Network topology generation method and device, electronic equipment and storage medium
By collecting heterogeneous data from multiple sources and using a topological inference neural network model to generate network topology graphs, the accuracy and readability issues of network topology generation in existing technologies are solved, enabling more accurate topology display and management.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-03
- Publication Date
- 2026-03-27
Smart Images
Figure CN121750486A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, and more specifically, to a network topology generation method, apparatus, electronic device, and computer-readable storage medium. Background Technology
[0002] Currently, automatic network topology discovery and mapping primarily rely on specific network management protocols. These methods have significant limitations. First, they are highly dependent on device support for specific protocols. In complex heterogeneous network environments, differences in device manufacturers, models, or configurations often lead to incomplete data collection, resulting in blind spots in the generated topology map. Second, these methods are essentially based on predefined rules and static information, making it difficult to accurately identify complex logical relationships and hierarchical structures between devices, especially for virtual network links or cross-domain connections. Finally, their topology layout often uses fixed templates or basic algorithms, failing to adaptively adjust to the actual network structure and characteristics, resulting in poor readability of complex topologies.
[0003] Therefore, improving the accuracy of network topology generation is a technical problem that needs to be solved by those skilled in the art. Summary of the Invention
[0004] The purpose of this application is to provide a network topology generation method, apparatus, electronic device, and computer-readable storage medium, which improves the accuracy of network topology generation.
[0005] To achieve the above objectives, this application provides a network topology generation method, comprising:
[0006] Collect network device operation data from multiple heterogeneous data sources, and generate device relationship feature data based on the network device operation data;
[0007] The device relationship feature data is input into the topology inference neural network model so as to use the topology inference neural network model to predict the connection relationship between network devices and the network hierarchy, and generate topology data.
[0008] The corresponding target layout algorithm is determined based on the network topology features represented by the topology data, and the network topology map is generated based on the topology data using the target layout algorithm.
[0009] The network topology diagram is pushed to a visualization interface for rendering and display.
[0010] Optionally, the collection of network device operation data from multiple heterogeneous data sources includes:
[0011] The network device's management information database is polled using the Simple Network Management Protocol to obtain information about the device's interface and adjacency relationships;
[0012] And / or, obtain the network device's directly connected neighbor information through the link layer discovery protocol;
[0013] And / or, sample traffic in the network and generate traffic metadata based on network traffic protocol or Internet protocol flow information output protocol to obtain logical communication relationships between devices;
[0014] And / or, call the application programming interface of the cloud service provider or network controller to obtain configuration and status information of the virtual network or software-defined network;
[0015] And / or, deploy extended Berkeley package filters at the operating system kernel level to track network connections and communication links within containers, service meshes, and hosts.
[0016] Optionally, the collection of network device operation data from multiple heterogeneous data sources further includes:
[0017] Capture data packets during the transport layer security protocol handshake phase;
[0018] Extract handshake features from the data packet; wherein the handshake features include server name indication, application layer protocol negotiation information, and any one or a combination of any number of items in the cipher suite list;
[0019] Based on the handshake features, a transport layer security protocol fingerprint is generated, and the logical connection relationship between the devices is determined according to the transport layer security protocol fingerprint and the network address information of the communicating parties.
[0020] The extended connection relationships and corresponding encryption types are identified as network device operation data.
[0021] Optionally, the step of generating device relationship feature data based on network device operation data includes:
[0022] Perform time synchronization and spatial mapping of network device operation data from heterogeneous data sources;
[0023] And / or, use anomaly detection algorithms to filter abnormal data in the network device's operating data;
[0024] And / or, convert command-line instructions from network device runtime data from heterogeneous data sources into a predefined standard instruction format;
[0025] And / or, convert network device operating data based on different communication protocols into a predefined standard data format.
[0026] Optionally, the topology inference neural network model is a graph neural network model, and the step of using the topology inference neural network model to predict the connection relationships between network devices and the network hierarchy includes:
[0027] A graph structure is constructed based on the device relationship feature data; wherein, the nodes in the graph structure represent network devices, and the edges represent candidate connection relationships between network devices;
[0028] The graph attention layer in the graph neural network model is used to calculate the association weights between nodes;
[0029] The graph convolutional layer in the graph neural network model is used to aggregate neighbor node information based on the association weights between nodes in order to extract the spatial structural features of network devices;
[0030] The temporal variation features of network device communication relationships are extracted from the graph structure using the temporal convolutional layer in the graph neural network model.
[0031] The spatial structure features and the temporal variation features are fused using the feature fusion layer in the graph neural network model. The fused features are then weighted according to the association weights. Based on the weighted features, the prediction results of the connection relationships between network devices and the network hierarchy are output.
[0032] Optionally, the step of determining the corresponding target layout algorithm based on the network topology features represented by the topology data, and generating a network topology map based on the topology data using the target layout algorithm, includes:
[0033] If the network topology features represented by the topology data are a tree or chain structure with hierarchical relationships, then a hierarchical layout algorithm is used to generate a network topology graph.
[0034] If the network topology features represented by the topology data are that the network density is greater than or equal to the first threshold, then the force-directed layout algorithm is used to generate the network topology map.
[0035] If the network topology feature represented by the topology data is that there is at least one node in the network topology with a centrality index greater than or equal to the second threshold, then the network topology graph is generated using the ring layout algorithm.
[0036] Optionally, it also includes:
[0037] When a device offline event is detected in the network, historical connection information related to the offline device is determined based on historical topology data;
[0038] Generate alternative communication paths based on the historical connection information;
[0039] The device offline event and the backup communication path are pushed to the visualization interface for alarm purposes.
[0040] To achieve the above objectives, this application provides a network topology generation apparatus, comprising:
[0041] The data acquisition module is used to collect network device operation data from multiple heterogeneous data sources and generate device relationship feature data based on the network device operation data.
[0042] The prediction module is used to input the device relationship feature data into the topology inference neural network model, so as to use the topology inference neural network model to predict the connection relationship between network devices and the network hierarchy, and generate topology data.
[0043] The generation module is used to determine the corresponding target layout algorithm based on the network topology features represented by the topology data, and to generate a network topology map based on the topology data using the target layout algorithm.
[0044] The display module is used to push the network topology map to a visualization interface for rendering and display.
[0045] To achieve the above objectives, this application provides an electronic device, comprising:
[0046] Memory, used to store computer programs;
[0047] A processor is used to implement the steps of the network topology generation method described above when executing the computer program.
[0048] To achieve the above objectives, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the network topology generation method described above.
[0049] The network topology generation method provided in this application collects network device operation data from multiple heterogeneous data sources and generates device relationship feature data based on this data. This breaks the dependence on a single protocol in related technologies and enables the acquisition of device information and interaction traces from a more comprehensive data dimension, laying a reliable data foundation for accurate topology construction and directly solving the topology blind spot problem caused by a single or incomplete data source. Next, the fused device relationship feature data is input into a topology inference neural network model for prediction. This model can learn complex, non-linear association patterns in the data to more intelligently infer the actual connection relationships between devices and the network hierarchy, thereby significantly improving the accuracy of the topology data in logical association and hierarchical division. Furthermore, based on the generated, more accurate topology data, a target layout algorithm is adaptively determined, ensuring that the final generated network topology map not only has accurate data relationships but also a visual layout that better reflects the actual characteristics of the network, improving the overall readability and accuracy of the network topology map. This application also discloses a network topology generation device, an electronic device, and a computer-readable storage medium, which can achieve the same technical effects.
[0050] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this application. Attached Figure Description
[0051] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. The drawings are used to provide a further understanding of this disclosure and constitute a part of the specification. They are used together with the following detailed description to explain this disclosure, but do not constitute a limitation of this disclosure. In the drawings:
[0052] Figure 1 This is a flowchart illustrating a network topology generation method according to an exemplary embodiment;
[0053] Figure 2 This is a schematic diagram illustrating a graph neural network model for processing data according to an exemplary embodiment;
[0054] Figure 3 This is a schematic diagram illustrating the processing of an offline event according to an exemplary embodiment;
[0055] Figure 4 This is an architectural diagram of a network topology generation system according to an exemplary embodiment;
[0056] Figure 5 This is a structural diagram of a network topology generation apparatus according to an exemplary embodiment;
[0057] Figure 6 This is a structural diagram of an electronic device according to an exemplary embodiment. Detailed Implementation
[0058] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.
[0059] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.
[0060] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0061] This application discloses a network topology generation method that improves the accuracy of network topology generation.
[0062] See Figure 1 A flowchart illustrating a network topology generation method according to an exemplary embodiment, such as... Figure 1 As shown, it includes:
[0063] S101: Collect network device operation data from multiple heterogeneous data sources and generate device relationship feature data based on the network device operation data;
[0064] Among these, multiple heterogeneous data sources refer to network data sources with different types, protocols, or formats, such as trap and polling data from Simple Network Management Protocol (SNMP), network traffic data such as NetFlow or sFlow, and configuration and status data collected from the device's command-line interface (CLI) via scripts. Network device operational data refers to raw data reflecting the device's own status and communication behavior, specifically including device interface status, routing tables, Address Resolution Protocol (ARP) tables, source and destination Internet Protocol (IP) addresses and ports, and protocol types in network traffic. Device relationship characteristic data refers to structured data that can quantify the potential connection relationships between devices, such as communication frequency, traffic volume, and protocol co-occurrence matrices.
[0065] In this step, network device operation data can be pulled or received in parallel from multiple heterogeneous data sources by deploying a data collector or calling an Application Programming Interface (API). Then, feature engineering methods are used to extract or calculate features that indicate relationships between devices from the network device operation data, thereby generating device relationship feature data.
[0066] As can be seen, this step, by integrating heterogeneous data from multiple sources, overcomes the information limitations of a single data source, providing a more comprehensive and reliable data foundation for subsequent topology inference, and reducing topology blind spots and misjudgments caused by incomplete data from the source.
[0067] As a feasible implementation method, the collection of network device operation data from multiple heterogeneous data sources includes: polling the network device management information base through a simple network management protocol to obtain the device's interface and adjacency information; and / or obtaining the network device's direct neighbor information through a link layer discovery protocol; and / or sampling network traffic and generating traffic metadata based on network traffic protocols or Internet Protocol flow information output protocols to obtain the logical communication relationships between devices; and / or calling the application programming interfaces of cloud service providers or network controllers to obtain the configuration and status information of virtual networks and software-defined networks; and / or deploying an extended Berkeley packet filter program at the operating system kernel layer to track network connections and communication links within containers, service meshes, and hosts.
[0068] In practical implementation, multiple technical means can be used to collect network data in parallel: periodically query the MIB (Management Information Base) of network devices via the SNMP protocol to obtain basic information such as interface status and routing tables; use the LLDP (Link Layer Discovery Protocol) to discover the physical direct connection relationship between devices; deploy traffic probes to sample network traffic and generate traffic metadata containing information such as source / destination addresses, ports, and protocols; call the API interface of the cloud platform or network controller to obtain the configuration information of virtual networks and software defined networking (SDN); and run the eBPF (extended Berkeley Packet Filter) program at the kernel layer to track fine-grained communication links in modern network architectures such as containers and service meshes in real time.
[0069] As can be seen, this implementation method achieves comprehensive perception of complex heterogeneous network environments by integrating multi-dimensional data from physical networks, virtual networks, and cloud-native environments, providing a rich source of data for accurately constructing network topologies.
[0070] As a feasible implementation, the collection of network device operation data from multiple heterogeneous data sources further includes: capturing data packets during the transport layer security protocol handshake phase; extracting handshake features from the data packets; wherein the handshake features include server name indication, application layer protocol negotiation information, and any one or more items from the cipher suite list; generating a transport layer security protocol fingerprint based on the handshake features, and determining the logical connection relationship between devices according to the transport layer security protocol fingerprint and the network address information of the communicating parties; and determining the extended connection relationship and the corresponding encryption type as network device operation data.
[0071] The Server Name Indication (SNI) is an extension field of the TLS protocol used to specify the domain name of the server the client wants to connect to. Application-Layer Protocol Negotiation (ALPN) is an extension of TLS (Transport Layer Security) used to negotiate the application-layer protocol during the establishment of a secure connection.
[0072] In this implementation, data packets during the TLS handshake phase are captured via bypass monitoring or traffic mirroring, and characteristic parameters such as SNI, ALPN, and cipher suites are extracted. These characteristic parameters are then concatenated in a specific order, and a secure hash algorithm (such as SHA-256) is used to generate a TLS fingerprint. Simultaneously, the Internet Protocol (IP) addresses and port information of both communicating parties are recorded. Combined with the TLS fingerprint, the device pairs establishing the encrypted connection are identified, and these logical connection relationships and the encryption types used are incorporated into the network device's operational data.
[0073] As can be seen, this implementation method can effectively identify the logical connection relationship between devices in an encrypted communication environment, overcome the limitations of traditional topology discovery technology in the face of encrypted traffic, and expand the coverage of network topology discovery.
[0074] As a feasible implementation method, the step of generating device relationship feature data based on network device operation data includes: performing time synchronization and spatial mapping on network device operation data from heterogeneous data sources; and / or, using anomaly detection algorithms to filter abnormal data in the network device operation data; and / or, converting command line instructions in network device operation data from heterogeneous data sources into predefined standard instruction formats; and / or, converting network device operation data based on different communication protocols into predefined standard data formats.
[0075] Time synchronization refers to unifying data collected from different data sources to the same time base, while spatial mapping refers to mapping device identifiers to a standard addressing space. Anomaly detection algorithms are machine learning methods used to identify outliers in data. Command-line instructions are the operation commands used in device configuration management. Standard command formats and standard data formats are unified data representation specifications defined internally by the system.
[0076] In practice, the system first performs time alignment on multi-source data, converting the timestamps of each data source into a unified Coordinated Universal Time (UTC) format, and standardizing the mapping of device identifiers (such as IP addresses and media access control addresses). Then, anomaly detection algorithms such as Isolation Forest are used to identify and filter noise and outliers generated during data acquisition. For configuration data collected via command-line interface, the system uses a rule engine to convert device commands from different manufacturers into a unified standard format. Finally, all data based on different protocols is converted into a standard data format defined internally by the system to ensure data consistency and processability.
[0077] As can be seen, this implementation method eliminates the problems of format differences and timing inconsistencies between data by standardizing the processing of multi-source heterogeneous data, thereby improving data quality and providing accurate and consistent input data for subsequent topology analysis.
[0078] S102: Input the device relationship feature data into the topology inference neural network model so as to use the topology inference neural network model to predict the connection relationship between network devices and the network hierarchy structure, and generate topology structure data;
[0079] Topology inference neural network models are trained machine learning models that take graph-structured or relational data as input and output the probability of connections between nodes or their hierarchical affiliation. Examples include Graph Neural Networks (GNNs) or their variants. Connection relationships refer to the existence of physical or logical links between network devices and the type of those links. Network hierarchy refers to the logical hierarchical affiliation of network devices, such as core layer, aggregation layer, access layer, or belonging to different Virtual Local Area Networks (VLANs) or subnets. Topology data is the structured data output by the model, describing the set of all devices in the network, the set of connections between devices, and the hierarchical attributes of the devices.
[0080] In this step, device relationship feature data is input into a pre-trained topological inference neural network model. Internally, this model learns deep representations of nodes and edges through multi-layered information propagation and aggregation. Finally, the output layer predicts the probability of a connection between any two devices and simultaneously performs hierarchical classification for each device. The model's output is then organized into standardized topological structure data.
[0081] As can be seen, this step utilizes the powerful nonlinear fitting and pattern recognition capabilities of neural network models to automatically and accurately learn the implicit connection rules and hierarchical patterns between devices from complex multi-source features. This overcomes the limitations of traditional fixed-rule engines and significantly improves the intelligence level and accuracy of topology discovery.
[0082] As a feasible implementation method, the topology inference neural network model is a graph neural network model. The step of using the topology inference neural network model to predict the connection relationships and network hierarchy between network devices includes: constructing a graph structure based on the device relationship feature data; wherein nodes in the graph structure represent network devices, and edges represent candidate connection relationships between network devices; calculating the association weights between nodes using the graph attention layer in the graph neural network model; aggregating neighbor node information based on the association weights between nodes using the graph convolutional layer in the graph neural network model to extract the spatial structure features of network devices; extracting the temporal variation features of network device communication relationships from the graph structure using the temporal convolutional layer in the graph neural network model; fusing the spatial structure features and the temporal variation features using the feature fusion layer in the graph neural network model, and weighting the fused features according to the association weights; and outputting the prediction results of the connection relationships and network hierarchy between network devices based on the weighted features.
[0083] Graph neural network (GNN) models are deep learning models specifically designed for processing graph-structured data. A graph is a mathematical structure composed of nodes and edges. In this embodiment, nodes represent specific network devices (such as routers, switches, and servers), and edges represent potential candidate connections between devices. A graph attention layer is a component in a GNN used to calculate the importance weights of associations between different nodes in the graph. A graph convolutional layer is a core component of a GNN, extracting the spatial structural features of nodes by aggregating information from neighboring nodes. A temporal convolutional layer is a neural network layer used to process time-series data, capable of extracting feature change patterns from time series. A feature fusion layer is a neural network layer that integrates features from different sources or types.
[0084] In practical implementation, the device relationship feature data is first constructed into a graph structure, where each network device is a node in the graph, and the potential connections between devices are edges. The attributes of the edges can include feature values such as communication frequency and traffic volume. Subsequently, as... Figure 2As shown, the original data is processed by a graph attention network. The graph attention layer of this network employs a multi-head attention mechanism, calculating the similarity between node features to obtain the association weights between each pair of nodes. This helps the model focus on device pairs that truly have strong associations. Next, the graph convolutional layer, based on these association weights, aggregates the feature information of each node's neighboring nodes through an information propagation mechanism, thereby extracting the structural features of network devices in the spatial topology. Simultaneously, the temporal convolutional layer processes the time-series data of device communication relationships, completing temporal feature extraction and capturing their dynamic patterns over time, such as the periodicity and stability of communication relationships. Finally, a feature fusion layer effectively fuses the spatial structural features and temporal variation features, and weights the fused features according to the association weights calculated by the graph attention layer. Ultimately, based on these weighted comprehensive features, a connection probability matrix is output, and through a classification or regression output layer, the existence of connections between devices and the network layer to which the devices belong are predicted.
[0085] As can be seen, this implementation combines graph attention mechanism, spatial convolution and temporal convolution, and effectively integrates them, enabling the topology inference model to simultaneously capture the complex spatial relationships and dynamic temporal behaviors between network devices, thereby significantly improving the accuracy and robustness of connection relationship prediction and hierarchical structure partitioning, and is especially suitable for large and complex network environments with dynamic changes.
[0086] S103: Determine the corresponding target layout algorithm based on the network topology features represented by the topology data, and use the target layout algorithm to generate a network topology map based on the topology data;
[0087] Network topology features refer to the attribute characteristics extracted from topology data to describe the overall shape of the network, such as network size, density, number of layers, and the presence of obvious core nodes. Target layout algorithms refer to graphical layout algorithms selected to achieve specific visualization effects, such as force-directed layout, hierarchical layout, and ring layout algorithms. A network topology diagram refers to image data that transforms topology data into graphical elements with specific coordinate positions, connections, colors, and shapes, and can be used for display.
[0088] In this step, the topology data is first analyzed for features, such as counting the number of nodes, determining the integrity of the hierarchical structure, and identifying the central nodes in the network. Then, based on a pre-defined rule mapping table, a suitable target layout algorithm is assigned to the current topology features. Finally, the target layout algorithm is invoked, taking the topology data as input, to calculate the coordinates of each node on the canvas, and to generate connections and labels, forming a preliminary network topology map.
[0089] As can be seen, this step achieves dynamic matching between the layout strategy and the actual characteristics of the network, avoiding the limitations of a single layout algorithm when dealing with networks of different sizes and structures. This results in the automatic generation of a network topology diagram that is logically clear and highly readable, greatly improving the interpretation efficiency for operations and maintenance personnel.
[0090] As a feasible implementation, the step of determining the corresponding target layout algorithm based on the network topology features represented by the topology data, and generating a network topology graph based on the topology data using the target layout algorithm, includes: if the network topology features represented by the topology data are a tree or chain structure with hierarchical relationships, then a hierarchical layout algorithm is used to generate a network topology graph; if the network topology features represented by the topology data are a network density greater than or equal to a first threshold, then a force-directed layout algorithm is used to generate a network topology graph; if the network topology features represented by the topology data are that there is at least one node in the network topology with a centrality index greater than or equal to a second threshold, then a ring layout algorithm is used to generate a network topology graph.
[0091] Among them, the force-directed layout algorithm is a layout algorithm that simulates the gravitational and repulsive forces between physical particles, achieving a uniform distribution of nodes by minimizing energy. The ring layout algorithm is a layout method that places important nodes at the center, with other nodes arranged around them. Network density refers to the ratio of the actual number of edges in a network to the maximum possible number of edges, used to measure the density of connections in the network. Centrality metrics are quantitative indicators that measure the importance of a node in a network, including degree centrality and betweenness centrality. The first and second thresholds are numerical parameters set according to the network size and layout effect requirements.
[0092] In practical implementation, the topology data is first analyzed to extract key network topology features. When a clear hierarchical relationship is identified in the network, presenting a tree-like or chain-like structure, the system automatically selects a hierarchical layout algorithm, placing core layer devices at the top, aggregation layer in the center, and access layer at the bottom, forming a clearly hierarchical topology. When the network density is high and the connection relationships are complex (e.g., density greater than or equal to the first threshold of 0.5), a force-directed layout algorithm is used. By simulating the attraction and repulsion between nodes, tightly connected nodes are clustered, and sparsely connected nodes are separated, forming a uniformly distributed topology. When a highly central node is detected in the network (e.g., centrality index greater than or equal to the second threshold of 0.8), a ring layout algorithm is selected, placing the core node at the center of the circle, with other nodes arranged in a hierarchical arrangement around it according to their connection relationship with the core node, highlighting the core-edge structure of the network.
[0093] As can be seen, this implementation method, by establishing an intelligent matching mechanism between network topology features and layout algorithms, can automatically select the optimal visualization scheme for networks with different structural features, effectively improving the readability and practicality of network topology diagrams, enabling operation and maintenance personnel to quickly understand network structural features, and improving the efficiency of network management and troubleshooting.
[0094] S104: Push the network topology diagram to the visualization interface for rendering and display.
[0095] In this context, a visual interface refers to a software interface provided to users that can graphically display the network topology, typically a web page or part of a desktop application. Rendering and display refer to the process where the front-end interface receives the topology map data, calls the drawing interface of a graphics library, and draws graphical elements such as nodes and connections on the screen, potentially providing interactive functions such as zooming, dragging, and clicking to view details.
[0096] In this step, the generated network topology map is sent to the client's front-end application via a network communication protocol. After receiving the data, the front-end application parses the data content and draws graphical elements on the canvas of the visualization interface according to predefined style specifications, ultimately presenting the complete topology map to the user.
[0097] As can be seen, this step completes the final stage from backend data analysis to frontend graphical presentation, providing users with an intuitive and interactive network topology view, making the complex network structure clear at a glance, and greatly facilitating network monitoring, management, and troubleshooting.
[0098] As a possible implementation method, this embodiment further includes: when a device offline event is detected in the network, determining the historical connection information related to the offline device based on historical topology data; generating a backup communication path based on the historical connection information; and pushing the device offline event and the backup communication path to the visualization interface for alarm.
[0099] Device offline events refer to state changes in network devices due to malfunctions, maintenance, or network outages. Historical topology data refers to network topology data collected and stored at past points in time, recording historical connection relationships, communication paths, and network status between devices. Historical connection information is detailed information extracted from historical topology data that is directly related to the currently offline device, including connection relationships, communication paths, and associated devices. Backup communication paths refer to alternative feasible communication routes calculated based on historical connection information when the primary communication path is interrupted due to device offline.
[0100] In specific implementation, such as Figure 3As shown, by continuously monitoring the status of network devices (such as through heartbeat detection, SNMP polling, etc.), device offline events are identified in real time. Once a device is detected to be offline, the analysis engine immediately retrieves the device's connection information when it was in normal condition from the historical topology data stored in the database, including its directly connected neighboring devices, the main communication links it once carried, and its logical location in the network. Based on this historical connection information, the analysis engine uses a path calculation algorithm, comprehensively considering the current network connectivity status and policy constraints, to automatically generate feasible alternative paths to bypass the offline device. Finally, the analysis engine pushes the specific information of the device offline event (such as device identifier, offline time, and scope of impact) and the calculated alternative communication path solutions to the visualization layer in real time through the data interface, alerting maintenance personnel in the form of highlighting, pop-up warning boxes, or generating fault tickets.
[0101] As can be seen, this implementation method, by combining real-time fault detection, historical data analysis and intelligent path calculation, can not only promptly alert devices to offline faults, but also proactively provide feasible recovery solutions, greatly shortening the diagnosis and recovery time of network faults and improving the self-healing capability and operation and maintenance efficiency of the network system.
[0102] The network topology generation method provided in this application collects network device operation data from multiple heterogeneous data sources and generates device relationship feature data based on this data. This breaks the dependence on a single protocol in related technologies and enables the acquisition of device information and interaction traces from a more comprehensive data dimension, laying a reliable data foundation for accurate topology construction and directly solving the topology blind spot problem caused by a single or incomplete data source. Next, the fused device relationship feature data is input into a topology inference neural network model for prediction. This model can learn complex, non-linear association patterns in the data to more intelligently infer the actual connection relationships between devices and the network hierarchy, thereby significantly improving the accuracy of the topology data in logical association and hierarchical division. Furthermore, based on the generated, more accurate topology data, a target layout algorithm is adaptively determined, ensuring that the final generated network topology map not only has accurate data relationships but also a more visually accurate layout that better reflects the actual characteristics of the network, improving the overall readability and accuracy of the network topology map.
[0103] The following describes an application embodiment provided by this application, such as... Figure 4As shown, the network topology system adopts a three-layer architecture, including a data perception layer, an intelligent analysis layer, and a cognitive interaction layer. The data perception layer is responsible for the collection and preliminary processing of multi-source heterogeneous data. This layer collects network device operation data in parallel through various protocols and interfaces, specifically including: polling the device's management information database through a simple network management protocol to obtain basic information such as interface status and routing tables; collecting traffic metadata through network traffic protocols such as NetFlow and sFlow to analyze the logical communication relationships between devices; obtaining device configuration and status information through application programming interfaces, representational state transfer (REST) interfaces, and system logs (Syslog); and also collecting data from software-defined network controllers to obtain topology information for new network architectures such as virtual networks and overlay networks. This layer also performs preprocessing operations such as time synchronization and format standardization on the collected data to provide a high-quality data foundation for subsequent analysis.
[0104] The intelligent analysis layer comprises two main components: a topology model and an anomaly detection engine. The topology model, built upon a graph neural network, first constructs a graph structure from the multi-source data processed by the data perception layer, with devices as nodes and potential connections as edges. The model calculates the association weights between nodes through a graph attention layer, extracts spatial structure features through graph convolutional layers, extracts temporal variation features through temporal convolutional layers, and finally fuses the spatiotemporal features in a feature fusion layer, outputting a connection probability matrix that accurately predicts the connection relationships between devices and the network hierarchy, generating a dynamically updated topology model. The anomaly detection engine continuously monitors the network status. When it detects anomalies such as device offline, it immediately initiates a processing flow: querying historical topology data, analyzing the affected area, and automatically generating alternative communication paths using path calculation algorithms, forming a complete fault handling solution.
[0105] The cognitive interaction layer provides users with an intuitive interactive experience, including a dynamic relationship graph, an augmented reality (AR) visualization interface, and a voice interaction module. The dynamic relationship graph adaptively selects a layout algorithm based on the topology data output by the intelligent analysis layer: a hierarchical layout algorithm for hierarchical structures, a force-directed layout algorithm for dense networks, and a ring layout algorithm for networks with central nodes, generating the optimal visualization effect. The AR visualization interface overlays virtual topology information onto real network devices via wearable devices or mobile terminals, achieving a fusion display of physical space and logical topology. The voice interaction module supports natural language queries, allowing maintenance personnel to obtain the topology relationships of specific devices or trigger topology update operations via voice commands. When the intelligent analysis layer detects an abnormal event and generates a handling plan, the cognitive interaction layer immediately receives the push notification, highlights the faulty device and backup path in the dynamic relationship graph, provides 3D annotation through the AR interface, and broadcasts alarm information through the voice module to guide maintenance personnel in rapid response.
[0106] As can be seen, this embodiment effectively solves the problems of data silos, static display, and poor interactivity in traditional network topology management through the collaborative work of the three-layer architecture, and significantly improves the efficiency and intelligence level of network operation and maintenance.
[0107] The following describes a network topology generation apparatus provided in an embodiment of this application. The network topology generation apparatus described below and the network topology generation method described above can be referred to each other.
[0108] See Figure 5 A structural diagram of a network topology generation apparatus according to an exemplary embodiment is shown, such as... Figure 5 As shown, it includes:
[0109] The acquisition module 100 is used to acquire network device operation data from multiple heterogeneous data sources and generate device relationship feature data based on the network device operation data;
[0110] The prediction module 200 is used to input the device relationship feature data into the topology inference neural network model, so as to use the topology inference neural network model to predict the connection relationship between network devices and the network hierarchy, and generate topology data.
[0111] The generation module 300 is used to determine the corresponding target layout algorithm based on the network topology features represented by the topology data, and to generate a network topology map based on the topology data using the target layout algorithm.
[0112] The display module 400 is used to push the network topology map to the visualization interface for rendering and display.
[0113] The network topology generation device provided in this application collects network device operation data from multiple heterogeneous data sources and generates device relationship feature data based on this data. This breaks the dependence on a single protocol in related technologies and enables the acquisition of device information and interaction traces from a more comprehensive data dimension, laying a reliable data foundation for accurate topology construction and directly solving the topology blind spot problem caused by a single or incomplete data source. Next, the fused device relationship feature data is input into a topology inference neural network model for prediction. This model can learn complex, non-linear association patterns in the data to more intelligently infer the actual connection relationships between devices and the network hierarchy, thereby significantly improving the accuracy of the topology data in logical association and hierarchical division. Furthermore, based on the generated, more accurate topology data, a target layout algorithm is adaptively determined, ensuring that the final generated network topology map not only has accurate data relationships but also a more visually accurate layout that better reflects the actual characteristics of the network, improving the overall readability and accuracy of the network topology map.
[0114] Based on the above embodiments, as a preferred implementation, the acquisition module 100 is specifically used to: poll the management information database of network devices through a simple network management protocol to obtain the interface and adjacency information of the devices; and / or, obtain the direct neighbor information of network devices through a link layer discovery protocol; and / or, sample the traffic in the network and generate traffic metadata based on the network traffic protocol or the Internet Protocol Flow Information Output Protocol to obtain the logical communication relationship between devices; and / or, call the application programming interface of the cloud service provider or network controller to obtain the configuration and status information of virtual networks and software-defined networks; and / or, deploy an extended Berkeley packet filter program at the operating system kernel layer to track network connections and communication links within containers, service meshes, and hosts.
[0115] Based on the above embodiments, as a preferred implementation, the acquisition module 100 is further configured to: capture data packets during the handshake phase of the Transport Layer Security (TLS) protocol; extract handshake features from the data packets; wherein the handshake features include server name indication, application layer protocol negotiation information, and any one or more items from the cipher suite list; generate a TLS fingerprint based on the handshake features, and determine the logical connection relationship between the devices according to the TLS fingerprint and the network address information of the communicating parties; and determine the extended connection relationship and the corresponding encryption type as network device operation data.
[0116] Based on the above embodiments, as a preferred implementation, the acquisition module 100 is specifically used for: performing time synchronization and spatial mapping on network device operation data from heterogeneous data sources; and / or, using an anomaly detection algorithm to filter abnormal data in the network device operation data; and / or, converting command line instructions in the network device operation data from heterogeneous data sources into a predefined standard instruction format; and / or, converting network device operation data based on different communication protocols into a predefined standard data format.
[0117] Based on the above embodiments, as a preferred implementation, the topological inference neural network model is a graph neural network model, and the prediction module 200 is specifically used for: constructing a graph structure based on the device relationship feature data; wherein, the nodes in the graph structure represent network devices, and the edges represent candidate connection relationships between network devices; calculating the association weights between nodes using the graph attention layer in the graph neural network model; aggregating neighbor node information based on the association weights between nodes using the graph convolutional layer in the graph neural network model to extract the spatial structure features of network devices; extracting the temporal change features of network device communication relationships from the graph structure using the temporal convolutional layer in the graph neural network model; fusing the spatial structure features and the temporal change features using the feature fusion layer in the graph neural network model, and weighting the fused features according to the association weights, and outputting the prediction results of the connection relationships between network devices and the network hierarchy based on the weighted features.
[0118] Based on the above embodiments, as a preferred implementation, the generation module 300 is specifically used to: if the network topology features represented by the topology data are a tree or chain structure with hierarchical relationships, then generate a network topology graph using a hierarchical layout algorithm; if the network topology features represented by the topology data are a network density greater than or equal to a first threshold, then generate a network topology graph using a force-directed layout algorithm; if the network topology features represented by the topology data are that there is at least one node in the network topology with a centrality index greater than or equal to a second threshold, then generate a network topology graph using a ring layout algorithm.
[0119] Based on the above embodiments, as a preferred embodiment, it further includes:
[0120] The offline event processing module is used to determine the historical connection information related to the offline device based on historical topology data when a device offline event is detected in the network; generate an alternative communication path based on the historical connection information; and push the device offline event and the alternative communication path to the visualization interface for alarm.
[0121] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.
[0122] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiments of this application, the embodiments of this application also provide an electronic device. Figure 6 This is a structural diagram of an electronic device according to an exemplary embodiment, such as... Figure 6 As shown, the electronic device includes:
[0123] Communication interface 1 enables information exchange with other devices, such as network devices;
[0124] Processor 2 is connected to communication interface 1 to enable information exchange with other devices. When running a computer program, it executes the network topology generation method provided by one or more of the above-mentioned technical solutions. The computer program is stored in memory 3.
[0125] Of course, in practical applications, the various components in an electronic device are coupled together through bus system 4. It can be understood that bus system 4 is used to achieve communication and connection between these components. In addition to the data bus, bus system 4 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 6 The general will label all buses as Bus System 4.
[0126] The memory 3 in this embodiment is used to store various types of data to support the operation of the electronic device. Examples of such data include any computer program used to operate on the electronic device.
[0127] It is understood that memory 3 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memory 3 described in the embodiments of this application is intended to include, but is not limited to, these and any other suitable types of memory.
[0128] The methods disclosed in the embodiments of this application can be applied to processor 2, or implemented by processor 2. Processor 2 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 2 or by instructions in the form of software. The processor 2 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 2 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in memory 3. Processor 2 reads the program in memory 3 and completes the steps of the aforementioned method in combination with its hardware.
[0129] When processor 2 executes the program, it implements the corresponding processes in the various methods of the embodiments of this application. For the sake of brevity, these will not be described in detail here.
[0130] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a memory 3 that stores a computer program, which can be executed by a processor 2 to complete the steps described in the aforementioned method. The computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.
[0131] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.
[0132] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer, server, network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.
[0133] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.
Claims
1. A method for generating network topology, characterized in that, include: Collect network device operation data from multiple heterogeneous data sources, and generate device relationship feature data based on the network device operation data; The device relationship feature data is input into the topology inference neural network model so as to use the topology inference neural network model to predict the connection relationship between network devices and the network hierarchy, and generate topology data. The corresponding target layout algorithm is determined based on the network topology features represented by the topology data, and the network topology map is generated based on the topology data using the target layout algorithm. The network topology diagram is pushed to a visualization interface for rendering and display.
2. The network topology generation method according to claim 1, characterized in that, The network device operation data collected from multiple heterogeneous data sources includes: The network device's management information database is polled using the Simple Network Management Protocol to obtain information about the device's interface and adjacency relationships; And / or, obtain the network device's directly connected neighbor information through the link layer discovery protocol; And / or, sample traffic in the network and generate traffic metadata based on network traffic protocol or Internet protocol flow information output protocol to obtain logical communication relationships between devices; And / or, call the application programming interface of the cloud service provider or network controller to obtain configuration and status information of the virtual network or software-defined network; And / or, deploy extended Berkeley package filters at the operating system kernel level to track network connections and communication links within containers, service meshes, and hosts.
3. The network topology generation method according to claim 2, characterized in that, The collection of network device operation data from multiple heterogeneous data sources also includes: Capture data packets during the transport layer security protocol handshake phase; Extract handshake features from the data packet; wherein the handshake features include server name indication, application layer protocol negotiation information, and any one or a combination of any number of items in the cipher suite list; Based on the handshake features, a transport layer security protocol fingerprint is generated, and the logical connection relationship between the devices is determined according to the transport layer security protocol fingerprint and the network address information of the communicating parties. The extended connection relationships and corresponding encryption types are identified as network device operation data.
4. The network topology generation method according to claim 1, characterized in that, The generation of device relationship feature data based on network device operation data includes: Perform time synchronization and spatial mapping of network device operation data from heterogeneous data sources; And / or, use anomaly detection algorithms to filter abnormal data in the network device's operating data; And / or, convert command-line instructions from network device runtime data from heterogeneous data sources into a predefined standard instruction format; And / or, convert network device operating data based on different communication protocols into a predefined standard data format.
5. The network topology generation method according to claim 1, characterized in that, The topology inference neural network model is a graph neural network model. The step of using the topology inference neural network model to predict the connectivity relationships between network devices and the network hierarchy includes: A graph structure is constructed based on the device relationship feature data; wherein, the nodes in the graph structure represent network devices, and the edges represent candidate connection relationships between network devices; The graph attention layer in the graph neural network model is used to calculate the association weights between nodes; The graph convolutional layer in the graph neural network model is used to aggregate neighbor node information based on the association weights between nodes in order to extract the spatial structural features of network devices; The temporal variation features of network device communication relationships are extracted from the graph structure using the temporal convolutional layer in the graph neural network model. The spatial structure features and the temporal variation features are fused using the feature fusion layer in the graph neural network model. The fused features are then weighted according to the association weights. Based on the weighted features, the prediction results of the connection relationships between network devices and the network hierarchy are output.
6. The network topology generation method according to claim 1, characterized in that, The step of determining the corresponding target layout algorithm based on the network topology features represented by the topology data, and generating a network topology map based on the topology data using the target layout algorithm, includes: If the network topology features represented by the topology data are a tree or chain structure with hierarchical relationships, then a hierarchical layout algorithm is used to generate a network topology graph. If the network topology features represented by the topology data are that the network density is greater than or equal to the first threshold, then the force-directed layout algorithm is used to generate the network topology map. If the network topology feature represented by the topology data is that there is at least one node in the network topology with a centrality index greater than or equal to the second threshold, then the network topology graph is generated using the ring layout algorithm.
7. The network topology generation method according to claim 1, characterized in that, Also includes: When a device offline event is detected in the network, historical connection information related to the offline device is determined based on historical topology data; Generate alternative communication paths based on the historical connection information; The device offline event and the backup communication path are pushed to the visualization interface for alarm purposes.
8. A network topology generation device, characterized in that, include: The data acquisition module is used to collect network device operation data from multiple heterogeneous data sources and generate device relationship feature data based on the network device operation data. The prediction module is used to input the device relationship feature data into the topology inference neural network model, so as to use the topology inference neural network model to predict the connection relationship between network devices and the network hierarchy, and generate topology data. The generation module is used to determine the corresponding target layout algorithm based on the network topology features represented by the topology data, and to generate a network topology map based on the topology data using the target layout algorithm. The display module is used to push the network topology map to a visualization interface for rendering and display.
9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the network topology generation method as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the network topology generation method as described in any one of claims 1 to 7.