Intelligent auditing system and method of SD-WAN network based on dynamic threshold

Abstract

The invention relates to the technical field of communication, and particularly discloses an intelligent auditing system and method for an SD-WAN network based on a dynamic threshold, and the system comprises an auditing data collection module which is used for collecting network interaction data in the SD-WAN network in real time, and generating multi-dimensional auditing data based on the network interaction data; the dynamic threshold value management module is used for setting an initial threshold value of the multi-dimensional auditing index based on the network deployment scale, the equipment performance parameters and the business scene requirements, and adjusting the initial threshold value of the multi-dimensional auditing index in real time based on the statistical characteristics of the latest statistical historical auditing data to obtain a dynamic threshold value of the multi-dimensional auditing index; the abnormal event identification module is used for mining a logic mapping relationship among different types of audit data, and identifying an abnormal audit event and triggering a hierarchical alarm in combination with a dynamic threshold value and a current index value of a multi-dimensional audit index; the secure and stable operation of the SD-WAN network is effectively ensured, and the network management efficiency and security are improved.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to an intelligent auditing system and method for SD-WAN networks based on dynamic thresholds. Background Technology

[0002] In today's digital age, enterprise network architectures are becoming increasingly complex, and the requirements for network management and security are constantly rising. SD-WAN (Software-Defined Wide Area Network), as an emerging network technology, separates the network's control plane from its data plane, enabling software-defined and centralized network management, providing enterprises with more flexible, efficient, and low-cost network solutions. With the widespread adoption of SD-WAN in enterprises, effective network auditing has become crucial. SD-WAN network auditing covers multiple aspects, such as DNS auditing, which records DNS query logs, including source IP, target domain name, and resolved IP, to help understand domain name access patterns on the network; FlowStatistics, used to analyze Site 5-tuple data traffic, recording traffic sources and destinations to provide a basis for network traffic management; and NAT auditing, which records Network Address Translation (NAT) involving DNAT and SNAT, monitoring address translation for internal and external network access. These auditing functions play a key role in ensuring enterprise network security, compliant operations, and optimizing network performance. With the acceleration of enterprise digital transformation, the demand for SD-WAN network auditing is constantly increasing. On the one hand, enterprises hope to promptly detect abnormal behaviors in the network, such as potential security threats and data breach risks, to ensure the security of their information assets. On the other hand, accurate audit data can help enterprises better understand network usage, rationally plan network resources, and improve network efficiency. Therefore, developing an intelligent audit system and method for SD-WAN networks based on dynamic thresholds is of great significance. It can more accurately adapt to the dynamic changes in enterprise networks, improve the accuracy and effectiveness of audits, and has broad application prospects in the field of enterprise network management.

[0003] However, existing SD-WAN network auditing technologies lack the ability to set reasonable initial thresholds and adjust them in real time. This results in a lack of dynamic adaptability in audit indicator thresholds, making it difficult to accurately respond to changes in the network environment. In the anomaly identification phase, existing technologies cannot effectively uncover the logical mapping relationships between different types of audit data, nor can they accurately identify abnormal audit events by combining dynamic thresholds with current indicator values. This leads to an inability to promptly and effectively detect and handle anomalies in the network, impacting the security and stable operation of the enterprise network.

[0004] Therefore, this invention proposes an intelligent auditing system and method for SD-WAN networks based on dynamic thresholds. Summary of the Invention

[0005] This invention provides an intelligent auditing system and method for SD-WAN networks based on dynamic thresholds. It collects network interaction data in real time and generates multi-dimensional audit data, comprehensively recording network activity details and laying the foundation for accurate auditing. Addressing the problem of existing technologies' inability to reasonably set initial thresholds and adjust them in real time, this invention sets initial thresholds for multi-dimensional audit indicators based on network deployment scale, device performance parameters, and business scenario requirements. These thresholds are then adjusted in real time based on the statistical characteristics of the latest historical audit data, enabling dynamic adaptability and precise responses to changes in the network environment. Overcoming the limitation of existing technologies in effectively mining the logical mapping relationships between different types of audit data, this invention, by mining these relationships and combining them with dynamic thresholds and current indicator values, can accurately identify abnormal audit events and trigger tiered alarms, promptly detecting and handling network anomalies, and ensuring the secure and stable operation of the enterprise network.

[0006] This invention provides an intelligent auditing system for SD-WAN networks based on dynamic thresholds, comprising: The audit data acquisition module is used to collect network interaction data in the SD-WAN network in real time and generate multi-dimensional audit data based on the network interaction data; The dynamic threshold management module is used to set the initial thresholds of multi-dimensional audit indicators based on network deployment scale, device performance parameters, and business scenario requirements, and to adjust the initial thresholds of multi-dimensional audit indicators in real time based on the statistical characteristics of the latest historical audit data to obtain the dynamic thresholds of multi-dimensional audit indicators. The abnormal event identification module is used to mine the logical mapping relationship between different types of audit data, and combine the dynamic thresholds and current indicator values ​​of multi-dimensional audit indicators to identify abnormal audit events and trigger hierarchical alarms.

[0007] Preferably, the audit data acquisition module includes: The interactive data processing submodule is used to collect network interactive data in the SD-WAN network in real time, merge and record repeated domain name resolution requests in the network interactive data within a short period of time, record the network identification information before and after the address translation data in the network interactive data according to the conversion type, and define and measure the flow statistics data in the network interactive data based on the network 5-tuple to obtain the effective network interactive data in the SD-WAN network. The audit data processing submodule is used to generate multi-dimensional audit data, including domain name resolution data, address translation data, traffic statistics data, and session data, based on valid network interaction data.

[0008] Preferably, the dynamic threshold management module includes: The initial threshold setting submodule is used to construct a network feature map based on network deployment scale, device performance parameters, and business scenario requirements, and to construct a network feature dynamic coupling matrix by combining all abnormal events in the latest period. The initial threshold of multi-dimensional audit indicators is calculated based on the network feature dynamic coupling matrix. The audit indicator sampling submodule is used to divide the latest historical audit data into first historical audit data of multiple business types during peak business periods and second historical audit data of multiple business types during non-peak business periods based on business volume and business type. Based on the corresponding granularity of the peak business period, multi-dimensional audit indicator sampling is performed on each first historical audit data to obtain a multi-dimensional audit indicator first historical audit sequence vector set. At the same time, based on the corresponding granularity of the non-peak business period, multi-dimensional audit indicator sampling is performed on each second historical audit data to obtain a multi-dimensional audit indicator second historical audit sequence vector set. The reference sample filtering submodule is used to filter out all dynamic reference audit sequence vectors for each audit indicator from all first and second historical audit sequence vector sets. The dynamic threshold management submodule is used to adjust the initial threshold of the multidimensional audit indicator in real time based on all dynamic reference audit sequence vectors of the multidimensional audit indicator, so as to obtain the dynamic threshold of the multidimensional audit indicator.

[0009] Preferably, the initial threshold setting submodule includes: The knowledge graph construction unit is used to take the network deployment scale, equipment performance parameters, and business scenario requirements as entity nodes of the knowledge graph, and the maximum session processing capacity, bandwidth capacity, and peak business traffic of the equipment as node attributes. It also sets the association weights between nodes based on the equipment model performance parameters and business traffic characteristics, and constructs a network feature graph based on all entity nodes, their corresponding node attributes, and the association weights between nodes. The matrix generation unit is used to construct a dynamic coupling matrix of network features by superimposing the inter-node association weights of the network feature map and the influence weights of all abnormal events in the latest period. The vector extraction unit is used to incrementally update the singular value decomposition results based on the inter-node association weights of the network feature map and the dynamic coupling matrix of the network features, and extract the core feature vectors. The weight allocation unit is used to allocate the initial weights of multidimensional audit indicators based on the core feature vector and the analytic hierarchy process. The threshold calculation unit is used to calculate the initial threshold of the multidimensional audit indicators based on the benchmark indicator value, the corresponding initial weight, and the business demand coefficient.

[0010] Preferably, the reference sample screening submodule includes: The weight calculation unit is used to calculate the weight of each first historical audit sequence vector set or second historical audit sequence vector set based on the time decay rule and the start and end statistical times of each first historical audit sequence vector set or second historical audit sequence vector set and the coverage period of historical audit data. The indicator sampling unit is used to sample multi-dimensional audit indicators from the multi-dimensional audit data in the latest period to obtain the current audit sequence vector set. The vector operation unit is used to calculate the referenceability of each first historical audit sequence vector set or second historical audit sequence vector set based on the similarity between the current audit sequence vector set and each first historical audit sequence vector set or second historical audit sequence vector set, as well as the weight of the corresponding first historical audit sequence vector set or second historical audit sequence vector set. The vector filtering unit is used to treat all first historical audit sequence vector sets and second historical audit sequence vector sets whose referenceability exceeds the referenceability threshold as reference audit sequence vector sets. The vector clustering unit is used to perform cluster analysis on all reference audit sequence vector sets. It requires that the business types of all reference audit sequence vector sets in a single cluster in each cluster result belong to the same business type, until a clustering result with a silhouette coefficient not less than the silhouette coefficient threshold is obtained. Then, the average vector of each audit indicator in each cluster in the currently obtained clustering result is used as the dynamic reference audit sequence vector of the corresponding audit indicator.

[0011] Preferably, the dynamic threshold management submodule includes: An abnormal inflection point identification unit is used to generate a dynamic reference audit function based on each dynamic reference audit sequence vector, and to identify all abnormal inflection points in the corresponding dynamic reference audit function based on the first and second derivatives of each dynamic reference audit function. The abnormal segment extraction unit is used to extract all abnormal sequence vector segments from the corresponding dynamic reference audit sequence vector based on all abnormal inflection points in each dynamic reference audit function. The initial threshold adjustment unit is used to calculate the similarity between all abnormal sequence vector segments in all dynamic reference audit sequence vectors of a single-dimensional audit indicator and the current audit sequence vector set. When the similarity exceeds the similarity threshold, the initial threshold of the corresponding single-dimensional audit indicator is adjusted to obtain the dynamic threshold of the multi-dimensional audit indicator.

[0012] Preferably, the method for adjusting the initial threshold of the corresponding single-dimensional audit indicator by the initial threshold adjustment unit to obtain the dynamic threshold of the multi-dimensional audit indicator includes: Adjustment coefficients for constructing multidimensional audit indicators based on network feature dynamic coupling matrix; The update amount of the initial weight of the multidimensional audit indicator is determined based on the Euclidean distance between the dynamic reference audit sequence vectors of the multidimensional audit indicator, and the update weight of the multidimensional audit indicator is determined based on the initial weight and corresponding update amount of the multidimensional audit indicator. The product of the initial threshold of the multidimensional audit indicator, the corresponding update weight, and the corresponding adjustment coefficient is used as the dynamic threshold of the multidimensional audit indicator.

[0013] Preferably, the abnormal event recognition module includes: The relationship mining unit is used to mine logical mapping relationships between different types of audit data based on a preset association rule base; The indicator comparison unit is used to compare the current indicator value of the multidimensional audit indicator with the dynamic threshold to identify all abnormal audit indicators. Anomaly identification unit is used to identify abnormal audit events based on the logical mapping relationship between different types of audit data and all abnormal audit indicators; The alarm triggering unit is used to trigger hierarchical alarms based on abnormal audit events.

[0014] Preferably, the anomaly detection unit includes: The anomaly correlation subunit is used to identify the abnormal correlations between all abnormal audit indicators based on the logical mapping relationship between different types of audit data; The anomaly identification subunit is used to identify abnormal audit events based on the abnormal correlations among all abnormal audit indicators.

[0015] This invention provides an intelligent auditing method for SD-WAN networks based on dynamic thresholds, comprising: Real-time acquisition of network interaction data in the SD-WAN network, and generation of multi-dimensional audit data based on the network interaction data; The initial thresholds of multi-dimensional audit indicators are set based on network deployment scale, equipment performance parameters, and business scenario requirements. The initial thresholds of multi-dimensional audit indicators are adjusted in real time based on the statistical characteristics of the latest historical audit data to obtain dynamic thresholds of multi-dimensional audit indicators. By exploring the logical mapping relationships between different types of audit data and combining the dynamic thresholds and current values ​​of multidimensional audit indicators, abnormal audit events can be identified and tiered alarms can be triggered.

[0016] The beneficial effects of this invention compared to existing technologies are as follows: It collects network interaction data in real time and generates multi-dimensional audit data, comprehensively recording network activity details and laying the foundation for accurate auditing. Addressing the problem that existing technologies cannot reasonably set initial thresholds and adjust them in real time, this invention sets initial thresholds for multi-dimensional audit indicators based on network deployment scale, device performance parameters, and business scenario requirements, and adjusts them in real time based on the statistical characteristics of the latest historical audit data, making the thresholds dynamically adaptable and able to accurately respond to changes in the network environment. It overcomes the deficiency of existing technologies in effectively mining the logical mapping relationships between different types of audit data. By mining these relationships and combining dynamic thresholds with current indicator values, it can accurately identify abnormal audit events and trigger tiered alarms, promptly detect and handle network anomalies, and ensure the safe and stable operation of enterprise networks.

[0017] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in this application.

[0018] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0019] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This invention relates to an intelligent auditing system and method for SD-WAN networks based on dynamic thresholds. Figure 2 This is a schematic diagram of the audit data acquisition module in an embodiment of the present invention; Figure 3 This is a schematic diagram of the abnormal event recognition module in an embodiment of the present invention. Detailed Implementation

[0020] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0021] like Figure 1 As shown, this invention provides an implementation of an intelligent auditing system for SD-WAN networks based on dynamic thresholds, comprising: The audit data acquisition module is used to collect network interaction data in the SD-WAN network in real time and generate multi-dimensional audit data based on the network interaction data; The dynamic threshold management module is used to set the initial thresholds of multi-dimensional audit indicators based on network deployment scale, device performance parameters, and business scenario requirements, and to adjust the initial thresholds of multi-dimensional audit indicators in real time based on the statistical characteristics of the latest historical audit data to obtain the dynamic thresholds of multi-dimensional audit indicators. The abnormal event identification module is used to mine the logical mapping relationship between different types of audit data, and combine the dynamic thresholds and current indicator values ​​of multi-dimensional audit indicators to identify abnormal audit events and trigger hierarchical alarms.

[0022] In this embodiment, SD-WAN (Software-Defined Wide Area Network) separates the network's control plane from its data plane, enabling software-defined and centralized management of the network, providing enterprises with flexible, efficient, and low-cost network solutions. In this invention, it refers to the network environment targeted by the intelligent auditing system. For example, an enterprise might use SD-WAN to build cross-regional network connections, linking branch offices in various locations with its headquarters.

[0023] In this embodiment, network interaction data refers to the data generated when devices in an SD-WAN network exchange information, including various types of data such as domain name resolution requests, address translation data, and traffic statistics. Examples include DNS domain name resolution requests initiated by users accessing websites within the network, and NAT address translation data generated when internal network users access external networks.

[0024] In this embodiment, the multi-dimensional audit data is generated from network interaction data and includes various types of data such as domain name resolution data, address translation data, traffic statistics data, and session data, recording network activity information from multiple dimensions. For example, the domain name resolution data records MAC address, source IP, DNS address, etc., while the traffic statistics data records source IP address, destination IP address, total traffic, etc.

[0025] In this embodiment, network deployment scale involves factors such as the number of sites in the network and the geographical distribution hierarchy, and is one of the factors affecting the setting of audit indicator thresholds. For example, a large enterprise's SD-WAN network may have numerous branch offices distributed in different regions, resulting in a large network deployment scale; while a small enterprise may have fewer sites, resulting in a smaller network deployment scale.

[0026] In this embodiment, device performance parameters include the device's maximum session processing capacity, bandwidth capacity, and CPU utilization limit. For example, the maximum session threshold for a single CPE of the BX3000 model is set to 20,000, and the concurrent session threshold for the server is set to 200,000. These parameters reflect the device's ability to process network services.

[0027] In this embodiment, business scenario requirements refer to the network requirements of different business operations within an enterprise, such as bandwidth-sensitive services (like video services which require high bandwidth), latency-sensitive services (like real-time communication services which have high latency requirements), and security-sensitive services (like financial services which have high data security requirements). These are factors to consider when setting audit indicator thresholds. For example, for security-sensitive services, the DNS resolution frequency threshold might be set more strictly.

[0028] In this embodiment, multi-dimensional audit metrics include single IPsession count, single IP bandwidth, abnormal traffic fluctuations, and DNS resolution frequency, which measure the normality of network operation from multiple dimensions. For example, the single IPsession count threshold can determine whether the number of sessions initiated by a single IP is abnormal, thus preventing excessive consumption of network resources.

[0029] In this embodiment, the initial thresholds for multi-dimensional audit metrics are the starting thresholds for each audit metric set when the audit system begins operation. For example, based on the performance parameters and business traffic characteristics of the BX3000 model device, the initial value for the maximum session threshold per CPE is set to 20,000.

[0030] In this embodiment, the dynamic thresholds of the multi-dimensional audit indicators are as follows: the initial threshold is not fixed, but is obtained by adjusting it in real time based on the statistical characteristics of the latest historical audit data. By continuously adjusting the thresholds to better reflect the actual network operation, such as dynamically correcting the traffic threshold based on the 95th percentile of the historical audit data of the past 7 days, the audit system can more accurately determine network anomalies.

[0031] Furthermore, the system features built-in lightweight auditing functionality supported by CPE, reducing reliance on independent third-party devices, simplifying the architecture, lowering deployment and maintenance costs, and improving scalability to meet the growing network auditing needs of enterprises. It also supports IPv6 traffic auditing, enhanced data leakage protection, and national cryptographic algorithm capabilities, meeting the auditing requirements of large-scale networks of state-owned enterprises. In terms of security, only authorized users can access audit data, and role-based access control is supported. Regarding reliability, it supports hot and cold data separation and configurable data retention periods. In terms of performance, it has minimal impact on system resources, short query response times, and comprehensively improves the quality and efficiency of network auditing.

[0032] like Figure 2 As shown, in order to generate multi-dimensional audit data containing various key data by deduplicating, classifying, recording, and metering real-time collected network interaction data, and to comprehensively and accurately obtain network activity information, an audit data acquisition module is proposed, including: The interactive data processing submodule is used to collect network interactive data in the SD-WAN network in real time, merge and record repeated domain name resolution requests in the network interactive data within a short period of time, record the network identification information before and after the address translation data in the network interactive data according to the conversion type, and define and measure the flow statistics data in the network interactive data based on the network 5-tuple to obtain the effective network interactive data in the SD-WAN network. The audit data processing submodule is used to generate multi-dimensional audit data, including domain name resolution data, address translation data, traffic statistics data, and session data, based on valid network interaction data.

[0033] In this embodiment, repeated domain name resolution requests within a short period of time are merged into a single record: In an SD-WAN network, the data exchanged between devices contains a large number of domain name resolution requests. If a user requests to resolve the same domain name multiple times within a short period of time, the system will merge these requests into a single record. For example, multiple requests to resolve "example.com" within one second will only be recorded once, reducing redundant data and improving data processing efficiency.

[0034] Address translation data is recorded by translation type: Network address translation includes types such as SNAT, DNAT, and port mapping. The system records network identification information before and after address translation for different translation types, such as source IP, source port, destination IP, destination port, and translated IP / port, which can clearly present the network address translation situation and facilitate the analysis of internal and external network access paths.

[0035] Network flow data definition and measurement based on the network 5-tuple: A network 5-tuple consists of a source IP, source port, destination IP, destination port, and protocol type. The system processes traffic statistics based on this, defining a flow and calculating its traffic. For example, it can calculate the traffic from a specific source IP and port to a destination IP and port under a certain TCP protocol, providing accurate data for network traffic management, such as determining the traffic usage of a particular service or IP. Through these processes, effective network interaction data is obtained, laying the foundation for subsequent audit analysis.

[0036] In this embodiment, multi-dimensional audit data, including domain name resolution data, address translation data, traffic statistics data, and session data, is generated based on valid network interaction data. The domain name resolution data includes MAC address, source IP, DNS address, target domain name, etc., which can reflect the network domain name access situation; address translation data records relevant information of different translation types, which is used to monitor network address translation behavior; traffic statistics cover source IP address, target IP address, total traffic, etc., showing the network traffic distribution; session data records session status and other information, reflecting the network connection status.

[0037] To construct a graph and coupling matrix based on multiple network features, calculate and set initial thresholds for multi-dimensional audit indicators, and sample historical audit data according to business volume and type, filter dynamic reference samples, and adjust the initial thresholds in real time to obtain dynamic thresholds that fit reality and enhance the dynamic adaptability of the thresholds, a dynamic threshold management module is proposed, including: The initial threshold setting submodule is used to construct a network feature map based on network deployment scale, device performance parameters, and business scenario requirements, and to construct a network feature dynamic coupling matrix by combining all abnormal events in the latest period. The initial threshold of multi-dimensional audit indicators is calculated based on the network feature dynamic coupling matrix. The audit indicator sampling submodule is used to divide the latest historical audit data into first historical audit data of multiple business types during peak business periods and second historical audit data of multiple business types during non-peak business periods based on business volume and business type. Based on the corresponding granularity of the peak business period, multi-dimensional audit indicator sampling is performed on each first historical audit data to obtain a multi-dimensional audit indicator first historical audit sequence vector set. At the same time, based on the corresponding granularity of the non-peak business period, multi-dimensional audit indicator sampling is performed on each second historical audit data to obtain a multi-dimensional audit indicator second historical audit sequence vector set. The reference sample filtering submodule is used to filter out all dynamic reference audit sequence vectors for each audit indicator from all first and second historical audit sequence vector sets. The dynamic threshold management submodule is used to adjust the initial threshold of the multidimensional audit indicator in real time based on all dynamic reference audit sequence vectors of the multidimensional audit indicator, so as to obtain the dynamic threshold of the multidimensional audit indicator.

[0038] In this embodiment, all abnormal events within the latest period: During the operation of this intelligent auditing system, network activity is continuously monitored. The "latest period" can be a pre-set time period, such as one day or one week. During this period, the system analyzes network interaction data to identify various situations that do not conform to normal network behavior patterns; these are abnormal events. For example, traffic bursts exceeding thresholds, high-frequency abnormal DNS resolutions, and unauthorized NAT translations are all considered abnormal events.

[0039] In this embodiment, network usage by different enterprise businesses varies over time, with peak and off-peak periods. The system categorizes the latest historical audit data based on business volume (e.g., network traffic, number of sessions) and business type (e.g., bandwidth-sensitive, latency-sensitive businesses). For example, during a company's working hours (9:00-18:00), employees conduct business intensively, resulting in frequent network usage and a large business volume; the audit data for this period falls under the peak business period category. Conversely, after get off work, business volume is relatively low, representing the off-peak period. Furthermore, different business types exhibit different performance at different times. Therefore, the peak and off-peak data are further subdivided by business type to obtain first historical audit data (peak business period) and second historical audit data (off-peak business period) for multiple business types.

[0040] In this embodiment, the frequency and characteristics of network behavior changes differ during peak and off-peak periods, thus requiring different sampling granularities. "Granularity" refers to the time interval for sampling data. For example, during peak periods, when network conditions change rapidly, a 1-minute sampling granularity might be used, meaning multi-dimensional audit indicator data is collected once per minute; while during off-peak periods, when network conditions are relatively stable, a 5-minute sampling granularity might be used. For the first historical audit data of each service type during peak periods, multi-dimensional audit indicator data such as the number of single IPsessions, single IP bandwidth, abnormal traffic fluctuations, and DNS resolution frequency are collected according to the corresponding granularity. The continuously collected single indicator data sequences are organized into a sequence vector, and all audit indicator sequence vectors constitute the first historical audit sequence vector set of multi-dimensional audit indicators. Similarly, for the second historical audit data of each service type during off-peak periods, multi-dimensional audit indicator data is sampled according to the corresponding granularity to form the second historical audit sequence vector set of multi-dimensional audit indicators.

[0041] To achieve a scientific and reasonable initial threshold setting for multi-dimensional audit indicators by constructing network feature maps, generating coupling matrices, extracting core feature vectors, assigning initial weights, and calculating initial thresholds, an initial threshold setting submodule is proposed, including: The knowledge graph construction unit is used to take the network deployment scale, equipment performance parameters, and business scenario requirements as entity nodes of the knowledge graph, and the maximum session processing capacity, bandwidth capacity, and peak business traffic of the equipment as node attributes. It also sets the association weights between nodes based on the equipment model performance parameters and business traffic characteristics, and constructs a network feature graph based on all entity nodes, their corresponding node attributes, and the association weights between nodes. The matrix generation unit is used to construct a dynamic coupling matrix of network features by superimposing the inter-node association weights of the network feature map and the influence weights of all abnormal events in the latest period. The vector extraction unit is used to incrementally update the singular value decomposition results based on the inter-node association weights of the network feature map and the dynamic coupling matrix of the network features, and extract the core feature vectors. The weight allocation unit is used to allocate the initial weights of multidimensional audit indicators based on the core feature vector and the analytic hierarchy process. The threshold calculation unit is used to calculate the initial threshold of the multidimensional audit indicators based on the benchmark indicator value, the corresponding initial weight, and the business demand coefficient.

[0042] In this embodiment, the association weights between nodes are set based on device model performance parameters and service traffic characteristics: When constructing the network feature graph, different device models have different performance parameters. For example, the maximum session threshold for a single CPE of the BX3000 model is set to 20,000, and the concurrent session threshold for the server is set to 200,000. Different service traffic characteristics also vary; for example, video service traffic is large and continuous, while office service traffic is relatively dispersed. The degree of association between nodes in the knowledge graph, i.e., the association weight, is determined based on these differences. For instance, for devices handling high-traffic services, the association weight with traffic-related nodes may be set higher, indicating that they are closely connected and have a significant mutual influence.

[0043] In this embodiment, network deployment scale (involving the number of sites, geographical distribution, etc.), device performance parameters (such as maximum session processing capacity, bandwidth capacity), and business scenario requirements (such as bandwidth-sensitive and security-sensitive business requirements) are treated as entity nodes in a knowledge graph, much like marking different locations on a map. Specific values ​​such as the device's maximum session processing capacity, bandwidth capacity, and peak traffic are used as attributes of these nodes to describe the characteristics of each node in detail. Furthermore, the association weights between nodes are set by combining device model performance parameters and business traffic characteristics. Through these entity nodes, node attributes, and association weights, a network feature graph is constructed.

[0044] In this embodiment, the impact weights of all anomalous events within the latest cycle are as follows: Within the latest cycle of system operation (e.g., the past day or week), the degree of impact of all anomalous events on network characteristics varies, and these differences are quantified using impact weights. Assuming a week as the latest cycle, two anomalous events occurred during this period: a DNS attack and a brief, slight fluctuation in traffic to a certain IP address. Only the impact on two audit metrics—DNS resolution frequency and single-IP bandwidth—is considered.

[0045] For DNS attack events, due to their significant impact on DNS resolution frequency, a weighting system is established with a total weight of 1. The weight of the impact of DNS attack events on DNS resolution frequency is set to 0.8, meaning that when a DNS attack event occurs, its impact on DNS resolution frequency accounts for 80% of the overall influencing factors.

[0046] For a brief and slight fluctuation in traffic to a certain IP address, this is a relatively minor anomaly and has little impact on the DNS resolution frequency. Let its impact on the DNS resolution frequency be weighted at 0.1.

[0047] For the audit metric of single-IP bandwidth, DNS attacks typically have little impact, so we assign a weight of 0.2 to their effect; however, brief, slight fluctuations in IP address traffic do have some correlation with single-IP bandwidth, so we assign a weight of 0.6 to their effect. By setting these different weight values, we quantify the differences in the degree of impact of different abnormal events on specific audit metrics.

[0048] In this embodiment, the inter-node association weights in the network feature graph refer to the strength of the interaction between various entity nodes in the knowledge graph. It reflects the degree to which a change in one node affects other nodes. Taking a dynamic threshold-based SD-WAN network intelligent auditing system as an example, the network feature graph contains several entity nodes: network deployment scale, device performance parameters, and business scenario requirements.

[0049] Assume the network deployment scale node represents the number of branch offices in an enterprise. As the number of branch offices increases (the network deployment scale node changes), better-performing equipment is needed to ensure the normal operation of each branch office. This will cause parameters such as the maximum session processing capacity and bandwidth capacity of the equipment performance parameter node to increase, indicating that the network deployment scale node has a strong influence on the equipment performance parameter node, and the two nodes are closely related.

[0050] Looking at the business scenario requirements, if an enterprise conducts network latency-sensitive services such as video conferencing (a change in the business scenario requirements), the equipment needs higher performance to ensure low latency. This causes the relevant parameters in the equipment performance parameter node to adjust accordingly, demonstrating that the business scenario requirements node influences the equipment performance parameter node, and there is a correlation between them. The degree of this influence is what the correlation between nodes describes.

[0051] In this embodiment, a network feature dynamic coupling matrix is ​​constructed by superimposing the inter-node association weights of the network feature graph and the influence weights of all abnormal events in the latest period: the element in the network feature dynamic coupling matrix = inter-node association weights of the network feature graph × (1 + the average value of the influence weights of the two dimensions of audit indicators corresponding to the association weights of all abnormal events in the latest period).

[0052] In this embodiment, the core feature vector is extracted by incrementally updating the singular value decomposition results based on the node association weights of the network feature graph and the dynamic coupling matrix of the network features: the difference between the dynamic coupling matrix of the network features and the network feature association matrix constructed based on the node association weights of the network feature graph is calculated to obtain the incremental matrix; Singular value decomposition is performed on the increment matrix to obtain multiple singular values ​​and corresponding left singular vectors; The left singular vector corresponding to the largest singular value is taken as the core feature vector.

[0053] In this embodiment, the initial weights of multi-dimensional audit indicators are assigned based on the core feature vector and the analytic hierarchy process: Assuming that there are three audit indicators in the network audit scenario, namely bandwidth utilization, connection stability, and data transmission latency, the core feature vector has been obtained before, and now the analytic hierarchy process is used to assign initial weights to these indicators.

[0054] Establish a hierarchical model. At the top is the target layer, which optimizes the weights of network audit metrics to better reflect the network's operational status. The middle layer is the criteria layer, containing factors represented by core feature vectors, such as network service type (divided into real-time and non-real-time services), equipment performance status (judged based on the performance parameters of a key device), and network topology complexity. At the bottom is the solution layer, which contains the three audit metrics mentioned earlier.

[0055] Next, construct the judgment matrix. Starting from each factor at the criterion level, compare its relative importance to each audit indicator at the solution level. For example, from the perspective of network service type, real-time services have particularly high requirements for bandwidth utilization, followed by connection stability, and relatively low requirements for data transmission latency. Construct a judgment matrix such that the first row and first column are both 1, indicating that bandwidth utilization is as important as the service itself; the first row and second column are both 3, meaning that bandwidth utilization is three times more important to real-time services than connection stability; the first row and third column are both 5, indicating that bandwidth utilization is five times more important to real-time services than data transmission latency. And so on. Similarly, construct judgment matrices from the perspectives of device performance and network topology complexity.

[0056] Next, calculate the weight vector and perform a consistency check. For each judgment matrix, calculate the largest eigenvalue and its corresponding eigenvector, then normalize the eigenvector so that the sum of all elements equals 1, obtaining the weight vector. Simultaneously, calculate the consistency index by subtracting the matrix order from the largest eigenvalue and then dividing by the matrix order minus 1. Then, find the average random consistency index and calculate the consistency ratio. If the consistency ratio is less than 0.1, the judgment matrix has good consistency; if it is greater than 0.1, the judgment matrix needs adjustment.

[0057] Next, the initial weights of the multi-dimensional audit indicators are determined. This is done by combining the importance of each criterion-level factor reflected in the core feature vectors. For example, assuming network service type accounts for 50%, equipment performance status for 30%, and network topology complexity for 20%, the weight vectors corresponding to the previously calculated judgment matrices are calculated according to this ratio. For instance, the initial weight for bandwidth utilization is calculated by multiplying the weight corresponding to network service type by 50%, adding the weight corresponding to equipment performance status by 30%, and adding the weight corresponding to network topology complexity by 20%. The initial weights for connection stability and data transmission latency are calculated using the same method. In this way, based on the core feature vectors and the analytic hierarchy process, the initial weights for the multi-dimensional audit indicators are assigned.

[0058] In this embodiment, the initial threshold of the multidimensional audit indicator is calculated based on the baseline indicator value, corresponding initial weight, and business demand coefficient of the multidimensional audit indicator. The business demand coefficient is determined according to the business scenario requirements (for example, for bandwidth-sensitive businesses, this coefficient may be adjusted according to the business's bandwidth requirements). Assume an enterprise has three business scenarios: online office, video conferencing, and big data storage and analysis. The business demand coefficient is determined for the network bandwidth audit indicator.

[0059] Online office tasks mainly involve file uploading and downloading, web browsing, etc., which require relatively stable network bandwidth, but not excessively high bandwidth. Assuming the bandwidth required for normal operation of online office tasks is set to 1 times the base bandwidth, then the service demand coefficient for online office tasks is set to 1.

[0060] Video conferencing services, due to the need to ensure real-time transmission of video and audio, have high requirements for network bandwidth stability and capacity. Generally, the bandwidth required is three times that of online office services; therefore, the service demand coefficient for video conferencing services is set at 3.

[0061] Big data storage and analysis services require the rapid transmission of large amounts of data during storage, processing, and analysis, placing extremely high demands on network bandwidth. Assuming its bandwidth requirement is five times that of online office services, the business demand coefficient for big data storage and analysis services is set at 5.

[0062] The initial threshold for the multi-dimensional audit metric is then calculated by multiplying the baseline metric value by the initial weight and then by the business demand coefficient. For example, assuming the baseline metric value for the single IPsession quantity threshold is 1000, and the initial weight obtained from the previous steps is 0.6, and the business demand coefficient is 1.2, then the initial threshold for this metric = 1000 × 0.6 × 1.2 = 720. The initial threshold calculated in this way is closer to the actual network operation and business needs, laying the foundation for subsequent dynamic adjustment of the threshold.

[0063] To calculate the weights of each historical audit sequence vector set based on the time decay rule, combine the current audit sequence vector set to calculate the referenceability, filter and cluster the reference audit sequence vector sets, and obtain dynamic reference audit sequence vectors for each audit indicator, thus providing effective reference samples for dynamic threshold adjustment, a reference sample filtering submodule is proposed, including: The weight calculation unit is used to calculate the weight of each first historical audit sequence vector set or second historical audit sequence vector set based on the time decay rule and the start and end statistical times of each first historical audit sequence vector set or second historical audit sequence vector set and the coverage period of historical audit data. The indicator sampling unit is used to sample multi-dimensional audit indicators from the multi-dimensional audit data in the latest period to obtain the current audit sequence vector set. The vector operation unit is used to calculate the referenceability of each first historical audit sequence vector set or second historical audit sequence vector set based on the similarity between the current audit sequence vector set and each first historical audit sequence vector set or second historical audit sequence vector set, as well as the weight of the corresponding first historical audit sequence vector set or second historical audit sequence vector set. The vector filtering unit is used to treat all first historical audit sequence vector sets and second historical audit sequence vector sets whose referenceability exceeds the referenceability threshold as reference audit sequence vector sets. The vector clustering unit is used to perform cluster analysis on all reference audit sequence vector sets. It requires that the business types of all reference audit sequence vector sets in a single cluster in each cluster result belong to the same business type, until a clustering result with a silhouette coefficient not less than the silhouette coefficient threshold is obtained. Then, the average vector of each audit indicator in each cluster in the currently obtained clustering result is used as the dynamic reference audit sequence vector of the corresponding audit indicator.

[0064] In this embodiment, a time decay rule is used: This rule is a method that adjusts the importance of data based on its proximity in time. When analyzing historical audit data, data closer to the current time is considered to have higher reference value for the current network status, and its importance gradually decreases over time. For example, data from the last 3 days is weighted at 1.0, data from 4-7 days at 0.7, and data from 8-30 days at 0.3.

[0065] In this embodiment, the start and end times for each first historical audit sequence vector set or second historical audit sequence vector set are defined as follows: The start and end times determine the time range of the data covered by each vector set. For example, if the peak business period is from 9:00 AM to 6:00 PM, then the start time for the first historical audit sequence vector set is 9:00 AM and the end time is 6:00 PM; the start and end times for the second historical audit sequence vector set are different for the non-peak business period.

[0066] In this embodiment, the coverage period of historical audit data refers to the time span encompassed by the collected and analyzed historical audit data. For example, if audit data from the past 30 days is collected, then these 30 days constitute the coverage period of the historical audit data.

[0067] In this embodiment, the weight of each first or second historical audit sequence vector set is calculated based on the time decay rule and the start and end statistical times and coverage period range of each first or second historical audit sequence vector set. The vector set weight is determined by comprehensively considering the time decay rule, the start and end statistical times, and the coverage period range. First, the position of the vector set data within the coverage period range is determined based on the start and end statistical times, and then the corresponding weight is assigned according to the time decay rule. For example, if the start and end times of a certain first historical audit sequence vector set are within the last 3 days, its weight is 1.0 according to the time decay rule; if it is within 4-7 days, the weight is 0.7. This calculation reflects the different levels of importance of different vector set data to the current network state analysis.

[0068] In this embodiment, multidimensional audit metrics are sampled from the multidimensional audit data within the latest period to obtain the current audit sequence vector set: Within the latest set period (e.g., the past hour or day), multidimensional audit data generated by network interactions are sampled according to multidimensional audit metrics (e.g., number of single IP sessions, single IP bandwidth, abnormal traffic fluctuations, DNS resolution frequency, etc.). The single-dimensional audit metric data obtained from each sampling are organized into a sequence vector, and the sequence vectors of all audit metrics constitute the current audit sequence vector set.

[0069] In this embodiment, the similarity between the current audit sequence vector set and each first historical audit sequence vector set or second historical audit sequence vector set is calculated using a specific algorithm. For example, a cosine similarity algorithm can be used.

[0070] In this embodiment, the similarity between the current audit sequence vector set and each first or second historical audit sequence vector set, along with the corresponding weights of the first or second historical audit sequence vector sets, is calculated by multiplying the similarity by the weight. For example, if the similarity between a first historical audit sequence vector set and the current audit sequence vector set is 0.8, and its weight is 0.7, then the referenceability of this vector set is 0.8 × 0.7 = 0.56. A higher referenceability indicates greater reference value for the historical vector set in current network state analysis and threshold adjustment.

[0071] In this embodiment, the referenceability threshold is a pre-set referenceability standard value. For example, if the referenceability threshold is set to 0.6, only vector sets with a referenceability ≥ 0.6 will proceed to the next step of processing.

[0072] In this embodiment, cluster analysis is a method of grouping similar data into one category. The selected reference audit sequence vector sets are clustered, requiring that the vector sets within each cluster belong to the same business type to ensure cluster homogeneity. The silhouette coefficient is used to evaluate the clustering effect; the closer its value is to 1, the better the clustering effect. When the silhouette coefficient obtained from clustering is not less than a pre-set silhouette coefficient threshold, the clustering result is considered reliable. At this point, the data of all vector sets within each cluster are averaged for each audit indicator, and the resulting average vector is used as the dynamic reference audit sequence vector for the corresponding audit indicator.

[0073] In this embodiment, the silhouette coefficient threshold is a standard value used to measure whether the clustering effect is acceptable. For example, the silhouette coefficient threshold is set to 0.7.

[0074] In this embodiment, the average vector for each audit metric in each cluster is calculated as follows: After clustering the reference audit sequence vector set is completed and the clustering effect meets the silhouette coefficient threshold requirement, the average vector is calculated for each cluster. For all reference audit sequence vector sets within each cluster, the average vector is obtained by averaging all sequence vectors on the same audit metric (such as the number of single IPsessions), which is the average vector for each audit metric in each cluster.

[0075] To accurately adjust the dynamic thresholds of multi-dimensional audit indicators by identifying anomalous inflection points in the dynamic reference audit function, extracting anomalous sequence vector fragments, and adjusting the initial threshold based on their similarity to the current audit sequence vector set, a dynamic threshold management submodule is proposed, including: An abnormal inflection point identification unit is used to generate a dynamic reference audit function based on each dynamic reference audit sequence vector, and to identify all abnormal inflection points in the corresponding dynamic reference audit function based on the first and second derivatives of each dynamic reference audit function. The abnormal segment extraction unit is used to extract all abnormal sequence vector segments from the corresponding dynamic reference audit sequence vector based on all abnormal inflection points in each dynamic reference audit function. The initial threshold adjustment unit is used to calculate the similarity between all abnormal sequence vector segments in all dynamic reference audit sequence vectors of a single-dimensional audit indicator and the current audit sequence vector set. When the similarity exceeds the similarity threshold, the initial threshold of the corresponding single-dimensional audit indicator is adjusted to obtain the dynamic threshold of the multi-dimensional audit indicator.

[0076] In this embodiment, a dynamic reference audit function is generated based on each dynamic reference audit sequence vector. The data in the vector can be viewed as the values ​​of a function at different points. A function is fitted using mathematical methods, and this function can reflect the changing patterns of the data. For example, using time as the independent variable and the audit indicator data in the vector as the dependent variable, a function is generated to describe the audit indicators that change over time.

[0077] In this embodiment, all abnormal inflection points in the corresponding dynamic reference audit function are identified based on the first and second derivatives of each dynamic reference audit function: when the real-time indicator value exceeds the initial threshold by 1.1 times and the first derivative exceeds the historical average by 1.5 times, and the second derivative changes sign for two consecutive windows, it is determined that an abnormal inflection point has occurred.

[0078] In this embodiment, all abnormal sequence vector fragments are extracted from the corresponding dynamic reference audit sequence vector based on all abnormal inflection points in each dynamic reference audit function. After identifying the abnormal inflection points in the dynamic reference audit function, the corresponding portion is found in the original dynamic reference audit sequence vector according to the position of these inflection points in time or other dimensions. This portion of vector data is the abnormal sequence vector fragment. For example, if the abnormal inflection point occurs at the 5th time point of the function, then a segment of data near the 5th data point is selected as the abnormal sequence vector fragment in the dynamic reference audit sequence vector. These fragments contain information about significant changes in audit indicator data.

[0079] In this embodiment, the similarity between all abnormal sequence vector fragments in all dynamic reference audit sequence vectors of a single-dimensional audit indicator and the current audit sequence vector set is calculated using methods such as cosine similarity and Euclidean distance.

[0080] In this embodiment, the similarity threshold is a pre-set similarity standard value. For example, the similarity threshold is set to 0.8.

[0081] To obtain dynamic thresholds for multidimensional audit indicators by constructing adjustment coefficients, determining initial weight update amounts, and calculating updated weights, based on initial thresholds, updated weights, and adjustment coefficients, and specifically to achieve scientific adjustment from initial thresholds to dynamic thresholds, a method is proposed whereby an initial threshold adjustment unit adjusts the initial thresholds of corresponding single-dimensional audit indicators to obtain dynamic thresholds for multidimensional audit indicators. This method includes: Adjustment coefficients for constructing multidimensional audit indicators based on network feature dynamic coupling matrix; The update amount of the initial weight of the multidimensional audit indicator is determined based on the Euclidean distance between the dynamic reference audit sequence vectors of the multidimensional audit indicator, and the update weight of the multidimensional audit indicator is determined based on the initial weight and corresponding update amount of the multidimensional audit indicator. The product of the initial threshold of the multidimensional audit indicator, the corresponding update weight, and the corresponding adjustment coefficient is used as the dynamic threshold of the multidimensional audit indicator.

[0082] In this embodiment, adjustment coefficients for multi-dimensional audit indicators are constructed based on the dynamic coupling matrix of network features: For each audit metric, the weighted sum of the related matrix elements is used to obtain the adjustment coefficient. Let's assume the network deployment scale, device performance parameters, business scenario requirements, and abnormal events are assigned weights of 0.3, 0.3, 0.2, and 0.2, respectively.

[0083] In this embodiment, the update amount of the initial weight of the multi-dimensional audit indicator is determined based on the Euclidean distance between the dynamic reference audit sequence vectors of the multi-dimensional audit indicator, and the update weight of the multi-dimensional audit indicator is determined based on the initial weight and corresponding update amount of the multi-dimensional audit indicator. The product of the mean Euclidean distance between the dynamic reference audit sequence vector of a single-dimensional audit indicator and the dynamic reference audit sequence vectors of other single-dimensional audit indicators, a preset conversion coefficient (an adjustment parameter used to convert the Euclidean distance into the initial weight update amount, such as 0.1), and the indicator's own numerical proportion (the ratio of the mean of all values ​​in the dynamic reference audit sequence vector of the audit indicator to the mean of all values ​​in the dynamic reference audit sequence vectors of all audit indicators) is used as the update amount of the initial weight of the corresponding audit indicator.

[0084] Determine the update weight: After obtaining the update amount of the initial weight, combine it with the initial weight of the multidimensional audit indicator to determine the update weight. For example, if the initial weight of a certain audit indicator is 0.6, and the initial weight update amount calculated based on Euclidean distance is 0.1, then the update weight is 0.6 + 0.1 = 0.7.

[0085] like Figure 3As shown, in order to mine the logical mapping relationship between different types of audit data based on a preset association rule base, identify abnormal indicators by comparing the current indicator value with the dynamic threshold, and then identify abnormal audit events and trigger hierarchical alarms based on the mapping relationship and abnormal indicators, thereby achieving accurate identification and alarming of abnormal audit events, an abnormal event identification module is proposed, including: The relationship mining unit is used to mine logical mapping relationships between different types of audit data based on a preset association rule base; The indicator comparison unit is used to compare the current indicator value of the multidimensional audit indicator with the dynamic threshold to identify all abnormal audit indicators. Anomaly identification unit is used to identify abnormal audit events based on the logical mapping relationship between different types of audit data and all abnormal audit indicators; The alarm triggering unit is used to trigger hierarchical alarms based on abnormal audit events.

[0086] In this embodiment, the pre-defined association rule base is a pre-set set of rules that includes various logical relationship rules that may exist between different types of audit data. For example, the device performance and service impact rule states that if the CPU utilization of the core router exceeds 80% and the number of concurrent online users exceeds 70% of the router's design capacity, then it is determined that it may affect the smoothness of real-time video services. This rule is based on the association between device performance parameters (CPU utilization, number of users supported) and service scenario requirements (smoothness of real-time video services).

[0087] Network Attack and Audit Metrics Rules: When a large number of abnormal connection requests targeting a specific port (such as port 80, typically used for HTTP services) are detected on the network, and the connection failure rate exceeds 30%, it is determined that a DDoS attack may have occurred. This will lead to an abnormal increase in network bandwidth utilization and fluctuations in the single IP connection threshold. This rule links network attack behavior (abnormal connection requests on a specific port, connection failure rate) with audit metrics (network bandwidth utilization, single IP connection threshold).

[0088] Business Hours and Traffic Rules: During weekdays from 9:00 AM to 5:00 PM (busy business hours), if network traffic in the office area suddenly drops to below 50% of normal levels, and the success rate of file transfers is below 60%, it is suspected that there may be a network failure or local network congestion. This is a logical relationship rule constructed by combining the characteristics of business hours with indicators such as network traffic and business success rate.

[0089] In this embodiment, a pre-defined association rule base is used to uncover the logical mapping relationships between different types of audit data. The system analyzes and compares various types of collected audit data, such as domain name resolution data, address translation data, traffic statistics data, and session data, based on the pre-defined association rule base. For example, according to the rules in the rule base, the source IP and target domain name in the domain name resolution data are associated with the source IP, target IP, and traffic value in the traffic statistics data to establish an "IP-domain-traffic" association graph, thereby discovering the hidden logical connections between different types of audit data.

[0090] In this embodiment, the current values ​​of multi-dimensional audit metrics are compared with dynamic thresholds to identify all abnormal audit metrics: the system obtains the current actual values ​​of multi-dimensional audit metrics (such as the number of single IP sessions, single IP bandwidth, abnormal traffic fluctuations, DNS resolution frequency, etc.) in real time, and then compares these current metric values ​​one by one with the dynamic thresholds generated by the dynamic threshold management module. If the current value of a certain audit metric exceeds the corresponding dynamic threshold, the metric is determined to be an abnormal audit metric.

[0091] In this embodiment, tiered alarms are triggered based on abnormal audit events: when the system identifies an abnormal audit event (such as a traffic burst exceeding a threshold, high-frequency abnormal DNS resolution, unauthorized NAT translation, etc.), it classifies the event according to factors such as the type, scope of impact, and correlation strength. Different levels of abnormal events correspond to different alarm methods. For example, "composite network abnormal events" are marked as emergency alarms and pushed to the administrator in real time via SMS so that timely measures can be taken; "abnormal domain name access events" and "unauthorized address translation events" are marked as general alarms and are periodically summarized and pushed via email.

[0092] To determine the abnormal correlations between abnormal audit indicators based on the logical mapping relationships between different types of audit data, and thus accurately identify abnormal audit events, an anomaly identification unit is proposed, including: The anomaly correlation subunit is used to identify the abnormal correlations between all abnormal audit indicators based on the logical mapping relationship between different types of audit data; The anomaly identification subunit is used to identify abnormal audit events based on the abnormal correlations among all abnormal audit indicators.

[0093] In this embodiment, the abnormal correlations between all abnormal audit indicators are identified based on the logical mapping relationships between different types of audit data: In this intelligent auditing system, logical mapping relationships have been mined from a pre-set association rule base between different types of audit data, such as the "IP-domain-traffic" association graph and the "NAT translation-session lifecycle" mapping relationship. When multiple abnormal audit indicators are identified, the inherent connections between these abnormal indicators are analyzed based on these logical mapping relationships, thereby determining their abnormal correlation.

[0094] For example, suppose the DNS resolution frequency metric is abnormal, and the traffic metric is also abnormal. Based on the "IP-domain-traffic" correlation graph, if the IPs and domains involved in these two abnormal metrics are closely related, then it can be determined that there is an abnormal correlation between these two abnormal audit metrics, meaning that they may be caused by the same abnormal reason, rather than independent abnormal situations.

[0095] In this embodiment, abnormal audit events are identified based on the abnormal correlations among all abnormal audit indicators: Once the abnormal correlations between all the abnormal audit indicators are determined, the system will synthesize this correlation information and identify specific abnormal audit events based on pre-set judgment rules. For example, if an abnormal DNS resolution frequency and a sudden increase in traffic to the corresponding IP are detected, and there is a close abnormal correlation between these two abnormal indicators, and they also meet the judgment rules for "abnormal domain name access events" (such as showing a specific abnormal pattern in the "IP-domain name-traffic" correlation graph), then the system will identify this situation as an "abnormal domain name access event".

[0096] For example, if a NAT translation record shows a translation that does not follow a pre-defined mapping relationship and the corresponding session state is abnormal, and the abnormal correlation between these two abnormal indicators matches the characteristics of an "unauthorized address translation event," the system will determine that this is an "unauthorized address translation event." By identifying abnormal audit events based on abnormal correlations, the system can more accurately locate problems in the network and provide accurate evidence for taking timely and appropriate measures.

[0097] This invention provides an implementation method for an intelligent auditing method for SD-WAN networks based on dynamic thresholds, comprising: Real-time acquisition of network interaction data in the SD-WAN network, and generation of multi-dimensional audit data based on the network interaction data; The initial thresholds of multi-dimensional audit indicators are set based on network deployment scale, equipment performance parameters, and business scenario requirements. The initial thresholds of multi-dimensional audit indicators are adjusted in real time based on the statistical characteristics of the latest historical audit data to obtain dynamic thresholds of multi-dimensional audit indicators. By exploring the logical mapping relationships between different types of audit data and combining the dynamic thresholds and current values ​​of multidimensional audit indicators, abnormal audit events can be identified and tiered alarms can be triggered.

[0098] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of this invention and its equivalents, this invention also intends to include these modifications and variations.

Claims

1. An intelligent auditing system for SD-WAN networks based on dynamic thresholds, characterized in that: include: The audit data acquisition module is used to collect network interaction data in the SD-WAN network in real time and generate multi-dimensional audit data based on the network interaction data; The dynamic threshold management module is used to set the initial thresholds of multi-dimensional audit indicators based on network deployment scale, device performance parameters, and business scenario requirements, and to adjust the initial thresholds of multi-dimensional audit indicators in real time based on the statistical characteristics of the latest historical audit data to obtain the dynamic thresholds of multi-dimensional audit indicators. The abnormal event identification module is used to mine the logical mapping relationship between different types of audit data, and combine the dynamic thresholds and current indicator values ​​of multi-dimensional audit indicators to identify abnormal audit events and trigger hierarchical alarms.

2. The intelligent auditing system for SD-WAN networks based on dynamic thresholds according to claim 1, characterized in that, The audit data collection module includes: The interactive data processing submodule is used to collect network interactive data in the SD-WAN network in real time, merge and record repeated domain name resolution requests in the network interactive data within a short period of time, record the network identification information before and after the address translation data in the network interactive data according to the conversion type, and define and measure the flow statistics data in the network interactive data based on the network 5-tuple to obtain the effective network interactive data in the SD-WAN network. The audit data processing submodule is used to generate multi-dimensional audit data, including domain name resolution data, address translation data, traffic statistics data, and session data, based on valid network interaction data.

3. The intelligent auditing system for SD-WAN networks based on dynamic thresholds according to claim 1, characterized in that, The dynamic threshold management module includes: The initial threshold setting submodule is used to construct a network feature map based on network deployment scale, device performance parameters, and business scenario requirements, and to construct a network feature dynamic coupling matrix by combining all abnormal events in the latest period. The initial threshold of multi-dimensional audit indicators is calculated based on the network feature dynamic coupling matrix. The audit indicator sampling submodule is used to divide the latest historical audit data into first historical audit data of multiple business types during peak business periods and second historical audit data of multiple business types during non-peak business periods based on business volume and business type. Based on the corresponding granularity of the peak business period, multi-dimensional audit indicator sampling is performed on each first historical audit data to obtain a multi-dimensional audit indicator first historical audit sequence vector set. At the same time, based on the corresponding granularity of the non-peak business period, multi-dimensional audit indicator sampling is performed on each second historical audit data to obtain a multi-dimensional audit indicator second historical audit sequence vector set. The reference sample filtering submodule is used to filter out all dynamic reference audit sequence vectors for each audit indicator from all first and second historical audit sequence vector sets. The dynamic threshold management submodule is used to adjust the initial threshold of the multidimensional audit indicator in real time based on all dynamic reference audit sequence vectors of the multidimensional audit indicator, so as to obtain the dynamic threshold of the multidimensional audit indicator.

4. The intelligent auditing system for SD-WAN networks based on dynamic thresholds according to claim 3, characterized in that, The initial threshold setting submodule includes: The knowledge graph construction unit is used to take the network deployment scale, equipment performance parameters, and business scenario requirements as entity nodes of the knowledge graph, and the maximum session processing capacity, bandwidth capacity, and peak business traffic of the equipment as node attributes. It also sets the association weights between nodes based on the equipment model performance parameters and business traffic characteristics, and constructs a network feature graph based on all entity nodes, their corresponding node attributes, and the association weights between nodes. The matrix generation unit is used to construct a dynamic coupling matrix of network features by superimposing the inter-node association weights of the network feature map and the influence weights of all abnormal events in the latest period. The vector extraction unit is used to incrementally update the singular value decomposition results based on the inter-node association weights of the network feature map and the dynamic coupling matrix of the network features, and extract the core feature vectors. The weight allocation unit is used to allocate the initial weights of multidimensional audit indicators based on the core feature vector and the analytic hierarchy process. The threshold calculation unit is used to calculate the initial threshold of the multidimensional audit indicators based on the benchmark indicator value, the corresponding initial weight, and the business demand coefficient.

5. The intelligent auditing system for SD-WAN networks based on dynamic thresholds according to claim 3, characterized in that, The reference sample screening submodule includes: The weight calculation unit is used to calculate the weight of each first historical audit sequence vector set or second historical audit sequence vector set based on the time decay rule and the start and end statistical times of each first historical audit sequence vector set or second historical audit sequence vector set and the coverage period of historical audit data. The indicator sampling unit is used to sample multi-dimensional audit indicators from the multi-dimensional audit data in the latest period to obtain the current audit sequence vector set. The vector operation unit is used to calculate the referenceability of each first historical audit sequence vector set or second historical audit sequence vector set based on the similarity between the current audit sequence vector set and each first historical audit sequence vector set or second historical audit sequence vector set, as well as the weight of the corresponding first historical audit sequence vector set or second historical audit sequence vector set. The vector filtering unit is used to treat all first historical audit sequence vector sets and second historical audit sequence vector sets whose referenceability exceeds the referenceability threshold as reference audit sequence vector sets. The vector clustering unit is used to perform cluster analysis on all reference audit sequence vector sets. It requires that the business types of all reference audit sequence vector sets in a single cluster in each cluster result belong to the same business type, until a clustering result with a silhouette coefficient not less than the silhouette coefficient threshold is obtained. Then, the average vector of each audit indicator in each cluster in the currently obtained clustering result is used as the dynamic reference audit sequence vector of the corresponding audit indicator.

6. The intelligent auditing system for SD-WAN networks based on dynamic thresholds according to claim 3, characterized in that, The dynamic threshold management submodule includes: An abnormal inflection point identification unit is used to generate a dynamic reference audit function based on each dynamic reference audit sequence vector, and to identify all abnormal inflection points in the corresponding dynamic reference audit function based on the first and second derivatives of each dynamic reference audit function. The abnormal segment extraction unit is used to extract all abnormal sequence vector segments from the corresponding dynamic reference audit sequence vector based on all abnormal inflection points in each dynamic reference audit function. The initial threshold adjustment unit is used to calculate the similarity between all abnormal sequence vector segments in all dynamic reference audit sequence vectors of a single-dimensional audit indicator and the current audit sequence vector set. When the similarity exceeds the similarity threshold, the initial threshold of the corresponding single-dimensional audit indicator is adjusted to obtain the dynamic threshold of the multi-dimensional audit indicator.

7. The intelligent auditing system for SD-WAN networks based on dynamic thresholds according to claim 6, characterized in that, The method for adjusting the initial threshold of the corresponding single-dimensional audit indicator to obtain the dynamic threshold of the multi-dimensional audit indicator by the initial threshold adjustment unit includes: Adjustment coefficients for constructing multidimensional audit indicators based on network feature dynamic coupling matrix; The update amount of the initial weight of the multidimensional audit indicator is determined based on the Euclidean distance between the dynamic reference audit sequence vectors of the multidimensional audit indicator, and the update weight of the multidimensional audit indicator is determined based on the initial weight and corresponding update amount of the multidimensional audit indicator. The product of the initial threshold of the multidimensional audit indicator, the corresponding update weight, and the corresponding adjustment coefficient is used as the dynamic threshold of the multidimensional audit indicator.

8. The intelligent auditing system for SD-WAN networks based on dynamic thresholds according to claim 1, characterized in that, The abnormal event recognition module includes: The relationship mining unit is used to mine logical mapping relationships between different types of audit data based on a preset association rule base; The indicator comparison unit is used to compare the current indicator value of the multidimensional audit indicator with the dynamic threshold to identify all abnormal audit indicators. Anomaly identification unit is used to identify abnormal audit events based on the logical mapping relationship between different types of audit data and all abnormal audit indicators; The alarm triggering unit is used to trigger hierarchical alarms based on abnormal audit events.

9. The intelligent auditing system for SD-WAN networks based on dynamic thresholds according to claim 8, characterized in that, Anomaly detection unit, including: The anomaly correlation subunit is used to identify the abnormal correlations between all abnormal audit indicators based on the logical mapping relationship between different types of audit data; The anomaly identification subunit is used to identify abnormal audit events based on the abnormal correlations among all abnormal audit indicators.

10. An intelligent auditing method for SD-WAN networks based on dynamic thresholds, characterized in that: include: Real-time acquisition of network interaction data in the SD-WAN network, and generation of multi-dimensional audit data based on the network interaction data; The initial thresholds of multi-dimensional audit indicators are set based on network deployment scale, equipment performance parameters, and business scenario requirements. The initial thresholds of multi-dimensional audit indicators are adjusted in real time based on the statistical characteristics of the latest historical audit data to obtain dynamic thresholds of multi-dimensional audit indicators. By exploring the logical mapping relationships between different types of audit data and combining the dynamic thresholds and current values ​​of multidimensional audit indicators, abnormal audit events can be identified and tiered alarms can be triggered.

Images