Cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning

Abstract

The application discloses a cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning, and belongs to the technical field of AI-assisted network management; the method first acquires matched to-be-detected configuration blocks and standard template blocks, and maps marked words in configuration statements into roles such as commands, parameters, referenced objects, resource entities and operation polarities. Subsequently, role-based differential evidence is constructed and judgment routing is performed: when no reference, resource and polarity change is contained, basic difference comparison is performed to output simple anomalies; when reference or resource change is contained, structure anomaly verification is performed in combination with graph retrieval enhanced generation architecture to extract graph context; when polarity change is contained, a semantic arbitration evidence package containing optional graph context is constructed, and a large language model is called for controlled semantic arbitration. The application realizes accurate routing and collaborative verification of anomalies, improves the accuracy and explainability of detection while controlling the computing power overhead.

Description

Technical Field

[0001] This invention belongs to the field of AI-assisted network management technology, specifically relating to a cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning. Background Technology

[0002] With the development of 5G, 6G, cloud-network convergence, industry private networks, and intelligent operation and maintenance technologies, modern communication networks are increasingly characterized by multi-vendor, multi-protocol, and multi-service collaborative operation. Operators and large enterprise networks typically deploy multiple types of devices simultaneously, including routers, switches, firewalls, and security gateways. Network configuration files directly impact routing, security policies, access control, and service connectivity. Devices from different vendors vary significantly in command structure, parameter format, configuration hierarchy, and policy expression. In actual operation and maintenance, issues such as missing statements, incorrect parameters, missing object references, resource conflicts, and policy action conflicts may occur. If these anomalies are not detected in a timely manner, they can lead to unreachable routes, access control failures, service interruptions, and even security risks.

[0003] In existing technologies, network configuration inspection mainly follows two technical paths: link logic verification and rule self-learning. For example, patent application CN116170304B discloses a method for checking network device configuration files. This method generates a configuration file and a network link table by obtaining the initial configuration file and the current configuration file, and determines whether the configuration is qualified by combining the MAC address in the trust certificate and the link consistency. This method is suitable for configuration checks in specific network link and trust relationship scenarios, but its focus is on the consistency verification between the configuration file, trust certificate, and network link table. It lacks fine-grained characterization of command roles, parameter roles, object references, resource consumption, and operation polarity changes within the configuration statement, making it difficult to directly complete the multi-type anomaly judgment in cross-platform configuration audits.

[0004] For example, patent application CN119854127B relates to a self-learning algorithm and device for network configuration audit rules, which can improve the automation capability of configuration audit through rule learning. This type of method is significant in reducing the cost of manual rule maintenance, but it typically still relies on existing rules, historical samples, and manual verification results. When faced with cross-vendor command differences, insufficiently covered structural relationships, resource mutual exclusion constraints, and semantic boundary anomalies, relying solely on rule self-learning is insufficient to form anomaly explanations supported by structural evidence, and it is also difficult to effectively constrain the input range and output results of semantic reasoning modules such as large language models.

[0005] In summary, existing configuration anomaly detection technologies still struggle to simultaneously address local text difference recognition, cross-block structural relationship verification, and complex semantic anomaly arbitration. Ordinary text differencing struggles to distinguish between command keyword perturbations, parameter changes, object reference changes, resource usage changes, and operation polarity changes; single-rule or link-checking methods are insufficient for verifying object definitions, reference paths, resource usage, and scope relationships; and directly using large language models for full-scale judgment can easily lead to high inference costs and output instability.

[0006] Therefore, there is an urgent need for a cross-platform network configuration anomaly detection method that can synergistically utilize role-based differential evidence, graph structure evidence, and controlled semantic reasoning capabilities to improve the accuracy, interpretability, and verifiability of configuration audits. Summary of the Invention

[0007] To address the shortcomings of existing technologies, the present invention aims to provide a cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning, thereby solving the problems in existing technologies.

[0008] The objective of this invention can be achieved through the following technical solutions: A cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning includes the following steps: Retrieve the matched configuration blocks to be inspected and the standard template blocks; The configuration statements in the configuration block to be inspected and the standard template block are segmented, and the marker words in the configuration statements are mapped to command roles, parameter roles, reference object roles, resource entity roles, and operation polarity roles. Based on the mapping results of the marker words, statement sequence difference is performed on the configuration block to be inspected and the standard template block to construct role-based differential evidence; Based on the aforementioned role-based differential evidence, the decision path is routed accordingly. When the role-based differential evidence does not include changes in the referenced object role, the resource entity role, and the operation polarity role, a basic difference comparison is performed based on the role-based differential evidence, and a simple anomaly determination result is output. When the role-based differential evidence includes changes in the role of the referenced object or the role of the resource entity, an online configuration entity relationship graph is constructed, and the graph context is extracted by combining the structural evidence index of the enhanced generation architecture with offline graph retrieval. Structural anomaly verification is performed based on the graph context, and structural anomaly judgment result is output. When the role-based differential evidence includes changes in the operational polarity role, the command context is extracted from the configuration statement, and differential facts are extracted from the role-based differential evidence. A semantic arbitration evidence package is constructed, which includes the differential facts, the command context, and the optional graph context. When changes in the referenced object role or the resource entity role exist simultaneously, the generated graph context is added to the semantic arbitration evidence package. Based on the semantic arbitration evidence package, controlled prompt words are constructed. Based on the controlled prompt words, a large language model is invoked to perform polarity prompt analysis and context understanding, and a semantic anomaly determination result is output.

[0009] Furthermore, the role-based differential evidence is a multidimensional feature data set, which includes at least the differential fragment type, character similarity, token overlap, local edit distance, semantic role annotation results, and sentence positional relationship.

[0010] Furthermore, the process of performing basic difference comparison based on the aforementioned role-based differential evidence and outputting a simple anomaly determination result includes: When the role-based differential evidence indicates the existence of missing statements on the template side or redundant statements on the side to be inspected, the missing statements or the redundant statements are extracted, and a global coverage check and a position consistency check are performed in the configuration block to be inspected or the standard template block. When there are highly similar matching segments across different positions in other positions, output the result of position migration or order error determination; When the cross-position high similarity matching segment does not exist, output the result of the missing statement or redundant statement determination; A high similarity matching segment refers to a sentence segment where the character similarity and token overlap are not less than 0.75, and the semantic role sequence or command role corresponding to the two are consistent.

[0011] Furthermore, the operational polarity role includes action polarity, direction polarity, or state polarity; the routing of the decision path based on the role-based differential evidence also includes: Identify the change type of the operation polarity role, and determine whether the change type is in a valid policy context or functional state context in combination with the command context; When it is determined that the policy is within a valid policy context, policy conflict candidates are generated; When the judgment is in a functional state context, semantic inconsistency candidates are generated.

[0012] Furthermore, the process of performing structural anomaly verification based on the context of the graph and outputting the structural anomaly determination result includes: Based on the change in the role of the referenced object, query the online configuration entity relationship graph to see if there is a defined object of the same type, name and scope that is reachable; When the defined object does not exist, and the rule constraints in the graph context indicate that the referenced object is necessary for configuration, confirm that the output dependency is missing.

[0013] Furthermore, the process of outputting the structural anomaly determination result also includes: Based on the changes in the roles of the resource entities, the occupancy relationships of the same resource are aggregated in the online configuration entity relationship graph; When the occupancy relationship is incompatible with reuse, and the rule constraints in the graph context indicate that the resource cannot be reused in the current context, the resource conflict result is confirmed and output.

[0014] Furthermore, after invoking a large language model to perform polarity suggestion analysis and contextual understanding based on the controlled prompt words, and outputting semantic anomaly determination results, the process also includes: The semantic anomaly determination results output by the large language model are subjected to format verification and evidence consistency verification. When the field format of the semantic anomaly determination result does not conform to the preset format constraint, or when the evidence referenced by the semantic anomaly determination result exceeds the scope of the semantic arbitration evidence package, the semantic anomaly determination result is intercepted, and the controlled prompt word is reconstructed and the large language model is called again.

[0015] Furthermore, the controlled prompt words include a non-open category tag set, which includes: semantic inconsistency, policy conflict, and no semantic anomaly; The process of outputting semantic anomaly determination results includes: strictly limiting the output anomaly types of the large language model to the non-open classification label set.

[0016] A cross-platform network configuration anomaly detection device based on heterogeneous evidence collaborative reasoning executes the above method, including: The data acquisition module is used to acquire matched configuration blocks to be inspected and standard template blocks; The role mapping module is used to segment the configuration statements in the configuration block to be inspected and the standard template block, and map the marker words in the configuration statements to command roles, parameter roles, reference object roles, resource entity roles and operation polarity roles; The differential construction module is used to perform statement sequence differential on the configuration block to be inspected and the standard template block according to the mapping result of the marker words, and construct role-based differential evidence; The decision routing module is used to perform traffic routing for the decision path based on the role-based differential evidence. When the role-based differential evidence does not include changes in the referenced object role, the resource entity role, and the operation polarity role, a basic difference comparison is performed based on the role-based differential evidence, and a simple anomaly determination result is output. When the role-based differential evidence includes changes in the role of the referenced object or the role of the resource entity, an online configuration entity relationship graph is constructed, and the graph context is extracted by combining the structural evidence index of the enhanced generation architecture with offline graph retrieval. Structural anomaly verification is performed based on the graph context, and structural anomaly judgment result is output. When the role-based differential evidence includes changes in the operational polarity role, the command context is extracted from the configuration statement, and differential facts are extracted from the role-based differential evidence. A semantic arbitration evidence package is constructed, which includes the differential facts, the command context, and the optional graph context. When changes in the referenced object role or the resource entity role exist simultaneously, the generated graph context is added to the semantic arbitration evidence package. Based on the semantic arbitration evidence package, controlled prompt words are constructed. Based on the controlled prompt words, a large language model is invoked to perform polarity prompt analysis and context understanding, and a semantic anomaly determination result is output.

[0017] A computer storage medium storing a readable program that, when executed, instructs a computing device to perform the cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning as described above.

[0018] The beneficial effects of this invention are: 1. This invention explicitly distinguishes different functional components in configuration statements through semantic role labeling, and can identify whether the difference occurs in the command, parameter, reference object, resource entity or operation polarity position, thus avoiding mixing configuration differences of different natures into ordinary text differences.

[0019] 2. This invention achieves rapid and simple anomaly detection through role-based differential evidence, and can classify and process missing statements, redundant statements, syntax errors, parameter mismatches, and sequence errors, thereby improving the efficiency and accuracy of local configuration anomaly detection.

[0020] 3. This invention drives the diversion of complex anomaly candidates through semantic role evidence index, so that dependency missing candidates, resource conflict candidates, semantic inconsistency candidates and policy conflict candidates enter different subsequent verification paths, thus avoiding premature misjudgment of complex anomalies by pre-rules.

[0021] 4. This invention generates a Graph Context by configuring an entity relationship graph online and using an offline GraphRAG structure evidence index, which enables the determination of missing dependencies and resource conflicts to have traceable definition reference paths, resource occupancy relationships, and rule constraint evidence.

[0022] 5. This invention limits the large language model to a controlled arbiter of semantic anomaly candidates, rather than a full anomaly classifier, thereby reducing the use of irrelevant samples and reducing the instability caused by open reasoning through constraints on evidence sources and output formats.

[0023] 6. This invention can output the anomaly type, anomaly location, differential basis, structural evidence, semantic arbitration basis, and repair suggestions, which facilitates the review by operation and maintenance personnel and subsequent template maintenance. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a schematic diagram of the framework of the cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning of the present invention. Figure 2 This is a simplified flowchart of the cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning, as described in this invention. Figure 3 This is a flowchart of the complex anomaly candidate diversion process of the cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning of the present invention. Figure 4 This is a flowchart illustrating the structural anomaly verification process of the cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning, as described in this invention. Figure 5 This is a flowchart of the semantic anomaly arbitration process for the cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning, as described in this invention. Detailed Implementation

[0026] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] Example 1 This embodiment provides a cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning. The method takes a matched configuration block to be inspected and a standard template block as input, and outputs a configuration anomaly report. The configuration anomaly report includes the anomaly type, anomaly location, supporting evidence, and remediation suggestions.

[0028] like Figure 1As shown, the cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning includes the following steps: Step S1: Receive the matched configuration block to be inspected and the standard template block.

[0029] The configuration block to be tested and the standard template block have a corresponding relationship in terms of configuration function or business intent. They can come from the same manufacturer's equipment or from different manufacturers' equipment. Subsequent system tests all use this configuration block pair as input, and do not perform indiscriminate full-scale judgment on the complete configuration file.

[0030] Step S2: Perform semantic role annotation on the configuration statements in the configuration block to be inspected and the standard template block to obtain semantic role representations; Specifically, the system first performs token segmentation on the configuration statement, and then combines placeholders in the standard template, preset regular expressions, vendor command dictionaries, and command context rules to map the token in the configuration statement to command roles, parameter roles, reference object roles, resource entity roles, and operation polarity roles. Fixed command words, protocol keywords, and command operators are marked as command roles; variable components such as IP addresses, interface numbers, VLAN numbers, port numbers, AS numbers, masks, thresholds, metrics, and time parameters are marked as parameter roles; objects appearing in the context of invocation, reference, or policy matching, such as ACLs, route-policy, prefix-lists, community-lists, VRFs, VLANs, and policy object names, are marked as reference object roles; objects that can be bound, occupied, or reused, such as IP addresses, address ranges, VLAN IDs, interface numbers, ACL numbers, route-targets, and policy names, are marked as resource entity roles; tokens with action, status, or directional meanings, such as permit, deny, enable, disable, allow, block, import, export, inbound, and outbound, are marked as operation polarity roles in the context of policies, filtering, route propagation, or function switching. The semantic role labeling function is represented as follows: in, This indicates the configuration statement to be annotated. Represents configuration statements The number of tokens in the middle, Represents configuration statements The first in One token, express The corresponding semantic roles, and CMD represents the command role, PARAM represents the parameter role, REF represents the reference object role, RES represents the resource entity role, and OP represents the operation polarity role. In one embodiment, the semantic role labeling includes the following process: First, identify predefined or template-normalized placeholders in the standard template statement, and infer the parameter type or object type of the corresponding token based on the placeholder name; for example, ... <ipv4> 、 <ipv6> 、 <vlan> 、 <port> 、 <as> 、 <mask>Mark as parameter role,<ACL_NAME> ,<POLICY_NAME> ,<PREFIX_LIST_NAME> ,<VRF_NAME> Mark as a referenced object role; Secondly, regular expressions are used to identify the value type token in the configuration statement to be inspected, and it is marked as a parameter role or a resource entity role according to its occurrence position and command context. For example, based on regular expressions for IPv4 / IPv6 address, interface name, VLAN number, port number, and AS number, variable components such as IP address, interface number, VLAN ID, port number, and AS number are identified. When the variable component is used to describe the command value, it is marked as a parameter role; when the variable component is used to represent an object that can be bound, occupied, or reused, it is marked as a resource entity role. Furthermore, the fixed command words, protocol keywords, and command operators in the configuration statements are identified by combining the vendor command dictionary, and they are marked as command roles; the vendor command dictionary includes interface configuration commands, access control commands, routing policy commands, prefix list commands, VPN / VRF commands, and routing protocol commands in different vendor configuration syntaxes; Finally, the reference object role, resource entity role, and operation polarity role are corrected according to the command context in which the token is located. When the token appears in an object call, policy reference, or matching condition, it is marked as a reference object role. When the token appears in a resource binding, address configuration, interface binding, or resource reuse context, it is marked as a resource entity role. When the token belongs to the preset operation polarity vocabulary and is in a policy action, filtering direction, route propagation direction, or functional state context, it is marked as an operation polarity role.

[0031] Step S3: Based on the semantic role annotation results, perform statement sequence difference on the configuration block to be inspected and the standard template block to construct role-based differential evidence.

[0032] Specifically, the system performs a differential comparison between the statement sequence in the standard template block and the statement sequence in the configuration block to be inspected to obtain differential segments. These differential segments include consistent segments, one-sided differential segments, and content-replacement segments. A consistent segment represents a statement segment whose content is identical in both the standard template block and the configuration block to be inspected; a one-sided differential segment represents a statement segment that exists only in the standard template block or only in the configuration block to be inspected; and a content-replacement segment represents a statement segment in the standard template block and the configuration block to be inspected that corresponds in position but has inconsistent content.

[0033] The role-based differential evidence is used to describe the type of differential fragment, text similarity, local character perturbation, semantic role position, and sentence position relationship, and is represented as follows: in, Indicates the difference fragment type. Indicates character similarity. Indicates the token overlap. Indicates the local edit distance. This indicates the semantic role labeling results. Indicates the positional relationship of statements.

[0034] in, and The calculation method is the same as that in the definition of highly similar matching segments mentioned above; Used to measure character-level perturbation between aligned tokens, denoted as: In the formula, and Represents a set of aligned tokens. This indicates that the token will be used. Convert to token The minimum number of insertions, deletions, or replacements required.

[0035] Differential segment type O is used to distinguish between consistent segments, one-sided difference segments, and content-substitute segments; character similarity Used to measure the similarity in overall text structure between template statements and configuration statements to be inspected; token overlap. Used to measure the degree of overlap between the two in terms of command components; local edit distance Used to measure character-level perturbation between aligned tokens; Semantic role labeling result Z is used to determine the command role, parameter role, reference object role, resource entity role, or operation polarity role of the differing token; Statement position relationship Pos is used to determine the relative order changes of configuration statements in the standard template block and the configuration block to be inspected.

[0036] Step S4: Perform semantic role-driven simple anomaly detection based on role-based differential evidence; specific steps are as follows. Figure 2 As shown; For differential fragments that exist on the template side but not on the configuration to be inspected side, the system generates initial missing candidates; for differential fragments that exist on the configuration to be inspected but not on the template side, the system generates redundant initial candidates. The system performs global coverage verification and position consistency checks on the missing and redundant initial candidates. If the missing statement on the template side can find a cross-position high similarity match in other positions of the configuration to be inspected, the candidate is not directly output as a missing statement, but enters the position migration judgment; if the newly added statement on the configuration to be inspected can form a cross-position high similarity match with the missing statement on the template side, the sequence error correction process is entered; if no cross-position high similarity match exists, the missing or redundant statement is confirmed.

[0037] For content replacement fragments, the system determines the error based on the semantic role of the difference token. If the difference occurs in the parameter role, and the value to be checked violates the corresponding type, format, or value range constraints, it is determined to be a parameter mismatch. If the difference occurs in the command role, and the local edit distance between the token to be checked and the valid command keyword is less than a preset threshold, it is determined to be a syntax error. If there are highly similar matching fragments between the template statement and the statement to be checked, and the relative order of the highly similar matching fragments in the standard template block and the configuration block to be checked is reversed, it is determined to be an order error. If the above conditions are not met, no simple exception result is output.

[0038] The highly similar matching segment refers to the character similarity between the template statement t and the configuration statement c to be checked after whitespace normalization and case unification. overlap with token Statement fragments with a value of not less than 0.75, and whose corresponding semantic role sequences or primary command roles are consistent.

[0039] Among them, character similarity Defined as: In the formula, template statement With the configuration statement to be inspected The length of the longest common subsequence, template statement The length of the characters, Indicates the configuration statement to be inspected The character length.

[0040] token overlap Defined as: In the formula, Represents the set of tokens for template statement t. This represents the set of tokens for the configuration statement c to be inspected. This represents the set of tokens shared by both parties. and These represent the number of tokens in the two token sets, respectively.

[0041] When the missing statement on the template side and the redundant statement on the test side meet the above high similarity matching conditions, and their relative positions in the standard template block and the test configuration block are inconsistent, it is determined that the difference is not a real missing or redundant statement, but is caused by position migration, and the result of the order error judgment is output.

[0042] Step S5, as follows Figure 3 As shown, when the role-based differential evidence contains changes in referenced objects, resource entities, or operation polarity, the complex anomaly candidate routing driven by the semantic role evidence index is initiated.

[0043] The complex anomaly candidate routing is implemented based on a reference definition index, a resource occupancy index, and a domain polarity trigger table. The reference definition index is used to query whether the referenced object has a definition object of the same type, name, and scope reachable; the resource occupancy index is used to record the resource type, resource value, bound role, occupant, scope, and command structure; the domain polarity trigger table is used to identify actions, states, or direction changes such as permit, deny, enable, disable, import, export, inbound, and outbound.

[0044] For the reference object role, the system extracts the object type, object name, and reference scope of the reference object, and queries the reference definition relationship. If no definition object of the same type, name, and reachable scope is found, a dependency missing candidate is generated; if a valid definition exists, no dependency missing candidate is generated.

[0045] For resource entity roles, the system constructs resource occupancy relationships. If the same resource is repeatedly bound or occupied in an incompatible context, a resource conflict candidate is generated; if resource reuse is permitted in the scope or vendor rules, no resource conflict candidate is generated.

[0046] For operational polarity roles, the system identifies changes in action, state, or direction, and determines whether it is within a valid policy context or functional state context based on the command context. If the polarity change occurs within a policy context such as ACL, route-policy, or filter-policy, a policy conflict candidate is generated; if the polarity change occurs within a function start / stop, state switch, or operating mode context, a semantic inconsistency candidate is generated. If the same difference fragment simultaneously contains changes in referenced objects or resource entities, and is accompanied by an operational polarity change, a structural semantic composite candidate is generated.

[0047] Step S6, as follows Figure 4 As shown, for structural anomaly candidates, the system performs graph evidence index-driven structural anomaly verification.

[0048] This phase first constructs an online configuration entity relationship graph to depict the definitions, references, bindings, occupancy, scope ownership, and mutual exclusion constraints in the current configuration to be inspected; then, it combines the offline semantic clustering tree and entity relationship index to perform local retrieval, global retrieval, evidence sorting, and evidence fusion to generate a Graph Context.

[0049] The online configuration entity relationship graph uses configuration objects and resource entities in the current configuration to be inspected as nodes, and the structural relationships expressed in the configuration statements as edges. Configuration objects include interfaces, ACLs, prefix lists, routing policies, VRFs, VLANs, neighbor objects, and policy nodes; resource entities include IP addresses, address ranges, VLAN IDs, interface numbers, ACL numbers, and route-targets. If a configuration statement declares a configuration object, a definition relationship is established; if a configuration statement calls objects such as ACLs, route-policies, prefix lists, VRFs, or VLANs, a reference relationship is established; if an interface, policy, or service object is associated with a rule, policy, or resource, a binding relationship is established; if a configuration object uses resources such as IP addresses, VLAN IDs, interface numbers, ACL numbers, or route-targets, a usage relationship is established.

[0050] Scope attribution is automatically extracted based on view entry statements, configuration block boundaries, and hierarchical relationships in the configuration file. When a view entry statement such as interface, VLAN, ACL, route-policy, BGP, OSPF, VPN-instance, or address-family is detected, the system designates that view as the current scope; subsequent configuration statements belong to this scope until they encounter another sibling view entry statement or an exit marker. For configurations with multi-level views, the system forms scope paths based on the configuration block hierarchy and establishes the attribution relationship between configuration statements, object nodes, or resource nodes and scope nodes.

[0051] Mutual exclusion constraints are determined by resource type, resource value, bound role, occupying entity, command skeleton, and scope. The system first extracts resource occupancy relationships based on the resource entity's role. ,in, Represents a resource entity. Indicates the scope of the resource. This indicates that resources are bound to roles. This indicates the configuration object or configuration item that uses the resource. Represents the command skeleton. If the same resource... Within the same or overlapping scope, by different Mutual exclusion or mutually exclusive If a binding is repeated, a mutual exclusion constraint relationship will be established or a mutual exclusion constraint check will be triggered. For example, if the same Layer 3 IP address is configured on two different interfaces, it is determined that there is a risk of mutual exclusion; if the same VLAN ID is used by multiple access ports, since this scenario allows reuse, a mutual exclusion constraint relationship will not be directly established.

[0052] Offline structural evidence consists of a semantic clustering tree, an entity relationship graph, and an entity-to-configuration-block index. The semantic clustering tree organizes the functional hierarchy of configuration blocks in standard templates, vendor rules, and verified configuration samples. Its leaf nodes correspond to specific configuration blocks, storing the configuration block text, vendor type, functional category, line number range, and scope path. Clustering nodes correspond to functional clusters formed by similar configuration blocks, representing the global semantic proximity relationship between configuration blocks. The entity relationship graph stores configuration objects and resource entities in offline configuration samples, along with their definitions, references, bindings, occupancy, and mutual exclusion relationships. The entity-to-configuration-block index quickly locates relevant template fragments or verified configuration fragments based on candidate entities, while the configuration-to-entity index reverse-engineers the object and resource entities involved in the template fragments.

[0053] During online retrieval, the system employs a hybrid retrieval mechanism combining vector recall and entity relationship expansion. First, the system uses configuration text, object name, resource value, scope, and command skeleton from the structural anomaly candidates as query information. It then uses the configuration block vector index to recall template fragments or verified configuration fragments semantically similar to the current candidate. In this embodiment, the configuration block vector is generated by the RoBERTa model, using token embedding and mean pooling to obtain block-level semantic vectors, and a vector index is established using FAISS.

[0054] Subsequently, the system uses entities from the vector recall results and candidate entities from the structural anomaly candidates as entry points, performing one- to two-hop adjacency expansion in the entity relationship index to obtain structural relationship evidence such as definitions, references, bindings, and occupancy. Its graph expansion logic can be represented as: in, Indicates a candidate for structural anomaly. This represents the set of candidate configuration blocks obtained from vector recall. This represents the set of entities extracted from the structural anomaly candidates. This represents the set of entities extracted from the recall configuration block, and E represents the relation edge in the entity relation index. and Let each represent a set of one-hop neighbor entities and a set of two-hop neighbor entities. The system, based on... , and By tracing back through the relevant configuration blocks, we can obtain the definition blocks, reference blocks, binding relationships, and resource usage relationships of the candidate objects.

[0055] The retrieval process includes local retrieval and global retrieval. Local retrieval focuses on candidate entities and their neighborhood relationships, mainly returning definition blocks, reference blocks, binding relationships, and resource usage relationships directly related to the candidate objects. Global retrieval focuses on the function family, vendor type, scope path, and command skeleton to which the candidate configuration block belongs, mainly returning template structures, vendor rules, and historical correct configuration evidence related to the candidate.

[0056] For the recalled candidate evidence, the system sorts them according to entity coverage, scope consistency, path support, and template relevance: in, Indicates a candidate for structural anomaly. Indicate candidate evidence; It indicates the degree of entity coverage and is used to measure whether candidate evidence contains candidate objects, resource values, or similar entities; Indicates scope consistency, used to measure whether candidate evidence is in the same vendor, same configuration view, or same scope path as the candidate; Indicates the degree of path support, used to measure whether there are definitions, references, bindings, or path occupancy in candidate evidence; Template relevance is used to measure the degree of association between candidate evidence and the current matching standard template block or similar template structure; , , and These are the weighting coefficients.

[0057] Evidence fusion is used to merge the current configuration facts in the online configuration entity relationship graph with structural evidence from the offline semantic clustering tree, entity relationship graph, and template fragment index to form a Graph Context. The Graph Context is represented as: in, Represents a candidate correlation subgraph. This indicates the definition of the reference path. Indicates resource usage relationships. Indicates rule constraints. This represents a relevant template fragment. The Graph Context is used for structural anomaly verification of missing dependencies and resource conflicts; it can also serve as structured evidence input for semantic anomaly arbitration when candidates simultaneously involve changes in operation polarity.

[0058] Step S7: Verify structural anomalies based on the Graph Context.

[0059] For candidate missing dependencies, the system queries the online entity relationship graph for defined objects of the same type, name, and scope based on the object type, object name, and scope of the referenced object. If no valid definition exists, and the template fragment or rule constraint in the Graph Context indicates that the referenced object should have a valid definition, then the dependency is confirmed as missing. If a valid definition exists, or offline structural evidence does not support the necessity of the reference, then the dependency is not confirmed as missing.

[0060] For potential resource conflict candidates, the system aggregates the occupancy relationships of the same resource entity in the current configuration and determines whether incompatible reuse exists by combining the resource type, resource value, bound role, occupant, scope, and command structure. If incompatible reuse exists, and the rule constraints in the Graph Context indicate that the resource cannot be reused in the corresponding context, then a resource conflict is confirmed. If duplicate occupancy occurs in different scopes or in reuse scenarios allowed by vendor rules, then a resource conflict is not confirmed.

[0061] Step S8, as shown in Figure 5, involves the system performing semantic anomaly arbitration with structural evidence constraints for semantic anomaly candidates.

[0062] This phase first receives semantic anomaly candidates, including operation polarity changes, differential facts, template statements, configuration statements to be inspected, command contexts, and optional graph contexts. Then, a semantic arbitration evidence package is constructed to organize the candidate-related evidence into a controlled input that can be processed by a large language model.

[0063] The semantic arbitration evidence package is represented as follows: in, This represents the difference between the template statement and the configuration statement to be inspected. This represents a standard template statement. This indicates the configuration statement to be checked. Indicates the command context. This indicates an optional Graph Context. When semantic candidates only involve changes in operation polarity... Empty; when semantic candidates simultaneously involve reference paths, resource usage, or scope relationships, It was added to the semantic arbitration evidence package.

[0064] Step S9: Based on controlled prompts, invoke the large language model to complete semantic anomaly arbitration.

[0065] When complex anomaly candidates are routed to the semantic arbitration path, the system constructs controlled hints based on semantic role changes, differential facts, command context, and optional Graph Context. These controlled hints are then input into the large language model to obtain the semantic anomaly arbitration result. The semantic anomalies include semantic inconsistencies and policy conflicts; when the evidence is insufficient to support these semantic anomalies, a conclusion of no semantic anomaly is output.

[0066] The controlled prompt is represented as follows: in, This represents the set of semantic conclusions that are allowed to be output, including semantic inconsistencies, policy conflicts, and no semantic anomalies. This indicates a semantic arbitration evidence package; This indicates output format constraints.

[0067] The semantic arbitration evidence package include: in, This indicates the differences between the configuration statement to be inspected and the standard template statement, including the changed tokens, semantic roles, changes in operation polarity, and the locations of the differences. This represents a standard template statement or standard template fragment; This indicates the configuration statement or configuration fragment to be inspected. It represents the command context, including vendor type, configuration view, scope path, command type, and policy context; This represents the Graph Context generated by the graph structure layer. When the candidate lacks structural evidence... Empty.

[0068] In one embodiment, the controlled prompts include two parts: system prompts and user prompts. System prompts are used to define the role of the large language model, the available anomaly types, the scope of evidence used, and the output format; user prompts are used to fill in the specific evidence for the current candidate. The system prompts include the following constraints: the large language model can only select one conclusion from semantic inconsistency, policy conflict, and no semantic anomaly; it can only make judgments based on the input differential facts, standard template statements, configuration statements to be inspected, command context, and Graph Context; it cannot generate anomaly types outside the preset range; and it cannot cite facts other than the input evidence.

[0069] The user prompts are organized according to structured fields, including: [Differential Facts]: Records the tokens that have changed, their values ​​before and after the change, their corresponding semantic roles, and changes in operational polarity; [Standard Template]: Records the standard template statement or template fragment that matches the current candidate; [Configuration to be inspected]: Records the configuration statements or fragments to be inspected; [Command Context]: Records vendor type, configuration view, scope path, command category, and policy context; [Graph Context]: Records candidate related subgraphs, defines reference paths, resource consumption relationships, rule constraints, and related template fragments; if no graph structure evidence exists, this field is empty; [Output Requirements]: The large language model is required to output the arbitration results in a structured JSON format.

[0070] The output format constraint F requires the large language model to output the following fields: in, This indicates the semantic arbitration conclusion, with values ​​limited to semantic inconsistency, policy conflict, or no semantic anomaly. Indicates confidence level; Evidence can be presented as evidence, including differential tokens that trigger the judgment, template statements, configuration statements to be checked, and structural evidence in the command context or Graph Context. This indicates a repair suggestion.

[0071] Step S10: Verify the model output and generate a configuration exception report.

[0072] After receiving the output of the large language model, the system first performs a structured format validation on the output. The output of the large language model adopts a preset JSON field format, which includes at least the fields for exception type, confidence level, evidence, and repair suggestion. The format validation is used to determine whether the output can be parsed into valid JSON, whether it contains the preset fields, and whether the exception type field belongs to the allowed output set. If the output cannot be parsed, lacks necessary fields, or the exception type does not belong to the allowed output set, the output is deemed invalid, and a controlled prompt is reconstructed for arbitration; if the format constraints are still not met, the model output is not adopted.

[0073] Subsequently, the system performs evidence consistency verification on the model output. The system parses the evidence reference fields in the model output into evidence entries and matches them against differential facts, standard template statements, configuration statements to be checked, command contexts, and graph contexts in the semantic arbitration evidence package. If the evidence token, configuration statement, object name, resource value, scope path, or graph structure relationship referenced by the model can be found in the semantic arbitration evidence package, the evidence is deemed valid; if the evidence referenced by the model cannot be matched in the semantic arbitration evidence package, the model is deemed to have referenced evidence that does not exist in the input evidence package.

[0074] The evidence consistency verification includes keyword reverse matching and string inclusion verification. Keyword reverse matching is used to retrieve the differential token, object name, resource value, and scope keywords in the model output back to the semantic arbitration evidence package. String inclusion verification is used to determine whether the template statement, configuration statement to be checked, or Graph Context evidence fragment referenced by the model output is included in the input evidence package, or whether it reaches a preset similarity threshold with the evidence fragment in the input evidence package. If all the key evidence in the evidence basis field passes the above verification, the output is retained; if the key evidence fails the verification, the output is not adopted, and a controlled prompt is reconstructed for arbitration.

[0075] The system also performs consistency checks on repair suggestions. If a repair suggestion involves restoring policy actions, adjusting policy direction, supplementing referenced objects, or modifying resource bindings, it checks whether the suggestion is consistent with the exception type and supporting evidence. For example, when the exception type is a policy conflict, the repair suggestion should focus on policy actions, policy direction, or policy binding relationships; when the exception type is semantic inconsistency, the repair suggestion should focus on changes in functional status, operating mode, or semantic polarity. If a repair suggestion is inconsistent with the exception type or supporting evidence, it will not be adopted.

[0076] Finally, the system summarizes the simple anomaly judgment results, structural anomaly verification results, and semantic anomaly arbitration results that pass the verification, generating a configuration anomaly report. The configuration anomaly report includes the anomaly type, anomaly location, differential basis, structural evidence, semantic arbitration basis, and remediation suggestions.

[0077] Example 2 In this embodiment, the solution of the present invention is further elaborated: To verify the effectiveness of the cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning proposed in this invention, experiments were conducted on the entire process of cross-platform configuration anomaly detection in a unified experimental environment. The experimental content includes: 1) comparison of the accuracy of configuration anomaly detection using multiple methods; 2) verification of detection effects under different anomaly types; 3) verification of the ability of the evidence routing mechanism to balance detection performance and inference efficiency; 4) runtime analysis compared with C-Tree, PreConfig, Ciri, and CAIP methods. The following section presents and analyzes the results of the experiments step by step.

[0078] I. Experimental Environment Configuration 1. Hardware environment: NVIDIA GeForce RTX 3050 Laptop GPU 2. Software environment: Python 3.9.25, PyTorch 2.6.0 + cu124 II. Experimental Dataset The test dataset covers six vendors, including Huawei and Fiberhome, and is used to evaluate the model's performance in detecting various configuration errors. Each vendor's anomaly dataset contains the same proportion of nine types of errors, including missing statements, redundant statements, spelling errors, and sequence errors, with each type of error evenly distributed. Specifically, Huawei devices account for 39% (2490 errors), Fiberhome for 22% (1379 errors), Cisco for 15% (976 errors), ZTE for 12% (770 errors), Ruijie for 6% (400 errors), and H3C for 6% (389 errors). The specific distribution is shown in Table 1.

[0079] Table 1 Test Dataset Details III. Experimental Methods and Procedures 1. Evaluation Indicators (a) Precision, recall, and F1 score To evaluate anomaly detection results, this paper uses Precision, Recall, and F1 as the main evaluation metrics. Precision measures the proportion of true anomalies in the detected results, Recall measures the proportion of anomalous samples that are correctly recalled, and F1 comprehensively reflects detection accuracy and recall capability. Their definitions are as follows: Where TP represents the number of correctly detected abnormal samples, FP represents the number of samples that were misclassified as abnormal, and FN represents the number of abnormal samples that were not detected.

[0080] (b) Overall performance indicators To measure the overall performance across different anomaly types, this paper further analyzes Micro-F1 and Macro-F1. Micro-F1 performs statistical analysis on all anomaly detection results at the overall sample level, while Macro-F1 averages the F1 scores for each anomaly type to measure the method's balance across different anomaly categories.

[0081] (c) Operational efficiency indicators To evaluate the method's operational efficiency, this paper statistically analyzes end-to-end runtime, module call ratio, and average execution time. The module call ratio includes the proportion of calls for structural evidence verification, large language model calls, and total calls to complex modules. Average execution time measures the end-to-end inference overhead of a single detection process.

[0082] 2. Key points of experimental implementation of the method of the present invention In this experiment, the method of the present invention uses the matched configuration block to be tested and the standard template block as input. The overall detection process includes three stages: differential evidence judgment, structural evidence verification, and semantic anomaly arbitration.

[0083] 2.1 Differential Evidence Determination Stage Statement-level differencing is performed on the configuration block to be inspected and the standard template block to generate consistent fragments, one-sided differencing fragments, and content replacement fragments. Simultaneously, semantic role labeling is applied to the configuration statements, marking tokens as command roles, parameter roles, reference object roles, resource entity roles, and operation polarity roles. Based on this, the system constructs role-based differencing evidence such as character similarity, token overlap, local edit distance, and statement positional relationships to identify simple anomalies such as missing values, redundancy, syntax errors, parameter mismatches, and sequence errors.

[0084] 2.2 Structural Evidence Verification Stage For samples in the differential evidence involving changes in referenced objects and resource entities, the system generates dependency missing candidates or resource conflict candidates and proceeds to the structural evidence verification stage. This stage constructs an online configuration entity relationship graph, characterizing the definitions, references, bindings, occupancy, and scope facts in the current configuration. Simultaneously, it uses the offline GraphRAG structural evidence index to retrieve relevant template fragments, structural paths, and rule constraints, generating a Graph Context to determine whether reference paths are broken and whether resource occupancy constitutes incompatible reuse.

[0085] 2.3 Semantic Anomaly Arbitration Phase For samples involving changes in operational polarity, the system generates semantic anomaly candidates and constructs a semantic arbitration evidence package. This evidence package includes differential facts, standard template statements, configuration statements to be inspected, command context, and optional GraphContext. The large language model arbitrates semantic anomaly candidates only under controlled cue constraints, outputting semantic inconsistency, policy conflict, or no semantic anomaly. The model output also undergoes format validation and evidence consistency validation to avoid referencing content beyond the input evidence.

[0086] 3. Comparison Methods This paper selects C-Tree, PreConfig, Ciri, and CAIP as comparison methods. C-Tree is a configuration statement tree and static semantic association method, primarily relying on the configuration tree structure and static matching for anomaly identification. PreConfig is a deep learning configuration representation method, mainly learning the relationships between configuration statements or configuration blocks through deep semantic representation. Ciri is a single-turn large language model configuration verification method, capable of using the model's semantic understanding capabilities for anomaly detection. CAIP is an iterative large language model configuration analysis method, enhancing contextual reasoning capabilities through multi-turn prompts.

[0087] IV. Experimental Results and Analysis 1. Summary of Results Table 2 Comparison of overall detection performance and runtime of different methods on the test set. As shown in Table 2, the method of this invention achieves the highest results on both Micro-F1 and Macro-F1, reaching 0.9624 and 0.9612 respectively, significantly outperforming C-Tree, PreConfig, Ciri, and CAIP. While C-Tree and PreConfig have shorter runtimes, they primarily rely on static structures or deep semantic representations, lacking explicit modeling of object references, resource consumption, and policy semantic boundaries, resulting in lower overall detection performance. Ciri and CAIP enhance semantic anomaly detection capabilities by incorporating large language models, but their runtime increases significantly with the number of large model calls. In contrast, the method of this invention achieves a better balance between detection performance and runtime overhead through the collaborative work of differential evidence, structural evidence, and controlled semantic arbitration.

[0088] 2. Evidence routing efficiency experiment and analysis To verify the ability of the evidence routing mechanism to balance detection performance and inference efficiency, this paper compares the complete model with the No-Gate setting. In the No-Gate setting, all samples enter structural evidence verification and large language model arbitration; the method of this invention calls upon evidence as needed based on anomalies and evidence requirements in the differential evidence. Experimental results are shown in Tables 3, 4, and 5.

[0089] Table 3 Performance Verification of Gating Mechanism Anomaly Detection As shown in Table 3, the detection performance did not decrease after introducing the evidence routing mechanism. The Precision, Recall, Micro-F1, and Macro-F1 scores of the complete model were 0.9804, 0.9449, 0.9623, and 0.9623, respectively. Compared with No-Gate, Recall improved by 1.15 percentage points, Micro-F1 improved by 0.59 percentage points, and Macro-F1 improved by 0.96 percentage points. This indicates that the evidence routing mechanism does not simply reduce subsequent module calls, but rather selects the appropriate detection path based on the anomaly type and evidence status.

[0090] Table 4. Efficiency Verification of Each Module by the Gating Mechanism As shown in Table 4, in terms of call ratio, the call ratios for structural evidence verification and LLM are both 1.0000 under the No-Gate setting; while in the method of this invention, the call ratio for structural evidence verification is 0.2045, the call ratio for LLM is 0.2549, and the total call ratio for complex modules is 0.4595. This result indicates that most samples do not need to enter the complete complex reasoning process, and structural evidence verification and the large language model mainly serve samples that truly require cross-block relation verification or semantic arbitration. Table 5. Average time consumption of the gating mechanism in each module. As shown in Table 5, the average total time of the method of this invention is 313.4514 ms, and the No-Gate time is 602.9973 ms, representing a reduction of approximately 48.02% in total time. Therefore, the evidence routing mechanism can effectively reduce the proportion of complex module calls and end-to-end inference time while maintaining detection performance.

[0091] 3. Running Time Experiment and Analysis To further compare the running efficiency of different methods, this paper statistically analyzes the running time of C-Tree, PreConfig, Ciri, CAIP, and the method of this invention on the dataset2 test set. The experimental results are shown in Table 2.

[0092] In terms of runtime, C-Tree and PreConfig had the lowest execution times, at 494.62 s and 659.27 s respectively. This is mainly because they do not perform explicit structural evidence verification and large language model arbitration. However, this lightweight design also limits their ability to detect complex anomalies, resulting in overall detection performance that is significantly lower than the method of this invention.

[0093] After Ciri and CAIP introduced large language models, their semantic anomaly detection capabilities were enhanced. However, when the large model was applied to all candidates, the runtime increased significantly. With reference anchors disabled, Ciri required 4261 large model calls, with an estimated runtime of approximately 9.77 hours; CAIP, due to its iterative suggestion mechanism, required 8468 calls, with an estimated runtime of approximately 19.27 hours.

[0094] In comparison, the method of this invention has a runtime of 3734.46 s, which is longer than C-Tree and PreConfig, but significantly shorter than the full-scale large-model validation method. This is because simple anomalies can be handled in the differential evidence determination stage, while missing information and resource conflicts are required to enter the structural evidence validation path, and semantic inconsistencies and policy conflicts are required to enter the large language model arbitration path. Therefore, the method of this invention limits high-overhead modules to a small number of complex candidates, achieving a better balance between complex anomaly detection capability and runtime efficiency.

[0095] 4. Experimental Conclusions In summary, the method of this invention demonstrates superior overall performance in cross-platform network configuration anomaly detection tasks. Compared to C-Tree and PreConfig, this method explicitly utilizes object references, resource consumption, and scope constraints to enhance structural anomaly identification capabilities. Compared to Ciri and CAIP, this method reduces the number of large language model calls and lowers inference costs through candidate-level semantic arbitration. Ablation experiments and evidence routing efficiency experiments further demonstrate that role-based differential evidence, graph structure evidence, and controlled semantic arbitration can form a complementary relationship, enabling the system to maintain high accuracy and interpretability in simple anomaly, structural anomaly, and semantic anomaly detection.

[0096] Example 3 In this embodiment, a cross-platform network configuration anomaly detection device based on heterogeneous evidence collaborative reasoning is proposed, specifically including: The data acquisition module is used to acquire matched configuration blocks to be inspected and standard template blocks; The role mapping module is used to segment the configuration statements in the configuration block to be inspected and the standard template block, and map the marker words in the configuration statements to command roles, parameter roles, reference object roles, resource entity roles and operation polarity roles; The differential construction module is used to perform statement sequence differential on the configuration block to be inspected and the standard template block according to the mapping result of the marker words, and construct role-based differential evidence; The decision routing module is used to perform traffic routing for the decision path based on the role-based differential evidence. When the role-based differential evidence does not include changes in the referenced object role, the resource entity role, and the operation polarity role, a basic difference comparison is performed based on the role-based differential evidence, and a simple anomaly determination result is output. When the role-based differential evidence includes changes in the role of the referenced object or the role of the resource entity, an online configuration entity relationship graph is constructed, and the graph context is extracted by combining the structural evidence index of the enhanced generation architecture with offline graph retrieval. Structural anomaly verification is performed based on the graph context, and structural anomaly judgment result is output. When the role-based differential evidence includes changes in the operational polarity role, the command context is extracted from the configuration statement, and differential facts are extracted from the role-based differential evidence. A semantic arbitration evidence package is constructed, which includes the differential facts, the command context, and the optional graph context. When changes in the referenced object role or the resource entity role exist simultaneously, the generated graph context is added to the semantic arbitration evidence package. Based on the semantic arbitration evidence package, controlled prompt words are constructed. Based on the controlled prompt words, a large language model is invoked to perform polarity prompt analysis and context understanding, and a semantic anomaly determination result is output.

[0097] The methods of the present invention can be implemented in hardware, firmware, or as software or computer code that can be stored in a recording medium (such as a CD-ROM, RAM, floppy disk, hard disk, or magneto-optical disk), or as computer code originally stored on a remote recording medium or a non-transitory machine-readable medium and subsequently stored on a local recording medium, downloaded via a network. Thus, the methods described herein can be processed by software stored on a recording medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware (such as an ASIC or FPGA). It is understood that the computer, processor, microprocessor controller, or programmable hardware includes storage components (e.g., RAM, ROM, flash memory, etc.) capable of storing or receiving software or computer code that, when accessed and executed by the computer, processor, or hardware, implements the methods described herein. Furthermore, when a general-purpose computer accesses the code used to implement the methods shown herein, the execution of the code transforms the general-purpose computer into a dedicated computer for performing the methods shown herein.

[0098] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention.< / mask> < / as> < / port> < / vlan> < / ipv6> < / ipv4>

Claims

1. A cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning, characterized in that, Includes the following steps: Retrieve the matched configuration blocks to be inspected and the standard template blocks; The configuration statements in the configuration block to be inspected and the standard template block are segmented, and the marker words in the configuration statements are mapped to command roles, parameter roles, reference object roles, resource entity roles, and operation polarity roles. Based on the mapping results of the marker words, statement sequence difference is performed on the configuration block to be inspected and the standard template block to construct role-based differential evidence; Based on the aforementioned role-based differential evidence, the decision path is routed accordingly. When the role-based differential evidence does not include changes in the referenced object role, the resource entity role, and the operation polarity role, a basic difference comparison is performed based on the role-based differential evidence, and a simple anomaly determination result is output. When the role-based differential evidence includes changes in the role of the referenced object or the role of the resource entity, an online configuration entity relationship graph is constructed, and the graph context is extracted by combining the structural evidence index of the enhanced generation architecture with offline graph retrieval. Structural anomaly verification is performed based on the graph context, and structural anomaly judgment result is output. When the role-based differential evidence includes a change in the operation polarity role, the command context is extracted from the configuration statement, and the differential fact is extracted from the role-based differential evidence. A semantic arbitration evidence package is constructed, which includes the differential fact, the command context, and the optional graph context. When there is a change in either the referenced object role or the resource entity role at the same time, the generated graph context is added to the semantic arbitration evidence package. Based on the semantic arbitration evidence package, controlled prompt words are constructed. Based on the controlled prompt words, a large language model is invoked to perform polarity prompt analysis and contextual understanding, and semantic anomaly judgment results are output.

2. The cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning according to claim 1, characterized in that, The role-based differential evidence is a multidimensional feature data set, which includes at least the differential fragment type, character similarity, token overlap, local edit distance, semantic role annotation results, and sentence positional relationship.

3. The cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning according to claim 1, characterized in that, The process of performing basic difference comparison based on the aforementioned role-based differential evidence and outputting simple anomaly determination results includes: When the role-based differential evidence indicates the existence of missing statements on the template side or redundant statements on the side to be inspected, the missing statements or the redundant statements are extracted, and a global coverage check and a position consistency check are performed in the configuration block to be inspected or the standard template block. When there are highly similar matching segments across different positions in other positions, output the result of position migration or order error determination; When the cross-position high similarity matching segment does not exist, output the result of the missing statement or redundant statement determination; A high similarity matching segment refers to a sentence segment where the character similarity and token overlap are not less than 0.75, and the semantic role sequence or command role corresponding to the two are consistent.

4. The cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning according to claim 1, characterized in that, The operational polarity role includes action polarity, direction polarity, or state polarity; The traffic routing for the decision path based on the role-based differential evidence also includes: Identify the change type of the operation polarity role, and determine whether the change type is in a valid policy context or functional state context in combination with the command context; When it is determined that the policy is within a valid policy context, policy conflict candidates are generated; When the judgment is in a functional state context, semantic inconsistency candidates are generated.

5. The cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning according to claim 1, characterized in that, The process of performing structural anomaly verification based on the context of the graph and outputting the structural anomaly determination result includes: Based on the change in the role of the referenced object, query the online configuration entity relationship graph to see if there is a defined object of the same type, name and scope that is reachable; When the defined object does not exist, and the rule constraints in the graph context indicate that the referenced object is necessary for configuration, confirm that the output dependency is missing.

6. The cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning according to claim 1, characterized in that, The process of outputting the structural anomaly determination result also includes: Based on the changes in the roles of the resource entities, the occupancy relationships of the same resource are aggregated in the online configuration entity relationship graph; When the occupancy relationship is incompatible with reuse, and the rule constraints in the graph context indicate that the resource cannot be reused in the current context, the resource conflict result is confirmed and output.

7. The cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning according to claim 1, characterized in that, After invoking a large language model based on the controlled prompt words to perform polarity prompt analysis and contextual understanding, and outputting semantic anomaly determination results, the process also includes: The semantic anomaly determination results output by the large language model are subjected to format verification and evidence consistency verification. When the field format of the semantic anomaly determination result does not conform to the preset format constraint, or when the evidence referenced by the semantic anomaly determination result exceeds the scope of the semantic arbitration evidence package, the semantic anomaly determination result is intercepted, and the controlled prompt word is reconstructed and the large language model is called again.

8. The cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning according to claim 1, characterized in that, The controlled prompt words contain a non-open category tag set, which includes: semantic inconsistency, policy conflict, and no semantic anomaly. The process of outputting semantic anomaly determination results includes: strictly limiting the output anomaly types of the large language model to the non-open classification label set.

9. A cross-platform network configuration anomaly detection device based on heterogeneous evidence collaborative reasoning, executing the method described in any one of claims 1-8, characterized in that, include: The data acquisition module is used to acquire matched configuration blocks to be inspected and standard template blocks; The role mapping module is used to segment the configuration statements in the configuration block to be inspected and the standard template block, and map the marker words in the configuration statements to command roles, parameter roles, reference object roles, resource entity roles and operation polarity roles; The differential construction module is used to perform statement sequence differential on the configuration block to be inspected and the standard template block according to the mapping result of the marker words, and construct role-based differential evidence; The decision routing module is used to perform traffic routing for the decision path based on the role-based differential evidence. When the role-based differential evidence does not include changes in the referenced object role, the resource entity role, and the operation polarity role, a basic difference comparison is performed based on the role-based differential evidence, and a simple anomaly determination result is output. When the role-based differential evidence includes changes in the role of the referenced object or the role of the resource entity, an online configuration entity relationship graph is constructed, and the graph context is extracted by combining the structural evidence index of the enhanced generation architecture with offline graph retrieval. Structural anomaly verification is performed based on the graph context, and structural anomaly judgment result is output. When the role-based differential evidence includes a change in the operation polarity role, the command context is extracted from the configuration statement, and the differential fact is extracted from the role-based differential evidence. A semantic arbitration evidence package is constructed, which includes the differential fact, the command context, and the optional graph context. When there is a change in either the referenced object role or the resource entity role at the same time, the generated graph context is added to the semantic arbitration evidence package. Based on the semantic arbitration evidence package, controlled prompt words are constructed. Based on the controlled prompt words, a large language model is invoked to perform polarity prompt analysis and contextual understanding, and semantic anomaly judgment results are output.

10. A computer storage medium storing a readable program, characterized in that, When the program runs, it can instruct the computing device to perform the cross-platform network configuration anomaly detection method based on heterogeneous evidence collaborative reasoning as described in any one of claims 1-8.

Images