multimodal networks. Background Technology

[0002] The continuous evolution of network technologies and applications is profoundly reshaping the face of the Internet era, with various network forms and models constantly innovating and developing. With the exponential expansion of network scale and the continuous growth of business demands, traditional network architectures face severe challenges in terms of flexibility and scalability. Against this backdrop, Software-Defined Networking (SDN) has emerged, decoupling the control plane and data plane to achieve centralized and intelligent network management, significantly improving network performance and operational efficiency. In the SDN architecture, the centralization of the control plane allows network engineers to finely control network behavior through software programming, without directly configuring physical devices. The emergence of Programming Protocol-Independent Packet Processors (P4) is a major advancement in the SDN field, driving the rapid development of the programmable data plane. It supports directly defining packet processing methods without being limited to specific network protocols. This protocol independence greatly enhances the programmability of the data plane, enabling network devices to adapt to ever-changing network needs and technological advancements.

[0003] However, with the increasing complexity of network environments, IP-centric network architectures have room for optimization when facing diverse business needs. To address this, the academic community has proposed an intelligent multimodal network architecture, inheriting the north-south architecture concept of SDN, achieving full-dimensional customization at the network layer, and providing rich addressing and routing modes. The application plane, control plane, and data plane together constitute the fully definable functional planes of the multimodal network architecture.

[0004] How to support the forwarding function of data packets from multiple different modes of networks and realize their routing and addressing on a unified platform is a fundamental problem in the research and construction of multimodal networks. Summary of the Invention

[0005] In view of the shortcomings of related technologies, the present invention aims to provide a forwarding control method and a security detection method for multimodal networks, which aims to solve the problem of how to carry forwarding functions of data packets of multiple different modes of networks and realize their routing and addressing on a unified platform.

[0006] To achieve the above objectives, in a first aspect, the present invention provides a forwarding control method for a multimodal network, comprising:

[0007] S1. Obtain the business requirements from the application plane and send them to the data plane to obtain the modal data packets corresponding to the business requirements. parse the modal data packet Obtain modal identifiers ;

[0008] S2, based on the modal identifier modal data packets Write to forwarding queue ;

[0009] S3, from the forwarding queue Obtain the modal identifier And calculate the modal data packets based on the network topology of the multimodal network currently controlled by the control plane. The shortest forwarding path; simultaneously, based on the modality identifier Obtain the corresponding flow table entry and distribute the flow table entry to the switches along the shortest forwarding path, so that the switches in the data plane forward the modal data packets according to the flow table entry. Forward according to the shortest forwarding path described above;

[0010] The flow table entry includes a list of matching fields, a list of actions to be performed, and a default action to be performed; the network includes multiple modalities, and the header of the modal data packet includes a modal identifier.

[0011] Optionally, the data plane switch processes the modal data packets according to the flow table entries. Forwarding according to the shortest forwarding path, including:

[0012] The data plane switch parses the Ethernet header of the modal data packet to obtain the corresponding modality, selects the parsing logic for the corresponding modality in the network layer according to the value of the Ethernet type field, processes the modal data packet according to the parsing logic, and obtains the header field value corresponding to each modality.

[0013] The switch, based on the acquired modality and the corresponding flow table entry, matches the header field values ​​of all modality data packets received by the switch according to the matching field list of the flow table entry. Based on the matching result, it retrieves the corresponding default execution action from the execution action list of the flow table entry, sets the forwarding port, and sends the modality data packet from the corresponding forwarding port of the switch to the network to complete the forwarding of the modality data packet.

[0014] Optionally, the switch defines a multimodal message format including: an Ethernet header field and a multimodal network layer header field;

[0015] The Ethernet header fields include a type field. Ethernet header fields of the same modality have the same format, while multimodal network layer header fields of different modalities have different formats.

[0016] In a second aspect, the present invention also provides a security detection method for multimodal networks, based on the method described in any one of the first aspects, comprising:

[0017] T1. A multimodal network traffic data detection model is used to detect the real-time network performance indicators of the multimodal network. Based on the network performance indicators, it is determined whether abnormal traffic has occurred in the multimodal network. When abnormal traffic occurs, abnormal traffic data packets are acquired. With the corresponding abnormal mode identifier ;

[0018] T2, based on the abnormal mode identifier Modify the flow table policy and mark the abnormal modality. Corresponding abnormal traffic data packets Write to blocking queue ;

[0019] T3, from the blocking queue Obtain the abnormal mode identifier from And query the routing policy corresponding to this modality identifier, and send drop flow table entries to the switches along the path of the routing policy;

[0020] T4. The data plane switch identifies the abnormal mode according to the contents of the drop flow table entry. Corresponding abnormal traffic data packets throw away;

[0021] The training process of the multimodal network traffic data detection model includes:

[0022] Real-time network data measurement is performed on the data plane to generate end-to-end measurement records;

[0023] Based on the measurement records, several network performance metrics are calculated; these network performance metrics include end-to-end latency, switch queue depth, packet arrival time interval, latency jitter, and link latency.

[0024] The measurement records and network performance indicators are used as measurement data for deep learning training to obtain a multimodal network traffic data detection model.

[0025] Optionally, the multimodal network traffic data detection model uses the Transformer model as the detection framework;

[0026] The Transformer model takes real-time network data measurement results as source data input, embeds modality-related feature information during the multimodal feature embedding process, and injects time series information through position encoding.

[0027] Optionally, the Transformer model comprises an input part, an encoder part, a decoder part, and an output part;

[0028] The input portion is preprocessed using group normalization.

[0029] The encoder part consists of multiple encoders, each of which consists of a self-attention layer and a feedforward neural network; wherein, a multi-head attention mechanism is used to modify the self-attention layer so that the model learns the network performance characteristics corresponding to each modality;

[0030] The decoder part consists of multiple decoders, each of which has a self-attention layer and a feedforward neural network, and there is an Encoder-Decoder attention layer that combines the encoder output between them; a modality-aware attention bias mechanism is introduced in the encoder to adaptively enhance the correlation between features of the same modality;

[0031] The output section outputs a high-dimensional vector. A linear transformation maps this vector to the dimension of the target space, and then converts it into a probability distribution. The classification head uses the Sigmoid activation function to output the probability of abnormal traffic and the results of modality recognition.

[0032] Thirdly, the present invention also provides a control plane controller, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the forwarding control method as described in any one of the first aspects, or to implement the steps of the security detection method as described in any one of the second aspects.

[0033] Fourthly, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the forwarding control method as described in any one of the first aspects, or implements the steps of the security detection method as described in any one of the second aspects.

[0034] Compared with the prior art, the above-described technical solutions conceived in this invention can achieve the following beneficial effects:

[0035] 1. This invention provides a forwarding control method for multimodal networks. Based on the SDN data plane, it designs and implements data packet and routing forwarding mechanisms for various network modes, and deploys them on a programmable switch. The multimodal network architecture includes an application plane, a control plane, and a data plane. In the SDN control plane, network topology management, multimodal packet parsing, dynamic route calculation, flow table generation and distribution, network status analysis, and network measurement are implemented through module partitioning. Centralized management and control of the multimodal network are achieved through resource coordination and control scheduling algorithms. A deep learning-based multimodal network traffic time-series model is established to achieve multimodal identification. The multimodal network includes network forms such as IP, content, identity, geographic location, and elastic address space. The data plane and control plane form a fully definable functional plane. This invention achieves unified communication and control of multimodal networks, with complete functionality and stable performance.

[0036] 2. This invention provides a security detection method for multimodal networks. It constructs a multimodal security detection framework in the control plane, establishes a deep learning-based multimodal network traffic time-series model, and achieves multimodal traffic anomaly detection. The security detection framework introduces intrinsic security capabilities. The multimodal network and control architecture constructed in this invention provide theoretical support and practical foundation for building fully definable, intrinsically secure multimodal networks. Attached Figure Description

[0037] Figure 1 This is a diagram illustrating the architecture of a multimodal network control system provided in an embodiment of the present invention.

[0038] Figure 2 This is a schematic diagram of the ID modal message header structure provided in an embodiment of the present invention.

[0039] Figure 3 This is a schematic diagram of the NDN modal message header structure provided in an embodiment of the present invention.

[0040] Figure 4 This is a schematic diagram of the Geo-modal message header structure provided in an embodiment of the present invention.

[0041] Figure 5 This is a schematic diagram of the FlexIP modal message header structure provided in an embodiment of the present invention.

[0042] Figure 6 This is a schematic diagram of the header structure of a Custom modal message provided in an embodiment of the present invention.

[0043] Figure 7 A flowchart illustrating the state of multimodal header parsing provided in an embodiment of the present invention.

[0044] Figure 8 This is a schematic diagram of the multimodal flow table structure provided in an embodiment of the present invention.

[0045] Figure 9 This is a schematic diagram of a Transformer-based multimodal traffic anomaly detection and modal recognition framework provided in an embodiment of the present invention. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0047] The following description, in conjunction with a preferred embodiment, illustrates the content involved in the above embodiments.

[0048] Example 1

[0049] Multimodal networks are a new type of network architecture that needs to support the communication functions of various heterogeneous network services. The control architecture of multimodal networks is significantly different from the traditional SDN controller architecture. It needs to consider the parsing of data packets of various network modes, expand the flow table structure to adapt to heterogeneous networks, detect the data plane status of various network modes to generate network topology, and design network security detection mechanisms according to the communication mode of each network mode to maintain the normal operation of the data plane.

[0050] The multimodal network and multimodal network control architecture constructed in this embodiment can implement the forwarding control method and the security detection method of the multimodal network, as detailed below:

[0051] A forwarding control method for a multimodal network includes:

[0052] S1. Obtain the business requirements from the application plane and send them to the data plane to obtain the modal data packets corresponding to the business requirements. parse the modal data packet Obtain modal identifiers ;

[0053] S2, based on the modal identifier modal data packets Write to forwarding queue ;

[0054] S3, from the forwarding queue Obtain the modal identifier And calculate the modal data packets based on the network topology of the multimodal network currently controlled by the control plane. The shortest forwarding path; simultaneously, based on the modality identifier Obtain the corresponding flow table entry and distribute the flow table entry to the switches along the shortest forwarding path, so that the switches in the data plane forward the modal data packets according to the flow table entry. Forward according to the shortest forwarding path described above;

[0055] The flow table entry includes a list of matching fields, a list of actions to be performed, and a default action to be performed; the network includes multiple modalities, and the header of the modal data packet includes a modal identifier.

[0056] Optionally, the data plane switch processes the modal data packets according to the flow table entries. Forwarding according to the shortest forwarding path, including:

[0057] The data plane switch parses the Ethernet header of the modal data packet to obtain the corresponding modality, selects the parsing logic for the corresponding modality in the network layer according to the value of the Ethernet type field, processes the modal data packet according to the parsing logic, and obtains the header field value corresponding to each modality.

[0058] The switch, based on the acquired modality and the corresponding flow table entry, matches the header field values ​​of all modality data packets received by the switch according to the matching field list of the flow table entry. Based on the matching result, it retrieves the corresponding default execution action from the execution action list of the flow table entry, sets the forwarding port, and sends the modality data packet from the corresponding forwarding port of the switch to the network to complete the forwarding of the modality data packet.

[0059] A security detection method for multimodal networks, implemented based on the aforementioned forwarding control method for multimodal networks, includes:

[0060] T1. A multimodal network traffic data detection model is used to detect the real-time network performance indicators of the multimodal network. Based on the network performance indicators, it is determined whether abnormal traffic has occurred in the multimodal network. When abnormal traffic occurs, abnormal traffic data packets are acquired. With the corresponding abnormal mode identifier ;

[0061] T2, based on the abnormal mode identifier Modify the flow table policy and mark the abnormal modality. Corresponding abnormal traffic data packets Write to blocking queue ;

[0062] T3, from the blocking queue Obtain the abnormal mode identifier from And query the routing policy corresponding to this modality identifier, and send drop flow table entries to the switches along the path of the routing policy;

[0063] T4. The data plane switch identifies the abnormal mode according to the contents of the drop flow table entry. Corresponding abnormal traffic data packets throw away.

[0064] The multimodal network constructed in this invention includes various novel addressing methods, network configurations, and forwarding strategies. Its network transport mechanism is implemented under an SDN architecture and P4 programmable technology. From top to bottom, it comprises an application plane, a control plane, and a data plane, each undertaking different responsibilities, such as... Figure 1 As shown.

[0065] This scheme implements a forwarding control method for a multimodal network based on P4 programmable switches and SDN architecture. The specific contents include: (1) designing the communication mode and message structure of the new modal network, and realizing the routing and addressing of multimodal data packets based on programmable network technology in the data plane; (2) designing the control plane architecture of the multimodal network, performing centralized management and control of multimodal networks in a distributed and modular form, and designing a control scheduling algorithm to realize the collaborative control and optimization of multimodal transactions; (3) constructing a security detection framework for the multimodal network, introducing a modality-related position bias mechanism, proposing a machine learning model with modality perception capability, and improving the ability of multimodal traffic anomaly detection and modality recognition.

[0066] In the data plane, the P4 programmable switch allows for customizable packet parsing logic to verify format validity, and implements fine-grained access control and direct discarding of abnormal traffic through flow tables. It also integrates INT in-band telemetry to natively sense network status. In the control plane, the measurement module collects key indicators, and the security module, based on a modality-aware Transformer model, detects anomalies in real time and locates their sources, triggering the control module and flow table module to dynamically update flow table policies, forming a "detection-response-protection" closed loop. Differentiated security policies can be formulated for different modalities such as IP, ID, and NDN, adapting to diverse scenario requirements and achieving proactive immunity and dynamic defense throughout the entire process. Security is ensured through the network architecture and its components themselves, rather than relying on externally added protection; therefore, the forwarding control method for multimodal networks implemented in this solution has an inherent security effect.

[0067] (1) Design of multimodal message header format and addressing mode

[0068] The multimodal network in this solution needs to borrow from the working mode of IP networks to achieve multimodal message communication. Ethernet frames contain source MAC addresses, destination MAC addresses, and Ethernet type. The Ethernet type field, EtherType, identifies the protocol type; for example, 0x0800 represents IPv4, and 0x86DD represents IPv6. Currently, this field still has many reserved values ​​available, which makes it possible to define multimodal related identifiers and support a multimodal architecture running parallel to IP protocols. The Ethernet type field of multimodal messages typically uses non-standard EtherType values ​​to identify mode affiliation. Implementing a multimodal network not only requires specifying the mode type in the Ethernet frame through the EtherType field but also embedding mode-related fields within the limited header space. Since the MAC address at the link layer is bound to the physical device, its addressing method is relatively fixed. To support multimodal data transmission running parallel to IP packets, the focus is on modifying the network layer structure.

[0069] The control plane defines the multimodal message format, including: Ethernet header fields and multimodal network layer header fields; the Ethernet header fields include a type field, the format of the Ethernet header fields is the same for each mode, and the format of the multimodal network layer header fields is different for each mode.

[0070] The multimodal network layer header fields proposed in this scheme include IP modality, identity modality (ID modality), content modality (NDN modality), geomodality (Geo modality), flexible address modality (FlexIP modality), and user-defined modality (Custom modality), which together form the packet header structure and serve as the multimodal network layer header fields. This enables multimodal packets to be parsed and forwarded on data plane devices, thereby meeting the diverse needs of multimodal networks.

[0071] like Figures 2-6 As shown, the data packets of multimodal networks corresponding to different modalities are illustrated, including the data packet formats for ID, NDN, Geo, FlexIP, and Custom modalities. Besides basic information fields such as version, protocol, type, length, hop count limit, TTL, and checksum, each modal type has its own unique source-destination addressing identifier with different bit lengths. For example... Figure 3 As shown, NDN modal data packets are divided into Interest Packets and Data Packets, both of which are encoded using TLV format. Figure 4 As shown, to ensure its robustness and scalability, the Geo modality defines basic information fields in the base message (geo), while functional fields are defined in the broadcast message (GeographicalBroadcast, gbc) and the node message (beacon), respectively, each with different functions. For example... Figure 5 As shown, the FlexIP modality dynamically scales the address length through index blocks, and is divided into four spatial address formats: "restricted," "expandable," "hierarchical segmentation," and "multi-semantic." These formats are reflected in the source and destination address types. For example, the index value distinguishes the format type (e.g., indices 0x01~0xEF correspond to the "restricted" spatial format, and 0xF0~0xF5 correspond to the "expandable" spatial format). This index value is mapped to the "source address type (src_format)" and "destination address type (dst_format)" fields in the FlexIP modality packet header. While inheriting the core routing mechanism of IPv4 / IPv6, it breaks through the limitations of traditional fixed-length addresses.

[0072] Design rules and algorithms for generating modal identifiers, perform header parsing, flow table matching, and action execution on multimodal packets in a P4 switch, complete a custom routing and forwarding multimodal network communication mechanism, and achieve efficient multimodal network communication by defining multimodal packet formats and optimizing the forwarding process.

[0073] (2) Control plane architecture of multimodal network, design control scheduling algorithm to realize forwarding control and abnormal traffic detection of multimodal network.

[0074] Traditional SDN networks rely on the IP protocol for rule setting in the control plane and packet forwarding in the data plane. However, the introduction of multimodal networks brings new challenges. Multimodal networks support multiple data forwarding modes, each with its own unique forwarding logic and requirements. In order to achieve efficient and flexible multimodal communication between the control plane and the data plane, this invention designs an overall architecture for a multimodal control system.

[0075] The application plane, located at the top layer of the network architecture, focuses on resource scheduling and service delivery. It interacts with the control plane to transmit higher-level service requirements downwards. The control plane is the core of the multimodal network delivery mechanism. It employs a clustered distributed architecture for unified management, with multiple controllers working collaboratively to achieve core functions such as network topology acquisition, modality resolution, route calculation, flow table distribution, and network measurement. Furthermore, the control plane incorporates anomaly detection technology, enabling real-time multimodal traffic anomaly detection and modality recognition. This allows the overall network to inherently build security mechanisms and continuously improve its security capabilities through learning, thus exhibiting a degree of adaptability to unknown and changing network environments. The data plane, as the lowest-level infrastructure in the multimodal network, uses P4 programmable switches as its core devices. It primarily handles the actual packet forwarding tasks. The switches execute instructions from the control plane and utilize dynamically configured flow tables to route and forward data packets.

[0076] The control system is divided into five independent modules with clearly defined functions and interfaces: the "Control Module," the "Analysis Module," the "Flow Table Module," the "Measurement Module," and the "Safety Module." Figure 1 As shown. The first three modules mainly complete the control tasks of the multimodal SDN network, while the latter two modules constitute the security detection framework of the multimodal network, periodically measuring the network status and performing anomaly detection, and collaboratively completing the security protection of the control plane through proactive defense mechanisms.

[0077] To effectively manage the efficient flow of data between modules, the system designs a module scheduling algorithm for the aforementioned modular architecture, constructing a clustered, distributed intelligent control system that handles multimodal transactions between modules using a scheduling chain approach. The control plane's functions, including topology acquisition, modality resolution, flow table creation, intelligent routing, and network measurement, adapt to the resource optimization needs of complex network environments. It can efficiently support control plane communication in medium- to large-scale environments and effectively control the behavior of each module, enabling flexible processing of multimodal transactions.

[0078] The algorithm employs a multi-threaded approach, separating the main scheduling task from auxiliary tasks for execution, and implementing event-driven execution through registered listening events and hook functions within modules. The main scheduling task directly serves the core process of multimodal services, including a forwarding control chain of "parsing modality identifiers - writing to the forwarding queue - distributing flow tables - data forwarding" and a security protection chain of "collecting telemetry data - detecting anomalies - writing to the blocking queue - updating flow tables to block anomalies." Auxiliary tasks are periodic, background tasks supporting the main task, including the control module periodically updating the network topology view via the LLDP protocol and the measurement module periodically collecting network metrics such as latency and queue depth. The algorithm allocates these tasks to different threads for independent execution, prioritizing resources for the main task to ensure low latency, while auxiliary tasks run periodically in the background, avoiding mutual interference and improving overall scheduling efficiency and system stability.

[0079] Meanwhile, the algorithm constructs a hierarchical message queue system, using a multi-level pipeline mechanism to achieve asynchronous communication between modules, thereby improving the algorithm's execution efficiency. The scheduling algorithm mainly implements two task scheduling chains: first, after the parsing module obtains the modal identifier, it triggers the control module to write it to the forwarding queue, and the flow table module subscribes to and distributes the flow table; second, after the security module detects an anomaly, it triggers writing to the blocking queue, and the flow table module updates the flow table to block the anomaly, thus linking multiple modules to complete multimodal control and security tasks. These two tasks require the cooperation of multiple modules, and the task of the scheduling algorithm is to link multiple functional modules together to jointly achieve multimodal control tasks.

[0080] 1. Implementation of parsing modal data packets and formulating flow table strategies.

[0081] When the data plane switch sends a modal data packet to the control plane, the parsing module extracts the modal identifier through header parsing logic, triggering the listening event registered by the control module. Its hook1 function is activated, and the modal identifier is written to the forwarding queue of the hierarchical message queue. Qforward The flow table module asynchronously consumes queue messages through a subscription mechanism. Combined with the network topology view dynamically updated by the control module based on the LLDP protocol, it calls the shortest path algorithm to calculate the forwarding path, matches the flow table template corresponding to the modality identifier to generate flow table entries, and then distributes the flow table to the switches along the path through the P4Runtime protocol. The entire process is connected through thread collaboration and queue communication between the "parsing module → control module → flow table module". Each module only interacts through a standardized interface and does not need to wait for other modules to block execution.

[0082] 2. Implementation of detecting abnormal traffic and modifying flow table strategies

[0083] The measurement module, operating as an independent sub-thread, periodically collects metrics such as end-to-end latency and switch queue depth from the data plane using INT in-band telemetry technology, and synchronizes this data to the security module. The security module runs anomaly detection logic (with the Transformer model as its core algorithm). If anomalies are detected (such as a sudden increase in queue depth or excessive latency jitter), the module identifies the abnormal modality and triggers the hook2 function of the control module, writing the anomaly flag into the blocking queue. Qblock After the flow table module subscribes to the queue, it quickly queries the routing path corresponding to the anomaly identifier, generates a flow table entry for the drop action, and sends it to the switches along the path, completing the dynamic update of the flow table policy. During this process, the auxiliary detection tasks of the measurement and security modules and the core response tasks of the flow table module are executed separately through threads, and the queue mechanism ensures low latency in anomaly response.

[0084] A deep learning-based multimodal network traffic time-series model is established to achieve multimodal traffic anomaly detection and modality recognition. Multi-dimensional metrics such as end-to-end latency, switch queue depth, packet arrival time interval, and latency jitter are obtained through network measurement techniques. Based on this data, a deep learning model is constructed and trained to achieve traffic anomaly detection and modality recognition in a multimodal network environment.

[0085] In-band telemetry is a real-time network data measurement technique that enables fine-grained monitoring of network performance by directly embedding network status information into the data packet transmission path. The network measurement process typically generates a large number of telemetry data reports, which are collected and parsed by the INT collector to extract network performance metrics. Each end-to-end measurement generates an end-to-end record (e2e_record) and several corresponding hop-by-hop records (hop_record). Based on these records, several key network performance metrics can be calculated, including end-to-end latency (e2e_delay), hop-by-hop switch latency (hop_latency), switch jitter (hop_jitter), and link latency (link_delay). This data is also converted into time series data and fed into a deep learning model for learning and training, enabling tasks such as traffic anomaly detection and modality recognition.

[0086] The collected network traffic data possesses complex characteristics such as high dimensionality, nonlinearity, and multimodality. These data exhibit specific evolutionary patterns over time, providing feasibility for anomaly traffic prediction based on historical data. The security module employs the Transformer model as its core detection framework, adaptively modified to suit the characteristics of multimodal network traffic data. The Transformer-based multimodal traffic anomaly detection and modality recognition framework also consists of four parts: input, encoder, decoder, and output. Multimodal adaptation of the model is primarily performed in the input part (i.e., data preprocessing) and the encoder / decoder regions, thereby endowing the model with modality perception capabilities.

[0087] The preprocessing stage of Transformer typically uses word embedding algorithms to convert each word in the source data into a word vector, completing feature embedding. In time-series-based multimodal anomaly detection tasks, the Transformer model takes the INT measurement results as the source data input, embeds modality-related feature information such as IP, ID, Geo, NDN, and FlexIP through a multimodal feature embedding process, and injects time-series information through positional encoding.

[0088] The encoder region consists of multiple encoders, each composed of a self-attention layer and a feed-forward network (FFN). Residual connections and layer normalization operations mitigate the vanishing gradient problem, ensuring stable convergence of the model during training. The main modification focuses on the self-attention layer, imbuing the original multi-head attention mechanism with modality awareness. This allows the model to correctly learn the latency, jitter, and queue depth features corresponding to each modality, enhancing its perception of correlations within the same modality in the time series and dynamically capturing correlation patterns of temporal features across different modalities.

[0089] The decoder region consists of multiple decoders, each with a self-attention layer and a feedforward neural network. However, there is also an Encoder-Decoder attention layer that incorporates the encoder output. Modality awareness is also added to the encoder. By introducing a modality-aware attention bias mechanism, the correlation between features of the same modality is adaptively enhanced, while interference between features of different modalities is reduced. This effectively mitigates the problem of sudden changes in data features caused by modality switching, improving the model's robustness and prediction accuracy in complex multimodal scenarios.

[0090] The decoder output is a high-dimensional vector. A linear transformation maps this vector to the dimension of the target space, and then the output is converted into a probability distribution through a SoftMax operation. The classification head uses the Sigmoid activation function to output the probability of abnormal traffic and the results of modality recognition.

[0091] The overall architecture of the multimodal control system is as follows Figure 1 As shown, the scheduling algorithm achieves efficient scheduling through parallelization, event-driven mechanisms, and asynchronous communication pipes. The input to the module scheduling algorithm is a data stream. Initial topology and initial message queue Since it operates continuously in the control plane, the algorithm will continue to run as long as the service remains active, and its output is a flow table entry. .

[0092] The control plane obtains an overall view of the data plane by integrating link information. e and host information v The control module in the control plane utilizes LLDP (Link Layer Discovery Protocol) to achieve link discovery and host discovery. The algorithm creates a sub-thread to periodically update the topology view as a timed task, providing topology support for subsequent policy formulation, as shown in formula (1).

[0093] (1)

[0094] When performing forwarding control tasks in a multimodal network, the control plane parses modal data packets and formulates flow table policies.

[0095] When the data plane switch transmits modal data packets After being sent to the control plane, the parsing module will parse the modal data packet to obtain the modal identifier, i.e. The modal identifier field is a factor that can influence the definition of flow tables. It is often composed of source host modal identifiers and destination host modal identifiers, such as the source IP address and destination IP address in IP modal. The parsed modal identifier will trigger a listener event defined by the control module. The hook1 function of the control module will receive this modal identifier and write the newly uploaded modal data packet to the message queue. forwarding queue in ,Right now The flow table module subscribes to message queues and executes consumption tasks asynchronously. In this case, it retrieves the modality identifier from the forwarding queue and calculates the shortest forwarding path based on the current network topology. Then, flow table entries are sent to the switches along this path, i.e. This guides the data plane in implementing the forwarding of modal data packets.

[0096] In the data plane, the multimode switch executes pipelined processing logic based on the SDN flow tables issued by the control plane. First, it performs layer-by-layer header parsing on the data packets. The parser function in the P4 program defines a state machine for multimode header parsing; each state in the state machine is called a "state," such as... Figure 7 As shown. The parser parses the Ethernet header and jumps to the parsing state of the corresponding network layer mode based on the value of the Ethernet type field, processing the headers of IP mode, ID mode, NDN mode, Geo mode, FlexIP mode, and Custom mode respectively.

[0097] The P4 program defines flow tables for IP, ID, Geo, NDN, FlexIP, and Custom modalities. These flow tables contain structures such as a list of matching fields (key), a list of actions (actions), a default action (default_action), a counter, and a priority. Figure 8 As shown. After the data packet passes through the parser, it matches the header and metadata information according to the flow table entry rules, executes the action corresponding to the flow table entry to set the forwarding port, and when the switch successfully executes the action, it will send the data packet from the corresponding physical port of the switch to the network according to the port mapping relationship, thereby realizing the forwarding of the data packet.

[0098] When performing security inspection tasks in multimodal networks, the control plane detects abnormal traffic and modifies flow table policies.

[0099] The security detection framework in the control plane also periodically performs traffic feature extraction and network status measurement on the data plane. The measurement module collects measurement indicators such as latency, jitter, queue depth, and bandwidth of the data plane. Then, deep learning training is performed on the measurement data to classify abnormal traffic, as shown in formula (2).

[0100] (2)

[0101] Traffic characteristics obtained from network measurements are classified using anomaly detection algorithms. Data packets contained in anomalous traffic are then... This indicates that the modal identifiers after parsing these data packets are denoted as... When the security module detects an anomaly in the current network status indicators, that is... First, the abnormal modality flag is located, and then the hook2 function of the control module is triggered. This function notifies the flow table module to modify the flow table policy and write the abnormal modality flag into the blocking queue. ,Right now The flow table module subscribes to message queues and performs asynchronous consumption tasks, retrieving abnormal modality identifiers from them, and then querying the routing policy corresponding to these identifiers. Then, drop flow table entries are sent to switches along the path of this routing policy, i.e. This guides the data plane to discard abnormal traffic packets.

[0102] (3) A modality-related position bias mechanism is introduced, and a machine learning model with modality perception capability is proposed, which improves the ability of multimodal traffic anomaly detection and modality recognition.

[0103] Figure 9 A schematic diagram of a framework for multimodal traffic anomaly detection and modality recognition based on Transformer is shown. This invention realizes a multi-head attention mechanism for multimodal feature embedding and modality awareness.

[0104] 1. Multimodal feature embedding

[0105] The goal of the embedding layer is to transform the INT metric into time-series data suitable for the Transformer model. The function first extracts feature matrices and anomaly labels from the multimodal measurement dataset, including switch latency, end-to-end latency, queue depth, packet arrival interval, latency jitter, and modality type. Then, the data is grouped according to modality type, and after removing the modality type fields from each group, it is normalized using MinMaxScaler. The reshaped modality type fields are then merged with the normalized data. Subsequently, the data is reorganized according to the original time series based on the data index, and a sliding window mechanism is used to divide the continuous data into subsequences with fixed time steps. Finally, the data is proportionally divided into training and test sets, providing structured, time-series, and modally distinct feature data for the Transformer model input.

[0106] In the feature selection stage, by analyzing the correlation between network traffic characteristics and anomaly detection tasks, seven key features were finally selected: switch latency hop_latency, end-to-end latency e2e_delay, modal type modal_type, queue depth queue_occupancy, packet arrival interval IAT, switch latency jitter hop_jitter, and end-to-end jitter e2e_jitter, as shown in Equation (3).

[0107] (3)

[0108] The design of this feature system takes the following considerations: latency features can effectively capture burst traffic characteristics; queue depth features directly reflect the load of network devices; packet arrival interval indicators can indirectly reflect traffic bandwidth; jitter indicators characterize the stability of traffic transmission; and mode type, as a key classification indicator, can effectively solve the mode confusion problem existing in direct global normalization, avoiding misjudgment of abrupt changes in data distribution caused by mode switching as anomalies. The measurement data distribution of packets from different modes varies significantly. If all multimodal traffic is uniformly normalized, then when traffic switches from one mode to another, the Transformer model cannot distinguish whether the abrupt change in measurement data is due to traffic anomalies or mode switching.

[0109] The preprocessing stage employs a grouping normalization strategy: First, the data is classified based on the modal_type field to obtain independent measurement data for each modality. Then, MinMaxScaler normalization is performed on the measurement data for each independent modality. Finally, the modal_type field is reshaped, and the reshaped modal_type value is merged with the normalized measurement data and added to the final grouping normalization list.

[0110] The list generated after grouping and normalization obfuscates the original time series. Since the list stores the data indices, sorting by index allows for reassembly according to the original time series. During the time series construction phase, a sliding window mechanism is used to divide continuous data into subsequences of specific time steps. The window size needs to balance the capture of short-term anomalies with the modeling of long-term dependencies. To maintain temporal continuity, the data reassembly process strictly preserves the original time series relationships, ultimately dividing the complete dataset into training and test sets according to a certain ratio.

[0111] 2. Multi-head attention mechanism of modality perception

[0112] Modality-aware self-attention layers can use multi-head attention mechanisms to detect anomalies in different modalities. To achieve modality awareness, the differences in network modalities need to be embedded into the attention calculation, enabling the model to dynamically adjust feature weights and interaction relationships in different modalities. Feature data collected by the measurement module shows that, with a fixed packet payload length, the feature differences between different modalities are mainly reflected in end-to-end latency, hop-by-hop latency, and queue depth metrics.

[0113] To reflect the differences in measurement features between modalities, this layer introduces a modality-related attention bias matrix to enhance modality discrimination, enabling the model to focus more on learning modality-discretionary features. The average latency or queue depth indicators of different modalities show a definite proportional relationship, and the offset coefficients of various modalities relative to the IP modality are shown in Equation (4).

[0114] (4)

[0115] When processing actual feature sample sets, the modalities of the feature samples may differ. In order to suppress the influence of modal changes on anomaly detection, a similarity coefficient (5) is defined for modalities m and n, where It is an adjustable decay factor with a default value of 1.0. The exponential decay function projects features onto a uniform and comparable metric space while dynamically adjusting for "strong decay due to large modal differences, and weak decay due to similar modalities".

[0116] (5)

[0117] Matrix parameters and The attention bias matrix M is used to generate the attention bias matrix. For samples i and j, if the two samples have the same modality type, the same-modality association will be enhanced; otherwise, cross-modal association will be suppressed, as shown in formula (6). Analysis reveals that if the modality types are different, the greater the modality difference, the smaller the similarity coefficient, and the weaker the suppression effect. Conversely, when the modalities are similar, the suppression effect is enhanced. Therefore, the parameters... The selection of the modal offset coefficient should ensure that the greater the modal difference, the weaker the cross-modal correlation; if the modes are the same, the modal offset coefficient should be chosen. It will undergo nonlinear compression, causing the reinforcement strength to vary. Growth should be gradual and moderate to avoid high-indicator modalities dominating attention distribution.

[0118] (6)

[0119] The attention calculation formula for the modality-aware self-attention layer after introducing the modality-related position bias mechanism is shown in (7), where Q, K, and V represent the query information, the queried information, and the actual information value, respectively. The dimension representing the key is added to the standard Transformer attention calculation by adding a matrix bias, thereby achieving modality awareness.

[0120] (7)

[0121] Based on the above, a modality-related position bias mechanism is introduced, and a machine learning model with modality perception capability is proposed, which improves the ability to detect multimodal traffic anomalies and identify modalities.

[0122] Furthermore, the existing SDN anomaly detection dataset is modified for multimodal operation, and end-to-end communication is performed by replaying the dataset at a certain rate. Multi-dimensional metrics such as end-to-end latency, switch queue depth, packet arrival time interval, and latency jitter are obtained through network measurement techniques. Based on this data, a deep learning model is built and trained to achieve traffic anomaly detection and modality recognition in a multimodal network environment.

[0123] By sending multimodal modified data streams at different replay rates, the overall communication latency can be calculated based on the control plane's modality resolution latency, message queue latency, routing calculation latency, flow table distribution latency, and the data plane's switch latency and link latency, thus evaluating system performance. This invention can support multimodal communication with 2000 data nodes. When the replay rate is greater than 400Mbps, it can save approximately 14% to 23% of time overhead compared to traditional control architectures, and multimodal communication only incurs 5% to 8% additional overhead compared to single-IP mode.

[0124] By replaying normal and abnormal traffic after multimodal transformation at a fixed rate, the proposed Transformer-based multimodal traffic anomaly detection and classification algorithm is compared with anomaly traffic time-series prediction algorithms based on LSTM, RNN, and TCN. This demonstrates the advantages of this invention in multimodal network security maintenance. The modality-aware Transformer algorithm achieves an anomaly detection accuracy of 96.49%, higher than LSTM, TCN, and RNN's 95.96%, 95.96%, and 74.39%, respectively. Its modality recognition accuracy is 99.72%, also superior to the other three algorithms.

[0125] In this invention, the multimodal network introduces novel addressing and routing mechanisms such as content-based, identity-based, geographic, elastic address space, satellite networks, and optical networks. It encompasses various network forms including hierarchical networks, distributed networks, peer-to-peer networks, and hybrid networks, supports multiple protocol types such as reliable transmission protocols, real-time transmission protocols, and high-efficiency transmission protocols, and integrates forwarding strategies such as dynamic forwarding, intelligent forwarding, and multi-path forwarding. Furthermore, it can perform intelligent decision-making based on multidimensional data, including traffic analysis, resource scheduling, and route optimization. This multimodal network architecture effectively expands the application boundaries of traditional TCP / IP networks, providing users with a higher quality and more personalized service experience. The data plane and control plane constitute a fully definable functional plane, and the security detection framework introduces inherent security capabilities. This invention enables unified communication and control of multimodal networks, with complete functionality and stable performance, providing theoretical support and a practical foundation for building fully definable and inherently secure multimodal networks.

[0126] Example 2

[0127] The present invention also provides a control plane controller, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the forwarding control method as described in any one of Embodiment 1, or to implement the steps of the security detection method as described in any one of Embodiment 1.

[0128] Example 3

[0129] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the forwarding control method as described in any one of Embodiment 1, or implements the steps of the security detection method as described in any one of Embodiment 1.

[0130] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A forwarding control method for a multimodal network, characterized in that, include: S1. Obtain the business requirements from the application plane and send them to the data plane to obtain the modal data packets corresponding to the business requirements. parse the modal data packet Obtain modal identifiers ; S2, based on the modal identifier modal data packets Write to forwarding queue ; S3, from the forwarding queue Obtain the modal identifier And calculate the modal data packets based on the network topology of the multimodal network currently controlled by the control plane. The shortest forwarding path; simultaneously, based on the modality identifier Obtain the corresponding flow table entry and distribute the flow table entry to the switches along the shortest forwarding path, so that the switches in the data plane forward the modal data packets according to the flow table entry. Forward according to the shortest forwarding path described above; The flow table entry includes a list of matching fields, a list of actions to be performed, and a default action to be performed; the network includes multiple modalities, and the header of the modal data packet includes a modal identifier; The data plane switch processes the modal data packets according to the flow table entries. Forwarding according to the shortest forwarding path, including: The data plane switch parses the Ethernet header of the modal data packet to obtain the corresponding modality, selects the parsing logic for the corresponding modality in the network layer according to the value of the Ethernet type field, processes the modal data packet according to the parsing logic, and obtains the header field value corresponding to each modality. The switch, based on the acquired modality and the corresponding flow table entry, matches the header field values ​​of all modality data packets received by the switch according to the matching field list of the flow table entry. Based on the matching result, it retrieves the corresponding default execution action from the execution action list of the flow table entry, sets the forwarding port, and sends the modality data packet from the corresponding forwarding port of the switch to the network to complete the forwarding of the modality data packet.

2. The method as described in claim 1, characterized in that, The switch defines a multimodal packet format including: an Ethernet header field and a multimodal network layer header field; The Ethernet header fields include a type field. Ethernet header fields of the same modality have the same format, while multimodal network layer header fields of different modalities have different formats.

3. A security detection method for multimodal networks, based on the method described in any one of claims 1-2, characterized in that, include: T1. A multimodal network traffic data detection model is used to detect the real-time network performance indicators of the multimodal network. Based on the network performance indicators, it is determined whether abnormal traffic has occurred in the multimodal network. When abnormal traffic occurs, abnormal traffic data packets are acquired. With the corresponding abnormal mode identifier ; T2, based on the abnormal mode identifier Modify the flow table policy and mark the abnormal modality. Corresponding abnormal traffic data packets Write to blocking queue ; T3, from the blocking queue Obtain the abnormal mode identifier from And query the routing policy corresponding to this modality identifier, and send drop flow table entries to the switches along the path of the routing policy; T4. The data plane switch identifies the abnormal mode according to the contents of the drop flow table entry. Corresponding abnormal traffic data packets throw away; The training process of the multimodal network traffic data detection model includes: Real-time network data measurement is performed on the data plane to generate end-to-end measurement records; Based on the measurement records, several network performance metrics are calculated; these network performance metrics include end-to-end latency, switch queue depth, packet arrival time interval, latency jitter, and link latency. The measurement records and network performance indicators are used as measurement data for deep learning training to obtain a multimodal network traffic data detection model.

4. The method as described in claim 3, characterized in that, The multimodal network traffic data detection model uses the Transformer model as the detection framework. The Transformer model takes real-time network data measurement results as source data input, embeds modality-related feature information during the multimodal feature embedding process, and injects time series information through position encoding.

5. The method as described in claim 4, characterized in that, The Transformer model consists of an input part, an encoder part, a decoder part, and an output part; The input portion is preprocessed using group normalization. The encoder part consists of multiple encoders, each of which consists of a self-attention layer and a feedforward neural network; wherein, a multi-head attention mechanism is used to modify the self-attention layer so that the model learns the network performance characteristics corresponding to each modality; The decoder part consists of multiple decoders, each of which has a self-attention layer and a feedforward neural network, and there is an Encoder-Decoder attention layer that combines the encoder output between them; a modality-aware attention bias mechanism is introduced in the encoder to adaptively enhance the correlation between features of the same modality; The output section outputs a high-dimensional vector. A linear transformation maps this vector to the dimension of the target space, and then converts it into a probability distribution. The classification head uses the Sigmoid activation function to output the probability of abnormal traffic and the results of modality recognition.

6. A control plane controller, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the forwarding control method as described in any one of claims 1-2, or the steps of the security detection method as described in any one of claims 3-5.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the forwarding control method as described in any one of claims 1-2, or performs the steps of the security detection method as described in any one of claims 3-5.

Images