Cloud network traffic scheduling method, system, device, medium and product

Abstract

The application discloses a kind of cloud network traffic scheduling method, system, equipment, medium and product, the method is first obtained the network state characteristic data of current cloud network;Wherein, the network state characteristic data includes physical equipment characteristic data, service stream characteristic data and message microcosmic characteristic data, and physical topology graph, service topology graph and message graph are constructed based on the network state characteristic data, and multiple graph fusion features are generated, then the multiple graph fusion features are input to network traffic prediction model to carry out the event early warning and traffic prediction of multi-scene network;Wherein, the network traffic prediction model is weighted in the graph convolution coding process, and the space attention mechanism based on event driving is used to graph convolution aggregation;Finally, according to the event early warning result and traffic prediction result of different types, network self-healing action and traffic scheduling are executed.The application can improve network traffic prediction accuracy, network event real-time detection capability and network traffic scheduling efficiency.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a cloud network traffic scheduling method, system, device, medium and product. Background Technology

[0002] With the rapid development of cloud computing technology and the widespread adoption of artificial intelligence inference tasks, cloud networks need to simultaneously meet the low-latency requirements of time-sensitive services such as real-time video conferencing, online gaming, and financial transactions, as well as the capacity to handle large-scale bursts of traffic generated during AI training and inference. Meanwhile, the continuous expansion of private network scale, the increasing number of network devices, and the frequent changes in service topology in multi-tenant environments have dramatically increased the complexity of cloud network operations and maintenance. How to achieve accurate traffic prediction and automated scheduling in a dynamically changing cloud network environment has become a critical technical problem that cloud service providers urgently need to solve.

[0003] Currently, network traffic prediction technologies mainly include: traditional intelligent optimization algorithms, which predict future traffic trends by analyzing temporal patterns in historical traffic data; and machine learning and deep learning methods, which predict future traffic trends by learning the temporal and spatial correlations of historical traffic data. In recent years, graph neural networks (GNNs) have been gradually introduced into the field of network traffic prediction due to their powerful modeling capabilities for graph-structured data. Existing technical solutions include a Chinese patent with publication number CN117978670A, which discloses an SDN traffic prediction method based on graph neural networks. Its core idea is to integrate graph convolutional networks with gated convolutional units to capture the spatiotemporal correlations of SDN networks and construct a mutual information matrix to obtain the relational weight representation of traffic data.

[0004] However, this existing solution still has significant technical shortcomings. First, in terms of graph modeling, the solution only constructs a single graph model based on the topology of the SDN network. This makes it difficult for the model to comprehensively capture the state information and traffic characteristics of different layers of the cloud network, limiting the model's training performance and prediction accuracy. Second, regarding topology adaptability, the solution uses a static graph topology structure. The graph structure and edge weights remain fixed after model deployment, making it unable to adapt to the frequent topology changes in cloud networks. When the network topology changes, the model's prediction accuracy drops significantly, lacking real-time detection and online adaptation capabilities. Summary of the Invention

[0005] The purpose of this invention is to provide a cloud network traffic scheduling method, system, device, medium, and product to improve the accuracy of network traffic prediction, the real-time detection capability of network events, and the efficiency of network traffic scheduling.

[0006] To achieve the above objectives, the present invention provides a cloud network traffic scheduling method, comprising: Obtain network status characteristic data of the current cloud network; wherein, the network status characteristic data includes physical device characteristic data, service flow characteristic data, and packet micro-characteristic data; Based on the network state feature data, a physical topology map, a service topology map, and a packet map are constructed to generate multi-map fusion features; The multi-graph fusion features are input into a network traffic prediction model for event warning and traffic prediction in multi-scenario networks; wherein, in the graph convolutional encoding process, the network traffic prediction model uses an event-driven spatiotemporal attention mechanism to weight the graph convolutional aggregation. Based on the early warning results and traffic prediction results of different types of events, network self-healing actions and traffic scheduling are executed.

[0007] Optionally, after performing network self-healing actions and traffic scheduling based on different types of event warning results and traffic prediction results, the method further includes: The event warning results and traffic prediction results are compared and verified with real-time data; If the deviation between the event warning result and the actual event result exceeds a preset range, and / or the deviation between the traffic prediction result and the actual traffic result exceeds a preset threshold, then the network traffic prediction model is optimized based on the real-time data. Monitor the self-healing effect after the network self-healing action is executed. If the self-healing effect does not reach the preset effect, adjust the trigger threshold of the network self-healing action.

[0008] Optionally, the step of constructing a physical topology map, a service topology map, and a packet map based on the network state feature data, and generating multi-graph fusion features, includes: A physical topology graph is constructed based on the physical device feature data, with physical devices as nodes and communication links between physical devices as edges. A service topology graph is constructed based on the service flow feature data, with virtual machines as nodes and logical communication relationships between virtual machines as edges. A message graph is constructed based on the micro-feature data of the messages, with messages as nodes and the relationships between messages as edges. The physical topology graph, the service topology graph, and the message graph are subjected to graph convolutional encoding. The encoded graph features are then weighted and fused according to preset fusion weights to obtain multi-graph fusion features.

[0009] Optionally, the event-driven spatiotemporal attention mechanism includes an event-driven spatial attention mechanism and a multi-scale temporal attention mechanism; The event-driven spatial attention mechanism is used to correct the adjacency relationships and spatial aggregation weights between nodes in the graph structure according to the event type when a network event is detected. The multi-scale time attention mechanism is used to capture traffic time features of different granularities through multiple time scale factors and generate time aggregation weights. The event-driven spatiotemporal attention mechanism couples the spatial aggregation weights with the temporal aggregation weights and adjusts them according to the event time decay function to generate event-spatiotemporal fusion weights.

[0010] Optionally, the network event includes at least one of virtual machine migration events, cluster expansion events, and link failure events; The step of correcting the adjacency relationships and spatial aggregation weights between nodes in the graph structure based on event type includes: For the virtual machine migration event, update the node position label, add migration edges, and adjust edge weights; For the cluster expansion event, new nodes and business edges are added to the graph structure, and the initial aggregation weight of the new nodes is configured according to the importance of the business. For the link failure event, the edge corresponding to the failed link is marked as invalid, the edge corresponding to the backup link is activated, and the aggregation weight of the edge is increased.

[0011] Optionally, the multi-scale temporal attention mechanism is used to capture flow temporal features of different granularities through multiple time scale factors, including: For each time scale, historical cycle characteristics, expected trend characteristics, and unexpected instantaneous fluctuation characteristics are integrated to generate time characteristics for the corresponding time scale. The historical cycle feature is extracted based on the flow rate values ​​of multiple historical cycles prior to the current moment; the expected trend feature is extracted based on the flow rate value at the current moment and the preset trend intensity information; the unexpected instantaneous fluctuation feature is extracted by amplifying the remaining fluctuation component after removing the historical cycle component and trend component from the flow rate value at the current moment.

[0012] To achieve the above objectives, the present invention also provides a cloud network traffic scheduling system, comprising: The data acquisition module is used to acquire network status characteristic data of the current cloud network; wherein, the network status characteristic data includes physical device characteristic data, service flow characteristic data, and packet micro-characteristic data; The feature fusion module is used to construct a physical topology map, a service topology map, and a packet map based on the network state feature data, and generate multi-map fusion features; The network prediction module is used to input the multi-graph fusion features into the network traffic prediction model for event warning and traffic prediction in multi-scenario networks; wherein, in the graph convolutional encoding process, the network traffic prediction model adopts an event-driven spatiotemporal attention mechanism to weight the graph convolutional aggregation. The scheduling module is used to perform network self-healing actions and traffic scheduling based on different types of event warning results and traffic prediction results.

[0013] To achieve the above objectives, the present invention also provides a cloud network traffic scheduling device, comprising: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the cloud network traffic scheduling method as described above.

[0014] To achieve the above objectives, the present invention also provides a computer-readable storage medium storing a computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the cloud network traffic scheduling method described in any of the above embodiments.

[0015] To achieve the above objectives, the present invention also provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the cloud network traffic scheduling method as described in any of the above claims.

[0016] Compared to existing technologies, the cloud network traffic scheduling method, system, device, medium, and product provided in this invention simultaneously collects three types of network state feature data: physical devices, service flows, and packet micro-level data. It then constructs physical topology graphs, service topology graphs, and packet graphs in parallel and fuses them to obtain multi-graph fusion features, enabling multi-dimensional feature extraction and improving network traffic prediction accuracy. Furthermore, it introduces an event-driven spatiotemporal attention mechanism in the graph convolutional encoding stage to weight the graph convolutional aggregation features. The topology association weights are dynamically adjusted according to event-driven logic, making it adaptable to various topology change scenarios. Simultaneously, the method can match differentiated event warnings with traffic prediction results to execute corresponding network self-healing and traffic scheduling operations. This invention can effectively improve network traffic prediction accuracy, real-time network event detection capabilities, and network traffic scheduling efficiency. Attached Figure Description

[0017] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating a cloud network traffic scheduling method provided in an embodiment of the present invention; Figure 2 This is another flowchart illustrating a cloud network traffic scheduling method provided in an embodiment of the present invention; Figure 3 This is a structural block diagram of a cloud network traffic scheduling system provided in an embodiment of the present invention; Figure 4 This is a structural block diagram of a cloud network traffic scheduling device provided in an embodiment of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Because existing network traffic prediction technologies have limited graph modeling dimensions, insufficient feature extraction capabilities, poor network topology adaptability, and an inability to respond to dynamic network changes, the accuracy of traffic prediction and the real-time performance of scheduling are not high in dynamically changing cloud network environments. Therefore, this invention provides a cloud network traffic scheduling method.

[0021] See Figure 1 , Figure 1 This is a flowchart illustrating a cloud network traffic scheduling method provided in an embodiment of the present invention. The cloud network traffic scheduling method includes steps S1 to S4: S1. Obtain the network status characteristic data of the current cloud network; wherein, the network status characteristic data includes physical device characteristic data, service flow characteristic data, and packet micro-characteristic data; The causes of cloud network anomalies are located in different protocol layers and functional layers in the cloud network architecture, each with its own independent generation mechanism and manifestation. In the existing technology, it is impossible to fully cover all fault types with any one-dimensional or two-dimensional data. In order to ensure the coverage completeness of the early warning and the accuracy of root cause location, this embodiment of the invention obtains network status feature data in three dimensions, including physical device feature data, service flow feature data, and message micro-feature data.

[0022] It should be noted that cloud network scenarios involve Underlay and Overlay networks. Overlay is a logical network layer built on top of the existing physical network (Underlay).

[0023] The methods for acquiring physical device characteristic data include obtaining the topology map and communication link status information of underlay devices such as switches, routers, and programmable gateways from the physical topology management system; and obtaining the load status of host machines and physical servers from the computing node management platform.

[0024] The methods for obtaining service flow characteristic data include extracting the service traffic topology and service packet flow links of the overlay network from the SDN (Software-Defined Networking) controller, and obtaining the logical communication relationship between virtual machines in a multi-tenant environment.

[0025] It should be noted that a virtual machine refers to a virtual server instance in a cloud computing or virtualization environment. It is an independently usable computing unit that is partitioned from physical server resources after virtualization.

[0026] The methods for obtaining micro-feature data of messages include parsing information such as timestamp, packet length, protocol type, and TCP flags of messages through the traffic mirroring function of virtual switches, and extracting message quintuples and features such as throughput and latency.

[0027] In addition, historical network status data, fault tickets, abnormal alarm records and topology change logs can be obtained from the cloud network's operation and maintenance work order system and monitoring and alarm system to build a fault event knowledge base for subsequent event-driven attention mechanisms.

[0028] S2. Construct a physical topology map, a service topology map, and a packet map based on the network state feature data, and generate multi-map fusion features; S3. Input the multi-graph fusion features into the network traffic prediction model to perform event warning and traffic prediction for multi-scenario networks; wherein, in the graph convolutional encoding process, the network traffic prediction model uses an event-driven spatiotemporal attention mechanism to weight the graph convolutional aggregation. Therefore, in this embodiment of the invention, the network traffic prediction model is named ED-MG-STGCN (Enevt-DriverMulti-Graph Spatio-Temporal Graph Convolutional Networks) model.

[0029] S4. Based on the early warning results and traffic prediction results of different types of events, execute network self-healing actions and traffic scheduling.

[0030] Specifically, in step S4, the target network event type is first determined based on the event warning result and traffic prediction result; wherein, the target network event type includes attack events, resource overload events, link anomaly events, and service surge events, etc.; then, a corresponding self-healing strategy is matched according to the target network event type, and the self-healing action and traffic scheduling operation corresponding to the self-healing strategy are executed; the self-healing action and traffic scheduling operation include traffic scrubbing, elastic scaling, virtual machine hot migration, traffic shaping, and node hibernation or frequency reduction, etc.

[0031] This invention provides a cloud network traffic scheduling method that constructs three types of data—physical devices, service flows, and packet micro-level data—distributed across different protocol layers and with independent fault root causes, into three graph structures and merges them into a unified multi-graph feature. This provides the model with a complete perceptual view from the underlying hardware to the upper-layer services and then to packet behavior. At the same time, by introducing an event-driven spatiotemporal attention mechanism into the graph convolutional coding to dynamically weight the aggregation weights, the model can respond to topology changes in real time, identify periodic traffic patterns and sudden attack events. This can effectively improve the accuracy of network traffic prediction, the real-time detection capability of network events, and the efficiency of cloud network traffic scheduling and operation and maintenance.

[0032] In an optional embodiment, after step S4, the method further includes step S5, which includes S501 to S503: S501. Compare and verify the event warning results and traffic prediction results with real-time data; For example, after the self-healing action is executed, the prediction results output by the model are compared with the actual network status data collected in real time by the monitoring and alarm system in the actual application.

[0033] S502. If the deviation between the event warning result and the actual event result exceeds a preset range, and / or the deviation between the traffic prediction result and the actual traffic result exceeds a preset threshold, then the network traffic prediction model is optimized based on the real-time data. For example, the traffic prediction values ​​output by the model (such as the estimated traffic value within a future time window, the predicted link bandwidth utilization value, etc.) are compared with the actual traffic data collected by the monitoring system within the same time window, and the prediction error is calculated. If the deviation between the predicted value and the actual value exceeds a preset threshold (for example, the relative error exceeds 20%, or the root mean square error exceeds the 3σ range of the historical error distribution), it is determined that the model's ability to fit the current traffic pattern has decreased, triggering the subsequent model optimization process.

[0034] The model's output event warnings (such as DDoS attack warnings, link congestion warnings, node overload warnings, etc.) are compared with the actual alarm events reported by the monitoring system. The comparison dimensions include whether the warning type matches the actual event type—if the model warns of a certain type of event but it does not actually occur, it is a false alarm; if a certain type of event actually occurs but the model fails to warn, it is a missed alarm. When the missed alarm rate or false alarm rate exceeds a preset range (e.g., a missed alarm rate exceeding 5%), the model is also deemed to need optimization.

[0035] Furthermore, when the traffic prediction deviation is determined to exceed the preset threshold and / or the event warning deviation exceeds the preset range, the latest network data collected in real time is immediately introduced to incrementally optimize the parameters of the network traffic prediction model or trigger a phased retraining, so that the model can adapt to changes in network status as soon as possible.

[0036] Preferably, model optimization can be performed in an online learning mode, which involves updating the model parameters with gradients in a single or mini-batch manner using the latest data; alternatively, it can trigger an asynchronous model retraining task, which pushes the new model parameters to the inference service after completion in the background. The two methods can be flexibly selected according to the actual scenario.

[0037] S503. Monitor the self-healing effect after the network self-healing action is executed. If the self-healing effect does not reach the preset effect, adjust the trigger threshold of the network self-healing action.

[0038] In practice, the self-healing effect is continuously evaluated by observing network status indicators. Observation dimensions include whether link bandwidth utilization has returned to the normal range, whether packet loss rate has decreased, whether service traffic has recovered to the expected level, and whether related alarms have been cleared. If the fault is observed to have converged (i.e., the relevant network indicators have recovered to the preset normal range within a preset time window), the self-healing action is recorded as a valid operation, and the corresponding decision path is reinforced without manual intervention. If the fault is observed to have not converged (i.e., the relevant indicators remain abnormal or further deteriorate within a preset time window), the fault information and the current network status context are automatically pushed to the manual processing queue of the operations and maintenance personnel for manual diagnosis and handling.

[0039] After manual processing is completed, the processing experience is synchronized to the system for dynamically adjusting the trigger thresholds of various self-healing actions. For example, in a certain scenario, the trigger load threshold for virtual machine migration needs to be reduced from 70% to 60%. The adjusted threshold will take effect in subsequent self-healing decisions, allowing the self-healing strategy to be continuously optimized with the support of human experience.

[0040] It is worth noting that through the above steps, the model and self-healing strategy can continuously self-verify and self-optimize in each inference and scheduling cycle, thereby improving prediction accuracy and decision reliability.

[0041] In an optional embodiment, step S2 includes steps S201 to S204: It should be noted that cloud network scenarios, due to their involvement of Underlay and Overlay networks, multi-tenant traffic carrying, heterogeneous physical link devices, frequent changes in service topology, diverse traffic packet types, and frequent network attacks, place extremely high demands on the modeling of data center traffic characteristics. The modeling effect directly affects the training effect of neural networks and the accuracy of real-time traffic prediction. Based on this, this embodiment of the invention focuses on unfolding graph modeling for three types of core objects in the data center. First, physical devices such as switches, compute nodes, and programmable gateways, as well as complex links in the Underlay network; second, service carriers such as multi-tenant virtual machines and NFV (Network Functions Virtualization) network elements, as well as intertwined logical communication links in the Overlay network; and third, diverse packets and the relationships between packets.

[0042] S201. Construct a physical topology graph based on the physical device feature data, with physical devices as nodes and communication links between physical devices as edges. Specifically, after acquiring the physical device characteristic data, physical devices such as computing nodes, routers, and switches are used as nodes in the graph. The graph uses physical communication links between devices (such as compute nodes to switches, switches to programmable gateways) as edges. For any two physical devices i and j, if there is a physical link connecting them, then an edge is established between them. The characteristics of the edges include physical link latency, link bandwidth utilization, and link failure probability, and a physical device topology graph is constructed.

[0043] Among them, physical link latency is measured in real time through bidirectional forwarding detection (BFD) or network probing tools, reflecting the transmission delay of packets on the physical link; link bandwidth usage is calculated by the ratio of the current actual traffic on the link to the rated bandwidth of the link, reflecting the link load level; and link failure probability is obtained based on the historical failure records and equipment aging status statistics of the link, used to assess the risk of link failure in the future time window.

[0044] S202. Construct a service topology graph based on the service flow feature data, with virtual machines as nodes and logical communication relationships between virtual machines as edges. Specifically, the basic bearer unit (virtual machine) of user services is used as the node of the graph. For any two virtual machine nodes, if there is a service message exchange between them, an edge is established between them. The logical communication relationship between virtual machines (such as the interaction link between different virtual machines within the same tenant, the communication link from the user virtual machine to NFV network elements (such as firewalls and load balancers), and the cross-tenant communication link) is used as the edge. The characteristics of the edge include the packet loss rate of the flow, the directionality of the flow (one-way / two-way traffic ratio), and the growth rate of the flow (the growth rate of traffic per unit time). A service topology graph is constructed to depict the dynamics of network service traffic.

[0045] Among them, the packet loss rate of a flow is obtained by statistically analyzing the proportion of lost packets on the logical link to the total number of sent packets per unit time, reflecting the link quality; the flow growth rate is obtained by calculating the rate of change of traffic on the logical link per unit time, reflecting the changing trend of business activity; and the flow directionality is obtained by statistically analyzing the ratio of unidirectional traffic to bidirectional traffic, reflecting the business communication mode.

[0046] S203. Construct a message graph based on the message micro-feature data, with messages as nodes and the relationships between messages as edges. Specifically, a message graph is constructed using individual messages as nodes in a graph, and the relationships between messages (such as the interval between consecutive messages, the timing relationship of TCP flags, and the reassembly logic of fragmented messages) as edges. The characteristics of the edges include message timing interval, retransmission rate, type ratio, etc., to analyze the micro-behavioral patterns of traffic.

[0047] Among them, message timing interval: obtained by calculating the arrival time difference between adjacent messages, reflecting the rhythm and burstiness of traffic arrival; message retransmission rate: obtained by statistically analyzing the proportion of retransmitted messages to the total number of sent messages, reflecting network congestion or link quality status; message type ratio: obtained by statistically analyzing the proportion of messages of various protocol types, used to identify whether the traffic composition is abnormal.

[0048] S204. Perform graph convolutional encoding on the physical topology graph, the service topology graph, and the message graph, and then perform weighted fusion of the encoded graph features according to preset fusion weights to obtain multi-graph fusion features.

[0049] Specifically, based on the analysis of the physical device topology diagram, service topology diagram, and message diagram, they are defined as physical topology diagram models: ; in, A set of points representing a physical topology graph; The set of edges representing the physical topology graph; The Laplace matrix represents the physical topology graph.

[0050] Business topology diagram model: ; in, A set of points representing a physical topology graph; The set of edges representing the physical topology graph; The Laplace matrix represents the physical topology graph.

[0051] Message graph model: ; in, A set of points representing a physical topology graph; The set of edges representing the physical topology graph; The Laplace matrix represents the physical topology graph.

[0052] At the same time, define the characteristics of the physical topology graph: physical link latency. Link bandwidth utilization Link failure probability ; Define the characteristics of the business topology graph: packet loss rate of the flow. growth rate of flow Flow directionality ; Define the characteristics of a message graph: message timing interval Message retransmission rate Message type ratio .

[0053] Therefore, the physical link delay at time t for node i in the physical topology graph can be expressed as: Similarly, we can obtain the link bandwidth utilization rate. and link failure probability The packet loss rate of the flow at time t for node j in the business topology graph. Similarly, we can obtain the growth rate of the flow. With directionality The message timing interval of node k in the message graph at time t is: Similarly, we can deduce the message retransmission rate. and message type ratio .

[0054] Then, the three types of graphs are trained separately using graph neural network models based on their feature values. Each branch uses a graph convolutional network structure with the same number of layers, but the parameters are trained independently. The graph convolutional layers of each branch update the node features in the following way: For the l-th layer graph convolution, the node feature matrix of this branch is updated as follows: ; Where l represents the graph convolutional layer number; k represents the graph branch index; u represents the physical topology graph; o represents the service topology graph; and p represents the message graph. Let be the fusion coefficient of the k-th graph; This represents the initial node feature matrix of layer l; This represents the trainable weights of the l-th layer; It is a symmetric normalized adjacency matrix.

[0055] After multiple layers of graph convolution, each branch outputs the encoded graph-level feature vector. , , .

[0056] Subsequently, the encoded feature vectors output from the three branches are parametrically weighted and fused according to preset fusion weights. Specifically, for each dimension of each graph feature (such as link bandwidth utilization in the physical topology graph, flow growth rate in the service topology graph, and packet retransmission rate in the packet graph), corresponding trainable fusion weight parameters are configured. After the encoded features of all dimensions are weighted and summed, the fusion weights are normalized using the softmax function to obtain the multi-graph fusion features. .

[0057] The calculation method for the multi-graph fusion process can be represented as follows: .

[0058] in, The feature vector is the edge feature of a graph after graph convolution encoding. This is the trainable fusion weight parameter matrix corresponding to the edge features.

[0059] It should be noted that the multi-graph fusion in this step adopts a purely parametric linear fusion method and does not introduce the subsequent event-driven spatiotemporal attention mechanism. The event-driven spatiotemporal attention mechanism only takes effect during the graph convolutional encoding process in the subsequent step S3, and is not used in this fusion stage.

[0060] In one alternative embodiment, the event-driven spatiotemporal attention mechanism includes an event-driven spatial attention mechanism and a multi-scale temporal attention mechanism.

[0061] It should be noted that cloud network traffic follows the "Pareto Principle," meaning that 80% of the traffic is carried by 20% of the service types and links. There are significant regularities in its temporal and spatial topological dimensions, but traditional spatiotemporal attention mechanisms have limitations. Temporal attention only identifies key time points through weights, and spatial attention only captures static relationships between nodes, making them unsuitable for scenarios with frequent changes in cloud network topology and complex traffic patterns.

[0062] To this end, this invention presents an event-driven spatiotemporal attention model that dynamically adjusts spatial weights through an event-driven mechanism and combines multi-scale encoding to capture complex traffic features, thereby achieving accurate modeling of topological dynamics and traffic regularity.

[0063] 1. Regarding event-driven spatial attention mechanisms: The event-driven spatial attention mechanism is used to correct the adjacency relationships and spatial aggregation weights between nodes in the graph structure according to the event type when a network event is detected.

[0064] It should be noted that traditional spatial attention mechanisms only focus on the static relationships between nodes and ignore the impact of frequent changes in cloud network topology. Events such as virtual machine ordering / cancellation, cluster scaling up / down, and link failures will change the structure of the Underlay link and Overlay topology in real time, and the degree of impact of different events on the topology varies significantly (e.g., the impact range and duration of cluster scaling up and link failures are completely different).

[0065] In this embodiment of the invention, a core network event set is predefined. This includes at least virtual machine migration events. Cluster expansion events and link failure events Each event type has a corresponding topology correction method configured.

[0066] When any network event is detected by the monitoring system or SDN controller, the system triggers the corresponding correction action according to the event type, and corrects the adjacency relationship (adding / deleting nodes and edges, activating backup edges, etc.) and spatial aggregation weight between nodes in real time (increasing the weight of newly added or critical nodes, decreasing the weight of non-critical nodes, etc.) in the current branch graph structure, so that the graph structure changes from a static topology to a dynamic topology that responds to events.

[0067] Therefore, in one alternative embodiment, the network event includes at least one of virtual machine migration events, cluster expansion events, and link failure events; The step of correcting the adjacency relationships and spatial aggregation weights between nodes in the graph structure based on event type includes: For the virtual machine migration event, update the node position label, add migration edges, and adjust edge weights; For the cluster expansion event, new nodes and business edges are added to the graph structure, and the initial aggregation weight of the new nodes is configured according to the importance of the business. For the link failure event, the edge corresponding to the failed link is marked as invalid, the edge corresponding to the backup link is activated, and the aggregation weight of the edge is increased.

[0068] For example, embodiments of the present invention optimize spatial attention through the following mechanism: First, define the core event set. .

[0069] Each event corresponds to a specific topology adjustment strategy: Virtual machine migration event Update node position labels, add migration edges and dynamically adjust weights; Cluster expansion event Add new nodes and business edges, with initial weights adapted to business importance (e.g., live streaming business nodes are weighted higher than ordinary nodes). Link failure event Mark the faulty edge as invalid, activate the backup edge and increase its weight.

[0070] The spatial attention formula after the event-driven update is as follows: ; in, , is the false alarm rate, with a value range of [0.01, 0.1]. This is the node distance decay factor (the effect is more significant for events occurring closer to the node); This is a function representing the effect of event e on the connection between nodes i and j, and it depends on the actual event, such as a cluster expansion event: adding nodes and associated edges. ,in, For the number of new nodes, For the number of nodes before expansion, Variables of 0-1 This represents the business importance coefficient.

[0071] 2. On multi-scale temporal attention mechanisms The multi-scale time attention mechanism is used to capture traffic time features of different granularities through multiple time scale factors and generate time aggregation weights.

[0072] It should be noted that traffic characteristics in the time dimension exhibit a complex pattern of "coexistence of regularity and suddenness." For example, data backup and live streaming have fixed cycles (daily / weekly), while scenarios such as celebrity appearances have short-term bursts (minute-level), and anomalies such as DDoS attacks exhibit fluctuations that cannot be thresholded. Traditional time attention methods struggle to capture multi-scale features simultaneously, making it difficult to distinguish between live streaming peaks and sudden attacks. Therefore, this embodiment of the invention introduces multiple time scale factors to capture traffic time characteristics at different granularities, including minute-level, hour-level, day-level, and month-level. At each scale, feature representations of the corresponding granularity are extracted from the traffic data, and a time aggregation weight is generated for that scale. That is, time points with higher relevance to the current prediction time receive higher aggregation weights.

[0073] In one optional embodiment, the multi-scale temporal attention mechanism is used to capture traffic temporal features of different granularities through multiple time scale factors, including: For each time scale, historical cycle characteristics, expected trend characteristics, and unexpected instantaneous fluctuation characteristics are integrated to generate time characteristics for the corresponding time scale. The historical cycle feature is extracted based on the flow rate values ​​of multiple historical cycles prior to the current moment; the expected trend feature is extracted based on the flow rate value at the current moment and the preset trend intensity information; the unexpected instantaneous fluctuation feature is extracted by amplifying the remaining fluctuation component after removing the historical cycle component and trend component from the flow rate value at the current moment.

[0074] For example, embodiments of the present invention optimize temporal attention through the following mechanism: Introducing a scaling factor {minutes, hours, days, months}, satisfying Capture flow characteristics at different granularities: Short-term scale (minutes / hours): Focus on sudden surges in traffic (such as a sudden increase in traffic during a celebrity live stream); Long-term scale (days / months): Capturing periodic patterns (such as daily peaks during a live broadcast of a certain festival).

[0075] Integrating the three characteristics of "historical cycles + expected trends + unexpected fluctuations", the time-dimensional modeling formula can be expressed as: ; in, It is a historical periodic characteristic function. The period of scale m, and K is the number of historical periods; The expected trend characteristic function, This is the trend strength coefficient. This is the time decay factor; For unexpected instantaneous fluctuation characteristic function, These are historical cycle predictions. This is a predicted value based on the expected trend. It is a fluctuation amplification function.

[0076] Furthermore, the event-driven spatiotemporal attention mechanism couples the spatial aggregation weights with the temporal aggregation weights and adjusts them according to the event time decay function to generate event-spatiotemporal fusion weights.

[0077] The event time decay function controls the rate at which the influence of an event diminishes over time. Specifically, the closer an event is to the current moment, the greater its impact on the fusion weights; the farther away an event is, the smaller its impact becomes, until it decays to negligible levels. This design ensures that the model prioritizes recent events during inference, preventing outdated historical events from interfering with current traffic predictions.

[0078] For example, to achieve deep coupling between spatial topological dynamics and temporal flow characteristics, the event-spatiotemporal fusion formula is defined as follows: ; in, Let the decay function of event e at time t be: This ensures that the impact of events dynamically diminishes over time, preventing outdated events from interfering with current decisions.

[0079] It should be noted that the event-spatiotemporal fusion weight, as the neighborhood aggregation weight coefficient of the graph convolutional layer, is directly used to guide the aggregation of neighbor node features during the graph convolution process. The higher the fusion weight of a neighbor node, the greater its contribution to the aggregation.

[0080] It is worth noting that this optional embodiment, through the collaborative work of spatial attention and temporal attention, enables the model's encoding and aggregation process to simultaneously perceive the spatial dynamic changes of the topology and the multi-scale traffic patterns in the temporal dimension, thereby improving the model's adaptability and prediction accuracy to complex cloud network scenarios.

[0081] In summary, see Figure 2 , Figure 2 This is another flowchart of a cloud network traffic scheduling method provided in an embodiment of the present invention. For example... Figure 2 As shown, the system first aggregates data from physical topology management, SDN controllers, traffic mirroring, and operations and maintenance (O&M) ticketing systems. Topology graphs, traffic states, packet characteristics, and event knowledge bases are extracted from these sources. Multi-graph fusion features are then generated based on this information, and the network traffic prediction model (ED-MG-STGCN model) performs inference to output event alerts and traffic prediction results. Different self-healing actions are then executed based on different events (including virtual machine hot migration, traffic scrubbing, traffic shaping, elastic scaling, or node hibernation). After execution, the system continuously monitors whether the fault has converged. If it hasn't converged or the system determines that manual intervention is required, the case is transferred to O&M personnel. The experience gained from manual handling is also recorded and used to adjust subsequent trigger thresholds and achieve alarm convergence. Simultaneously, the business topology changes caused by the entire process are fed back to the monitoring and alarm system and the model training phase. The discrepancy between the model prediction results and the actual monitoring data is also fed back for model optimization, forming a closed loop.

[0082] The following example, using a live-streaming scenario of an e-commerce festival gala, illustrates the cloud network traffic scheduling method provided in this embodiment of the invention, in order to fully demonstrate the technical effects of the invention.

[0083] For example, during the live broadcast of the festival gala, cloud network traffic exhibits a typical time pattern of "gradual warm-up in the early stage - surge during the prime time - sudden peak (such as when a celebrity appears) - decline in the later stage". It may also be accompanied by abnormal traffic such as DDoS attacks, and the cloud platform needs to dynamically scale up and down the virtual machine cluster according to the real-time traffic.

[0084] First, network status characteristic data of the current cloud network is collected through multiple sources. For example, the physical topology management system collects topology and link status data of underlay physical devices such as core switches, live streaming servers, and CDN nodes in real time, including physical link latency, link bandwidth utilization, and link failure probability. The SDN controller tracks the overlay service traffic topology and logical link characteristics between user virtual machines and live streaming service network elements (such as load balancers and live streaming media servers), including packet loss rate, flow growth rate, and flow directionality. The traffic mirroring function of the virtual switch is used to analyze the micro-characteristics of live streaming data stream packets, extracting information such as packet timestamps, packet length, protocol type, and TCP flags, and calculating characteristics such as packet timing interval, packet retransmission rate, and packet type ratio.

[0085] In addition, the system also obtains link load data, fault records and alarm logs from the operation and maintenance work order system for the same period of a certain holiday in history, and builds an event knowledge base to provide historical reference for subsequent event-driven attention mechanisms.

[0086] Then, based on the collected multi-source data, three types of graph structures are constructed respectively: A physical topology graph is constructed using physical devices such as core switches, live streaming servers, and CDN nodes as nodes, physical links between devices as edges, and physical link latency, link bandwidth utilization, and link failure probability as edge features. A service topology graph is constructed using user virtual machines and live streaming service network elements as nodes, logical communication relationships between nodes as edges, and packet loss rate, flow growth rate, and flow directionality as edge features. A packet graph is constructed using each packet in the live streaming data stream as a node, timing relationships and fragmentation / reassembly relationships between packets as edges, and packet timing interval, packet retransmission rate, and packet type ratio as edge features.

[0087] Graph convolutional encoding is performed on the three types of graph structures respectively. The encoded graph features are then parametrically weighted and fused according to preset fusion weights. After parameter normalization, multi-graph fusion features are generated and used as input for subsequent models.

[0088] Furthermore, the multi-graph fusion features are input into the network traffic prediction model for inference. During the graph convolutional encoding process, the model employs an event-driven spatiotemporal attention mechanism to dynamically weight the graph convolutional aggregation.

[0089] The following scenarios may be involved in the model inference stage: 1. When live stream traffic enters the preheating phase, if the growth rate of the flow in the business topology graph exceeds a preset threshold (e.g., the growth rate exceeds 20% for 5 consecutive minutes), it is determined that the upcoming traffic peak requires more computing resources, triggering a "cluster expansion" event. At this time, the event-driven spatial attention mechanism is activated. Virtual machine nodes and corresponding physical-virtual association links are added to the physical topology graph, and the adjacency relationships in the graph structure are updated synchronously. The initial spatial aggregation weight of the newly added nodes is configured to be higher than that of ordinary nodes, so that during graph convolutional aggregation, the model gives greater attention to the traffic characteristics carried by the newly added nodes, accelerating the state convergence of the newly expanded resources.

[0090] At the same time, priority is given to ensuring bandwidth resources for core live streaming links, while the spatial aggregation weight of non-critical links is dynamically suppressed to achieve resource allocation and ensure priority scheduling of critical business links.

[0091] 2. When the evening's entertainment enters prime time or a celebrity's sudden appearance causes a significant surge in traffic, a "sudden traffic surge" event is triggered. The minute-level scale factor weight in the multi-scale time attention mechanism is increased to focus on capturing instantaneous traffic peaks, making the model more sensitive to second- or minute-level traffic spikes. Simultaneously, the multi-scale time attention mechanism correlates with historical link load data from the same period of a certain holiday on a "day" scale, correlates with periodic traffic patterns during prime time on an "hour" scale, and focuses on the instantaneous surge during the celebrity's appearance on a "minute" scale. The synergistic effect of these three scales amplifies the attention weight of the celebrity's appearance time in the time dimension, enabling the model to prioritize traffic scheduling needs during that time and reserve bandwidth resources in advance.

[0092] 3. If abnormal traffic resembling a DDoS attack occurs during the live stream, and the proportion of abnormal type packets (such as the proportion of SYN Flood packets) in the packet graph suddenly increases, while the link bandwidth utilization in the physical topology graph suddenly rises to near the upper limit, then the "abnormal traffic" event is triggered.

[0093] At this point, the model superimposes event-driven spatial aggregation weights (reflecting the propagation path and impact range of attack traffic in the topology) with multi-scale temporal aggregation weights (reflecting the burst characteristics of attack traffic in the time dimension), and also superimposes the product of the impact intensity coefficient of large-volume attack events and the event time decay function. After processing by the activation function, an event-spatiotemporal fusion weight is generated. This fusion weight is directly used as the neighborhood aggregation weight coefficient of the graph convolutional layer, meaning that nodes on the attack path receive higher aggregation weights. This allows the model to quickly focus on the attack source and affected links during encoding, triggering traffic scrubbing strategies and directing attack traffic to the scrubbing center for filtering, ensuring the operation of normal live streaming services.

[0094] 4. After the live stream ends, if the growth rate of the flow in the business topology graph continues to decline to a low level, a "cluster scaling down" event will be triggered. The event time decay function makes the influence of this event on subsequent model inference decay rapidly over time. That is, several hours after the scaling down event occurs, its contribution to the neighborhood aggregation weight coefficient has decayed to a negligible level, avoiding outdated scaling down information from interfering with traffic prediction during subsequent normal periods.

[0095] Finally, based on the event warning and traffic prediction results output by the model, corresponding self-healing actions are executed. For example, for a "cluster expansion" event, elastic expansion is performed, adding virtual machine instances to the business cluster; for a "sudden traffic" event, bandwidth protection and priority scheduling strategies are implemented; and for an "abnormal traffic" event, traffic scrubbing strategies are executed. All business topology changes caused by the processing results are fed back to the model training stage in real time, and new data is periodically introduced to retrain and optimize the model, completing the iterative optimization closed-loop process.

[0096] It is worth noting that the embodiments of the present invention comprehensively perceive the network state from three dimensions—physical layer, service layer, and message layer—through three types of graph structures, respectively. This ensures that different types of events can be effectively captured by the corresponding graph structures, avoiding the perception blind spots caused by single-dimensional data. The event-spatiotemporal fusion weights unify spatial and temporal dynamics into neighborhood aggregation coefficients of the graph convolutional layer, allowing the attention mechanism to take effect directly within the encoding aggregation, rather than post-weighting the branch output. This enables dynamic information in both spatial and temporal dimensions to simultaneously guide feature aggregation in the same graph convolutional operation. The feedback iteration mechanism continuously transmits the model's prediction bias and self-healing effect back and triggers model optimization, giving the entire system the ability to continuously evolve. This avoids the shortcomings of traditional solutions where models and strategies are fixed once deployed and cannot be continuously optimized with network dynamic changes.

[0097] See Figure 3 , Figure 3 This is a structural block diagram of a cloud network traffic scheduling system provided in an embodiment of the present invention. The cloud network traffic scheduling system includes: The data acquisition module 21 is used to acquire network status characteristic data of the current cloud network; wherein, the network status characteristic data includes physical device characteristic data, service flow characteristic data, and packet micro-characteristic data; Feature fusion module 22 is used to construct physical topology map, service topology map and packet map based on the network state feature data, and generate multi-map fusion features; The network prediction module 23 is used to input the multi-graph fusion features into the network traffic prediction model for event warning and traffic prediction in multi-scenario networks; wherein, in the graph convolutional encoding process, the network traffic prediction model adopts an event-driven spatiotemporal attention mechanism to weight the graph convolutional aggregation. The scheduling module 24 is used to perform network self-healing actions and traffic scheduling based on different types of event warning results and traffic prediction results.

[0098] In one optional embodiment, the cloud network traffic scheduling system further includes a feedback optimization module, used for: The event warning results and traffic prediction results are compared and verified with real-time data; If the deviation between the event warning result and the actual event result exceeds a preset range, and / or the deviation between the traffic prediction result and the actual traffic result exceeds a preset threshold, then the network traffic prediction model is optimized based on the real-time data. Monitor the self-healing effect after the network self-healing action is executed. If the self-healing effect does not reach the preset effect, adjust the trigger threshold of the network self-healing action.

[0099] In one alternative embodiment, the feature fusion module 22 is configured to: A physical topology graph is constructed based on the physical device feature data, with physical devices as nodes and communication links between physical devices as edges. A service topology graph is constructed based on the service flow feature data, with virtual machines as nodes and logical communication relationships between virtual machines as edges. A message graph is constructed based on the micro-feature data of the messages, with messages as nodes and the relationships between messages as edges. The physical topology graph, the service topology graph, and the message graph are subjected to graph convolutional encoding. The encoded graph features are then weighted and fused according to preset fusion weights to obtain multi-graph fusion features.

[0100] In one optional embodiment, the event-driven spatiotemporal attention mechanism includes an event-driven spatial attention mechanism and a multi-scale temporal attention mechanism; The event-driven spatial attention mechanism is used to correct the adjacency relationships and spatial aggregation weights between nodes in the graph structure according to the event type when a network event is detected. The multi-scale time attention mechanism is used to capture traffic time features of different granularities through multiple time scale factors and generate time aggregation weights. The event-driven spatiotemporal attention mechanism couples the spatial aggregation weights with the temporal aggregation weights and adjusts them according to the event time decay function to generate event-spatiotemporal fusion weights.

[0101] In one optional embodiment, the network event includes at least one of virtual machine migration events, cluster expansion events, and link failure events; The step of correcting the adjacency relationships and spatial aggregation weights between nodes in the graph structure based on event type includes: For the virtual machine migration event, update the node position label, add migration edges, and adjust edge weights; For the cluster expansion event, new nodes and business edges are added to the graph structure, and the initial aggregation weight of the new nodes is configured according to the importance of the business. For the link failure event, the edge corresponding to the failed link is marked as invalid, the edge corresponding to the backup link is activated, and the aggregation weight of the edge is increased.

[0102] In one optional embodiment, the multi-scale temporal attention mechanism is used to capture traffic temporal features of different granularities through multiple time scale factors, including: For each time scale, historical cycle characteristics, expected trend characteristics, and unexpected instantaneous fluctuation characteristics are integrated to generate time characteristics for the corresponding time scale. The historical cycle feature is extracted based on the flow rate values ​​of multiple historical cycles prior to the current moment; the expected trend feature is extracted based on the flow rate value at the current moment and the preset trend intensity information; the unexpected instantaneous fluctuation feature is extracted by amplifying the remaining fluctuation component after removing the historical cycle component and trend component from the flow rate value at the current moment.

[0103] It should be noted that the cloud network traffic scheduling system provided in this embodiment of the invention is used to execute all the process steps of the cloud network traffic scheduling method in the above embodiment. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.

[0104] See Figure 4 , Figure 4 This is a structural block diagram of a cloud network traffic scheduling device provided in an embodiment of the present invention. The cloud network traffic scheduling device includes a processor 31, a memory 32, and a computer program stored in the memory 32 and executable on the processor 31. When the processor 31 executes the computer program, it implements the steps in the various cloud network traffic scheduling method embodiments described above, for example...

[0105] For example, the computer program can be divided into one or more modules / units, which are stored in the memory 32 and executed by the processor 31 to complete the present invention. The one or more modules / units can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the cloud network traffic scheduling device.

[0106] The cloud network traffic scheduling device may include, but is not limited to, a processor 31 and a memory 32. Those skilled in the art will understand that the schematic diagram is merely an example of a cloud network traffic scheduling device and does not constitute a limitation on the device. It may include more or fewer components than illustrated, or combine certain components, or use different components. For example, the cloud network traffic scheduling device may also include input / output devices, network access devices, buses, etc.

[0107] The processor 31 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 31 is the control center of the cloud network traffic scheduling device, connecting various parts of the entire cloud network traffic scheduling device through various interfaces and lines.

[0108] The memory 32 can be used to store the computer programs and / or modules. The processor 31 implements various functions of the cloud network traffic scheduling device by running or executing the computer programs and / or modules stored in the memory 32 and calling the data stored in the memory 32. The memory 32 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 32 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0109] If the modules / units integrated into the cloud network traffic scheduling device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 31, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0110] Furthermore, embodiments of the present invention also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the cloud network traffic scheduling method as described in any of the above embodiments.

[0111] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A cloud network traffic scheduling method, characterized in that, include: Obtain network status characteristic data of the current cloud network; wherein, the network status characteristic data includes physical device characteristic data, service flow characteristic data, and packet micro-characteristic data; Based on the network state feature data, a physical topology map, a service topology map, and a packet map are constructed to generate multi-map fusion features; The multi-graph fusion features are input into a network traffic prediction model for event warning and traffic prediction in multi-scenario networks; wherein, in the graph convolutional encoding process, the network traffic prediction model uses an event-driven spatiotemporal attention mechanism to weight the graph convolutional aggregation. Based on the early warning results and traffic prediction results of different types of events, network self-healing actions and traffic scheduling are executed.

2. The cloud network traffic scheduling method as described in claim 1, characterized in that, After performing network self-healing actions and traffic scheduling based on different types of event warning results and traffic prediction results, the following is also included: The event warning results and traffic prediction results are compared and verified with real-time data; If the deviation between the event warning result and the actual event result exceeds a preset range, and / or the deviation between the traffic prediction result and the actual traffic result exceeds a preset threshold, then the network traffic prediction model is optimized based on the real-time data. Monitor the self-healing effect after the network self-healing action is executed. If the self-healing effect does not reach the preset effect, adjust the trigger threshold of the network self-healing action.

3. The cloud network traffic scheduling method as described in claim 1, characterized in that, The process of constructing physical topology graphs, service topology graphs, and packet graphs based on the network state feature data, and generating multi-graph fusion features, includes: A physical topology graph is constructed based on the physical device feature data, with physical devices as nodes and communication links between physical devices as edges. A service topology graph is constructed based on the service flow feature data, with virtual machines as nodes and logical communication relationships between virtual machines as edges. A message graph is constructed based on the micro-feature data of the messages, with messages as nodes and the relationships between messages as edges. The physical topology graph, the service topology graph, and the message graph are subjected to graph convolutional encoding. The encoded graph features are then weighted and fused according to preset fusion weights to obtain multi-graph fusion features.

4. The cloud network traffic scheduling method as described in claim 1, characterized in that, The event-driven spatiotemporal attention mechanism includes an event-driven spatial attention mechanism and a multi-scale temporal attention mechanism; The event-driven spatial attention mechanism is used to correct the adjacency relationships and spatial aggregation weights between nodes in the graph structure according to the event type when a network event is detected. The multi-scale time attention mechanism is used to capture traffic time features of different granularities through multiple time scale factors and generate time aggregation weights. The event-driven spatiotemporal attention mechanism couples the spatial aggregation weights with the temporal aggregation weights and adjusts them according to the event time decay function to generate event-spatiotemporal fusion weights.

5. The cloud network traffic scheduling method as described in claim 4, characterized in that, The network events include at least one of virtual machine migration events, cluster expansion events, and link failure events; The step of correcting the adjacency relationships and spatial aggregation weights between nodes in the graph structure based on event type includes: For the virtual machine migration event, update the node position label, add migration edges, and adjust edge weights; For the cluster expansion event, new nodes and business edges are added to the graph structure, and the initial aggregation weight of the new nodes is configured according to the importance of the business. For the link failure event, the edge corresponding to the failed link is marked as invalid, the edge corresponding to the backup link is activated, and the aggregation weight of the edge is increased.

6. The cloud network traffic scheduling method as described in claim 4, characterized in that, The multi-scale temporal attention mechanism is used to capture flow temporal features of different granularities through multiple temporal scale factors, including: For each time scale, historical cycle characteristics, expected trend characteristics, and unexpected instantaneous fluctuation characteristics are integrated to generate time characteristics for the corresponding time scale. The historical cycle feature is extracted based on the flow rate values ​​of multiple historical cycles prior to the current moment; the expected trend feature is extracted based on the flow rate value at the current moment and the preset trend intensity information; the unexpected instantaneous fluctuation feature is extracted by amplifying the remaining fluctuation component after removing the historical cycle component and trend component from the flow rate value at the current moment.

7. A cloud network traffic scheduling system, characterized in that, include: The data acquisition module is used to acquire network status characteristic data of the current cloud network; wherein, the network status characteristic data includes physical device characteristic data, service flow characteristic data, and packet micro-characteristic data; The feature fusion module is used to construct a physical topology map, a service topology map, and a packet map based on the network state feature data, and generate multi-map fusion features; The network prediction module is used to input the multi-graph fusion features into the network traffic prediction model for event warning and traffic prediction in multi-scenario networks; wherein, in the graph convolutional encoding process, the network traffic prediction model adopts an event-driven spatiotemporal attention mechanism to weight the graph convolutional aggregation. The scheduling module is used to perform network self-healing actions and traffic scheduling based on different types of event warning results and traffic prediction results.

8. A cloud network traffic scheduling device, characterized in that, include: A processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the cloud network traffic scheduling method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the cloud network traffic scheduling method as described in any one of claims 1 to 6.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the cloud network traffic scheduling method as described in any one of claims 1 to 6.

Images