Data network operation risk identification method

Abstract

The invention relates to the technical field of communication network and power system dispatching, in particular to a data network operation risk identification method, which comprises the following steps of: S1, identifying and classifying communication endpoint equipment to be analyzed, and determining a starting point and an ending point of routing analysis; s2, analyzing possible physical link channels between endpoints and the number of forwarding nodes based on a network topology link table; s3, inquiring a private network VPN routing table, a public network routing table and interface ledger information step by step by taking the master station equipment as a starting point and the plant station equipment as an end point, and splicing to form a forward full-link routing forwarding path; according to the invention, through links of endpoint equipment identification, physical link reasoning, routing path step-by-step splicing, bidirectional path comparison, risk identification analysis and the like, full-link visualization and dynamic monitoring from a service communication starting point to an end point are realized.

Description

Technical Field

[0001] This invention relates to the fields of communication networks and power system dispatching technology, and in particular to a method for identifying operational risks in data networks. Background Technology

[0002] With the rapid development of power system dispatching operations, the scale of dispatching data networks is constantly expanding, and the network structure is becoming increasingly complex, encompassing multi-level network equipment such as master station application services, substation business terminals, and cross-regional backbone, aggregation, and access networks. Existing dispatching data networks mainly employ routing technologies such as OSPF, BGP, MPLS, and VPN, using multi-table routing to achieve business data forwarding and communication support. However, existing technologies still primarily rely on physical node status, link connectivity detection, or basic performance analysis for network operation monitoring, lacking the ability to dynamically identify and systematically analyze the entire forwarding path of business data.

[0003] In actual operation, due to the complexity of network configuration strategies, the diversity of device layers, and dynamic changes in service load, traditional monitoring methods struggle to accurately detect potential problems such as suboptimal routes, inconsistent bidirectional paths, or potential routing black holes. This can not only lead to a decline in service communication performance but also increase the difficulty of network fault diagnosis and maintenance optimization. Furthermore, existing technologies largely rely on manual analysis or single-node log data, resulting in problems such as high workload, slow response, limited coverage, and insufficient visualization, failing to meet the requirements of modern scheduling data networks for high reliability, intelligence, and early warning capabilities.

[0004] Therefore, it is necessary to design a data network operation risk identification method that can solve the above-mentioned technical problems. Summary of the Invention

[0005] To address the aforementioned problems, the present invention aims to provide a method for identifying risks in data network operation, thereby enabling end-to-end visualization and dynamic monitoring of the entire business communication chain from its inception to its destination.

[0006] To achieve the above objectives, the present invention adopts the following technical solution, comprising the following steps: Step S1: Identify and classify the communication endpoint devices to be analyzed, and determine the start and end points of the route analysis; Step S2: Analyze the physical link channels and the number of forwarding nodes between endpoints based on the network topology link table; Step S3: Starting from the main station equipment and ending at the plant equipment, query the private network VPN routing table, public network routing table, and interface ledger information level by level, and assemble them to form a forward full-link routing and forwarding path. Step S4: Starting from the plant equipment and ending at the master station equipment, form a reverse full-link routing and forwarding path based on the path splicing logic in Step S3; Step S5: Compare the forward and reverse full-link routing paths with the physical optimal path to identify non-optimal paths and bidirectional routing inconsistencies, in order to determine potential routing anomalies and operational risks in the data network.

[0007] Furthermore, in step S1, the communication endpoint device to be analyzed is identified, and the specific process is as follows: The communication objects to be analyzed are classified, and by comparing them with the network device ledger, it is initially identified whether they are network devices. For non-network device nodes, the attribution is determined by matching the equipment management platform ledger information to determine whether it belongs to the main station node or the plant station node. For devices that cannot be matched in the ledger, attribution is determined through an inference model. The inference model is constructed based on communication adjacency relationships and / or routing topology features, and the specific formula is as follows: like If it is determined to be a master station node, it is determined to be a plant station node. Based on the endpoint device type and affiliation, determine the start and end points of the route analysis, and record the endpoint information as the basis for subsequent analysis. The specific formula is as follows: Furthermore, in step S2, the analysis of the physical link channels and the number of forwarding nodes between endpoints based on the network topology link table specifically includes the following steps: Step S21: Based on the routing origin device determined in step S1 and endpoint equipment For the analysis object, information on all interconnection links between devices is obtained through the network topology link table; the content of the topology link table includes: link start port, link end port, link type, link status, and link bandwidth; Step S22: Generate a set of physical paths between endpoints based on the link table. The specific formula is as follows: in, Indicates the network device nodes in the middle of the path; Step S23: Filter the path set to remove links with abnormal link status and / or insufficient bandwidth, in order to form a candidate path set. Simultaneously calculate the candidate path set Each path in Number of mounting nodes The specific formula is as follows: in: This represents the total number of nodes in the path, minus the start and end points; Step S24: Assign a comprehensive weight to each path The specific formula is as follows: in: A path cost model can be formed based on link bandwidth, link status, node load, and hop count settings.

[0008] Furthermore, in step S3, the specific steps are as follows: Step S31: Using the master station equipment determined in step S1 Starting with the plant and station business terminal equipment To determine the destination, add the originating device to the path set: ; Step S32: Query the current analysis device Private VPN instance routing table Public network routing table and interface table To obtain the next-hop forwarding information and the outgoing port IP address, the specific formula is as follows: Step S33: If there are multiple matching paths in the routing table, the optimal next-hop device can be selected according to the routing priority; Step S34: Calculate the port IP of the other device based on the private subnet rules. The specific formula is as follows: in, This indicates a bitwise XOR operation, used to deduce the IP address of the other side from the local IP address within a subnet. Step S35: Combine with the entire network interface ledger and equipment ledger The next-hop device is located based on the IP address of the other port. The specific formula is as follows: ,Will Add it to the path collection Path, using the following formula: ; Step S36: Determine whether the current route is a directly connected route. The specific formula is as follows: If it is not a directly connected route, then As a new analytical device Repeat the above steps until the target device is reached. This forms a complete forwarding path from the main station to the plant, as shown in the following formula: ; Step S37: Calculate the path cost of each link in the path. The specific formula is as follows: in, For the first One device, For the number of devices, To measure equipment and Indicators of distance between This is the overall indicator after accumulation.

[0009] Furthermore, step S4 specifically includes the following steps: Step S41: Using the plant / station business terminal equipment determined in step S1 Starting from the main station equipment Initialize the set of reverse paths for the target destination: ; Step S42: Query the private network VPN instance routing table of the current analysis device. Public network routing table Using the main station device address or its network segment as the target address, obtain the egress port information and then use the interface table. Find the corresponding outgoing port IP address. ; Step S43: If multiple matching routes exist, select the optimal next-hop device based on route priority, using the following formula: in, For the next hop device, Current analytical equipment, Indicates from device To candidate next-hop device The routing cost value; Step S44: Calculate the port IP of the other device based on the private subnet rules. The specific formula is as follows: in, This is the current device's egress port IP address. The bitwise XOR operation is used to flip the IP address of a subnet to the address of the other end. Step S45: Combine with the interface ledger Equipment ledger Based on the calculated peer port IP, the next-hop device is uniquely determined: Add the device to the reverse path set: ; Step S46: Determine if the current route is a directly connected route. The specific formula is as follows: If it is a directly connected route, the analysis ends; if it is not a directly connected route, then... As the new current device, repeat the above operations until the target device is reached. This forms a complete reverse full-link routing and forwarding path from the plant to the main station.

[0010] Furthermore, in step S4, the consistency of bidirectional paths is quantitatively described, and a path symmetry coefficient can be defined. : in, Indicates the number of path nodes. The closer the value is to 1, the higher the overlap of the bidirectional paths; the closer it is to 0, the greater the difference between the paths. The system determines that there is a risk of bidirectional routing inconsistency and generates an early warning event in the platform.

[0011] Furthermore, step S5 specifically includes the following steps: Step S51: Obtain the physical link reference path set from step S2 Obtain the actual forward routing path from steps S3 and S4. Reverse routing path Establish path set ; Step S52: Define the path The comprehensive cost function is formulated as follows: in, This represents the number of links in the path. For the first The routing cost of a segment link. For link latency, For link bandwidth, For empirical weighting coefficients, satisfying ; Step S53: For the physical link reference path set Calculations are performed to determine the physically optimal path; the specific formula is as follows: in, The physical optimal path; Step S54: Compare the physical optimal path with the actual route cost, using the following formula: ,like If the system determines that the service has a risk of non-optimal routing, it will generate a path optimization suggestion event.

[0012] Furthermore, in step S5, to detect potential routing black holes, path continuity can be assessed: Let the path node sequence be And define a connectivity index, with the following formula: in, Indicates the first Network nodes, Represents a node and The status of the links between them The total number of nodes in the network path This represents taking the product of the states of all adjacent node pairs. It represents the overall connectivity state of the entire path; in, ,like This indicates that there is a broken segment in the path, which is identified as a risk of a routing black hole.

[0013] The present invention has the following beneficial effects: 1. This invention achieves end-to-end visualization and dynamic monitoring of business communication from its inception to its endpoint through endpoint device identification, physical link reasoning, hierarchical routing path concatenation, bidirectional path comparison, and risk identification and analysis. This method can automatically identify non-optimal paths, bidirectional routing inconsistencies, and potential black holes within the data network without affecting network operation, enabling early warning and precise location of network vulnerabilities. Compared to traditional methods relying on manual or single-point monitoring, this invention offers advantages such as high automation, high identification accuracy, and transparent analysis, effectively supporting the optimization of communication network operation, configuration checks, and anomaly handling, significantly improving the security, reliability, and intelligent operation and maintenance level of the data network. Attached Figure Description

[0014] Figure 1 This is a schematic diagram of the present invention. Detailed Implementation

[0015] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments: like Figure 1 As shown, the solution includes the following steps: Step S1: Identify and classify the communication endpoint devices to be analyzed, and determine the start and end points of the route analysis; Step S2: Analyze the physical link channels and the number of forwarding nodes between endpoints based on the network topology link table; Step S3: Starting from the main station equipment and ending at the plant equipment, query the private network VPN routing table, public network routing table, and interface ledger information level by level, and assemble them to form a forward full-link routing and forwarding path. Step S4: Starting from the plant equipment and ending at the master station equipment, form a reverse full-link routing and forwarding path based on the path splicing logic in Step S3; Step S5: Compare the forward and reverse full-link routing paths with the physical optimal path to identify non-optimal paths and bidirectional routing inconsistencies, in order to determine potential routing anomalies and operational risks in the data network.

[0016] Furthermore, in step S1, the communication endpoint device to be analyzed is identified, and the specific process is as follows: The communication objects to be analyzed are classified, and by comparing them with the network device ledger, it is initially identified whether they are network devices. For non-network device nodes, the attribution is determined by matching the equipment management platform ledger information to determine whether it belongs to the main station node or the plant station node. For devices that cannot be matched in the ledger, attribution is determined through an inference model. The inference model is constructed based on communication adjacency relationships and / or routing topology features, and the specific formula is as follows: like If it is determined to be a master station node, it is determined to be a plant station node. Based on the endpoint device type and affiliation, determine the start and end points of the route analysis, and record the endpoint information as the basis for subsequent analysis. The specific formula is as follows: The endpoint device information analysis step aims to identify the starting and ending devices of the communication being analyzed, providing basic input data for subsequent routing path analysis. Its core objective is to identify the communication objects and determine their network affiliation to ensure the accuracy and uniqueness of the path analysis.

[0017] In the specific implementation process, the system first receives the input communication object address information, which is recorded as follows: The system then performs a ledger matching and comparison between the two addresses. The system accesses the network device ledger database. This records information such as the network device ID, interface address, VPN instance, layer (backbone, aggregation, access), and device type for all network devices across the entire network. If the communication target's IP address is in... If a unique match exists, the object is directly identified as a network device node, denoted as: , For communication objects that cannot be matched in the network device ledger, the system further accesses the device management platform's ledger database. This database contains business terminal information such as the main station server, the dispatching backend system, and secondary equipment of the plant. Through... By matching the MAC address, logical access port, or business system identifier of the terminal device, the system can determine its category. If the communication object fails to match in both types of ledgers, the system will mark it as an "unknown node" and trigger a ledger missing prompt for subsequent manual verification. In this embodiment, the main purpose of the endpoint device information analysis step is to determine the identities of the master station and plant station devices participating in the communication analysis, and to clarify the starting and ending points of the route analysis, thereby providing accurate input for subsequent path derivation and risk identification. During implementation, the system first obtains the address information of the communication object to be analyzed, including the master station server address and the plant station business terminal address. Subsequently, the system calls the network device ledger database to match and compare the input addresses. The network device ledger records the unique identifier, interface IP address, device type, hierarchical position (backbone layer, aggregation layer, or access layer), and VPN instance of all network devices. If the IP address of the communication object has a unique match in the ledger, the system determines that the communication object is a network device node and directly includes it in the route analysis scope.

[0018] For objects that cannot be matched in the network device ledger, the system further accesses the device management platform ledger to perform a secondary match using the physical address, logical port number, or service identifier of the business terminal, thereby identifying the service attributes of the node. If the matching result shows that the node belongs to the master station side system (such as the scheduling master station server, data concentrator, etc.), it is identified as a master station device; if the matching result shows that it belongs to the plant terminal (such as protection and control devices, RTUs, monitoring terminals, etc.), it is identified as a plant terminal device. When the communication object cannot be matched in either type of ledger, the system temporarily classifies it as an unknown node and generates an identification anomaly record for subsequent manual confirmation and ledger updates. After endpoint identification is completed, the system automatically determines the route analysis direction. When the master station node is the source and the plant node is the destination, the analysis direction is defined as master station to plant; if the identification order is reversed, it is automatically adjusted to plant to master station. To improve the accuracy of the identification results, the system comprehensively considers multi-dimensional features such as IP matching degree, MAC matching status, VPN affiliation consistency, and business system correlation during the comparison process, and calculates the endpoint identification confidence level to quantify the reliability of the identification results. If the confidence level is higher than the preset threshold, the system automatically confirms the recognition result as valid; if it is lower than the threshold, it enters the manual review process to prevent misjudgment.

[0019] Furthermore, in step S2, the analysis of the physical link channels and the number of forwarding nodes between endpoints based on the network topology link table specifically includes the following steps: Step S21: Based on the routing origin device determined in step S1 and endpoint equipment For analysis purposes, information on all interconnection links between devices is obtained through the network topology link table. The topology link table includes: link start port, link end port, link type (fiber optic, Ethernet, etc.), link status (normal, abnormal, unknown), and link bandwidth. Step S22: Generate a set of physical paths between endpoints based on the link table. The specific formula is as follows: in, Indicates the network device nodes in the middle of the path; Step S23: Filter the path set to remove links with abnormal link status and / or insufficient bandwidth, in order to form a candidate path set. Simultaneously calculate the candidate path set Each path in Number of mounting nodes The specific formula is as follows: in: This represents the total number of nodes in the path, minus the start and end points; Step S24: Assign a comprehensive weight to each path The specific formula is as follows: in: A path cost model can be formed based on link bandwidth, link status, node load, and hop count settings.

[0020] In this embodiment, the physical link and possible path analysis step aims to determine all possible physical link channels and their forwarding nodes between the master station and the plant endpoint based on network topology information, providing a physical layer reference for subsequent routing path analysis. Specifically, the system first uses the starting and ending devices identified in step S1 as the analysis start and end points, and calls the network topology link table, device interconnection table, and interface resource ledger to automatically retrieve all possible interconnection relationships between the two devices. The system generates a candidate link set between the starting and ending points using the device interconnection information stored in the topology link table, including link identifier, starting and ending ports, bandwidth, interface type, and layer (backbone, aggregation, access). Subsequently, the system performs a deep traversal analysis of the candidate links. First, using the starting device as the source node, it recursively searches for reachable adjacent devices based on the interface pairs recorded in the link table; each time a valid adjacent device node is found, the path branch is expanded in the link graph until the target endpoint device is found or no reachable node is found. Through this traversal process, the system can construct all possible end-to-end physical connectivity paths and form a path set. For each path, the system automatically calculates the number of forwarding nodes, the number of layers crossed, and the number of physical hops, serving as a reference for subsequent determination of path rationality and optimality. Simultaneously, the system monitors the operational status of links during path analysis, using interface status tables and link operation monitoring data to determine whether each link is active, standby, or interrupted, and accordingly marks the path's validity. For example, when a link is interrupted, the corresponding path is automatically marked as "unavailable," thus being excluded from subsequent route splicing and risk analysis.

[0021] Furthermore, in step S3, the specific steps are as follows: Step S31: Using the master station equipment determined in step S1 Starting with the plant and station business terminal equipment To determine the destination, add the originating device to the path set: ; Step S32: Query the current analysis device Private VPN instance routing table Public network routing table and interface table To obtain the next-hop forwarding information and the outgoing port IP address, the specific formula is as follows: Step S33: If there are multiple matching paths in the routing table, the optimal next-hop device can be selected according to the routing priority; Step S34: Calculate the port IP of the other device based on the private subnet rules. The specific formula is as follows: in, This indicates a bitwise XOR operation, used to deduce the IP address of the other side from the local IP address within a subnet. Step S35: Combine with the entire network interface ledger and equipment ledger The next-hop device is located based on the IP address of the other port. The specific formula is as follows: ,Will Add it to the path collection Path, using the following formula: ; Step S36: Determine whether the current route is a directly connected route. The specific formula is as follows: If it is not a directly connected route, then As a new analytical device Repeat the above steps until the target device is reached. This forms a complete forwarding path from the main station to the plant, as shown in the following formula: ; Step S37: Calculate the path cost of each link in the path. The specific formula is as follows: in, For the first One device, For the number of devices, To measure equipment and Indicators of distance between This is the overall indicator after accumulation.

[0022] In this embodiment, the step-by-step query and concatenation of routing and forwarding paths aims to obtain the complete service routing and forwarding path between the master station and the plant station, realizing a full reconstruction of the actual forwarding link of the data flow in the network, and providing path-level basis for subsequent risk identification. During implementation, the system takes the master station device determined in step S1 as the starting point and the plant station device as the target endpoint, and recursively queries the multi-level routing tables of the network devices to gradually determine the forwarding device and egress port information for each hop.

[0023] The specific process includes the following steps: First, the system uses the main station device as the source node and the plant device as the target node. It reads the private VPN instance routing table and public routing table of the source node, retrieving the forwarding record corresponding to the target address. The routing table typically contains information such as the destination network segment, next-hop address, egress interface, and routing type. By parsing the query results, the system identifies the egress interface of the service data on the current device and its corresponding next-hop address. Subsequently, the system accesses the device interface table and obtains the egress port IP address and interface status information based on the egress interface identifier.

[0024] According to the routing design specifications of the scheduling data network, the interconnection between network devices adopts a 30-bit subnet structure, with each subnet containing only two available IP addresses. Therefore, the system can automatically deduce the interface IP address of the peer device based on the obtained local exit IP address. The system then matches the interface ledger with the device ledger, determines the corresponding device identifier and device type based on the peer interface IP, and thus obtains the complete information of the next-hop forwarding node.

[0025] After completing a query, the system determines whether the route is a directly connected route (i.e., the route type is Direct or Connected). If it is a directly connected route, it means that the current device is directly connected to the target address, and the path query ends. If it is not directly connected, the obtained next-hop device is used as a new analysis object, and the above query steps are repeated to continue recursively until the target device is reached or no reachable path exists. Through this step-by-step query and node concatenation method, the system can ultimately construct a complete routing and forwarding path link from the master station to the plant.

[0026] To ensure the accuracy of path splicing, the system performs bidirectional verification of the interface association between devices during each query process, checking whether the peer information recorded in the interface ledger is consistent with the next hop result in the routing table. If there is a discrepancy, the path result is marked as "interface inconsistent" for subsequent risk analysis module identification.

[0027] Furthermore, step S4 specifically includes the following steps: Step S41: Using the plant / station business terminal equipment determined in step S1 Starting from the main station equipment Initialize the set of reverse paths for the target destination: ; Step S42: Query the private network VPN instance routing table of the current analysis device. Public network routing table Using the main station device address or its network segment as the target address, obtain the egress port information and then use the interface table. Find the corresponding outgoing port IP address. ; Step S43: If multiple matching routes exist, select the optimal next-hop device based on route priority, using the following formula: in, For the next hop device, Current analytical equipment, Indicates from device To candidate next-hop device The routing cost value; Step S44: Calculate the port IP of the other device based on the private subnet rules. The specific formula is as follows: in, This is the current device's egress port IP address. The bitwise XOR operation is used to flip the IP address of a subnet to the address of the other end. Step S45: Combine with the interface ledger Equipment ledger Based on the calculated peer port IP, the next-hop device is uniquely determined: Add the device to the reverse path set: ; Step S46: Determine if the current route is a directly connected route. The specific formula is as follows: If it is a directly connected route, the analysis ends; if it is not a directly connected route, then... As the new current device, repeat the above operations until the target device is reached. This forms a complete reverse full-link routing and forwarding path from the plant to the main station.

[0028] Furthermore, in step S4, the consistency of bidirectional paths is quantitatively described, and a path symmetry coefficient can be defined. : in, Indicates the number of path nodes. The closer the value is to 1, the higher the overlap of the bidirectional paths; the closer it is to 0, the greater the difference between the paths. The system determines that there is a risk of bidirectional routing inconsistency and generates an early warning event in the platform.

[0029] In this embodiment, the reverse path analysis step aims to obtain the complete service routing and forwarding path from the plant to the main station (B→A), enabling comparative analysis of bidirectional paths and thus verifying the consistency and stability of network data flow in both directions. This step corresponds to the forward path analysis method in S3, but the analysis direction is opposite. The goal is to start from the service terminal at the plant end and reconstruct the actual forwarding process to reach the application server at the main station step by step.

[0030] During implementation, the system first takes the plant-side equipment determined in step S1 as the starting point and the main station-side equipment as the destination. It reads the private VPN instance routing table and public network routing table of the plant-side equipment to retrieve the forwarding record corresponding to the target address, analyzing the data's exit interface and next-hop device information in the plant-side network. Subsequently, the system accesses the interface table, extracts the port IP address of the exit interface, and automatically calculates the interface IP address of the other device based on the interconnection subnet structure (usually a 30-bit mask). The system then performs cross-matching with the interface ledger and equipment ledger to confirm the identifier and type of the next-hop device.

[0031] Similar to forward path analysis, the system determines whether each hop query result is a directly connected route. If the current route type is Direct or Connected, it means that the device is directly connected to the target device at the main station, and the reverse path analysis ends. If it is not directly connected, the next hop device is treated as a new analysis object, and the query and matching process is repeated to continue to deduce forward step by step until the path reaches the main station device or there is no valid route.

[0032] During path assembly, the system analyzes the network hierarchy step by step (access layer, aggregation layer, backbone layer), verifying the consistency of device associations through interface identifiers and VPN instance information to ensure the logical integrity and accuracy of the path assembly. If missing interface information or mismatched routing records are found during path derivation, the system will mark the node as "path abnormal" for targeted analysis by the subsequent anomaly identification module.

[0033] Furthermore, step S5 specifically includes the following steps: Step S51: Obtain the physical link reference path set from step S2 Obtain the actual forward routing path from steps S3 and S4. Reverse routing path Establish path set ; Step S52: Define the path The comprehensive cost function is formulated as follows: in, This represents the number of links in the path. For the first The routing cost of a segment link. For link latency, For link bandwidth, For empirical weighting coefficients, satisfying ; Step S53: For the physical link reference path set Calculations are performed to determine the physically optimal path; the specific formula is as follows: in, The physical optimal path; Step S54: Compare the physical optimal path with the actual route cost, using the following formula: ,like If the system determines that the service has a risk of non-optimal routing, it will generate a path optimization suggestion event.

[0034] Furthermore, in step S5, to detect potential routing black holes, path continuity can be assessed: Let the path node sequence be And define a connectivity index, with the following formula: in, Indicates the first Network nodes, Represents a node and The status of the links between them The total number of nodes in the network path This represents taking the product of the states of all adjacent node pairs. It represents the overall connectivity state of the entire path; in, ,like This indicates that there is a broken segment in the path, which is identified as a risk of a routing black hole.

[0035] Risk classification and alarm output Based on the analysis results, the risks are divided into three categories:

[0036] The system triggers corresponding events based on risk types, displays early warnings through the network monitoring platform, and links with the alarm module to achieve visual push notifications. Output and Application Generate a routing risk analysis report containing the following: End-to-end path topology; Path cost comparison results; Bidirectional consistency index ; Risk classification and severity level.

[0037] The report results may be as follows: Provides quantitative basis for network configuration optimization; Provides path-level evidence for troubleshooting communication vulnerabilities; Analysis of abnormal evolution trends is supported by historical data.

[0038] In this embodiment, the main purpose of the routing risk identification and anomaly analysis step is to comprehensively compare and evaluate the acquired forward (master station to plant) and reverse (plant to master station) routing paths, identify possible operational risks such as non-optimal routes, inconsistent paths, or routing black holes, and thus provide a basis for decision-making for network operation optimization and hidden danger handling.

[0039] In the specific implementation process, the system first acquires various types of path data generated in steps S2 to S4, including physical link topology paths, forward routing paths, and reverse routing paths. The system then performs correlation analysis on these paths under a unified data model to determine the difference between the "theoretically optimal physical path" and the "actual forwarding path" for each service communication in the network.

[0040] First, the system calculates the theoretical shortest physical path between the master station and the plant based on the topology link table. This is the optimal path selected based on comprehensive indicators such as the number of links, hierarchical span, bandwidth, and latency. This path serves as an ideal physical reference to assess whether there are deviations in the routing forwarding path. The system then compares this path with the actual routing forwarding path. If the actual path traverses more device layers, has a larger hop count, or has significantly higher cross-network segment complexity than the theoretical path, it is determined to be a "non-optimal path," indicating that the service data forwarding path may have an unreasonable configuration or abnormal routing policy. The system can record this deviation in the analysis report and generate a "path optimization suggestion" event for subsequent adjustments by operations and maintenance personnel.

[0041] Secondly, the system compares the node sequences and interface correspondences of the forward path (A→B) and the reverse path (B→A) to determine whether the bidirectional routes are consistent. If there are significant differences between the two paths at key forwarding nodes or interfaces, i.e., the A→B and B→A paths are not completely symmetrical, the system determines that there is a risk of "bidirectional routing inconsistency." This risk may cause data packets to fail to reach the source device correctly in the return path, resulting in routing black holes or performance degradation. After detecting inconsistencies, the system will identify the path differences and output a detailed node comparison list to assist in fault location.

[0042] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0043] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0044] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0045] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0046] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention in any other way. Any person skilled in the art may make changes or modifications to the disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A method for identifying operational risks in a data network, characterized in that, Includes the following steps: Step S1: Identify and classify the communication endpoint devices to be analyzed, and determine the start and end points of the route analysis; Step S2: Analyze the physical link channels and the number of forwarding nodes between endpoints based on the network topology link table; Step S3: Starting from the main station equipment and ending at the plant equipment, query the private network VPN routing table, public network routing table and interface ledger information level by level, and splice them to form a forward full-link routing and forwarding path; Step S4: Starting from the plant equipment and ending at the master station equipment, form a reverse full-link routing and forwarding path based on the path splicing logic in Step S3; Step S5: Compare the forward and reverse full-link routing paths with the physical optimal path to identify non-optimal paths and bidirectional routing inconsistencies, in order to determine potential routing anomalies and operational risks in the data network.

2. The data network operation risk identification method according to claim 1, characterized in that, In step S1, the communication endpoint device to be analyzed is identified, and the specific process is as follows: The communication objects to be analyzed are classified, and by comparing them with the network device ledger, it is initially identified whether they are network devices. For non-network device nodes, the attribution is determined by matching the equipment management platform ledger information to determine whether it belongs to the main station node or the plant station node. For devices that cannot be matched in the ledger, attribution is determined through an inference model. The inference model is constructed based on communication adjacency relationships and / or routing topology features, and the specific formula is as follows: ； like If it is determined to be a master station node, it is determined to be a plant station node. Based on the endpoint device type and affiliation, determine the start and end points of the route analysis, and record the endpoint information as the basis for subsequent analysis. The specific formula is as follows: 。 3. The data network operation risk identification method according to claim 2, characterized in that, In step S2, the analysis of the physical link channels and the number of forwarding nodes between endpoints based on the network topology link table specifically includes the following steps: Step S21: Based on the routing origin device determined in step S1 and endpoint equipment For the analysis object, information on all interconnection links between devices is obtained through the network topology link table; the content of the topology link table includes: link start port, link end port, link type, link status, and link bandwidth; Step S22: Generate a set of physical paths between endpoints based on the link table. The specific formula is as follows: ； in, Indicates the network device nodes in the middle of the path; Step S23: Filter the path set to remove links with abnormal link status and / or insufficient bandwidth, in order to form a candidate path set. Simultaneously calculate the candidate path set Each path in Number of mounting nodes The specific formula is as follows: ； in: This represents the total number of nodes in the path, minus the start and end points; Step S24: Assign a comprehensive weight to each path The specific formula is as follows: ； in: A path cost model can be formed based on link bandwidth, link status, node load, and hop count settings.

4. The data network operation risk identification method according to claim 3, characterized in that, The specific steps in step S3 are as follows: Step S31: Using the master station equipment determined in step S1 Starting with the plant and station business terminal equipment To determine the destination, add the originating device to the path set: ; Step S32: Query the current analysis device Private VPN instance routing table Public network routing table and interface table To obtain the next-hop forwarding information and the outgoing port IP address, the specific formula is as follows: ； Step S33: If there are multiple matching paths in the routing table, the optimal next-hop device can be selected according to the routing priority; Step S34: Calculate the port IP of the other device based on the private subnet rules. The specific formula is as follows: ； in, This indicates a bitwise XOR operation, used to deduce the IP address of the other side from the local IP address within a subnet. Step S35: Combine with the entire network interface ledger and equipment ledger The next-hop device is located based on the IP address of the other port. The specific formula is as follows: ,Will Add it to the path collection Path, using the following formula: ; Step S36: Determine whether the current route is a directly connected route. The specific formula is as follows: ； If it is not a directly connected route, then As a new analytical device Repeat the above steps until the target device is reached. This forms a complete forwarding path from the main station to the plant, as shown in the following formula: ; Step S37: Calculate the path cost of each link in the path. The specific formula is as follows: ； in, For the first One device For the number of devices, To measure equipment and Indicators of distance between This is the overall indicator after accumulation.

5. The data network operation risk identification method according to claim 4, characterized in that, The specific steps of step S4 are as follows: Step S41: Using the plant / station business terminal equipment determined in step S1 Starting from the main station equipment Initialize the set of reverse paths for the target destination: ; Step S42: Query the private network VPN instance routing table of the current analysis device. Public network routing table Using the main station device address or its network segment as the target address, obtain the egress port information and then use the interface table. Find the corresponding outgoing port IP address. ; Step S43: If multiple matching routes exist, select the optimal next-hop device based on route priority, using the following formula: ； in, For the next hop device, Current analytical equipment, Indicates from device To candidate next-hop device The routing cost value; Step S44: Calculate the port IP of the other device based on the private subnet rules. The specific formula is as follows: ； in, This is the current device's egress port IP address. The bitwise XOR operation is used to flip the IP address of a subnet to the address of the other end. Step S45: Combine with the interface ledger Equipment ledger Based on the calculated peer port IP, the next-hop device is uniquely determined: Add the device to the reverse path set: ; Step S46: Determine if the current route is a directly connected route. The specific formula is as follows: ； If it is a directly connected route, the analysis ends; if it is not a directly connected route, then... As the new current device, repeat the above operations until the target device is reached. This forms a complete reverse full-link routing and forwarding path from the plant to the main station.

6. The data network operation risk identification method according to claim 5, characterized in that, In step S4, the consistency of bidirectional paths is quantitatively described, and the path symmetry coefficient can be defined. : ； in, Indicates the number of path nodes. The closer the value is to 1, the higher the overlap of the bidirectional paths; the closer it is to 0, the greater the difference between the paths. The system determines that there is a risk of bidirectional routing inconsistency and generates an early warning event in the platform.

7. The data network operation risk identification method according to claim 6, characterized in that, Step S5 specifically includes the following steps: Step S51: Obtain the physical link reference path set from step S2 Obtain the actual forward routing path from steps S3 and S4. Reverse routing path Establish path set ; Step S52: Define the path The comprehensive cost function is formulated as follows: ； in, This represents the number of links in the path. For the first The routing cost of a segment link. For link latency, For link bandwidth, For empirical weighting coefficients, satisfying ; Step S53: For the physical link reference path set Calculations are performed to determine the physically optimal path; the specific formula is as follows: ； in, The physically optimal path; Step S54: Compare the physical optimal path with the actual route cost, using the following formula: ,like If the system determines that the service has a risk of non-optimal routing, it will generate a path optimization suggestion event.

8. The data network operation risk identification method according to claim 7, characterized in that, In step S5, to detect potential routing black holes, path continuity can be determined: Let the path node sequence be And define a connectivity index, with the following formula: ； in, Indicates the first Network nodes, Represents a node and The status of the links between them The total number of nodes in the network path This represents taking the product of the states of all adjacent node pairs. It represents the overall connectivity state of the entire path; in, ,like This indicates that there is a broken segment in the path, which is identified as a risk of a routing black hole.

Images