Network data analysis method and device

Abstract

The embodiment of the invention provides a network data analysis method and device, relates to the field of data processing, and aims to perform association analysis on various data and process real-time streaming data. The method comprises the following steps: acquiring SNMP data acquired by a data acquisition node according to an SNMP data acquisition demand; obtaining a netflow log of the target communication device, a DNS log of the user and an AAA log of the user; searching a target interface in the target SNMP data according to the target interface index of the target communication device; searching and obtaining a target user request domain name of the target user in the DNS log according to the target IP, and determining a target application according to the target user request domain name; searching and obtaining an IP of a target user in the DNS log according to the source IP, and searching and obtaining a target user account in the AAA log according to the IP of the target user; and determining that the traffic is generated when the target user uses the target user account on the target application through the target interface of the target communication device. The embodiment of the invention is applied to processing network data.

Description

technical field [0001] Embodiments of the present invention relate to the field of data processing, in particular to a method and device for analyzing network data. Background technique [0002] The existing network data acquisition and analysis system is mainly an Internet Protocol (IP) network management system. The network management system is mainly composed of four aspects: resource management, performance management, alarm management, and configuration management. After decades of development, it has gradually formed A complete set of mature management models and management software. On the other hand, many manufacturers have released their own network management systems, for example, Cisco digital network architecture (cisco digital network architecture, CISCODNA), Huawei's iManager U2000, H3C's intelligent management center (intelligent management center, iMC), etc. These software basically solve the problem of IP data collection. [0003] In the actual application...

AI Technical Summary

Problems solved by technology

[0003] In the actual application process, due to the underlying implementation, the existing network data acquisition and analysis system will limit the collection server operating system version, server model, etc., and cannot be expanded horizontally. Due to the use of a relational database, the real-time data processing performance is limited. When When the amount of data is too large, the system may not respond, and it does not support real-time processing of streaming data; because cross-node deployment and collection cannot be performed, it is difficult to centralize the processing of cross-province reports or overall reports; in addition, due to network element equipment With the rapid increase, the complexity of network topology is constantly increasing, and the diversification and rapid development of Internet services, operators only manage the network through simple network management protocol (SNMP), which cannot meet the needs of business support, and the existing network data collection The scalability of the analysis system is limited, the multi-system big data analysis function is insufficient, and the correlation analysis ability is weak

Images