Method and device for analyzing network data

Abstract

Embodiments of the present invention provide a method and device for analyzing network data, which relate to the field of data processing, and can perform association analysis on various data and process real-time streaming data. The method includes: obtaining SNMP data collected by a data collection node according to the SNMP data collection requirement; obtaining netflow logs of a target communication device, DNS logs of a user, and AAA logs of a user; searching in the target SNMP data according to a target interface index of the target communication device Target interface; find and obtain the target user’s requested domain name in the DNS log according to the destination IP, determine the target application according to the target user’s requested domain name; find and obtain the target user’s IP in the DNS log according to the source IP, and obtain the target user’s IP according to the target user’s request domain name The IP searches and obtains the target user account in the AAA log; it is determined that the target user generates traffic when using the target user account on the target application through the target interface of the target communication device. The embodiments of the present application are applied to processing network data.

Description

technical field [0001] Embodiments of the present invention relate to the field of data processing, in particular to a method and device for analyzing network data. Background technique [0002] The existing network data acquisition and analysis system is mainly an Internet Protocol (IP) network management system. The network management system is mainly composed of four aspects: resource management, performance management, alarm management, and configuration management. After decades of development, it has gradually formed A complete set of mature management models and management software. On the other hand, many manufacturers have released their own network management systems, for example, Cisco digital network architecture (cisco digital network architecture, CISCODNA), Huawei's iManager U2000, H3C's intelligent management center (intelligent management center, iMC), etc. These software basically solve the problem of IP data acquisition. [0003] In the actual applicatio...

AI Technical Summary

Problems solved by technology

[0003] In the actual application process, due to the underlying implementation, the existing network data acquisition and analysis system will limit the collection server operating system version, server model, etc., and cannot be expanded horizontally. Due to the use of a relational database, the real-time data processing performance is limited. When When the amount of data is too large, the system may not respond, and it does not support real-time processing of streaming data; because cross-node deployment and collection cannot be performed, it is difficult to centralize the processing of cross-province reports or overall reports; in addition, due to network element equipment With the rapid increase, the complexity of network topology is constantly increasing, and the diversification and rapid development of Internet services, operators only manage the network through simple network management protocol (SNMP), which cannot meet the needs of business support, and the existing network data collection The scalability of the analysis system is limited, the multi-system big data analysis function is insufficient, and the correlation analysis ability is weak

Images