52 results about "Campus network" patented technology

The invention discloses an industrial park virtual power plant reactive voltage control method of multi-target multi-agent deep reinforcement learning considering energy storage life, and belongs to the technical field of virtual power plant reactive voltage control methods based on industrial data acquisition. The problem that in the prior art, a traditional industrial park virtual power plant reactive voltage control method is difficult to consider park network loss optimization and energy storage life protection at the same time is solved. According to the method, a multi-objective optimization model including network loss minimization, node voltage deviation minimization and energy storage battery service life maximization is constructed, a virtual power plant is divided through a distributed multi-agent framework, each agent trains multiple strategies in parallel through a multi-objective multi-agent deep reinforcement learning algorithm based on local observation, the Pareto front is approached, and the energy storage battery service life is maximized. High-efficiency control is realized, and each intelligent agent independently generates an energy storage reactive power regulation and active power charging and discharging instruction. The reliability of the energy storage equipment is improved, and the method can be applied to an industrial park active power distribution network scene with high renewable energy source permeation.

The invention discloses a data forwarding processing method and system for a campus network, and the method comprises the steps: controlling a plurality of independent cameras to generate a multicast video stream carrying a permission identifier according to an access control terminal triggering event; the method comprises the following steps: synchronously creating (S, G) table entries with permission marks and never expired (*, G) table entries on a path multicast router according to a first video stream data packet received by a multicast source side designated router source DR; according to an IGMP join message which is sent by a receiver and carries a permission identifier, through a matching result of an RP comparison (*, G) table entry output interface permission and a multicast data permission identifier, whether a data stream is forwarded along a shared tree (RPT) is decided; and according to a matching result of the permission identifier of the new receiver and the pruned (S, G) flow permission, activating a pruning state on the multicast path and recovering data flow forwarding. According to the embodiment of the invention, occupation of invalid data streams on campus network bandwidth can be reduced, and the overall utilization rate of network resources is improved.

The invention relates to the technical field of electric digital data processing, and discloses an intelligent campus network security protection system. A network data acquisition module of the system continuously monitors data transmission flow of a smart campus network environment to obtain an original data packet; the chaotic encryption engine encrypts an original data packet by using a key stream based on dynamic chaotic mapping, wherein the key stream is generated by multi-chaotic system switching and a random parameter distribution mechanism; the security protocol processing module converts the encrypted data packet into a format conforming to a network security protocol standard and transmits the encrypted data packet; the data decryption unit decrypts the received encrypted data packet; the security threat analysis module identifies and estimates potential network attack behaviors according to the decrypted plaintext data; and the protection strategy controller generates and executes a network security protection instruction according to the threat analysis result. The system can effectively protect the network security of the smart campus, resist various network attacks, and ensure the security of data transmission and storage.

Disclosed herein are system, method, and computer program product aspects for providing an agent-based zero trust network access (ZTNA) remote device access to a campus network. Some aspects of this disclosure relate to a universal network access application including a memory and a processor. The processor is configured to receive an authentication request from a client device and in response to receiving the authentication request, retrieve a set of network policies indicating an Internet protocol (IP) address and a port number based on the authentication request. The processor is further configured to transmit the set of network policies to a policy enforcement application in a campus network.

This invention proposes a multi-energy coordinated regulation method and system for a comprehensive energy system in a park, relating to the field of energy management technology. It includes: constructing energy autonomous units and local energy balance equations, energy storage state update equations, and equipment power and energy boundary constraints; solving for the elastic net exchange power range of each autonomous unit under uncertain scenarios based on the equations and constraints, symmetrically shrinking the range and reporting it to the elastic coalition scheduling layer; constructing a clearing model at the elastic coalition scheduling layer based on the reported information, solving for the target net exchange power, reserve capacity allocation, and park network energy flow of each autonomous unit; distributing the solution results to the autonomous units, which then adjust equipment output according to priority and track it in real time; monitoring equipment status and renewable energy output deviations, triggering emergency degradation control when equipment failure or deviation exceeding a threshold is detected, reconstructing the model, and introducing a graded load reduction mechanism, thereby improving the stability, reliability, and regulation accuracy of the system operation.

The application discloses a campus network flow prediction method and system, relates to the technical field of flow prediction, and comprises the following steps: step one, historical flow analysis, step two, flow distribution and step three, flow scheduling. The flow information of each region in each time period in each historical preset period is analyzed, the total demand of the current period campus flow is predicted, the flow priority and the flow threshold of each region in each time period are obtained, the flow distribution of each region is carried out based on the flow priority of each region in each time period, the speed of each region in each time period is analyzed when the flow threshold is reached, the network management strategy is refined, the flow resource is dynamically adjusted, the network resource utilization is greatly improved, and finally, the flow of each region in each time period is scheduled, so that the on-demand distribution and dynamic optimization of the campus flow are ensured.

The present application relates to a kind of two-stage park network SSH reverse tunnel detection method and system, its method includes: S1: the original traffic collected is divided according to four tuples: {source ip, destination ip, source port number, destination port number}, and the original traffic with same four tuples is regarded as a flow;S2: one-stage SSH reverse tunnel detection based on rule matching, whether the flow contains SSH reverse tunnel is detected;S3: two-stage SSH reverse tunnel detection based on deep learning, after the flow is imaged, classification task is carried out using trained CNN model, whether the flow contains SSH reverse tunnel is judged;S4: the condition of flow containing SSH reverse tunnel obtained in step S2 and S3 is summarized, and detection result is output.The method provided by the present application can quickly and accurately detect the SSH reverse tunnel existing in park network.

The invention discloses a network encryption attack detection method based on dual-source flow diagram fusion, and the method comprises the steps: collecting IP-level data of campus network flow of a certain college, and carrying out the basic feature extraction of an original pcap flow packet; carrying out feature engineering on the extracted basic features, and carrying out malicious or benign preliminary screening through a random forest model; extracting IP node features and edge features from the benign traffic packets and the malicious traffic packets after preliminary screening; performing data processing on the extracted node features and edge features, and fusing the node features and the edge features into a graph; and executing real-time blocking through a firewall API according to the node malicious probability. According to the method, collaborative analysis is achieved through cross-graph fusion, ID conflicts are eliminated through a node offset mechanism to ensure topological fusion zero loss, the Markov edge features accurately capture an encrypted traffic behavior mode, the novel attack detection rate is improved by 46.5% compared with traditional single-graph modeling, and a brand new solution is provided for encryption threat detection.

The invention relates to the technical field of data information transmission, in particular to a network intrusion detection method and system based on a firewall, and the method comprises the steps: determining a network instability time period in an association time period of a current moment, and carrying out the detection of the network intrusion according to the condition of a user in an online state at each moment in the network instability time period and the unstable condition of the total flow of a campus network; determining a suspected intrusion time period, obtaining the abnormal behavior intensity of each user according to the active moment of each user in the suspected intrusion time period and the correlation between the user traffic of the active moment and the total traffic of the campus network, and further obtaining the network intrusion risk of the suspected intrusion time period; according to the network intrusion risk of each suspected intrusion time period in the associated time period, the degree of network intrusion threat received at the current moment is obtained, the possibility of misjudgment can be greatly reduced, and therefore the accuracy of a campus network intrusion detection result is improved.

The invention provides a campus network flow anomaly detection method based on a rule engine and a graph neural network, which comprises the following steps: acquiring original flow data of a campus network through a flow acquisition module, analyzing and extracting metadata information, and aggregating the metadata information into a flow record; the flow record is input to a rule engine module, flow is screened in real time through a rule set, and the rule set comprises rules predefined based on expert experience and rules generated based on a decision forest model; for the traffic which is not judged to be abnormal by the rule engine module, constructing a dynamic flow graph; inputting the dynamic flow graph into a dynamic graph neural network detection module, performing time sequence modeling and neighbor aggregation based on a memory vector of a node, and generating an abnormal score; and judging whether the flow is abnormal according to the abnormal score, and giving an alarm when the flow is judged to be abnormal. According to the scheme, through collaborative fusion of the rule engine and the dynamic graph neural network, efficient, accurate and adaptive campus network anomaly detection is realized, and the detection efficiency is effectively improved.

The invention belongs to the technical field of network communication, provides a hop count triggering-based CSIG telemetering method, network forwarding equipment and a network forwarding system, and aims to solve the technical defects of message expansion and overhigh overhead of an existing IFA in-band measurement scheme and incapability of realizing full-path panoramic acquisition of a native CSIG aggregation scheme. According to the method, specific processing logic is deployed in network forwarding equipment, a CSIG label telemetering message carrying a novel protocol identifier NEW TPID is identified, decreasing operation is carried out on a collection trigger counter TTC, and nodes are triggered according to the TTC value to collect telemetering data and write the telemetering data into a label. The method can be applied to path node state collection and congestion monitoring of a data center network and a park network, and the lightweight characteristic and the refined operation and maintenance requirement are both considered.

The application discloses a scripted dynamic scheduling system and method, a computer device and a storage medium. The system comprises a resource modeling module, which is responsible for resource modeling conforming to the ISA-95 standard, and maps an object model conforming to the ISA-95 standard into a data structure readable and writable by a script language based on reflection or binding technology; a script engine, which is used for executing scheduling algorithms and rule judgment; a data ferry module, which is used for transmitting scheduling script files as logical loads between a campus network and an industrial control network based on a network lock; a dynamic hot loading and non-inductive switching module, which is used for setting a file listener to monitor a specified directory, and when a new scheduling script file is detected through the file listener, a currently running script engine instance is destroyed and a new instance corresponding to the new scheduling script file and conforming to preset conditions is called when the next scheduling period comes, so that the service does not need to be restarted. The problems of long scheduling logic update period, high deployment cost and difficulty in responding to agile production in the prior art are solved.

The application discloses a privacy-enhanced campus network psychological data federated learning analysis method, and belongs to the field of network behavior data collection and privacy protection calculation. The method comprises the following steps: performing field white list projection, sensitive domain hard discarding, pseudo-anonymization and irreversible digest processing, and binning on each original network session collected in the campus network respectively to obtain a plurality of minimized event streams; performing semantic classification and feature extraction on each minimized event stream respectively to obtain a plurality of window statistical features; training a mental health assessment model based on the plurality of window statistical features, and generating a to-be-protected upload object of the i th round; and performing privacy protection processing on the to-be-protected upload object of the i th round to obtain a protected upload object of the i th round. The application can realize risk analysis and controlled uploading without outputting content load, reduce the risk of data leakage, and improve compliance controllability and credibility.

The present application relates to the technical field of campus network, and provides a method and device for roaming authentication exemption of campus network, which comprises the following steps: setting a roaming group for a terminal in an access cloud gateway in advance, each roaming group corresponding to a virtual ONU device; when receiving a first uplink message from a first terminal, judging whether the first terminal is an authenticated terminal in a roaming area of a first ONU device; if the first terminal is an authenticated terminal in the roaming area, encapsulating the second uplink message into a third uplink message recognizable by a wide area network according to the virtual ONU device related information in the roaming group to which the first ONU device belongs, and transmitting the third uplink message to the network. The present application sets a roaming group and a virtual ONU device, and generates WAN side information using the virtual ONU device related information, so that the whole roaming group appears to be only one ONU device to the outside, and further, repeated authentication is not needed, thus realizing roaming authentication exemption of campus network.

The invention relates to the technical field of network operation and maintenance, in particular to a network fault real-time predicting and positioning method based on multi-modal data fusion, which comprises the following steps of: acquiring multi-source network data such as performance, flow and logs, and forming a multi-modal data set through space-time alignment and feature fusion; dividing multiple operation scenes of the campus network by using density peak clustering, and training a scene-based normal behavior baseline of each network entity through VAE; then calculating the mahalanobis distance recognition anomaly of the real-time fusion feature and the baseline, and outputting the fault probability and type in combination with the LSTM; then constructing a causal graph by using a PC algorithm, and determining candidate root causes by Bayesian reasoning; and finally, learning a node attention weight by using the GAT, generating an interpretable report in combination with the LLaMA-2, and outputting a positioning result. According to the method, accurate campus network fault prediction and interpretable positioning are effectively realized.

The application provides a PON system supporting multi-level slices, an OLT device and an ONU device, and belongs to the technical field of communication. The system comprises an OLT device, an optical distribution network and an ONU device. The OLT device is decomposed into a vOLT management plane and a vOLT user plane through a virtual OLT technology. The OLT device is provided with a first-level network slice management module, and the ONU device is provided with a second-level network slice management module. The second-level network slice management module is used for dividing and managing the second-level network slice of the connected user terminal device. The network slice hierarchical capability is used for dividing the priority and network performance of each service in a large park network, solving the problems of single network slice division, insufficient granularity, inability to completely solve the problems of the concentration of various service types and different requirements, and realizing the intelligentization of the park network and reducing the deployment cost.

The present application relates to the technical field of data information transmission, and particularly relates to a network intrusion detection method and system based on a firewall, which comprises the following steps: determining a network unstable period in a relevant period at a current time, determining a suspected intrusion period according to the situation of users in an online state and the unstable situation of total traffic of a campus network in the network unstable period, obtaining the abnormal behavior intensity of each user according to the active time of each user in the suspected intrusion period and the correlation between the user traffic of the active time and the total traffic of the campus network, and then obtaining the network intrusion risk of the suspected intrusion period; and obtaining the network intrusion threat degree at the current time according to the network intrusion risk of each suspected intrusion period in the relevant period. The present application can greatly reduce the possibility of misjudgment, thereby improving the accuracy of the network intrusion detection result of the campus network.

The invention discloses a psychological health assessment method based on dynamic time sequence hypergraph representation learning, and belongs to the technical field of artificial intelligence and psychological health assessment. The method comprises the steps that according to campus network behavior data of a target student in an evaluation time period, a dynamic time sequence hypergraph of the target student is constructed, and the campus network behavior data comprises N pieces of access behavior data sorted according to timestamps; determining weight values of N hyperedges connecting a single time slice node, a single website category node and a single access strength node in the dynamic time sequence hypergraph, and updating initial features of each node in the dynamic time sequence hypergraph based on the weight values of the N hyperedges to obtain target features corresponding to each node; and determining rhythm characterization features and preference characterization features based on the updated dynamic time sequence hypergraph, and evaluating the mental health state of the target student according to the rhythm characterization features and the preference characterization features. The psychological health state of the student is objectively and effectively evaluated by analyzing the campus network behavior data of the student.

The invention provides a smart campus network security operation integrated protection method and system, and the method comprises the steps: collecting behavior data of terminal equipment, inputting the behavior data into a pre-constructed local risk scoring model, and generating a local risk score of each terminal equipment; performing privacy disturbance processing on the local risk score, and generating a risk situation map matrix according to region and role dimension aggregation; obtaining teaching rhythm vectors from an educational administration system, and converting the teaching rhythm vectors into strategy enhancement factors; calculating a strategy intervention score and matching a strategy template in combination with the risk situation map matrix and a strategy enhancement factor, and generating a strategy rule set; gathering the strategy rules into a structured instruction set, and adding an effective time constraint; and distributing the structured instruction set to terminal equipment for execution according to network equipment types and capability differences in the campus network. According to the invention, the safety operation efficiency and the strategy response precision in a smart campus network environment are obviously improved.

Disclosed herein are system, method, and computer program product aspects for providing packets from an agent-based zero trust network access (ZTNA) user device class of service in a campus network. Some aspects of this disclosure relate to a user equipment (UE) including a memory and a processor. The processor is configured to generate a packet that include a payload and an inner header and generate an encrypted packet by encrypting the packet. The processor is further configured to generate a combined packet based on the encrypted packet and an outer header. The outer header indicates a class of service corresponding to the packet. The processor is further configured to transmit the combined packet to a campus network via a secured tunnel.

The embodiment of the invention discloses a flow control method, a routing forwarding device, a storage medium and a program product, and belongs to the technical field of communication. In the embodiments of the present application, after a first routing forwarding device in a park network classifies and caches messages in traffic from a second routing forwarding device in an operator network to a plurality of queues, first packet loss information and second packet loss information are obtained, the first packet loss information is used for indicating packet loss conditions of the plurality of queues, and the second packet loss information is used for indicating packet loss conditions of the plurality of queues. The second packet loss information is used for indicating the packet loss condition at the second routing forwarding equipment. The queue speed limit of each queue is dynamically adjusted according to the first packet loss information and the second packet loss information, so that the queue speed limit corresponding to each queue can better conform to the real situation of the flow in the current network, and the flow control effect is improved. Compared with the method for configuring the queue speed limits of different queues only according to the signed bandwidth, the flow control method provided by the embodiment of the invention is higher in flexibility, so that the flow control effect is better.

A software-defined network (SDN) controller in a campus network environment for a dynamic virtual local area network (VLAN) is provided. The SDN controller may comprise: a transceiver including a communication circuit; a processor including a processing circuit; and a memory including a storage medium in which instructions are stored, wherein, when executed by the processor, the instructions can instruct the SDN controller to: receive, from an SDN switch, through the transceiver, an authentication request for a terminal connected to the SDN switch; respond to the success of authentication of the terminal in response to the authentication request; identify a VLAN; and transmit a VLAN configuration to the SDN switch through the at least one transceiver such that an uplink port of the SDN switch operates according to the VLAN corresponding to the terminal. The uplink port of the SDN switch can be used to connect with other SDN switches, routers or servers. The VLAN configuration can be used to configure the uplink port so that an Ethernet frame for the VLAN corresponding to the terminal passes therethrough.

This application discloses a service deployment method, device, and medium based on a campus network. The method includes: determining a network architecture for a preset area network within the campus; the network architecture includes either a Layer 2 network architecture or a Layer 3 network architecture; adding network devices to the network environment based on the network architecture to generate a network topology for the network environment; enabling the link discovery function of the Link Layer Discovery Protocol (LLDP) in the network topology to display the network topology; creating a service network to be deployed based on the network topology; obtaining service parameters uploaded by users; and configuring the network devices carried by the service network according to the service parameters when receiving a service deployment request. This method can improve the efficiency and accuracy of service deployment.

The specification provides a method and network device for dialing into a network, the method comprising: receiving a dial request sent by a user in a campus, and obtaining user key information from the dial request; initiating a dial request to an operator according to the dial request; receiving a dial result fed back by the operator according to the dial request; establishing a dial table item according to the user key information and the dial result; and managing the user to access the campus network and / or the operator network according to the dial table item. Through the method, the problem that the user cannot access the campus network in the case that the dial authentication fails due to the operator's arrears or other reasons in the scenario that the campus network BRAS serves as a dial device is solved.

Various embodiments of the teachings herein include a radio communication apparatus providing a locally defined campus network for an industrial environment. An example includes: a mobile entity with a radio unit to operate a radio frontend maintaining the campus network; and a plurality of network function nodes assigned to a shared infrastructure edge cloud, the mobile entity contributing computational resources for at least one of said plurality of network function nodes. The plurality of network function nodes includes a trajectory node to collect and track trajectory data of the mobile entity and a localizer node to use the trajectory data to identify locations to be covered by the locally defined campus network.

The application relates to the technical field of unmanned vehicle scheduling, in particular to a park networked unmanned vehicle dynamic scheduling planning method and system, which comprises the following steps: collecting dynamic obstacle data through a multi-source sensor and a V2X device to generate a four-dimensional passability graph, formulating avoidance strategy weights and optimizing multi-vehicle trajectories, combining edge nodes and cloud adjustment paths, and evaluating threat values to trigger a resident area reconstruction. The system comprises a perception module, a decision module, a storage module, a distribution module, a regulation and control module and a verification module, and an abnormality processing module is linked with a threat value change rate to optimize resource distribution. The application can dynamically adjust the avoidance strategy according to the threat value, improve scheduling accuracy and resource distribution accuracy, guarantee vehicle safety and reduce the task failure rate.

The invention discloses a network access security management system and a dynamic equipment behavior evaluation method, and belongs to the technical field of network security. The system aims at the problems that the behavior of a new access device of an intranet is difficult to assess accurately and the risk of an abnormal device cannot be controlled in real time: when the device is accessed, MAC, fingerprints, confidentiality levels and timestamps are verified through an authentication module, and information is stored in a shared database; the semi-supervised SVM model evaluates the equipment based on historical behaviors and real-time characteristics, and generates a risk integral (PRS); the PRS over-threshold device triggers isolation or permission adjustment. Internal communication adopts an encryption protocol, external access verifies authentication information and a PRS through an exit gateway, equipment with qualified authority accesses an external network through a VPN, and equipment with insufficient authority or overdue authority is isolated. And the system periodically calibrates the dynamic label, evaluates the threshold value and the PRS logic, and realizes long-term stable operation. The device behavior can be accurately evaluated, the risk is controlled, the internal and external network security is ensured, and the method is suitable for enterprise internal networks, campus networks, data centers and Internet of Things.

The embodiments of the present application belong to the technical field of communications. Disclosed are a traffic control method, a routing and forwarding device, a storage medium, and a program product. In the embodiments of the present application, a first routing and forwarding device in a campus network classifies messages in traffic from a second routing and forwarding device in a provider network and caches same into a plurality of queues, and then acquires first packet loss information and second packet loss information, wherein the first packet loss information is used for indicating the packet loss status of the plurality of queues, and the second packet loss information is used for indicating the packet loss status at the second routing and forwarding device. Queue rate limits for the queues are dynamically adjusted on the basis of the first packet loss information and the second packet loss information, such that the queue rate limits corresponding to the queues can be more in line with the real status of traffic in the current network, thereby improving the traffic control effect. Compared with a method in which queue speed limits for different queues are configured only on the basis of contracted bandwidths, the traffic control method provided in the embodiments of the present application has higher flexibility, and thus has a better traffic control effect.

The invention relates to the technical field of resource scheduling, and provides a VPN resource dynamic scheduling method and device based on a service strategy. The method comprises the following steps: establishing a logic sub-interface of a service server on a service switch, and determining a unique identifier of the sub-interface; allocating a unique NAI-IP address for terminal access, and establishing a mapping relationship among a real source MAC address of the terminal, the unique NAI-IP address and the unique identifier of the sub-interface; the access switch receives an original message from the terminal, and converts the original message into a standardized message by using the mapping relation; and sending the standardized message to the service switch so as to forward the standardized message to the service server. According to the invention, the problems that the campus network user cannot be accurately traced and positioned and the practicability is poor in a dual-network and dual-speed scene in the prior art are solved.