A privacy-preserving traffic self-healing scheduling method, system and computer readable storage medium

Abstract

The application discloses a privacy maintenance type abnormal communication flow self-healing scheduling method and system of an edge terminal group and a computer readable storage medium. The technical problem to be solved is that the cooperative judgment of abnormal communication flow of multiple edge nodes depends on the exchange of original data, and the recovery control lacks a feedback rollback mechanism. The technical solution is that: in multiple edge nodes, an irreversible and comparable abnormal flow fingerprint is generated through a local summary module and a privacy fingerprint module, only the abnormal flow fingerprint or a secure summary of the abnormal flow fingerprint is exchanged through a secure exchange module, the regional consistency score is calculated by a consistency judgment module in combination with the similarity distribution of adjacent time windows and the spatial correlation, and the abnormal confidence or the trigger threshold is updated based on the self-healing effect value by a self-healing scheduling module and a feedback rollback module, and batch recovery, suspension recovery or strategy rollback are performed. It is mainly used for privacy protection abnormal disposal in converged communication, private network communication and emergency communication.

Description

Technical Field

[0001] This invention relates to the fields of converged communications, edge computing, and communication network security, and specifically to a privacy-preserving self-healing scheduling method, system, and computer-readable storage medium for edge terminal clusters. Background Technology

[0002] In scenarios such as converged communications, private network communications, mine communications, campus communications, and emergency communications, there are typically numerous edge terminals, edge gateways, and service links. Multiple services, including voice, video, control messages, file synchronization, and background data reporting, are transmitted in parallel within the same communication network. The network's operational status is susceptible to impacts from terminal anomalies, localized link congestion, gateway failures, traffic spikes, and suspected attack traffic. Failure to promptly identify abnormal communication traffic and adjust service paths, transmission rates, or terminal connection status can lead to critical service interruptions, increased communication latency, or network resources being consumed by abnormal traffic.

[0003] In existing technologies, abnormal traffic detection solutions typically employ centralized log collection, raw traffic mirroring, uploading complete session records, or single-node local detection. While these solutions can detect abnormal traffic to some extent, they still have the following shortcomings in a multi-edge node collaborative environment: Firstly, centralized uploading of raw communication content, complete communication logs, complete IP port sequences, or complete traffic sequences can easily lead to privacy leaks and data compliance risks; secondly, single-node anomaly detection struggles to distinguish between single-point terminal anomalies, local link congestion, gateway failures, temporary service peaks, and suspected cross-regional attack traffic.

[0004] Furthermore, existing anomaly handling schemes mostly employ static rules to trigger blocking, isolation, rate limiting, or rerouting. These schemes typically lack feedback evaluation based on network recovery effectiveness and mechanisms for dynamically updating anomaly confidence, trigger thresholds, recovery order, and rollback strategies based on self-healing effects. Therefore, there is an urgent need for a self-healing scheduling scheme for abnormal communication traffic that can achieve collaborative anomaly detection across multiple edge nodes without exchanging original communication data, and can execute batch recovery, paused recovery, or strategy rollback based on self-healing effects. Summary of the Invention

[0005] To overcome the shortcomings of existing technologies, such as reliance on raw data exchange for collaborative detection of abnormal traffic, insufficient privacy protection, weak ability to judge regional anomalies and consistency, and lack of effect feedback and mechanisms for batch recovery, pause recovery or policy rollback in self-healing scheduling, this invention provides a privacy-preserving traffic self-healing scheduling method, system and computer-readable storage medium.

[0006] This invention provides a privacy-preserving self-healing scheduling method for abnormal communication traffic in edge terminal clusters, comprising: collecting local communication traffic behavior data at multiple edge nodes respectively, and performing summary processing on the local communication traffic behavior data at each edge node to obtain a local traffic behavior summary, wherein the local communication traffic behavior data includes traffic mutation characteristics, protocol distribution characteristics, session persistence characteristics, terminal role characteristics, service priority characteristics, and link quality characteristics.

[0007] The local traffic behavior summary is sequentially processed by anomaly embedding, random projection, quantization, and salted hashing to generate an irreversible and comparable anomaly traffic fingerprint. The random projection is used to maintain the approximate similarity relationship between the anomaly embedding vectors of different edge nodes, and the salted hashing uses salt values ​​related to a time window, edge nodes, or regions.

[0008] The multiple edge nodes exchange only the abnormal traffic fingerprint or the security digest of the abnormal traffic fingerprint, without exchanging the original communication content, the complete and reproducible communication log, the complete IP port sequence, or the complete traffic sequence; a regional consistency score is calculated based on the similarity distribution and spatial correlation of the abnormal traffic fingerprints of the multiple edge nodes in adjacent time windows, and the anomaly type and anomaly confidence are determined according to the regional consistency score.

[0009] A self-healing scheduling strategy is generated and executed based on the anomaly type, the anomaly confidence level, the service priority, and the link health. The self-healing scheduling strategy includes at least one of the following: terminal rate limiting strategy, terminal isolation strategy, alternative link switching strategy, service degradation strategy, edge cache takeover strategy, and recovery rollback strategy.

[0010] The self-healing effect value is calculated based on the latency change rate, packet loss rate change rate, link utilization change, session retransmission count change, and service recovery success rate after the self-healing scheduling strategy is executed. The abnormal confidence level or the trigger threshold of the self-healing scheduling strategy is updated based on the self-healing effect value. When the abnormal confidence level is lower than the recovery threshold for multiple consecutive time windows, the service path or transmission rate is restored in batches according to the service priority and the link health. If the link health decreases or the abnormal confidence level rises during the recovery process, the subsequent recovery is paused and the current scheduling strategy is maintained or the previous scheduling strategy is rolled back.

[0011] Preferably, the local traffic behavior summary is obtained by statistically analyzing traffic mutation characteristics, protocol distribution characteristics, session persistence characteristics, terminal role characteristics, service priority characteristics, and link quality characteristics according to a preset time window, and by normalizing, discretizing, and processing abnormal baseline offsets on the statistical results within the same preset time window; the local traffic behavior summary does not contain the original payload content.

[0012] Preferably, the abnormal traffic fingerprint is generated as follows: the local traffic behavior summary is input into an abnormal embedding model to obtain an abnormal embedding vector; the abnormal embedding vector is dimensionality-reduced and projected using a random projection matrix to obtain a projection vector; the projection vector is symbolically quantized or multi-level quantized to obtain a quantized code; and the quantized code is salted and hashed using a salt value that rotates according to a time window to obtain the abnormal traffic fingerprint.

[0013] Preferably, the regional consistency score is obtained by calculating at least one of Hamming distance, Jaccard similarity, cosine approximation or local sensitive hash bucket overlap among multiple abnormal traffic fingerprints within adjacent time windows to obtain a similarity distribution, and by weighting and aggregating the similarity distribution using spatial association weights constructed from geographical location distance, network topology distance, link adjacency relationship or business path relationship among multiple edge nodes.

[0014] Preferably, when the regional consistency score is concentrated in a single edge node or a single terminal role, the anomaly type is determined as a single-point terminal anomaly; when the regional consistency score is concentrated in multiple edge nodes associated with the same gateway, the same link adjacency area, or the same service path, the anomaly type is determined as local link congestion or gateway failure; when the regional consistency score increases synchronously in multiple edge nodes with non-adjacent topologies and inconsistent service priority distribution, the anomaly type is determined as suspected attack traffic.

[0015] Preferably, the self-healing scheduling strategy is executed differently according to different anomaly types: when the anomaly type is a single-point terminal anomaly and the anomaly confidence level reaches the isolation threshold, rate limiting, isolation, or authentication review are performed on the corresponding abnormal terminal; when the anomaly type is local link congestion or gateway failure, high-priority voice services, video services, or control message services are switched to alternative links with a link health level higher than the health threshold; when the anomaly type is suspected attack traffic, service flows with a fingerprint similarity to the abnormal traffic higher than the attack similarity threshold are filtered or forwarded in a low-speed sandbox; when the anomaly type is a temporary service peak, the transmission rate of low-priority data synchronization services or background data reporting services is reduced and an edge cache takeover strategy is enabled.

[0016] Preferably, the self-healing effect value is obtained by weighting the average latency, average packet loss rate, link utilization, number of session retransmissions, and number of successful service recoverys before and after the execution of the self-healing scheduling strategy. When the self-healing effect value indicates improved network conditions and the service recovery success rate is higher than the success rate threshold, the anomaly confidence level is reduced or the trigger threshold of the self-healing scheduling strategy is increased. When the self-healing effect value indicates deteriorated network conditions or the service recovery success rate is lower than the success rate threshold, the anomaly confidence level is increased or the trigger threshold of the self-healing scheduling strategy is decreased.

[0017] Preferably, during the batch recovery process, candidate recovery services and candidate recovery links that meet the recovery conditions are determined, and the candidate recovery services are sorted from high to low according to the service priority, and candidate recovery links with link health values ​​higher than the health threshold are selected first; after each batch of candidate recovery services is recovered, the self-healing effect value is recalculated. If the recalculated self-healing effect value is lower than the rollback effect threshold, the link health value decreases by more than a predetermined amount, or the abnormal confidence value rises by more than the warning threshold, then subsequent recovery is suspended and the current scheduling strategy is maintained or the previous scheduling strategy is rolled back.

[0018] This invention also provides a privacy-preserving self-healing scheduling system for abnormal communication traffic in an edge terminal cluster, comprising a local summary module, a privacy fingerprint module, a secure exchange module, a consistency judgment module, a self-healing scheduling module, and a feedback rollback module. The local summary module collects local communication traffic behavior data at multiple edge nodes and performs summary processing on the local communication traffic behavior data at each edge node to obtain a local traffic behavior summary. The privacy fingerprint module sequentially performs anomaly embedding, random projection, quantization, and salted hashing on the local traffic behavior summary to generate an irreversible and similarity-comparable abnormal traffic fingerprint. The secure exchange module enables multiple edge nodes to exchange only the abnormal traffic fingerprint or the secure summary of the abnormal traffic fingerprint. The consistency judgment module calculates a regional consistency score and determines the anomaly type and anomaly confidence level. The self-healing scheduling module generates and executes a self-healing scheduling strategy. The feedback rollback module calculates the self-healing effect value, updates the anomaly confidence level or trigger threshold, and performs batch recovery, paused recovery, or strategy rollback.

[0019] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps in the above-described privacy-preserving abnormal communication traffic self-healing scheduling method for edge terminal groups.

[0020] Compared with existing technologies, the present invention has the following advantages: First, by generating irreversible and comparable abnormal traffic fingerprints locally at each edge node, and enabling nodes to exchange only abnormal traffic fingerprints or security digests, the ability to compare cross-node similarity can be retained while reducing the risk of leakage of original communication data. Second, by combining the fingerprint similarity distribution and spatial correlation within adjacent time windows to calculate regional consistency scores, it is possible to distinguish between single-point terminal anomalies, local link congestion, gateway failures, temporary service peaks, and suspected attack traffic. Third, by generating self-healing scheduling strategies based on anomaly type, anomaly confidence, service priority, and link health, the impact of abnormal traffic on critical services can be reduced. Fourth, by updating the anomaly confidence or trigger threshold through self-healing effect value feedback and executing batch recovery, paused recovery, or rollback to the previous scheduling strategy, the stability of network recovery after anomaly handling can be improved. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention. It is obvious that the drawings described below are merely some embodiments of the invention, and those skilled in the art can obtain other drawings based on these drawings without inventive effort. The drawings are not intended to be drawn to scale. In the drawings, corresponding or identical parts shown in each figure can be represented by the same or corresponding reference numerals. For clarity, not every part is labeled in every drawing.

[0022] Figure 1 This is an architectural block diagram of a privacy-preserving abnormal communication traffic self-healing scheduling system for edge terminal groups according to an embodiment of the present invention.

[0023] Figure 2 This is a flowchart of an abnormal traffic fingerprint generation method according to an embodiment of the present invention.

[0024] Figure 3 This is a schematic diagram of the secure digest exchange and region consistency judgment process according to an embodiment of the present invention.

[0025] Figure 4 This is a flowchart of a self-healing scheduling strategy generation and execution method according to an embodiment of the present invention.

[0026] Figure 5 This is a flowchart of a self-healing effect feedback, threshold update, and recovery control method according to an embodiment of the present invention. Detailed Implementation

[0027] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. The described embodiments are only some embodiments of the present invention, and not all embodiments. Other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort should fall within the protection scope of the present invention.

[0028] It should be noted that the terms "first," "second," etc., used in this specification and claims are only used to distinguish similar objects and are not used to limit a specific order or sequence. The terms "comprising," "including," and any variations thereof are intended to cover non-exclusive inclusion. The modules described herein can be implemented by software, hardware, firmware, or a combination thereof. Multiple modules can be integrated in the same processing device or distributed in different edge nodes, gateways, servers, or scheduling platforms; this invention does not limit this.

[0029] The preferred embodiment known to the inventors at the application date is as follows: Communication traffic behavior summaries and abnormal traffic fingerprints are generated locally at each edge node. Privacy-preserving collaborative judgment among multiple edge nodes is achieved through secure summary exchange. Self-healing scheduling is performed on the scheduling side based on regional consistency scores, anomaly confidence levels, service priorities, and link health. Trigger threshold updates, batch recovery, paused recovery, or policy rollback are then performed based on the self-healing effect value. This embodiment can achieve regional anomaly identification and network self-healing recovery without exchanging the original communication content.

[0030] like Figure 1 As shown, this embodiment of the invention provides a privacy-preserving self-healing scheduling system (100) for abnormal communication traffic of an edge terminal group. The system (100) may include an edge terminal group (102), multiple edge nodes (104), a local digest module (106), a privacy fingerprint module (108), a secure exchange module (110), a consistency judgment module (112), a self-healing scheduling module (114), a feedback rollback module (116), a service link set (118), and a scheduling policy library (120). The edge terminal group (102) may include voice terminals, video terminals, sensing terminals, control terminals, mobile terminals, wearable terminals, or other terminal devices that can generate service traffic through a communication network.

[0031] Multiple edge nodes (104) are communicatively connected to at least some of the terminals in the edge terminal group (102). The edge nodes (104) can be edge gateways, edge servers, base station-side computing nodes, mine communication substations, campus gateways, or emergency communication nodes. In some embodiments, the edge nodes (104) are deployed in different geographical locations, different network topology areas, or different service paths to process the communication traffic generated by the distributed terminals locally. The edge nodes (104) can also be connected to a service link set (118), which may include a main communication link, a backup communication link, a low-latency link, a high-bandwidth link, or a temporary emergency link.

[0032] The local summary module (106) is configured to collect local communication traffic behavior data at the edge node (104) and perform summary processing on the local communication traffic behavior data locally at the edge node (104) to obtain a local traffic behavior summary. The local communication traffic behavior data may include traffic mutation characteristics, protocol distribution characteristics, session persistence characteristics, terminal role characteristics, service priority characteristics, and link quality characteristics. Preferably, the local summary module (106) does not output the original communication content, reproducible complete communication logs, complete IP port sequences, or complete traffic sequences, thereby reducing the risk of original data leakage at the source.

[0033] The privacy fingerprint module (108) is operatively coupled to the local digest module (106) and configured to receive the local traffic behavior digest, and perform anomaly embedding, random projection, quantization, and salted hashing on the local traffic behavior digest to generate an irreversible and comparable anomaly traffic fingerprint. In some embodiments, the privacy fingerprint module (108) can generate a random projection matrix based on a random seed shared by the same region, so that the anomaly embedding vectors generated by different edge nodes (104) still retain an approximate similarity relationship after projection. The salt value used for salted hashing can be rotated according to a time window, or it can be associated with the edge node identifier or the region identifier; this invention does not limit this.

[0034] The secure exchange module (110) is communicatively connected to the privacy fingerprint module (108) and configured to enable multiple edge nodes (104) to exchange anomalous traffic fingerprints or secure digests of anomalous traffic fingerprints via a secure digest exchange protocol. The secure digest exchange protocol may include at least one of node authentication, time window number verification, salt version verification, duplicate fingerprint suppression, or message integrity verification. In some embodiments, the secure exchange module (110) transmits the secure digest via a dedicated control channel, message queue, edge collaboration bus, or encrypted communication link. Because the exchanged information does not include the original payload and reproducible traffic sequence, the system (100) can reduce the privacy risks associated with cross-node data sharing while maintaining collaborative judgment capabilities.

[0035] The consistency judgment module (112) is operationally coupled to the secure exchange module (110) and configured to calculate a regional consistency score based on the similarity distribution and spatial correlation of abnormal traffic fingerprints of multiple edge nodes (104) within adjacent time windows, and determine the anomaly type and anomaly confidence level based on the regional consistency score. The spatial correlation can be characterized by the geographical distance, network topology distance, link adjacency, or service path relationship between edge nodes (104). By combining the similarity distribution with the spatial correlation, the consistency judgment module (112) can reduce the impact of false alarms from a single node on scheduling decisions and can distinguish between local regional anomalies and cross-regional synchronization anomalies.

[0036] The self-healing scheduling module (114) is connected to the consistency judgment module (112) and configured to generate and execute self-healing scheduling policies based on the anomaly type, anomaly confidence level, service priority, and link health. The scheduling policy library (120) can store terminal rate limiting policies, terminal isolation policies, alternative link switching policies, service degradation policies, edge cache takeover policies, and recovery rollback policies. The self-healing scheduling module (114) can apply the generated self-healing scheduling policies to the service link set (118) or edge terminal group (102) to reduce the impact of abnormal traffic on high-priority services. The feedback rollback module (116) is connected to the self-healing scheduling module (114) and configured to calculate the self-healing effect value after the self-healing scheduling policy is executed, and update the anomaly confidence level or trigger threshold based on the self-healing effect value, and further execute batch recovery, pause recovery, or rollback to the previous scheduling policy.

[0037] like Figure 2 As shown, this embodiment of the invention provides a method (200) for generating abnormal traffic fingerprints. This method (200) can be performed by... Figure 1 The local digest module (106) and privacy fingerprint module (108) shown are executed locally on the edge node (104). The method (200) may include a local communication traffic behavior data acquisition step (202), a time window statistics step (204), a digestion processing step (206), an anomaly embedding step (208), a random projection step (210), a quantization encoding step (212), a salted hashing step (214), a fingerprint output step (216), and a salt value rotation step (218).

[0038] The local communication traffic behavior data collection step (202) is used to collect communication traffic behavior data related to local terminal services at the edge node (104). In some embodiments, the communication traffic behavior data may include, but is not limited to, the traffic change amplitude per unit time, the proportion of protocol types, the number of session establishments, the session duration, the terminal role, the service priority, the link latency, the packet loss rate, the jitter, the remaining bandwidth, and the number of link handover failures. This step (202) may only collect statistical features or behavioral features, without collecting the original payload content, thereby providing an input basis for subsequent privacy-preserving processing.

[0039] The time window statistics step (204) is used to statistically analyze local communication traffic behavior data according to a preset time window. The preset time window can be a fixed-length time window or a time window that is dynamically adjusted according to service load, link status, or anomaly detection requirements. In some embodiments, the edge node (104) can generate statistical results in the current time window, the previous time window, and the adjacent time window, respectively, so as to facilitate subsequent anomaly trend judgment and cross-node similarity comparison. The length, sliding step, and overlap ratio of the time window can be configured according to the communication network scale, service type, and edge node processing capability, and are not limited in this invention.

[0040] The summarization process (206) is used to normalize, discretize, and perform abnormal baseline offset processing on the statistical results within the same preset time window to obtain a local traffic behavior summary (220). Normalization can convert traffic characteristics of different dimensions into comparable numerical ranges; discretization can map continuous features into several discrete levels; abnormal baseline offset processing can offset the current statistical results based on historical normal traffic baselines, baselines of similar terminals, or baselines of similar services. Through the above processing, the local traffic behavior summary (220) can characterize the abnormal tendency of traffic behavior, while avoiding the inclusion of reproducible complete communication logs, complete IP port sequences, or complete traffic sequences.

[0041] The anomaly embedding step (208) is used to input the local traffic behavior summary (220) into the anomaly embedding model (222) to obtain the anomaly embedding vector (224). The anomaly embedding model (222) can be a rule-based feature mapping model, a machine learning-based encoding model, a neural network-based embedding model, or a combination thereof. In some embodiments, the anomaly embedding model (222) can be trained using historical communication traffic behavior summaries, historical anomaly type labels, and historical handling effect data, with the training constraint that historical communication traffic behavior summaries of the same anomaly type are closer in the embedding space and historical communication traffic behavior summaries of different anomaly types are farther apart in the embedding space. The above model structure and training method are merely examples, and the present invention is not limited thereto.

[0042] The random projection step (210) is used to perform dimensionality reduction projection on the anomalous embedding vector (224) using the random projection matrix (226) to obtain the projected vector (228). The random projection matrix (226) can be shared among multiple edge nodes (104) in the same region, or it can be generated locally on each edge node (104) by the same random seed. Through the random projection step (210), the approximate similarity relationship between the anomalous embedding vectors (224) of different edge nodes (104) can be preserved in a lower-dimensional space, thereby reducing the computational and communication overhead required for subsequent fingerprint comparison and summary exchange.

[0043] The quantization encoding step (212) is used to perform sign quantization or multi-level quantization on the projection vector (228) to obtain quantization encoding (230). For example, in some embodiments, binary encoding can be generated based on the sign of each dimension in the projection vector (228); in other embodiments, multi-level encoding can be generated based on the numerical range that each dimension in the projection vector (228) falls into. Quantization encoding (230) enables edge nodes (104) to be approximated by Hamming distance, Jaccard similarity, cosine approximation, or local sensitive hash bucket overlap, but this example does not constitute a limitation on the similarity calculation method.

[0044] The salted hashing step (214) is used to hash the quantized code (230) using a salt value (232) to obtain an abnormal traffic fingerprint (234). The salt value (232) may include a salt value related to a time window, a salt value related to an edge node, or a salt value related to a region. The salt value rotation step (218) may update the salt value (232) according to a time window, event triggering conditions, regional scheduling cycle, or security policy to reduce the risk of correlation tracing between different cycles. Through the salted hashing step (214), it is difficult to reverse the original communication content or the complete traffic sequence from the abnormal traffic fingerprint (234). At the same time, it is still possible to perform approximate similarity comparison and approximate similarity calculation under the same salt value version or a verifiable salt value version. However, it is impossible to restore the original communication content, the reproducible complete communication log, the complete IP port sequence, or the complete traffic sequence based on the abnormal traffic fingerprint.

[0045] The fingerprint output step (216) is used to output the abnormal traffic fingerprint (234) or the security digest of the abnormal traffic fingerprint (234) to Figure 1The security exchange module (110) is shown. In some embodiments, the fingerprint output step (216) may also output the time window number, edge node identifier, salt version number, region identifier, and digest integrity check value, so as to facilitate subsequent security digest exchange and region consistency judgment. Since the method (200) performs digestion, embedding, projection, quantization, and salted hashing locally on the edge node (104), the system (100) can obtain anomaly traffic fingerprints (234) that can be used for cross-node collaborative judgment without uploading the original traffic data.

[0046] like Figure 3 As shown, this embodiment of the invention provides a schematic structure (300) for secure digest exchange and region consistency judgment. This schematic structure (300) can... Figure 1 The secure exchange module (110) and consistency judgment module (112) shown are implemented and are integrated with... Figure 2 The fingerprint output steps (216) shown are connected. The schematic structure (300) includes a first edge node (302), a second edge node (304), a third edge node (306), a local fingerprint message (308), a security digest message (310), a node authentication unit (312), a time window alignment unit (314), a salt value version verification unit (316), a secure exchange channel (318), a similarity calculation unit (320), a similarity distribution set (322), a spatial association model (324), a spatial association weight set (326), a weighted aggregation unit (328), a regional consistency score (330), an anomaly type determination unit (332), an anomaly confidence output (334), and an anomaly impact range output (336).

[0047] The first edge node (302), the second edge node (304), and the third edge node (306) represent multiple edge nodes located within the same converged communication area, the same mine communication area, the same park communication area, or the same emergency communication area. The number of edge nodes mentioned above is merely an example for illustrative purposes; in some embodiments, the schematic structure (300) may include two edge nodes, or it may include four or more edge nodes. The first edge node (302), the second edge node (304), and the third edge node (306) can all be configured according to... Figure 2 The method (200) shown generates anomaly traffic fingerprints (234) locally and encapsulates the anomaly traffic fingerprints (234) into local fingerprint messages (308) or security summary messages (310) without sending the original communication content, a reproducible complete communication log, a complete IP port sequence, or a complete traffic sequence to other edge nodes.

[0048] The local fingerprint message (308) may include at least one of the following: abnormal traffic fingerprint (234), edge node identifier, time window number, region identifier, salt version number, and message integrity verification value. The security digest message (310) may be a message obtained by further digesting, signing, or encrypting the local fingerprint message (308). In some embodiments, the security digest message (310) only includes fingerprint digests that can be used for similarity comparison, window synchronization information, and necessary verification information; in other embodiments, the security digest message (310) may also include service priority digests, terminal role digests, or link quality level digests to improve the accuracy of region consistency judgment without exposing sensitive communication content. The above message fields may be tailored or extended according to security policies, bandwidth conditions, and business scenarios, and are not limited in this invention.

[0049] The node authentication unit (312) is configured to verify the identity, region affiliation, and communication permissions of the message sender before exchanging security digest messages (310) between multiple edge nodes. The node authentication unit (312) can be implemented using any applicable method such as certificates, shared keys, tokens, device fingerprints, or trusted execution environment proofs. The time window alignment unit (314) is configured to map local fingerprint messages (308) or security digest messages (310) from different edge nodes to the current time window, the previous time window, or the adjacent time window according to the time window number, so as to avoid mismatches caused by transmission delays or edge node clock deviations. The salt version verification unit (316) is configured to verify whether the salt version number carried by the security digest message (310) is consistent with the local comparable salt version or whether it meets the preset verifiable relationship, thereby ensuring that abnormal traffic fingerprints (234) can be compared for approximate similarity.

[0050] A secure exchange channel (318) is used to transmit secure digest messages (310) between a first edge node (302), a second edge node (304), and a third edge node (306). In some embodiments, the secure exchange channel (318) can be a dedicated control channel, an edge collaboration bus, a message queue, a virtual private network link, or an encrypted wireless / wired communication link. The secure exchange channel (318) can support replay detection, duplicate digest suppression, message timeliness checks, and packet loss retransmission control to improve the reliability of cross-node collaborative judgment. Since the secure exchange channel (318) transmits abnormal traffic fingerprints (234) or secure digest messages (310) instead of raw communication data, the risk of privacy leakage caused by cross-regional data centralization can be reduced even if multiple edge nodes participate in collaborative judgment.

[0051] The similarity calculation unit (320) is configured to calculate the approximate similarity between multiple anomalous traffic fingerprints (234) within adjacent time windows and form a similarity distribution set (322). For example, the similarity calculation unit (320) can calculate at least one of Hamming distance, Jaccard similarity, cosine approximation, or local sensitive hash bucket overlap; other distance or similarity metrics that can reflect the closeness of fingerprints can also be used. The similarity distribution set (322) can represent the horizontal similarity between different edge nodes within the same time window, or the vertical similarity between the same edge node in the current time window and the previous time window. By considering both horizontal and vertical similarity, the schematic structure (300) can identify sudden regional anomalies, persistent local anomalies, and anomalous trends that increase synchronously across regions.

[0052] The spatial association model (324) is used to characterize the geographical distance, network topology distance, link adjacency, or service path relationship between multiple edge nodes. The spatial association weight set (326) can be generated by the spatial association model (324) and is used to represent the strength of association between the first edge node (302), the second edge node (304), and the third edge node (306) in terms of anomaly propagation, link sharing, or service carrying. In some embodiments, edge nodes located downstream of the same gateway, sharing the same transmission link, or carrying the same service path can have higher spatial association weights; edge nodes that are not topologically adjacent and whose service paths do not overlap significantly can have lower spatial association weights. The specific construction method of the spatial association model (324) can be determined based on static topology configuration, real-time link discovery results, historical fault propagation data, or service path orchestration information, and the present invention is not limited to the above examples.

[0053] The weighted aggregation unit (328) is operationally coupled to the similarity calculation unit (320) and the spatial association model (324), and is configured to perform weighted aggregation on the similarity distribution set (322) using the spatial association weight set (326) to obtain a regional consistency score (330). In some embodiments, the weighted aggregation unit (328) can assign a higher contribution value to fingerprints with high similarity within the same spatial association cluster, and assign a lower contribution value to fingerprints with weak spatial association or inconsistent time windows; in other embodiments, the weighted aggregation unit (328) can also modify the regional consistency score (330) by combining similarity duration, number of covered nodes, service priority distribution, and link quality change magnitude. The regional consistency score (330) can be a normalized value, a level label, or a multidimensional scoring vector, as long as it can reflect the degree of consistency of abnormal traffic within the region.

[0054] The anomaly type determination unit (332) is configured to determine the anomaly type based on the spatial concentration, temporal duration, and number of covered nodes of the regional consistency score (330). When the regional consistency score (330) is mainly concentrated in a single edge node or a single terminal role, the anomaly type determination unit (332) can determine the anomaly type as a single-point terminal anomaly; when the regional consistency score (330) is concentrated in multiple edge nodes associated with the same gateway, the same link adjacent area, or the same service path, the anomaly type determination unit (332) can determine the anomaly type as local link congestion or gateway failure; when the regional consistency score (330) increases synchronously in multiple edge nodes with non-adjacent topologies and inconsistent service priority distributions, the anomaly type determination unit (332) can determine the anomaly type as suspected attack traffic. The above anomaly type classification is used to illustrate the implementation of the present invention and should not be construed as a limitation on the set of anomaly types.

[0055] The anomaly confidence output (334) is used to output the anomaly confidence based on the value of the regional consistency score (330), the duration, the number of covered nodes, and the concentration of the spatial association weight set (326). The anomaly impact range output (336) is used to output the range of edge nodes affected by the anomaly, the range of terminal roles, the range of links, or the range of business paths. The anomaly confidence output (334) and the anomaly impact range output (336) can be provided to Figure 1 The self-healing scheduling module (114) shown enables the self-healing scheduling module (114) to generate a self-healing scheduling strategy based on the anomaly type, anomaly confidence, service priority, and link health. Thus, the schematic structure (300) improves the accuracy of regional anomaly judgment and the pertinence of scheduling decisions while protecting communication privacy through the processing chain of "exchanging only fingerprints or security digests - similarity distribution of adjacent time windows - spatial correlation weighting - regional consistency score".

[0056] like Figure 4 As shown, this embodiment of the invention provides a self-healing scheduling strategy generation and execution process (400). This process (400) can be generated by... Figure 1 The self-healing scheduling module (114) shown executes and receives... Figure 3 The anomaly type determination unit (332), anomaly confidence output (334), and anomaly impact range output (336) provide the determination results. The process (400) includes anomaly type input (402), anomaly confidence input (404), business priority evaluation unit (406), link health evaluation unit (408), and scheduling decision engine (410). Figure 1The system includes a scheduling policy library (120), terminal rate limiting policy (414), terminal isolation policy (416), authentication verification policy (418), alternative link switching policy (420), service degradation policy (422), edge cache takeover policy (424), filtering or low-speed sandbox forwarding policy (426), policy execution controller (428), and execution status monitoring unit (430).

[0057] The anomaly type input (402) is used to receive anomaly types such as single-point terminal anomaly, local link congestion, gateway failure, suspected attack traffic, or temporary service peaks. The anomaly confidence input (404) is used to receive the anomaly confidence corresponding to the anomaly type input (402), whereby the anomaly confidence can be a numerical value, a level, or a multi-dimensional vector representing the degree of anomaly confidence. The anomaly type input (402) and the anomaly confidence input (404) can be used in conjunction with the anomaly impact range output (336) to limit the scope of the scheduling object, such as limiting it to a specific terminal, a specific edge node, a specific gateway, a specific link, or a specific service path. Thus, the self-healing scheduling module (114) can avoid over-adjusting the set of unaffected service links (118).

[0058] The service priority assessment unit (406) is configured to determine service priorities based on service type, terminal role, service quality requirements, historical interruption impact value, and task timeliness level. In some embodiments, the service type may include at least one of voice service, video service, control message service, file synchronization service, and background data reporting service; the terminal role may include a scheduling terminal, emergency terminal, ordinary data acquisition terminal, inspection terminal, or a terminal under the edge gateway; the service quality requirements may include latency requirements, bandwidth requirements, continuity requirements, and reliability requirements. The service priority assessment unit (406) may output results such as high-priority service, medium-priority service, and low-priority service, or it may output continuous scoring results, which is not limited in this invention.

[0059] The link health assessment unit (408) is configured to determine link health based on at least one of link latency, packet loss rate, jitter, remaining bandwidth, number of link handover failures, and link congestion duration. The link health assessment unit (408) can assess primary links, backup links, wireless links, wired links, private network links, or public network backhaul links respectively, and output a health level, health score, or availability label that can be used for scheduling decisions. In some embodiments, the link health assessment unit (408) can also combine... Figure 3 The spatial association weight set (326) shown reduces the selection weight of links within the scope of abnormal impact and increases the selection weight of healthy alternative links, thereby reducing business fluctuations caused by abnormal propagation or repeated switching.

[0060] The scheduling decision engine (410) is operationally coupled to the exception type input (402), exception confidence input (404), service priority evaluation unit (406), and link health evaluation unit (408), and configured to generate a self-healing scheduling policy based on the exception type, exception confidence, service priority, and link health. Figure 1 The scheduling strategy library (120) shown is used to store optional scheduling strategies, strategy triggering conditions, strategy mutual exclusion relationships, strategy priorities, and strategy rollback conditions. The scheduling decision engine (410) can make decisions using rule matching, score ranking, strategy template matching, strategy selection based on historical effects, or other applicable methods. In some embodiments, the scheduling decision engine (410) can first filter candidate strategies that meet the anomaly confidence threshold and link health threshold, and then select a strategy combination with less impact on key services based on business priorities. The above decision-making methods are merely examples, and the present invention is not limited to a specific algorithm or model structure.

[0061] When the anomaly type input (402) represents a single-point terminal anomaly and the anomaly confidence input (404) reaches the isolation threshold, the scheduling decision engine (410) can... Figure 1 The scheduling policy library (120) shown selects at least one of the following: terminal rate limiting policy (414), terminal isolation policy (416), or authentication verification policy (418). The terminal rate limiting policy (414) is used to reduce the uplink rate, downlink rate, connection frequency, or session establishment frequency of abnormal terminals; the terminal isolation policy (416) is used to migrate abnormal terminals from normal service paths to isolated networks, isolated queues, or restricted access domains; the authentication verification policy (418) is used to trigger re-authentication, permission verification, terminal status verification, or device integrity checks. In some embodiments, the terminal rate limiting policy (414) may be executed before the terminal isolation policy (416) to reduce the impact of abnormal traffic while maintaining basic service availability.

[0062] When the anomaly type input (402) indicates local link congestion or gateway failure, the scheduling decision engine (410) can select an alternative link switching strategy (420). The alternative link switching strategy (420) is used to switch high-priority voice services, video services, or control message services to alternative links with a link health level higher than the health threshold. Optionally, the alternative link switching strategy (420) can combine the results of the service priority evaluation unit (406) to prioritize the migration of services that are sensitive to latency or have high task timeliness, while retaining file synchronization services or background data reporting services on the original path, reducing transmission speed, or delaying transmission. In this way, in the event of local link congestion or gateway failure, the system can maintain the continuity of critical services and reduce the global rerouting pressure.

[0063] When an anomaly type input (402) characterizes suspected attack traffic, the scheduling decision engine (410) can select a filtering or low-speed sandbox forwarding strategy (426). The filtering or low-speed sandbox forwarding strategy (426) is used to drop, block, rate limit, redirect, or forward at low speed to traffic flows that have a similarity to the anomaly traffic fingerprint (234) higher than the attack similarity threshold. In some embodiments, the filtering or low-speed sandbox forwarding strategy (426) can guide suspected attack traffic flows to an isolated analysis channel while keeping normal traffic flows transmitted through a healthy link; in other embodiments, the filtering or low-speed sandbox forwarding strategy (426) can perform strong filtering only on traffic with low service priority or high anomaly confidence to reduce the impact of misjudgment on normal communication.

[0064] When an anomaly type input (402) represents a temporary traffic peak, the scheduling decision engine (410) can select at least one of a service degradation strategy (422) and an edge cache takeover strategy (424). The service degradation strategy (422) is used to reduce the transmission rate, transmission frequency, or encoding quality of low-priority data synchronization services, background data reporting services, or non-real-time services. The edge cache takeover strategy (424) is used to temporarily cache non-critical service data, duplicate content, or data that can be delayed in transmission by edge nodes, and then synchronize it to the target node or central platform after the link health is restored. In some embodiments, the service degradation strategy (422) and the edge cache takeover strategy (424) can be used in combination with the alternative link switching strategy (420) to absorb short-term traffic peaks while ensuring high-priority services.

[0065] The policy execution controller (428) is used to distribute the self-healing scheduling policy generated by the scheduling decision engine (410) to the corresponding edge nodes, gateways, link control components, or service control components, and to control the policy execution order, execution scope, and execution duration. The execution status monitoring unit (430) is used to monitor the service status, link status, terminal status, and abnormal confidence changes after policy execution, and to provide the monitoring results to the relevant departments. Figure 1 The feedback rollback module (116) shown and subsequent... Figure 5 The self-healing effect feedback process is shown. Thus, the process (400) can establish a closed-loop scheduling relationship between the anomaly type, anomaly confidence, service priority and link health, so that strategies such as terminal rate limiting, terminal isolation, alternative link switching, service degradation, edge cache takeover, filtering or low-speed sandbox forwarding are selected and executed according to the actual anomaly scenario, thereby improving the self-healing capability and service continuity of the converged communication system under abnormal traffic conditions.

[0066] like Figure 5 As shown, this embodiment of the invention provides a self-healing effect feedback, threshold update, and recovery control process (500). This process (500) can be performed by... Figure 1The feedback rollback module (116) shown is executed, and together with Figure 4 The strategy execution controller (428) and execution status monitoring unit (430) shown are connected. The process (500) includes a pre-strategy execution status acquisition unit (502), a post-strategy execution status acquisition unit (504), a latency change rate calculation unit (506), a packet loss rate change rate calculation unit (508), a link utilization rate change calculation unit (510), a session retransmission count change calculation unit (512), a service recovery success rate calculation unit (514), an effect weighting processing unit (516), a self-healing effect value (518), a confidence update unit (520), a trigger threshold update unit (522), a continuous window recovery judgment unit (524), a candidate recovery service determination unit (526), ​​a candidate recovery link determination unit (528), a batch recovery execution unit (530), a recovery monitoring unit (532), a pause recovery control unit (534), and a previous scheduling strategy rollback unit (536).

[0067] The pre-execution state acquisition unit (502) is used to acquire state before strategy execution. Figure 4 The baseline network state is collected before the self-healing scheduling strategy is executed. The post-strategy execution state collection unit (504) is used to collect feedback network state after the self-healing scheduling strategy is executed. The baseline network state and feedback network state may include at least one of average latency, average packet loss rate, link utilization, number of session retransmissions, number of successful service recoverys, total number of service requests, number of successful link switchings, terminal online status, and anomaly confidence. In some embodiments, the pre-strategy execution state collection unit (502) and the post-strategy execution state collection unit (504) may collect data with the same time window length; in other embodiments, different sampling periods may be used according to service priority, anomaly type, or link stability, which is not limited by this invention.

[0068] The latency change rate calculation unit (506) is configured to determine the latency change rate based on the average latency before and after the execution of the self-healing scheduling strategy. The packet loss rate change rate calculation unit (508) is configured to determine the packet loss rate change rate based on the average packet loss rate before and after the execution of the self-healing scheduling strategy. The link utilization change calculation unit (510) is configured to determine the link utilization change based on the link utilization before and after the execution of the self-healing scheduling strategy. The session retransmission count change calculation unit (512) is configured to determine the session retransmission count change based on the session retransmission count before and after the execution of the self-healing scheduling strategy. The above changes can be expressed as proportions, differences, grade changes, or normalized scores, as long as they can reflect the improvement or deterioration of the network state before and after the strategy execution.

[0069] The service recovery success rate calculation unit (514) is used to determine the service recovery success rate based on the number of successful service recovery attempts and the number of service recovery requests after the execution of the self-healing scheduling strategy. In some embodiments, the service recovery success rate can be calculated uniformly for all services; in other embodiments, the recovery success rate can be calculated separately for voice services, video services, control message services, file synchronization services, and background data reporting services. For services with high service priority, the service recovery success rate calculation unit (514) can assign a higher evaluation weight to make the self-healing effect evaluation closer to the goal of ensuring the continuity of critical services. The service recovery success rate can also be extended by combining terminal online recovery rate, session retention rate, or service path recovery rate.

[0070] The effect weighting processing unit (516) is operationally coupled to the latency change rate calculation unit (506), packet loss rate change rate calculation unit (508), link utilization change calculation unit (510), session retransmission count change calculation unit (512), and service recovery success rate calculation unit (514), and is configured to perform weighted processing on the latency change rate, packet loss rate change rate, link utilization change, session retransmission count change, and service recovery success rate to obtain a self-healing effect value (518). In some embodiments, when the latency decreases, the packet loss rate decreases, the link utilization rate tends to be reasonable, the session retransmission count decreases, and the service recovery success rate increases, the self-healing effect value (518) can characterize the improvement of the network state; when at least some of the above indicators deteriorate or the service recovery success rate is lower than the success rate threshold, the self-healing effect value (518) can characterize the deterioration of the network state. The weights of each indicator can be dynamically adjusted according to the anomaly type, service priority, link health, or historical handling effect, or can be determined by a preset strategy. This invention is not limited to a specific calculation formula.

[0071] The confidence update unit (520) is used to update the anomaly confidence based on the self-healing effect value (518). The trigger threshold update unit (522) is used to update the trigger threshold of the self-healing scheduling strategy based on the self-healing effect value (518). In one embodiment, when the self-healing effect value (518) indicates that the network state has improved and the service recovery success rate is higher than the success rate threshold, the confidence update unit (520) can reduce the anomaly confidence corresponding to the current anomaly type, or the trigger threshold update unit (522) can increase the trigger threshold of the corresponding self-healing scheduling strategy to reduce the probability of repeated triggering or over-processing. When the self-healing effect value (518) indicates that the network state has deteriorated or the service recovery success rate is lower than the success rate threshold, the confidence update unit (520) can increase the anomaly confidence, or the trigger threshold update unit (522) can decrease the trigger threshold so that the system can perform enhanced processing more promptly.

[0072] In some embodiments, the confidence update unit (520) and the trigger threshold update unit (522) can determine whether to maintain, enhance, weaken, or cancel the current self-healing scheduling strategy based on the changing trend of the self-healing effect value (518) within multiple consecutive time windows. For example, when the self-healing effect value (518) continues to improve within multiple consecutive time windows, the rate limiting amplitude can be reduced, the isolation range can be narrowed, or preparations can be made to restore the original business path; when the self-healing effect value (518) does not improve significantly within multiple consecutive time windows, the current strategy can be maintained or switched to an alternative strategy; when the self-healing effect value (518) deteriorates within multiple consecutive time windows, the isolation can be enhanced, the filtering range can be expanded, or an alternative link can be reselected. The above trend judgment can be implemented by sliding window statistics, threshold comparison, score smoothing, or prediction based on historical treatment effects, and the present invention does not limit it.

[0073] The continuous window recovery judgment unit (524) is used to determine whether the abnormal confidence level is lower than the recovery threshold for multiple consecutive time windows, and to determine whether to enter the recovery stage by combining the link health and self-healing effect value (518). The candidate recovery service determination unit (526) is used to determine the candidate recovery services that meet the recovery conditions. The candidate recovery services may include services that have been rate-limited, downgraded, cache-taken over, isolated, or switched paths. The candidate recovery link determination unit (528) is used to determine the candidate recovery links that meet the recovery conditions. The candidate recovery links may include the original link, the backup link, or the newly selected link with a link health level higher than the health threshold. In some embodiments, the candidate recovery service determination unit (526) sorts the candidate recovery services from high to low according to the service priority, and the candidate recovery link determination unit (528) prioritizes the candidate recovery links with higher link health and lower spatial correlation risk.

[0074] The batch recovery execution unit (530) is used to restore service paths or transmission rates in batches according to service priority and link health. In some embodiments, the batch recovery execution unit (530) can first restore service paths with high service priority and high link health, then restore service paths with medium service priority, and finally restore service paths with low service priority or deferred service. In other embodiments, the batch recovery execution unit (530) can restore the transmission rate first and then restore the complete service path, or release the cache takeover first and then release the rate limit and isolation. After each batch of candidate recovery services is restored, the recovery monitoring unit (532) re-collects the network status and triggers the effect weighting processing unit (516) to recalculate the self-healing effect value (518) to avoid abnormal traffic rebound or link congestion caused by a one-time recovery. The recovery monitoring unit (532) is used to detect situations such as decreased link health, abnormal confidence increase, self-healing effect value (518) being lower than the rollback effect threshold, or reduced service recovery success rate during the batch recovery process. The pause recovery control unit (534) is used to pause subsequent recovery and maintain the current scheduling policy when the above situation is detected, so that the system can continue to observe the current network status. The previous scheduling policy rollback unit (536) is used to roll back the relevant service path, transmission rate or isolation status to the previous scheduling policy when the link health drops by more than a predetermined amount, the abnormal confidence rises by more than the warning threshold, or the recalculated self-healing effect value (518) is lower than the rollback effect threshold. Thus, the process (500) drives the closed-loop control between abnormal confidence, trigger threshold, batch recovery, pause recovery and policy rollback through the self-healing effect value (518), so that the system can deal with anomalies quickly when they occur, and reduce the risk of false recovery and repeated oscillations during the recovery phase.

Claims

1. A privacy-preserving self-healing scheduling method for abnormal communication traffic in edge terminal groups, characterized in that, include: Local communication traffic behavior data is collected at multiple edge nodes, and the local communication traffic behavior data is digested locally at each edge node to obtain a local traffic behavior summary. The local communication traffic behavior data includes traffic mutation characteristics, protocol distribution characteristics, session persistence characteristics, terminal role characteristics, service priority characteristics, and link quality characteristics. The local traffic behavior summary is sequentially processed by anomaly embedding, random projection, quantization and salted hashing to generate an irreversible and similarity-comparable anomaly traffic fingerprint. The random projection is used to maintain the approximate similarity relationship between the anomaly embedding vectors of different edge nodes. The salted hashing process uses salt values ​​related to time windows, edge nodes, or regions. The multiple edge nodes exchange only the anomalous traffic fingerprint or the security digest of the anomalous traffic fingerprint, without exchanging the original communication content, the complete and reproducible communication log, the complete IP port sequence, or the complete traffic sequence. The region consistency score is calculated based on the similarity distribution and spatial correlation of the abnormal traffic fingerprints of multiple edge nodes within adjacent time windows, and the anomaly type and anomaly confidence are determined based on the region consistency score. A self-healing scheduling strategy is generated and executed based on the anomaly type, the anomaly confidence level, the service priority, and the link health. The self-healing scheduling strategy includes at least one of the following: terminal rate limiting strategy, terminal isolation strategy, alternative link switching strategy, service degradation strategy, edge cache takeover strategy, and recovery rollback strategy. as well as The self-healing effect value is calculated based on the latency change rate, packet loss rate change rate, link utilization change, session retransmission count change, and service recovery success rate after the self-healing scheduling strategy is executed. The abnormal confidence level or the trigger threshold of the self-healing scheduling strategy is updated based on the self-healing effect value. When the abnormal confidence level is lower than the recovery threshold for multiple consecutive time windows, the service path or transmission rate is restored in batches according to the service priority and the link health. If the link health decreases or the abnormal confidence level rises during the recovery process, the subsequent recovery is paused and the current scheduling strategy is maintained or the previous scheduling strategy is rolled back.

2. The privacy-preserving abnormal communication traffic self-healing scheduling method for edge terminal groups according to claim 1, characterized in that, The step of performing local communication traffic behavior data digestion processing at each edge node to obtain a local traffic behavior digest includes: The traffic mutation characteristics, protocol distribution characteristics, session persistence characteristics, terminal role characteristics, service priority characteristics, and link quality characteristics are statistically analyzed according to preset time windows. Normalization, discretization, and abnormal baseline shift processing are performed on the statistical results within the same preset time window; and The processed statistical results are combined into a summary of the local traffic behavior that does not contain the original payload content.

3. The privacy-preserving abnormal communication traffic self-healing scheduling method for edge terminal groups according to claim 1, characterized in that, The process of sequentially performing anomaly embedding, random projection, quantization, and salted hashing on the local traffic behavior summary to generate an irreversible and comparable anomaly traffic fingerprint includes: The local traffic behavior summary is input into the anomaly embedding model to obtain the anomaly embedding vector; The abnormal embedding vector is dimensionality-reduced by projecting a random projection matrix onto the vector to obtain a projection vector, wherein the random projection matrix is ​​shared among multiple edge nodes in the same region or generated from the same random seed. The projection vector is subjected to sign quantization or multi-level quantization to obtain quantized encoding; and The abnormal traffic fingerprint is obtained by performing salted hashing on the quantized code using salt values ​​that rotate according to a time window.

4. The privacy-preserving abnormal communication traffic self-healing scheduling method for edge terminal groups according to claim 1, characterized in that, The abnormal traffic fingerprint meets the following conditions: The original communication content, the reproducible complete communication log, the complete IP port sequence, or the complete traffic sequence cannot be reconstructed based on the abnormal traffic fingerprint. Multiple anomalous traffic fingerprints generated by different edge nodes within the same time window can be used for approximate similarity calculation; as well as The salt values ​​used for the salted hashing process are rotated according to a time window to reduce the risk of cross-period correlation tracking.

5. The privacy-preserving abnormal communication traffic self-healing scheduling method for edge terminal groups according to claim 1, characterized in that, The calculation of the regional consistency score based on the similarity distribution and spatial correlation of the abnormal traffic fingerprints of multiple edge nodes within adjacent time windows includes: Within adjacent time windows, at least one of the following is calculated among Hamming distance, Jaccard similarity, cosine approximation, or local sensitive hash bucket overlap between multiple abnormal traffic fingerprints to obtain the similarity distribution; Spatial association weights are constructed based on geographical distance, network topology distance, link adjacency, or service path relationship between multiple edge nodes; and The similarity distribution is weighted and aggregated using the spatial association weights to obtain the regional consistency score.

6. The privacy-preserving abnormal communication traffic self-healing scheduling method for edge terminal groups according to claim 5, characterized in that, The step of determining the anomaly type and anomaly confidence level based on the regional consistency score includes: When the regional consistency score is concentrated in a single edge node or a single terminal role, the anomaly type is determined to be a single-point terminal anomaly. When the regional consistency score is concentrated in multiple edge nodes associated with the same gateway, the same link adjacent region, or the same service path, the anomaly type is determined to be local link congestion or gateway failure. When the regional consistency score increases synchronously across multiple non-adjacent edge nodes and the service priority distribution is inconsistent, the anomaly type is identified as suspected attack traffic; and The anomaly confidence level is calculated based on the regional consistency score, duration, and number of covered nodes.

7. The privacy-preserving abnormal communication traffic self-healing scheduling method for edge terminal groups according to claim 1, characterized in that, The step of generating and executing a self-healing scheduling strategy based on the anomaly type, the anomaly confidence level, the service priority, and the link health includes: When the anomaly type is a single-point terminal anomaly and the anomaly confidence level reaches the isolation threshold, rate limiting, isolation, or authentication review are performed on the corresponding abnormal terminal. When the anomaly type is local link congestion or gateway failure, high-priority voice services, video services, or control message services will be switched to alternative links with a link health level higher than the health threshold. When the anomaly type is suspected attack traffic, service flows with a fingerprint similarity to the anomaly traffic higher than the attack similarity threshold are filtered or forwarded in a low-speed sandbox; and When the anomaly type is a temporary service peak, reduce the transmission rate of low-priority data synchronization services or background data reporting services and enable the edge cache takeover strategy.

8. The privacy-preserving abnormal communication traffic self-healing scheduling method for edge terminal groups according to claim 1, characterized in that, The service priority is determined based on the service type, terminal role, service quality requirements, historical interruption impact value, and task timeliness level. The service type includes at least one of voice service, video service, control message service, file synchronization service, and background data reporting service. The link health is determined based on link latency, packet loss rate, jitter, remaining bandwidth, and number of link switching failures.

9. The privacy-preserving abnormal communication traffic self-healing scheduling method for edge terminal groups according to claim 1, characterized in that, The calculation of the self-healing effect value based on the latency change rate, packet loss rate change rate, link utilization change, session retransmission count change, and service recovery success rate after executing the self-healing scheduling strategy includes: Obtain the average latency, average packet loss rate, link utilization, number of session retransmissions, and number of successful service recoverys before and after executing the self-healing scheduling strategy; The latency change rate is determined based on the average latency; the packet loss rate change rate is determined based on the average packet loss rate; and the service recovery success rate is determined based on the number of successful service recovery attempts. The self-healing effect value is obtained by weighting the latency change rate, the packet loss rate change rate, the link utilization change, the session retransmission count change, and the service recovery success rate.

10. The privacy-preserving abnormal communication traffic self-healing scheduling method for edge terminal groups according to claim 9, characterized in that, The step of updating the anomaly confidence level or the trigger threshold of the self-healing scheduling strategy based on the self-healing effect value includes: When the self-healing effect value indicates that the network status has improved and the service recovery success rate is higher than the success rate threshold, the anomaly confidence level is reduced or the trigger threshold of the self-healing scheduling strategy is increased. When the self-healing effect value indicates network condition deterioration or service recovery success rate is lower than the success rate threshold, the anomaly confidence level is increased or the trigger threshold of the self-healing scheduling strategy is decreased; and The self-healing scheduling strategy is determined based on the trend of the self-healing effect value changes over multiple consecutive time windows.

11. The privacy-preserving abnormal communication traffic self-healing scheduling method for edge terminal groups according to claim 1, characterized in that, The step of restoring service paths or transmission rates in batches according to the service priority and the link health when the abnormal confidence level is below the recovery threshold for multiple consecutive time windows includes: Identify candidate services and candidate recovery links that meet the recovery conditions; The candidate recovery services are sorted from high to low according to their service priority, and the candidate recovery links with a link health score higher than the health threshold are selected first. The self-healing effect value is recalculated after each batch of candidate recovery services is restored; and If the recalculated self-healing effect value is lower than the rollback effect threshold, the link health decreases by more than a predetermined amount, or the abnormal confidence rises by more than the warning threshold, then subsequent recovery is suspended and the current scheduling strategy is maintained or the previous scheduling strategy is rolled back.

12. The privacy-preserving anomalous communication traffic self-healing scheduling method for edge terminal groups according to claim 1, characterized in that, Multiple edge nodes exchange the abnormal traffic fingerprint or the security digest of the abnormal traffic fingerprint through a security digest exchange protocol, wherein the security digest exchange protocol includes at least one of node authentication, time window number verification, salt version verification, and duplicate fingerprint suppression.

13. The privacy-preserving abnormal communication traffic self-healing scheduling method for edge terminal groups according to claim 3, characterized in that, The anomaly embedding model is trained in the following manner: Obtain historical communication traffic behavior summaries, historical anomaly type labels, and historical handling effect data; Training constraints are used to indicate that historical communication traffic behavior summaries of the same anomaly type are closer in the embedding space, while historical communication traffic behavior summaries of different anomaly types are farther apart in the embedding space. as well as The parameters of the anomaly embedding model are adjusted based on the historical treatment effect data, so that the anomaly embedding vector is associated with the subsequent self-healing scheduling effect.

14. A privacy-preserving self-healing scheduling system for abnormal communication traffic in edge terminal groups, characterized in that, include: The local summary module is used to collect local communication traffic behavior data at multiple edge nodes, and to perform summary processing on the local communication traffic behavior data at each edge node to obtain a local traffic behavior summary. The privacy fingerprint module is used to sequentially perform anomaly embedding, random projection, quantization and salted hashing on the local traffic behavior summary to generate an irreversible and similarity-comparable anomaly traffic fingerprint. The secure exchange module is used to enable multiple edge nodes to exchange only the abnormal traffic fingerprint or the security digest of the abnormal traffic fingerprint, without exchanging the original communication content, the complete and reproducible communication log, the complete IP port sequence, or the complete traffic sequence. The consistency judgment module is used to calculate the regional consistency score based on the similarity distribution and spatial correlation of the abnormal traffic fingerprints of multiple edge nodes in adjacent time windows, and to determine the anomaly type and anomaly confidence based on the regional consistency score. The self-healing scheduling module is used to generate and execute a self-healing scheduling strategy based on the anomaly type, the anomaly confidence level, the service priority, and the link health. as well as The feedback rollback module is used to calculate the self-healing effect value based on the latency change rate, packet loss rate change rate, link utilization change, session retransmission count change, and service recovery success rate after the execution of the self-healing scheduling strategy. Based on the self-healing effect value, it updates the anomaly confidence level or the trigger threshold of the self-healing scheduling strategy, and performs batch recovery, pause recovery, or strategy rollback.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it performs the following steps: Local communication traffic behavior data is collected at multiple edge nodes, and the local communication traffic behavior data is digested at each edge node to obtain a local traffic behavior summary. The local traffic behavior summary is sequentially processed by anomaly embedding, random projection, quantization, and salted hashing to generate an irreversible and comparable anomaly traffic fingerprint. The multiple edge nodes exchange only the anomalous traffic fingerprint or the security digest of the anomalous traffic fingerprint, without exchanging the original communication content, the complete and reproducible communication log, the complete IP port sequence, or the complete traffic sequence. The region consistency score is calculated based on the similarity distribution and spatial correlation of the abnormal traffic fingerprints of multiple edge nodes within adjacent time windows, and the anomaly type and anomaly confidence are determined based on the region consistency score. A self-healing scheduling strategy is generated and executed based on the anomaly type, the anomaly confidence level, the service priority, and the link health. as well as The self-healing effect value is calculated based on the latency change rate, packet loss rate change rate, link utilization change, session retransmission count change, and service recovery success rate after the self-healing scheduling strategy is executed. The anomaly confidence or the trigger threshold of the self-healing scheduling strategy is updated based on the self-healing effect value, and batch recovery, paused recovery, or strategy rollback are performed.

Images