Situation awareness method and system for campus information system

Abstract

The invention discloses a campus information system situation awareness method and system, and the method carries out the following steps for each campus information system: calculating a moving average value and a moving standard deviation of the current campus information system in a specified period according to the historical access amount of the current campus information system in the specified period, determining an early warning threshold value according to the moving average value and the moving standard deviation obtained through calculation; capturing the flow of the current campus information system, and determining the page view of the current campus information system in a specified period; and judging whether the page view of the current campus information system in the current specified period is greater than an early warning threshold, and if so, performing access surge early warning.

Description

Technical Field

[0001] The present invention belongs to the technical field of information processing, and in particular relates to a situation awareness method and system for a campus information system. Background Art

[0002] At present, most of the information systems built by colleges and universities have problems such as high management complexity, large number of information systems, various types, complex construction entities and repeated construction. This makes it difficult for managers, especially the school information department, to grasp the application construction and operation status of the whole school. Failure to understand the overall situation of the school's information system assets will lead to decision makers being unable to make effective overall plans, and there will be risks of conflict and duplication in construction plans. It will also lead to the information system being out of supervision, causing serious security problems.

[0003] Most of the existing information system management methods only describe the management of some aspects of the information system, or only roughly describe the architecture of information system management and monitoring, and do not consider the overall perception of all applications in the complex environment of universities. Therefore, the existing information system management methods have great limitations. Summary of the invention

[0004] Purpose of the invention: In order to solve the perception problems existing in the currently constructed information systems and to solve the problems existing in the existing information system management methods, the present invention proposes a campus information system situation awareness method and system, which applies the theory of situation awareness to the field of campus information system management, so that the campus information-related departments can discover and manage the information systems in the campus network, and always grasp the status of all applications in the campus in the dynamically changing campus network environment, providing decision support for relevant managers.

[0005] Technical solution: A campus information system situation awareness method, for each campus information system, performs the following steps:

[0006] According to the historical visits of the current campus information system in the specified period, the moving average and moving standard deviation of the current campus information system in the specified period are calculated, and the warning threshold is determined according to the calculated moving average and moving standard deviation;

[0007] Capture the current campus information system traffic and determine the current campus information system access volume within a specified period;

[0008] Determine whether the number of visits to the current campus information system in the current specified period is greater than the warning threshold. Only if it is greater, issue an access surge warning.

[0009] Furthermore, according to the historical visits of the current campus information system in the specified period, the moving average value of the current campus information system in the specified period is calculated, which is expressed as:

[0010]

[0011] Where n represents the number of time windows included in the specified period, t represents the current time point, and i represents time window i.

[0012] Furthermore, the moving standard deviation is expressed as:

[0013]

[0014] In the formula, n represents the number of time windows included in the specified period, t represents the current time point, and μ t Represents a moving average.

[0015] Furthermore, the warning threshold is determined based on the calculated moving average and moving standard deviation, which is expressed as: μ t +k×σ t , where μ t represents the moving average, σ t represents the moving standard deviation, and k is the adjustment factor.

[0016] Furthermore, the capture of the current campus information system traffic and determination of the current campus information system access volume within a specified period specifically includes:

[0017] Capture current campus information system traffic;

[0018] Analyze whether the access address of the IP layer of the traffic is in the pre-set address library. If not, discard the traffic. If yes, analyze the application layer protocol of the traffic. Only when the application layer protocol of the traffic is HTTP or HTTPS, retain the traffic and extract key information from the traffic. Convert the key information into JSON format to form a JSON package.

[0019] Count the IP addresses corresponding to each campus information system in the JSON package to determine the number of visits to the current campus information system within a specified period.

[0020] Furthermore, the method further comprises the following steps:

[0021] Extract the destination IP address from the JSON packet;

[0022] Determine whether the extracted destination IP address has been recorded in the campus information system IP address library. Only if the destination IP address does not exist, generate an unknown information system record. Based on the generated unknown information system record, check whether the destination IP address belongs to the campus information system. Only if it does, add the destination IP address to the campus information system IP address library.

[0023] The present invention also proposes a campus information system situation awareness system, comprising:

[0024] Traffic capture module, used to capture the traffic of current campus information system;

[0025] The access statistics module is used to determine the access volume of the current campus information system within a specified period according to the traffic of the current campus information system;

[0026] The access surge warning module is used to determine whether the number of visits to the current campus information system in the current specified period is greater than the warning threshold. Only when it is greater, an access surge warning is issued;

[0027] The warning threshold is determined according to the following steps:

[0028] According to the historical visits of the current campus information system in a specified period, the moving average and moving standard deviation of the current campus information system in the specified period are calculated, and the warning threshold is determined according to the calculated moving average and moving standard deviation.

[0029] Furthermore, according to the historical access volume of the current campus information system in the specified period, the moving average value of the current campus information system in the specified period is calculated, which is expressed as:

[0030]

[0031] Where n represents the number of time windows included in the specified period, t represents the current time point, and i represents time window i;

[0032] Moving standard deviation, expressed as:

[0033]

[0034] In the formula, n represents the number of time windows included in the specified period, t represents the current time point, and μ t represents a moving average;

[0035] The warning threshold is determined based on the calculated moving average and moving standard deviation, expressed as: t +k×σ t , where μ t represents the moving average, σ t represents the moving standard deviation, and k is the adjustment factor.

[0036] Furthermore, the traffic of the current campus information system is determined according to the traffic of the current campus information system within a specified period, and the specific operations include:

[0037] Analyze whether the access address of the IP layer of the traffic is in the pre-set address library. If not, discard the traffic. If yes, analyze the application layer protocol of the traffic. Only when the application layer protocol of the traffic is HTTP or HTTPS, retain the traffic and extract key information from the traffic. Convert the key information into JSON format to form a JSON package.

[0038] Count the IP addresses corresponding to each campus information system in the JSON package to determine the number of visits to the current campus information system within a specified period.

[0039] Furthermore, it also includes:

[0040] The unknown campus information system monitoring module is used to extract the destination IP address from the JSON package and determine whether the extracted destination IP address has been recorded in the campus information system IP address library. Only when the destination IP address does not exist, an unknown information system record is generated; based on the generated unknown information system record, it is checked whether the destination IP address belongs to the campus information system. Only when it does, the destination IP address is added to the campus information system IP address library.

[0041] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0042] (1) The method / system of the present invention can effectively record and manage all information system assets of the school, and perform statistical analysis on asset data according to the dimensions that managers are concerned about, so that managers can intuitively and comprehensively manage school information system assets and make effective decisions;

[0043] (2) The method / system of the present invention has an information system discovery function. By analyzing network traffic, it can discover information systems without records, thus preventing information systems from being out of supervision;

[0044] (3) The method / system of the present invention statistically analyzes the network traffic of each system, keeps an eye on the number of visits to each information system at any time, and warns the status of the information system, such as a surge in visits, disappearance of visits, etc., and promptly notifies the administrator to pay attention to the status of the information system and take corresponding measures;

[0045] (4) The method / system of the present invention can obtain key network information such as the number of real-time online users of VPN through a third-party interface, and comprehensively perceive the access and operation status of the information system of the entire school. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 Flowchart for capturing and parsing campus network traffic;

[0047] Figure 2 A flowchart for discovering unknown information systems in the campus network;

[0048] Figure 3 A flowchart of a warning method for application access disappearance;

[0049] Figure 4 A flowchart of an early warning method for determining a surge in application access;

[0050] Figure 5 Design schematics for functions;

[0051] Figure 6 This is a schematic diagram of the system architecture;

[0052] Figure 7 This is a schematic diagram of the system interface. DETAILED DESCRIPTION

[0053] The technical solution of the present invention is now further described in conjunction with the accompanying drawings and embodiments.

[0054] Embodiment 1:

[0055] like Figure 1 As shown, this embodiment proposes a method for capturing and parsing campus network traffic, which mainly includes the following steps:

[0056] Step 1: Direct the mirrored traffic from the core switch to the traffic capture server;

[0057] Step 2: Set up the address database used by the school information system;

[0058] Step 3: Process the traffic captured by the traffic capture server and analyze whether the access address of the IP layer of the traffic is in the address library used by the school information system. If not, discard the traffic without any processing. If yes, execute step 4 for further traffic filtering.

[0059] Step 4: Analyze the application layer protocol of the traffic. Only when the application layer protocol is HTTP or HTTPS, retain the traffic, complete the traffic filtering, and obtain the filtered traffic.

[0060] Step 5: Extract key information from the filtered traffic and convert the key information into JSON format to form a JSON package;

[0061] Step 6: Use the MQTT protocol to perform high-throughput data transmission and transmit the JSON package for subsequent processing.

[0062] Embodiment 2:

[0063] like Figure 2 As shown, this embodiment proposes a method for discovering an unknown information system in a campus network, which mainly includes the following steps:

[0064] Step 1: Receive the JSON packet formed in Example 1, and extract the destination IP address from it;

[0065] Step 2: Create and manage the IP address segments used by the school information system, and stipulate that the school information system must use a specific IP address segment;

[0066] Step 3: Compare the extracted destination IP address with the recorded information system IP address database. If the destination IP address already exists, the system does not generate an unknown information system record. If the destination IP address does not exist, an unknown information system record is generated.

[0067] Step 4: Based on the unknown information system record generated, check whether the destination IP address belongs to the information system. If it does not belong to the information system, the user can choose to hide the unknown information system record and no longer remind the user; if it does, you can directly click the "Add" button on this reminder record, and complete the relevant application information, and add the application to the "System Asset Management Module".

[0068] Embodiment 3:

[0069] This embodiment proposes a system early warning method, which counts the number of visits to each campus information system of a university, comprehensively considers the characteristics of university information system access, and mainly focuses on two traffic thresholds, including:

[0070] (1) For low-frequency applications, the number of users is small. To monitor whether such low-frequency applications are not accessed due to system failure, it is not possible to monitor the number of visits in real time, but to focus on whether there are users accessing within 24 hours. The specific warning methods are as follows: Figure 3 As shown, including:

[0071] Step 1: Query the campus information system deployed in the school every 10 minutes;

[0072] Step 2: Calculate whether the number of visits to the campus information system in the 24 hours before the current query node is greater than 0. If the number of visits is equal to 0, go to step 3. If it is greater than 0, determine whether the campus information system has generated an "access disappearance" alarm message before. If it has, eliminate the alarm message, otherwise end;

[0073] Step 3: If the number of visits to the campus information system in the 24 hours before the current query node is 0, but the "visit disappearance" alarm message of the system has been generated before, then the process ends directly; if the alarm message of the system has not been generated before, then go to step 4;

[0074] Step 4: Generate an alarm message for the system.

[0075] (2) For high-frequency applications, the main concern is whether the number of visits will suddenly surge. This embodiment uses the moving average and standard deviation as the benchmark for the number of visits. If the current number of visits exceeds the benchmark, an alarm of "surge in visits" is generated.

[0076] The moving average is calculated using the number of visits per minute over the past 7 days, expressed as:

[0077]

[0078] Wherein, n represents the size of the time window used. In this embodiment, n=7×24×60, and t represents the current time point.

[0079] The moving standard deviation can measure the variability of the data and provide a basis for setting a reasonable warning threshold, which can be expressed as:

[0080]

[0081] If the number of visits in the current minute is x t >μ t +k×σ t If the following conditions are met, an early warning is triggered, where k is an adjustment factor that can be adjusted according to historical data. Common values ​​are 1.5 to 3. In this embodiment, 1.5 is selected as the adjustment factor.

[0082] A surge in the number of visits to campus information systems can cause slow application access or crashes. You can focus on applications with special business periods, including but not limited to the course selection time of the academic affairs department and the orientation time of new students. Specific warning methods include: Figure 4 As shown, it mainly includes:

[0083] Step 1: After receiving a new Mqtt message, the number of visits to each campus information system in the previous minute will be counted;

[0084] Step 2: Calculate the moving average and moving standard deviation of the number of visits per minute for each campus information system in the previous 7 days according to the formula;

[0085] Step 3: Determine whether the number of visits to the campus information system in the previous minute is greater than the moving average + 1.5*moving standard deviation. If it is greater, go to step 4. If it is less, determine whether the campus information system has previously generated an "access surge" warning. If so, eliminate the warning. If not, end the process.

[0086] Step 4: Determine whether the campus information system has previously generated an early warning of "access surge". If so, end the process; if not, proceed to step 5.

[0087] Step 5: Generate a "visit surge" warning message for the system.

[0088] Embodiment 4:

[0089] Due to the high complexity of university management, there were no means and methods to master all information systems of universities in the past, resulting in managers and decision makers having no way to grasp the overall situation of the school, and thus unable to make effective decisions, which would cause problems such as duplicate construction. At the same time, information systems that are out of control will become unknown risk sources, causing safety hazards. This embodiment proposes a campus information system situation awareness system, which can effectively manage the information systems of the entire school and perform statistical displays based on indicators that managers are concerned about. At the same time, it can discover unknown information systems and prevent systems from being out of control. The situation awareness platform also monitors the number of visits to each system according to preset indicators, and promptly gives managers early warning information based on the number of visits.

[0090] The system proposed in this embodiment mainly includes the following modules:

[0091] The dashboard is used to display the statistical information that managers are concerned about, including statistics of all dimensions of all information systems, statistics of different dimensions of a single information system, and third-party situation data connected through open interfaces. This embodiment can display important statistical data such as the proportion of system server versions and the number of department systems through the dashboard, which greatly improves the management level and efficiency of the current campus information system through an intuitive and simple interface and operation;

[0092] The system asset management module is used to manage the detailed information of the information system. The administrator can enter the campus information system that needs to be managed into the system asset management module. The entered information includes the system name, construction year, amount, operating system, system location and other information that the administrator is concerned about, and then display it in a list. This system can effectively manage all information systems in the campus network through the system asset management module, and can query dozens of details such as the amount, IP address, construction time, administrator, etc. of the relevant system.

[0093] The network discovery module is used to compare the destination IP address in the JSON package sent by the traffic processing end with the IP address of the campus information system managed by the system asset management module. If a certain IP address is not registered in the system asset management module, the IP address will be registered as an unknown campus information system and displayed to the system administrator in the form of a list. The system administrator can click the "Add" button to directly substitute the IP address into the system asset management module to complete the new system information, thereby adding the unknown system to the system detailed list. If the IP address is not an information system, but a network device such as a switch, the IP discovery information can be hidden and will not be displayed in the unknown system list. Subsequent users can view the hidden IP information in the hidden list.

[0094] The IP address resource management module is used to manage the school's IP resources. It mainly registers the school's physical addresses corresponding to different IP address segments, such as 192.168.0.128 corresponding to the Computer College Building. This allows us to know which physical address of the school the access traffic to each campus information system comes from, supporting related statistical analysis.

[0095] The traffic processing end is a program deployed separately on the mirror server to capture the mirror traffic and analyze whether the access address of the traffic's IP layer is in the school information system address library. If the traffic does not access the address in the school information system address library, the traffic is discarded without any processing. If the traffic accesses the address in the school information system address library, further traffic filtering is performed. The application layer protocol of the traffic that is not discarded is analyzed. If the traffic is HTTP or HTTPS protocol traffic, it is retained. The key information in the filtered traffic is extracted, and the information is formatted and converted into JSON format. Through the Mqtt protocol, high-throughput data transmission is performed, and the converted JSON package data is sent to the network discovery module for data processing.

[0096] The access surge warning module is used to determine whether the number of visits to the current campus information system in the current specified period is greater than the warning threshold. Only when it is greater, an access surge warning is issued; the warning threshold is determined according to the following steps: based on the historical number of visits to the current campus information system in the specified period, the moving average and moving standard deviation of the current campus information system in the specified period are calculated, and the warning threshold is determined based on the calculated moving average and moving standard deviation.

[0097] According to the historical visits of the current campus information system in the specified period, the moving average of the current campus information system in the specified period is calculated, which is expressed as:

[0098]

[0099] Where n represents the number of time windows included in the specified period, and t represents the current time point.

[0100] Moving standard deviation, expressed as:

[0101]

[0102] In the formula, n represents the number of time windows included in the specified period, t represents the current time point, and μ t represents a moving average;

[0103] The determined warning threshold is expressed as: μ t +k×σ t , where μt t represents the moving average, σ trepresents the moving standard deviation, and k is the adjustment factor.

[0104] By analyzing the access traffic of servers in the campus network, this embodiment can intuitively see the access volume of each system, and combined with early warning information, such as access surge, access disappearance, etc., the status of campus-related business systems can be known in the first time to ensure the service continuity of the campus business system, thereby improving the service and security level of the campus network.

[0105] The system proposed in this embodiment adopts an open interface to gather the situation information of the whole school, which can solve the problem of data islands. Through the open interface, it can connect to the situation data of various different devices or systems in the school, such as VPN systems, firewall devices, etc., to monitor key data such as the number of VPN online users and server ping values, and monitor the service and security status of the campus network from multiple dimensions.

[0106] The system proposed in this embodiment realizes the overall situation awareness of the school's information system, and displays statistical analysis information such as system operation status, overall system access volume, department system quantity statistics, operating system ratio, system type ratio, system location ratio, early warning events and network discovery, so that managers can intuitively understand the school's situation at any time.

[0107] For example, during the undergraduate course selection period, the system proposed in this embodiment can timely observe the substantial increase in the traffic of the academic affairs system on that day, and at the same time, issue an early warning of the surge in visits to the relevant course selection system. Through the undergraduate course selection case, it is verified that this embodiment can effectively obtain the status of the application system of the entire school and provide decision makers with effective decision-making information and early warning information.

Claims

1. A campus information system situation awareness method, characterized by: For each campus information system, perform the following steps: According to the historical visits of the current campus information system in the specified period, the moving average and moving standard deviation of the current campus information system in the specified period are calculated, and the warning threshold is determined according to the calculated moving average and moving standard deviation; Capture the current campus information system traffic and determine the current campus information system access volume within a specified period; Determine whether the number of visits to the current campus information system in the current specified period is greater than the warning threshold. Only if it is greater, issue an access surge warning.

2. A campus information system situation awareness method according to claim 1, characterized in that: The moving average value of the current campus information system in the specified period is calculated based on the historical access volume of the current campus information system in the specified period, which is expressed as: Where n represents the number of time windows included in the specified period, t represents the current time point, and i represents time window i.

3. A campus information system situation awareness method according to claim 1, characterized in that: The moving standard deviation is expressed as: In the formula, n represents the number of time windows included in the specified period, t represents the current time point, and μ t Represents a moving average.

4. A campus information system situation awareness method according to claim 1, characterized in that: The warning threshold is determined based on the calculated moving average and moving standard deviation, expressed as: t +k×σ t , where μ t represents the moving average, σ t represents the moving standard deviation, and k is the adjustment factor.

5. A campus information system situation awareness method according to claim 1, characterized in that: The specific operations of capturing the traffic of the current campus information system and determining the number of visits to the current campus information system within a specified period include: Capture current campus information system traffic; Analyze whether the access address of the IP layer of the traffic is in the pre-set address library. If not, discard the traffic. If yes, analyze the application layer protocol of the traffic. Only when the application layer protocol of the traffic is HTTP or HTTPS, retain the traffic and extract key information from the traffic. Convert the key information into JSON format to form a JSON package. Count the IP addresses corresponding to each campus information system in the JSON package to determine the number of visits to the current campus information system within a specified period.

6. A campus information system situation awareness method according to claim 5, characterized in that: The following steps are also included: Extract the destination IP address from the JSON packet; Determine whether the extracted destination IP address has been recorded in the campus information system IP address library. Only if the destination IP address does not exist, generate an unknown information system record. Based on the generated unknown information system record, check whether the destination IP address belongs to the campus information system. Only if it does, add the destination IP address to the campus information system IP address library.

7. A campus information system situation awareness system, characterized by: include: Traffic capture module, used to capture the traffic of current campus information system; The access statistics module is used to determine the access volume of the current campus information system within a specified period according to the traffic of the current campus information system; The access surge warning module is used to determine whether the number of visits to the current campus information system in the current specified period is greater than the warning threshold. Only when it is greater, an access surge warning is issued; The warning threshold is determined according to the following steps: According to the historical visits of the current campus information system in the specified period, the moving average and moving standard deviation of the current campus information system in the specified period are calculated, and the warning threshold is determined according to the calculated moving average and moving standard deviation.

8. A campus information system situation awareness system according to claim 7, characterized in that: The moving average value of the current campus information system in the specified period is calculated based on the historical access volume of the current campus information system in the specified period, which is expressed as: Where n represents the number of time windows included in the specified period, t represents the current time point, and i represents time window i; Moving standard deviation, expressed as: In the formula, n represents the number of time windows included in the specified period, t represents the current time point, and μ t represents a moving average; The warning threshold is determined based on the calculated moving average and moving standard deviation, expressed as: t +k×σ t , where μ t represents the moving average, σ t represents the moving standard deviation, and k is the adjustment factor.

9. A campus information system situation awareness system according to claim 7, characterized in that: The method of determining the number of visits to the current campus information system within a specified period according to the flow of the current campus information system includes: Analyze whether the access address of the IP layer of the traffic is in the pre-set address library. If not, discard the traffic. If yes, analyze the application layer protocol of the traffic. Only when the application layer protocol of the traffic is HTTP or HTTPS, retain the traffic and extract key information from the traffic. Convert the key information into JSON format to form a JSON package. Count the IP addresses corresponding to each campus information system in the JSON package to determine the number of visits to the current campus information system within a specified period.

10. A campus information system situation awareness system according to claim 9, characterized in that: Also includes: The unknown campus information system monitoring module is used to extract the destination IP address from the JSON package and determine whether the extracted destination IP address has been recorded in the campus information system IP address library. Only when the destination IP address does not exist, an unknown information system record is generated; based on the generated unknown information system record, it is checked whether the destination IP address belongs to the campus information system. Only when it does, the destination IP address is added to the campus information system IP address library.

Images