Industrial network device congestion early warning method and system based on traffic feature recognition
By grouping, quantizing, and normalizing the traffic interaction data of industrial network devices, and combining K-means clustering and random forest algorithms, accurate congestion warning signals are generated. This solves the problems of accuracy and timeliness of congestion warnings for industrial network devices in existing technologies, and ensures the stable operation of industrial networks.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING ZIGUANG INTELLIGENCE INFORMATION TECHNOLOGY CO LTD
- Filing Date
- 2026-03-24
- Publication Date
- 2026-06-30
Smart Images
Figure CN122316985A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the technical field of congestion warning for industrial network equipment, and in particular to a method and system for congestion warning for industrial network equipment based on traffic feature recognition. Background Technology
[0002] In multi-segment interconnection scenarios such as smart manufacturing, automated production lines, and the Industrial Internet of Things (IIoT), industrial network devices need to carry a large number of cross-segment interactions of industrial control commands, sensor data, and video surveillance streams. With the acceleration of Industry 4.0, the number of workshop-level terminal accesses has surged, and high-bandwidth services such as industrial vision have been deployed. This has led to congestion in industrial network devices due to sudden periodic surges in commands and load imbalances in industrial control protocols. Since industrial sites have extremely high requirements for the real-time and deterministic nature of data transmission, even microsecond-level congestion delays can cause controller communication timeouts, production line shutdowns, or even serious production safety accidents. Therefore, there is an urgent need for an industrial network device congestion early warning method based on traffic feature recognition to detect congestion risks in advance, provide a basis for timely intervention by industrial operation and maintenance personnel, and ensure the stable operation of the production network.
[0003] Currently, for congestion warnings of industrial network equipment, existing technologies mostly collect basic traffic data such as port packet volume and transmission rate of industrial network equipment, and statistically analyze the changes in basic traffic data at fixed time periods. Some technologies further standardize the collected traffic data to filter out key traffic indicators, and then determine whether the equipment is in a potential congestion state based on a single threshold. Other technologies use a simple classification method to divide traffic indicators and combine them with historical congestion data to make a preliminary assessment of the traffic status in order to generate early warning information.
[0004] However, existing technologies have some drawbacks. The most significant drawback is that relying on a single or limited number of traffic indicators for congestion assessment makes it difficult to accurately capture early signs of congestion. Furthermore, existing technologies are prone to false alarms or missed alarms, thus failing to meet the accuracy and timeliness requirements of congestion warnings for industrial network equipment. Summary of the Invention
[0005] The purpose of this application is to provide an industrial network device congestion early warning and system based on traffic feature recognition, so as to solve the problem of low accuracy and inefficiency in the existing industrial network device congestion early warning technology.
[0006] To address the aforementioned technical problems, in a first aspect, this application provides a method for congestion early warning of industrial network equipment based on traffic feature identification, comprising:
[0007] Acquire traffic interaction data, and group and quantize the traffic interaction data according to a preset time interval to obtain the quantized dataset corresponding to each time window.
[0008] The quantized dataset is preprocessed by normalization, and the traffic characteristic parameters in the preprocessed dataset are extracted.
[0009] The K-means clustering algorithm is used to classify the traffic feature parameters to obtain a traffic feature set, and the importance value of each traffic feature parameter in the traffic feature set is determined.
[0010] Based on the importance values of each traffic feature parameter in the traffic feature set, the random forest algorithm is used to judge the current traffic operation status of industrial network devices and generate a congestion warning signal corresponding to the judgment result.
[0011] Optionally, the step of using a random forest algorithm to determine the current traffic operation status of industrial network devices based on the importance values of each traffic feature parameter in the traffic feature set, and generating a congestion warning signal corresponding to the determination result, includes:
[0012] The importance values of each flow feature parameter in the flow feature set are evaluated to obtain the initial evaluation result for each flow feature parameter.
[0013] The initial evaluation results are summarized according to a preset category order to obtain the target evaluation results;
[0014] By combining preset state rules, the target evaluation results are processed using a random forest algorithm to obtain a judgment result on the current traffic operation status of industrial network devices. Then, by combining preset warning signal generation rules and the judgment result, a congestion warning signal is generated.
[0015] Optionally, the step of combining preset state rules and performing multi-parameter processing on the target evaluation results using a random forest algorithm to obtain the judgment result of the current traffic operation status of the industrial network device includes:
[0016] Based on the importance values of each flow characteristic parameter, a corresponding weight is assigned to each initial evaluation result in the target evaluation result to construct a weighted evaluation model;
[0017] The weighted evaluation model is invoked using the random forest algorithm to perform a weighted calculation on all the initial evaluation results to obtain an initial comprehensive score.
[0018] The initial comprehensive score is matched with the state threshold range defined in the preset state rules to determine the corresponding congestion state;
[0019] Traffic feature parameters with a correlation degree greater than a preset correlation degree threshold to the congestion state are extracted from the traffic feature set and used as key feature parameters.
[0020] All key feature parameters are subjected to correlation verification. If the correlation verification fails, the threshold compensation mechanism of the random forest algorithm is triggered to adjust the boundary value of the congestion state threshold interval according to the actual deviation of the key feature parameters in order to obtain the updated preset state rules.
[0021] Based on the updated preset state rules, the matching, extraction, and correlation verification operations are repeatedly executed until the correlation verification passes, and the congestion state corresponding to the last generation is used as the judgment result of the current traffic operation status of the industrial network device.
[0022] Optionally, the step of combining the preset warning signal generation rules and the judgment result to perform signal generation processing to obtain a congestion warning signal includes:
[0023] Based on the preset warning signal generation rules, the corresponding warning signal type is matched according to the judgment result, and based on the warning signal type, a description containing abnormal traffic characteristic parameters, impact range and preliminary suggestions is generated;
[0024] The signal strength is calculated based on the degree of anomaly of each flow characteristic parameter and the importance value of each flow characteristic parameter.
[0025] The time window information corresponding to the judgment result is used as the start and end time information of the warning signal. The warning signal type, the description content, the signal strength and the corresponding start and end time information are combined to obtain the initial warning signal.
[0026] The initial warning signal is format-normalized using a preset processing mechanism to obtain an intermediate warning signal. The intermediate warning signal is then converted to obtain a congestion warning signal.
[0027] Optionally, the traffic characteristic parameters include average transmission rate, protocol distribution ratio, burst frequency, and traffic fluctuation coefficient;
[0028] The step of normalizing the quantized dataset and extracting traffic feature parameters from the normalized dataset includes:
[0029] The quantized datasets corresponding to each time window are normalized and preprocessed to obtain the normalized and preprocessed datasets.
[0030] The normalized preprocessed dataset is divided into transmission data group, protocol data group and interaction data group according to data type.
[0031] Calculate the average value of the amount of data transmitted per unit time in the transmitted data group to obtain the average transmission rate corresponding to each time window;
[0032] The traffic share of each network protocol in the protocol data group is statistically analyzed to obtain the protocol distribution share;
[0033] Analyze the time periods in the interactive data group where the interaction frequency exceeds a preset frequency threshold, and count the number of times the time period appears in each time window to obtain the burst frequency corresponding to each time window;
[0034] Based on the average transmission rate, the difference between the maximum and minimum transmission volume within the same time window is calculated to obtain the traffic fluctuation coefficient that reflects the degree of change in transmission volume in each time window.
[0035] The average transmission rate, the proportion of protocol distribution, the burst frequency, and the traffic fluctuation coefficient within the same time window are combined to form traffic characteristic parameters.
[0036] Optionally, the step of using the K-means clustering algorithm to classify the traffic feature parameters to obtain a traffic feature set, and determining the importance value of each traffic feature parameter in the traffic feature set, includes:
[0037] Based on preset feature classification rules, the K-means clustering algorithm is used to classify the traffic feature parameters to obtain a traffic feature set.
[0038] A feature evaluation model is constructed based on historical network congestion data. Each traffic feature parameter in the traffic feature set is input into the feature evaluation model, and the influence weight of each traffic feature parameter on the congestion warning result is calculated.
[0039] Based on the influence weights, each traffic feature parameter in the traffic feature set is assigned a numerical importance level.
[0040] Optionally, the feature evaluation model constructed based on historical network congestion data includes:
[0041] A training dataset is constructed based on historical network congestion data collected within a historical time period and the corresponding congestion occurrence time.
[0042] Using machine learning algorithms, with each historical traffic feature parameter in the training dataset as input and the corresponding congestion occurrence time as output, a model is trained to obtain a feature evaluation model.
[0043] Secondly, this application provides an industrial network equipment congestion early warning system based on traffic feature recognition, comprising:
[0044] The acquisition module is used to acquire traffic interaction data and perform grouping and quantization processing on the traffic interaction data according to a preset time interval to obtain the quantized dataset corresponding to each time window.
[0045] The extraction module is used to perform normalization preprocessing on the quantized dataset and extract the traffic feature parameters from the normalized preprocessed dataset.
[0046] The classification module is used to classify the traffic feature parameters using the K-means clustering algorithm to obtain a traffic feature set and determine the importance value of each traffic feature parameter in the traffic feature set.
[0047] The judgment module is used to judge the current traffic operation status of industrial network devices based on the importance value of each traffic feature parameter in the traffic feature set, and to generate a congestion warning signal corresponding to the judgment result.
[0048] Thirdly, this application provides an electronic device, comprising:
[0049] Memory, used to store computer programs;
[0050] A processor, configured to execute the computer program to implement the steps of the industrial network device congestion early warning method based on traffic feature identification as described in the first aspect above.
[0051] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the steps of the industrial network equipment congestion early warning method based on traffic feature identification as described in the first aspect above.
[0052] The technical solution of this application has the following beneficial effects:
[0053] This application first comprehensively covers the key dimensions of cross-network segment traffic interaction by collecting three core data types: packet transmission volume, protocol type proportion, and interaction frequency, thus avoiding information gaps caused by single data collection. Next, the core data is grouped and quantified according to preset time intervals to form datasets corresponding to time windows, enabling dynamic time-segmented management of traffic data. Then, normalization preprocessing eliminates the dimensional differences between different data dimensions, ensuring the accuracy and comparability of subsequent feature analysis. Afterwards, four parameters—average transmission rate, protocol distribution proportion, burst frequency, and traffic fluctuation coefficient—are extracted to comprehensively cover the core influencing factors of congestion. Finally, a classification algorithm is used to organize the feature parameters into ordered traffic data. Feature sets enhance the structuring of feature data, facilitating efficient subsequent processing. Determining the importance of each parameter allows for differentiated weighting of different features, avoiding judgment biases caused by traditional indiscriminate evaluation. Furthermore, status assessments are performed based on importance values to ensure the dominant role of key features in the judgment, reducing interference from secondary features. Finally, combining this with a random forest algorithm to generate corresponding early warning signals creates a closed loop from industrial traffic feature identification to early warning output. This provides clear risk alerts for industrial control center maintenance personnel, further mitigating production line downtime risks due to network congestion and ensuring the real-time performance and reliability of the industrial network.
[0054] Furthermore, this application achieves accurate initial judgment of individual traffic characteristics through a hierarchical processing logic from single-parameter evaluation, multi-parameter aggregation, comprehensive judgment to signal generation, thereby avoiding the omission of key abnormal characteristics; then, by orderly aggregation to form structured multi-parameter results, it can ensure that the feature information is complete and clear; finally, by combining comprehensive rules and early warning algorithms, it can resolve possible conflicts in multi-parameter results, thereby improving the comprehensiveness and accuracy of state judgment, while generating targeted early warning signals to ensure that the early warning information matches the actual risk, further effectively improving the accuracy and practicality of industrial network equipment congestion early warning. Attached Figure Description
[0055] To more clearly illustrate the technical solutions of the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0056] Figure 1 A flowchart illustrating a method for early warning of congestion in industrial network devices based on traffic feature identification, provided in an embodiment of this application;
[0057] Figure 2A schematic diagram illustrating a specific implementation of an industrial network device congestion early warning method based on traffic feature identification, provided in this application embodiment;
[0058] Figure 3 A schematic diagram of the structure of an industrial network device congestion early warning system based on traffic feature recognition provided in this application embodiment;
[0059] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation
[0060] In multi-segment interconnected scenarios such as industrial automated production lines, smart factories, and energy and power monitoring, congestion of industrial network equipment directly affects the transmission efficiency of real-time industrial control data and production instructions. However, existing congestion early warning technologies are insufficient to meet the extremely high accuracy and millisecond-level timeliness requirements for capturing congestion precursors in industrial scenarios. Current technologies mostly rely on single or limited traffic indicators such as transmission rate and data packet volume for judgment, making it difficult to capture congestion precursors. At the same time, they are prone to false alarms or missed alarms, thus failing to provide reliable intervention basis for operation and maintenance personnel.
[0061] To address the aforementioned issues, this application provides a method for congestion early warning of industrial network equipment based on traffic feature identification. This method first collects cross-segment data packet transmission volume, protocol type ratio, and interaction frequency data, quantifying them according to time windows. Then, it extracts four types of feature parameters, including average transmission rate, and classifies them to determine the importance value of each parameter. Finally, based on this value, it judges the traffic operation status and generates an early warning signal. This scheme covers the core causes of congestion in industrial scenarios through multi-dimensional feature collection, distinguishes feature weights by importance values, and combines time windows to achieve dynamic analysis. It effectively overcomes the shortcomings of existing technologies in complex industrial environments, such as single-feature and coarse-grained assessment. It can accurately identify microsecond-level congestion risks and generate clear early warnings in a timely manner, thereby helping industrial operation and maintenance personnel respond quickly to production line status and ensure the continuous and stable operation of industrial production systems.
[0062] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0063] The core of this application is to provide a method for congestion early warning of industrial network equipment based on traffic feature identification. A flowchart of one specific implementation is shown below. Figure 1 As shown, the method includes:
[0064] S101. Obtain traffic interaction data, and perform grouping and quantization processing on the traffic interaction data according to a preset time interval to obtain the quantized dataset corresponding to each time window.
[0065] In the above scheme, traffic interaction data includes transmission volume data between network segments, protocol proportion data used during interaction between network segments, and interaction frequency. Transmission volume data refers to the total number of data packets or bytes transmitted per unit time during interaction between different network segments. Protocol proportion data refers to the proportion of different network protocols used during interaction between network segments in the total number of protocols used. Interaction frequency data refers to the total number of data interaction requests initiated between different network segments per unit time.
[0066] The preset time interval refers to the time segmentation standard set in advance according to the network operation and maintenance requirements. The time window refers to a single time period divided based on the preset time interval. Each time window corresponds to traffic data within a specific duration, which facilitates dynamic analysis of traffic characteristics in different time periods. The quantified dataset refers to the data set formed after numerical processing of the traffic interaction data within each time window, which ensures that the data format is uniform and can be directly used for subsequent analysis and calculation.
[0067] Furthermore, the differences between different network segments are reflected in the industrial network hierarchy, data interaction boundaries, or management scope. Specifically, from the perspective of network function positioning, different network segments correspond to different core business carrying directions; then, from the perspective of data interaction boundaries, different network segments correspond to different industrial protocol interoperability strategies and data transmission scopes; and finally, from the perspective of management scope, different network segments correspond to different operation and maintenance management responsibilities.
[0068] This application first collects three core data types: data packet transmission volume, protocol type ratio, and interaction frequency. This comprehensively covers the total volume, structure, and frequency dimensions of cross-network segment traffic interaction, thus avoiding the loss of traffic information caused by single data collection. Then, by dividing continuous traffic data into time windows and grouping and quantifying them through preset time intervals, the discrete raw data can be transformed into a structured and numerical quantitative dataset. This not only realizes dynamic time-segmented management of traffic data, which facilitates subsequent analysis of traffic change patterns in different time periods, but also unifies the data format, providing a standard and usable data foundation for subsequent normalization preprocessing, feature parameter extraction, and other steps.
[0069] S102. Normalize the quantized dataset and extract the traffic characteristic parameters from the normalized dataset.
[0070] In one specific implementation, the traffic characteristic parameters include average transmission rate, protocol distribution ratio, burst frequency, and traffic fluctuation coefficient. Step S102 includes:
[0071] Step 1021: Perform normalization preprocessing on the quantized datasets corresponding to each time window to obtain the normalized preprocessed datasets.
[0072] In this application example, the min-max normalization algorithm is used to map the values of different dimensions in the quantized data to a unified range of 0-1, so as to eliminate the difference in the units of different data dimensions and obtain the normalized preprocessed dataset.
[0073] For example, first collect data on transmission volume, protocol proportion, and interaction frequency between each network segment: the data packet transmission volume between the control layer network segment and the field execution network segment is 120 packets / second, and the data volume is 60KB / second; the data packet transmission volume between the control layer network segment and the monitoring and acquisition network segment is 90 packets / second and 45KB / second; the data packet transmission volume between the field execution network segment and the sensor access network segment is 80 packets / second and 40KB / second. Then, it is calculated that the proportion of industrial Ethernet protocols used in the interaction between each network segment is 76%, 72%, and 70%, respectively, and the proportion of EtherNet / IP protocols is 19%, 23%, and 25%, respectively; the interaction frequency is 30 times, 25 times, and 22 times, respectively. The above data are then integrated to obtain traffic interaction data.
[0074] Subsequently, the traffic interaction data was grouped and quantified according to a preset time interval of 5 minutes, resulting in a quantized dataset of 108 time windows. Taking the 9:00-9:05 window as an example, the quantized dataset of this window includes the transmission volume, protocol proportion, and frequency data of the interaction of each network segment.
[0075] Secondly, the quantized dataset is preprocessed for normalization using the minimum-maximum normalization algorithm. Calculate, where x represents the original value of a certain dimension. This represents the minimum value of all data in this dimension. x' represents the maximum value of all data in this dimension, and x' represents the normalization result. Taking the data packet transmission volume per second as an example, all windows in this dimension... =50 per second =200 packets / second, the transmission volume of the office network segment and the R&D network segment under the 9:00-9:05 window is x=120 packets / second. Substituting into the formula, we get x'=(120-50) / (200-50)=70 / 150=0.47. Similarly, the normalized dataset is obtained by calculating other dimensions of data in the same way.
[0076] Step 1022: Divide the normalized preprocessed dataset into transmission data group, protocol data group and interaction data group according to data type.
[0077] Among them, the transmission data group refers to the group that contains only data related to the amount of data packets transmitted, which is divided from the normalized preprocessed dataset; the protocol data group refers to the group that contains only data related to the proportion of network protocol types, which is divided from the normalized preprocessed dataset; and the interaction data group refers to the group that contains only data related to the frequency of interactions between network segments, which is divided from the normalized preprocessed dataset.
[0078] Step 1023: Calculate the average value of the amount of data transmitted per unit time in the transmitted data group to obtain the average transmission rate corresponding to each time window.
[0079] Step 1024: Calculate the traffic proportion of each type of network protocol in the protocol data group to obtain the protocol distribution proportion.
[0080] Protocol distribution percentage refers to the specific percentage of traffic for each type of network protocol in the total traffic.
[0081] Then, for the protocol data group, the traffic share of various network protocols is statistically analyzed through 1024 steps, and the average traffic share of the same protocol in each time window protocol data group is taken to obtain the protocol distribution share.
[0082] Step 1025: Analyze the time periods in the interactive data group where the interaction frequency exceeds the preset frequency threshold, and count the number of times the time period appears in each time window to obtain the burst frequency corresponding to each time window.
[0083] Among them, the preset frequency threshold refers to the reference value set according to the interaction frequency when the network is operating normally, and the burst frequency refers to the number of times the interaction frequency exceeds the preset frequency threshold within each time window.
[0084] Furthermore, a time window is a basic time unit divided according to a preset time interval, while a time period is a smaller time segment within each time window. The duration of a time period is always less than or equal to the duration of its corresponding time window, and multiple consecutive time periods will completely cover the corresponding time window.
[0085] In this step, for the interactive data group, a preset frequency threshold is first set, then the normalized frequency data in the interactive data group of each time window is traversed, and the number of time periods with values exceeding the preset frequency threshold is counted to obtain the burst frequency corresponding to each time window.
[0086] It should be noted that since the interaction frequency data has already undergone normalization preprocessing in step 1021, the preset frequency threshold is also set based on the normalized value. The burst frequency count is the number of time periods in which the normalized interaction frequency exceeds the threshold, and its unit is times / time window. However, the value itself is dimensionless, and the value range is usually from 0 to the total number of time periods within the time window, such as 0~100, which is similar to the value range of other feature parameters. Therefore, no secondary normalization processing is performed. In practical applications, if the burst frequency differs greatly from other feature dimensions, normalization can be performed as needed. In this embodiment, the counting result is directly used as one of the feature parameters.
[0087] For example, a preset frequency threshold of 0.5 is set, corresponding to 50 interaction frequencies. The interaction data groups are iterated through, and the number of those exceeding the threshold is counted as 1. Therefore, the burst frequency is 1.
[0088] Step 1026: Based on the average transmission rate, calculate the difference between the maximum and minimum transmission volume within the same time window to obtain the traffic fluctuation coefficient that reflects the degree of change in transmission volume in each time window.
[0089] The traffic fluctuation coefficient refers to the difference between the maximum and minimum transmission volume within the same time window.
[0090] For example, extract the maximum normalized transmission amount of 0.52 and the minimum normalized transmission amount of 0.45 from the transmitted data set, and calculate the difference between the two, 0.52-0.45=0.07, to obtain the traffic fluctuation coefficient.
[0091] Step 1027: Combine the average transmission rate, the protocol distribution ratio, the burst frequency, and the traffic fluctuation coefficient within the same time window to form traffic characteristic parameters.
[0092] For example, the traffic characteristic parameters of this window are: average transmission rate 0.485, protocol distribution ratio TCP: 0.76, UDP: 0.19, burst frequency 1, and traffic fluctuation coefficient 0.07.
[0093] This application first eliminates the dimensional differences in quantitative data through normalization preprocessing, which can avoid deviations in subsequent analysis results due to different data dimensions. Then, by grouping the data according to data type, the normalized data is sorted into three clear data groups: transmission volume, protocol proportion, and interaction frequency, which can provide structured data support for subsequent targeted extraction of feature parameters. Then, by calculating the average transmission rate, statistically analyzing the protocol distribution proportion, identifying burst frequency, and calculating the traffic fluctuation coefficient, key traffic features can be comprehensively extracted from four dimensions: efficiency, structure, risk, and stability. Furthermore, the four types of features are combined to form traffic feature parameters, which can fully reflect the core attributes of traffic in each time window.
[0094] S103. Use the K-means clustering algorithm to classify the traffic feature parameters to obtain a traffic feature set, and determine the importance value of each traffic feature parameter in the traffic feature set.
[0095] K-means clustering algorithm is an algorithm used to classify traffic feature parameters into categories. It is used to group feature parameters with similar attributes into the same category, which can make feature data structured. Traffic feature set refers to the ordered combination of features formed after classification. Traffic feature set contains all traffic feature parameters organized according to categories.
[0096] In one specific implementation, step S103 includes:
[0097] Step 1031: Combining the preset feature classification rules, the K-means clustering algorithm is used to classify the traffic feature parameters to obtain a traffic feature set.
[0098] The preset feature classification rules refer to the classification criteria pre-set based on the attributes of the feature parameters. It should be noted that the preset feature classification rules are used to specify the number of clusters and the initial meaning of the clusters. For example, the feature parameters are pre-divided into four categories: efficiency, structure, risk, and stability. The K-means clustering algorithm clusters with the number of clusters K=4 and iteratively optimizes each feature parameter to be assigned to the most similar category. The final category assignment is based on the clustering result, but the category labels can be named according to the preset rules. This not only utilizes prior knowledge to guide clustering but also ensures the objectivity of the classification through a data-driven approach.
[0099] For example, first, pre-defined rules are used to classify features into categories such as production efficiency, protocol structure, sudden risk, and link stability. Then, the K-means clustering algorithm is used to perform cluster analysis on the feature parameters of all windows. Finally, the average transmission rate is classified into the production efficiency category, the distribution ratio of industrial control protocols is classified into the protocol structure category, the frequency of sudden out-of-cycle commands is classified into the sudden risk category, and the traffic fluctuation coefficient is classified into the link stability category. The above results are then integrated into a traffic feature set.
[0100] Step 1032: Construct a feature evaluation model based on historical network congestion data, input each traffic feature parameter in the traffic feature set into the feature evaluation model, and calculate the influence weight of each traffic feature parameter on the congestion warning result.
[0101] The feature evaluation model refers to a model trained based on historical data. It can be a general model trained based on machine learning algorithms. The specific structure of the model is not specifically limited in the embodiments of this application.
[0102] Furthermore, historical network congestion data refers to network congestion-related data recorded within a historical time period, and includes the traffic characteristic parameters and congestion occurrence at that time; the influence weight is used to reflect the degree of influence of each characteristic parameter on the congestion warning result during the model decision-making process.
[0103] Step 1032 may specifically include the following steps:
[0104] Step a1: Construct a training dataset based on historical network congestion data collected within a historical time period and the corresponding congestion occurrence time.
[0105] For example, first collect 10,000 historical network congestion data points from the past 6 months of the smart factory production line network. Each data point contains historical traffic characteristic parameters reflecting the characteristics of industrial cyclic communication and the corresponding congestion occurrence. Add the congestion occurrence time to each data point, where congestion is marked as 1 and no congestion is marked as 0. Divide the data into training set and validation set in an 8:2 ratio to obtain training set sample size = 10,000 × 80% = 8,000 data points and validation set sample size = 10,000 × 20% = 2,000 data points.
[0106] Step a2: Using a machine learning algorithm, with the historical traffic feature parameters in the training dataset as input and the corresponding congestion occurrence time as output, train the model to obtain the feature evaluation model.
[0107] The training dataset refers to a collection of data consisting of historical traffic feature parameters and corresponding congestion occurrence times. The machine learning algorithm refers to an algorithm that learns the patterns in historical data to establish the correlation between features and congestion results and is used to train the model. The congestion occurrence time refers to the marker that indicates whether congestion has occurred in historical data and can be used as the output target for model training.
[0108] In step a2, the training dataset is divided into a training set and a validation set according to the proportion. Then, the random forest machine learning algorithm is selected, with the historical traffic feature parameters in the training set as input and the corresponding congestion occurrence time as output. The model parameters are then adjusted through multiple rounds of iterative training. The model performance can be evaluated using the validation set until the model performance meets the standard, so as to obtain the feature evaluation model.
[0109] For example, the random forest algorithm is selected, with 100 trees and a maximum depth of 10. The historical traffic feature parameters in the training set are used as input and the congestion occurrence time is used as output. The algorithm is trained iteratively 50 times. After training, the model is evaluated using a validation set to calculate the model's classification accuracy, which is the ratio of the number of correctly predicted samples to the total number of samples. Assuming that there are 1840 samples in the validation set whose model prediction results are consistent with the actual congestion occurrence time, the accuracy is calculated as 1840 / 2000 = 0.92. The validation model meets the standard and the feature evaluation model is obtained.
[0110] Step a3: Input each traffic feature parameter in the traffic feature set into the trained feature evaluation model. Analyze the contribution of each traffic feature parameter to the congestion warning result during the model decision-making process using the built-in computing unit of the feature evaluation model. Based on the contribution and the stability analysis results of each traffic feature parameter over time, assign a quantified influence weight to each traffic feature parameter.
[0111] The computational unit refers to the module built into the model used to calculate the contribution of each feature parameter. The stability analysis results on the time series refer to the analysis conclusions on the numerical fluctuations of the feature parameters in different time windows, which can help adjust the influence weights.
[0112] In step a3, each traffic feature parameter in the traffic feature set is input into the trained feature evaluation model, and the contribution of each feature parameter to the congestion warning result is analyzed using the importance calculation module based on the Gini coefficient built into the model. At the same time, the stability analysis of the numerical fluctuation of each feature parameter in the time series is performed, and the influence weight of each traffic feature parameter is determined by combining the contribution degree and the stability analysis results.
[0113] For example, the feature parameters in the traffic feature set are input into the model, and the initial contribution of each feature is obtained through the built-in Gini coefficient calculation module. These features include: burst frequency, average transmission rate, traffic fluctuation coefficient, TCP protocol distribution ratio, UDP protocol distribution ratio, etc. Then, the initial contribution is corrected according to the stability analysis results to obtain the final influence weight.
[0114] Step 1033: Based on the influence weights, assign importance values to each traffic feature parameter in the traffic feature set.
[0115] In step 1033, the influence weights can be converted into values in the range of 0-1 according to the proportion, and then each traffic feature parameter in the traffic feature set can be assigned a corresponding importance value to form a structured result containing category, feature parameter and corresponding importance value.
[0116] For example, the influence weights can be directly used as importance values in the 0-1 interval, and importance values can be assigned to each feature parameter to form a structured result.
[0117] This application first classifies the feature parameters using the K-means clustering algorithm combined with preset rules, and organizes the scattered feature parameters into a structured set of traffic features, which can make the feature data clear and organized; then, by determining the importance value, it can accurately distinguish the influence of different feature parameters.
[0118] S104. Based on the importance values of each traffic feature parameter in the traffic feature set, the random forest algorithm is used to judge the current traffic operation status of the industrial network equipment and generate a congestion warning signal corresponding to the judgment result.
[0119] In this context, an industrial network device serves as a connection node for multiple network segments and is associated with carrying traffic interactions between at least two or more network segments.
[0120] In one specific implementation, such as Figure 2 As shown, step S104 includes:
[0121] Step 1041: Evaluate the importance value of each flow characteristic parameter in the flow characteristic set to obtain the initial evaluation result corresponding to each flow characteristic parameter.
[0122] In step 1041, the evaluation process can be carried out in combination with preset status judgment conditions. The preset status judgment conditions refer to the status evaluation standards set for each traffic characteristic parameter, which may include the threshold range of normal and abnormal.
[0123] For example, the initial state judgment condition is that if the importance value of each traffic characteristic parameter exceeds 0.6, it is abnormal, and if it does not exceed 0.6, it is normal. Then, the importance values of each characteristic are compared: the burst frequency is 0.4, so it is judged as normal because 0.4≤0.6; the average transmission rate is judged as normal because 0.28≤0.6; the traffic fluctuation coefficient is judged as normal because 0.2≤0.6; the TCP protocol distribution ratio is judged as normal because 0.15≤0.6; the UDP protocol distribution ratio is judged as normal because 0.05≤0.6. And all the initial evaluation results are normal.
[0124] Step 1042: Summarize the initial evaluation results according to the preset category order to obtain the target evaluation results.
[0125] The preset category order refers to the summary order set according to the feature categories, which can ensure that the results of multiple parameters are clearly organized.
[0126] For example, efficiency, structure, risk, and stability categories are integrated according to a preset category order, and the results of a single parameter are summarized. That is, the average transmission rate of efficiency category is normal, the distribution ratio of TCP protocol in structure category is normal, the distribution ratio of UDP protocol is normal, the burst frequency of risk category is normal, and the traffic fluctuation coefficient of stability category is normal, thus forming the target evaluation result.
[0127] Step 1043: Combine the preset state rules and process the target evaluation results using the random forest algorithm to obtain the judgment result of the current traffic operation status of the industrial network equipment. Combine the preset warning signal generation rules and the judgment result to generate a signal and obtain a congestion warning signal.
[0128] Among them, the preset state rules refer to the judgment criteria that include multi-level congestion state threshold ranges; the warning signal generation rules refer to the rules that define the type and content composition of warning signals, which can standardize the format and elements of signal generation.
[0129] Step 1043 may specifically include the following steps:
[0130] Step b1: Based on the importance values of each flow characteristic parameter, assign corresponding weights to each initial evaluation result in the target evaluation results, and construct a weighted evaluation model.
[0131] For example, a weighted evaluation model is first constructed based on the importance values of each feature, with the single parameter state value of normal being recorded as 0 and abnormal as 1.
[0132] Step b2: Use the random forest algorithm to call the weighted evaluation model to perform weighted calculations on all the initial evaluation results to obtain the initial comprehensive score.
[0133] Step b3: Match the initial comprehensive score with the state threshold range defined in the preset state rules to determine the corresponding congestion state.
[0134] The state threshold interval refers to a set of multiple consecutive congestion threshold intervals, each interval corresponding to a congestion state. For example, the state threshold intervals are 0-0.3 (normal), 0.3-0.6 (mild congestion), and 0.6-1 (severe congestion). Since the initial comprehensive score of 0 belongs to the 0-0.3 interval, the congestion state is normal.
[0135] Step b4: Extract traffic feature parameters from the traffic feature set that have a correlation degree greater than a preset correlation degree threshold with the congestion state, and use them as key feature parameters.
[0136] Among them, key feature parameters refer to traffic feature parameters whose correlation with the congestion state exceeds a preset correlation threshold, and can reflect the core factors affecting the current state; the preset correlation threshold is a reference value for judging the degree of correlation between feature parameters and congestion state.
[0137] For example, a preset correlation threshold of 0.5 is set, and feature parameters with a correlation greater than 0.5 with abnormal states are extracted as key feature parameters.
[0138] Step b5: Perform correlation verification on all key feature parameters. If the correlation verification fails, trigger the threshold compensation mechanism of the random forest algorithm to adjust the boundary value of the congestion state threshold interval according to the actual deviation of the key feature parameters, so as to obtain the updated preset state rules.
[0139] Among them, correlation verification refers to the verification process of checking the logical consistency between key feature parameters, which can ensure the reliability of the evaluation results; threshold compensation mechanism refers to the mechanism of adjusting the boundary value of the threshold interval when the correlation verification fails, which can correct the evaluation deviation.
[0140] In this step, the correlation verification can use the Pearson correlation coefficient to calculate the correlation between key feature parameters. If the absolute value of the correlation coefficient between any two key feature parameters is lower than a preset correlation threshold, such as 0.5, the correlation verification is considered to pass; otherwise, it fails and a threshold compensation mechanism needs to be triggered. The threshold compensation mechanism adjusts according to the actual deviation of the key feature parameters: for each key feature parameter, the percentage deviation between its current value and the historical normal average is calculated, and the boundary value of the congestion state threshold interval is adjusted in the same direction according to the percentage deviation. For example, if the key feature parameter is too high, the lower or upper limit of the threshold interval is increased accordingly to compensate for misjudgment caused by inconsistency between features. The adjusted threshold interval is used for the next iteration judgment until the correlation verification of all key feature parameters passes or the maximum number of iterations is reached.
[0141] For example, if the correlation of all key feature parameters is checked and the status of each feature parameter is found to be normal, and the logical consistency check is passed, then the judgment result is that the current traffic operation status is normal.
[0142] Step b6: Based on the updated preset state rules, repeat the matching, extraction, and correlation verification operations until the correlation verification passes, and use the congestion state corresponding to the last generation as the judgment result of the current traffic operation state of the industrial network device.
[0143] In this step, the embodiments of this application may set a maximum number of iterations, and stop iterating when the number of iterations equals the maximum number of iterations or when the change of the adjusted threshold range is less than a certain threshold.
[0144] Step b7: Based on the preset warning signal generation rules, match the corresponding warning signal type according to the judgment result, and generate a description containing abnormal traffic characteristic parameters, impact range and preliminary suggestions based on the warning signal type.
[0145] For example, based on the preset early warning signal generation rules, the abnormal state matching industrial network congestion level 2 early warning signal type is obtained. The description is that the frequency of sudden commands in the field execution layer network segment exceeds the standard. The affected area is automated production line No. 3. The preliminary suggestion is to check the scanning cycle setting of the PLC master station of the production line or temporarily restrict the transmission of non-critical video monitoring streams.
[0146] Step b8: Calculate the signal strength based on the degree of anomaly of each flow characteristic parameter and the importance value of each flow characteristic parameter.
[0147] The degree of anomaly can be represented by a quantized value. Therefore, the signal strength can be the weighted sum of the degree of anomaly of the traffic characteristic parameters and the importance of the traffic characteristic parameters.
[0148] Step b9: Use the time window information corresponding to the judgment result as the start and end time information of the warning signal, and combine the warning signal type, the description content, the signal strength and the corresponding start and end time information to obtain the initial warning signal.
[0149] For example, if the start and end time is the current time window of 9:00-9:05, an initial warning signal is obtained, which includes the warning signal type (warning type 1), description content (xxx), signal strength (yyy), and start and end time (9:00-9:05).
[0150] Step b10: The initial warning signal is format-normalized using a preset processing mechanism to obtain an intermediate warning signal. The intermediate warning signal is then converted to obtain a congestion warning signal.
[0151] This application first achieves independent judgment of the operating status of each traffic characteristic parameter through single-parameter state evaluation, which can provide a detailed basis for the overall evaluation; then, by integrating the single-parameter results according to categories, the target evaluation results are made clear and easy to analyze in subsequent comprehensive analysis; then, by combining the random forest algorithm with weighted evaluation model, threshold matching, correlation verification and other mechanisms, the application achieves accurate judgment of network traffic operating status, effectively avoiding misjudgment caused by single parameter bias.
[0152] Ultimately, by generating congestion warning signals that include elements such as warning type, description, and signal strength, we can provide intuitive and comprehensive decision-making references for network operations and maintenance, thereby ensuring that operations and maintenance personnel can quickly understand the network status and key influencing factors.
[0153] Figure 3This is a schematic diagram illustrating a specific implementation of an industrial network device congestion early warning system based on traffic feature recognition, as provided in this application embodiment. (Refer to...) Figure 3 The system may include:
[0154] The acquisition module 31 is used to acquire traffic interaction data and perform grouping and quantization processing on the traffic interaction data according to a preset time interval to obtain the quantized dataset corresponding to each time window.
[0155] Extraction module 32 is used to perform normalization preprocessing on the quantized dataset and extract traffic feature parameters from the normalized preprocessed dataset.
[0156] The classification module 33 is used to perform feature classification on the traffic feature parameters using the K-means clustering algorithm to obtain a traffic feature set and determine the importance value of each traffic feature parameter in the traffic feature set.
[0157] The judgment module 34 is used to judge the current traffic operation status of industrial network equipment based on the importance value of each traffic feature parameter in the traffic feature set and to generate a congestion warning signal corresponding to the judgment result.
[0158] The industrial network device congestion early warning system based on traffic feature identification in this application is used to implement the aforementioned industrial network device congestion early warning method based on traffic feature identification. Therefore, the specific implementation of the industrial network device congestion early warning system based on traffic feature identification can be found in the embodiment section of the industrial network device congestion early warning method based on traffic feature identification above. The specific implementation can be referred to the description of the corresponding embodiments, which will not be repeated here.
[0159] like Figure 4 As shown, this application also provides an electronic device, including: a memory 41 for storing a computer program; and a processor 42 for executing the computer program to implement the steps of any of the above-described methods for congestion warning of industrial network equipment based on traffic feature identification.
[0160] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the above-described methods for congestion warning of industrial network equipment based on traffic feature identification.
[0161] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory, random access memory, portable hard drives, magnetic disks, or optical disks.
[0162] Embodiments of the present invention also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the embodiments of the industrial network device congestion early warning method based on traffic feature identification.
[0163] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.
[0164] The foregoing has provided a detailed description of the industrial network equipment congestion early warning method and system based on traffic feature identification provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of this application.
Claims
1. A method for congestion early warning of industrial network equipment based on traffic feature recognition, characterized in that, include: Acquire traffic interaction data, and group and quantize the traffic interaction data according to a preset time interval to obtain the quantized dataset corresponding to each time window. The quantized dataset is preprocessed by normalization, and the traffic characteristic parameters in the preprocessed dataset are extracted. The K-means clustering algorithm is used to classify the traffic feature parameters to obtain a traffic feature set, and the importance value of each traffic feature parameter in the traffic feature set is determined. Based on the importance values of each traffic feature parameter in the traffic feature set, the random forest algorithm is used to judge the current traffic operation status of industrial network devices and generate a congestion warning signal corresponding to the judgment result.
2. The method according to claim 1, characterized in that, Based on the importance values of each traffic feature parameter in the traffic feature set, the random forest algorithm is used to determine the current traffic operation status of industrial network devices, and a congestion warning signal corresponding to the determination result is generated, including: The importance values of each flow feature parameter in the flow feature set are evaluated to obtain the initial evaluation result for each flow feature parameter. The initial evaluation results are summarized according to a preset category order to obtain the target evaluation results; By combining preset state rules, the target evaluation results are processed using a random forest algorithm to obtain a judgment result on the current traffic operation status of industrial network devices. Then, by combining preset warning signal generation rules and the judgment result, a congestion warning signal is generated.
3. The method according to claim 2, characterized in that, The step of combining preset state rules and processing the target evaluation results using a random forest algorithm to obtain a judgment result on the current traffic operation status of industrial network devices includes: Based on the importance values of each flow characteristic parameter, a corresponding weight is assigned to each initial evaluation result in the target evaluation result to construct a weighted evaluation model; The weighted evaluation model is invoked using the random forest algorithm to perform a weighted calculation on all the initial evaluation results to obtain an initial comprehensive score. The initial comprehensive score is matched with the state threshold range defined in the preset state rules to determine the corresponding congestion state; Traffic feature parameters with a correlation degree greater than a preset correlation degree threshold to the congestion state are extracted from the traffic feature set and used as key feature parameters. All key feature parameters are subjected to correlation verification. If the correlation verification fails, the threshold compensation mechanism of the random forest algorithm is triggered to adjust the boundary value of the congestion state threshold interval according to the actual deviation of the key feature parameters in order to obtain the updated preset state rules. Based on the updated preset state rules, the matching, extraction, and correlation verification operations are repeatedly executed until the correlation verification passes, and the congestion state corresponding to the last generation is used as the judgment result of the current traffic operation status of the industrial network device.
4. The method according to claim 2, characterized in that, The process of generating a congestion warning signal by combining a preset warning signal generation rule with the judgment result includes: Based on the preset warning signal generation rules, the corresponding warning signal type is matched according to the judgment result, and based on the warning signal type, a description containing abnormal traffic characteristic parameters, impact range and preliminary suggestions is generated; The signal strength is calculated based on the degree of anomaly of each flow characteristic parameter and the importance value of each flow characteristic parameter. The time window information corresponding to the judgment result is used as the start and end time information of the warning signal. The warning signal type, the description content, the signal strength and the corresponding start and end time information are combined to obtain the initial warning signal. The initial warning signal is format-normalized using a preset processing mechanism to obtain an intermediate warning signal. The intermediate warning signal is then converted to obtain a congestion warning signal.
5. The method according to claim 1, characterized in that, The traffic characteristic parameters include average transmission rate, protocol distribution ratio, burst frequency, and traffic fluctuation coefficient. The step of normalizing the quantized dataset and extracting traffic feature parameters from the normalized dataset includes: The quantized datasets corresponding to each time window are normalized and preprocessed to obtain the normalized and preprocessed datasets. The normalized preprocessed dataset is divided into transmission data group, protocol data group and interaction data group according to data type. Calculate the average value of the amount of data transmitted per unit time in the transmitted data group to obtain the average transmission rate corresponding to each time window; The traffic share of each network protocol in the protocol data group is statistically analyzed to obtain the protocol distribution share; Analyze the time periods in the interactive data group where the interaction frequency exceeds a preset frequency threshold, and count the number of times the time period appears in each time window to obtain the burst frequency corresponding to each time window; Based on the average transmission rate, the difference between the maximum and minimum transmission volume within the same time window is calculated to obtain the traffic fluctuation coefficient that reflects the degree of change in transmission volume in each time window. The average transmission rate, the proportion of protocol distribution, the burst frequency, and the traffic fluctuation coefficient within the same time window are combined to form traffic characteristic parameters.
6. The method according to claim 1, characterized in that, The process involves using the K-means clustering algorithm to classify the traffic characteristic parameters, obtaining a traffic characteristic set, and determining the importance value of each traffic characteristic parameter in the traffic characteristic set, including: Based on preset feature classification rules, the K-means clustering algorithm is used to classify the traffic feature parameters to obtain a traffic feature set. A feature evaluation model is constructed based on historical network congestion data. Each traffic feature parameter in the traffic feature set is input into the feature evaluation model, and the influence weight of each traffic feature parameter on the congestion warning result is calculated. Based on the influence weights, each traffic feature parameter in the traffic feature set is assigned a numerical importance level.
7. The method according to claim 6, characterized in that, The feature evaluation model built based on historical network congestion data includes: A training dataset is constructed based on historical network congestion data collected within a historical time period and the corresponding congestion occurrence time. Using machine learning algorithms, with each historical traffic feature parameter in the training dataset as input and the corresponding congestion occurrence time as output, a model is trained to obtain a feature evaluation model.
8. A congestion early warning system for industrial network equipment based on traffic feature recognition, characterized in that, include: The acquisition module is used to acquire traffic interaction data and perform grouping and quantization processing on the traffic interaction data according to a preset time interval to obtain the quantized dataset corresponding to each time window. The extraction module is used to perform normalization preprocessing on the quantized dataset and extract the traffic feature parameters from the normalized preprocessed dataset. The classification module is used to classify the traffic feature parameters using the K-means clustering algorithm to obtain a traffic feature set and determine the importance value of each traffic feature parameter in the traffic feature set. The judgment module is used to judge the current traffic operation status of industrial network devices based on the importance value of each traffic feature parameter in the traffic feature set, and to generate a congestion warning signal corresponding to the judgment result.
9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the industrial network device congestion early warning method based on traffic feature identification as described in any one of claims 1 to 7 when executing the computer program.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, enables the implementation of the industrial network equipment congestion early warning method based on traffic feature identification as described in any one of claims 1 to 7.