Website node automatic operation and maintenance system combined with edge computing

Abstract

This invention relates to the field of edge computing technology, specifically to an automated operation and maintenance system for website nodes that integrates edge computing. The system includes an edge autonomous gateway and a central cloud management platform. The edge autonomous gateway collects the processor queue length and network protocol stack retransmission rate of directly connected website nodes in real time; its built-in local timing deviation calculation engine uses a sliding window to extract the product of the queue length variance and the retransmission rate within a continuous time slice as a comprehensive anomaly evaluation value; when the evaluation value exceeds a preset static threshold, the edge autonomous gateway directly modifies its local forwarding table to redirect inbound requests to redundant nodes within the same edge cluster, and reports an alarm through the out-of-band network using the truncated anomaly feature vector; the central cloud management platform receives the vector and performs a static baseline update of the global routing policy. This invention decentralizes anomaly detection and traffic switching to the network access layer, reducing the link bandwidth consumption caused by status data backhaul during fault periods.

Description

Technical Field

[0001] This invention relates to the field of edge computing technology, and more specifically to an automated operation and maintenance system for website nodes that incorporates edge computing. Background Technology

[0002] Current website node operation and maintenance systems generally adopt a centralized monitoring and scheduling architecture. In a typical implementation, monitoring agents deployed at various edge sites collect full operational status data of website nodes in real time, including CPU utilization, memory consumption, network throughput, and system logs. This collected raw monitoring data is continuously transmitted back to the remote data center via the uplink transmission link. After receiving the massive amount of data, the centralized analysis server deployed in the data center runs a centralized anomaly detection model to periodically evaluate the status of each node. When the centralized analysis server determines that a certain edge website node has failed, it generates corresponding node isolation and traffic scheduling instructions. These instructions are distributed tier by tier through the core network routing equipment to the edge routers to which the failed website node belongs. The edge routers then modify their local routing tables, redirecting user access requests originally destined for the failed node to other healthy nodes.

[0003] In the centralized operation and maintenance architecture described above, when edge website nodes experience sudden anomalies such as local network congestion or process deadlock, the uplink backhaul link itself is affected by congestion. This causes packet loss or severe queuing delays in the transmission of the full operational status data collected by the monitoring agent, resulting in a time lag in the status information received by the data center. After the centralized analysis server completes the anomaly determination and generates scheduling instructions based on the delayed status information, the instructions again travel through a long downlink transmission link to reach the edge router. This mechanism, relying on remote closed-loop control, results in an excessively long overall time from the occurrence of an anomaly to the completion of traffic switching. Furthermore, the continuous backhaul of the full original data during congestion further exacerbates the already fragile uplink bandwidth burden, leading to even more severe data packet loss. Summary of the Invention

[0004] The purpose of this invention is to provide an automated operation and maintenance system for website nodes that incorporates edge computing, which can solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] An automated operation and maintenance system for website nodes combining edge computing includes an edge autonomous gateway deployed at the access layer of a website edge computing node cluster and a central cloud management and control platform communicatively connected to the edge autonomous gateway. The edge autonomous gateway collects the processor run queue length and network protocol stack retransmission rate of directly connected website nodes in real time. The edge autonomous gateway has a built-in local timing deviation calculation engine. The local timing deviation calculation engine uses a sliding window to extract the product of the variance of the processor run queue length and the network protocol stack retransmission rate within a continuous time slice as a comprehensive anomaly evaluation value. When the comprehensive anomaly evaluation value exceeds a preset static threshold, the edge autonomous gateway directly modifies the local forwarding table to redirect inbound requests pointing to the abnormal website node to redundant nodes in the same edge cluster. At the same time, it reports the truncated anomaly feature vector to the central cloud management and control platform through an out-of-band network. The central cloud management and control platform receives the anomaly feature vector, performs a static baseline update of the global routing policy, and then distributes it to other non-faulty edge autonomous gateways.

[0007] Preferably, the local timing deviation calculation engine is deployed with a memory-state time slice partitioning register, which divides the system clock cycle into multiple consecutive time slices of equal length. At the beginning of each consecutive time slice, the local timing deviation calculation engine locks the instantaneous value of the current processor run queue length and the accumulated value of the network protocol stack retransmission rate. When the multiple consecutive time slices covered by the sliding window end, the local timing deviation calculation engine calculates the variance of the instantaneous values ​​of the processor run queue length corresponding to all the covered consecutive time slices, and multiplies the variance by the accumulated value of the network protocol stack retransmission rate corresponding to the last consecutive time slice in the sliding window to generate the comprehensive anomaly evaluation value.

[0008] Preferably, the memory-mode time slice partitioning register is configured with a dynamic step size adjustment pointer. The dynamic step size adjustment pointer is directly connected to the central processing unit interrupt controller of the directly connected website node through a hardware pin. When the number of times the central processing unit interrupt controller triggers a hard interrupt signal in the current continuous time slice reaches a preset interrupt threshold, the dynamic step size adjustment pointer shortens the duration of the next continuous time slice to 1 / 2 of the original duration. When the local timing deviation calculation engine detects that the duration of the continuous time slice has been shortened, it clears the instantaneous value of the processor run queue length and the accumulated value of the network protocol stack retransmission rate corresponding to the continuous time slice farthest from the current time in the sliding window.

[0009] Preferably, the edge autonomous gateway internally maintains an edge cluster topology adjacency table. The edge cluster topology adjacency table records the remaining memory capacity and CPU load rate of each redundant node in the same edge cluster. When the comprehensive anomaly evaluation value exceeds the preset static threshold, the edge autonomous gateway traverses the edge cluster topology adjacency table, calculates the difference between the remaining memory capacity and the CPU load rate of each redundant node, and determines the redundant node with the largest difference as the target redirection node. The edge autonomous gateway adds a destination media access control address mapping entry pointing to the target redirection node to the local forwarding table.

[0010] Preferably, the edge autonomous gateway is deployed with a Transmission Control Protocol (TCP) State Synchronization (SSY) agent. Before the edge autonomous gateway adds the destination MTAC address mapping entry to the local forwarding table, the TCPS SYN agent extracts the original TCP connection quadruple information corresponding to the inbound request. The TCPS SYN agent re-encapsulates the original TCP connection quadruple information and the Internet Protocol (IP) address of the target redirection node to generate state synchronization signaling. The edge autonomous gateway sends the state synchronization signaling to the target redirection node through an internal inter-process communication channel, so that the target redirection node pre-creates a session context in its local memory that matches the original TCP connection quadruple information.

[0011] Preferably, the out-of-band network is a control plane virtual local area network channel independent of the data forwarding plane. The edge autonomous gateway is deployed with a feature truncating and reassembling device. The feature truncating and reassembling device extracts the original timing sequence of the processor run queue length and the network protocol stack retransmission rate at a fixed sampling interval within the time period covered by the sliding window. The feature truncating and reassembling device retains the feature fields of the first and last data packets in the original timing sequence and removes all intermediate timing data between the first and last data packets. The feature truncating and reassembling device concatenates the retained feature fields to generate the truncated abnormal feature vector and encapsulates the truncated abnormal feature vector into a customized Ethernet frame of the control plane virtual local area network channel.

[0012] Preferably, the edge autonomous gateway is configured with a ring buffer connected to the central processing unit interrupt controller. The ring buffer stores the timestamps of the hard interrupt signals. When the dynamic step size adjustment pointer determines that the number of times the hard interrupt signal is triggered reaches the preset interrupt threshold, it reads the time interval difference between two adjacent timestamps in the ring buffer. When the time interval difference is less than the microsecond-level determination threshold, the dynamic step size adjustment pointer further shortens the duration of the next continuous time slice to 1 / 4 of the original duration and triggers the local timing deviation calculation engine to send a buffer overflow alarm flag to the central cloud management platform.

[0013] Preferably, the target redirection node is deployed with a connection takeover responder. After receiving the state synchronization signaling and pre-creating the session context, the connection takeover responder returns a takeover response message carrying an acknowledgment sequence number to the edge autonomous gateway. When the edge autonomous gateway receives the takeover response message, it modifies the network address translation port mapping relationship corresponding to the original transmission control protocol connection quadtuple information recorded in the local forwarding table to a combination of the Internet Protocol address pointing to the target redirection node and the acknowledgment sequence number. After completing the modification of the network address translation port mapping relationship, the edge autonomous gateway discards subsequent inbound requests pointing to the abnormal website node.

[0014] Preferably, after generating the truncated anomalous feature vector, the feature truncation and reassembly unit calls the hardware security module built into the edge autonomous gateway. The hardware security module uses a preset symmetric encryption key to perform Advanced Encryption Standard (AES) operations on the truncated anomalous feature vector to generate ciphertext data. The hardware security module also calculates the hash message authentication code of the ciphertext data. The feature truncation and reassembly unit appends the hash message authentication code to the end of the ciphertext data and writes the ciphertext data carrying the hash message authentication code into the payload field of the custom Ethernet frame.

[0015] Preferably, the central cloud management platform is equipped with a key distribution center, which stores an asymmetric encryption public key that matches the hardware security module. During the startup phase of the edge autonomous gateway, the key distribution center generates the symmetric encryption key, encrypts it using the asymmetric encryption public key, and then sends it to the hardware security module. The hardware security module decrypts the symmetric encryption key using the locally stored asymmetric encryption private key. The key distribution center generates a new symmetric encryption key according to a preset key rotation cycle and sends the new symmetric encryption key to the hardware security module through the control plane virtual LAN channel to overwrite the previous version of the symmetric encryption key.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0017] 1. This invention embeds a local timing deviation calculation engine within the edge autonomous gateway. It utilizes a sliding window to extract the product of the processor run queue length variance and the network protocol stack retransmission rate within consecutive time slices to generate a comprehensive anomaly evaluation value. When the evaluation value exceeds a threshold, it directly modifies the local forwarding table to execute traffic redirection. This offloads the anomaly detection and traffic switching logic from the central cloud to the network access layer closest to the website node. This mechanism breaks the long-link closed loop of conventional technologies that rely on remote data backhaul and command issuance, eliminates the uplink bandwidth occupation caused by full state data backhaul in abnormal states, and shortens the traffic switching response time when local sudden anomalies occur.

[0018] 2. This invention utilizes a memory-based time-slice partitioning register combined with a dynamic step-size adjustment pointer to automatically shorten the duration of continuous time slices and adjust the amount of data covered by the sliding window when hardware interrupt signals are frequently triggered, adapting to the abnormal feature capture requirements in scenarios with high-frequency node interrupts. It selects redirection targets by traversing the edge cluster topology adjacency list to calculate the difference between the remaining memory capacity of redundant nodes and the CPU load rate, avoiding traffic intrusion that could overload the target nodes. It pre-creates session contexts before redirection using a Transmission Control Protocol (TCP) state synchronization proxy, maintaining the continuity of the underlying state of the access connection. The feature truncation and reassembly processor removes intermediate time-series data and retains only the first and last feature fields when generating reported data. This, combined with the hardware security module, performs advanced encryption standard operations and hash message authentication code calculations, ensuring the data anti-tampering capability of the transmission channel while reporting alarm data volume on the control plane. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating the overall process of local anomaly handling and global baseline update for an edge autonomous gateway, as provided in this embodiment of the invention.

[0020] Figure 2 This is a flowchart of the data processing of the local timing deviation calculation engine provided in an embodiment of the present invention;

[0021] Figure 3 A flowchart of continuous time slice dynamic step size adjustment provided in an embodiment of the present invention;

[0022] Figure 4 A flowchart of redundant node selection and TCP state synchronization provided for embodiments of the present invention;

[0023] Figure 5 A flowchart of abnormal feature vector truncation and encrypted transmission provided for embodiments of the present invention;

[0024] Figure 6 A flowchart illustrating the symmetric key generation, distribution, and rotation process provided in this embodiment of the invention. Detailed Implementation

[0025] In one embodiment, the automated operation and maintenance system for website nodes combined with edge computing includes an edge autonomous gateway and a central cloud management and control platform. The edge autonomous gateway is deployed at the access layer of the website edge computing node cluster. Each edge computing node cluster corresponds to at least one edge autonomous gateway. The Layer 2 forwarding port of the edge autonomous gateway is directly connected to all website nodes within the cluster. Website nodes are virtual or physical server nodes providing web services. Website nodes belonging to the same edge cluster and the edge autonomous gateway are in the same Layer 2 broadcast domain. The central cloud management and control platform is deployed in a remote core data center and establishes communication connections with all edge autonomous gateways through wide area network links. These communication links include data forwarding plane links and independent control plane links.

[0026] refer to Figure 1 The edge autonomous gateway collects real-time data on the processor run queue length and network protocol stack retransmission rate of directly connected website nodes. Specifically, the edge autonomous gateway and directly connected website nodes interact via a dedicated kernel-mode acquisition channel. Lightweight acquisition probes based on eBPF technology are deployed in the kernel of the directly connected website nodes. These probes are attached to the `sched_process_exec` hook function of the Linux kernel scheduling subsystem and the `tcp_retransmit_skb` hook function of the TCP protocol stack. The acquisition probes read the `nr_running` parameter in the kernel run queue in real-time through the `sched_process_exec` hook function. This parameter represents the number of processes waiting to be executed in the processor run queue at the current moment, i.e., the processor run queue length. The acquisition probes use the `tcp_retransmit_skb` hook function to count the number of retransmitted segments and the total number of sent segments in the TCP protocol stack, calculating the network protocol stack retransmission rate. The collected processor run queue length and network protocol stack retransmission rate data are directly shared to the edge autonomous gateway's acquisition module via memory mapping, without needing to be processed by user-mode processes, thus avoiding transmission latency and data jitter caused by context switching.

[0027] The edge autonomous gateway incorporates a local timing deviation calculation engine, deployed on a dedicated isolated core of the multi-core network processor within the edge autonomous gateway. This isolated core is used solely for anomaly detection-related computational tasks and does not participate in packet processing on the data forwarding plane, ensuring the real-time and deterministic nature of the computation process. The local timing deviation calculation engine employs a sliding window mechanism to extract processor run queue length and network protocol stack retransmission rate data within consecutive time slices. The sliding window length is a fixed N consecutive time slices, the value of which can be preset through the edge autonomous gateway's configuration interface. The storage area corresponding to the sliding window is allocated in the network processor's L2 cache, enabling low-latency data read and write operations.

[0028] The local timing deviation calculation engine calculates the variance of the instantaneous values ​​of the processor run queue lengths corresponding to all consecutive time slices covered by the sliding window. The specific calculation process is defined by the following formula:

[0029]

[0030] in, Let be the arithmetic mean of the instantaneous values ​​of the run queue lengths of N processors within the sliding window. is the instantaneous value of the processor run queue length corresponding to the i-th consecutive time slice within the sliding window, and N is the number of consecutive time slices covered by the sliding window.

[0031]

[0032] in, The variance of the instantaneous value of the processor run queue length within the sliding window is used to characterize the degree of fluctuation of the processor run queue length within the sliding window period.

[0033] The local timing deviation calculation engine multiplies the calculated variance by the cumulative retransmission rate of the network protocol stack corresponding to the last consecutive time slice within the sliding window to generate a comprehensive anomaly evaluation value. The specific calculation process is defined by the following formula:

[0034]

[0035] Where S is the comprehensive anomaly evaluation value, This is the cumulative retransmission rate of the network protocol stack corresponding to the Nth consecutive time slice within the sliding window.

[0036] The non-volatile storage area of ​​the edge autonomous gateway is pre-configured with static thresholds. These static thresholds are determined based on the 99.9th percentile of the comprehensive anomaly evaluation value of website nodes under historical normal operating conditions within the same cluster, and are used to distinguish between normal and abnormal operating conditions. When the comprehensive anomaly evaluation value exceeds the preset static threshold, the edge autonomous gateway determines that the corresponding directly connected website node is in an abnormal operating state and directly calls the driver of the forwarding chip to modify the local forwarding table. The local forwarding table is stored in the TCAM memory of the edge autonomous gateway's forwarding chip and contains forwarding table entries such as destination IP address, next-hop MAC address, egress port, and VLAN identifier. The edge autonomous gateway modifies the next-hop MAC address of the forwarding table entry pointing to the IP address of the abnormal website node to the MAC address of a redundant node within the same edge cluster, thereby redirecting inbound requests. The redundant node is a backup server node pre-deployed within the same edge cluster, providing the same web service content as the abnormal website node, directly connected to the edge autonomous gateway, and in normal operating condition.

[0037] While modifying the local forwarding table to perform redirection, the edge autonomous gateway generates a truncated anomaly feature vector and reports it to the central cloud management platform via the out-of-band network. The out-of-band network is a control plane transmission channel independent of the data forwarding plane, completely isolated from the data forwarding plane link, and has dedicated bandwidth resources, unaffected by data plane network congestion. The truncated anomaly feature vector is generated by the edge autonomous gateway's control plane processing module, retaining only the core feature fields before and after the anomaly occurs, removing redundant content from the full time-series data, and significantly reducing the length of the reported data.

[0038] The central cloud management platform receives truncated anomaly feature vectors reported by edge autonomous gateways, extracts core information such as the anomaly node identifier, the time of anomaly occurrence, and the comprehensive anomaly evaluation value, and updates the static baseline of the global routing policy. The static baseline of the global routing policy is stored in the central cloud management platform's network-wide node health status database, containing the health status identifiers, available node lists, and routing forwarding rules for all edge website nodes in the network. The central cloud management platform updates the health status identifier of the anomaly website node to unavailable, removes the node from the available node list, and adjusts the corresponding global routing forwarding rules. After completing the static baseline update, the central cloud management platform distributes the updated global routing policy static baseline to all other non-faulty edge autonomous gateways in the network via a reliable transmission protocol. Upon receiving the updated static baseline, the non-faulty edge autonomous gateways synchronously modify their local forwarding rules to avoid forwarding user access requests to the anomaly-stricken website node, thus achieving network-wide routing convergence.

[0039] In this embodiment, the definitions and sources of all parameters involved in the calculation of the comprehensive anomaly evaluation value are shown in the following table:

[0040] Table 1 Definition of Parameters for Calculating Comprehensive Anomaly Evaluation Value

[0041] Instantaneous value of the length of the on-chip processor run queue in the i-th consecutive time period The nr_running parameter of the direct-connect website node kernel scheduling subsystem Unsigned 32-bit integer The cumulative retransmission rate of the network protocol stack corresponding to the Nth consecutive time slice within the sliding window. The ratio of the number of retransmitted segments to the total number of segments sent in the TCP protocol stack of a directly connected website node. Single-precision floating-point type N Number of consecutive time slices covered by the sliding window Pre-configured fixed parameters of the edge autonomous gateway Unsigned 16-bit integer Arithmetic mean of the instantaneous values ​​of the processor run queue length within the sliding window Real-time calculation results of the local timing deviation calculation engine Single-precision floating-point type Variance of instantaneous value of processor run queue length within sliding window Real-time calculation results of the local timing deviation calculation engine Single-precision floating-point type S Comprehensive anomaly evaluation value Real-time calculation results of the local timing deviation calculation engine Double-precision floating-point Preset static threshold Pre-configuration parameters in the non-volatile storage of edge autonomous gateways Double-precision floating-point

[0042] The table above clarifies the physical meaning, value source, and data type of all parameters in the calculation process of the comprehensive anomaly evaluation value. Based on the parameter definitions in the table above, those skilled in the art can completely reproduce the calculation logic of the comprehensive anomaly evaluation value without creative labor.

[0043] In this embodiment, the execution logic of anomaly detection and traffic redirection is completed entirely locally on the edge autonomous gateway, without waiting for instructions from the central cloud management platform. This shifts the closed-loop control of anomaly handling from the remote central cloud to the network access layer closest to the website node, eliminating the link latency caused by full monitoring data backhaul and instruction issuance in a centralized architecture. It also avoids the uplink bandwidth occupation caused by full data backhaul in abnormal states.

[0044] In a preferred embodiment, the local timing deviation calculation engine is deployed with a memory-state time slice partitioning register. The memory-state time slice partitioning register is integrated into the system control module of the multi-core network processor of the edge autonomous gateway. It is directly connected to the processor core through the memory bus. The configuration space of the register is mapped to the physical memory address space of the processor. It can be configured and read directly through memory read and write instructions without the need for I / O bus interaction, thus reducing the latency of configuration operations.

[0045] refer to Figure 2 The memory-mode time slice partitioning register divides the system clock cycle into multiple consecutive time slices of equal length. The system clock is a high-precision clock synchronized between the edge autonomous gateway and directly connected website nodes via the 1588PTP protocol, with clock synchronization accuracy reaching the nanosecond level, ensuring complete consistency of the time base between the edge autonomous gateway and directly connected website nodes. The original duration of each consecutive time slice can be preset through the configuration field of the memory-mode time slice partitioning register, with a default value of 100 microseconds. At the beginning of each consecutive time slice, the memory-mode time slice partitioning register triggers the kernel-mode acquisition thread of the local timing deviation calculation engine via a hardware interrupt. This acquisition thread is set to the highest kernel priority, preempting all other user-mode and kernel-mode processes to ensure that data locking and reading are completed at the beginning of the time slice. The local timing deviation calculation engine locks the instantaneous value of the processor run queue length of the directly connected website node at the current moment in the acquisition thread, and simultaneously locks the accumulated value of the network protocol stack retransmission rate within the current consecutive time slice. The locking operation is implemented through memory atomic instructions to prevent data from being modified by the kernel during the reading process, ensuring the accuracy and timeliness of the acquired data.

[0046] The local timing deviation calculation engine reads the instantaneous values ​​of the processor run queue length locked in all consecutive time slices within the sliding window at the end of the window, calculates the corresponding variance, and simultaneously reads the accumulated value of the network protocol stack retransmission rate locked in the last consecutive time slice within the sliding window. The variance and the accumulated retransmission rate are multiplied to generate a comprehensive anomaly evaluation value. The sliding window's update mechanism is a first-in, first-out (FIFO) mechanism. When a new consecutive time slice ends, the newly acquired instantaneous values ​​of the processor run queue length and the accumulated value of the network protocol stack retransmission rate are written to the sliding window's storage area. Simultaneously, the acquired data corresponding to the earliest consecutive time slice within the sliding window is removed from the storage area, ensuring that the sliding window always covers the acquired data from the N consecutive time slices closest to the current time.

[0047] refer to Figure 3The memory-mode time slice partitioning register contains a dynamic step size adjustment pointer. This pointer, a programmable step size control field within the register, points to the configuration address space for the current continuous time slice duration. The dynamic step size adjustment pointer is directly connected to the CPU interrupt controller of the directly connected web node via a hardware pin, allowing it to receive hardware interrupt signals output by the CPU interrupt controller in real time. Hardware interrupt signals include hardware-triggered interrupts such as network interface interrupts, disk I / O interrupts, and timer interrupts from the web node. The triggering frequency of these hardware interrupt signals directly reflects the system load fluctuations of the web node.

[0048] The edge autonomous gateway is configured with a preset interrupt threshold, which is stored in the configuration field of the memory-based time slice partitioning register and used to trigger time slice duration adjustment operations. When the number of times the central processing unit interrupt controller triggers a hard interrupt signal within the current consecutive time slice reaches the preset interrupt threshold, the dynamic step size adjustment pointer generates a step size adjustment instruction, shortening the duration of the next consecutive time slice to half of the original duration. The number of times the hard interrupt signal is triggered within the current consecutive time slice is defined by the following formula:

[0049]

[0050] in, This represents the number of hard interrupt signals triggered within the current continuous time slice t. This is the indicator value of the hard interrupt signal during the k-th system clock cycle, when the hard interrupt signal is triggered. The value is 1, indicating that it is not triggered. The value is 0, and M is the total number of system clock cycles contained in the current continuous time slice t.

[0051] The local timing deviation calculation engine monitors the duration configuration field of consecutive time slices in the memory-state time slice partition register in real time. When it detects that the duration of a consecutive time slice has shortened, it performs a sliding window data cleanup operation, clearing the instantaneous value of the processor run queue length and the cumulative value of the network protocol stack retransmission rate corresponding to the consecutive time slice furthest from the current time in the sliding window. This ensures that the total time period covered by the sliding window will not be excessively extended due to the shortening of the time slice duration, thus avoiding an increase in the response delay of anomaly detection.

[0052] The edge autonomous gateway is configured with a circular buffer connected to the central processing unit's interrupt controller. This circular buffer is a hardware FIFO buffer integrated into the network processor's system control module. It is directly connected to the central processing unit's interrupt controller via hardware pins and can store the timestamps of hard interrupt signals in real time. The circular buffer has a storage depth of 1024 entries, with each entry storing the timestamp of a hard interrupt signal. The timestamp precision is in the nanosecond range. When the number of entries stored in the buffer reaches its limit, a newly written timestamp automatically overwrites the oldest timestamp entry in the buffer.

[0053] When the dynamic step size adjustment pointer determines that the number of hard interrupt signal triggers within the current continuous time slice has reached a preset interrupt threshold, it locks the circular buffer through hardware atomic operations, reads the occurrence timestamps of all hard interrupt signals stored in the buffer, and calculates the time interval difference between two adjacent occurrence timestamps. The specific calculation process is defined by the following formula:

[0054]

[0055] in, This represents the time interval difference between the j-th and (j+1)-th hard interrupt signals. Let be the timestamp of the j-th hard interrupt signal. This is the timestamp of the (j+1)th hard interrupt signal.

[0056] The non-volatile storage of the edge autonomous gateway is configured with a microsecond-level judgment threshold, with a default value of 1 microsecond, used to determine the density of hard interrupt signals. When the minimum value of the time interval difference between adjacent occurrence timestamps is less than the microsecond-level judgment threshold, the dynamic step size adjustment pointer generates a secondary step size adjustment instruction, further shortening the duration of the next consecutive time slice to 1 / 4 of the original duration. At the same time, the local timing deviation calculation engine is triggered to generate a buffer overflow alarm flag, which is appended to the truncated abnormal feature vector and reported to the central cloud management platform.

[0057] In this embodiment, the triggering conditions and corresponding execution actions for continuous time slice dynamic step size adjustment are shown in the table below:

[0058] Table 2. Rules for Adjusting Dynamic Step Size of Continuous Time Slices

[0059] Current number of hard interrupts triggered within the current continuous time slice Minimum time interval between adjacent hard interrupts Next consecutive time slice duration Sliding window data processing actions Additional execution actions Less than the preset interrupt threshold No judgment requirement Keep the original duration Normal first-in-first-out update none Greater than or equal to the preset interrupt threshold Greater than or equal to the microsecond-level judgment threshold 1 / 2 of the original duration Clear the data from the furthest time slice none Greater than or equal to the preset interrupt threshold Less than the microsecond-level judgment threshold 1 / 4 of the original duration Clear the data from the furthest time slice Report warning signs

[0060] The table above clearly defines all the triggering conditions, corresponding execution actions, and additional operations for dynamic step size adjustment. Those skilled in the art can fully reproduce the adaptive adjustment logic of continuous time slices based on the rules in the table above, without any creative effort.

[0061] In this embodiment, precise control of the acquisition time slice is achieved through the memory-state time slice partition register, and adaptive adjustment of the time slice duration is achieved by combining the dynamic step size adjustment pointer. In the case of sudden load scenarios where the website node experiences high-frequency hard interrupts, the granularity of the acquisition time slice can be shortened, and the sensitivity of abnormal feature capture can be improved. At the same time, through the dynamic cleaning of sliding window data, it is ensured that the response speed of anomaly detection will not decrease due to the adjustment of time slice granularity.

[0062] refer to Figure 4 In another preferred embodiment, the edge autonomous gateway maintains an edge cluster topology adjacency table internally. This table is stored in the edge autonomous gateway's memory using a hash table structure. The key of the hash table is the IP address of the redundant node, and the value is a set of attribute information for the corresponding redundant node. The edge autonomous gateway establishes a neighbor discovery mechanism with all redundant nodes within the same edge cluster through a link-layer discovery protocol. It sends heartbeat probe messages to all redundant nodes at a fixed interval of 1 second. Upon receiving the heartbeat probe message, a redundant node returns a response message carrying its remaining memory capacity, CPU load rate, and health status identifier. Upon receiving the response message, the edge autonomous gateway updates the corresponding entry in the edge cluster topology adjacency table in real time, ensuring the real-time nature of the redundant node attribute information stored in the adjacency table. The redundant nodes are backup server nodes within the same edge cluster that provide the same web service content as the abnormal website node. All redundant nodes are directly connected to the edge autonomous gateway and are within the same Layer 2 broadcast domain.

[0063] When the comprehensive anomaly evaluation value exceeds the preset static threshold, the edge autonomous gateway traverses all available redundant node entries in the edge cluster topology adjacency table, extracts the remaining memory capacity and CPU load rate parameters for each available redundant node, and calculates the difference between the remaining memory capacity and CPU load rate for each redundant node. The remaining memory capacity is the proportion of the current available memory capacity of the redundant node to the total physical memory capacity, and the CPU load rate is the average utilization rate of all CPU cores of the redundant node. Both parameters are standardized values ​​within the range of 0 to 1. The specific standardization process is defined by the following formula:

[0064]

[0065] in, Let i be the normalized remaining memory capacity of the i-th redundant node. Let be the current available memory capacity of the i-th redundant node. Let be the total physical memory capacity of the i-th redundant node.

[0066]

[0067] in, Let i be the normalized CPU load rate of the i-th redundant node. Let be the CPU core time currently used by the i-th redundant node. Let be the total CPU core time of the i-th redundant node.

[0068] The edge autonomous gateway calculates the difference between the remaining memory capacity of each redundant node and the CPU load rate. The specific calculation process is defined by the following formula:

[0069]

[0070] in, The difference in redirection priority is evaluated for the i-th redundant node. The larger the value, the more abundant the available resources of the redundant node, and the higher the redirection priority.

[0071] After traversing all available redundant nodes, the edge autonomous gateway determines the redundant node with the largest difference as the target redirection node. The specific target node selection process is defined by the following formula:

[0072]

[0073] in, This is the sequence number of the target redirection node. This is the set of all available redundant nodes in the edge cluster topology adjacency table.

[0074] After identifying the target redirection node, the edge autonomous gateway adds a destination media access control address mapping entry pointing to the target redirection node to its local forwarding table. The local forwarding table is stored in the TCAM memory of the edge autonomous gateway's forwarding chip. The newly added mapping entry sets the next-hop MAC address corresponding to the IP address of the abnormal website node to the MAC address of the target redirection node. All inbound requests matching the destination IP address will be directly forwarded to the target redirection node by the forwarding chip.

[0075] The edge autonomous gateway deploys a Transmission Control Protocol (TCP) state synchronization agent. This agent is a processing module deployed within the kernel-level TCP stack of the edge autonomous gateway, running in an isolated kernel thread. It can capture all TCP connection packets passing through the edge autonomous gateway in real time. Before adding a destination MTCP address mapping entry to the local forwarding table of the edge autonomous network, the TCP state synchronization agent extracts the original TCP connection quad-tuple information corresponding to the inbound request to be redirected. This connection quad-tuple information includes the source IP address, source port number, destination IP address, and destination port number, serving as a unique identifier for the TCP connection. The TCP state synchronization agent re-encapsulates the extracted original TCP connection quad-tuple information with the Internet Protocol address of the target redirection node to generate state synchronization signaling. The state synchronization signaling uses a custom binary format, including a signaling type identifier, an original connection quad-tuple field, a target node IP address field, a sequence number field, and a checksum field. The checksum field is used to verify the integrity of the signaling transmission process.

[0076] The edge autonomous gateway sends the generated state synchronization signaling to the target redirection node via an internal inter-process communication (IPC) channel. This IPC channel is implemented using Unix domain sockets and transmits data based on the TCP protocol, ensuring reliable signaling transmission. The target redirection node's kernel has a corresponding signaling processing module. Upon receiving the state synchronization signaling, it parses the original Transmission Control Protocol (TCP) connection quadruple information from the signaling and pre-creates a session context matching the original TCP connection quadruple information in its local memory TCP connection hash table. The session context includes all connection state information such as the TCP connection sequence number, acknowledgment number, window size, congestion control status, and slow start threshold, ensuring that the target redirection node can directly process subsequent packets for the corresponding TCP connection without needing to perform a three-way handshake again.

[0077] The target redirection node deploys a connection takeover responder, which is a kernel-level processing module running in the same kernel thread as the signaling processing module. After receiving state synchronization signaling and completing the pre-creation of the session context, the connection takeover responder generates a takeover response message. This message carries the acknowledgment sequence number from the pre-created session context, as well as a signaling processing result identifier. The connection takeover responder then returns the takeover response message to the Transmission Control Protocol (TCP) state synchronization agent of the edge autonomous gateway via the existing inter-process communication channel.

[0078] After receiving the takeover response message, the Transmission Control Protocol (TCP) state synchronization agent of the edge autonomous gateway parses the acknowledgment sequence number and signaling processing result identifier in the message. When the signaling processing result identifier indicates success, it calls the driver program of the edge autonomous gateway's Network Address Translation (NAT) module to modify the NAT port mapping relationship corresponding to the original TCP connection quadruple information recorded in the local forwarding table to a combination of the Internet Protocol (IP) address and acknowledgment sequence number pointing to the target redirection node. The NAT port mapping relationship is stored in the stateful NAT table of the edge autonomous gateway, including fields such as the original connection quadruple, the translated destination IP address, the translated destination port number, and the TCP sequence number offset. The modified mapping relationship converts the destination IP address of the original connection to the IP address of the target redirection node. Simultaneously, it sets the TCP sequence number offset according to the acknowledgment sequence number in the takeover response message to ensure that the TCP packet sequence number can be correctly identified by the target redirection node after conversion. The specific sequence number adjustment process is defined by the following formula:

[0079]

[0080] in, This is the converted TCP segment sequence number. OFFSET is the sequence number of the original TCP segment, and OFFSET is the offset between the acknowledgment sequence number of the pre-created session context and the original connection sequence number.

[0081] After modifying the network address translation port mapping relationship, the edge autonomous gateway invalidates the original forwarding table entry pointing to the abnormal website node in the local forwarding table, and discards subsequent inbound requests pointing to the abnormal website node. All inbound requests matching the original connection quadruple will be forwarded to the target redirection node through the modified network address translation mapping relationship.

[0082] In this embodiment, examples of parameters for evaluating the redirection priority of redundant nodes and their corresponding priorities are shown in the table below:

[0083] Table 3 Redundant Node Redirection Priority Evaluation Table

[0084] 1 0.85 0.20 0.65 1 2 0.72 0.15 0.57 2 3 0.90 0.40 0.50 3 4 0.65 0.25 0.40 4 5 0.50 0.10 0.40 4

[0085] The table above clarifies the evaluation method and sorting rules for the redirection priority of redundant nodes. Those skilled in the art can fully reproduce the selection logic of the target redirection node based on the examples in the table above, without any creative effort.

[0086] In this embodiment, real-time monitoring of available resources of redundant nodes is achieved through the edge cluster topology adjacency table. The optimal selection of the target redirection node is achieved based on the difference between the remaining memory capacity and the CPU load rate, avoiding overload of the target node after traffic redirection. At the same time, the TCP connection is seamlessly taken over through the Transmission Control Protocol state synchronization agent and connection takeover responder, ensuring that the connection status of user access requests is not interrupted due to redirection and maintaining the continuity of the access process.

[0087] In another preferred embodiment, the out-of-band network is a control plane virtual LAN channel independent of the data forwarding plane. The control plane virtual LAN channel uses an independent VLAN identifier and is completely isolated from the service VLAN of the data forwarding plane. The WAN link between the edge autonomous gateway and the central cloud management and control platform reserves dedicated bandwidth resources for the control plane virtual LAN channel. The bandwidth resources will not be occupied by the service traffic of the data forwarding plane, ensuring the reliability of abnormal feature vector reporting and control signaling, and is not affected by data plane network congestion.

[0088] refer to Figure 5 The edge autonomous gateway deploys a feature truncated reassembler, a data processing module deployed in the control plane processor of the edge autonomous gateway. Running in a dedicated process in user space, it interacts with the local timing deviation calculation engine via shared memory. Within the time period covered by the sliding window, the feature truncated reassembler extracts the original timing sequence of the processor run queue length and the network protocol stack retransmission rate at a fixed sampling interval. This fixed sampling interval can be preset via a configuration interface, with a default value of 10 microseconds. The original timing sequence is a two-dimensional data structure, with each data element containing three fields: a sampling timestamp, a sampled value of the processor run queue length, and a sampled value of the network protocol stack retransmission rate. The length of the original timing sequence is determined by both the time period of the sliding window and the fixed sampling interval.

[0089] The feature truncation and reassembly processor truncates the original time-series data, retaining the feature fields of the first and last data packets while removing all intermediate time-series data between them. The feature fields of the first data packet include the sampling start timestamp, the initial processor run queue length sample value, the initial network protocol stack retransmission rate sample value, and the sliding window length parameter. The feature fields of the last data packet include the sampling end timestamp, the final processor run queue length sample value, the final network protocol stack retransmission rate sample value, the comprehensive anomaly evaluation value, the anomaly trigger timestamp, and the anomaly node identifier. The feature truncation and reassembly processor concatenates all retained feature fields in a preset fixed order to generate a truncated anomaly feature vector. The fixed length of the truncated anomaly feature vector is 128 bytes, less than one-hundredth the length of the original full time-series data, significantly reducing the bandwidth consumption of the reported data.

[0090] The feature truncation and reassembly unit encapsulates the generated truncated abnormal feature vector into a custom Ethernet frame of the control plane VLAN channel. The custom Ethernet frame adopts the IEEE 802.3 standard format. The Ethernet type field in the frame header is set to the pre-assigned private Ethernet type value 0x88B8 to distinguish control plane signaling frames from ordinary service data frames. The VLAN identifier field in the frame header is set to the dedicated VLAN ID of the control plane VLAN to ensure that the Ethernet frame is transmitted only in the control plane VLAN channel and will not enter the data forwarding plane.

[0091] After generating the truncated abnormal feature vector, the feature truncation and recombination unit calls the hardware security module built into the edge autonomous gateway. The hardware security module is a dedicated security chip integrated on the motherboard of the edge autonomous gateway. It has a built-in encryption algorithm engine that conforms to national and international cryptographic standards. It supports advanced encryption standard operations, RSA asymmetric encryption operations, SHA-256 hash operations and hash message authentication code operations. The hardware security module has a non-exportable secure storage area for storing encryption keys and sensitive data. The keys cannot be read through any external interface, ensuring the security of the keys.

[0092] The hardware security module uses a pre-set symmetric encryption key to perform Advanced Encryption Standard (ACE) operations on the truncated anomalous feature vector, generating ciphertext data. The ACE operation employs CBC encryption mode with a block size of 128 bits and a key length of 256 bits. The initialization vector used in the encryption process is a 128-bit random number generated by the hardware security module's internal random number generator. This initialization vector is appended to the header of the ciphertext data for data restoration during decryption. The specific encryption process is defined by the following formula:

[0093]

[0094] Where C represents the encrypted ciphertext data. Let P be a pre-set symmetric encryption key, P be the truncated plaintext anomalous feature vector, and IV be a randomly generated initialization vector. Indicates the use of a symmetric encryption key The advanced encryption standard encryption operation is performed.

[0095] The hardware security module calculates the hash message authentication code (HMAC) of the encrypted data while generating it. The HMAC is based on the SHA-256 hash algorithm and is calculated using a separate HMAC key. It is used to verify the integrity of the encrypted data and prevent malicious tampering during transmission. The specific calculation process for the HMAC is defined by the following formula:

[0096]

[0097] Wherein, HMAC is the calculated hash message authentication code. C is the HMAC key, and C is the encrypted ciphertext data. This indicates the hash message authentication code calculation based on the SHA-256 algorithm.

[0098] The feature truncation and reassembler appends the calculated hash message authentication code to the end of the ciphertext data to form a complete encrypted message. The structure of the encrypted message includes an initialization vector field, a ciphertext data field, and a hash message authentication code field. The feature truncation and reassembler writes the complete encrypted message into the payload field of a custom Ethernet frame and reports it to the central cloud management platform through the control plane virtual LAN channel.

[0099] refer to Figure 6 The central cloud management platform deploys a key distribution center, which is a dedicated service module within the central cloud management platform. It runs in a secure environment protected by a hardware encryption machine and is used to manage the encryption keys of all edge autonomous gateways in the network. The key distribution center stores asymmetric encryption public keys that match the hardware security module of each edge autonomous gateway. Each edge autonomous gateway's hardware security module corresponds to a unique asymmetric key pair. The private key of the asymmetric key pair is stored in the non-exportable secure storage area of ​​the hardware security module. The public key is pre-registered with the key distribution center when the edge autonomous gateway leaves the factory.

[0100] During the startup phase of the edge autonomous gateway, the edge autonomous gateway sends a key request to the key distribution center through the control plane virtual LAN channel. The key request carries the edge autonomous gateway's unique device identifier. Upon receiving the key request, the key distribution center verifies the validity of the device identifier. If the verification is successful, it generates a random symmetric encryption key and an HMAC key. Simultaneously, using the edge autonomous gateway's corresponding asymmetric encryption public key, it encrypts the key set consisting of the symmetric encryption key and the HMAC key to generate the encrypted ciphertext. The specific asymmetric encryption process is defined by the following formula:

[0101]

[0102] in, The encrypted key ciphertext, This indicates an RSA encryption operation performed using the asymmetric encryption public key of an edge autonomous gateway. It is a key set containing symmetric encryption keys and HMAC keys.

[0103] The key distribution center distributes the encrypted key ciphertext to the corresponding edge autonomous gateway via the control plane virtual LAN channel. Upon receiving the key ciphertext, the edge autonomous gateway's hardware security module decrypts it using its locally stored asymmetric encryption private key, obtaining the symmetric encryption key and the HMAC key. The decrypted key is then stored in the hardware security module's secure memory area for subsequent encryption and authentication operations. The specific asymmetric decryption process is defined by the following formula:

[0104]

[0105] Here, #imgpt51# represents the RSA decryption operation performed using the asymmetric encryption private key stored locally by the hardware security module.

[0106] The key distribution center is configured with a preset key rotation period, which defaults to 7 days. According to this period, the center periodically generates new symmetric encryption keys and HMAC keys. These new keys are then encrypted and distributed to the corresponding edge autonomous gateway's hardware security module via the control plane virtual LAN channel. Upon receiving the new keys, the hardware security module overwrites the previous versions of the symmetric encryption and HMAC keys, completing the key rotation operation. During the key rotation process, the hardware security module retains the old keys for a 1-hour transition period to decrypt messages received during this transition period that were encrypted using the old keys, preventing decryption failures during the key switch.

[0107] In this embodiment, the field structure and definition of the truncated abnormal feature vector are shown in the following table:

[0108] Table 4. Definition of Fields in Truncated Anomaly Feature Vectors

[0109] 1 Version identifier 2 Feature vector format version number Edge Autonomous Gateway Pre-configuration Parameters 2 Unique Device Identifier 8 The unique device ID of the edge autonomous gateway that reports data Built-in device ID of hardware security module 3 Abnormal node identifier 4 IP address of the website node that is experiencing an anomaly Configuration information for directly connected website nodes 4 Sampling start timestamp 8 The starting sampling time of the sliding window Data collected by the feature truncated recombinator 5 Initial processor run queue length 4 Processor run queue length at the start of the sliding window Data collected by the local timing deviation calculation engine 6 Initial network protocol stack retransmission rate 4 Network protocol stack retransmission rate at the start of the sliding window Data collected by the local timing deviation calculation engine 7 Sampling end timestamp 8 End sampling time of the sliding window Data collected by the feature truncated recombinator 8 Final processor run queue length 4 Processor run queue length at the end of the sliding window Data collected by the local timing deviation calculation engine 9 Final network protocol stack retransmission rate 4 Network protocol stack retransmission rate at the end of the sliding window Data collected by the local timing deviation calculation engine 10 Comprehensive anomaly evaluation value 8 The comprehensive anomaly evaluation value calculated when the anomaly is triggered Calculation results of the local timing deviation calculation engine 11 Exception trigger timestamp 8 When the comprehensive anomaly evaluation value exceeds the threshold Trigger records of the local timing deviation calculation engine 12 Sliding window length parameter 2 Number of consecutive time slices covered by the sliding window Edge Autonomous Gateway Pre-configuration Parameters 13 Alarm flag 1 Additional alerts such as cache overflow Alarm logs of the local timing deviation calculation engine 14 Reserved fields 53 Reserved fields for future feature expansion Fixed fill is 0

[0110] The table above clarifies the complete field structure, length, and meaning of the truncated abnormal feature vector. Based on the definitions in the table, those skilled in the art can completely reproduce the generation, truncation, and encapsulation logic of the abnormal feature vector without any creative effort.

[0111] In this embodiment, the original time-series sequence is truncated by a feature truncation and recombination device, retaining only the core beginning and end feature fields. This significantly reduces the length of the reported data and avoids exacerbating uplink congestion during control signaling reporting in abnormal states. At the same time, end-to-end encryption and integrity verification of the reported data are achieved through a hardware security module and a key distribution center, ensuring the security of the control plane transmission channel and preventing malicious third parties from eavesdropping, tampering with, or forging the reported data.

Claims

1. An automated operation and maintenance system for website nodes combining edge computing, characterized in that, The system includes an edge autonomous gateway deployed at the access layer of a website edge computing node cluster and a central cloud management platform communicating with the edge autonomous gateway. The edge autonomous gateway collects the processor run queue length and network protocol stack retransmission rate of directly connected website nodes in real time. The edge autonomous gateway has a built-in local timing deviation calculation engine. The local timing deviation calculation engine uses a sliding window to extract the product of the variance of the processor run queue length and the network protocol stack retransmission rate within a continuous time slice as a comprehensive anomaly evaluation value. When the comprehensive anomaly evaluation value exceeds a preset static threshold, the edge autonomous gateway directly modifies the local forwarding table to redirect inbound requests pointing to the abnormal website node to redundant nodes in the same edge cluster. At the same time, it reports the truncated anomaly feature vector to the central cloud management platform through an out-of-band network. The central cloud management platform receives the anomaly feature vector and performs a static baseline update of the global routing policy before distributing it to other non-faulty edge autonomous gateways.

2. The automated operation and maintenance system for website nodes combined with edge computing according to claim 1, characterized in that, The local timing deviation calculation engine is equipped with a memory-state time slice partitioning register, which divides the system clock cycle into multiple consecutive time slices of equal length. At the beginning of each consecutive time slice, the local timing deviation calculation engine locks the instantaneous value of the current processor run queue length and the accumulated value of the network protocol stack retransmission rate. When the multiple consecutive time slices covered by the sliding window end, the local timing deviation calculation engine calculates the variance of the instantaneous values ​​of the processor run queue length corresponding to all the covered consecutive time slices, and multiplies the variance by the accumulated value of the network protocol stack retransmission rate corresponding to the last consecutive time slice in the sliding window to generate the comprehensive anomaly evaluation value.

3. The automated operation and maintenance system for website nodes combined with edge computing according to claim 2, characterized in that, The memory-state time slice partitioning register is configured with a dynamic step size adjustment pointer. The dynamic step size adjustment pointer is directly connected to the central processing unit interrupt controller of the directly connected website node through a hardware pin. When the number of times the central processing unit interrupt controller triggers a hard interrupt signal in the current continuous time slice reaches a preset interrupt threshold, the dynamic step size adjustment pointer shortens the duration of the next continuous time slice to 1 / 2 of the original duration. When the local timing deviation calculation engine detects that the duration of the continuous time slice has been shortened, it clears the instantaneous value of the processor run queue length and the accumulated value of the network protocol stack retransmission rate corresponding to the continuous time slice farthest from the current time in the sliding window.

4. The automated operation and maintenance system for website nodes combined with edge computing according to claim 1, characterized in that, The edge autonomous gateway internally maintains an edge cluster topology adjacency table, which records the remaining memory capacity and CPU load rate of each redundant node in the same edge cluster. When the comprehensive anomaly evaluation value exceeds the preset static threshold, the edge autonomous gateway traverses the edge cluster topology adjacency table, calculates the difference between the remaining memory capacity and CPU load rate of each redundant node, and determines the redundant node with the largest difference as the target redirection node. The edge autonomous gateway adds a destination media access control address mapping entry pointing to the target redirection node to the local forwarding table.

5. The automated operation and maintenance system for website nodes combined with edge computing according to claim 4, characterized in that, The edge autonomous gateway is deployed with a Transmission Control Protocol (TCP) State Synchronization Agent. Before the edge autonomous network adds the destination MTCA address mapping entry to the local forwarding table, the TCP State Synchronization Agent extracts the original TCP connection quadruple information corresponding to the inbound request. The TCP State Synchronization Agent re-encapsulates the original TCP connection quadruple information and the Internet Protocol address of the target redirection node to generate state synchronization signaling. The edge autonomous gateway sends the state synchronization signaling to the target redirection node through an internal inter-process communication channel, so that the target redirection node pre-creates a session context in its local memory that matches the original TCP connection quadruple information.

6. The automated operation and maintenance system for website nodes combined with edge computing according to claim 1, characterized in that, The out-of-band network is a control plane virtual local area network channel independent of the data forwarding plane. The edge autonomous gateway is equipped with a feature truncating and reassembling device. The feature truncating and reassembling device extracts the original timing sequence of the processor run queue length and the network protocol stack retransmission rate at a fixed sampling interval within the time period covered by the sliding window. The feature truncating and reassembling device retains the feature fields of the first and last data packets in the original timing sequence and removes all intermediate timing data between the first and last data packets. The feature truncating and reassembling device concatenates the retained feature fields to generate the truncated abnormal feature vector and encapsulates the truncated abnormal feature vector into a customized Ethernet frame of the control plane virtual local area network channel.

7. The automated operation and maintenance system for website nodes combined with edge computing according to claim 3, characterized in that, The edge autonomous gateway is configured with a ring buffer connected to the central processing unit interrupt controller. The ring buffer stores the timestamps of the hard interrupt signals. When the dynamic step size adjustment pointer determines that the number of times the hard interrupt signal is triggered reaches the preset interrupt threshold, it reads the time interval difference between two adjacent timestamps in the ring buffer. When the time interval difference is less than the microsecond-level determination threshold, the dynamic step size adjustment pointer further shortens the duration of the next continuous time slice to 1 / 4 of the original duration and triggers the local timing deviation calculation engine to send a buffer overflow alarm flag to the central cloud management platform.

8. The automated operation and maintenance system for website nodes combined with edge computing according to claim 5, characterized in that, The target redirection node is equipped with a connection takeover responder. After receiving the state synchronization signaling and pre-creating the session context, the connection takeover responder returns a takeover response message carrying an acknowledgment sequence number to the edge autonomous gateway. When the edge autonomous gateway receives the takeover response message, it modifies the network address translation port mapping relationship corresponding to the original transmission control protocol connection quadtuple information recorded in the local forwarding table to a combination of the Internet Protocol address pointing to the target redirection node and the acknowledgment sequence number. After completing the modification of the network address translation port mapping relationship, the edge autonomous gateway discards subsequent inbound requests pointing to the abnormal website node.

9. The automated operation and maintenance system for website nodes combined with edge computing according to claim 6, characterized in that, After generating the truncated anomalous feature vector, the feature truncation and reassembly unit calls the hardware security module built into the edge autonomous gateway. The hardware security module uses a preset symmetric encryption key to perform Advanced Encryption Standard (AES) operations on the truncated anomalous feature vector to generate ciphertext data. The hardware security module also calculates the hash message authentication code of the ciphertext data. The feature truncation and reassembly unit appends the hash message authentication code to the end of the ciphertext data and writes the ciphertext data carrying the hash message authentication code into the payload field of the custom Ethernet frame.

10. The automated operation and maintenance system for website nodes combined with edge computing according to claim 9, characterized in that, The central cloud management platform is equipped with a key distribution center, which stores asymmetric encryption public keys that match the hardware security module. During the startup phase of the edge autonomous gateway, the key distribution center generates the symmetric encryption key, encrypts it using the asymmetric encryption public key, and then sends it to the hardware security module. The hardware security module decrypts the symmetric encryption key using the locally stored asymmetric encryption private key. The key distribution center generates a new symmetric encryption key according to a preset key rotation cycle and sends the new symmetric encryption key to the hardware security module through the control plane virtual LAN channel to overwrite the previous version of the symmetric encryption key.

Images