WO2019205282A1 - Sdn-based network management control method, device, and computer readable storage medium - Google Patents

Abstract

Provided are an SDN-based network management control method, a device, and a computer readable storage medium. The method comprises: inputting a historical data flow anomaly into an AI engine to perform model training of a deep learning model, and generating a diagnostic model, wherein the historical data flow anomaly is data identified as being associated with malicious attack behavior in an SDN; deploying the diagnostic model in an SDN cloud network controller; the SDN cloud network controller identifying, according to the diagnostic model, a data flow acquired in real time, and acquiring a data anomaly identification result; and the SDN cloud network controller intercepting, according to the data anomaly identification result, malicious attack data in the data flow acquired in real time that belongs to a data flow anomaly. The above method incorporates artificial intelligence and enables highly efficient diagnosis and automatic interception of malicious attacks on an SDN, thereby realizing autonomous monitoring of SDNs, improving efficiency of network operations and maintenance, and reducing operational costs of networks.

Description

Network management and control method, device and computer readable storage medium based on SDN network Technical field

The present invention relates to the field of SDN network technologies, and in particular, to a network management and control method, apparatus and computer readable storage medium based on an SDN network.

Background technique

SDN network, or Software Defined Network (SDN), is a new network innovation architecture of Emulex network. It is an implementation of network virtualization. Its core technology, OpenFlow, separates the control plane of the network device from the data plane. In order to achieve flexible control of network traffic, the network becomes more intelligent as a pipeline.

However, with the gradual deepening of ICT industry chain architecture integration, the acceleration of network cloud reconfiguration transformation and the evolution of more new systems and technologies, there will be more and more pressures and challenges in network operation and maintenance, how to effectively diagnose It also automatically intercepts malicious attacks on the SDN network, improves the efficiency of network operation and maintenance, and reduces the operation and maintenance costs of the network. The self-monitoring of the SDN network has become a technical problem to be solved by those skilled in the art.

Summary of the invention

The object of the present invention is to provide a network management and control method, device and computer readable storage medium based on SDN network, and combine artificial intelligence to realize efficient diagnosis and automatically intercept malicious attacks on SDN network, realize self-monitoring of SDN network, and simultaneously improve The efficiency of network operation and maintenance reduces the operation and maintenance cost of the network.

The embodiment of the invention provides a network management and control method based on an SDN network, including:

The historical abnormal data stream is input into the AI engine to perform model training on the deep learning model to generate a diagnostic model; wherein the historical abnormal data stream is data that is determined to have malicious attack behavior in the SDN network;

Deploying the diagnostic model to a SDN cloud network controller;

The SDN cloud network controller identifies the data stream collected in real time according to the diagnosis model, and obtains an abnormal data identification result;

The SDN cloud network controller intercepts the malicious attack data belonging to the abnormal data stream in the real-time collected data stream according to the abnormal data identification result.

Preferably, the SDN network-based network management method further includes:

The SDN cloud network controller sends the malicious attack data intercepted in the set time period to the AI engine;

The AI engine re-trains the diagnosis model according to the malicious attack data intercepted in the set time period, and obtains an iteratively optimized diagnosis model;

The iteratively optimized diagnostic model is updated to the SDN cloud controller.

Preferably, the SDN cloud network controller intercepts the malicious attack data belonging to the abnormal data stream in the real-time collected data stream according to the abnormal data identification result, and specifically includes:

The SDN cloud network controller generates an interception flow table according to the abnormal data identification result, and sends the intercept flow table to each switch; wherein the intercept flow table includes an address of the attacking host, an address of the destination host, and a malicious Attack data;

When the data stream that is collected in real time includes data corresponding to any one of the interception flow tables, the malicious attack data in the real-time collected data stream is intercepted.

Preferably, the historical abnormal data stream is input into the AI engine to perform model training on the deep learning model to generate a diagnostic model; wherein the historical abnormal data stream is data that is determined to have malicious attack behavior in the SDN network, specifically include:

Performing data cleaning and pre-processing on the historical abnormal data stream to generate standardized data samples and storing the data in the acceleration storage module;

The AI engine acquires the data samples from the acceleration storage module for feature mining to obtain feature information;

Modeling the deep learning model with the feature information to generate the diagnostic model.

Preferably, the deep learning model is trained by using the feature information to generate the diagnostic model, and specifically includes:

Entering the feature information into the deep learning model for model training, generating a diagnosis rule, and storing the diagnosis rule in a preset diagnosis rule database; wherein the diagnosis rule includes a mapping relationship of the feature information;

Root cause analysis is performed on the diagnosis rule to generate the diagnosis model.

Preferably, the pre-processing comprises one or more of the following processes: missing value processing, feature discretization processing, feature combination processing, feature selection processing.

Preferably, the deep learning model comprises one or more of the following deep learning algorithms: Spark ML algorithm, MLlib algorithm, deeplearning 4j algorithm, TensorFlow algorithm, Caffe algorithm, CNTK algorithm, Theano algorithm, Torch algorithm, association algorithm and classification algorithm.

The embodiment of the invention further provides a network management device based on an SDN network, comprising:

a diagnostic model generating module, configured to input a historical abnormal data stream into the AI engine to perform model training on the deep learning model, and generate a diagnostic model; wherein the historical abnormal data stream is data that is determined to have malicious attack behavior in the SDN network. ;

a model deployment module, configured to deploy the diagnostic model to a SDN cloud network controller;

The SDN cloud network controller is configured to identify a data stream collected in real time according to the diagnosis model, and obtain an abnormal data identification result;

The SDN cloud network controller is configured to intercept, according to the abnormal data identification result, malicious attack data belonging to the abnormal data stream in the real-time collected data stream.

An embodiment of the present invention further provides a network management device based on an SDN network, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, the processor executing the The computer program implements the SDN network-based network management method as described above.

The embodiment of the present invention further provides a computer readable storage medium, the computer readable storage medium comprising a stored computer program, wherein, when the computer program is running, controlling a device where the computer readable storage medium is executed is performed as described above Network management and control method based on SDN network.

Compared with the prior art, the network management and control method based on the SDN network provided by the embodiment of the present invention has the beneficial effects that: the network management and control method based on the SDN network includes: inputting a historical abnormal data stream into the AI engine to the depth The learning model performs model training to generate a diagnostic model; wherein the historical abnormal data stream is data that is determined to have malicious attack behavior in the SDN network; the diagnostic model is deployed to the SDN cloud network controller; the SDN cloud The network controller identifies the data stream collected in real time according to the diagnosis model, and obtains an abnormal data identification result; the SDN cloud network controller intercepts the real-time collected data stream according to the abnormal data identification result Malicious attack data for anomalous data streams. The above method combined with artificial intelligence can realize efficient diagnosis and automatically intercept malicious attacks on the SDN network, realize self-monitoring of the SDN network, improve the efficiency of network operation and maintenance, and reduce the operation and maintenance cost of the network. The embodiment of the invention further provides a network management device and a computer readable storage medium based on an SDN network.

DRAWINGS

1 is a flowchart of a network management and control method based on an SDN network according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of a network management device based on an SDN network according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Referring to FIG. 1 , which is a flowchart of a network management and control method based on an SDN network according to an embodiment of the present invention, the network management and control method based on an SDN network includes:

S100: input a historical abnormal data stream into the AI engine to perform model training on the deep learning model, and generate a diagnosis model; wherein the historical abnormal data stream is data that is determined to have malicious attack behavior in the SDN network;

S200: Deploy the diagnostic model to a SDN cloud network controller.

S300: The SDN cloud network controller identifies the data stream collected in real time according to the diagnosis model, and obtains an abnormal data identification result;

S400: The SDN cloud network controller intercepts the malicious attack data belonging to the abnormal data stream in the real-time collected data stream according to the abnormal data identification result.

In this embodiment, lightweight AI training capability is introduced in the network and service control layer, and intelligent control is implemented on the network and the service, which can effectively diagnose and automatically intercept malicious attacks on the SDN network, and implement self-monitoring of the SDN network. Improve the efficiency of network operation and maintenance and reduce the operation and maintenance costs of the network.

In an optional embodiment, the SDN network-based network management method further includes:

The SDN cloud network controller sends the malicious attack data intercepted in the set time period to the AI engine;

The AI engine re-trains the diagnosis model according to the malicious attack data intercepted in the set time period, and obtains an iteratively optimized diagnosis model;

The iteratively optimized diagnostic model is updated to the SDN cloud controller.

In this embodiment, by performing model training on the diagnostic model by setting malicious attack data intercepted within a set period of time, iterative optimization of the diagnostic model is implemented, thereby implementing automatic optimization of the SDN cloud network controller. control.

In an optional embodiment, the SDN cloud network controller intercepts the malicious attack data belonging to the abnormal data stream in the real-time collected data stream according to the abnormal data identification result, and specifically includes:

The SDN cloud network controller generates an interception flow table according to the abnormal data identification result, and sends the intercept flow table to each switch; wherein the intercept flow table includes an address of the attacking host, an address of the destination host, and a malicious Attack data;

When the data stream that is collected in real time includes data corresponding to any one of the interception flow tables, the malicious attack data in the real-time collected data stream is intercepted.

In an optional embodiment, the historical abnormal data stream is input into an AI engine to perform model training on the deep learning model to generate a diagnostic model; wherein the historical abnormal data stream is determined to be determined in the SDN network. The data of malicious attacks, including:

Performing data cleaning and pre-processing on the historical abnormal data stream to generate standardized data samples and storing the data in the acceleration storage module;

The AI engine acquires the data samples from the acceleration storage module for feature mining to obtain feature information;

Modeling the deep learning model with the feature information to generate the diagnostic model.

In this embodiment, taking text data as an example, the process of generating standardized data samples includes: extracting structured data related to fault diagnosis from the historical abnormal data stream by using information extraction technology, preferably, adopting Named entity recognition, extracting entity words or phrases that appear in the text,

The AI engine acquires the data sample from the acceleration storage module for feature mining, and obtains feature information, which specifically includes:

Keyword extraction, extracting important words and phrases in the text,

Relationship extraction, extracting the relationship between entities in the text,

Text categorization automatically maps text to a preset classification system.

The feature information of the historical abnormal data stream is mined by the above process.

In an optional embodiment, the deep learning model is trained by using the feature information to generate the diagnostic model, and specifically includes:

Entering the feature information into the deep learning model for model training, generating a diagnosis rule, and storing the diagnosis rule in a preset diagnosis rule database; wherein the diagnosis rule includes a mapping relationship of the feature information;

Root cause analysis is performed on the diagnosis rule to generate the diagnosis model.

In an optional embodiment, the pre-processing includes one or more of the following processes: missing value processing, feature discretization processing, feature combination processing, feature selection processing.

In an optional embodiment, the deep learning model includes one or more of the following deep learning algorithms: Spark ML algorithm, MLlib algorithm, deeplearning4j algorithm, TensorFlow algorithm, Caffe algorithm, CNTK algorithm, Theano algorithm, Torch algorithm , association algorithms, and classification algorithms.

Specifically, the deep learning model can be understood as a neural network model, and each neuron of the deep learning model is a logical regression, with x ₁ , x ₂ , . . . , x _n as inputs, and the output is:

通过反传误差函数

不断调整神经网络的参数W和阈值θ，使误差函数E达到极小，此时深度学习过程结束，确定网络中每个神经元的神经网络的参数W和阈值θ，并得到所述深度学习模型；其中，t _i为期望输出，y _i为神经元的输出。通过将挖掘得到的特征信息作为所述深度学习模型的第一层神经元的输入，经过多层神经元的正向传递迭代计算后获得网络中每个神经元的神经网络的参数W1和阈值θ1，将所述深度学习模型的每个神经元的神经网络的参数W和阈值θ分别调整为W1和θ1，得到所述诊断模型。 Where f is called the activation function; W is the parameter of the neural network; θ is the comparison threshold; by taking the output y _i of each neuron of each layer as the input to each neuron of the next layer. The deep learning model uses an S-type transfer function

Back propagation error function

The parameter W and the threshold θ of the neural network are continuously adjusted so that the error function E reaches a minimum. At this time, the deep learning process ends, the parameter W and the threshold θ of the neural network of each neuron in the network are determined, and the deep learning model is obtained. Where t _i is the desired output and y _i is the output of the neuron. By using the extracted feature information as the input of the first layer of neurons of the deep learning model, the neural network parameters W1 and the threshold θ1 of each neuron in the network are obtained after the iterative calculation of the forward propagation of the multi-layered neurons. The parameter W and the threshold θ of the neural network of each neuron of the deep learning model are adjusted to W1 and θ1, respectively, to obtain the diagnostic model.

Referring to FIG. 2, it is a schematic diagram of a network management device based on an SDN network, where the network management device based on the SDN network includes: a diagnostic model generation module 1, an AI engine 2, and a model deployment. Module 3, SDN cloud network controller 4;

The diagnostic model generating module 1 is configured to input a historical abnormal data stream into the AI engine 2 to perform model training on the deep learning model to generate a diagnostic model; wherein the historical abnormal data stream is determined to be malicious in the SDN network Data on aggression;

The model deployment module 4 is configured to deploy the diagnostic model to the SDN cloud network controller 4;

The SDN cloud network controller 4 is configured to identify a data stream collected in real time according to the diagnosis model, and obtain an abnormal data identification result;

The SDN cloud network controller 3 is configured to intercept, according to the abnormal data identification result, malicious attack data belonging to the abnormal data stream in the real-time collected data stream.

In this embodiment, lightweight AI training capability is introduced in the network and service control layer, and intelligent control is implemented on the network and the service, which can effectively diagnose and automatically intercept malicious attacks on the SDN network, and implement self-monitoring of the SDN network. Improve the efficiency of network operation and maintenance and reduce the operation and maintenance costs of the network.

In an optional embodiment, the SDN cloud network controller is configured to send malicious attack data intercepted within a set time period to the AI engine;

The AI engine is configured to perform model training on the diagnosis model according to the malicious attack data intercepted in the set time period, and obtain an iteratively optimized diagnosis model;

The model deployment module is configured to update the iteratively optimized diagnosis model to the SDN cloud network controller.

In this embodiment, by performing model training on the diagnostic model by setting malicious attack data intercepted within a set time period, iterative optimization of the diagnostic model is implemented, thereby implementing automatic SDN cloud network controller. optimized control.

In an optional embodiment, the SDN network-based network management device further includes: an intercepting module;

The SDN cloud network controller is configured to generate an intercepting flow table according to the abnormal data identification result, and send the intercepting flow table to each switch; wherein the intercepting flow table includes an address of the attacking host and a destination host Address and malicious attack data;

The intercepting module is configured to intercept malicious attack data in the real-time collected data stream when the data stream corresponding to the one of the intercepting flow tables is included in the data stream collected in real time.

In an optional embodiment, the diagnostic model generating module includes: a data preprocessing module and a model generating module;

The data pre-processing module is configured to perform data cleaning and pre-processing on the historical abnormal data stream, generate standardized data samples, and store the data in the acceleration storage module;

The AI engine is configured to acquire the data samples from the accelerated storage module for feature mining, and obtain feature information;

The model generating module is configured to perform model training on the deep learning model by using the feature information to generate the diagnostic model.

In this embodiment, taking text data as an example, the process of generating standardized data samples includes: extracting structured data related to fault diagnosis from the historical abnormal data stream by using information extraction technology, preferably, adopting Named entity recognition, extracting entity words or phrases that appear in the text,

The process of feature mining by the AI engine includes:

Keyword extraction, extracting important words and phrases in the text,

Relationship extraction, extracting the relationship between entities in the text,

Text categorization automatically maps text to a preset classification system.

The feature information of the historical abnormal data stream is mined by the above process.

In an optional embodiment, the model generating module includes: a diagnosis rule generating unit and a root cause analyzing unit;

The diagnosis rule generating unit is configured to input the feature information into the deep learning model for model training, generate a diagnosis rule, and store the diagnosis rule in a preset diagnosis rule database; wherein the diagnosis rule includes Mapping relationship of feature information;

The root cause analysis unit is configured to perform root cause analysis on the diagnosis rule to generate the diagnosis model.

In an optional embodiment, the pre-processing includes one or more of the following processes: missing value processing, feature discretization processing, feature combination processing, feature selection processing.

In an optional embodiment, the deep learning model includes one or more of the following deep learning algorithms: Spark ML algorithm, MLlib algorithm, deeplearning4j algorithm, TensorFlow algorithm, Caffe algorithm, CNTK algorithm, Theano algorithm, Torch algorithm , association algorithms, and classification algorithms.

Specifically, the deep learning model can be understood as a neural network model, and each neuron of the deep learning model is a logical regression, with x ₁ , x ₂ , . . . , x _n as inputs, and the output is:

通过反传误差函数

不断调整神经网络的参数W和阈值θ，使误差函数E达到极小，此时深度学习过程结束，确定网络中每个神经元的神经网络的参数W和阈值θ，并得到所述深度学习模型；其中，t _i为期望输出，y _i为神经元的输出。通过将挖掘得到的特征信息作为所述深度学习模型的第一层神经元的输入，经过多层神经元的正向传递迭代计算后获得网络中每个神经元的神经网络的参数W1和阈值θ1，将所述深度学习模型的每个神经元的神经网络的参数W和阈值θ分别调整为W1和θ1，得到所述诊断模型。 Where f is called the activation function; W is the parameter of the neural network; θ is the comparison threshold; by taking the output yi of each neuron of each layer as the input to each neuron of the next layer. The deep learning model uses an S-type transfer function

Back propagation error function

The parameter W and the threshold θ of the neural network are continuously adjusted so that the error function E reaches a minimum. At this time, the deep learning process ends, the parameter W and the threshold θ of the neural network of each neuron in the network are determined, and the deep learning model is obtained. Where t _i is the desired output and y _i is the output of the neuron. By using the extracted feature information as the input of the first layer of neurons of the deep learning model, the neural network parameters W1 and the threshold θ1 of each neuron in the network are obtained after the iterative calculation of the forward propagation of the multi-layered neurons. The parameter W and the threshold θ of the neural network of each neuron of the deep learning model are adjusted to W1 and θ1, respectively, to obtain the diagnostic model.

An embodiment of the present invention further provides a network management device based on an SDN network, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, the processor executing the The computer program implements the SDN network-based network management method as described above.

Illustratively, the computer program can be partitioned into one or more modules/units that are stored in the memory and executed by the processor to perform the present invention. The one or more modules/units may be a series of computer program instruction segments capable of performing a particular function, the instruction segments being used to describe the execution of the computer program in the SDN network-based network management device. For example, the computer program may be divided into a diagnosis model generation module, a model deployment module, and a SDN cloud network controller. The specific functions of each module are as follows: the diagnosis model generation module is configured to input a historical abnormal data stream into the AI engine. Performing model training on the deep learning model to generate a diagnostic model; wherein the historical abnormal data stream is data that is determined to have malicious attack behavior in the SDN network; the model deployment module is configured to deploy the diagnostic model to the In the SDN cloud network controller, the SDN cloud network controller is configured to identify the data stream collected in real time according to the diagnosis model, and obtain an abnormal data identification result; the SDN cloud network controller is configured to The abnormal data identification result intercepts malicious attack data belonging to the abnormal data stream in the real-time collected data stream.

The network management device based on the SDN network may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server. The SDN network-based network management device may include, but is not limited to, a processor and a memory. It will be understood by those skilled in the art that the schematic diagram is merely an example of a network management device based on an SDN network, and does not constitute a limitation of a network management device based on an SDN network, and may include more or less components than illustrated, or Combining certain components, or different components, such as the SDN network-based network management device, may also include input and output devices, network access devices, buses, and the like.

The so-called processor can be a central processing unit (CPU), or other general-purpose processor, digital signal processor (DSP), application specific integrated circuit (ASIC), ready-made Field-Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like, and the processor is a control center of the SDN network-based network management device, and uses the various interfaces and lines to connect the entire SDN-based device. The various parts of the network's network management device.

The memory can be used to store the computer program and/or module, the processor implementing the basis by running or executing a computer program and/or module stored in the memory, and invoking data stored in the memory Various functions of the network management device of the SDN network. The memory may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may be stored. Data created based on the use of the mobile phone (such as audio data, phone book, etc.). In addition, the memory may include a high-speed random access memory, and may also include non-volatile memory such as a hard disk, a memory, a plug-in hard disk, a smart memory card (SMC), and a Secure Digital (SD) card. , Flash Card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

Wherein, the module/unit integrated by the SDN network-based network management device can be stored in a computer readable storage medium if it is implemented in the form of a software functional unit and sold or used as a separate product. Based on such understanding, the present invention implements all or part of the processes in the foregoing embodiments, and may also be completed by a computer program to instruct related hardware. The computer program may be stored in a computer readable storage medium. The steps of the various method embodiments described above may be implemented when the program is executed by the processor. Wherein, the computer program comprises computer program code, which may be in the form of source code, object code form, executable file or some intermediate form. The computer readable medium may include any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a removable hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM). , random access memory (RAM, Random Access Memory), electrical carrier signals, telecommunications signals, and software distribution media. It should be noted that the content contained in the computer readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in a jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, computer readable media Does not include electrical carrier signals and telecommunication signals.

The embodiment of the present invention further provides a computer readable storage medium, the computer readable storage medium comprising a stored computer program, wherein, when the computer program is running, controlling a device where the computer readable storage medium is executed is performed as described above Network management and control method based on SDN network.

Compared with the prior art, the network management and control method based on the SDN network provided by the embodiment of the present invention has the beneficial effects that: the network management and control method based on the SDN network includes: inputting a historical abnormal data stream into the AI engine to the depth The learning model performs model training to generate a diagnostic model; wherein the historical abnormal data stream is data that is determined to have malicious attack behavior in the SDN network; the diagnostic model is deployed to the SDN cloud network controller; the SDN cloud The network controller identifies the data stream collected in real time according to the diagnosis model, and obtains an abnormal data identification result; the SDN cloud network controller intercepts the real-time collected data stream according to the abnormal data identification result Malicious attack data for anomalous data streams. The above method combined with artificial intelligence can realize efficient diagnosis and automatically intercept malicious attacks on the SDN network, realize self-monitoring of the SDN network, improve the efficiency of network operation and maintenance, and reduce the operation and maintenance cost of the network. The embodiment of the invention further provides a network management device and a computer readable storage medium based on an SDN network.

It should be noted that the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical. Units can be located in one place or distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment. In addition, in the drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, and specifically, one or more communication buses or signal lines can be realized. Those of ordinary skill in the art can understand and implement without any creative effort.

The above is a preferred embodiment of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. It is the scope of protection of the present invention.

Claims (10)

A network management and control method based on SDN network, characterized in that it comprises: The historical abnormal data stream is input into the AI engine to perform model training on the deep learning model to generate a diagnostic model; wherein the historical abnormal data stream is data that is determined to have malicious attack behavior in the SDN network; Deploying the diagnostic model to a SDN cloud network controller; The SDN cloud network controller identifies the data stream collected in real time according to the diagnosis model, and obtains an abnormal data identification result; The SDN cloud network controller intercepts the malicious attack data belonging to the abnormal data stream in the real-time collected data stream according to the abnormal data identification result. The SDN network-based network management and control method according to claim 1, wherein the SDN network-based network management and control method further comprises: The SDN cloud network controller sends the malicious attack data intercepted in the set time period to the AI engine; The AI engine re-trains the diagnosis model according to the malicious attack data intercepted in the set time period, and obtains an iteratively optimized diagnosis model; The iteratively optimized diagnostic model is updated to the SDN cloud controller. The SDN network-based network management and control method according to claim 1, wherein the SDN cloud network controller intercepts the malicious attack belonging to the abnormal data stream in the real-time collected data stream according to the abnormal data identification result. Data, including: The SDN cloud network controller generates an interception flow table according to the abnormal data identification result, and sends the intercept flow table to each switch; wherein the intercept flow table includes an address of the attacking host, an address of the destination host, and a malicious Attack data; When the data stream that is collected in real time includes data corresponding to any one of the interception flow tables, the malicious attack data in the real-time collected data stream is intercepted. The SDN network-based network management and control method according to claim 1, wherein the historical abnormal data stream is input into an AI engine to perform model training on the deep learning model to generate a diagnosis model; wherein the historical abnormal data A stream is data that is determined to have malicious attacks in an SDN network, and includes: Performing data cleaning and pre-processing on the historical abnormal data stream to generate standardized data samples and storing the data in the acceleration storage module; The AI engine acquires the data samples from the acceleration storage module for feature mining to obtain feature information; Modeling the deep learning model with the feature information to generate the diagnostic model. The SDN network-based network management and control method according to claim 4, wherein the deep learning model is trained by using the feature information to generate the diagnostic model, and specifically includes: Entering the feature information into the deep learning model for model training, generating a diagnosis rule, and storing the diagnosis rule in a preset diagnosis rule database; wherein the diagnosis rule includes a mapping relationship of the feature information; Root cause analysis is performed on the diagnosis rule to generate the diagnosis model. The SDN network-based network management method according to claim 4, wherein the preprocessing comprises one or more of the following processes: missing value processing, feature discretization processing, feature combination processing, and feature selection processing. The SDN network-based network management method according to claim 1, wherein the deep learning model comprises one or more of the following deep learning algorithms: Spark ML algorithm, MLlib algorithm, deeplearning4j algorithm, TensorFlow algorithm, Caffe algorithm. , CNTK algorithm, Theano algorithm, Torch algorithm, association algorithm and classification algorithm. A network management device based on an SDN network, comprising: a diagnostic model generating module, configured to input a historical abnormal data stream into the AI engine to perform model training on the deep learning model, and generate a diagnostic model; wherein the historical abnormal data stream is data that is determined to have malicious attack behavior in the SDN network. ; a model deployment module, configured to deploy the diagnostic model to a SDN cloud network controller; The SDN cloud network controller is configured to identify a data stream collected in real time according to the diagnosis model, and obtain an abnormal data identification result; The SDN cloud network controller is configured to intercept, according to the abnormal data identification result, malicious attack data belonging to the abnormal data stream in the real-time collected data stream. A network management device based on an SDN network, comprising: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, when the processor executes the computer program The SDN network-based network management method according to any one of claims 1 to 7. A computer readable storage medium, comprising: a stored computer program, wherein the computer readable storage medium is controlled to execute the apparatus as claimed in claim 1 The SDN network-based network management and control method according to any one of the preceding claims.

Images