A method and device for detecting abnormal equipment

Abstract

The invention provides a method for finding abnormal device and a device, thereby achieving objectives of monitoring the device and finding an abnormal device. The invention comprises steps of obtaining flow abnormal report of a local device during abnormity of current flows; examining whether flows in the output port is consistent with flows in the input end of the local device; examining flow in the previous device output port is consistent with the flows in the input end of the local device on a link until determining abnormity occurs on the device with flows in the output port being different from flows in the input end in the internal network when the flows in the output port is consistent with the flows in the input end of the local device; and determining the local device to be abnormal when the flows in the output port is different from the flows in the input end of the local device. The method directly shows the related logic relations between the local device and other network devices, and not only focuses on link relative ratio changing conditions of the flows but also on year-over-year changing conditions of the flows, thereby increasing precision of judgment.

Description

technical field [0001] The invention relates to the communication field, in particular to a method and device for finding abnormal equipment. Background technique [0002] In a broad sense, a server refers to a computer system that can provide certain services to other machines in the network. In a narrow sense, a server refers to certain high-performance computers that can provide services to the outside world through the network. Compared with ordinary PCs, the requirements for stability, security, and performance are higher; and as the nodes of the network, servers store and process 80% of the data and information on the network, so they are also called the soul of the network. Network terminal devices, such as microcomputers in families and enterprises, must go through the server to access the Internet, obtain information, communicate with the outside world, and entertain. Therefore, it can also be said that the server "organizes" and "leads" these devices. [0003] The...

AI Technical Summary

Problems solved by technology

[0003] Therefore, the status of the server is very important, and it is necessary to monitor whether the server is abnormal from time to time. In the prior art, traditional monitoring tools are used to monitor the traffic of the local device to determine whether the server is abnormal. For example, when the traffic is higher than the preset threshold, It is considered that the local device is under attack; however, the increase in traffic may be within the normal business scope, so this method of triggering an alarm by setting a single threshold will cause false alarms; in addition, traditional monitoring tools also have the following problems: For example, traditional monitoring tools do not intuitively provide the logical relationship between servers and network devices, network devices and network devices; they only record historical values, and generally do not make further judgments through accurate comparisons

Images