Self-adaptive linear speed filtering device, method, medium and equipment

Abstract

The invention provides a self-adaptive line speed filtering device and method, a medium and equipment. The device comprises a signal access module, a data acquisition module, an algorithm decision module, a threshold execution module and a feedback adjustment module. The signal access module accesses a network message between the switch and the controller to realize line-speed forwarding and filtering preprocessing; the data acquisition module acquires controller operation performance indexes and network transmission state parameters in real time; pID, reinforcement learning and dual-mode switching units are arranged in the algorithm decision module, a dominant algorithm is dynamically determined, and a filtering threshold adjusting instruction is generated; the threshold execution module adjusts a threshold according to an instruction and executes linear speed filtering; and the feedback adjustment module collects a filtering result to form feedback data return optimization. According to the scheme, the working condition of the industrial control network can be dynamically adapted, adaptive adjustment of the filtering threshold value is achieved, controller CPU overload and real-time task blockage caused by flow impact are avoided, the mistaken blocking / missing blocking rate is reduced, the manual operation and maintenance cost is reduced, and the real-time performance and reliability of the industrial control network are guaranteed.

Description

Technical Field

[0001] This application relates to the field of industrial control technology, and in particular to an adaptive linear speed filtering device, method, medium, and equipment. Background Technology

[0002] In industrial control networks, the controller, as the core control unit, undertakes critical tasks such as real-time data processing, equipment command issuance, and closed-loop control. Its operational stability and real-time response directly determine the reliability of the industrial production process. Currently, the typical connection architecture of industrial control networks involves the controller being directly connected to a switch. Various packets in the network are transmitted directly to the controller through the switch, where the controller itself handles packet reception, parsing, and filtering. Existing technologies primarily rely on two implementation methods for packet filtering: one is to use a fixed filtering threshold, i.e., pre-setting a fixed packet transmission rate threshold, and directly limiting or dropping packets when network traffic exceeds this threshold; the other is to configure static access control lists (ACLs) on the switch, filtering packets based on preset fixed rules such as packet source address and destination address. However, these two implementation methods expose many unavoidable technical defects in actual industrial scenarios, seriously affecting the operational efficiency of industrial control networks.

[0003] First, existing technologies lack the ability to dynamically adapt to changes in controller operating status and network traffic. The traffic characteristics of industrial control networks are highly volatile, with potential for sudden traffic surges due to production process switching as well as periodic data transmission peaks. Fixed filtering thresholds cannot adaptively adjust to these dynamic changes: when sudden traffic surges occur, fixed thresholds struggle to respond quickly, resulting in a large influx of redundant or unnecessary packets into the controller, causing a sudden spike in CPU load, which in turn blocks real-time control tasks, delays in control command execution, and even fluctuations or interruptions in the production process. Conversely, during periods of low network load, fixed thresholds excessively restrict packet transmission, leading to wasted bandwidth resources and an inability to fully utilize network resources to transmit valuable non-critical packets such as monitoring data and equipment status feedback. Meanwhile, static ACL configuration can only filter packets based on a limited set of fixed rules, and cannot perceive the differences in packet priority and length characteristics. High-priority control command packets that are crucial in industrial control may be mistakenly blocked due to rule restrictions, while redundant low-priority packets may be missed because they are not identified, resulting in high false blocking and missed blocking rates, which seriously threaten the security and reliability of industrial control.

[0004] Secondly, existing technologies rely on manual parameter tuning and maintenance, resulting in high operation and maintenance costs and a lack of quantitative basis. Since fixed filtering thresholds and static ACL rules cannot automatically adapt to changes in operating conditions, when network traffic characteristics, production processes, or controller loads change, maintenance personnel need to manually adjust the thresholds or ACL rules. However, in industrial control scenarios, operating conditions change complexly and frequently, making it difficult for maintenance personnel to accurately determine the timing and extent of adjustments in real time. They often need to determine suitable parameters through repeated trial and error, which not only consumes significant manpower and time but may also lead to poor filtering effects or even secondary failures due to improper parameter settings. Furthermore, the manual parameter tuning process lacks scientific quantitative indicators and relies entirely on the experience and judgment of maintenance personnel. The consistency and accuracy of the adjustment results are difficult to guarantee, failing to meet the requirement of 24 / 7 uninterrupted and stable operation of industrial control networks.

[0005] In summary, existing message filtering methods in industrial control networks, due to their inherent defects of being static, imperceptible, and reliant on manual intervention, cannot solve problems such as CPU overload, bandwidth waste, high false positive and false negative rates, and high operation and maintenance costs caused by traffic surges. They have become a key bottleneck restricting the improvement of the real-time performance, reliability, and operation and maintenance efficiency of industrial control networks. Summary of the Invention

[0006] In view of this, this application provides an adaptive linear speed filtration device, method, medium and equipment, the main purpose of which is to dynamically adapt to changes in operating conditions and automatically adjust the filtration strategy.

[0007] According to one aspect of this application, an adaptive line-speed filtering device is provided for use in an industrial control network, comprising a signal access module, a data acquisition module, an algorithm decision module, a threshold execution module, and a feedback adjustment module. The signal access module is used to access network packets between switches and controllers in the industrial control network, enabling line-speed forwarding and filtering preprocessing of the packets. The data acquisition module is used to acquire real-time operating performance indicators of the industrial controller and network transmission status parameters of the industrial control network. The algorithm decision module incorporates a PID algorithm unit, a reinforcement learning algorithm unit, and a dual-mode switching unit. The dual-mode switching unit determines the dominant algorithm, and the PID algorithm unit or reinforcement learning algorithm unit, combined with acquired data and feedback data, generates a filtering threshold adjustment command. The threshold execution module adjusts the packet filtering threshold according to the adjustment command output by the algorithm decision module, performing line-speed filtering on the network packets accessed by the signal access module. The feedback adjustment module collects the filtering execution results from the threshold execution module, forms feedback data, and sends it back to the algorithm decision module, providing data support for optimizing the adjustment command.

[0008] In one implementation, the reinforcement learning algorithm unit includes a state construction subunit, an action generation subunit, and a reward calculation subunit. The state construction subunit constructs a state space based on the data collected by the data acquisition module. The action generation subunit generates an action space that includes threshold increases, maintenance, and decreases. The reward calculation subunit calculates the reward value based on controller operating deviation, message delay, and packet loss rate. The dual-mode switching unit has built-in deviation judgment logic: when the deviation between the current operating performance index obtained by the data acquisition module and the target value is within a preset steady-state range and lasts for a preset time, the PID algorithm is maintained as the dominant algorithm; when the current operating performance index exceeds a preset extreme range, the PID algorithm is forcibly switched to; in other states, the reinforcement learning algorithm is dominant, and the PID algorithm serves as a fallback.

[0009] In one implementation, a canary verification module is also included. This module selects a portion of network traffic and verifies it based on the filtering threshold adjustment command output by the algorithm decision module. The reasonableness of the threshold is judged by a preset verification index. If the verification passes, the threshold execution module is triggered to apply the threshold in its entirety. If the verification fails, the threshold execution module is triggered to roll back to the previous valid threshold and send a negative feedback flag to the algorithm decision module. The threshold execution module has a built-in threshold limiting unit that sets the upper and lower limits of the filtering threshold. When the threshold corresponding to the adjustment command output by the algorithm decision module exceeds the upper and lower limits, the threshold is limited to the corresponding limit, and an integral zeroing signal is sent to the PID algorithm unit.

[0010] According to one aspect of this application, a dynamic threshold control method is provided, applied to an adaptive line-speed filtering scenario in an industrial control network. The method includes: initializing adaptive line-speed filtering related parameters, setting the target operating performance index of the industrial controller and the initial range of the filtering threshold; real-time acquisition of the current operating performance index of the industrial controller and network transmission status parameters in the industrial control network; determining the deviation between the current operating performance index and the target operating performance index, and determining the dominant algorithm for generating the filtering threshold adjustment command based on the deviation; using the dominant algorithm, combined with the current operating performance index, network transmission status parameters, and historical feedback data, calculating and generating the filtering threshold adjustment command; adjusting the message filtering threshold according to the filtering threshold adjustment command, and performing line-speed filtering on network messages in the industrial control network; acquiring the line-speed filtered message transmission data and controller operating status data, forming feedback data, and transmitting it back to the dominant algorithm; repeating the above real-time acquisition and feedback data transmission operations to achieve dynamic closed-loop control.

[0011] In one implementation, the deviation state is determined by the absolute value of the difference between the current operating performance index and the target operating performance index, as well as the duration of the absolute value of the difference. The process of determining the dominant algorithm includes: when the deviation between the current operating performance index and the target operating performance index is within a preset steady-state range and lasts for a preset time, the PID algorithm is maintained as the dominant algorithm; when the current operating performance index exceeds a preset extreme range, the algorithm is forcibly switched to the PID algorithm; in other states, the reinforcement learning algorithm is dominant, and the PID algorithm serves as a backup.

[0012] In one implementation, during the calculation of the control output by the PID algorithm, upper and lower limits of the filtering threshold are set. When the control output exceeds the range of the upper and lower limits, the output is limited to the corresponding limit and the integral term is cleared. The reinforcement learning algorithm generates adjustment instructions by constructing a state space, an action space, and a reward function. The state space consists of the operating performance index and network transmission state parameters. The action space includes three action types: threshold increase, threshold maintenance, and threshold decrease. The reward function is constructed based on the controller operating deviation, message transmission delay, and packet loss rate.

[0013] In one implementation, after generating the filtering threshold adjustment command and before executing line-rate filtering, a canary verification operation is also included: selecting a portion of network traffic and performing filtering verification based on the threshold corresponding to the filtering threshold adjustment command, judging the rationality of the threshold through preset verification indicators; if the verification passes, line-rate filtering is executed; if the verification fails, it is rolled back to the previous valid threshold, and the corresponding algorithm experience is marked as negative feedback; the preset verification indicators include at least packet false blocking rate, average latency, and CPU jitter amplitude.

[0014] In one implementation, the adaptive line-rate filtering parameters include the proportional coefficient, integral coefficient, and derivative coefficient of the PID algorithm; the current operating performance indicators include at least the CPU utilization rate of the industrial controller; the network transmission status parameters include at least the bandwidth utilization rate, average packet byte length, proportion of high-priority messages, average packet delay, and packet loss rate; and the feedback data includes at least the filtered packet false blocking rate, the change in controller operating performance after threshold execution, and the change in network transmission status.

[0015] According to one aspect of this application, a storage medium is provided that stores a computer program, wherein the computer program is configured to execute the above-described method at runtime.

[0016] According to one aspect of this application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the methods described above.

[0017] By employing the above technical solutions, the adaptive line-speed filtering device, method, medium, and equipment provided in this application firstly synchronously capture the controller's operating performance and network transmission status, providing accurate quantitative basis for strategy adjustment and avoiding blind filtering; secondly, it innovatively adopts a "dual-mode algorithm dynamic switching" strategy, abandoning the limitations of a single algorithm, utilizing the rapid response and stability of the PID algorithm under steady-state and extreme conditions, combined with the optimal strategy exploration capability of the reinforcement learning algorithm under complex and variable conditions, to achieve optimal strategy adaptation under different scenarios, ensuring that the filtering threshold can quickly cope with sudden traffic surges and optimize resource utilization in the long term; finally, through a closed-loop feedback mechanism, a continuous optimization cycle is formed, transmitting the filtering effect back to the decision-making stage in real time, continuously correcting the algorithm parameters and threshold strategy, avoiding strategy rigidity, and ensuring that the filtering effect always conforms to changes in operating conditions. This collaborative design of "perception-decision-execution-feedback" logically forms a systematic solution to the shortcomings of existing technologies, enabling the device to autonomously and intelligently adapt to the dynamic changes of industrial control networks, and achieve adaptive adjustment of thresholds without human intervention. This simultaneously achieves the technical effects of stabilizing controller operation, reducing false blocking / missed blocking rates, and reducing operation and maintenance costs.

[0018] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A schematic diagram of an industrial control network connection based on an embodiment of this application is shown; Figure 2 This illustration shows a schematic diagram of an adaptive linear velocity filtering device provided in an embodiment of this application. Figure 3 A flowchart of a dynamic threshold control method provided in an embodiment of this application is shown; Figure 4 A flowchart illustrating an example of a dynamic threshold control method provided in this application is shown. Detailed Implementation

[0020] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, and not all of them. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present application. It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of the present application can be combined with each other.

[0021] During their research, the inventors of this application discovered that the existing industrial control network architecture consists of an HMI (Human-Machine Interface), switches, controllers, and I / O cards. The HMI is connected to the switch via network lines, the switch is directly connected to the controller, and multiple I / O cards are mounted below the controller. Simultaneously, the switch can connect to other devices or switches to expand the scale of the industrial control network. In this connection method, various network packets are directly transmitted from the switch to the controller, and the reception, parsing, and filtering of packets are handled by the controller itself or by the static configuration of the switch. There is a lack of dynamic adaptation mechanisms for changes in controller operating status and network traffic.

[0022] At least the following technical problems exist. First, the fixed threshold leads to CPU load and real-time task issues. Due to the lack of an adaptive line-speed filtering device, there is no dynamic flow control mechanism between the switch and the controller, and fixed filtering thresholds or non-targeted rate limiting strategies are used. When sudden traffic occurs in the industrial network, a large number of redundant packets directly flood the controller, which can easily cause the controller's CPU utilization to soar, leading to increased jitter in the execution of real-time control tasks, and in severe cases, even causing delays in control commands and fluctuations in the production process. Second, the problem of false blocking / missed blocking caused by static ACLs. If packet filtering is performed by setting static access control lists (ACLs) on the switch, since ACLs can only filter packets based on preset fixed rules (such as source / destination addresses), they cannot perceive the priority (such as the priority difference between control commands and monitoring data) and length characteristics of packets. This can result in high-priority control packets being falsely blocked and low-value redundant packets being missed, significantly increasing the false blocking / missed blocking rate and threatening the reliability and real-time performance of industrial control. Third, the maintenance cost problem caused by manual parameter tuning. Both adjusting fixed thresholds and modifying static ACL rules rely on manual operation. Industrial environments are subject to complex and frequent changes in operating conditions, making it difficult for maintenance personnel to accurately judge the timing and extent of adjustments in real time. They often have to repeat trial and error, which lacks quantitative basis and consumes a lot of manpower and time, resulting in high maintenance costs. Furthermore, the consistency and accuracy of the adjustment results are difficult to guarantee.

[0023] Based on the above analysis, this application proposes to add an adaptive line speed filtering device to the industrial control network architecture to support dynamic adaptation to changes in controller operating status and network traffic.

[0024] See Figure 1 This is a schematic diagram of an industrial control network connection based on an embodiment of this application. The architecture includes an HMI (Human-Machine Interface), a switch, an adaptive line-speed filter, a controller, and I / O cards. The HMI is connected to the switch via a network. The switch is connected to the adaptive line-speed filter, which is then connected to the controller. The controller further connects to multiple sets of I / O cards. Simultaneously, the switch can also connect to other devices or switches to expand the network.

[0025] The adaptive line-rate filtering device, acting as an intelligent filtering hub between the switch and the controller, enables line-rate filtering and dynamic threshold control of industrial control network packets. On one hand, it can accurately intercept redundant and unnecessary network packets without affecting the packet transmission rate, preventing CPU overload and real-time control task blockage caused by traffic surges. On the other hand, it can automatically adjust the filtering threshold based on the controller's operating performance (such as CPU utilization) and network transmission status (such as bandwidth and packet priority), achieving an adaptive strategy of enhanced filtering under high load and flexible passage under low load.

[0026] In practical implementation, this adaptive line-speed filtering device can integrate core units such as a data acquisition module, an algorithm decision-making module, and a threshold execution module. The data acquisition module captures the controller's operating performance indicators (such as CPU utilization) and network transmission status parameters (such as bandwidth utilization and the proportion of high-priority messages) in real time. Based on this data, the algorithm decision-making module generates filtering threshold adjustment instructions adapted to the current operating conditions by dynamically switching between PID and reinforcement learning algorithms. The threshold execution module adjusts the filtering rules according to the instructions to perform line-speed filtering on passing network packets. At the same time, the device continuously optimizes the filtering strategy through a feedback mechanism, forming a closed-loop control of "acquisition-decision-execution-feedback" to ensure that the filtering effect both guarantees the stable operation of the controller and makes full use of network bandwidth.

[0027] See Figure 2 This is a schematic diagram of an adaptive linear speed filtering device provided in an embodiment of this application. The device is applied to an industrial control network and includes a signal access module, a data acquisition module, an algorithm decision module, a threshold execution module, and a feedback adjustment module.

[0028] The signal access module is used to access network packets between switches and controllers in industrial control networks, enabling line-speed forwarding and filtering preprocessing of packets.

[0029] In this embodiment, the signal access module is designed based on a high-speed hardware forwarding architecture, employing a dedicated network processing chip (such as an FPGA or a high-performance network processor) to support line-speed (i.e., the maximum transmission rate of the network interface, such as 1Gbps or 10Gbps) packet forwarding and preprocessing. Through the signal access module, network packets can be initially classified and marked without introducing additional latency, providing basic information for subsequent filtering. When network packets between switches and controllers in the industrial control network flow through the signal access module, the module first performs high-speed parsing of the Ethernet frame header, IP header, protocol type, and other fields of the packet using a hardware parsing engine. Then, it marks the packet according to preset preprocessing rules (such as preliminary classification based on packet source / destination port and protocol type), while maintaining line-speed packet transmission to ensure that the real-time performance of the industrial control network is not affected.

[0030] For example, the signal access module can quickly identify and label Modbus TCP control messages and Ethernet / IP device status messages at the hardware level as "high-priority control messages" and "medium-priority status messages," respectively, providing a classification basis for the subsequent threshold execution module's accurate filtering. This achieves preprocessing of messages while they are forwarded at high speed, ensuring the real-time requirements of industrial control networks (without additional delays) and providing fundamental data support for subsequent intelligent filtering, avoiding message delays or packet loss caused by software-level processing.

[0031] The data acquisition module is used to acquire the operating performance indicators of the industrial controller and the network transmission status parameters of the industrial control network in real time.

[0032] In this embodiment, the data acquisition module captures the operating status and network transmission characteristics of the industrial controller in real time through multi-dimensional sensors and protocol parsing. For example, based on the communication protocols of the industrial control network (such as OPC UA, Modbus, etc.) and the controller's management interface (such as SNMP, serial port), it collects key performance and status parameters to form a comprehensive understanding of the system's operating conditions.

[0033] On one hand, the data acquisition module establishes a connection with the management interface of the industrial controller, periodically collecting operational performance indicators such as CPU utilization, memory usage, and task execution cycle. On the other hand, by deploying traffic acquisition probes on the network link, it parses network packets in real time to obtain network transmission status parameters such as bandwidth utilization, average packet byte length, proportion of high-priority messages, average packet latency, and packet loss rate. The collected data, after standardization processing, is transmitted to the algorithm decision-making module in real time. Taking a PLC controller as an example, the data acquisition module collects its CPU utilization every 50 milliseconds (with an accuracy of 0.1%), and simultaneously calculates the network link bandwidth utilization (with a resolution of 1Kbps) and the proportion of high-priority Modbus control messages every 100 milliseconds, providing a high-frequency, high-precision data source for algorithm decision-making. This achieves real-time, multi-dimensional perception of the industrial controller and network transmission status, providing the algorithm decision-making module with a precise "operating condition dashboard," enabling quantitative adjustments to the filtering threshold and solving the static filtering defects caused by the lack of status perception in existing technologies.

[0034] The algorithm decision module has a built-in PID algorithm unit, reinforcement learning algorithm unit, and dual-mode switching unit. The dual-mode switching unit determines the dominant algorithm, and the PID algorithm unit or reinforcement learning algorithm unit combines the collected data and feedback data to generate the filter threshold adjustment command.

[0035] In this embodiment, the algorithm decision-making module integrates classical control theory and artificial intelligence algorithms. Through dual-mode switching logic, it selects the optimal algorithm (PID algorithm or reinforcement learning algorithm) under different operating conditions, generating a filtering threshold adjustment command adapted to the current operating condition. Its principle is based on real-time data from the data acquisition module, combined with historical data from the feedback adjustment module, to construct a mapping relationship between "operating condition-algorithm-threshold," thereby achieving intelligent decision-making.

[0036] The dual-mode switching unit continuously monitors the deviation (including absolute value and duration) between the controller's operating performance indicators and the target value transmitted from the data acquisition module. When the deviation is within a preset steady-state range (e.g., CPU utilization deviation < 5% for 1 second), the PID algorithm remains dominant; when the deviation exceeds a preset extreme range (e.g., CPU utilization > 90%), it forcibly switches to the PID algorithm to quickly recover the operating condition; in other states, it switches to the reinforcement learning algorithm to explore better strategies. The PID algorithm unit uses a discretized bilinear transformation to convert the continuous-domain PID control equation into a discrete-domain model. Based on historical deviation data and current deviation data (e.g., CPU utilization deviation), it calculates the control output (i.e., the adjustment amount of the filtering threshold) and sets upper and lower limits for the threshold to avoid over-adjustment. The reinforcement learning algorithm unit constructs a reinforcement learning model with "controller operating performance indicators + network transmission status parameters" as the state space, "threshold increase / maintenance / decrease" as the action space, and "controller operating deviation + message transmission delay + packet loss rate" as the reward function. Through continuous interaction with the environment (industrial control network and controller), it learns the optimal threshold adjustment strategy under different operating conditions. In one implementation, the reinforcement learning algorithm unit further includes a state construction subunit, an action generation subunit, and a reward calculation subunit. The state construction subunit constructs a state space based on data collected by the data acquisition module; the action generation subunit generates an action space including threshold increases, maintenance, and decreases; and the reward calculation subunit calculates the reward value based on controller operating deviation, message latency, and packet loss rate. The dual-mode switching unit incorporates deviation judgment logic: when the deviation between the current operating performance index obtained by the data acquisition module and the target value is within a preset steady-state range and lasts for a preset time, the PID algorithm remains dominant; when the current operating performance index exceeds a preset extreme range, a forced switch to the PID algorithm is initiated; in other states, the reinforcement learning algorithm is dominant, with the PID algorithm serving as a fallback.

[0037] For example, when the industrial network is in a steady state (CPU utilization is stable at 60%±3%), the dual-mode switching unit selects the PID algorithm and calculates that the filtering threshold needs to be increased by 20% based on the CPU utilization deviation (target value 55%) to slightly reduce the number of packets entering the controller. When the network experiences a sudden surge in traffic due to a change in production process (CPU utilization suddenly rises to 85%), the dual-mode switching unit forces a switch to the PID algorithm, quickly increasing the filtering threshold by 50% and pulling the CPU utilization back below 70% within 1 second. When the network conditions are complex and changeable (such as multiple devices communicating alternately), the system switches to the reinforcement learning algorithm. Through continuous exploration and learning, it finds a threshold adjustment strategy that can both ensure stable CPU utilization and maximize bandwidth utilization.

[0038] Thus, the optimal algorithm is adapted to different working conditions, taking into account both the control accuracy in steady state and the response speed in extreme working conditions. At the same time, the optimal filtering strategy that is difficult to discover manually is discovered through reinforcement learning algorithm, which solves the problem of the limited applicability of a single algorithm in the existing technology, making the adjustment of the filtering threshold more intelligent and efficient.

[0039] The threshold execution module adjusts the packet filtering threshold according to the adjustment instructions output by the algorithm decision module, and performs line-rate filtering on the network packets accessed by the signal access module.

[0040] The threshold execution module, based on a high-speed hardware filtering engine, adjusts the filtering threshold in real time according to the adjustment instructions from the algorithm decision module, performing line-speed filtering on packets preprocessed by the signal access module. By converting the threshold instructions generated by the algorithm into hardware-executable filtering rules, it achieves precise interception or passage along the packet line-speed forwarding path. Upon receiving the filtering threshold adjustment instructions from the algorithm decision module, the threshold execution module parses the instructions into hardware filtering rules (such as filtering conditions based on packet priority, length, and protocol type) and loads them into the high-speed filtering engine. When packets from the signal access module flow through, the filtering engine, based on the currently loaded rules, completes packet matching and filtering within nanoseconds (allowing packets that meet the threshold and intercepting those that do not), while maintaining line-speed forwarding.

[0041] For example, when the algorithm decision module generates an instruction to "increase the release threshold for high-priority Modbus control messages (from 80% to 95%) and decrease the release threshold for low-priority status messages (from 60% to 30%)", the threshold execution module parses this instruction into hardware rules and classifies and filters the passing messages: the release rate of high-priority Modbus control messages is increased to 95%, ensuring that critical control commands are not mistakenly blocked; only 30% of low-priority status messages are released, reducing the impact of redundant data on the controller. This enables real-time, linear-speed adjustment of the filtering threshold, ensuring the real-time performance of the industrial control network (no additional delay in filtering operations) while accurately executing the algorithm decision module's strategy, ensuring that the filtering effect matches the algorithm's expectations. This solves the control failure problem caused by untimely or inaccurate filtering execution in existing technologies.

[0042] The feedback adjustment module collects the filtering execution results of the threshold execution module, forms feedback data, and sends it back to the algorithm decision module to provide data support for the optimization of adjustment instructions.

[0043] The feedback adjustment module collects the results data after filtering execution to form a closed-loop feedback, providing a basis for the optimization of the algorithm decision module. Based on the closed-loop feedback concept of control theory, the system output (filtering effect) is fed back to the input (algorithm decision) to achieve continuous optimization of the strategy. The feedback adjustment module collects packet transmission data (such as false blocking rate, average latency, packet loss rate) and controller operating status data (such as changes in CPU utilization, task execution jitter) after the threshold execution module filters the packets. After cleaning and analyzing this data, it generates feedback data (such as a quantitative suggestion of "false blocking rate is too high, the filtering threshold needs to be reduced by 5%), and sends it back to the PID algorithm unit and reinforcement learning algorithm unit of the algorithm decision module in real time to correct the PID parameters or update the reinforcement learning model.

[0044] For example, if feedback data shows that the false blocking rate of high-priority control messages after filtering reaches 5% (exceeding the acceptable range of 2%), the feedback adjustment module quantifies this data into an instruction to "reduce the corresponding filtering threshold by 5%" and sends it back to the algorithm decision module. The algorithm decision module then adjusts the PID parameters or reinforcement learning strategy accordingly, optimizing the filtering threshold in the next control cycle to reduce the false blocking rate to below 1%. This achieves closed-loop optimization of the filtering strategy, enabling the algorithm decision module's strategy to continuously adapt to changes in operating conditions. It avoids filtering failures caused by operating condition drift or algorithm deviations, ensuring the long-term stability and accuracy of the system and solving the strategy rigidity problem caused by the lack of feedback in existing technologies.

[0045] In summary, the adaptive line-rate filtering device provided in this application, through the synergistic effect of its various modules, can specifically address the core defects of existing technologies and achieve significant technical effects. In existing technologies, industrial control networks often adopt an architecture where the controller is directly connected to the switch, relying on fixed filtering thresholds or static ACLs. This lacks the ability to dynamically perceive and adapt to changes in the controller's operating status and network traffic, leading to a surge in controller CPU usage and significant real-time task jitter under sudden traffic spikes. Static ACLs cannot perceive packet priority and length, resulting in high false blocking / missed blocking rates. Furthermore, manual parameter tuning lacks quantitative basis and incurs high maintenance costs. The adaptive line-speed filtering device provided in this application embodiment has a signal access module that accesses network packets between the switch and the controller, realizing line-speed forwarding and filtering preprocessing. This avoids the load impact caused by packets directly flooding the controller in the prior art, and provides basic data support for subsequent filtering. The data acquisition module acquires the controller's operating performance indicators and network transmission status parameters in real time, breaking through the limitation of the lack of real-time status awareness in the prior art, and providing a quantitative basis for dynamic decision-making. The algorithm decision module has a built-in PID algorithm unit, reinforcement learning algorithm unit, and dual-mode switching unit, which can dynamically select the dominant algorithm according to the operating conditions. This solves the problem of the limited applicability of a single algorithm in the prior art. In steady state, the PID algorithm ensures control accuracy, and in extreme operating conditions, the PID quickly pulls back. In other states, reinforcement learning explores better strategies, making the filtering threshold adjustment more intelligent and efficient. The threshold execution module adjusts the filtering threshold at line speed according to the adjustment command, ensuring the real-time performance of the industrial control network and avoiding control failure caused by untimely filtering execution in the prior art. The feedback adjustment module collects the filtering execution results and sends back feedback data to form a closed-loop optimization, solving the problem of strategy rigidity caused by the lack of feedback in the prior art. Therefore, the device achieves adaptive dynamic adjustment of the filtering threshold, effectively avoiding CPU overload and real-time task blockage caused by traffic surges, reducing the false blocking / missed blocking rate, optimizing the filtering strategy without manual intervention, and significantly reducing operation and maintenance costs while ensuring the real-time performance and reliability of the industrial control network, thus overcoming the shortcomings of existing technologies.

[0046] As can be seen, the embodiments of this application employ PID algorithm and reinforcement learning algorithm for dual-mode switching in the software implementation of the adaptive linear speed filtering device. For clarity, the PID algorithm, reinforcement learning algorithm, and dual-mode switching are described below by example.

[0047] 1. PID Algorithm In terms of PID algorithms, its continuous domain equation is expressed as: u(t) = Kp·e(t) + Ki·∫e(t)dt + Kd·de(t) / dt in: u(t): Control Output; Kp: Proportional Gain, which generates control output according to the proportion of the current error; e(t): Error, the deviation between the current state of the system and the target state; Kp·e(t): The larger the error, the larger the output u(t) (proportional). Increasing Kp can speed up the system response (allow the system to approach the target faster), but too large Kp will cause the system to oscillate (repeatedly correct after overshoot), or even become unstable. Ki: Integral Gain, which accumulates historical errors and has a regulating effect, eliminating the system's "steady-state error"; Ki·∫e(t)dt: The longer the error duration and the larger the cumulative value, the higher the proportion of the integral term in the output u(t). For example, when the system generates a small steady-state error due to friction, load changes, etc., the integral term will continuously accumulate the error, gradually increasing the output until the error returns to zero. Increasing Ki can speed up the elimination of steady-state error, but excessively large Ki will lead to a slower system response and an increase in overshoot (integral saturation phenomenon). Kd: Derivative Gain, adjusted in advance based on the rate (trend) of error change to suppress system overshoot and enhance stability; Kd·dtde(t): The faster the error changes (the larger the absolute value of the derivative), the stronger the adjustment effect of the differential term in the output.

[0048] For example, when the system approaches the target value, if the error decreases rapidly (dtde(t) is negative), the derivative term will "decelerate" in advance to avoid overshoot; if the error suddenly increases (dtde(t) is positive), the derivative term will "accelerate" in advance to quickly suppress the deviation. Increasing Kd can reduce overshoot and enhance system stability, but excessive Kd will amplify high-frequency noise (such as small fluctuations in the sensor), causing output oscillation.

[0049] The error is defined as: e(t) = Ctarget C(t), where Ctarget: target value (set value); C(t): current system output value -- instantaneous CPU utilization. Its properties are: if e(t)>0, it means the current value is lower than the target value; if e(t)<0, it means the current value is higher than the target value; when e(t)=0, the system reaches the target.

[0050] To achieve digital applications, bilinear transformation can be used for discretization to obtain a discretized equation. Discretization (Tustin transformation, Δt = 1s), also known as bilinear transformation, is a core method for discretizing continuous systems in digital control systems. It is used to map the transfer function in the continuous time domain (s-domain) to the discrete time domain (z-domain) to achieve digital analysis and design of continuous systems. Its essence is to approximate continuous integration through "trapezoidal integration" and establish a one-to-one correspondence between the s-domain and the z-domain, which is widely used in fields such as industrial control and signal processing (such as discretization of PID controllers and filter design).

[0051] The discretized equation is as follows: e[k] = Ctarget C[k]; u[k] = u[k - 1]+α·e[k] +β·e[k - 1]+γ·e[k - 2]; where α = Kp + Ki·Δt + Kd / Δt; β = Kp 2·Kd / Δt; γ = Kd / Δt.

[0052] Meanwhile, to prevent integral saturation, an anti-saturation and upper and lower limit mechanism is set. If u[k]>Tmax or u[k]<Tmin, Tmax or Tmin is taken respectively and the integral term is cleared. As an example, the recommended industrial field parameters are Kp = 2.0, Ki = 0.5, Kd = 1.0, Tmin = 500 pps, Tmax = 3000 pps.

[0053] 2. Reinforcement learning algorithm The state space of the reinforcement learning algorithm (RL, Reinforcement Leaning) can be expressed as:​​​​​​​​​​​​​​​​​​​​​For example, w1=0.5, w2=0.3, w3=0.2.

[0054] See Table 1 for explanations of the meanings of each symbol.

[0055] Table 1

[0056] 3. Dual-mode switching logic The dual-mode switching logic determines the dominant algorithm based on the deviation between the controller's operating performance indicators and the target value: when |C When C_target|<5% for 5 seconds, the PID algorithm is maintained; when C>90% or C<30%, the system is forcibly switched to the PID algorithm to quickly return to the operating condition; in other states, the reinforcement learning algorithm is the main algorithm, and the PID algorithm is used as a backup.

[0057] In one implementation, the aforementioned adaptive line-rate filtering device further includes a canary verification module. This module selects a portion of network traffic and verifies it based on the filtering threshold adjustment command output by the algorithm decision module. It judges the reasonableness of the threshold using preset verification indicators. If the verification passes, the threshold execution module is triggered to apply the threshold in its entirety. If the verification fails, the threshold execution module is triggered to roll back to the previous valid threshold and sends a negative feedback flag to the algorithm decision module. The threshold execution module has a built-in threshold limiting unit that sets the upper and lower limits of the filtering threshold. When the threshold corresponding to the adjustment command output by the algorithm decision module exceeds the upper and lower limits, the threshold is limited to the corresponding limit, and an integral zeroing signal is sent to the PID algorithm unit.

[0058] For example, select 5% of the total traffic (or one switch port) as a gray-scale instance for rapid trial and error with small traffic volumes, and observe indicators such as false blocking rate ε, average latency Δ, and CPU jitter σ. If ε < 1%, Δ < 5ms, and σ < 1ms, the verification is successful; otherwise, the previous threshold is rolled back, and the reinforcement learning experience is marked as a negative reward, thus keeping the "exploration-exploitation" risk of reinforcement learning within a controllable range.

[0059] As can be seen, the canary validation module adopts the "gray-scale release" approach, selecting a small amount of network traffic (such as 5% of the total traffic or the traffic of a specified switch port) as a test sample to verify the filtering threshold adjustment commands generated by the algorithm decision module on a small scale. The core is to determine the rationality of the new threshold by monitoring preset indicators such as false blocking rate, average latency, and CPU jitter, without affecting the overall stability of the industrial control network. If the verification indicators meet expectations, the threshold execution module is triggered to apply the threshold to all targets; if the indicators exceed the tolerance range, it immediately rolls back to the previous effective threshold and sends a negative feedback flag to the algorithm decision module, providing the algorithm with a learning basis for "erroneous decisions" and avoiding the recurrence of similar problems. This design limits the exploration risk of threshold adjustment to a small traffic range, ensuring the continuity of the core production process while enabling rapid trial and error and algorithm iteration, significantly improving the convergence efficiency and robustness of the filtering strategy. The threshold execution module's built-in threshold limiting unit acts as a safety fallback. It pre-sets upper and lower limits for the filtering threshold. When the threshold corresponding to the adjustment command output by the algorithm decision module exceeds this range, it automatically limits the threshold to the corresponding limit and simultaneously sends an integral zeroing signal to the PID algorithm unit. This mechanism prevents damage to the system from excessively high or low thresholds and also solves the integral saturation problem of the PID algorithm in output-constrained scenarios. It ensures that the algorithm readjusts precisely at the new threshold base, guaranteeing the control accuracy and response speed of the entire system under extreme conditions, achieving coordinated protection between hardware execution and algorithm logic.

[0060] In summary, the adaptive line-speed filtering device provided in this application overcomes the inherent limitations of existing technologies, which are characterized by "staticity, lack of perception, single strategy, and lack of closed-loop," and constructs a full-process collaborative system of "perception-decision-execution-feedback," fundamentally adapting to the dynamic operating conditions of industrial control networks. The root cause of the shortcomings of existing technologies lies in the lack of a real-time linkage mechanism between controller status and network traffic. Fixed thresholds and static ACLs are essentially "passive response" modes, unable to adjust strategies according to changes in operating conditions, and lack quantitative data to support decision-making, relying solely on manual intervention. This device first breaks down information barriers through "full-dimensional state perception," moving beyond simple traffic parameters to simultaneously capture controller performance and network transmission status, providing precise quantitative data for policy adjustments and avoiding blind filtering. Secondly, it innovatively employs a "dual-mode algorithm dynamic switching" strategy, overcoming the limitations of single-algorithm applications. Leveraging the rapid response and stability of the PID algorithm under steady-state and extreme conditions, combined with the optimal policy exploration capabilities of reinforcement learning algorithms under complex and variable conditions, it achieves optimal policy adaptation for different scenarios, ensuring that the filtering threshold can quickly respond to sudden traffic surges while optimizing resource utilization over the long term. Finally, a closed-loop feedback mechanism forms a continuous optimization cycle, transmitting the filtering effect back to the decision-making process in real time, continuously correcting algorithm parameters and threshold strategies, preventing policy rigidity, and ensuring that the filtering effect always adapts to changes in operating conditions. This collaborative design of "perception-decision-execution-feedback" logically forms a systematic solution to the shortcomings of existing technologies, enabling the device to autonomously and intelligently adapt to the dynamic changes of industrial control networks, and achieve adaptive adjustment of thresholds without human intervention. This simultaneously achieves the technical effects of stabilizing controller operation, reducing false blocking / missed blocking rates, and reducing operation and maintenance costs.

[0061] See Figure 3 The diagram illustrates a flowchart of a dynamic threshold control method provided in an embodiment of this application. This dynamic threshold control method can be applied to adaptive line-rate filtering scenarios in industrial control networks, and includes the following steps S301-S306: S301: Initialize the adaptive line speed filtering parameters and set the target operating performance indicators and the initial range of the filtering threshold for the industrial controller; S302: Real-time acquisition of the current operating performance indicators of the industrial controller, as well as the network transmission status parameters in the industrial control network; S303: Determine the deviation status between the current operating performance index and the target operating performance index, and determine the dominant algorithm used to generate the filter threshold adjustment instruction based on the deviation status; S304: Using the dominant algorithm, combined with current operating performance indicators, network transmission status parameters and historical feedback data, a filter threshold adjustment instruction is calculated and generated; S305: Adjusts the message filtering threshold according to the filtering threshold adjustment command, and performs line-speed filtering on network messages in the industrial control network; S306: Collects the message transmission data after line speed filtering and the controller operating status data, forms feedback data and sends it back to the calculation process of the main algorithm, repeating the above operation of real-time acquisition and feedback data transmission to achieve dynamic closed-loop control.

[0062] In one implementation, the deviation state is determined by the absolute value of the difference between the current operating performance index and the target operating performance index, as well as the duration of the absolute value of the difference. The process of determining the dominant algorithm includes: when the deviation between the current operating performance index and the target operating performance index is within a preset steady-state range and lasts for a preset time, the PID algorithm is maintained as the dominant algorithm; when the current operating performance index exceeds a preset extreme range, the algorithm is forcibly switched to the PID algorithm; in other states, the reinforcement learning algorithm is dominant, and the PID algorithm serves as a backup.

[0063] In one implementation, during the calculation of the control output by the PID algorithm, upper and lower limits of the filtering threshold are set. When the control output exceeds the range of the upper and lower limits, the output is limited to the corresponding limit and the integral term is cleared. The reinforcement learning algorithm generates adjustment instructions by constructing a state space, an action space, and a reward function. The state space consists of the operating performance indicators and network transmission state parameters. The action space includes three action types: threshold increase, threshold maintenance, and threshold decrease. The reward function is constructed based on the controller operating deviation, message transmission delay, and packet loss rate.

[0064] In one implementation, after generating the filtering threshold adjustment command and before executing line-rate filtering, a canary verification operation is also included: selecting a portion of network traffic, performing filtering verification based on the threshold corresponding to the filtering threshold adjustment command, and judging the rationality of the threshold through preset verification indicators; if the verification passes, line-rate filtering is executed; if the verification fails, it rolls back to the previous valid threshold and marks the corresponding algorithm experience as negative feedback; the preset verification indicators include at least packet false blocking rate, average latency, and CPU jitter amplitude.

[0065] In one implementation, the adaptive line-rate filtering parameters include the proportional coefficient, integral coefficient, and derivative coefficient of the PID algorithm; the current operating performance indicators include at least the CPU utilization of the industrial controller; the network transmission status parameters include at least the bandwidth utilization, average packet byte length, proportion of high-priority messages, average packet delay, and packet loss rate; the feedback data includes at least the packet false blocking rate after filtering, the change in controller operating performance after threshold execution, and the change in network transmission status.

[0066] See Figure 4 The following is a flowchart of an example of a dynamic threshold control method provided in this application.

[0067] First, the device enters the startup phase and completes initialization, including setting the initial range of the filtering threshold, algorithm parameters (such as Kp, Ki, and Kd for PID, and the state space and action space of reinforcement learning), and the target operating performance indicators of the controller (such as the target CPU utilization).

[0068] Subsequently, sampling was performed at a frequency of 1Hz to collect the operating performance indicators (CPU utilization) of the industrial controller and the network transmission status parameters (bandwidth utilization BW, average message byte length L, and proportion of high-priority messages P) of the industrial control network. At the same time, data such as message delay and packet loss rate were collected to provide real-time and multi-dimensional operating condition data for subsequent decision-making.

[0069] After sampling is completed, the algorithm enters the dual-mode judgment stage, which is the core branch point for algorithm decision-making: If the deviation between the current performance metric (such as CPU utilization) and the target metric is within the preset steady-state range (such as |CPU utilization) If the target CPU usage is less than 5% and lasts for 5 seconds, the system enters PID steady-state mode. The PID algorithm is used to generate a filter threshold adjustment command based on historical and current deviations to ensure control accuracy in steady state. If the current operating performance indicators exceed the preset extreme range (such as CPU>90% or CPU<30%), then enter the PID extreme mode, and force the PID algorithm to quickly generate adjustment instructions to pull the system operating conditions back to the safe range. If neither of the above two situations applies, the system enters the RL-dominated mode, where the reinforcement learning algorithm generates more exploratory filtering threshold adjustment instructions based on the state space (CPU, BW, L, P), action space (threshold increase / maintain / decrease), and reward function (combining CPU bias, message latency, and packet loss rate).

[0070] Regardless of the mode entered, after generating the adjustment command, a canary test (lasting 60 seconds) can be performed, selecting 5% of network traffic as a test sample to verify the rationality of the new threshold. The verification is judged by preset indicators: if the false blocking rate is <1%, the average latency is <5ms, and the CPU jitter is <1ms, then a full pass is determined, triggering the threshold execution module to apply the filtering threshold to the entire network; if the above indicators are not met, a FAIL rollback is determined, triggering the threshold execution module to roll back to the previous valid threshold and sending a negative feedback flag to the algorithm decision module for optimizing subsequent algorithm decisions.

[0071] In addition, there is a logical connection of rollback monitoring in the whole process. That is, after the canary verification fails and rolls back, the status will be fed back to the sampling stage, so that the device can re-collect data based on the rolled-back operating conditions, enter the dual-mode judgment, continuously iterate and optimize the filtering strategy, and form a complete closed-loop control.

[0072] Embodiments of this application also provide a storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above method embodiments when running.

[0073] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0074] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0075] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0076] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated here.

[0077] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0078] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0079] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0080] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0081] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0082] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0083] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. An adaptive linear speed filtering device, applied in industrial control networks, characterized in that, It includes a signal access module, a data acquisition module, an algorithm decision-making module, a threshold execution module, and a feedback adjustment module; The signal access module is used to access network packets between switches and controllers in the industrial control network, and to realize line-speed forwarding and filtering preprocessing of packets. The data acquisition module is used to acquire the operating performance indicators of the industrial controller and the network transmission status parameters of the industrial control network in real time. The algorithm decision module has a built-in PID algorithm unit, reinforcement learning algorithm unit and dual-mode switching unit. The dual-mode switching unit determines the dominant algorithm, and the PID algorithm unit or reinforcement learning algorithm unit combines the collected data and feedback data to generate a filter threshold adjustment command. The threshold execution module adjusts the packet filtering threshold according to the adjustment instruction output by the algorithm decision module, and performs line-speed filtering on the network packets accessed by the signal access module. The feedback adjustment module collects the filtering execution results of the threshold execution module, forms feedback data, and sends it back to the algorithm decision module to provide data support for the optimization of adjustment instructions.

2. The apparatus according to claim 1, characterized in that, The reinforcement learning algorithm unit includes a state construction subunit, an action generation subunit, and a reward calculation subunit. The state construction subunit constructs a state space based on the data collected by the data acquisition module. The action generation subunit generates an action space that includes threshold increases, maintenance, and decreases. The reward calculation subunit calculates the reward value based on the controller's operating deviation, message latency, and packet loss rate. The dual-mode switching unit has built-in deviation judgment logic: when the deviation between the current operating performance index obtained by the data acquisition module and the target value is within a preset steady-state range and lasts for a preset time, the PID algorithm is maintained as the dominant algorithm; when the current operating performance index exceeds a preset extreme range, the PID algorithm is forcibly switched to; in other states, the reinforcement learning algorithm is dominant, and the PID algorithm serves as a fallback.

3. The apparatus according to claim 1, characterized in that, It also includes a canary verification module, which selects a portion of network traffic and verifies it based on the filtering threshold adjustment command output by the algorithm decision module. The reasonableness of the threshold is judged by preset verification indicators. If the verification passes, the threshold execution module is triggered to apply the threshold in full. If the verification fails, the threshold execution module is triggered to roll back to the previous valid threshold and send a negative feedback flag to the algorithm decision module. The threshold execution module has a built-in threshold limiting unit, which sets the upper and lower limits of the filtering threshold. When the threshold corresponding to the adjustment command output by the algorithm decision module exceeds the upper and lower limits, the threshold is limited to the corresponding limit value, and an integral zeroing signal is sent to the PID algorithm unit.

4. A dynamic threshold control method, applied to adaptive line-speed filtering scenarios in industrial control networks, characterized in that, include: Initialize the relevant parameters for adaptive line-speed filtering, and set the target operating performance indicators and the initial range of the filtering threshold for the industrial controller; Real-time acquisition of current operating performance indicators of industrial controllers, as well as network transmission status parameters in the industrial control network; Determine the deviation between the current operating performance index and the target operating performance index, and determine the dominant algorithm for generating the filter threshold adjustment instruction based on the deviation. Using the aforementioned dominant algorithm, combined with the current operating performance indicators, network transmission status parameters, and historical feedback data, a filtering threshold adjustment instruction is calculated and generated. Adjust the message filtering threshold according to the filtering threshold adjustment command to perform line-rate filtering on network messages in the industrial control network. The process of collecting the filtered message transmission data and controller operating status data, forming feedback data, and sending it back to the calculation process of the main algorithm is repeated to achieve dynamic closed-loop control.

5. The method according to claim 4, characterized in that, The deviation state is determined by the absolute value of the difference between the current operating performance index and the target operating performance index, as well as the duration of the absolute value of the difference. The process of determining the dominant algorithm includes: when the deviation between the current operating performance index and the target operating performance index is within a preset steady-state range and continues for a preset time, the PID algorithm is maintained as the dominant algorithm; When the current operating performance index exceeds the preset extreme range, the system will be forced to switch to the PID algorithm; in other states, the reinforcement learning algorithm will take the lead, with the PID algorithm serving as a backup.

6. The method according to claim 4, characterized in that, In the process of calculating the control output in the PID algorithm, upper and lower limits of the filtering threshold are set. When the control output exceeds the range of the upper and lower limits, the output is limited to the corresponding limit and the integral term is cleared. The reinforcement learning algorithm generates adjustment instructions by constructing a state space, an action space, and a reward function. The state space consists of the operating performance indicators and network transmission state parameters. The action space includes three action types: threshold increase, threshold maintenance, and threshold decrease. The reward function is constructed based on the controller's operating deviation, message transmission delay, and packet loss rate.

7. The method according to claim 4, characterized in that, After generating the filter threshold adjustment command and before executing line-rate filtering, a canary verification operation is also included: selecting a portion of network traffic and performing filter verification based on the threshold corresponding to the filter threshold adjustment command, and judging the rationality of the threshold through preset verification indicators. If the verification passes, line-rate filtering is executed; if the verification fails, the process rolls back to the previous valid threshold and marks the corresponding algorithm experience as negative feedback. The preset verification indicators include at least the packet error rate, average latency, and CPU jitter.

8. The method according to any one of claims 4-7, characterized in that, The adaptive line-rate filtering parameters include the proportional coefficient, integral coefficient, and derivative coefficient of the PID algorithm; the current operating performance indicators include at least the CPU utilization rate of the industrial controller; the network transmission status parameters include at least the bandwidth utilization rate, average packet byte length, proportion of high-priority messages, average packet delay, and packet loss rate; the feedback data includes at least the packet false blocking rate after filtering, the change in controller operating performance after threshold execution, and the change in network transmission status.

9. A storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program is configured to execute the method described in any one of claims 4 to 7 when it is run.

10. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method as described in any one of claims 4 to 7.

Images