Network load balancing method based on industrial data analysis

Abstract

This invention relates to the field of industrial network data processing technology, specifically to a network load balancing method based on industrial data analysis. An edge gateway receives data stream segments from industrial equipment through a ring-shaped buffer queue. Within a sliding window, it calculates the variance of the data packet arrival interval and the gradient of the sudden change in load length, inputting both into an anomaly condition judgment model to output an anomaly status identifier. When a fault-prone flow is determined, the edge gateway strips the original destination address, adds an isolated virtual LAN tag, and redirects the data stream to a standby processing node cluster physically isolated from the regular service links. When a regular periodic flow is determined, minimum connection load balancing is performed based on the real-time connection count of each destination node in the regular service links. This scheme completes anomaly judgment and physical isolation redirection before the data stream enters the regular queue, preventing sudden abnormal data from crowding out the bandwidth of regular service links and avoiding congestion and blocking of normal industrial control commands in the network queue.

Description

Technical Field

[0001] This invention relates to the field of industrial network data processing technology, and more specifically to a network load balancing method based on industrial data analysis. Background Technology

[0002] In existing industrial networks, load balancing mechanisms are typically deployed at the edge gateway to allocate computing resources to backend processing nodes during data exchange. Current conventional load balancing schemes, after receiving data streams from various industrial devices, do not perform pre-analysis of the data stream's content and status. Instead, they uniformly store all received data packets in a backend scheduling queue. The edge gateway's scheduling module, based on first-in-first-out (FIFO) or weighted round-robin rules, reads the network layer Internet Protocol (ISP) address or transport layer port number of the data packets in the scheduling queue and distributes the mixed data packets to different backend processing nodes for unified processing.

[0003] The aforementioned conventional load balancing solution has a core flaw: when individual devices in an industrial field experience abnormal failures, these devices send massive amounts of sudden alarm and log data to the edge gateway. This sudden data is mixed with the regular periodic control data from normal devices and queues in the edge gateway's scheduling queue. Because this sudden data occupies a large amount of queue storage space and egress bandwidth in a short period of time, normal control commands in the same scheduling queue cannot obtain forwarding resources in a timely manner, causing control command queuing congestion or even packet loss due to queue overflow. Summary of the Invention

[0004] The purpose of this invention is to provide a network load balancing method based on industrial data analysis, which can effectively solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] A network load balancing method based on industrial data analysis includes: an edge gateway caching data stream segments uploaded by various industrial devices in real time, performing sliding window feature extraction on the data stream segments, and calculating the variance of the data packet arrival interval and the abrupt gradient of the data packet payload length within the sliding window;

[0007] The edge gateway inputs the variance value and the mutation gradient into a preset abnormal condition judgment model and outputs an abnormal state identifier for the data stream segment.

[0008] When the abnormal status identifier indicates that the data flow is a fault burst flow, the edge gateway queries the preset list of isolation forwarding channels in the routing table and directly redirects the fault burst flow to a standby processing node cluster that is physically isolated from the regular service link;

[0009] When the abnormal status identifier indicates that the data stream is a regular periodic stream, the edge gateway performs minimum connection load balancing distribution according to the real-time connection number of each destination node in the regular service link.

[0010] Preferably, the step of performing sliding window feature extraction on the data stream segments includes: the edge gateway constructing a circular buffer queue with the first and last ends connected in its local memory, and writing the received data stream segments into the circular buffer queue in chronological order;

[0011] The edge gateway is configured with a sliding window pointer, which is used to extract a fixed-length sequence of data packets from the circular buffer queue by moving the sliding window pointer.

[0012] For the data packet sequence, the difference in arrival timestamps between adjacent data packets is recorded as an arrival interval sample, and the variance of the arrival interval sample is calculated to obtain the variance of the data packet arrival interval.

[0013] Extract the payload length of each data packet in the data packet sequence, calculate the absolute value of the difference between the payload length of the current data packet and the payload length of the previous data packet, and sum the absolute values ​​to obtain the abrupt gradient of the payload length of the data packet.

[0014] Preferably, the edge gateway inputs the variance value and the mutation gradient into a preset abnormal operating condition judgment model, including: the abnormal operating condition judgment model includes multiple preset feature interval mapping rules, the feature interval mapping rules divide the variance value into a stable interval, a fluctuating interval and a violently fluctuating interval, and divide the mutation gradient into a no-mutation interval, a slight mutation interval and a steeply increasing mutation interval;

[0015] The edge gateway extracts the target variance interval where the currently calculated variance value is located and the target gradient interval where the abrupt gradient is located, and combines and matches the target variance interval and the target gradient interval.

[0016] If the matching result is a combination of the violent fluctuation range and the steep increase mutation range, then a first abnormal state identifier representing the fault sudden flow is generated; otherwise, a second abnormal state identifier representing the normal periodic flow is generated.

[0017] Preferably, the edge gateway queries a preset list of isolated forwarding channels in the routing table and directly redirects the fault burst flow to a backup processing node cluster that is physically isolated from the regular service link. This includes: the edge gateway maintaining regular forwarding table entries and the list of isolated forwarding channels in its local routing table. The list of isolated forwarding channels records the media access control addresses and isolated outgoing port identifiers of multiple backup processing node clusters.

[0018] When the data stream is determined to be the fault burst stream, the edge gateway strips the original destination address of the fault burst stream, modifies the destination medium access control address of the fault burst stream to the medium access control address corresponding to the first backup processing node cluster according to the record in the isolated forwarding channel list, and after tagging the fault burst stream with an isolated virtual LAN label, sends it to the first backup processing node cluster through the physical network port corresponding to the isolated outgoing port identifier.

[0019] Preferably, the edge gateway performs minimum connection load balancing distribution according to the real-time connection count of each destination node in the regular service link, including: the edge gateway establishes a connection counter for each destination node in the regular service link, increments the value of the corresponding connection counter by 1 whenever a data packet of a regular periodic stream is successfully sent to the destination node, and decrements the value of the corresponding connection counter by 1 whenever an acknowledgment message is received from the destination node;

[0020] When distributing the regular periodic flow, the edge gateway reads the current value of the connection counter corresponding to all the destination nodes, compares the size of the current value, selects the target destination node with the smallest current value as the next hop for forwarding the regular periodic flow, and sends the regular periodic flow to the target destination node.

[0021] Preferably, after combining and matching the target variance interval with the target gradient interval, the method further includes: the edge gateway setting a continuous decision window to record the combined matching results of multiple consecutive sliding windows;

[0022] When all the combined matching results within the continuous determination window are the first abnormal state identifier, the edge gateway locks the source Internet Protocol address of the fault burst flow and writes the source Internet Protocol address into the dynamic isolation list.

[0023] When a data packet carrying the source Internet Protocol address is subsequently received, the edge gateway directly skips the calculation process of the abnormal working condition judgment model, queries the dynamic isolation list, and redirects the data packet to the backup processing node cluster.

[0024] Preferably, the step of extracting a fixed-length data packet sequence from the circular buffer queue by moving the sliding window pointer includes: the edge gateway detecting the current network throughput and determining a window scaling factor based on the current network throughput;

[0025] The edge gateway extracts the base window length and multiplies the base window length by the window scaling factor to obtain the dynamic window length;

[0026] The edge gateway sets the step size of the sliding window pointer according to the dynamic window length, and extracts a sequence of data packets containing the number corresponding to the dynamic window length from the circular buffer queue. When the current network throughput is greater than a preset throughput threshold, the window scaling factor is a value greater than 1, and when the current network throughput is less than or equal to the preset throughput threshold, the window scaling factor is a value equal to 1.

[0027] Preferably, before sending the fault burst flow to the first backup processing node cluster through the physical network port corresponding to the isolated outgoing port identifier after tagging it with an isolated virtual local area network, the method further includes: establishing a bidirectional link state detection mechanism between the edge gateway and the first backup processing node cluster, periodically sending detection probe messages to the first backup processing node cluster and receiving response messages returned by the first backup processing node cluster;

[0028] If the response message is not received within three consecutive detection cycles, the edge gateway marks the status field of the first backup processing node cluster in the isolated forwarding channel list as unavailable, and selects the second backup processing node cluster with an available status field as the redirection target according to the order of the isolated forwarding channel list.

[0029] Preferably, the edge gateway reads the current value of the connection counter corresponding to all the destination nodes, including: the edge gateway configures a status register for each destination node, and each bit of the status register maps to a different transmission control protocol port number of the destination node;

[0030] Whenever a new data forwarding connection is established to a specific Transmission Control Protocol (TCP) port number of the destination node, the edge gateway sets the value of the corresponding bit in the status register to 1, and whenever the connection to the specific TCP port number is closed, it sets the value of the corresponding bit to 0.

[0031] The edge gateway uses hardware logic to count the values ​​of all bits in the status register, and uses the count of '1's as the current value of the connection counter corresponding to the destination node.

[0032] Preferably, in the process of recording the combined matching results of multiple consecutive sliding windows, the method further includes: if some of the combined matching results within the consecutive judgment window are the second abnormal state identifier, and the interval where the mutation gradient corresponding to the second abnormal state identifier is located is the steeply increasing mutation interval, the edge gateway extracts the variance value corresponding to the second abnormal state identifier.

[0033] When the variance value is less than the lower limit of the violent fluctuation range, the edge gateway will correct the combined matching result of the continuous judgment window as the first abnormal state identifier.

[0034] The edge gateway redirects the corresponding data stream to the backup processing node cluster based on the corrected first abnormal state identifier, and writes the source Internet Protocol address into the dynamic isolation list.

[0035] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0036] 1. This solution completes the judgment and isolation of abnormal states before data packets enter the regular service queue. The edge gateway intercepts data stream segments through a circular buffer queue, calculates the variance of the data packet arrival interval and the gradient of the sudden change in payload length within the sliding window, and classifies the data stream into fault burst streams and regular periodic streams based on the feature interval combination matching results. For fault burst streams, the edge gateway directly strips their original destination address, modifies it to the media access control address of the backup processing node cluster, and adds an isolated virtual LAN tag, sending it through a dedicated physically isolated outgoing port. This mechanism cuts off the path for burst data streams to enter the regular service link at the edge gateway inlet, avoiding the bandwidth congestion of the regular service link caused by the surge in burst data volume, and eliminating the congestion and blocking phenomenon of normal control commands in the network queue.

[0037] 2. This scheme continuously records the combined matching results of multiple sliding windows. When all consecutive matches indicate anomalies, the source Internet Protocol address is added to a dynamic isolation list. Subsequent packets carrying this address are redirected directly, bypassing model calculations, thus reducing the gateway's overhead in processing duplicate abnormal data. The edge gateway adjusts the truncation step size of the sliding window based on the current network throughput, ensuring that the truncation length of the packet sequence adapts to different traffic conditions. For the distribution of regular periodic flows, the bits of the status register are mapped to the Transmission Control Protocol (TCP) port number of the destination node. Hardware logic is used to statistically read the connection count from the register bits, accelerating the numerical acquisition speed in the minimum connection number distribution decision process. Attached Figure Description

[0038] Figure 1 This is a flowchart of the network load balancing method based on industrial data analysis of the present invention.

[0039] Figure 2 This is a flowchart of the sliding window feature extraction and dynamic step size adjustment process of the present invention;

[0040] Figure 3 This is a flowchart of the abnormal operating condition determination and dynamic isolation list matching process of the present invention;

[0041] Figure 4This is a flowchart of the physical isolation redirection and link status detection process for fault burst flows according to the present invention.

[0042] Figure 5 This is a flowchart illustrating the connection count statistics of the conventional periodic flow status register of the present invention;

[0043] Figure 6 This is a flowchart of the minimum connection number load balancing distribution process for the conventional periodic stream of the present invention. Detailed Implementation

[0044] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0045] Please refer to Figure 1 This embodiment provides a network load balancing method based on industrial data analysis, applied to an edge gateway device in an industrial control network. The edge gateway is deployed between the industrial field device layer and the back-end processing node cluster, establishing bidirectional data communication connections with multiple industrial devices through an industrial Ethernet interface. The industrial devices include at least one of a programmable logic controller, industrial sensor, intelligent actuator, and distributed remote I / O module. The back-end processing node cluster includes a regular processing node cluster corresponding to the regular business links, and a backup processing node cluster physically isolated from the regular business links. The edge gateway caches data stream segments uploaded by each industrial device in real time. At the data link layer, it parses the Ethernet frames received by the industrial Ethernet interface, extracting payload data, timestamps, source addresses, and destination address information from the Ethernet frames to generate corresponding data stream segments. Each data stream segment corresponds to a complete Ethernet frame. The edge gateway writes the generated data stream segments to its local high-speed cache space in real time. The high-speed cache space uses memory mapping for addressing, ensuring low-latency response characteristics for writing and reading data stream segments.

[0046] The edge gateway performs sliding window feature extraction on cached data stream segments, calculating the variance of data packet arrival intervals and the gradient of abrupt changes in data packet payload length within the sliding window. The edge gateway establishes an independent feature extraction channel for the data stream corresponding to each connected industrial device, avoiding interference between data stream features from different devices. The edge gateway moves the sliding window according to a preset time step, extracting a fixed number of data packets from the cached data stream segments to form a data packet sequence, which serves as the basic sample set for feature extraction. For the extracted data packet sequence, the edge gateway extracts the arrival timestamp of each data packet, calculates the difference between the arrival timestamps of adjacent data packets to obtain a data packet arrival interval sample set, and calculates the corresponding variance value based on the arrival interval sample set. This variance value characterizes the degree of fluctuation in data packet arrival time. Simultaneously, the edge gateway extracts the payload length value of each data packet in the data packet sequence, calculates the change in payload length between adjacent data packets, and calculates the gradient of abrupt changes in the data packet payload length based on this change. This gradient of abrupt changes characterizes the degree of abrupt changes in the data packet payload length.

[0047] The edge gateway inputs the calculated variance and abrupt change gradient into a pre-defined anomaly detection model, outputting anomaly status identifiers for data stream segments. This pre-deployed anomaly detection model is located within the edge gateway's local processing unit, eliminating reliance on remote computing resources and ensuring low latency in the anomaly detection process. The model uses variance and abrupt change gradient as input features, processes these features through pre-defined feature matching logic, and outputs corresponding anomaly status identifiers. These identifiers are of two types, corresponding to both fault-prone streams and regular periodic streams.

[0048] When an anomaly status indicator indicates that a data flow is a sudden, faulty flow, the edge gateway queries the pre-defined list of isolated forwarding channels in its routing table and directly redirects the faulty flow to a standby processing node cluster that is physically isolated from the regular service links. The edge gateway maintains a static routing table and a dynamic forwarding rule table locally. The routing table contains regular forwarding entries and a list of isolated forwarding channels. The list of isolated forwarding channels and regular forwarding entries are independent of each other and have no address mapping association. When an anomaly status indicator indicates that a data flow is a sudden, faulty flow, the edge gateway terminates the regular forwarding process corresponding to that data flow, does not write the data flow into the forwarding queue corresponding to the regular service link, directly queries the list of available forwarding channels, modifies the Layer 2 forwarding address of the data flow based on the found forwarding channel information, and sends the faulty flow to the standby processing node cluster through a physical network interface physically isolated from the regular service links. There is no physical layer or data link layer network connection between the standby processing node cluster and the regular processing node cluster, achieving complete physical isolation and preventing the traffic impact of the faulty flow from spreading to the regular service links.

[0049] When the abnormal status indicator indicates that the data flow is a regular periodic flow, the edge gateway performs minimum connection load balancing distribution based on the real-time connection count of each destination node in the regular service link. When the abnormal status indicator indicates that the data flow is a regular periodic flow, the edge gateway writes the data flow into the forwarding queue corresponding to the regular service link. Simultaneously, it obtains the real-time connection count information of all available destination nodes in the regular service link. This real-time connection count information represents the number of Transmission Control Protocol (TCP) connections currently being processed by the destination node, reflecting the current load status of the destination node. The edge gateway compares the real-time connection counts of all available destination nodes and selects the destination node with the smallest real-time connection count as the next hop for forwarding this regular periodic flow. The data flow segment is then sent to this destination node, achieving minimum connection load balancing distribution and ensuring that the load of each destination node in the regular service link is balanced.

[0050] Table 1 Correspondence between Industrial Data Flow Characteristics and Forwarding Processing Rules

[0051] low volatility No mutation Regular periodic flow Second abnormal status indicator Minimum Connections Distribution for Regular Business Links low volatility slight mutation Regular periodic flow Second abnormal status indicator Minimum Connections Distribution for Regular Business Links low volatility Sudden increase mutation Regular periodic flow Second abnormal status indicator Minimum Connections Distribution for Regular Business Links Medium fluctuation No mutation Regular periodic flow Second abnormal status indicator Minimum Connections Distribution for Regular Business Links Medium fluctuation slight mutation Regular periodic flow Second abnormal status indicator Minimum Connections Distribution for Regular Business Links Medium fluctuation Sudden increase mutation Regular periodic flow Second abnormal status indicator Minimum Connections Distribution for Regular Business Links High volatility No mutation Regular periodic flow Second abnormal status indicator Minimum Connections Distribution for Regular Business Links High volatility slight mutation Regular periodic flow Second abnormal status indicator Minimum Connections Distribution for Regular Business Links High volatility Sudden increase mutation Fault burst flow First abnormal status indicator The isolated channel is redirected to the backup processing node cluster.

[0052] Table 1 clarifies the one-to-one correspondence between the fluctuation and mutation levels of input features, corresponding data stream types, abnormal state identifiers, and forwarding processing rules in this embodiment. This provides a clear matching basis for the forwarding decisions of the edge gateway, ensuring that all data streams can be matched with the corresponding processing flow without any matching logic loopholes. This embodiment completes feature extraction and abnormal state determination of the data stream at the data stream entry point of the edge gateway. Before the data stream enters the regular service forwarding queue, it performs traffic separation between fault-prone streams and regular periodic streams, directly redirecting fault-prone streams to a physically isolated backup processing node cluster. This avoids fault-prone streams crowding out the bandwidth and queue resources of regular service links. At the same time, the minimum number of connections rule is used for load balancing distribution of regular periodic streams to ensure the stable forwarding of regular service data streams.

[0053] In a preferred embodiment, reference Figure 2The edge gateway performs sliding window feature extraction on data stream segments, implemented using a circular cache queue built from local memory. The edge gateway allocates contiguous physical memory space in its local memory to construct a circular cache queue with its ends connected. The storage size of the circular cache queue is configured based on the maximum number of industrial devices connected to the industrial site and the maximum bandwidth of a single device's data stream, ensuring that the circular cache queue can accommodate all data stream segments uploaded by industrial devices within a preset time period. The edge gateway configures write and read pointers for the circular cache queue, both initially pointing to the start address of the circular cache queue. When a data stream segment uploaded by an industrial device is received, the edge gateway writes the data stream segment sequentially to the storage address pointed to by the write pointer, according to the chronological order. After each data stream segment is written, the write pointer moves forward by a preset step size. When the write pointer reaches the end address of the circular cache queue, it automatically jumps to the start address of the circular cache queue, achieving circular reuse of storage space. Both write and read pointer operations are implemented using atomic operations to avoid address contention issues during multi-channel concurrent access, ensuring consistency between data stream segment writing and reading.

[0054] The edge gateway configures an independent sliding window pointer for the circular buffer queue. The initial address of the sliding window pointer is consistent with the initial address of the read pointer. The edge gateway extracts a fixed-length sequence of data packets from the circular buffer queue by moving the sliding window pointer. Specifically, the sliding window pointer includes a window start pointer and a window end pointer. The number of data packets corresponding to the address space between the window start pointer and the window end pointer is the length of the data packet sequence extracted by the sliding window. The edge gateway periodically moves the window start pointer and the window end pointer according to a preset sliding step size. The sliding step size can be configured as a fixed proportion of the sliding window length to achieve overlapping sampling of the sliding window, avoiding the interruption of burst features of the data stream by the window boundary. After each sliding operation, a new sequence of data packets is extracted from the circular buffer queue as the feature extraction sample set for the current period.

[0055] For the captured data packet sequence, the edge gateway records the arrival timestamp of each data packet in the sequence. Let N be the total number of data packets in the sequence, and let the arrival timestamp of the i-th data packet be... The range of values ​​for i is 1. ,and This is a high-precision timestamp generated based on the edge gateway's local hardware clock. The difference in arrival timestamps between adjacent data packets is the arrival interval sample, and the i-th arrival interval sample... The calculation formula is:

[0056] Where the range of values ​​for i is... , Units and timestamps The units should be kept consistent.

[0057] Based on the obtained arrival interval sample set, the edge gateway calculates the mean of the arrival interval samples. The calculation formula is:

[0058] Based on the arrival interval samples and their corresponding means, the edge gateway calculates the variance of the arrival interval samples. That is, the variance of the data packet arrival interval, calculated using the following formula:

[0059] The magnitude of the value is positively correlated with the degree of fluctuation in the arrival time of data packets. The larger the value, the higher the degree of fluctuation in the arrival time of data packets and the stronger the burst characteristics of the data stream.

[0060] Synchronously, the edge gateway extracts the payload length of each data packet in the data packet sequence, and denotes the payload length of the i-th data packet as... The range of values ​​for i is 1. , The unit is bytes. The edge gateway calculates the absolute value of the difference between the payload length of the current data packet and the payload length of the preceding data packet to obtain the change in the payload length of a single data packet. The calculation formula is:

[0061] Where the range of values ​​for i is... When i=1, there is no preceding data packet in the sequence. The value of is 0.

[0062] The edge gateway accumulates the changes in payload length of all individual data packets in the data packet sequence to obtain the abrupt gradient of the data packet payload length. The calculation formula is:

[0063] The magnitude of the value is positively correlated with the degree of abrupt change in the length of the data packet payload. The larger the value, the higher the degree of abrupt change in the length of the payload in the data packet sequence, and the greater the difference between the payload characteristics of the data stream and the regular periodic stream.

[0064] Furthermore, during the process of capturing data packet sequences by moving the sliding window pointer, the edge gateway dynamically adjusts the length of the sliding window based on the current network throughput. The edge gateway monitors the total network throughput of all industrial Ethernet interfaces in real time, and the statistical period for network throughput is consistent with the sliding window's sliding period. The current network throughput obtained is denoted as R. The edge gateway pre-sets a throughput threshold. , determine the window scaling factor based on the relationship between the current network throughput rate R and the throughput rate threshold The calculation formula is as follows:

[0065]

[0066] where k is a preset proportionality coefficient, and its value range is 0 < k ≤ 1, which is used to adjust the sensitivity of the window length change with the throughput rate. The value of the proportionality coefficient is calibrated based on the data flow characteristics of the industrial site.

[0067] The edge gateway extracts the pre-configured basic window length The basic window length is the minimum number of data packet interceptions of the sliding window, which is calibrated based on the minimum sampling period of the regular periodic flow in the industrial site. Multiply the basic window length by the window scaling factor to obtain the dynamic window length The calculation formula is as follows:

[0068] where is the floor operation to ensure that the dynamic window length is a positive integer.

[0069] <00002c0>The edge gateway sets the address offset between the window start pointer and the window end pointer of the sliding window pointer according to the dynamic window length and intercepts a data packet sequence containing data packets in the circular buffer queue as the sample set for feature extraction. When the current network throughput rate is greater than the preset throughput rate threshold, the window scaling factor is a value greater than 1, and the dynamic window length is greater than the basic window length, which improves the accuracy of feature extraction by increasing the number of samples; when the current network throughput rate is less than or equal to the preset throughput rate threshold, the window scaling factor is a value equal to 1, and the dynamic window length is equal to the basic window length, which reduces the computational overhead of the edge gateway while ensuring the accuracy of feature extraction. <000023o>Table 2 Correspondence table of network throughput rate and sliding window parameters

[0071] Network throughput R and threshold Relationship Window scaling factor Range of values Dynamic window length Feature extraction sample size Calculate the cost level Basic sample size Low Medium sample size middle High sample size Medium and high High sample size high

[0072] Table 2 clarifies the correspondence relationship between the network throughput rate, window scaling factor, and dynamic window length in this embodiment, provides a quantitative basis for the dynamic adjustment of the sliding window parameters, can adapt to the feature extraction requirements under different network load conditions, and achieves a dynamic balance between the accuracy of feature extraction and the computational overhead.

[0073] This embodiment achieves circular caching and efficient reading of data stream segments through a circular buffer queue, avoiding the memory fragmentation and address reallocation overhead of conventional linear buffer queues. It achieves precise interception of data packet sequences through a sliding window pointer, and quantifies the variance of data packet arrival intervals and the gradient of payload length abrupt changes based on mathematical formulas to ensure the accuracy and repeatability of feature extraction. At the same time, it dynamically adjusts the length of the sliding window based on the current network throughput, improving the accuracy of feature extraction in high-throughput scenarios and reducing computational overhead in low-throughput scenarios, thus achieving adaptive optimization of the feature extraction process.

[0074] In a preferred embodiment, reference Figure 3 The process by which the edge gateway inputs the variance and abrupt gradient into a pre-defined abnormal operating condition judgment model and outputs anomaly status identifiers for data stream segments is based on pre-defined feature interval mapping rules. The abnormal operating condition judgment model pre-stores multiple sets of feature interval mapping rules. These rules are calibrated based on historical feature data of regular cyclical flows and sudden fault flows in the industrial field. The calibration process covers data stream characteristics under all operating conditions in the industrial field, ensuring the accuracy and adaptability of interval division.

[0075] The feature interval mapping rule calculates the variance of the data packet arrival interval. The data is divided into three consecutive numerical intervals: a stable interval, a fluctuating interval, and a highly fluctuating interval. The edge gateway has a pre-set first variance threshold. With the second threshold of variance ,in Both thresholds are calibrated based on the quantiles of the historical variance values ​​of the regular periodic flow. The rule for dividing the three intervals is as follows: when When the variance value is in a stable range, the corresponding data packet arrival time shows no significant fluctuation; when When the variance value is within the fluctuation range, the arrival time of the corresponding data packets fluctuates to some extent but does not exceed the normal range; when When the variance value is in a range of violent fluctuations, the arrival time of the corresponding data packets fluctuates greatly, which is consistent with the arrival time characteristics of fault burst flows.

[0076] Simultaneously, the feature interval mapping rule maps the abrupt gradient of the packet payload length. The data is divided into three consecutive numerical intervals: no sudden change interval, slight sudden change interval, and steep increase sudden change interval. The edge gateway pre-sets a first threshold for the gradient. With gradient second threshold ,in Both thresholds are calibrated based on the quantiles of the historical abrupt change gradient of a regular periodic flow. The rule for dividing the three intervals is as follows: when When the mutation gradient is in the no-mutation region, the corresponding data packet payload length does not change significantly; when When the mutation gradient is in the range of slight mutation, the corresponding data packet payload length shows some change but does not exceed the normal range; when At this time, the mutation gradient is in the steeply increasing mutation range, which corresponds to a large change in the data packet payload length, consistent with the payload characteristics of fault burst flow.

[0077] The edge gateway extracts the target variance interval where the currently calculated variance value lies, and the target gradient interval where the abrupt gradient lies, and combines and matches the target variance interval and the target gradient interval. The edge gateway assigns a unique interval code to each variance interval and gradient interval, combines the code of the target variance interval with the code of the target gradient interval to generate a combined code, and obtains the matching result based on the preset mapping relationship between the combined code and the abnormal state identifier. If the matching result is a combination of a drastic fluctuation interval and a steeply increasing abrupt interval, a first abnormal state identifier representing a sudden fault flow is generated; otherwise, a second abnormal state identifier representing a normal periodic flow is generated. The generation logic of the abnormal state identifier is quantitatively described by the following formula:

[0078] in, This is an abnormal status indicator. The first abnormal state identifier represents a sudden fault flow; The second abnormal state identifier represents a normal cyclical flow; This is a logical AND operation; the output is 1 only if both conditions are met.

[0079] Furthermore, after completing the combined matching of the target variance interval and the target gradient interval, the edge gateway sets up a continuous decision window to perform secondary verification on the combined matching results of multiple consecutive sliding windows, avoiding misjudgments caused by errors in a single feature extraction. The edge gateway sets up an independent continuous decision window for the data stream corresponding to each industrial device. The length of the continuous decision window is M, meaning it continuously records the combined matching results corresponding to M sliding windows, where M is a preset positive integer with a value range of 3 ≤ M ≤ 10. The edge gateway writes the combined matching results corresponding to each sliding window sequentially into the cache space corresponding to the continuous decision window according to the sliding window's sliding period. When the continuous decision window is full, statistical analysis is performed on all combined matching results within the window. The cumulative number of first abnormal state identifiers within the continuous decision window is recorded. The calculation formula is:

[0080] in, Let j be the abnormal state identifier corresponding to the j-th sliding window, where the value of j ranges from 1 to 2. .

[0081] when When all matching results within a continuous decision window indicate the first abnormal state, the edge gateway determines that the data stream is a continuous fault burst, locks the source Internet Protocol (IP) address corresponding to the data stream, and writes the source IP address into a locally maintained dynamic isolation list. The dynamic isolation list is stored using a hash table structure, with the source IP address as the hash key, achieving a fixed time complexity for address lookup. The edge gateway sets an aging timer for each source IP address in the dynamic isolation list. If no data packet is received from that source IP address within the preset aging time, the source IP address is removed from the dynamic isolation list, preventing the storage space of the isolation list from expanding indefinitely. When a subsequent data packet carrying that source IP address is received, the edge gateway directly queries the dynamic isolation list based on the source IP address of the data packet. If a matching record is found, the calculation process of the abnormal condition determination model is skipped, and the data packet is directly redirected to the standby processing node cluster, reducing the processing overhead of the edge gateway for duplicate abnormal data.

[0082] Furthermore, during the recording of combined matching results across multiple consecutive sliding windows, if some combined matching results within a consecutive decision window are identified as second abnormal states, and the interval containing the abrupt change gradient corresponding to this second abnormal state is a steeply increasing abrupt change interval, the edge gateway extracts the variance value corresponding to this second abnormal state and corrects the combined matching results of the consecutive decision window. The edge gateway iterates through all combined matching results within the consecutive decision window and filters out... Extract the mutation gradient corresponding to the record corresponding to the second abnormal state identifier. With variance If the record corresponds to That is, the mutation gradient is in the steeply increasing mutation region, and If the variance value is less than the lower limit of the drastic fluctuation range, the edge gateway will record the corresponding value. The value is corrected to 1, which represents the first abnormal state. The correction logic is quantified using the following formula:

[0083] in, This is the abnormal state identifier for the j-th sliding window after correction.

[0084] After correcting all eligible records, the edge gateway recounts the cumulative number of corrected first abnormal state identifiers within the continuous decision window. The calculation formula is:

[0085] when When this happens, the edge gateway corrects the combined matching results of the continuous judgment window to the first abnormal state identifier. Based on the corrected first abnormal state identifier, it redirects the corresponding data stream to the backup processing node cluster and writes the source Internet Protocol address corresponding to the data stream into the dynamic isolation list. This correction mechanism can avoid the failure of sudden flow detection due to instantaneous fluctuations in variance value, and improve the comprehensiveness and accuracy of abnormal condition detection.

[0086] Table 3. Matching Results of Combined Variance Intervals and Gradient Intervals

[0087] Stable range No mutation region 00 0 Regular periodic flow Stable range Slight mutation region 01 0 Regular periodic flow Stable range steep increase in mutation range 02 0 Regular periodic flow Fluctuation range No mutation region 10 0 Regular periodic flow Fluctuation range Slight mutation region 11 0 Regular periodic flow Fluctuation range steep increase in mutation range 12 0 Regular periodic flow Range of violent fluctuations No mutation region 20 0 Regular periodic flow Range of violent fluctuations Slight mutation region 21 0 Regular periodic flow Range of violent fluctuations steep increase in mutation range 22 1 Fault burst flow

[0088] Table 3 clarifies the matching results, abnormal state identifiers, and data stream types corresponding to all combinations of variance intervals and gradient intervals in this embodiment, covering all possible feature combination scenarios. It provides a complete matching basis for the generation of abnormal state identifiers, ensuring that the abnormal judgment process of the edge gateway is logically rigorous and free of matching loopholes.

[0089] This embodiment achieves accurate judgment of abnormal operating conditions through interval division and combination matching logic. The interval threshold is calibrated based on historical data from the industrial site to ensure that the judgment logic is adapted to the data flow characteristics of the industrial scenario. The matching results of multiple sliding windows are statistically verified through continuous judgment windows to reduce the probability of misjudgment caused by single feature extraction errors. At the same time, correction logic is set to correct the matching results that meet specific conditions to avoid missed judgment of sudden fault flows. The rapid forwarding of repeated abnormal data flows is achieved through a dynamic isolation list, which reduces the computational overhead of the edge gateway and improves the processing efficiency of abnormal data flows.

[0090] In a preferred embodiment, reference Figures 4 to 6 The edge gateway executes corresponding forwarding processes for data streams with different abnormal status identifiers. The redirection process for fault-prone streams is implemented based on the list of isolated forwarding channels maintained in the local routing table, while the load balancing distribution process for regular periodic streams is implemented based on the real-time connection count statistics of the destination node.

[0091] The edge gateway maintains independent regular forwarding entries and isolated forwarding channel lists in its local routing table. Regular forwarding entries are used for forwarding regular periodic flows, recording forwarding information such as the Internet Protocol address, Media Access Control address, and outgoing port identifier of each destination node in the regular service link. The isolated forwarding channel list is used for redirecting fault-prone flows, recording information such as the Media Access Control address, isolated outgoing port identifier, status field, and priority number of multiple backup processing node clusters. The physical network interface corresponding to the isolated outgoing port identifier in the isolated forwarding channel list and the physical network interface corresponding to the outgoing port identifier in the regular forwarding entry are independent physical Ethernet interfaces on the edge gateway. There is no Layer 2 forwarding association between the two physical network interfaces, and they are connected to physically isolated backup processing node clusters and regular processing node clusters, respectively, achieving physical layer isolation between fault-prone flows and regular periodic flows.

[0092] When a data flow is determined to be a fault-prone flow, the edge gateway terminates the regular forwarding process for that data flow, does not write it into the forwarding queue of the regular service link, and removes the original destination Media Access Control (MAC) address and Internet Protocol (IP) address from the fault-prone flow. Based on the records in the isolated forwarding channel list, it selects the highest-priority available backup processing node cluster as the first backup processing node cluster, modifies the destination MAC address of the fault-prone flow to the MAC address corresponding to the first backup processing node cluster, and simultaneously adds a preset isolated VLAN tag to the Ethernet frames of the fault-prone flow. The VLAN identifier of the isolated VLAN tag does not overlap with the VLAN identifier used in the regular service link, and the forwarding devices corresponding to the regular service link do not have forwarding rules configured for this isolated VLAN identifier, thus avoiding Layer 2 aliasing of the data flow. After completing the address modification and tag addition, the edge gateway sends the fault-prone flow to the first backup processing node cluster through the physical network port corresponding to the isolated outgoing port identifier.

[0093] Furthermore, before sending the fault burst traffic to the first backup processing node cluster, a bidirectional link status detection mechanism is established between the edge gateway and the first backup processing node cluster to monitor the availability of the forwarding link in real time. The edge gateway periodically sends detection probe messages to the first backup processing node cluster according to a preset detection cycle. These detection probe messages are Layer 2 link probe messages, containing the edge gateway's identification information and sequence number. After sending the detection probe message, the edge gateway starts a timeout timer, waiting to receive a response message from the first backup processing node cluster. If the corresponding response message is received within the timeout timer's duration, the edge gateway determines that the forwarding link is available and marks the status field of the first backup processing node cluster in the isolated forwarding channel list as available. If no corresponding response message is received within the timeout timer's duration, the edge gateway determines that the detection has failed and records the number of consecutive detection failures. (Number of consecutive detection failures is not specified.) The update logic is quantitatively described by the following formula:

[0094]

[0095] in, The initial value is 0.

[0096] when If the edge gateway does not receive a response message within three consecutive detection cycles, it marks the status field of the first backup processing node cluster in the isolation forwarding channel list as unavailable. At the same time, according to the priority number in the isolation forwarding channel list, it queries the status fields of subsequent backup processing node clusters in turn, selects the second backup processing node cluster with an available status field as the new redirection target, and redirects all subsequent fault burst flows to the second backup processing node cluster to ensure that the forwarding of fault burst flows is not interrupted.

[0097] Simultaneously, when the data flow is determined to be a regular periodic flow, the edge gateway performs minimum connection load balancing distribution based on the real-time connection count of each destination node in the regular service link. The edge gateway establishes an independent connection counter for each destination node in the regular service link, with an initial value of 0. Whenever the edge gateway successfully sends a data packet of a regular periodic flow to that destination node and completes the Transmission Control Protocol (TCP) three-way handshake to establish a new data forwarding connection, the corresponding connection counter value is incremented by 1. Whenever the edge gateway receives a TCP four-way handshake acknowledgment message from that destination node, confirming the corresponding data forwarding connection is closed, the corresponding connection counter value is decremented by 1. The connection counter value reflects the number of active TCP connections currently being processed by the destination node, i.e., the real-time connection count. The edge gateway periodically checks the liveness status of destination nodes in the regular service link. If a destination node does not respond for several consecutive detection cycles, it is marked as unavailable and excluded from load balancing distribution to prevent data packets from being sent to unavailable nodes.

[0098] When distributing regular periodic flows, the edge gateway reads the current value of the connection counters corresponding to all available destination nodes in the regular service link, compares all the current values, selects the destination node with the smallest current value as the target destination node, sets the next-hop address of the regular periodic flow to the address of the target destination node, and sends the regular periodic flow to the target destination node. If multiple destination nodes have the same current value of connection counters and all are at the minimum value, the edge gateway selects one of the destination nodes in turn as the target destination node according to a preset round-robin rule to ensure that the load of each destination node remains balanced.

[0099] Furthermore, the process of the edge gateway reading the current value of the connection counter corresponding to the destination node is implemented through hardware logic, using a status register to count and read the connection count. The edge gateway configures an independent hardware status register for each destination node in a regular service link. The bit width of the status register is consistent with the maximum number of Transmission Control Protocol (TCP) port numbers supported by the destination node. Each bit in the status register maps to a different TCP port number of the destination node, and the value of each bit represents the connection status of the corresponding TCP port number. The edge gateway assigns a unique bit offset to each TCP port number, establishing a fixed mapping relationship between the TCP port number and the bit offset, which is stored in a local mapping table.

[0100] Whenever the edge gateway successfully establishes a new data forwarding connection to a specific Transmission Control Protocol (TCP) port number of the destination node, the edge gateway queries the mapping table to obtain the bit offset corresponding to that TCP port number and sets the value of the corresponding bit in the status register to 1. Whenever the data forwarding connection corresponding to that specific TCP port number is closed, the edge gateway sets the value of the corresponding bit in the status register to 0. The edge gateway performs parallel counting of all bits in the status register using hardware logic gates, and uses the total number of bits with a value of 1 as the current value of the connection count counter for that destination node. This value is read directly through the hardware bus, without requiring software calculations by the central processing unit, thus improving the speed of obtaining the connection count. (Destination node real-time connection count) The statistical formula is:

[0101] in, is the real-time connection count corresponding to the destination node, i.e., the current value of the connection count counter; B is the total bit width of the status register; #imgpt91# is the value of the b-th bit in the status register, which can be 0 or 1.

[0102] Table 4. Parameter Structure Table for Isolated Forwarding Channels

[0103] 1 First backup processing node cluster address First isolated output port Preset isolated virtual LAN identifier Available / Unavailable 2 Second backup processing node cluster address Second isolation output port Preset isolated virtual LAN identifier Available / Unavailable 3 Third backup processing node cluster address Third isolation output port Preset isolated virtual LAN identifier Available / Unavailable 4 Fourth backup processing node cluster address Fourth isolated output port Preset isolated virtual LAN identifier Available / Unavailable

[0104] Table 4 clarifies the parameter structure, field meanings, and sorting rules of the isolated forwarding channel list in this embodiment, providing complete forwarding information for the redirection of fault burst flows, ensuring that the edge gateway can quickly query and select available redirection targets according to priority, and guaranteeing the continuity and stability of fault burst flow forwarding.

[0105] This embodiment achieves isolation of forwarding rules between fault-prone flows and regular periodic flows through independent regular forwarding table entries and isolated forwarding channel lists. By modifying the destination medium access control address, adding an isolated virtual LAN tag, and using an independent physical network port, complete physical isolation between fault-prone flows and regular service links is achieved, preventing the traffic impact of fault-prone flows from spreading to regular service links. A bidirectional link status detection mechanism monitors the availability of backup forwarding links in real time to ensure the forwarding continuity of fault-prone flows. For regular periodic flows, hardware status registers enable rapid statistics and reading of the real-time connection count of destination nodes, improving the response speed of minimum connection load balancing decisions and ensuring efficient and stable load balancing distribution of regular service links.

Claims

1. A network load balancing method based on industrial data analysis, characterized in that, include: The edge gateway caches data stream segments uploaded by various industrial devices in real time, performs sliding window feature extraction on the data stream segments, and calculates the variance of the data packet arrival interval and the abrupt gradient of the data packet payload length within the sliding window. The edge gateway inputs the variance value and the mutation gradient into a preset abnormal condition judgment model and outputs an abnormal state identifier for the data stream segment. When the abnormal status identifier indicates that the data flow is a fault burst flow, the edge gateway queries the preset list of isolation forwarding channels in the routing table and directly redirects the fault burst flow to a standby processing node cluster that is physically isolated from the regular service link; When the abnormal status identifier indicates that the data stream is a regular periodic stream, the edge gateway performs minimum connection load balancing distribution according to the real-time connection number of each destination node in the regular service link.

2. The network load balancing method based on industrial data analysis according to claim 1, characterized in that, The step of performing sliding window feature extraction on the data stream segments includes: the edge gateway constructs a circular cache queue with the first and last ends connected in its local memory, and writes the received data stream segments into the circular cache queue in chronological order. The edge gateway is configured with a sliding window pointer, which is used to extract a fixed-length sequence of data packets from the circular buffer queue by moving the sliding window pointer. For the data packet sequence, the difference in arrival timestamps between adjacent data packets is recorded as an arrival interval sample, and the variance of the arrival interval sample is calculated to obtain the variance of the data packet arrival interval. Extract the payload length of each data packet in the data packet sequence, calculate the absolute value of the difference between the payload length of the current data packet and the payload length of the previous data packet, and sum the absolute values ​​to obtain the abrupt gradient of the payload length of the data packet.

3. The network load balancing method based on industrial data analysis according to claim 1, characterized in that, The edge gateway inputs the variance value and the mutation gradient into a preset abnormal operating condition judgment model, including: the abnormal operating condition judgment model includes multiple preset feature interval mapping rules, the feature interval mapping rules divide the variance value into a stable interval, a fluctuating interval and a violently fluctuating interval, and divide the mutation gradient into a no-mutation interval, a slight mutation interval and a steeply increasing mutation interval; The edge gateway extracts the target variance interval where the currently calculated variance value is located and the target gradient interval where the abrupt gradient is located, and combines and matches the target variance interval and the target gradient interval. If the matching result is a combination of the violent fluctuation range and the steep increase mutation range, then a first abnormal state identifier representing the fault sudden flow is generated; otherwise, a second abnormal state identifier representing the normal periodic flow is generated.

4. The network load balancing method based on industrial data analysis according to claim 1, characterized in that, The edge gateway queries the preset list of isolated forwarding channels in the routing table and directly redirects the fault burst flow to a backup processing node cluster that is physically isolated from the regular service link. This includes: the edge gateway maintaining regular forwarding table entries and the list of isolated forwarding channels in the local routing table. The list of isolated forwarding channels records the media access control addresses and isolated outgoing port identifiers of multiple backup processing node clusters. When the data stream is determined to be the fault burst stream, the edge gateway strips the original destination address of the fault burst stream, modifies the destination medium access control address of the fault burst stream to the medium access control address corresponding to the first backup processing node cluster according to the record in the isolated forwarding channel list, and after tagging the fault burst stream with an isolated virtual LAN label, sends it to the first backup processing node cluster through the physical network port corresponding to the isolated outgoing port identifier.

5. The network load balancing method based on industrial data analysis according to claim 1, characterized in that, The edge gateway performs minimum connection load balancing distribution according to the real-time connection count of each destination node in the regular service link, including: the edge gateway establishes a connection count counter for each destination node in the regular service link, increments the value of the corresponding connection count counter by 1 whenever a data packet of a regular periodic stream is successfully sent to the destination node, and decrements the value of the corresponding connection count counter by 1 whenever an acknowledgment message is received from the destination node. When distributing the regular periodic flow, the edge gateway reads the current value of the connection counter corresponding to all the destination nodes, compares the size of the current value, selects the target destination node with the smallest current value as the next hop for forwarding the regular periodic flow, and sends the regular periodic flow to the target destination node.

6. The network load balancing method based on industrial data analysis according to claim 3, characterized in that, After combining and matching the target variance interval with the target gradient interval, the method further includes: the edge gateway setting a continuous decision window to record the combined matching results of multiple consecutive sliding windows; When all the combined matching results within the continuous determination window are the first abnormal state identifier, the edge gateway locks the source Internet Protocol address of the fault burst flow and writes the source Internet Protocol address into the dynamic isolation list. When a data packet carrying the source Internet Protocol address is subsequently received, the edge gateway directly skips the calculation process of the abnormal working condition judgment model, queries the dynamic isolation list, and redirects the data packet to the backup processing node cluster.

7. The network load balancing method based on industrial data analysis according to claim 2, characterized in that, The step of extracting a fixed-length sequence of data packets from the circular buffer queue by moving the sliding window pointer includes: the edge gateway detecting the current network throughput and determining a window scaling factor based on the current network throughput; The edge gateway extracts the base window length and multiplies the base window length by the window scaling factor to obtain the dynamic window length; The edge gateway sets the step size of the sliding window pointer according to the dynamic window length, and extracts a sequence of data packets containing the number corresponding to the dynamic window length from the circular buffer queue. When the current network throughput is greater than a preset throughput threshold, the window scaling factor is a value greater than 1, and when the current network throughput is less than or equal to the preset throughput threshold, the window scaling factor is a value equal to 1.

8. The network load balancing method based on industrial data analysis according to claim 4, characterized in that, Before sending the fault burst flow to the first backup processing node cluster through the physical network port corresponding to the isolated outgoing port identifier after tagging it with an isolated virtual local area network, the method further includes: establishing a bidirectional link state detection mechanism between the edge gateway and the first backup processing node cluster, periodically sending detection and probe messages to the first backup processing node cluster and receiving response messages returned by the first backup processing node cluster. If the response message is not received within three consecutive detection cycles, the edge gateway marks the status field of the first backup processing node cluster in the isolated forwarding channel list as unavailable, and selects the second backup processing node cluster with an available status field as the redirection target according to the order of the isolated forwarding channel list.

9. The network load balancing method based on industrial data analysis according to claim 5, characterized in that, The edge gateway reads the current value of the connection counter corresponding to all the destination nodes, including: the edge gateway configures a status register for each destination node, and each bit of the status register maps to a different transmission control protocol port number of the destination node; Whenever a new data forwarding connection is established to a specific Transmission Control Protocol (TCP) port number of the destination node, the edge gateway sets the value of the corresponding bit in the status register to 1, and whenever the connection to the specific TCP port number is closed, it sets the value of the corresponding bit to 0. The edge gateway uses hardware logic to count the values ​​of all bits in the status register, and uses the count of '1's as the current value of the connection counter corresponding to the destination node.

10. The network load balancing method based on industrial data analysis according to claim 6, characterized in that, In the process of recording the combined matching results of multiple consecutive sliding windows, the method further includes: if some of the combined matching results within the consecutive judgment window are the second abnormal state identifier, and the interval where the mutation gradient corresponding to the second abnormal state identifier is located is the steeply increasing mutation interval, the edge gateway extracts the variance value corresponding to the second abnormal state identifier. When the variance value is less than the lower limit of the violent fluctuation range, the edge gateway will correct the combined matching result of the continuous judgment window as the first abnormal state identifier. The edge gateway redirects the corresponding data stream to the backup processing node cluster based on the corrected first abnormal state identifier, and writes the source Internet Protocol address into the dynamic isolation list.

Images