A broadcasting SD-WAN dynamic port mapping method based on a multi-dimensional network feature vector

Abstract

The application discloses a kind of based on multi-dimensional network feature vector's radio and television SD-WAN dynamic port mapping method, including the following steps: multi-dimensional network feature vector construction, port resource pool management, service traffic identification and priority division, dynamic port mapping decision, SD-WAN tunnel linkage encapsulation, mapping state monitoring and dynamic tuning, abnormal event identification and fast rollback and mapping strategy self-learning iteration;The application constructs the multi-dimensional network feature vector system of radio and television private line speciality, accurately adapts NAT1 full port opening, the link characteristics of no CGNAT, realizes the classification pool management and dynamic distribution of port resource, fully releases radio and television full port resource advantage, avoids the resource waste and port conflict problem caused by static configuration, improves port resource utilization efficiency, reduces artificial configuration operation and maintenance cost.

Description

Technical Field

[0001] This invention relates to the fields of software-defined wide area networks, network address translation, and industrial internet communication technology, specifically a dynamic port mapping method for broadcast SD-WAN based on multi-dimensional network feature vectors. Background Technology

[0002] With the rapid development of the Industrial Internet, the demand for remote operation and maintenance of industrial PLCs, remote equipment debugging, and remote acquisition of production data continues to grow. SD-WAN technology, with its advantages of multi-link convergence, intelligent scheduling, and flexible deployment, is gradually becoming a core technology solution for industrial remote networking. As an emerging WAN access resource, cable TV leased lines possess unique characteristics such as NAT1 full-cone network address translation, no carrier-grade CGNAT, and full port openness, giving them a natural advantage in port penetration and intranet access scenarios. However, current port mapping technology in industrial SD-WAN networking is still mainly based on static configuration and has not been specifically optimized for the network characteristics of cable TV leased lines, resulting in the following problems in practical applications.

[0003] First, static port mapping configurations are rigid and cannot adapt to the characteristics of full-port resources in cable TV. Existing port mapping mostly uses manual static configuration, opening only a small number of designated ports, failing to fully utilize the resource advantage of full-port access on cable TV leased lines, resulting in low port resource utilization. Simultaneously, port conflicts easily occur when multiple services access concurrently, requiring repeated manual configuration adjustments, leading to high maintenance costs and slow response times, and failing to adapt to the dynamically changing needs of industrial scenarios.

[0004] Secondly, port mapping and SD-WAN scheduling are independent of each other, and mapping is prone to failure during link switching. Existing port mapping rules are only bound to a single access link. When SD-WAN performs multi-link switching due to link quality degradation, the original port mapping rules cannot be synchronously migrated to the new link, resulting in the interruption of industrial remote sessions. Critical services such as PLC program download and remote configuration debugging are forced to terminate, which seriously affects the continuity of industrial production and maintenance and cannot meet the high reliability communication requirements of industrial scenarios.

[0005] Furthermore, the lack of a differentiated mapping mechanism for business operations makes critical business port resources vulnerable to congestion. Existing port mapping does not differentiate between business types and priorities; industrial control traffic, maintenance and monitoring traffic, office traffic, and high-volume distribution traffic share port resources. High-priority industrial control traffic is easily overwhelmed by low-priority high-volume traffic, leading to delays and packet loss in industrial message transmission and impacting the stable operation of production equipment. Simultaneously, the lack of dedicated port protection for industrial protocols exposes ports to the public internet, posing significant network security risks.

[0006] Furthermore, the mapping recovery capability is insufficient under abnormal scenarios, and fault handling is delayed. Existing port mapping fault detection relies on a heartbeat timeout mechanism, which has high detection latency and cannot quickly distinguish between momentary link jitter and permanent faults, easily leading to frequent false switching or untimely fault response. After a fault occurs, mapping rules need to be manually reconfigured, resulting in long service interruptions, which does not meet the millisecond-level self-healing performance requirements of industrial sites.

[0007] Finally, the mapping strategy lacks adaptive optimization capabilities and has poor adaptability to complex scenarios. Existing port mapping strategies are fixed and cannot automatically optimize parameters according to changes in the network environment and service characteristics. Faced with complex networking environments and diverse service requirements in industrial sites, continuous manual configuration adjustments are required, resulting in long strategy iteration cycles and limited adaptability. Summary of the Invention

[0008] The purpose of this invention is to provide a dynamic port mapping method for SD-WAN based on multi-dimensional network feature vectors, so as to solve the problems mentioned in the background art.

[0009] To achieve the above objectives, the present invention provides the following technical solution: a dynamic port mapping method for cable SD-WAN based on multi-dimensional network feature vectors, comprising the following steps: Step 1: Collect network attribute data of cable TV leased lines and multi-carrier access links through SD-WAN edge nodes. After performing normalization preprocessing on the collected data, construct a multi-dimensional network feature vector containing six dimensions: NAT type characteristics, port open attributes, link latency, link jitter, packet loss rate, and link stability coefficient. Step 2: Classify and divide the port resources of the entire network according to their service attributes, collect historical port operation data to establish a port status baseline model, and generate a tiered available port resource pool based on the port availability assessment results; Step 3: Identify the protocol type and service attributes of the access service through deep packet analysis and traffic statistics feature matching, divide the service into four levels of priority according to the importance of the service, and match the corresponding port requirement level; Step 4: Using the multidimensional network feature vector and the business port requirement level as input, perform multidimensional matching decision calculation, filter the port resources with the highest matching degree, generate dynamic port mapping rules, and complete rule conflict detection; Step 5: Synchronize the generated dynamic port mapping rules to the SD-WAN control plane and encapsulate them in conjunction with the SD-WAN tunnel policy to complete the synchronization of mapping tables and tunnel protocol adaptation between multiple edge nodes; Step 6: Collect port mapping operation status data and link quality data at fixed intervals, compare them with port status baseline and link characteristic baseline, determine the degree of quality degradation, and then perform smooth dynamic optimization of the mapping rules. Step 7: Real-time detection of link connectivity and port operating status, identification of link failures, port conflicts and illegal access anomalies, and triggering port mapping fast rollback and service session migration after determining the fault type; Step 8: Periodically collect historical mapping performance data, calculate the contribution deviation of each feature dimension, iteratively update feature weights and mapping decision rules, and complete the self-learning optimization of the mapping strategy and the expansion of the feature library.

[0010] Furthermore, in step one, a multi-dimensional network feature vector is constructed and a comprehensive link feature score is calculated. The calculation formula is as follows: In the formula, The link's comprehensive characteristics are scored, with values ​​ranging from 0 to 1. This is a NAT type characteristic value, ranging from 0 to 1; Port openness, with a value ranging from 0 to 1. ; represents the normalized time delay value, ranging from 0 to 1; This is the normalized jitter value, ranging from 0 to 1; This is the normalized packet loss rate value, ranging from 0 to 1. This is the link stability coefficient, with a value ranging from 0 to 1; to The weight coefficients corresponding to each feature dimension satisfy the following conditions: .

[0011] Furthermore, in step two, the formula for calculating the port availability score is as follows: In the formula, Port availability is scored, with values ​​ranging from 0 to 1; , , The weighting coefficients for the three dimensions of port idleness, collision rate, and security risk satisfy the following conditions: ; This represents the duration the port has been occupied. The maximum continuous occupancy period threshold for the port; This represents the port's historical conflict rate, with a value ranging from 0 to 1. This represents the port security risk value, ranging from 0 to 1.

[0012] Furthermore, in step three, deep packet analysis extracts packet header and data segment features, matches them against an industrial protocol fingerprint database to identify ModbusTCP, S7, OPCUA, and Profinet industrial control protocols, and identifies encrypted maintenance traffic, video surveillance traffic, office internet traffic, and PCDN distribution traffic through traffic statistics feature matching. Based on business importance, real-time industrial control traffic is divided into first-level priority, maintenance monitoring and data acquisition traffic into second-level priority, office internet traffic into third-level priority, and PCDN high-volume distribution traffic into fourth-level priority, with each priority corresponding to a specific port requirement level.

[0013] Furthermore, in step four, the overall matching degree between the service and the port is calculated using the following formula: In the formula, This represents the overall compatibility between the service and the port, with a value ranging from 0 to 1. Total number of matching dimensions; Let be the weight coefficient of the i-th matching dimension, satisfying ; The matching score for the i-th dimension ranges from 0 to 1. Candidate ports are sorted from high to low based on their overall matching degree. The port ranked first is selected to generate a mapping rule, and a five-tuple conflict detection is performed to generate a conflict-free and valid mapping rule.

[0014] Furthermore, in step five, the port mapping rules are distributed to all edge gateway nodes in the network through incremental synchronization, and the local mapping tables of each node are updated; the encapsulation and adaptation of mapping packets are performed for IPsec encrypted tunnels, GRE tunnels, and VXLAN tunnels; when SD-WAN scheduling performs link switching, the port mapping rules are automatically migrated to the target link to maintain consistency between internal and external network mapping relationships, and the validity verification of port mapping is completed synchronously during the tunnel establishment process.

[0015] Furthermore, in step six, multi-dimensional feature data of the link, port operating status data, and service traffic data are collected at preset intervals, and the quality degradation degree is calculated by comparing them with the corresponding baseline data. When the comprehensive feature score of the link is lower than the preset degradation threshold, the port availability drops to the level threshold, or the service transmission quality does not meet the requirements, the mapping optimization process is triggered to regenerate the mapping rules. The switch between the old and new mappings is completed in a smooth transition manner. First, a new mapping channel is established and connectivity is verified. Then, service traffic is gradually migrated. After the migration is completed, the original port resources are released.

[0016] Furthermore, in step seven, link connectivity, port response status, and access behavior data are collected in real time through millisecond-level parallel detection; a sliding window statistical state filtering algorithm is used to distinguish three types of abnormal events: permanent faults, transient jitter, and port anomalies; backup mapping paths and backup port resources are pre-configured, and when a permanent fault or an unrecoverable port anomaly is detected, mapping rollback is triggered to switch service traffic to the backup path; and the service connection status is maintained through a session table synchronization mechanism to ensure that existing TCP sessions and industrial protocol connections do not need to be re-established during the mapping migration process.

[0017] Furthermore, in step eight, the weight coefficients of the feature dimensions are iteratively updated, and the weight update calculation formula is as follows: In the formula, Let be the weight of the i-th feature dimension after the t-th iteration; The weights are updated for the i-th feature dimension; The learning rate, with a value ranging from 0 to 1; The contribution deviation of the i-th feature dimension, with a value ranging from -1 to 1; The updated feature weights are normalized and used for mapping decision calculation in the next cycle. At the same time, the identified business protocol fingerprints and link feature types are added to expand the protocol feature library and link feature library.

[0018] Compared with the prior art, the beneficial effects of the present invention are: This invention constructs a dedicated multi-dimensional network feature vector system for broadcast dedicated lines, accurately adapting to the link characteristics of NAT1 with full port openness and no CGNAT. It achieves classified pooling management and dynamic allocation of port resources, fully releasing the advantages of broadcast's full port resources, avoiding resource waste and port conflicts caused by static configuration, improving port resource utilization efficiency, and reducing manual configuration and maintenance costs. It achieves deep linkage between port mapping strategies and SD-WAN tunnels, synchronously migrating mapping rules and maintaining sessions during multi-link switching, ensuring the continuity of services such as remote debugging of industrial PLCs, configuration program downloads, and equipment data acquisition, avoiding service interruptions caused by link switching, and meeting the high-reliability communication requirements of industrial scenarios. It establishes a service hierarchy and port demand matching mechanism, implementing differentiated port mapping strategies for industrial control traffic, operation and maintenance monitoring traffic, office traffic, and high-volume services, ensuring dedicated allocation of port resources for high-priority industrial services, preventing low-priority high-volume traffic from crowding out critical service resources, and improving the transmission stability and security of core industrial services. It possesses rapid abnormal event identification and mapping rollback capabilities, accurately distinguishing between three types of events: permanent link failures, transient jitter, and port anomalies. This avoids erroneous switching caused by transient jitter, while triggering millisecond-level mapping migration and rollback for permanent failures, significantly reducing service interruption time and achieving industrial-grade network self-healing capabilities. A built-in self-learning and iterative mapping policy mechanism continuously optimizes feature weights and mapping rules based on historical operational data and service performance, eliminating the need for repeated manual configuration adjustments. It can automatically adapt to complex and ever-changing industrial networking environments, reducing network operation and maintenance complexity and improving policy optimization efficiency. Attached Figure Description

[0019] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0020] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0021] Please see Figure 1 This invention provides a dynamic port mapping method for cable SD-WAN based on multi-dimensional network feature vectors, comprising the following steps: Step 1: Collect network attribute data of cable TV leased lines and multi-carrier access links through SD-WAN edge nodes. After performing normalization preprocessing on the collected data, construct a multi-dimensional network feature vector containing six dimensions: NAT type characteristics, port open attributes, link latency, link jitter, packet loss rate, and link stability coefficient. Step 2: Classify and divide the port resources of the entire network according to their service attributes, collect historical port operation data to establish a port status baseline model, and generate a tiered available port resource pool based on the port availability assessment results; Step 3: Identify the protocol type and service attributes of the access service through deep packet analysis and traffic statistics feature matching, divide the service into four levels of priority according to the importance of the service, and match the corresponding port requirement level; Step 4: Using the multidimensional network feature vector and the business port requirement level as input, perform multidimensional matching decision calculation, filter the port resources with the highest matching degree, generate dynamic port mapping rules, and complete rule conflict detection; Step 5: Synchronize the generated dynamic port mapping rules to the SD-WAN control plane and encapsulate them in conjunction with the SD-WAN tunnel policy to complete the synchronization of mapping tables and tunnel protocol adaptation between multiple edge nodes; Step 6: Collect port mapping operation status data and link quality data at fixed intervals, compare them with port status baseline and link characteristic baseline, determine the degree of quality degradation, and then perform smooth dynamic optimization of the mapping rules. Step 7: Real-time detection of link connectivity and port operating status, identification of link failures, port conflicts and illegal access anomalies, and triggering port mapping fast rollback and service session migration after determining the fault type; Step 8: Periodically collect historical mapping performance data, calculate the contribution deviation of each feature dimension, iteratively update feature weights and mapping decision rules, and complete the self-learning optimization of the mapping strategy and the expansion of the feature library.

[0022] Example: This embodiment uses an industrial SD-WAN networking scenario with hybrid access of cable TV lines and carrier broadband as an example to describe the specific implementation of the present invention in detail. In this networking scenario, an SD-WAN edge gateway is deployed in the industrial field, simultaneously accessing both a cable TV NAT1 leased line and ordinary carrier broadband. The field includes devices such as PLC controllers, sensors, and surveillance cameras. A remote operation and maintenance center achieves remote access and operation and maintenance of the field devices through the SD-WAN network. The method of the present invention is deployed on the SD-WAN control plane and edge gateway nodes to realize dynamic port mapping and link linkage. The specific implementation steps are as follows: Step 1: Construction of Multidimensional Network Feature Vectors The SD-WAN edge gateway's detection module performs full-dimensional network feature collection on all access links, and transmits the collected data to the control plane for preprocessing and vector construction.

[0023] First, a NAT type detection is performed. The edge gateway sends UDP probe packets from different source ports to the public network probe server. The probe server returns the reception results and determines the NAT type of the link based on the packet reception. If packets can be received normally on all ports, it is determined to be NAT1 full cone NAT, and the corresponding NAT type characteristic value is taken as the maximum value; if packets can be received only on the communication port, it is determined to be restricted cone NAT, and the corresponding characteristic value is taken as the median value; if packets can be received only on a specific source port, it is determined to be port restricted cone NAT, and the corresponding characteristic value is taken as the lower value; if packets are sent to different external network ports of the same external network address, and only the fixed port can receive them while the other ports cannot, it is determined to be symmetric NAT, and the corresponding characteristic value is taken as the minimum value.

[0024] Subsequently, a port openness detection is performed. The edge gateway uses a public network port scan to detect the range of ports accessible from the public network, and calculates the ratio of the number of open ports to the total number of ports to obtain the port openness value. The cable NAT1 leased line has all ports open, resulting in the maximum port openness value.

[0025] Next, link quality probing is performed. Probe messages are sent via a bidirectional active measurement protocol. The round-trip time of the messages is counted to calculate link latency, the degree of latency fluctuation is counted to calculate link jitter, and the proportion of lost probe messages is counted to calculate link packet loss rate. The probing process is continuously executed at fixed intervals to obtain real-time link quality data.

[0026] Then, the link stability coefficient is calculated by extracting the link's operation logs from past periods, statistically analyzing the continuous online time and the frequency of failures, and calculating the link stability coefficient by weighting the online time ratio with the failure frequency. The longer the continuous online time and the lower the failure frequency, the higher the stability coefficient.

[0027] After all feature data collection is complete, normalization preprocessing is performed. A linear normalization method is used to map the original data for each dimension to a numerical range of 0 to 1 according to the maximum and minimum values, eliminating the influence of different units on subsequent calculations. In the normalization process, for positive indicators, larger values ​​result in better performance, and the normalized value increases with the original value; for negative indicators, such as latency, jitter, and packet loss rate, smaller values ​​result in better performance, and the normalized value decreases with the original value.

[0028] After normalization, a multidimensional network feature vector is constructed, and the link comprehensive feature score is calculated.

[0029] The formula for calculating the comprehensive score of multidimensional network feature vectors is shown in equation (1): In the formula, The link's overall characteristics are scored, with a value ranging from 0 to 1. A higher score indicates better overall link quality. This is a NAT type characteristic value, ranging from 0 to 1. The value is 1 for NAT1 full cone, 0.6 for restricted cone, 0.3 for port restricted cone, and 0 for symmetric type. This represents the port openness, with a value ranging from 0 to 1. A larger value indicates a higher proportion of open ports. This is a normalized latency value, ranging from 0 to 1. A larger value indicates a higher link latency. This is a normalized jitter value, ranging from 0 to 1. A larger value indicates more severe link jitter. This is a normalized packet loss rate value, ranging from 0 to 1. A larger value indicates a higher packet loss rate. This is the link stability coefficient, with a value ranging from 0 to 1. The larger the value, the more stable the link operation. to The weight coefficients for each feature dimension satisfy the following conditions: The weighting coefficients can be configured according to the needs of the scenario. In this scenario... and The weighting is higher, highlighting the NAT features and port advantages of the cable TV dedicated line.

[0030] Through the above calculations, the multidimensional network feature vector and comprehensive score of each access link are obtained and stored in the link feature library to provide data support for subsequent mapping decisions.

[0031] Step 2: Port Resource Pooling Management The port management module in the control plane classifies and pools all available port resources across the network, establishes port status baselines, assesses port availability, and generates tiered resource pools.

[0032] First, port classification is performed, dividing the dynamic port range into four port segments according to service carrying attributes: Industrial control dedicated port segment, allocated only to Level 1 industrial control services; Operation and maintenance monitoring dedicated port segment, allocated only to Level 2 operation and maintenance monitoring services; General service port segment, allocated to Level 3 office internet access services; and High-volume distribution port segment, allocated to Level 4 PCDN services. Each port segment is isolated from the others to prevent different levels of services from competing for resources.

[0033] Subsequently, a port status baseline was established. Historical operational data from the past thirty days was extracted for each port, and the distribution of idle time, normal range of connection count, normal range of traffic, and normal range of response latency were statistically analyzed. The normal fluctuation range was calculated using statistical methods to form the port status baseline. The baseline data was updated regularly and continuously optimized as operational data accumulated to improve the accuracy of the baseline.

[0034] Next, the port availability score is calculated, and the port availability status is comprehensively evaluated from three dimensions: idle time, conflict rate, and security risk.

[0035] The formula for calculating port availability is shown in equation (2): In the formula, Port availability is scored, with values ​​ranging from 0 to 1; , , The weighting coefficients for the three dimensions of port idleness, collision rate, and security risk satisfy the following conditions: ; This represents the duration the port has been occupied. The maximum continuous occupancy period threshold for the port; This represents the port's historical conflict rate, with a value ranging from 0 to 1. This represents the port security risk value, ranging from 0 to 1.

[0036] Based on port availability scores, each port is divided into three levels: high availability ports (availability greater than or equal to 0.8), medium availability ports (availability greater than or equal to 0.5 but less than 0.8), and low availability ports (availability less than 0.5). High availability ports are prioritized for allocation to Tier 1 services, medium availability ports are allocated to Tier 2 and Tier 3 services, and low availability ports are allocated only to Tier 4 services. This ultimately forms a tiered availability port resource pool, with all port statuses updated in real time to dynamically maintain the resource pool status.

[0037] Step 3: Business Traffic Identification and Prioritization The edge gateway's traffic identification module performs in-depth analysis of inbound and outbound traffic, identifies service types, and prioritizes services.

[0038] First, packet collection is performed. All packets flowing through the edge gateway are obtained via traffic mirroring and then fed into the deep parsing engine. For plaintext packets, the source IP, destination IP, source port, destination port, and protocol number fields in the packet header are extracted, along with the characteristic byte sequence of the data segment. For encrypted packets, traffic statistics are extracted, including average packet length, packet length distribution, connection establishment time, byte rate, and traffic periodicity.

[0039] Subsequently, industrial protocol matching is performed, matching the extracted plaintext message features against a pre-built industrial protocol fingerprint database. This database contains multi-dimensional features of mainstream industrial protocols such as ModbusTCP, S7, OPCUA, and Profinet, covering proprietary port numbers, message header identifier fields, function code value ranges, and data segment format features. A multi-feature weighted verification method is used during matching; only when multiple feature conditions are met is the protocol identified, avoiding misidentification. The protocol fingerprint database supports custom additions, allowing for the addition of proprietary protocol features based on the type of field equipment.

[0040] For encrypted traffic, the extracted traffic statistical features are matched with an encrypted traffic feature library to identify encrypted industrial maintenance traffic, encrypted video surveillance traffic, etc. The feature library is generated through machine learning methods and can identify the statistical feature differences between different types of encrypted traffic.

[0041] After identifying the service type, service priority is assigned. Based on the service's importance to industrial production, real-time requirements, and reliability requirements, all services are divided into four priority levels: Level 1 priority is real-time industrial control traffic, including PLC control commands and real-time data acquisition messages, with the highest requirements for latency, packet loss, and continuity; Level 2 priority is operation and maintenance monitoring traffic, including remote configuration and debugging, equipment monitoring, and log uploads, with relatively high reliability requirements and tolerating slight latency; Level 3 priority is office internet traffic, including daily office access and management page access, with moderate reliability requirements; and Level 4 priority is high-volume distribution services, including PCDN content distribution and large file transfers, with high bandwidth requirements but the lowest priority. Each priority level corresponds to a different port requirement level, with Level 1 services corresponding to the highest level of port resources and Level 4 services corresponding to the lowest level of port resources.

[0042] Step 4: Dynamic Port Mapping Decision The mapping decision module receives service port application requests, combines link characteristics with the port resource pool, performs matching decisions, and generates the optimal mapping rules.

[0043] First, determine the scope of resource selection. Based on the service priority, select candidate ports from the corresponding level of port resource pool. Level 1 services are selected only from the high-availability ports of the industrial control dedicated port segment, and Level 4 services are selected only from the high-traffic distribution port segment, so as to achieve a one-to-one correspondence between services and port segments.

[0044] Subsequently, a multi-dimensional matching calculation is performed to extract three core attributes of the service: protocol type, bandwidth requirements, and security requirements. These attributes are then matched one by one with the three attributes of candidate ports: protocol compatibility, carrying capacity, and security level. Each matching item is assigned a matching score from 0 to 1 based on the degree of matching, with higher scores indicating higher matching degrees.

[0045] The formula for calculating the overall matching degree between services and ports is shown in equation (3): In the formula, This represents the overall compatibility between the service and the port, with a value ranging from 0 to 1. Total number of matching dimensions; Let be the weight coefficient of the i-th matching dimension, satisfying ; The matching score for the i-th dimension ranges from 0 to 1.

[0046] Calculate the overall matching degree of all candidate ports according to the above formula, sort them from high to low matching degree, and select the port at the top of the sort as the target port.

[0047] Generate mapping rules, which include information such as internal network source address and source port, external network mapped address and mapped port, protocol type, service priority, validity period, and access control list.

[0048] Perform rule conflict detection by comparing the generated mapping rule with the existing effective mapping rules using a 5-tuple to check for address and port conflicts. If a conflict exists, exclude the current port, select the next port in the sort order, regenerate the rule, and perform conflict detection again until a conflict-free and effective mapping rule is generated.

[0049] The generated mapping rules are temporarily stored in the queue to be activated, awaiting synchronous distribution.

[0050] Step 5: SD-WAN Tunnel Co-encapsulation The tunnel linkage module deeply binds port mapping rules with SD-WAN tunnel policies to achieve multi-link mapping synchronization and encapsulation adaptation.

[0051] First, mapping rule synchronization is performed. The control plane distributes the mapping rules to be implemented to all relevant edge gateway nodes within the network via the control channel. Each node receives the rules and updates its local mapping table. Synchronization uses an incremental approach, distributing only newly added, modified, and deleted mapping table entries to reduce bandwidth usage on the control channel. After synchronization is complete, a confirmation message is returned to the control plane to ensure that the mapping tables of all nodes are consistent.

[0052] Subsequently, tunnel encapsulation adaptation is performed, optimizing the encapsulation of mapped packets for different SD-WAN tunnel protocols. For IPsec encrypted tunnels, port mapping information is embedded in the tunnel negotiation process, and the mapping rules automatically take effect after the tunnel is established. For GRE and VXLAN tunnels, the packet header structure is optimized to reduce the additional overhead caused by encapsulation. For cable NAT1 links, a simplified encapsulation format is adopted to fully utilize the advantages of full port pass-through and reduce the performance loss caused by encapsulation.

[0053] To achieve synchronized link switching mapping, when the SD-WAN scheduling module detects a degradation in the quality of the primary link and decides to switch to a backup link, it synchronously triggers the port mapping migration process. The scheduling module synchronously distributes the mapping rules to the corresponding interfaces of the backup link and updates the mapping entries of the backup link. The validity of the backup link mapping is verified before the link switch to ensure that traffic can be forwarded normally after the switch. During the link switch, the internal and external network mapping relationships remain unchanged, and services do not need to be aware of the link change.

[0054] After the mapping rules take effect, the edge gateway performs address and port translation according to the mapping rules and forwards service traffic.

[0055] Step Six: Mapping Status Monitoring and Dynamic Optimization The status monitoring module periodically collects operational data, evaluates and maps the operational status, and performs dynamic optimization.

[0056] According to the preset collection cycle, three types of data are collected periodically: multi-dimensional link characteristic data, including latency, jitter, packet loss rate, and NAT status; port operation data, including port connection count, traffic, and response latency; and service quality data, including service packet loss rate, latency, and interruption status.

[0057] The collected real-time data is compared with the corresponding baseline data to calculate the degree of degradation. The mapping optimization process is triggered when any of the following occurs: the comprehensive link characteristic score is lower than the preset degradation threshold; the port availability drops below the level required for the current service; or the service transmission quality does not meet the preset SLA requirements.

[0058] After the optimization is triggered, the mapping decision process in step four is re-executed to generate new mapping rules based on the latest link characteristics and port resource status.

[0059] To perform a smooth switchover, first establish a new mapping channel on the target link and verify channel connectivity and service reachability. After successful verification, gradually migrate service traffic from the old channel to the new channel, using a gradual traffic switching approach to avoid traffic fluctuations caused by instantaneous switching. Once all service traffic migration is complete and operation is stable, close the old mapping channel and release the old port resources back to the port resource pool.

[0060] Set a cooldown period for optimization. Once a single optimization is completed, no new optimization will be triggered during the cooldown period to avoid frequent adjustments to mapping rules affecting business stability.

[0061] Step 7: Abnormal Event Identification and Quick Rollback The anomaly detection module monitors the status of links and ports in real time, identifies abnormal events, and performs a fast rollback.

[0062] Employing millisecond-level parallel probing technology, it simultaneously probes the connectivity of all access links and active ports, sending probe packets continuously at extremely short intervals to acquire connectivity status data in real time. It also monitors port access behavior to identify security events such as abnormal scanning and unauthorized access.

[0063] The detection data is analyzed based on a state filtering algorithm. A sliding window statistical method is used to collect state data from multiple consecutive detection cycles, distinguishing three types of abnormal events: permanent fault (multiple consecutive cycles of failed detection, determined as a permanent link or port fault); transient jitter (single or a few cycles of failed detection followed by automatic recovery, determined as transient jitter, not triggering a handover); and port anomaly (no port response but normal link, determined as a port-level anomaly). The filtering algorithm filters out transient jitter interference, avoiding frequent erroneous handovers.

[0064] Pre-configure backup mapping schemes, configure backup links and backup ports for each high-priority service mapping rule, pre-generate and store backup mapping rules, and can be directly called in case of failure.

[0065] When a permanent failure or an unrecoverable port anomaly is detected, a fast rollback mechanism is immediately triggered, directly invoking the pre-configured backup mapping rules to switch business traffic to the backup path.

[0066] During the handover process, session persistence is performed, synchronizing the session table information of the original business to the new mapping channel, maintaining the TCP session state and the industrial protocol connection state, so that the business does not need to re-establish the connection and achieves seamless handover.

[0067] In response to unauthorized access incidents, a temporary port closure mechanism is triggered, the source address is added to the blacklist to block abnormal access, and a security log is generated to record the event information. Once the anomaly is resolved, the port is restored to its normal state.

[0068] Step 8: Mapping strategy self-learning iteration The self-learning module runs cyclically, optimizing the mapping strategy based on historical running data to achieve closed-loop iteration.

[0069] At the end of each iteration cycle, data on the mapping performance within that cycle is collected, including core indicators such as average service interruption duration, number of port conflicts, link port resource utilization, and average service transmission quality, which serve as the basis for evaluating strategy optimization.

[0070] Contribution analysis is performed using correlation analysis to examine the correlation between the weight settings of each feature dimension and the final performance, and to calculate the contribution deviation of each feature dimension. If a feature dimension has a high weight but contributes little to the performance, its weight is reduced; conversely, if a dimension has a low weight but contributes much to the performance, its weight is increased.

[0071] The feature weights and matching decision weights are updated based on the contribution deviation. The weight update calculation formula is shown in equation (4): In the formula, Let be the weight of the i-th feature dimension after the t-th iteration; The weights are updated for the i-th feature dimension; The learning rate, with a value ranging from 0 to 1; The contribution deviation of the i-th feature dimension ranges from -1 to 1.

[0072] After completing the weight update, the feature library is expanded. Newly identified business protocol features and novel link features from this period are added to the corresponding feature library to broaden its coverage and improve subsequent identification accuracy.

[0073] The updated strategy will first be deployed and run on a small number of pilot nodes to verify its effectiveness. If the pilot results are better than the original strategy and no abnormal issues arise, the deployment will be gradually expanded until it takes effect across all nodes. If the pilot results are unsatisfactory, the weight parameters will be rolled back and re-analyzed and optimized.

[0074] Through the aforementioned cyclical iterations, the mapping strategy is continuously optimized to adapt to the ever-changing network environment and business needs, without the need for continuous manual intervention.

[0075] Performance comparison test experiment: To verify the actual technical effect of the method of the present invention, a test environment was built in the above-mentioned industrial SD-WAN networking scenario, and a comparative test was conducted with the traditional static port mapping scheme. The specific experimental process and results are as follows.

[0076] 1. Test Environment and Test Conditions Set up an industrial SD-WAN test network: The network includes 2 SD-WAN edge gateways (deployed at the industrial site and the remote operation and maintenance center respectively), 5 S7 series PLC controllers, 8 high-definition surveillance cameras, and 1 set of PCDN content distribution nodes on the field side; and 1 cable TV NAT1 leased line (downlink bandwidth 100Mbps, all ports open) and 2 ordinary operator broadband lines (downlink bandwidth 100Mbps each, symmetrical NAT) on the wide area network side.

[0077] The test period is 72 consecutive hours, simulating real-world conditions such as concurrent operation of multiple services in an industrial setting, random fluctuations in link quality, and dynamic online / offline operation of services.

[0078] Comparative approach: The industry-standard static port mapping scheme is adopted, with fixed port mapping rules configured manually. Port mapping is bound to a single main link, and there is no service classification mechanism, dynamic optimization and automatic fault fallback capability.

[0079] 2. Test Indicators and Experimental Results This test compared six core dimensions: port resource utilization, service conflict control, link switching continuity, critical service quality, fault self-healing capability, and self-learning optimization effect. The test results are as follows: (1) Port resource utilization The ratio of the actual number of ports used to the total number of available ports on the entire network during the statistical testing period was used. The comparative example, with a static configuration, only opened 32 designated service ports, resulting in an average port resource utilization rate of 24.7%. This invention, through port pooling management and dynamic allocation, achieved an average port resource utilization rate of 76.3% during the testing period, representing a resource utilization efficiency improvement of approximately 209% compared to the comparative example, fully leveraging the resource advantages of fully open ports on the cable TV leased line.

[0080] (2) Port conflict rate A scenario simulating 20 concurrent service accesses and random service up / down events was analyzed, and the number of port conflict events within 72 hours was recorded. Under the comparative static configuration, 11 port conflicts occurred, with a conflict rate of approximately 15.3%, requiring manual intervention to adjust the configuration. The proposed solution, through hierarchical resource pool isolation and a five-tuple conflict detection mechanism, only resulted in one minor conflict, reducing the conflict rate to 0.8% and significantly lowering manual maintenance costs.

[0081] (3) Duration of service interruption during link switching The simulation of SD-WAN automatic link switching triggered by primary link quality degradation was used to analyze the duration of service session interruptions. In the comparative solution, port mapping was only bound to the primary link, and the mapping rules became invalid after link switching, resulting in an average service interruption duration of 12.6 seconds. The present invention, through a tunnel-linked mapping synchronization mechanism, synchronously migrates the mapping rules to the target link during link switching, achieving an average service interruption duration of 42ms, meeting the 100ms-level seamless switching requirements of industrial scenarios.

[0082] (4) Transmission quality of high-priority services Under the premise of PCDN high-volume traffic operating at full bandwidth, the transmission latency and packet loss rate of Tier 1 industrial control services were tested. In the comparative scheme, industrial control traffic was squeezed out by high-volume traffic, resulting in an average transmission latency of 87ms and an average packet loss rate of 2.1%. The proposed solution, through service classification and dedicated port segment isolation, achieved an average transmission latency of 23ms and an average packet loss rate of 0.07% for industrial control services, significantly ensuring the transmission stability and real-time performance of critical services.

[0083] (5) Fault recovery performance A scenario simulating a permanent outage of a cable TV leased line was studied, and the time from the occurrence of the fault to the full restoration of normal communication was statistically analyzed. The comparative solution, relying on manual fault diagnosis and reconfiguration of mapping rules, had an average fault recovery time of 48.2 seconds. The proposed solution, through millisecond-level anomaly detection and a pre-configured backup mapping fast rollback mechanism, achieved an average fault recovery time of 210ms, representing a fault recovery speed approximately 229 times faster than the comparative solution, thus realizing industrial-grade network self-healing capabilities.

[0084] (6) Self-learning iterative optimization effect The effect of strategy iteration during continuous operation of the present invention was tested: under the initial default weight configuration, the port resource utilization rate was 64.8% and the overall service transmission quality score was 0.72; after 3 self-learning iteration cycles, the feature weights were automatically optimized, the port resource utilization rate increased to 78.1%, and the overall service transmission quality score increased to 0.81, verifying that the self-learning mechanism can automatically adapt to changes in network environment and service characteristics.

[0085] 3. Experimental Conclusions The experimental data above show that the dynamic port mapping method for cable SD-WAN based on multi-dimensional network feature vectors described in this invention has significant advantages over traditional static port mapping schemes in terms of port resource utilization efficiency, port conflict avoidance, service continuity during link switching, quality assurance of high-priority services, fault self-healing speed, and adaptive optimization capabilities. It can accurately adapt to the link characteristics of NAT1 with all ports open on cable leased lines, effectively meeting the communication needs of high reliability, low latency, and easy operation and maintenance in industrial Internet scenarios.

[0086] Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A dynamic port mapping method for cable SD-WAN based on multi-dimensional network feature vectors, characterized in that: Includes the following steps: Step 1: Collect network attribute data of cable TV leased lines and multi-carrier access links through SD-WAN edge nodes. After performing normalization preprocessing on the collected data, construct a multi-dimensional network feature vector containing six dimensions: NAT type characteristics, port open attributes, link latency, link jitter, packet loss rate, and link stability coefficient. Step 2: Classify and divide the port resources of the entire network according to their service attributes, collect historical port operation data to establish a port status baseline model, and generate a tiered available port resource pool based on the port availability assessment results; Step 3: Identify the protocol type and service attributes of the access service through deep packet analysis and traffic statistics feature matching, divide the service into four levels of priority according to the importance of the service, and match the corresponding port requirement level; Step 4: Using the multidimensional network feature vector and the business port requirement level as input, perform multidimensional matching decision calculation, filter the port resources with the highest matching degree, generate dynamic port mapping rules, and complete rule conflict detection; Step 5: Synchronize the generated dynamic port mapping rules to the SD-WAN control plane and encapsulate them in conjunction with the SD-WAN tunnel policy to complete the synchronization of mapping tables and tunnel protocol adaptation among multiple edge nodes; Step 6: Collect port mapping operation status data and link quality data at fixed intervals, compare them with port status baseline and link characteristic baseline, determine the degree of quality degradation, and then perform smooth dynamic optimization of the mapping rules. Step 7: Real-time detection of link connectivity and port operating status, identification of link failures, port conflicts and illegal access anomalies, and triggering port mapping fast rollback and service session migration after determining the fault type; Step 8: Periodically collect historical mapping performance data, calculate the contribution deviation of each feature dimension, iteratively update feature weights and mapping decision rules, and complete the self-learning optimization of the mapping strategy and the expansion of the feature library.

2. The method for dynamic port mapping of SD-WAN based on multi-dimensional network feature vectors according to claim 1, characterized in that: In step one, a multi-dimensional network feature vector is constructed and a comprehensive link feature score is calculated. The calculation formula is as follows: In the formula, The link's comprehensive characteristics are scored, with values ​​ranging from 0 to 1. This is a NAT type characteristic value, ranging from 0 to 1; Port openness, with a value ranging from 0 to 1; This is the normalized time delay value, ranging from 0 to 1; This is the normalized jitter value, ranging from 0 to 1; This is the normalized packet loss rate value, ranging from 0 to 1. This is the link stability coefficient, with a value ranging from 0 to 1; to The weight coefficients corresponding to each feature dimension satisfy the following conditions: .

3. The method for dynamic port mapping of SD-WAN based on multi-dimensional network feature vectors according to claim 1, characterized in that: In step two, the formula for calculating the port availability score is as follows: In the formula, Port availability is scored, with values ​​ranging from 0 to 1; , , The weighting coefficients for the three dimensions of port idleness, collision rate, and security risk satisfy the following conditions: ; This indicates the duration the port has been occupied. The maximum continuous occupancy period threshold for the port; This represents the port's historical conflict rate, with a value ranging from 0 to 1. This represents the port security risk value, ranging from 0 to 1.

4. The method for dynamic port mapping of SD-WAN based on multi-dimensional network feature vectors according to claim 1, characterized in that: In step three, deep message parsing extracts message header and data segment features, matches the industrial protocol fingerprint database to identify ModbusTCP, S7, OPCUA, and Profinet industrial control protocols, and identifies encrypted operation and maintenance traffic, video surveillance traffic, office internet traffic, and PCDN distribution traffic through traffic statistics feature matching. Based on the importance of the business, real-time traffic for industrial control is divided into Level 1 priority, traffic for operation and maintenance monitoring and data acquisition is divided into Level 2 priority, traffic for office internet access is divided into Level 3 priority, and traffic for PCDN large-volume distribution is divided into Level 4 priority. Each priority corresponds to a specific port requirement level.

5. The method for dynamic port mapping of SD-WAN based on multi-dimensional network feature vectors according to claim 1, characterized in that: In step four, the overall matching degree between the service and the port is calculated using the following formula: In the formula, This represents the overall compatibility between the service and the port, with a value ranging from 0 to 1. The total number of matching dimensions; Let be the weight coefficient of the i-th matching dimension, satisfying ; The matching score for the i-th dimension ranges from 0 to 1. Candidate ports are sorted from highest to lowest based on their overall matching degree. The port ranked first is selected to generate a mapping rule, and a five-tuple conflict detection is performed to generate a conflict-free and valid mapping rule.

6. The method for dynamic port mapping of SD-WAN based on multi-dimensional network feature vectors according to claim 1, characterized in that: In step five, the port mapping rules are distributed to all edge gateway nodes in the network via incremental synchronization, and the local mapping tables of each node are updated; the encapsulation and adaptation of mapping packets are performed for IPsec encrypted tunnels, GRE tunnels, and VXLAN tunnels. When SD-WAN schedules and executes link switching, it automatically migrates port mapping rules to the target link to maintain consistency between internal and external network mappings, and performs port mapping validity verification synchronously during tunnel establishment.

7. The method for dynamic port mapping of SD-WAN based on multi-dimensional network feature vectors according to claim 1, characterized in that: In step six, multi-dimensional feature data of the link, port operation status data and service traffic data are collected at a preset period, and the quality degradation degree is calculated by comparing them with the corresponding baseline data. When the comprehensive characteristic score of the link is lower than the preset degradation threshold, the port availability drops to the level threshold, or the service transmission quality does not meet the requirements, the mapping optimization process is triggered to regenerate the mapping rules; a smooth transition method is adopted to complete the switch between the old and new mappings, first establishing a new mapping channel and verifying connectivity, then gradually migrating service traffic, and releasing the original port resources after the migration is completed.

8. The method for dynamic port mapping of SD-WAN based on multi-dimensional network feature vectors according to claim 1, characterized in that: In step seven, link connectivity, port response status and access behavior data are collected in real time through millisecond-level parallel detection. A sliding window statistical state filtering algorithm is used to distinguish three types of abnormal events: permanent faults, transient jitter, and port anomalies. Backup mapping paths and backup port resources are pre-configured. When a permanent fault or an unrecoverable port anomaly is detected, mapping rollback is triggered, and business traffic is switched to the backup path. The business connection status is maintained through a session table synchronization mechanism to ensure that existing TCP sessions and industrial protocol connections do not need to be re-established during the mapping migration process.

9. The method for dynamic port mapping of SD-WAN based on multi-dimensional network feature vectors according to claim 1, characterized in that: In step eight, the weight coefficients of the feature dimensions are iteratively updated. The weight update calculation formula is as follows: In the formula, Let be the weight of the i-th feature dimension after the t-th iteration; The weights are updated for the i-th feature dimension; The learning rate, with a value ranging from 0 to 1; represents the contribution deviation of the i-th feature dimension, with a value ranging from -1 to 1. It takes a negative value when the weight of a feature dimension is high but its contribution to the effect is low, and a positive value otherwise.

10. The updated feature weights are used for mapping decision calculation in the next cycle. At the same time, the identified business protocol fingerprints and link feature types are added to expand the protocol feature library and link feature library.

Images