Natural language based sd-wan zero trust intelligent operations decision method

Abstract

This invention relates to the field of computer network communication technology and discloses a natural language-based SD-WAN zero-trust intelligent operation decision-making method. Through semantic confidence quantification via multiple forward propagations and an automatic clarification mechanism for low confidence, it addresses the structural disconnect between probabilistic parsing of large language models and deterministic authorization in zero-trust, improving the accuracy of fuzzy command parsing and the reliability of authorization. By introducing a time decay risk factor across time windows and combining it with dynamic information such as scheduling and permission changes, it overcomes the problem of authorization context failure during pre-submitted policy execution. Through an intent lifecycle tracking library, it achieves predictive assessment and proactive resolution of multi-policy resource conflicts, avoiding mutual interference between authorized policies. This realizes fully automated intelligent operation of SD-WAN under a high-security zero-trust framework, significantly reducing the risk of operational decision errors and improving network resource utilization efficiency and business continuity.

Description

Technical Field

[0001] This invention relates to the field of computer network communication technology, and in particular to a natural language-based SD-WAN zero-trust intelligent operation decision-making method. Background Technology

[0002] With the acceleration of enterprise digital transformation, business systems are placing higher demands on the real-time response, elastic scheduling, and intelligent collaboration of underlying network and security capabilities. In the Software-Defined Wide Area Network (SD-WAN) architecture, the control plane and data forwarding plane are separated, and a centralized controller enables unified orchestration and dynamic scheduling of network resources. Meanwhile, the zero-trust security model, with its core concept of never trusting and always verifying, performs continuous identity authentication and dynamic permission management for all access requests, and has been widely used in scenarios such as multi-cloud interconnection and branch access. In recent years, the development of natural language processing technology, especially large language models, has provided more intuitive intent understanding and semantic parsing capabilities for human-computer interaction. In the field of network operation and maintenance, research has already used natural language interfaces for auxiliary operations such as policy configuration query and alarm analysis. For typical high-dynamic scenarios such as e-commerce promotions, live broadcasts of large-scale events, and emergency command, network operation systems usually need to quickly adjust network topology, security policies, and resource allocation schemes according to business peaks, traffic surges, or changes in security status. Among related technologies, some systems can combine preset rules or templates to semi-automatically generate configuration suggestions and conduct pre-verification and iterative optimization in a simulation environment to improve the efficiency and accuracy of operational decisions.

[0003] The aforementioned and existing related technologies often suffer from the following shortcomings: 1. In scenarios such as e-commerce promotions and live broadcasts of large-scale events, operations and maintenance personnel often submit natural language intents several days or even weeks before the event. However, the actual execution time of the policy may span multiple shifts or face temporary permission transfers. Because multiple intent policies submitted at different times share the same network resources, and network traffic fluctuates periodically and security situations change suddenly during execution, the contextual information such as identity authentication and device evaluation relied upon during initial authorization becomes partially invalid at the time of execution. Furthermore, the implicit conflicts arising from multiple policies competing for resources within the same time window cannot be covered by unrelated single authorization checks. Existing technologies lack the ability to assess the consistency and conflict predictability of intent semantics across time windows, leading to potential interference or... 1. Violating the user's true intent; 2. In high-pressure scenarios such as emergency command, users often use vague expressions such as "may be attacked from the outside" and "try to protect core business as much as possible". Since the parsing of vague natural language by large language models is probabilistic and ambiguous, the same sentence may generate significantly different policy instructions in different contexts. Zero trust authorization requires each operation request to have clear and verifiable deterministic judgment basis, which forces the authorization system to choose between the following dilemmas: either reject reasonable requests due to insufficient confidence, or accept high-risk parsing results and allow policies that may cause network interruption. Existing technology does not embed semantic deterministic quantification and resolution mechanisms in the intent parsing link, nor can it require the model to provide traceable confidence basis in reverse, resulting in a structural break between the high-security authorization framework and the low-trust source input. Summary of the Invention

[0004] The technical problem this invention aims to solve is that existing technologies cannot assess multi-intent resource conflicts across time windows, and probabilistic semantic parsing leads to a break between deterministic authorization and trusted source input. To address this, we propose a natural language-based SD-WAN zero-trust intelligent operation decision-making method.

[0005] To achieve the above objectives, this application adopts the following technical solution: a natural language-based SD-WAN zero-trust intelligent operation decision-making method, comprising the following steps: Step 1. Receiving a natural language instruction containing a business intent description through a natural language interaction interface; Step 2. Inputting the natural language instruction into a large language model to perform multi-level intent parsing, generating a structured intent object containing a planned execution time window, resource requirement vector, and security level, while performing multiple forward propagations on the same natural language instruction and statistically analyzing the consistency of output for each field, generating the confidence level of each parsed field and the overall parsing credibility, if the overall parsing credibility is lower than a preset threshold or any key field has a low confidence level, automatically generating a clarification question to guide user confirmation, and correcting the structured intent object based on the confirmation result; Step 3. Inputting the corrected structured intent object into a zero-trust authorization decision engine to obtain the requester's identity authentication information and device fingerprint information, and simultaneously retrieving the relevant information based on the planned execution time window in the structured intent object. Step 4. Based on the scheduling information, permission change records, and historical operation behavior baseline within the corresponding time window, calculate the time decay risk factor, and integrate the identity authentication results, device health, behavior anomaly degree, and the overall parsing credibility to generate a comprehensive risk level; Step 5. Perform operations according to the comprehensive risk level: generate a dynamic authorization token directly when the risk is low, trigger secondary verification and generate a dynamic authorization token after user confirmation when the risk is medium, and reject the request when the risk is high; Step 6. After verifying the validity of the dynamic authorization token, generate multiple SD-WAN candidate policies based on the structured intent object, perform policy conflict detection based on resource contention coefficient and background traffic load, and feed the conflict detection results back to the weight adjustment process of the comprehensive risk level; Step 7. Input the multiple candidate policies into the simulation sandbox for simulation verification, select the optimal policy, convert it into a configuration command for the SD-WAN controller, issue it for execution through a secure channel, and record the execution summary of this scheduling and store it in the operation log database.

[0006] Preferably, the time decay risk factor is calculated as follows: the larger the time interval between the current time and the planned execution start time, the smaller the time decay risk factor; if the scheduling information shows that the requester is not on duty within the planned execution time window, the time decay risk factor is further reduced; if the permission change record shows that the requester had a predetermined permission revocation before the start of the planned execution time window, the time decay risk factor is further reduced.

[0007] Preferably, the comprehensive risk level is generated by weighting and fusing the identity authentication result, device health, abnormal behavior, time decay risk factor, and overall resolution credibility according to preset weights to obtain a comprehensive risk score, and then determining whether the comprehensive risk score falls into a threshold range as low risk, medium risk, or high risk; wherein the preset weights are dynamically adjusted according to the conflict detection feedback results, and the comprehensive risk level is also used to adjust the detection threshold when triggering subsequent strategy conflict detection.

[0008] Preferably, the dynamic authorization token includes a user identifier, the hash value of the structured intent object, the authorization validity time window, and the maximum number of executions; generating multiple SD-WAN candidate policies includes matching the corresponding template in the policy template library and filling in the resource requirement parameters to generate multiple candidate policies, and automatically adjusting the candidate policy parameters if a conflict is detected; the method for selecting the optimal policy is based on a preset evaluation standard; the scheduling execution summary includes a user identifier, natural language command, structured intent object, policy identifier, and issuance time.

[0009] Preferably, the method further includes establishing an intent lifecycle tracking library: after generating the dynamic authorization token, an intent record is created and stored in a time-series database. The intent record includes a unique intent identifier, user identifier, natural language plain text, structured intent object, authorization token fingerprint, planned start time, planned end time, submission time, and status. After the policy is successfully issued, the policy identifier and issuance time are backfilled into the corresponding intent record. A background scheduled task scans intent records that will be executed within a preset time period in the future and preloads them into the memory cache.

[0010] Preferably, the method further includes a step of multi-intent conflict predictability assessment: after receiving a new natural language instruction and parsing it to generate a new structured intent object, querying the intent lifecycle tracking library for all existing intent records whose planned execution time overlaps with the time window of the new structured intent object and whose business type or resource type is competitive; for each existing intent record, calculating the resource competition coefficient based on resource demand, total resources, time overlap length, and predicted background traffic load generated by a time-series prediction model based on historical data; when the resource competition coefficient exceeds a preset conflict threshold, generating a conflict prediction report, which includes a list of conflicting intents, conflict type, conflict severity, and suggested resolution solutions.

[0011] Preferably, when the severity of the conflict is determined to be irreconcilable, a conflict warning message is proactively pushed to the operations and maintenance personnel through the natural language interaction interface. The conflict warning message presents the conflict prediction report and optional resolution strategies in natural language. After receiving the resolution strategy selected by the operations and maintenance personnel, the resource requirement vector or time window of the new structured intent object is automatically updated, and then the updated structured intent object is resubmitted to the step of inputting the corrected structured intent object into the zero-trust authorization decision.

[0012] Preferably, the method further includes steps of semantic deterministic closed-loop calibration and dynamic adjustment of authorization weights: recording each correct parsing result confirmed by the user through the natural language interaction interface as a positive sample, and using the low-confidence parsing result initially generated by the large language model as a negative sample, and periodically using a contrastive learning method to incrementally fine-tune the large language model; simultaneously, adjusting the preset weights in real time based on the resource competition coefficient in the conflict prediction report and the overall parsing credibility, and increasing the proportion of conflict risk factors and semantic risk factors in the comprehensive risk score when the resource competition coefficient is higher than a first threshold or the overall parsing credibility is lower than a second threshold, triggering secondary verification and shortening the authorization validity time window in the dynamic authorization token.

[0013] Preferably, the process also includes steps for monitoring and feedback on the policy execution effect: after the policy is issued and executed, the actual execution performance data and environmental event data of the policy are continuously collected from the SD-WAN controller, the actual execution performance data is compared with the expected performance of the policy to calculate the deviation index, the deviation index is associated with the corresponding intent record and stored in the historical deviation table, the resource reservation coefficient of subsequent similar intents is dynamically adjusted according to the deviation index, and the deviation index is fed back to the calculation process of the time decay risk factor.

[0014] The technical effects and advantages of this invention are as follows: By introducing a semantic confidence quantification mechanism with multiple forward propagations in natural language intent parsing, and combining it with a closed loop of automatic clarification of low confidence and user confirmation, this invention effectively bridges the structural gap between the probabilistic output of the large language model and the zero-trust deterministic authorization. This significantly improves the parsing accuracy of fuzzy instructions and the reliability of authorization decisions, avoiding the misapplication of high-risk policies or the wrong rejection of reasonable requests due to semantic ambiguity. By introducing a time decay risk factor across time windows and retrieving scheduling information, permission change records, and historical behavior baselines in advance, this invention solves the problem of partial invalidation of the authorization context at the execution time of pre-submitted policies. It achieves predictive assessment and proactive resolution of multi-policy resource competition, preventing authorized policies from interfering with each other or violating the user's true intent. Through closed-loop optimization linking the intent lifecycle tracking library and conflict detection feedback, the semantic parsing model and authorization weights are continuously calibrated, significantly reducing the risk of operational decision errors, improving the utilization efficiency and business continuity of SD-WAN network resources, and realizing fully automated intelligent operation under a high-security zero-trust architecture. Attached Figure Description

[0015] The disclosure of this invention is illustrated with reference to the accompanying drawings. It should be understood that the drawings are for illustrative purposes only and are not intended to limit the scope of protection of this invention. In the drawings, the same reference numerals are used to refer to the same parts: Figure 1 This is an overall flowchart of the present invention; Figure 2 This is a schematic diagram of the natural language intent parsing and confidence quantification of the present invention; Figure 3 This is a schematic diagram of the cross-time window authorization and time decay risk factors of the present invention; Figure 4 This is a schematic diagram illustrating the multi-intent conflict predictability assessment of the present invention. Detailed Implementation

[0016] It is readily understood that, based on the technical solution of this invention, those skilled in the art can propose various interchangeable structural methods and implementations without altering the essential spirit of the invention. Therefore, the following detailed embodiments and accompanying drawings are merely illustrative examples of the technical solution of this invention and should not be considered as the entirety of the invention or as limitations or restrictions on the technical solution of this invention.

[0017] The technical solution will be described in detail below with reference to the accompanying drawings, such as... Figure 1-4 As shown, this technical solution can be applied to highly dynamic network operation and maintenance scenarios such as e-commerce promotions, live broadcasts of major events, and emergency command.

[0018] Before proceeding with a detailed description, the prior art and technical terms used in this specific embodiment will be defined to facilitate understanding.

[0019] Pre-trained large language models refer to deep learning models that are pre-trained on massive amounts of text data, such as generative pre-trained transform models (GPT) or large language models (LLaMA). These models have the ability to understand natural language instructions and generate structured outputs, but their outputs are probabilistic. The same input may produce different results in different contexts or multiple runs. In this solution, the model is called using multiple forward propagation techniques, that is, it is run multiple times while retaining the random deactivation layer of the model. The semantic confidence is quantified by statistical output consistency.

[0020] Zero Trust security architecture is a security model based on the principle of never trusting and always verifying. It requires continuous identity authentication, device health checks, and dynamic risk assessment for all access requests, rather than relying on a single login. The zero trust authorization decision in this solution not only assesses the requester's status at the current moment, but also pre-fetches information such as scheduling and permission changes for future periods based on the planned execution time window to solve the problem of authorization information becoming invalid over time.

[0021] The SD-WAN controller is a core control component in a software-defined wide area network (SDWAN), responsible for centralized management of network policies, path selection, and resource allocation. This solution interacts with the controller through the Representational State Transition Configuration Protocol RESTCONF or the Network Configuration Protocol NetConf to generate and issue configuration commands.

[0022] A network simulation environment is a software sandbox that simulates real network behavior. It can load a snapshot of the current network topology, including link latency, jitter, packet loss rate, remaining bandwidth, and historical traffic data. It can run candidate strategies in virtual time to predict their effects. This technology is a common verification method in the field of network engineering.

[0023] The Intent Lifecycle Tracking Library is a time-series database used to persistently store a complete record of each natural language intent, including structured intent objects, authorization token fingerprints, planned execution time windows, actual execution status, and policy association identifiers. The library supports fast retrieval by time range and resource type, providing a data foundation for predictive assessment of multi-intent conflicts.

[0024] The resource contention coefficient is used to quantify the degree of competition for limited network resources, such as link bandwidth, CPU cores, and storage space, among multiple intent strategies within the same time window. Its calculation factors include the resource demand of each strategy, the total amount of resources, the length of time overlap, and the background traffic load generated by a time series prediction model, such as an autoregressive integral moving average model, based on historical data from the same period. The prediction of background traffic load utilizes the periodic characteristics of network traffic and is a known technique in the field of statistical prediction.

[0025] The time decay risk factor is a trust coefficient that decreases as the interval between the current time and the planned execution start time increases. This factor also incorporates scheduling information, i.e. whether the future time period is a shift, and permission change records, i.e. whether there is a scheduled permission revocation. It is used to adjust the comprehensive risk score of zero-trust authorization. The bolded parts in the following embodiments are the key innovations that distinguish them from conventional technical means.

[0026] Example 1: This example corresponds to all the necessary technical features defined in the independent claims, and fully discloses the simplest feasible solution for solving two technical problems: unpredictable multi-intent resource conflicts across time windows and structural disconnect between probabilistic semantic parsing and deterministic authorization.

[0027] Step 1: Receive natural language commands input by maintenance personnel through the natural language interactive interface.

[0028] Step 11 initializes the session context and assigns a unique session identifier to the current user session. Taking the network operation and maintenance scenario before the Double 11 promotion of an e-commerce platform as an example, the operation and maintenance personnel open the dialog window through the browser. The system backend generates a universally unique identifier (UUID) for the session and records the session start time, user IP address and browser fingerprint. The session identifier will run through the entire processing flow and be used to associate subsequent intent parsing, authorization decision and policy execution records.

[0029] Step 12 receives natural language text input. The system receives natural language instructions input by the user through a WebSocket long connection. For example, during the period from 00:00 to 02:00 on November 11, the system dynamically allocates bandwidth to ensure payment peak for the order system and enables distributed denial-of-service (DDoS) protection. At the same time, the input timestamp is recorded for subsequent time window alignment.

[0030] Step 2: Input the natural language command into the pre-trained large language model to perform multi-level intent parsing and generate a structured intent object.

[0031] Step 21: Invoke the large language model deployed in the security sandbox. This model has been fine-tuned for the vertical domain and outputs a structured object containing fields such as business type, planned execution time window, resource requirement vector, and security level. The large language model extracts key entities from the instructions based on an attention mechanism and maps the order system to business type identifiers. The process involves resolving the period from 00:00 to 02:00 on November 11th into start and end timestamps, converting the peak payment period into a resource demand vector (e.g., bandwidth of at least 5 gigabits per second and at least 16 CPU cores), mapping DDoS protection to a high security level and triggering corresponding protection thresholds, and adding a semantic deterministic quantization branch to the model output layer to address the deterministic authorization breakage problem caused by probabilistic semantic parsing. This branch shares the feature extraction layer with the main parsing task but independently outputs the confidence level of each field.

[0032] Step 22: The semantic deterministic quantization module calculates the confidence level (high, medium, or low) of each parsed field and the overall parsing confidence. The module uses a multiple forward propagation method to perform multiple inferences (e.g., 10 times) on the same natural language instruction while retaining the random deactivation layer of the model. The consistency of the output of each field is statistically analyzed. If the output of a certain field is completely consistent in all inferences, it is marked as high confidence. If there are two or more different results and each accounts for a certain proportion (e.g., the bandwidth parsing is 5Gbps 6 times and 4Gbps 4 times), it is marked as low confidence. The rest are marked as medium confidence. The overall parsing confidence is the weighted geometric mean of the confidence levels of all fields. The key fields, namely business type, time window, and resource requirements, have higher weights than non-key fields. The system presets a confidence threshold, such as 0.75. If the overall confidence is higher than the threshold and there are no low-confidence key fields, proceed directly to step 24; otherwise, proceed to step 23.

[0033] Step 23: When the overall confidence level is below the threshold or any key field has low confidence, the system automatically generates clarification questions and guides the user to confirm through the interactive interface. For example, if the bandwidth value in the resource requirement has low confidence due to ambiguity in the term "peak", the system will return a message asking whether the "guaranteed payment peak" refers to ensuring that the bandwidth is not lower than a specific value or ensuring that the transaction processing capacity per second reaches a specific value. After the user replies with the bandwidth, the model will lock the bandwidth requirement at 5Gbps and recalculate the confidence level as high. This proactive clarification mechanism transforms the probabilistic output of the large language model into deterministic information, providing verifiable input for zero-trust authorization.

[0034] Step 24: Attach the parsed timestamp, confidence vector, and overall credibility to the finally confirmed structured intent object and store it in a temporary cache, such as Redis, with an expiration time of 24 hours. The cached object contains the following field: Business type identifier. The plan includes start and end times; resource requirements include 5Gbps bandwidth, 16 CPU cores, 32GB memory, high security level, and an overall resolution reliability of 0.92.

[0035] Step 3: Input the structured intent object into the zero-trust authorization decision engine and perform a predictive authorization assessment for a future time window.

[0036] Step 31: Obtain the current requester's identity authentication information, namely user ID, role, department, and device fingerprint information, namely device ID, operating system version, and security patch level. The system obtains the user's identity through Single Sign-On (SSO) and obtains the device's compliance status through the device management database. This part is a routine operation of the zero-trust architecture.

[0037] Step 32: Based on the planned execution time window in the structured intent object, retrieve the scheduling information, permission change records, and historical operation behavior baseline within that time window in advance. To address the issue of initial authorization information being partially invalid across time windows at the execution time, this step does not rely on static information at the current moment but instead establishes a time decay risk assessment model. Obtain the user's scheduling plan for the future time window from the human resources system. For example, if the query finds that the user's scheduling is on a statutory holiday from 00:00 to 02:00 on November 11th and the status is "not on duty," this risk increases. Query the permission audit log for any scheduled permission revocation or role change in the future period. For example, if the user has a temporary authorization that expires at 23:59 on November 10th, this will lead to a reduction in their permissions at the execution time. Analyze the user's operation history in the same time period (00:00 to 02:00) over the past three months from the behavior analysis engine. For example, if the user has never submitted a configuration change request during this period, the abnormality of the behavior increases.

[0038] Step 33: Calculate the time decay risk factor, defining the current time as... The planned start time is The time interval is (in hours), and the time decay factor is... The calculation formula is: ,in, For the attenuation coefficient, this embodiment takes... This formula shows that, For every additional 24 hours, It will decrease by approximately 10%, and the minimum will not be lower than 0.2.

[0039] Based on this, if the scheduling information shows that the requester is not on duty during the scheduled execution time window, then Multiply by the penalty factor If the permission change record shows that there was a scheduled permission revocation, then Multiply by the penalty factor The final time decay risk factor is: This value represents the expected credibility of the authorization information at the time of execution.

[0040] Step 34: Calculate the comprehensive risk level and generate a dynamic authorization decision. The comprehensive risk level is obtained by weighted fusion of five factors: identity authentication result (value 1 or 0), equipment health (value 0 to 1), behavior anomaly (value 1 minus normalized anomaly index), and time decay risk factor. The overall analytical credibility value ranges from 0 to 1. The initial weights of each factor are 0.25, 0.15, 0.2, 0.25, and 0.15, respectively. After weighted summation, a comprehensive risk score is obtained. The system presets three threshold ranges: a score greater than or equal to 0.7 indicates low risk, a score greater than or equal to 0.5 and less than 0.7 indicates medium risk, and a score less than 0.5 indicates high risk. For example, if the current scenario's calculated score is 0.62, which belongs to medium risk, then the secondary verification in step 35 is triggered.

[0041] Step 35: Perform secondary verification. The system will push a dynamic verification code to the user's mobile phone or call a biometric interface, such as face or fingerprint recognition, to require the user to confirm on-site. If the user confirms, the system will forcibly raise the overall risk score to 0.8, turning it into a low-risk system. If the user refuses to confirm, the system will reject the request and record it in the log.

[0042] Step 36: After authorization is approved, a dynamic authorization token is generated. The token adopts the JSONWebToken format. The payload contains the user identifier, the hash value of the structured intent object for anti-tampering, the authorization validity time window is consistent with the time window in the natural language instruction, the maximum number of executions is usually set to 1 to prevent duplicate issuance, and the authorization timestamp. The token is signed with Hash Message Authentication Code (HMAC) to prevent forgery.

[0043] Step 4: Based on the dynamic authorization token and the structured intent object, call the SD-WAN policy generation module to automatically generate a set of candidate policies.

[0044] Step 41: Verify the validity of the authorization token by checking the signature, validity period, and intent hash match. If they match, pass the structured intent object to the policy generation module.

[0045] Step 42: The strategy generation module maintains a strategy template library, which pre-configures e-commerce peak guarantee templates, sports live streaming optimization templates, emergency command isolation templates, etc., according to different business types. The e-commerce peak protection template was matched, which defines placeholders for parameters such as bandwidth allocation algorithm, DDoS protection threshold, and link selection strategy.

[0046] Step 43: Fill the template with the parameters from the resource requirement vector. The bandwidth should be no less than 5Gbps, the number of CPU cores should be 16, SYNCookie and source IP rate limiting should be enabled, and the DDoS protection threshold should be set to 10Mbps. At the same time, generate three candidate variants: variant A uses the primary China Telecom egress link, variant B uses the backup China Unicom egress link, and variant C uses a primary and backup active-active load balancer.

[0047] Step 44: Perform lightweight conflict detection. Read the list of currently effective policies from the SD-WAN controller and check for priority conflicts, such as existing policies prohibiting the allocation of more than 4Gbps bandwidth to the order system; resource contention, such as the same link having committed bandwidth usage exceeding 80%; and overlapping security rules, such as an existing DDoS protection threshold of 20Mbps while the new policy is 10Mbps, with overlapping scopes but inconsistent thresholds. If a conflict is found, the candidate policy parameters are automatically adjusted, such as reducing the bandwidth requirement of variant A to 4Gbps or switching variant B to another backup link. The adjusted candidate policy set is then re-detected for conflict until there are no conflicts or the maximum number of adjustments is reached.

[0048] Step 5: Perform simulation verification on the candidate strategy set, select the optimal strategy, and send it to the SD-WAN controller.

[0049] Step 51: Input multiple candidate strategies into the network simulation sandbox. The sandbox loads the real-time topology information of the current network, including the latency of each link, packet loss rate, remaining bandwidth, and historical traffic replay data, such as the traffic curve of the same period during last year's Double Eleven. The simulation sandbox is a discrete event simulator that can run strategies with a time compression ratio, such as 100:1.

[0050] Step 52: Run each candidate strategy in the simulation environment for a virtual period of time, such as 10 minutes, and output key performance indicators, including strategy activation delay (the time from issuance to activation), average end-to-end latency, maximum packet loss rate, and resource utilization change (the percentage increase in bandwidth usage). The simulation results are returned in numerical form.

[0051] Step 53: Select the optimal strategy according to the preset evaluation criteria. The evaluation criteria adopt a weighted scoring method with a weight of 0.4 for latency, 0.3 for packet loss rate, 0.2 for resource overhead, and 0.1 for safety margin. Calculate the comprehensive score of each candidate strategy. The strategy with the lowest score is the one with the lowest cost. For example, the dual-active load balancing scheme of variant C performs best in terms of latency and packet loss rate and is selected.

[0052] Step 54: Convert the optimal policy into a configuration command for the SD-WAN controller. Use the RESTCONF protocol to generate a configuration fragment according to the format described by the YANG model. Send the fragment to the controller through a bidirectional transport layer secure TLS channel. After the controller verifies the command signature, the configuration will take effect and then be distributed to each edge device, i.e., customer premises equipment (CPE) or general customer premises equipment (uCPE).

[0053] Step 55: The system records a summary of this scheduling execution, including user identifier, original natural language command, final structured intent object, policy identifier, issuance time, simulation score, etc., and stores it in the operation log database. This log can be used for subsequent auditing and fault backtracking. Thus, Implementation Example 1 completes the complete closed loop from natural language input to policy issuance. It solves the problem of authorization context failure over long periods of time through time decay risk assessment and secondary verification mechanism, and solves the problem of the break between probabilistic parsing and deterministic authorization through semantic deterministic quantification and clarification interaction.

[0054] Example 2: This example adds additional features such as intent lifecycle tracking, multi-intent conflict predictability assessment, semantic closed-loop calibration, and dynamic weight adjustment to the basis of Example 1, further improving the system's predictive and adaptive capabilities.

[0055] Step 6: Establish an intent lifecycle tracking library and persistently store each authorized structured intent object and its associated policies.

[0056] Step 61: After authorization is granted but before policy generation, create intent records and store them in a time-series database such as InfluxDB. Each record contains a unique intent identifier (UUID), user identifier, natural language plain text, JSON format of a structured intent object, authorization token fingerprint, planned start time, planned end time, submission time, status (pending execution, executed, expired, or failed), and associated policy identifier (initially empty).

[0057] Step 62: After the policy is successfully issued, the policy identifier and issuance time are populated back into the corresponding intent record. At the same time, an inverted index is built according to the planned start time and resource type to quickly query intents with overlapping time windows.

[0058] Step 63: Set up a background scheduled task to run once an hour, scan all intent records whose scheduled start time is within the next 72 hours and whose status is pending execution, and preload them into a memory cache such as Redis. The preloaded intent records will be quickly accessed in subsequent conflict detection.

[0059] Step 7: When a new natural language instruction is received, retrieve existing intents from the intent lifecycle tracking library that have overlapping time windows or resource competition with the current instruction, and perform a multi-intent conflict predictive assessment.

[0060] Step 71: Extract the planned execution window from the structured intent object generated by parsing the new instruction in step S2. to and resource demand vector This includes bandwidth, CPU, storage, etc.

[0061] Step 72: Query the intent lifecycle tracking library, provided that the planned start time is less than or equal to... And the planned end time is greater than or equal to If the business type or resource type overlaps, such as sharing the same physical link or the same security domain, return the existing intent list L.

[0062] Step 73: Calculate the resource competition coefficient γ between each existing intent in L and the current new intent. For each resource type, such as bandwidth, calculate the sum of existing demand and new demand, plus the predicted background traffic load for that period, and then compare it with the total resource. The predicted background traffic load is generated based on historical data of the same period, such as the average traffic of the same hour during the Double Eleven shopping festival in the past three years, through the autoregressive integral moving average model ARIMA. If the sum exceeds the total resource, the excess ratio is the competition coefficient component. If it does not exceed but is close to, such as exceeding 80%, a medium competition coefficient is allocated proportionally. The time overlap factor is the ratio of the overlap duration to the duration of the current intent. Finally, γ is the weighted average of the competition coefficients of each resource type. The weights are set according to the scarcity of resources: bandwidth weight 0.5, CPU weight 0.3, and storage weight 0.2. The competition level is divided according to the γ value: γ less than 0.2 is no competition, γ greater than or equal to 0.2 and less than 0.5 is mild competition, γ greater than or equal to 0.5 and less than 0.8 is moderate competition, and γ greater than or equal to 0.8 is severe conflict.

[0063] Step 74: Generate a conflict prediction report. The report includes a list of conflict intentions with submitter, time window, resource requirements, contention coefficient, conflict type (bandwidth contention, security rule exclusivity, or path contention), conflict severity (high, medium, or low), and suggested resolution solutions such as adjusting resource allocation ratios, staggered execution, and enabling backup links. The report is presented in natural language paragraphs for easy reading by operations and maintenance personnel.

[0064] Step 8: If the conflict prediction report shows that there is an irreconcilable conflict, i.e., the severity is high, then the natural language interaction interface will actively push an alert and provide selectable resolution strategies.

[0065] Step 81: Push an alert message via WebSocket, such as: "The order system's bandwidth guarantee of 5Gbps and the payment gateway's bandwidth request of 2Gbps overlap between 01:00 and 01:30 on November 11th. The estimated background traffic is 3Gbps, and the total demand is 10Gbps, exceeding the link capacity of 10Gbps. The overload is 0Gbps, and the actual available bandwidth is 0. We recommend: first, reducing the order system bandwidth to 4Gbps; second, moving the payment gateway request to after 01:30; and third, enabling the backup link requires approval. Please select or rephrase."

[0066] Step 82: The user selects Option 1 through the interface. The system automatically updates the resource requirement vector of the new intent, adjusting the bandwidth from 2Gbps to 0. At the same time, the order system intent is modified. In actual processing, the newly submitted intent is adjusted first because it has not yet been authorized. The modified structured intent object is sent back to Step 3 to re-execute the authorization evaluation. This proactive intervention mechanism avoids the resource shortage problem that is only discovered after the policy is issued, thus ensuring network stability.

[0067] Step 83: If the user chooses to ignore the conflict and force submission, the system will set the conflict risk coefficient γ to 0.9 when making the authorization decision, increase the weight of this item in the comprehensive risk score, which will likely lead to authorization failure or trigger the highest level of approval process, requiring double review by the department head.

[0068] Step 9: During the natural language intent parsing process, the confidence score is output through the semantic deterministic quantization module, and a continuous calibration mechanism based on contrastive learning is introduced.

[0069] Step 91: Record the final correct parsing result of each user clarification interaction as a positive sample P, and take the low confidence parsing initially generated by the large language model, i.e. the ambiguous option rejected by the user, as a negative sample N. The sample format is the original input text plus the correct structured intent and the original input text plus the incorrect structured intent.

[0070] Step 92: Trigger offline incremental training once a week, using a contrastive learning loss function such as Information Noise Contrast Estimation (InfoNCE). This function increases the similarity between positive samples and the original input in the representation space of similar semantics, and decreases the similarity between negative samples and the original input. Specifically, the model encoder maps the input text and intent structure to the same embedding space. By contrastive loss, the distance between correct pairings is shortened and the distance between incorrect pairings is widened. After multiple rounds of fine-tuning, the model gradually converges to a direction consistent with the preferences of most users for fuzzy expressions, such as ensuring the resolution as much as possible. In emergency command scenarios, it is necessary to gradually shift towards latency priority rather than bandwidth priority.

[0071] Step 93: Deploy the calibrated model to the online environment and conduct A / B testing, directing 5% of traffic to the new model to verify the improved parsing accuracy, for example, from 88% to 94%. After verification, replace the entire model. This closed-loop semantic calibration enables the system to accurately parse domain-specific expressions without human intervention after long-term operation, further reducing semantic uncertainty.

[0072] Step 10: Dynamically adjust the risk score weights of the zero-trust authorization decision engine based on the conflict prediction report and semantic deterministic quantification results.

[0073] Step 101: Introduce two dynamic factors into the authorization engine: the conflict risk coefficient γ is derived from the conflict prediction report and ranges from 0 to 1, and the semantic risk coefficient σ is equal to 1 minus the overall parsing credibility.

[0074] Step 102: Adjust the weights of each factor in step 34 in real time, and set the conflict risk coefficient as follows: (Derived from the conflict prediction report, with a value range of 0 to 1), Semantic Risk Coefficient Conflict weights With semantic weight The calculation formula is as follows: ; The min function is used to limit the maximum value of the weights to prevent a single factor from dominating the decision-making process.

[0075] Let the original other weights (identity authentication result weights) be removed. ), Equipment health weight ( ), behavioral abnormality weight ( ), time decay factor weight ( The sum of ) is After adjustment, the sum of these weights needs to be scaled proportionally to maintain a total weight of 1: Scaling factor Then each original weight is multiplied by The new weight values ​​are obtained.

[0076] Step 103: For requests with high conflict risk (γ > 0.7) or high semantic risk (σ > 0.3), the authorization level is automatically upgraded, requiring the user to perform secondary verification via hardware token or biometrics. The validity period of the authorization token is shortened to 30% of the original planned time window, with a minimum of 15 minutes. This dynamic risk-adaptive authorization mechanism enables the high-security zero-trust framework to not only accept low-confidence source inputs such as fuzzy natural language, but also to adjust its own strictness in reverse according to the input quality, thus achieving a flexible connection between probabilistic semantics and deterministic authorization.

[0077] Step 11: After the policy is issued and executed, continuously monitor the actual execution effect of the policy and changes in network status, collect deviation data, and feed it back to the intent lifecycle tracking library and authorization engine. Step 111: Deploy the monitoring agent to pull the policy execution status from the SD-WAN controller every 30 seconds, including actual bandwidth usage, actual end-to-end latency, actual packet loss rate, CPU and memory usage, and collect environmental events such as link jitter alarms, sudden increases in packet loss, DDoS attack events, and device restart records.

[0078] Step 112: Calculate the deviation index. The bandwidth deviation rate is equal to the actual bandwidth minus the expected bandwidth divided by the expected bandwidth. The latency deviation is equal to the actual latency minus the expected latency. If the absolute value of the bandwidth deviation rate is greater than 0.2 or the latency deviation is greater than 10 milliseconds, it is marked as a significant deviation.

[0079] Step 113: Associate the deviation data and environmental events with the corresponding intent records and store them in the historical deviation table. At the same time, dynamically adjust the resource reservation coefficient for subsequent similar intents based on the deviation direction. For example, if similar intents during similar periods in the past month, such as e-commerce promotion nights, generally show actual bandwidth demand 15% higher than expected, the system will automatically multiply the bandwidth value in the resource demand vector by 1.15 as the default suggested value, and prompt the operations and maintenance personnel when generating the policy to increase the bandwidth reservation to 5.75Gbps based on historical experience.

[0080] Step 114: Deviation data is also fed back to the time decay risk model. If a user's historical authorization requests repeatedly result in actual resource consumption far exceeding expectations (e.g., deviation rate greater than 30% and more than 3 times), the time decay penalty factor α for the next request to that user increases from 0.1 to 0.2, meaning that trust decays faster over time. This achieves personalized trust scoring based on user behavior, further improving the accuracy of authorization. Thus, Example 2, by introducing intent lifecycle tracking, multi-intent conflict predictability assessment, semantic closed-loop calibration, and dynamic risk adaptive authorization, forms a continuously evolving intelligent operation system based on Example 1. The additional features are interconnected, conflict prediction provides prior risk for authorization, semantic calibration reduces parsing uncertainty, and monitoring feedback optimizes the prediction model, forming a positive cycle.

[0081] Example 3: This example provides an alternative technical solution that differs from Example 1 and Example 2, and is particularly suitable for scenarios with extremely high data privacy requirements, offline deployment requirements, or special requirements for real-time performance.

[0082] Step 12: Replace the large cloud model with a locally deployed, lightweight language model.

[0083] Step 121: Select an open-source model with a smaller number of parameters, such as LLaMA-3-8B, and use quantization technology to compress the model size to 25% of the original size, i.e., 4-bit quantization. This improves the inference speed by 3 times to meet the needs of real-time interaction. Fine-tune the model using 100,000 annotated intent commands from the internal operations and maintenance corpus. Deploy the model on a local server, such as Huawei Atlas 800. All computations are performed in a trusted execution environment, such as Intel Software Protection Extensions (SGX). Input and output data are not written to disk and do not leave the local network. This alternative solution ensures the privacy of sensitive business data, such as the network topology and security policies of government emergency command, and meets the requirements of Level 3 network security protection.

[0084] Step 13: Replace traditional rule matching with policy conflict detection based on graph neural networks.

[0085] Step 131: Construct the SD-WAN policy dependency graph G, which is equal to the set of vertices V and edges E. Vertices V include three types: policy nodes (each effective policy is a node), resource nodes (links, bandwidth pools, CPU resources), and business nodes (order systems, payment gateways, etc.). Edges E include the relationships between policies (resources used by policies, business impact of policies, dependencies between policies such as priority order, and mutual exclusion between policies such as rule mutual exclusion).

[0086] Step 132: Use a Graph Convolutional Network (GCN) to train the graph embedding. The graph convolutional layers update the representation of each node by aggregating the features of neighboring nodes. After two convolutional layers, a 128-dimensional node embedding vector is obtained. The training data comes from a historical policy conflict case library and the edges are labeled with conflict or non-conflict. This model can capture high-order semantic conflicts. For example, policy A and policy B do not have direct resource contention, but policy A affects business X. Business X and business Y are indirectly coupled through a shared database. Policy B affects business Y, which ultimately leads to a decrease in overall performance. Traditional rule matching cannot discover such indirect conflicts, while graph neural networks can learn such indirect relationships through message passing.

[0087] Step 133: When a new strategy is generated, it is added to the graph as a temporary strategy node. GCN inference is run once, and the probability of conflict with each existing strategy node is output. If the probability of conflict is greater than 0.7, it is considered high risk. The three strategy nodes with the highest probability of conflict with it and their explanations are output. The cause is located by graph attention weight. Based on this, the system shows the operation and maintenance personnel that the new strategy has an indirect conflict with strategies P12 and P33. The reason is that the two are applied to business X and Y respectively, and X and Y share the database connection pool.

[0088] Step 14: Replace the traditional symmetric encryption token with an authorization token based on attribute-based encryption (ABE).

[0089] Step 141: Use the ciphertext policy attribute base to encrypt the CP-ABE scheme. The authorization center generates a master key and a public key. After authorization is successful, the authorization center constructs an access policy tree based on the current user's attribute set, such as role equal to network operations and maintenance, department equal to infrastructure department, security level equal to L3, and time window equal to November 11, 00:00 to 02:00. For example, the parentheses contain the option that the department equals infrastructure department, the role equals network operations and maintenance, and the time is between Ts and Te, or the security level equals administrator.

[0090] Step 142: Encrypt authorization data such as policy template identifier, allowed bandwidth limit, and session ID using the policy tree to generate a ciphertext token. The edge SD-WAN controller pre-stores the user's private key, which is generated by the master key based on the user's attributes. Only users whose attributes meet the policy tree requirements can decrypt the ciphertext to obtain the authorization data. The advantage of this alternative is that there is no need for a central authorization service to verify the token online. Even if the network between the control plane and the data plane is interrupted, the issued policies can still be verified and executed locally by the controller. At the same time, the token has a time attribute embedded in it, so it automatically expires and cannot be replayed.

[0091] Step 15: For natural language intents with a time window span exceeding a certain threshold, such as 24 hours, a hierarchical time abstraction mechanism is adopted.

[0092] Step 151: Detect the planned time window length in the structured intent object It equals Te minus Ts, if If the time exceeds 24 hours, a hierarchical abstraction will be triggered.

[0093] Step 152: Divide the long window into multiple consecutive sub-windows, each with a length of 1 hour. If the last sub-window is less than 1 hour, divide it according to the actual length. Generate an independent sub-intent object for each sub-window. The resource requirement vector of the sub-intent is evenly distributed over time. If the original bandwidth requirement is 5Gbps for 24 hours, then the bandwidth of each sub-window is still 5Gbps. If the original requirement is the total data volume, then it needs to be distributed proportionally over time. At the same time, establish the execution dependency relationship between sub-windows. The successful execution of the strategy of the previous sub-window and its non-cancellation are prerequisites for the execution of the strategy of the next sub-window.

[0094] Step 153: Each sub-intention performs an independent authorization assessment, using the scheduling information and permission change records in the corresponding sub-window. If the authorization of a sub-intention fails, the system immediately notifies the user through the interactive interface and terminates the policy execution of subsequent sub-windows. The issued policies will be set with an automatic expiration time. This mechanism strikes a balance between the convenience of long-term intentions and the dynamic security of short-term authorizations, avoiding the accumulation of risks caused by a one-time authorization lasting for several days. For example, a user may be transferred to another position the next day, but the long-term authorization has not been revoked.

[0095] Step 16: Employ multi-tenant semantic calibration based on federated learning without sharing the original data.

[0096] Step 161: For multi-tenant scenarios where multiple enterprise customers use the same system but the data is isolated, each tenant maintains a semantic calibration model locally. This model is based on lightweight fine-tuning of the low-rank adapter LoRA and only stores local clarification interaction records, i.e., positive and negative samples.

[0097] Step 162: The central server periodically, for example weekly, aggregates the model updates from each tenant, calculates the global model parameters using a federated averaging algorithm, but does not exchange the original text content to protect tenant data privacy. The aggregated global model is then distributed to each tenant to replace the local model or to perform weighted fusion. This solution solves the problem that a single tenant cannot effectively fine-tune a large language model due to insufficient data, while also complying with data compliance requirements such as the General Data Protection Regulation (GDPR).

[0098] Step 163: Tenants can choose to exit federated learning and maintain their own models completely independently, with the system providing a local training interface.

[0099] The above three embodiments fully and comprehensively disclose multiple implementation methods of this technical solution. Those skilled in the art can repeat the implementation without creative effort based on the above description. The embodiments are not mutually exclusive, and actual products or systems can be combined according to requirements. For example, graph neural network conflict detection and attribute-based cryptographic tokens can be used simultaneously. By introducing a series of interconnected and mutually supportive core mechanisms such as cross-time window predictive authorization models, intent lifecycle tracking and conflict predictability assessment, semantic deterministic quantification and closed-loop calibration, and dynamic risk adaptive authorization, the two major problems of time-dimensional intent conflict and the break between probabilistic semantics and deterministic authorization, which cannot be handled by existing technologies, are fundamentally solved. This significantly improves the security, reliability, and user experience of SD-WAN intelligent operation decision-making.

[0100] The technical scope of this invention is not limited to the content described above. Those skilled in the art can make various modifications and variations to the above embodiments without departing from the technical concept of this invention, and all such modifications and variations should fall within the protection scope of this invention.

Claims

1. A natural language-based SD-WAN zero-trust intelligent operation decision-making method, characterized in that, Includes the following steps: S1. Receive natural language instructions containing a description of business intent through a natural language interactive interface; S2. Input the natural language instruction into the large language model to perform multi-level intent parsing, generate a structured intent object containing the planned execution time window, resource requirement vector and security level, and perform multiple forward propagations on the same natural language instruction and count the consistency of output of each field to generate the confidence level of each parsed field and the overall parsing credibility. If the overall parsing credibility is lower than the preset threshold or any key field has a low confidence level, automatically generate a clarification question to guide the user to confirm, and correct the structured intent object based on the confirmation result. S3. Input the corrected structured intent object into the zero-trust authorization decision engine to obtain the requester's identity authentication information and device fingerprint information. At the same time, based on the planned execution time window in the structured intent object, retrieve the scheduling information, permission change records and historical operation behavior baselines within the corresponding time window, calculate the time decay risk factor, and integrate the identity authentication result, device health, behavior abnormality and the overall parsing credibility to generate a comprehensive risk level. S4. Perform the operation according to the comprehensive risk level: generate a dynamic authorization token directly when the risk is low; trigger secondary verification and generate a dynamic authorization token after user confirmation when the risk is medium; reject the request when the risk is high. S5. After verifying the validity of the dynamic authorization token, generate multiple SD-WAN candidate policies based on the structured intent object, perform policy conflict detection based on resource contention coefficient and background traffic load, and feed the conflict detection results back to the weight adjustment process of comprehensive risk level; S6. Input the multiple candidate strategies into the simulation sandbox for simulation verification. After selecting the optimal strategy, convert it into a configuration command for the SD-WAN controller, send it out for execution through a secure channel, and record the execution summary of this scheduling and store it in the operation log database.

2. The natural language based SD-WAN zero trust intelligent operations decision method according to claim 1, characterized in that: The confidence level is generated as follows: after multiple forward propagations of the same natural language command, the consistency of the output of each field is statistically analyzed. If the multiple outputs are completely consistent, it is marked as high confidence; if there are two or more different results and each accounts for a certain proportion, it is marked as low confidence; and the rest are marked as medium confidence. The overall parsing confidence is derived from the combined confidence levels of all fields.

3. The natural language based SD-WAN zero trust intelligent operations decision method according to claim 1, characterized in that: The time decay risk factor is calculated as follows: the larger the time interval between the current time and the planned execution start time, the smaller the time decay risk factor; if the scheduling information shows that the requester is not on duty within the planned execution time window, the time decay risk factor is further reduced; if the permission change record shows that the requester had a predetermined permission revocation before the start of the planned execution time window, the time decay risk factor is further reduced.

4. The natural language based SD-WAN zero trust intelligent operations decision method according to claim 2, characterized in that: The comprehensive risk level is generated as follows: the identity authentication result, device health, abnormal behavior, time decay risk factor and overall resolution credibility are weighted and fused according to preset weights to obtain a comprehensive risk score, and then the risk level is determined as low risk, medium risk or high risk based on the threshold range in which the comprehensive risk score falls; wherein the preset weights are dynamically adjusted according to the conflict detection feedback results, and the comprehensive risk level is also used to adjust the detection threshold when triggering subsequent policy conflict detection.

5. The natural language based SD-WAN zero trust intelligent operations decision method according to claim 4, characterized in that: The dynamic authorization token includes a user identifier, the hash value of the structured intent object, the authorization validity time window, and the maximum number of executions; generating multiple SD-WAN candidate policies involves matching the corresponding templates in the policy template library and filling in resource requirement parameters to generate multiple candidate policies, and automatically adjusting the candidate policy parameters if a conflict is detected; the method for selecting the optimal policy is based on preset evaluation criteria. The scheduling execution summary includes user identifier, natural language instruction, structured intent object, policy identifier, and issuance time.

6. The natural language based SD-WAN zero trust intelligent operations decision method according to claim 5, characterized in that: It also includes establishing an intent lifecycle tracking library: after generating the dynamic authorization token, an intent record is created and stored in a time-series database. The intent record includes a unique intent identifier, user identifier, natural language plain text, structured intent object, authorization token fingerprint, plan start time, plan end time, submission time, and status. After the policy is successfully issued, the policy identifier and issuance time are filled back into the corresponding intent record; the background scheduled task scans the intent records that will be executed in a preset time period in the future and preloads them into the memory cache.

7. The SD-WAN zero-trust intelligent operation decision-making method based on natural language according to claim 6, characterized in that: It also includes the step of multi-intent conflict predictability assessment: after receiving a new natural language instruction and parsing it to generate a new structured intent object, query the intent lifecycle tracking library for all existing intent records where the planned execution time overlaps with the time window of the new structured intent object and where there is competition between business type or resource type; For each existing intention record, the resource competition coefficient is calculated based on the resource demand, total resources, time overlap length, and predicted background traffic load generated by the time series prediction model based on historical data from the same period. When the resource competition coefficient exceeds a preset conflict threshold, a conflict prediction report is generated. The conflict prediction report includes a list of conflict intentions, conflict types, conflict severity, and suggested resolution solutions.

8. The natural language based SD-WAN zero trust intelligent operations decision method according to claim 7, characterized in that: When the severity of the conflict is determined to be irreconcilable, a conflict warning message is proactively pushed to the operation and maintenance personnel through the natural language interaction interface. The conflict warning message presents the conflict prediction report and optional resolution strategies in natural language. After receiving the resolution strategy selected by the operations and maintenance personnel, the resource requirement vector or time window of the new structured intent object is automatically updated, and then the updated structured intent object is resubmitted into the step of inputting the corrected structured intent object into the zero-trust authorization decision.

9. The natural language based SD-WAN zero trust intelligent operations decision method according to claim 8, characterized in that: It also includes the steps of semantic deterministic closed-loop calibration and dynamic adjustment of authorization weights: each time the user confirms the final correct parsing result through the natural language interaction interface, it is recorded as a positive sample, and the low-confidence parsing result initially generated by the large language model is used as a negative sample. The large language model is incrementally fine-tuned periodically using a contrastive learning method. Simultaneously, based on the resource competition coefficient and the overall resolution credibility in the conflict prediction report, the preset weights are adjusted in real time. When the resource competition coefficient is higher than the first threshold or the overall resolution credibility is lower than the second threshold, the proportion of conflict risk factors and semantic risk factors in the comprehensive risk score is increased, and secondary verification is triggered and the authorization validity time window in the dynamic authorization token is shortened.

10. The natural language based SD-WAN zero trust intelligent operations decision making method of claim 3, wherein: It also includes steps for monitoring and feedback on the policy execution effect: after the policy is issued and executed, the actual execution performance data and environmental event data of the policy are continuously collected from the SD-WAN controller. The actual execution performance data is compared with the expected performance of the policy to calculate the deviation index. The deviation index is associated with the corresponding intent record and stored in the historical deviation table. The resource reservation coefficient of subsequent similar intents is dynamically adjusted according to the deviation index. The deviation index is fed back to the calculation process of the time decay risk factor.

Images