Data center switch abnormal flow detection method, device, equipment and medium

Abstract

The invention relates to the technical field of flow monitoring, in particular to a data center switch abnormal flow detection method and device, equipment and a medium, and the method comprises the following steps: collecting port flow, calculating a jump ratio, identifying an abnormal path, analyzing a multi-feature behavior, tracking the attribution of flow direction oscillation aggregation equipment, and outputting a detection result. According to the method, the port abrupt change phenomenon is identified through linkage of the jump ratio and the dynamic threshold value, the discrimination logic for the network jitter initial offset is established by combining the path continuous node response delay difference, and the path-level composite feature anomaly judgment is established by fusing the multi-dimensional index intersection behavior. Potential path oscillation is identified according to flow direction alternation in a period and traced to equipment granularity to realize chain affiliation aggregation, so that the granularity and accuracy of abnormal flow identification are enhanced, closed-loop abnormality diagnosis from transient abnormality to a path level to equipment affiliation is realized, the perception capability in a complex link disturbance and multi-point abnormality cooperation scene is improved, and the reliability of abnormal flow identification is improved. And the abnormal flow detection definition of the data center switch is improved.

Description

Technical Field

[0001] The present invention relates to the field of traffic monitoring technology, and in particular to a method, device, equipment and medium for detecting abnormal traffic in a data center switch. Background Art

[0002] The field of traffic monitoring technology involves real-time or offline monitoring, analysis, and management of data streams transmitted in computer networks, including data stream collection, classification, metering, identification, and anomaly detection. Raw traffic data is obtained through collection devices or software components deployed at network nodes, and data packets or connection behaviors are processed in conjunction with specific rules or pattern recognition methods to identify potential security risks, abnormal resource utilization, or service quality issues. Traditional data center switch abnormal traffic detection methods refer to methods that identify abnormal communication behavior by statistically analyzing port traffic data from switch interfaces in a data center network environment. In order to accurately identify abnormal network traffic within a data center to assist managers in discovering potential network failures or security threats, traffic statistics strategies based on preset thresholds are typically used. By analyzing indicators such as rate changes, protocol distribution, and number of connections on switch port traffic, preliminary judgments on possible abnormal behavior are made in combination with set judgment conditions.

[0003] In the existing switch traffic detection process, the core means is to use fixed thresholds to judge port rate changes. In scenarios with multi-path forwarding and abnormal communication behaviors with short-cycle alternation or flow direction jumps, there is a response delay problem. Since it relies on changes in single-dimensional indicators at the port level and lacks the coordinated extraction of path behavior chains and node interaction characteristics, it is difficult to accurately identify burst traffic caused by network link jitter or protocol anomalies. In a dynamic network environment, it is easy to cause false alarms and missed judgments. For example, when port traffic suddenly increases due to scheduling rather than attack behavior, it is impossible to effectively analyze the abnormal propagation path and device association between upstream and downstream nodes. Summary of the Invention

[0004] The purpose of the present invention is to solve the shortcomings of the prior art and to propose a data center switch abnormal traffic detection method, device, equipment and medium.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: a method for detecting abnormal traffic in a data center switch, comprising the following steps:

[0006] S1: Obtain the adjacent period traffic data of the upstream and downstream ports of the data center switch, calculate the traffic jump ratio, and filter the ports that exceed the dynamic traffic threshold to generate the number of ports with sudden abnormal traffic;

[0007] S2: Based on the number of ports with sudden abnormal traffic, extract the port traffic response delays of consecutive switching nodes in the path, calculate the difference between the maximum and minimum values, select the path that first breaks the network jitter tolerance, and generate a delay offset abnormal traffic path;

[0008] S3: Based on the delay offset abnormal traffic path, extract the node port average flow rate, inter-packet arrival time, MAC address change frequency, and direction jump number, count the number of paths where any three indicators simultaneously exceed the corresponding baseline anomaly detection, and generate composite feature abnormal traffic path statistics;

[0009] S4: Based on the statistical results of the abnormal traffic paths with the composite characteristics, detect and record the traffic channels with BGP route oscillation, count the total number of path links, and generate the total number of abnormal traffic paths with link disturbance;

[0010] S5: According to the total number of link disturbance type abnormal traffic paths, the corresponding communication paths and node information are determined, abnormal traffic chain attribution aggregation is completed in the device dimension, and the switch abnormal traffic detection result is generated.

[0011] As a further solution of the present invention, the number of burst abnormal traffic ports includes abnormal port distribution records, port hop ratio intervals, and traffic change trend categories; the delay offset abnormal traffic path includes path delay difference intervals, abnormal path topology positions, and affected communication directions; the statistical results of composite feature abnormal traffic paths include the number of path association index items, abnormal index combination types, and path feature difference levels; the total number of link disturbance type abnormal traffic paths includes path oscillation frequency, direction alternation pattern within a period, and potential BGP impact level; the switch abnormal traffic detection results include abnormal switch numbers, the number of aggregated links, and the categories to which abnormal ports belong.

[0012] As a further solution of the present invention, the step of obtaining the number of ports with sudden abnormal traffic is:

[0013] S111: Based on SNMP polling data from the data center switch, obtain the uplink and downlink traffic values ​​of each key port in two adjacent cycles at a set time point, match the data of each port according to the polling interval, extract the total uplink and downlink traffic data of the port in the current cycle and the previous cycle, and generate a port period traffic value pair;

[0014] S112: Based on the port periodic traffic value pairs, compare the upstream and downstream traffic changes in the current period with those in the previous period, identify the overall change characteristics of each port in adjacent periods, summarize them into a unified change information set, and generate a traffic jump ratio list;

[0015] S113: Based on the traffic jump ratio list, compare the jump characteristics of each port with the set dynamic traffic threshold, identify ports whose jump characteristics exceed the threshold and perform number statistics to obtain the number of ports with sudden abnormal traffic.

[0016] As a further solution of the present invention, the step of obtaining the delay offset abnormal traffic path is:

[0017] S211: Based on the identified port set in the number of ports with sudden abnormal traffic, extract the communication path where each port is located, and limit three consecutive switching nodes in each path. Obtain the port traffic response time between the node pairs in each path, extract the timestamp interval as response delay data, and record the traffic response time difference between the front and rear ports of the three nodes corresponding to each path, and generate a path delay value list;

[0018] S212: Based on the path delay value list, perform response difference analysis on the three delay values ​​in each path to obtain a difference range between the maximum delay value and the minimum delay value in the current path, calculate and obtain a path delay offset difference, determine whether it exceeds the network jitter tolerance, construct a set of paths to be screened, and obtain a set of difference values ​​of paths that exceed the limit;

[0019] S213: Based on the set of exceeding path difference values, identify the path that first exceeds the network jitter tolerance, perform a screening operation, mark all paths that have not historically exceeded the limit and record the path numbers, and obtain the delay offset abnormal traffic path.

[0020] As a further solution of the present invention, the steps for obtaining the statistical results of the composite characteristic abnormal traffic path are:

[0021] S311: Based on each path in the number of delay offset abnormal traffic paths, generate a node characteristic time series quantity list based on the average flow rate, inter-packet arrival time, MAC address change frequency, and direction jump number of the node ports in the path in the current cycle;

[0022] S312: Based on the node characteristic time series quantity list, the numerical values ​​of the four indicators of average flow rate, inter-packet arrival time, MAC address change frequency, and direction jump number are judged against their respective baseline levels within the period, and whether three or more indicators in the path are in an abnormal state are determined, and the path count value that meets the baseline condition is obtained;

[0023] S313: Based on the path count value that meets the baseline condition, the path numbers that meet three or more characteristics and are abnormal at the same time are extracted, and their corresponding recording periods, path identifiers and abnormal states are classified and organized to form composite table items, and summary statistical processing is performed to obtain statistical results of composite characteristic abnormal traffic paths.

[0024] As a further solution of the present invention, the step of obtaining the total number of link disturbance type abnormal traffic paths is:

[0025] S411: Based on the identified paths in the statistical results of the composite feature abnormal traffic paths, detect the changes in the communication traffic direction of each path within the current analysis period one by one, extract the forwarding direction information between the starting node and the destination node corresponding to the path, establish a communication direction sequence sorted by time, mark the index position of each direction reversal in sequence, and record the number of times it occurs within the period to obtain the number of path direction switching times;

[0026] S412: Based on the number of path direction switching times, determining in sequence whether the number of communication direction changes for each path within the analysis period satisfies a condition of two or more reciprocating flips. If two or more reciprocating flips occur, the path is determined to exhibit bidirectional oscillation. The path numbers that meet the condition are archived and recorded to obtain a set of path numbers exhibiting routing oscillation.

[0027] S413: Based on the set of path numbers with routing oscillation characteristics, record the link segment numbers covered by the paths, count the number of oscillating paths carried on each link, and associate and map the path numbers, link numbers, and oscillation states to obtain the total number of link disturbance type abnormal traffic paths.

[0028] As a further solution of the present invention, the steps of obtaining the abnormal traffic detection result of the switch are:

[0029] S511: Based on the total number of link disturbance-type abnormal traffic paths, determine the numbers of all involved links and the corresponding path structures, extract the communication node device information traversed by each link, identify the starting device number and ending device number of each path, and the numbers of all relay switches in the path through the binding relationship between the path and the topology structure, establish a mapping relationship between the path number and the device number, and generate a path-associated switch node number set;

[0030] S512: Extract the port status information corresponding to each switch number in the current analysis period based on the path-associated switch node number set, establish an association structure between the period identifier and the device port status record, aggregate the indicator records of the ports included in the device number, determine whether the device has an abnormal port status in the period, mark the abnormal device, and record the number and period identifier together to obtain a set of period-abnormal switch numbers;

[0031] S513: Based on the set of periodic abnormal switch numbers, the total number of paths involved in each abnormal device is counted, and whether there is a multi-path cross-aggregation phenomenon is determined. Combined with the position and direction identification of the path in the network topology, the consistency of the source and destination of the device traffic is determined, and the aggregation and division of each abnormal path at the device level is completed. The abnormal path attribution set is established with the device number as the index, and the switch abnormal traffic detection result is obtained.

[0032] The data center switch abnormal traffic detection device is used to perform a data center switch abnormal traffic detection method, including:

[0033] The port hopping identification module is used to execute S1: obtain the adjacent period traffic data of the upstream and downstream ports of the data center switch, calculate the traffic hopping ratio and filter the ports that exceed the dynamic traffic threshold, and generate the number of ports with sudden abnormal traffic;

[0034] The path delay analysis module is used to execute S2: extracting the port traffic response delay of the continuous switching nodes of the path according to the number of the sudden abnormal traffic ports, calculating the difference between the maximum and minimum values, screening the path that first breaks the network jitter tolerance, and generating the delay offset abnormal traffic path;

[0035] The composite path screening module is used to execute S3: extract the average flow rate of the node port, the inter-packet arrival time, the MAC address change frequency and the number of direction jumps based on the delay offset abnormal traffic path, count the number of paths where any three indicators simultaneously exceed the corresponding baseline anomaly detection, and generate composite feature abnormal traffic path statistics;

[0036] The disturbance link identification module is used to execute S4: based on the statistical results of the composite characteristic abnormal traffic path, detect and record the traffic channel with BGP route oscillation, count the total number of path links, and generate the total number of link disturbance type abnormal traffic paths;

[0037] The anomaly detection output module is used to execute S5: determine the corresponding communication path and node information based on the total number of link disturbance type abnormal traffic paths, complete abnormal traffic chain attribution aggregation in the device dimension, and generate the switch abnormal traffic detection result.

[0038] Compared with the prior art, the advantages and positive effects of the present invention are:

[0039] In the present invention, the port mutation phenomenon is identified by linking the jump ratio with the dynamic threshold, the identification logic of the initial offset of the network jitter is established in combination with the response delay difference of continuous nodes in the path, and the path-level composite feature anomaly judgment is constructed by integrating the intersection behavior of multi-dimensional indicators. The potential path oscillation is identified based on the alternation of flow directions within the cycle and traced back to the device granularity to realize chain attribution aggregation, which can significantly enhance the granularity and accuracy of abnormal traffic identification, realize closed-loop abnormality diagnosis from transient anomalies to path level and then to device attribution, enhance the perception ability in complex link disturbances and multi-point abnormality collaboration scenarios, and improve the clarity of abnormal traffic detection of data center switches. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a schematic flow chart of the main steps of the present invention;

[0041] Figure 2 A flowchart for obtaining the number of ports with sudden abnormal traffic in the present invention;

[0042] Figure 3 Obtaining a flow chart of a delayed offset abnormal traffic path according to the present invention;

[0043] Figure 4 A flow chart for obtaining statistical results of abnormal flow paths with composite characteristics according to the present invention;

[0044] Figure 5 A flowchart for obtaining the total number of abnormal traffic paths of link disturbance type according to the present invention;

[0045] Figure 6 This is a flow chart for obtaining abnormal traffic detection results of a switch according to the present invention. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0047] In the description of the present invention, it should be understood that the terms "length," "width," "up," "down," "front," "back," "left," "right," "vertical," "horizontal," "top," "bottom," "inside," "outside," and the like, indicating positions or relationships, are based on the positions or relationships shown in the accompanying drawings and are intended only to facilitate the description of the present invention and simplify the description. They do not indicate or imply that the devices or elements referred to must have a specific orientation, be constructed, or operate in a specific orientation. Therefore, they should not be construed as limiting the present invention. Furthermore, in the description of the present invention, "plurality" means two or more, unless otherwise expressly and specifically defined.

[0048] See also Figure 1, a data center switch abnormal traffic detection method, comprising the following steps:

[0049] S1: Obtain traffic data from two consecutive cycles of key upstream and downstream ports of the data center switch (SNMP polling cycle data, implementing a standard 30-second polling interval), compare the total port traffic value of the current cycle with the previous cycle, calculate the traffic jump ratio, compare it with the dynamic traffic threshold (which meets the standard set 10% rate change rate), filter out ports that exceed the dynamic traffic threshold, and generate the number of ports with sudden abnormal traffic;

[0050] S2: Based on the communication paths involved in the number of ports with abnormal traffic bursts, extract the port traffic response delays of three consecutive switching nodes in each path, obtain the maximum and minimum values, calculate the difference, and compare it with the network jitter tolerance (set according to the standard of ±5ms). Select the path that first exceeds the network jitter tolerance and generate the abnormal traffic path with delay deviation;

[0051] S3: For each path in the delay offset abnormal traffic path count, extract the node port's average flow rate, inter-packet arrival time, MAC address change frequency, and direction jump count in the current cycle. Count the number of paths where any three indicators simultaneously exceed the corresponding baseline anomaly detection (meeting the digital evidence identification standard) to generate composite feature abnormal traffic path statistics.

[0052] S4: Based on the identified paths in the statistical results of the composite feature abnormal traffic paths, detect whether the internal communication traffic direction has changed more than twice within a cycle. If the conditions are met, record it as a traffic channel with BGP route oscillation (referring to the Border Gateway Protocol standard), count the total number of path links, and generate the total number of link disturbance type abnormal traffic paths;

[0053] S5: Based on the total number of link disturbance-type abnormal traffic paths, determine the corresponding communication paths and node information, trace back the switch device numbers, port traffic, and cycle status involved in the paths, complete abnormal traffic chain aggregation at the device level (implement the FlowSpecification mechanism of "Network Traffic Classification"), and generate switch abnormal traffic detection results.

[0054] The number of ports with sudden abnormal traffic includes abnormal port distribution records, port hop ratio range, and traffic change trend category. The delay offset abnormal traffic path includes the path delay difference range, abnormal path topology location, and affected communication direction. The statistical results of the composite feature abnormal traffic path include the number of path correlation indicator items, abnormal indicator combination type, and path feature difference level. The total number of link disturbance type abnormal traffic paths includes path oscillation frequency, direction alternation pattern within the cycle, and potential BGP impact level. The switch abnormal traffic detection results include the abnormal switch number, the number of aggregated links, and the category to which the abnormal port belongs.

[0055] See also Figure 2 , the specific steps of S1 are:

[0056] S111: Based on SNMP polling data from the data center switch, obtain the uplink and downlink traffic values ​​of each key port in two adjacent cycles at a set time point, match the data of each port according to the polling interval, extract the total uplink and downlink traffic data of the port in the current cycle and the previous cycle, and generate a port period traffic value pair;

[0057] Based on the SNMP polling data of the data center switch, it is necessary to obtain and structure the data of the upstream and downstream traffic of all key ports on the switch for two consecutive cycles. This process first requires initiating an SNMP request from the set management terminal. The target OIDs are ifHCInOctets and ifHCOutOctets. Each polling cycle is 30 seconds. The upstream and downstream data of the current time and the previous cycle are recorded respectively, and the port number is used as the index to assemble the data items. During execution, the timestamp is used to accurately locate the cycle boundary to avoid collection overlap or omissions. For example, if the time points are set to 2:00 PM and 1:59:30 PM on July 9, 2024, representing the current and previous cycles, respectively, and data is collected from port 1, the current cycle's upstream data rate is 210,000,000 bytes (i.e., 1680 Mbps) and the downstream data rate is 190,000,000 bytes (i.e., 1520 Mbps). The previous cycles' data rates were 200,000,000 bytes (1600 Mbps) and 180,000,000 bytes (1440 Mbps), respectively. The upstream and downstream data rates for this port during the current polling cycle are: [1680, 1600, 1520, 1440] Mbps. After collection, the periodic data for all ports is aggregated and organized into a structured array, where each row represents a two-cycle upstream and downstream data set for a port, forming the following data table:

[0058] Table 1 Data center switch key port cycle flow table

[0059] As shown in Table 1, the upstream and downstream traffic data of each port in two adjacent cycles have been archived. This type of table is directly derived from the original collection results of SNMP data polling. After unit conversion and structural organization, it is convenient for subsequent traffic behavior difference identification operations. The final port cycle traffic value pair will serve as the basic analysis object for judging the behavior of key links in the data center.

[0060] S112: Based on the port period traffic value pairs, compare the upstream and downstream traffic changes in the current period with those in the previous period, identify the overall change characteristics of each port in adjacent periods, summarize them into a unified change information set, and generate a traffic jump ratio list;

[0061] Based on the generated port cycle traffic value pairs, it is necessary to perform structural analysis and summarize the jump behavior to identify the traffic fluctuations of each key port between the two cycles. The process first extracts the total upstream and downstream traffic of the current and previous cycles in each set of data and performs an aggregate comparison. For example, the current total traffic of port 1 is 1680+1520=3200Mbps, and the previous cycle was 1600+1440=3040Mbps, with a change value of 160Mbps. In order to more accurately express the jump behavior characteristics, the offset effect of the upstream and downstream communication paths must also be considered. For example, if the communication data fluctuations of port 1 with port 2 and port 3 during the cycle are ±40Mbps and ±20Mbps respectively, the overall communication impact factor is considered to be 60Mbps. This value, as an auxiliary judgment parameter of the jump feature, together with the traffic difference value, constitutes the jump feature description group. The corresponding items for each port are as follows:

[0062] Table 2 Port periodic traffic jump characteristics

[0063] As shown in Table 2, the traffic change value is calculated by summing the traffic values ​​of the current and previous cycles, and the influence factors of the communication path fluctuations are added. This serves as the basis for determining whether there is a sudden change in port behavior. Once this structural information is constructed, a complete list of traffic jump ratios is formed, providing structural support for anomaly screening and jump ratio analysis.

[0064] S113: Based on the traffic jump ratio list, compare the jump characteristics of each port with the set dynamic traffic threshold, identify the ports whose jump characteristics exceed the threshold, and count the number of ports with sudden abnormal traffic;

[0065] Based on the constructed traffic jump ratio list, it is necessary to further determine which ports have abnormal jump behaviors. The jump judgment is based on the 10% change threshold. Any port whose total traffic in the current cycle differs from that in the previous cycle by more than this ratio is marked as an abnormal item. In the specific operation, the change value of each port needs to be divided by the traffic value of the previous cycle to obtain the jump ratio. For example, the jump ratio of port 1 is 160 / 3040≈5.26%, which does not exceed the threshold; the change of port 3 is 70 / 1930≈3.63%, which also does not exceed the threshold; if the jump ratio of a port is greater than 0.10, it is regarded as an abnormal port and enters the counting interval. To prevent misjudgment, a tolerance interval of ±0.5% is used, that is, no abnormal treatment is performed if it is lower than 9.5%. After counting the number of ports that meet the jump conditions, the final abnormal output indicator is shown in Table 3:

[0066] Table 3 Jump ratio and abnormal judgment table

[0067] As shown in Table 3, in this example, all ports do not exceed the set jump threshold of 10%, so the abnormality statistics result is 0. This number is the number of ports with sudden abnormal traffic in the data center switch corresponding to this period, which is used to further determine whether there is severe link fluctuation.

[0068] See also Figure 3 , the specific steps of S2 are:

[0069] S211: Based on the identified port set in the number of ports with sudden abnormal traffic, the communication path of each port is extracted, and three consecutive switching nodes in each path are defined. The port traffic response time between the node pairs in each path is obtained, and the timestamp interval is extracted as the response delay data. The traffic response time difference between the front and back ports of the three nodes corresponding to each path is recorded, and a path delay value list is generated.

[0070] Based on the number of ports with sudden abnormal traffic, the associated communication paths must be identified one by one, limited to transmission paths consisting of three consecutive switching nodes. Path information can be automatically correlated and located using the network topology diagram and link relationship table. After obtaining the path structure, the port response delay values ​​between each switching node segment are collected. Response delay is defined as the time interval between the upstream node interface completing data output and the downstream node interface completing data reception, measured in milliseconds. SNMP's interface delay field is used in conjunction with a clock synchronization mechanism for sampling to ensure consistent timestamp parsing. During data collection, the response times of three consecutive node segments are recorded for each path. For example, the three delays for path P1 are 3.2ms, 2.9ms, and 3.5ms; for path P2, 4.5ms, 4.1ms, and 5.0ms; and for path P3, 5.1ms, 6.0ms, and 4.9ms. All path delay data is format-checked and unit-converted, then summarized into the following structured table:

[0071] Table 4 Path delay collection table

[0072] As shown in Table 4, the delay data is a structured collection result in milliseconds. The path number corresponds to the node segment delay value one-to-one. This is used for subsequent path-level delay change calculation and screening logic judgment. The final result is a list of path delay values.

[0073] S212: Based on the path delay value list, perform response difference analysis on the three delay values ​​in each path to obtain the difference range between the maximum delay value and the minimum delay value in the current path using the formula:

[0074] ;

[0075] Calculate and obtain the path delay offset difference, determine whether it exceeds the network jitter tolerance, build a set of paths to be screened, and obtain the set of path difference values ​​that exceed the limit, where: Indicates the path The delay offset difference, in milliseconds (ms), Respectively represent the path The port traffic response delay of three consecutive node segments on the same node, in milliseconds (ms), Indicates the path The arithmetic mean of the three response delays, in milliseconds (ms), is calculated as: ; Indicates the total absolute deviation between the three-segment response delay of the path and the mean, in milliseconds (ms). is the square root of the sum of the squares of the response delays of the three segments of the path, in milliseconds (ms);

[0076] Based on the path delay value list, a comprehensive offset calculation is performed on the three response delay values ​​of each path. The difference between the maximum and minimum response delays in the path is obtained in sequence to form the initial range term. The delay mean is then calculated, and the absolute value of the offset between each delay segment and the mean is taken and averaged to form the average offset term. The square root of each delay value is then formed by summing and taking the square root. The absolute value of the three terms is added and subtracted, and then calculated as the path delay offset difference, which is calculated using the formula.

[0077] Taking path P2 as an example, its delay data is 4.5ms, 4.1ms, and 5.0ms. The corresponding calculation process is as follows:

[0078] Range Item: ;

[0079] Mean: ;

[0080] Mean deviation term: ;

[0081] Square root term: ;

[0082] Comprehensive difference: ;

[0083] All paths are calculated in this way, and the results are as follows:

[0084] Table 5 Path delay difference and abnormality judgment table

[0085] As shown in Table 5, the skew differences of paths P2 and P3 have exceeded the ±5ms tolerance line, while path P1 is within the normal range. The final result is the path delay skew difference.

[0086] The path delay skew difference (LDS) is a composite metric used to measure the delay fluctuation and distribution imbalance of a communication path in the network within the current cycle. It comprehensively reflects the difference between the maximum and minimum response delays between three consecutive switching nodes on the path, the deviation of each delay segment from the mean, and the masking effect of the overall delay intensity on the jump trend. A larger value indicates significant delay instability and drastic delay fluctuations on the path, which may be caused by network congestion, link fluctuations, or node anomalies. When the value exceeds the preset network jitter tolerance threshold, it indicates that the path has experienced abnormal delay skew behavior and should be regarded as a key signal of potential transmission jitter or link failure risks at the network transmission level.

[0087] The formula revolves around the differences, stability, and absolute magnitude of the three-segment response delay in the path. First, the range term is constructed by the difference between the maximum and minimum values ​​to capture the fluctuation amplitude of the instantaneous jump in the path and reflect the most direct and drastic change in the delay. Secondly, the absolute value of the deviation of each delay value from its arithmetic mean is introduced, and the three are summed and averaged to form the average deviation term. This term measures the uniformity of the overall delay. If the deviation is large, it means that the delay distribution is unstable. This term is introduced as a path stability indicator and is combined with the range term to reflect the discreteness of the delay. Further consideration is given to the delay. The square root of the sum of the squares of the three delay values ​​is introduced to form a square root term. This term is essentially the Euclidean norm of the delay vector, which can reflect the response load of the path in absolute terms. Because it is an absolute magnitude characteristic that affects the overall delay trend, it is deducted from the first two terms by subtraction to balance the interference between the offset value and the inherent load of the path. The final overall structure adopts the combination of adding and subtracting the three terms and then taking the absolute value to ensure that the obtained path delay offset difference is non-negative. It also takes into account the degree of fluctuation, delay distribution balance and overall load intensity, reflecting the multi-dimensional characterization capability of path hopping behavior.

[0088] S213: Based on the set of exceeded path difference values, identify the path that first exceeded the network jitter tolerance, perform a screening operation, mark all paths that have not historically exceeded the limit, and record the path numbers to obtain the delay deviation abnormal traffic path;

[0089] Based on the path delay offset difference, compared with the fixed network jitter tolerance of ±5ms, the path that first exceeds the threshold is marked. A first-time screening mechanism is used to avoid duplicate records. The offset records of previous cycles are retrieved from the path status table. If the current path has not previously exceeded the limit and the offset value of the current cycle is greater than 5ms, the path is recorded as an abnormal path. For example, path P2 was previously recorded as 7.2ms in the fifth cycle. The current cycle is the eighth cycle, which is not the first jump and is therefore eliminated. Path P3 has not exceeded the limit in previous cycles and its current offset value is 7.73ms. It is the first jump and is retained. Path P1 has an offset value of 4.76ms, which is less than the threshold and is not processed. Therefore, path P3 is ultimately recorded as a delay abnormal path in the structure table and is the result of abnormal delay offset traffic.

[0090] See also Figure 4 , the specific steps of S3 are:

[0091] S311: Based on each path in the number of delay offset abnormal traffic paths, the average flow rate, inter-packet arrival time, MAC address change frequency, and direction jump number of the node ports in the path in the current cycle are sequentially generated to generate a node characteristic time series quantity list;

[0092] Based on each path in the number of delay offset abnormal traffic paths, the average flow rate, inter-packet arrival time, MAC address change frequency and direction jump number of the node port in the path in the current cycle are extracted in turn. When obtaining the average flow rate, the total number of data bytes in the detection cycle is converted into megabits and then divided by the cycle duration. For example, the data transmission volume of path P1 in a 60-second cycle is 13.5MB, so its average flow rate is calculated as: 13.5×8 / 60=1.8Mbps. To obtain the inter-packet arrival time, the data packet timestamps of the path in the current cycle need to be extracted and arranged in order. The adjacent time intervals are calculated pair by pair, and the average value is taken as the inter-packet arrival time of the path after statistics. For example, the arrival time of the data packets received in path P3 is 0.000s, 0.004s, 0.008s, and 0.0 13s, 0.018s, then the adjacent time differences are 4ms, 4ms, 5ms, and 5ms, with an average of 4.5ms. To obtain the MAC address change frequency, the number of times the source MAC field in the data packet changes within the statistical period is divided by the total number of received data packets as the frequency indicator. If 200 data packets are received within the path P2 period, of which the source MAC changes five times, the change frequency is 5 / 200 = 0.025 times / packet. The number of directional jumps is extracted based on the comparison of the Layer 2 broadcast domains to which the source MAC and destination MAC of two consecutive data packets within the path belong to determine whether a jump has occurred. If there are four source and destination MAC corresponding broadcast domain changes within the path P2 period, it is recorded as four directional jumps. Finally, all the above parameter collection results are summarized in a structured table as shown below:

[0093] Table 6 Path node feature extraction table

[0094] As shown in Table 6, the characteristic parameters of each node corresponding to different path numbers have been extracted and summarized to obtain a list of node characteristic time series quantities.

[0095] S312: Based on the node characteristic time series list, the numerical values ​​of the four indicators (average flow rate, inter-packet arrival time, MAC address change frequency, and direction jump number) are compared with their respective baseline levels within the period to determine whether three or more indicators in the path are in an abnormal state, and obtain the path count value that meets the baseline conditions;

[0096] According to the node characteristic time series quantity list, the four indicators of average flow rate, inter-packet arrival time, MAC address change frequency and direction jump number in each path are judged in turn. The judgment benchmark values ​​are set as average flow rate 1.2Mbps, inter-packet arrival time 4ms, MAC change frequency 0.02 times / packet, and direction jump number 3 times. The judgment standard is whether each indicator exceeds the corresponding benchmark value. If it exceeds, the item is marked as abnormal. The average flow rate in path P1 is 1.8Mbps, which is higher than the benchmark value, which is abnormal; the inter-packet arrival time is 3.2ms, which is lower than the benchmark, which is normal; the MAC change frequency is 0.015 times / packet, which is lower than the benchmark, which is normal; the direction jump number is 0.015 times / packet, which is lower than the benchmark, which is normal. The number of directional jumps is 4 times higher than the benchmark, which is abnormal. P2 has three abnormalities in total. The average flow rate of path P3 is 2.0 Mbps, which is abnormal. The inter-packet arrival time is 4.3 ms, which is abnormal. The MAC change frequency is 0.021 times / packet, which is abnormal. The direction jump number is 3 times, which is equal to the benchmark and is not considered abnormal. There are only three abnormalities. Finally, P2 and P3 both meet three or more abnormal conditions, and the baseline condition is obtained to meet the path count value.

[0097] S313: Based on the path count values ​​that meet the baseline conditions, the path numbers of the paths that meet three or more characteristics and are abnormal are extracted, and their corresponding recording periods, path identifiers, and abnormal status are classified and organized into composite entries. Aggregate and statistically process them to obtain statistical results of the composite characteristic abnormal traffic paths;

[0098] Based on the baseline condition that meets the path count value, the path number set that meets three or more abnormal indicators in the node feature timing quantity list is summarized and classified, and the abnormal indicator composition, path number, current analysis cycle number, and abnormal status of each indicator are structured and recorded. First, the P2 and P3 paths judged in paragraph 2 are called as the path set that meets the conditions, and the single abnormal indicator of the set path is detailed. For example, the inter-packet arrival time in path P2 is 5.0ms, which exceeds the benchmark by 4ms and is marked as "inter-packet arrival abnormality". The MAC change frequency is 0.025 times / packet, which exceeds the benchmark by 0.02 times / packet and is marked as "MAC frequency abnormality". The number of direction jumps is 4 times, which exceeds the benchmark by 3 times. , marked as "abnormal jump count", the average flow rate in path P3 is 2.0Mbps, exceeding the benchmark by 1.2Mbps, marked as "abnormal flow rate", the inter-packet arrival time is 4.3ms, exceeding the benchmark by 4ms, marked as "abnormal inter-packet arrival", the MAC change frequency is 0.021 times / packet, exceeding the benchmark by 0.02 times / packet, marked as "abnormal MAC frequency", in this way, the abnormal dimension of each abnormal path is marked and counted, and the characteristic dimension mapping table of the abnormal path is constructed. In the path statistics process, the current cycle number is assigned to T8, and the number of abnormal dimensions, abnormal indicator type and corresponding parameter values ​​of each path in the cycle are recorded respectively, and a statistical list of abnormal paths is generated at the same time. The example is as follows:

[0099] Table 7 Composite abnormal path structure statistics

[0100] As shown in Table 7, paths P2 and P3 simultaneously meet the three-dimensional indicators exceeding the set benchmark values ​​in the current cycle T8. The corresponding indicator names and specific values ​​are explicitly recorded in the structured table to facilitate the subsequent scheduling module to perform path blocking judgment, abnormal feature clustering or association backtracking. By counting the number of qualified paths in this cycle, a total of 2 paths meet the standard of three or more indicators being abnormal at the same time, and the statistical results of the abnormal traffic path with composite characteristics are obtained.

[0101] See also Figure 5 , the specific steps of S4 are:

[0102] S411: Based on the identified paths in the statistical results of the composite feature abnormal traffic paths, the changes in the communication traffic direction of each path within the current analysis period are detected one by one, the forwarding direction information between the starting node and the destination node corresponding to the path is extracted, and a communication direction sequence sorted by time is established. The index position of each direction reversal is marked in sequence, and the number of times it occurs within the period is recorded to obtain the number of path direction switching times;

[0103] Based on the identified paths in the statistical results of the composite feature abnormal traffic paths, the communication direction change records of each path in the current analysis period are extracted. First, the sequence of data packets carried by each path in the period must be obtained, and the source MAC and destination MAC fields of each data packet are extracted. Then, combined with the interface location and link mapping relationship of the MAC, they are converted into direction identifiers. For example, if the source MAC corresponds to SN1 and the destination MAC corresponds to SN2, the direction is recorded as SN1→SN2. After completing the collection of the direction identifiers of all data packets, a time-ordered direction sequence is constructed, and the two direction identifiers before and after are compared. If the direction switches from X→Y to Y→X, or Y→X to X→Y, it is counted as a direction alternation event. The total number of direction flips on each path in the entire period is counted, and the following statistical table is constructed:

[0104] Table 8 Path communication direction alternation statistics

[0105] As shown in Table 8, the paths P2 and P3 both have direction reversals of 2 or more times within period T9, and the path direction switching count values ​​are obtained.

[0106] S412: Based on the number of path direction switching times, determine in sequence whether the number of communication direction changes on each path within the analysis period satisfies the condition of two or more reciprocating flips. If two or more reciprocating flips occur, the path is determined to exhibit bidirectional oscillation. The path numbers that meet the condition are archived and recorded to obtain a set of path numbers that exhibit routing oscillation.

[0107] Based on the number of path direction switches, the direction change behavior of each path within period T9 is judged. The judgment standard is set as whether the number of direction switches in a single period reaches 2 or more. If this condition is met, the path is determined to have communication direction oscillation, and its path number is further archived. Path P1 has 0 direction changes in period T9, indicating no direction alternation, and is not included in the path set. Path P2 has 3 direction flips, which is greater than the threshold and meets the condition. Path P3 has 2 flips, which is equal to the threshold and also meets the condition. Therefore, paths P2 and P3 are simultaneously included in the direction oscillation path set. The period number, flip number, and direction change pattern are recorded, and an initial identification structure for oscillating paths is established to obtain a set of path numbers with routing oscillation characteristics.

[0108] S413: Based on the set of path numbers with routing oscillation characteristics, record the link segment numbers covered by the paths, count the number of oscillating paths carried by each link, and associate and map the path numbers, link numbers, and oscillation status to obtain the total number of link-disturbance-type abnormal traffic paths;

[0109] Based on the set of path numbers with routing oscillation, the physical link structure mapped to each path is extracted. In the topology, path P2 passes through link segments L1 (SN1→SN2), L2 (SN2→SN3), and L3 (SN3→SN4). Path P3 passes through link segments L2 (SN2→SN3), L3 (SN3→SN4), and L4 (SN4→SN5). After binding the path numbers to the link numbers, a link bearer mapping table is constructed. The number of times each link is involved in a path with routing oscillation is counted. The results are as follows:

[0110] Table 9 Link disturbance path coverage statistics

[0111] As shown in Table 9, links L2 and L3 are each covered by 2 paths, and L1 and L4 are each covered by 1 path, involving a total of 4 link path mappings to obtain the total number of link disturbance type abnormal traffic paths.

[0112] See also Figure 6 , the specific steps of S5 are:

[0113] S511: Based on the total number of link-disturbance abnormal traffic paths, determine the numbers of all involved links and the corresponding path structures, extract the information of the communication node devices traversed by each link, and identify the starting device number, ending device number, and numbers of all relay switches in each path through the binding relationship between the path and the topology structure. A mapping relationship between the path number and the device number is established to generate a set of path-associated switch node numbers.

[0114] Based on the total number of link disturbance-type abnormal traffic paths, the network link segments traversed by each path in the current cycle are disassembled. After clarifying the link number, the topological structure bound to each path is identified one by one, and the switching devices involved in the path are matched based on the structure number mapped by the link. After the path number is associated with the link number, the starting device, end device and relay switch in the link topology are extracted as a device number sequence to form a mapping from the path to the switch number. For example, the link segments of path P2 are mapped as L1, L2, and L3, connecting devices SW01→SW02, SW02→SW03, and SW03→SW04 respectively. Therefore, the devices of path P2 are The numbering sequence is SW01, SW02, SW03, and SW04. Similarly, the link segments that path P3 passes through are L2, L3, and L4, and the connected devices are SW02→SW03, SW03→SW04, and SW04→SW05. The corresponding device numbers are SW02, SW03, SW04, and SW05. After sorting the device numbers corresponding to each path in sequence, a structured list of path numbers and device node numbers is constructed and filed according to the path cycle number. For example, paths P2 and P3 belong to cycle T9, and the corresponding device set is {SW01, SW02, SW03, SW04, SW05}. The data structure is as follows:

[0115] Table 10 Relationship between paths and switch node numbers

[0116] As shown in Table 10, a complete mapping relationship between path numbers and corresponding switch node numbers can be obtained in period T9, thereby obtaining a set of path-associated switch node numbers.

[0117] S512: Extract the port status information corresponding to each switch number in the current analysis cycle based on the set of path-associated switch node numbers, and establish an association structure between the cycle identifier and the device port status record. Aggregate the indicator records of the ports included in the device number to determine whether the device has an abnormal port status in the cycle. Mark the abnormal device and record the number and cycle identifier together to obtain a set of cycle-abnormal switch numbers.

[0118] Based on the path-associated switch node number set, extract the port operating status data of each switch in the current cycle T9 one by one. Match the upstream and downstream directions according to the device port number, and obtain the cumulative number of bytes transmitted, the number of forwarded packets, and the port bandwidth utilization rate in each direction in the current cycle. By summarizing them, a periodic port traffic indicator table is formed. For example, in cycle T9, switch SW02 sends 2.3GB of data on its upstream port and receives 2.1GB of data on its downstream port, with an average utilization rate of 74.5%. Its indicator items are 2300MB, 2100MB, and 74.5%, respectively. For SW03, the upstream and downstream data rates are 2.8GB and 2.4GB, respectively, with an utilization rate of 79.2%, as recorded below:

[0119] Table 11 Periodic port traffic index collection table

[0120] Based on the traffic indicators collected in the above table, the port load judgment standard is set. The judgment standard is derived from experimental statistics. When the average occupancy rate of the device port exceeds 75% and the difference between the upstream and downstream data exceeds 400MB, the device port load fluctuation is judged to be abnormal. The occupancy rate of SW02 is 74.5%, which is lower than the judgment benchmark and is marked as normal. The occupancy rate of SW03 is 79.2%, which exceeds 75%. The difference between the upstream and downstream is 400MB, which meets the conditions and is marked as an abnormal device. SW03 is entered into the abnormal device identification list and combined with the current cycle number to obtain the cycle abnormal switch number set.

[0121] S513: Based on the periodic abnormal switch number set, the total number of paths involved in each abnormal device is counted, and whether there is a multi-path cross-aggregation phenomenon is determined. Combined with the location and direction of the path in the network topology, the consistency of the device traffic source and destination is determined, and each abnormal path is aggregated and divided at the device level. The abnormal path attribution set is established with the device number as the index, and the switch abnormal traffic detection result is obtained;

[0122] According to the set of periodic abnormal switch numbers, the path information associated with the abnormal device is retrieved. The path and device mapping relationship is referenced to the content of Table 10 to check the path number corresponding to the device. For example, the paths associated with SW03 are P2 and P3, which are located in links L2 and L3 under cycle T9 respectively. Extracting the path direction identifier shows that P2 is in the direction of SN1→SN4 and P3 is in the direction of SN2→SN5. Although the directions are different, they are all aggregated on switch SW03. The switch number is bound to the corresponding path, and the number of paths is counted as 2. The same steps are performed on SW04 to obtain its aggregated path number. Path aggregation is performed on all abnormal device numbers to obtain a corresponding structure table of device numbers and aggregated path numbers. Unidirectional aggregation and bidirectional mixed aggregation are distinguished according to the path direction. Finally, it is organized into a device-level abnormal path attribution list. The summary structure content is extracted to obtain the switch abnormal traffic detection result.

[0123] The abnormal traffic detection device for a data center switch includes:

[0124] The port hopping identification module is used to execute S1: obtain the adjacent period traffic data of the upstream and downstream ports of the data center switch, calculate the traffic hopping ratio and filter the ports that exceed the dynamic traffic threshold, and generate the number of ports with sudden abnormal traffic;

[0125] The path delay analysis module is used to perform S2: based on the number of ports with sudden abnormal traffic, it extracts the port traffic response delay of the continuous switching nodes of the path, calculates the difference between the maximum and minimum values, selects the path that first exceeds the network jitter tolerance, and generates the delay deviation abnormal traffic path;

[0126] The composite path screening module is used to perform S3: based on the abnormal delay offset traffic path, extract the node port average flow rate, inter-packet arrival time, MAC address change frequency, and direction jump number, count the number of paths where any three indicators simultaneously exceed the corresponding baseline anomaly detection, and generate composite feature abnormal traffic path statistics;

[0127] The disturbance link identification module is used to execute S4: based on the statistical results of the composite characteristic abnormal traffic path, detect the traffic channel recorded as having BGP route oscillation, count the total number of path links, and generate the total number of link disturbance type abnormal traffic paths;

[0128] The anomaly detection output module is used to execute S5: determine the corresponding communication path and node information based on the total number of link disturbance type abnormal traffic paths, complete abnormal traffic chain attribution aggregation in the device dimension, and generate the switch abnormal traffic detection result.

[0129] The above are merely preferred embodiments of the present invention and do not limit the present invention in any other form. Any technician familiar with the profession may use the technical content disclosed above to change or modify it into an equivalent embodiment with equivalent changes and apply it to other fields. However, any simple modification, equivalent change and modification made to the above embodiment based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall still fall within the scope of protection of the technical solution of the present invention.

Claims

1. A method for detecting abnormal traffic in a data center switch, characterized in that: The following steps are involved: S1: Obtain the adjacent period traffic data of the upstream and downstream ports of the data center switch, calculate the traffic jump ratio, and filter the ports that exceed the dynamic traffic threshold to generate the number of ports with sudden abnormal traffic; S2: Based on the number of ports with sudden abnormal traffic, extract the port traffic response delays of consecutive switching nodes in the path, calculate the difference between the maximum and minimum values, select the path that first breaks the network jitter tolerance, and generate a delay offset abnormal traffic path; S3: Based on the delay offset abnormal traffic path, extract the node port average flow rate, inter-packet arrival time, MAC address change frequency, and direction jump number, count the number of paths where any three indicators simultaneously exceed the corresponding baseline anomaly detection, and generate composite feature abnormal traffic path statistics; S4: Based on the statistical results of the abnormal traffic paths with the composite characteristics, detect and record the traffic channels with BGP route oscillation, count the total number of path links, and generate the total number of abnormal traffic paths with link disturbance; S5: According to the total number of link disturbance type abnormal traffic paths, the corresponding communication paths and node information are determined, abnormal traffic chain attribution aggregation is completed in the device dimension, and the switch abnormal traffic detection result is generated.

2. The method for detecting abnormal traffic in a data center switch according to claim 1, wherein: The number of burst abnormal traffic ports includes abnormal port distribution records, port hop ratio intervals, and traffic change trend categories; the delay offset abnormal traffic path includes path delay difference intervals, abnormal path topology locations, and affected communication directions; the statistical results of composite feature abnormal traffic paths include the number of path association indicator items, abnormal indicator combination types, and path feature difference levels; the total number of link disturbance type abnormal traffic paths includes path oscillation frequency, direction alternation pattern within a period, and potential BGP impact level; the switch abnormal traffic detection results include abnormal switch numbers, the number of aggregated links, and the categories to which abnormal ports belong.

3. The method for detecting abnormal traffic in a data center switch according to claim 1, wherein: The steps for obtaining the number of ports with sudden abnormal traffic are as follows: S111: Based on SNMP polling data from the data center switch, obtain the uplink and downlink traffic values ​​of each key port in two adjacent cycles at a set time point, match the data of each port according to the polling interval, extract the total uplink and downlink traffic data of the port in the current cycle and the previous cycle, and generate a port period traffic value pair; S112: Based on the port periodic traffic value pairs, compare the upstream and downstream traffic changes in the current period with those in the previous period, identify the overall change characteristics of each port in adjacent periods, summarize them into a unified change information set, and generate a traffic jump ratio list; S113: Based on the traffic jump ratio list, compare the jump characteristics of each port with the set dynamic traffic threshold, identify ports whose jump characteristics exceed the threshold and perform number statistics to obtain the number of ports with sudden abnormal traffic.

4. The method for detecting abnormal traffic in a data center switch according to claim 1, wherein: The steps for obtaining the delay offset abnormal traffic path are: S211: Based on the identified port set in the number of ports with sudden abnormal traffic, extract the communication path where each port is located, and limit three consecutive switching nodes in each path. Obtain the port traffic response time between the node pairs in each path, extract the timestamp interval as response delay data, and record the traffic response time difference between the front and rear ports of the three nodes corresponding to each path, and generate a path delay value list; S212: Based on the path delay value list, perform response difference analysis on the three delay values ​​in each path to obtain a difference range between the maximum delay value and the minimum delay value in the current path, calculate and obtain a path delay offset difference, determine whether it exceeds the network jitter tolerance, construct a set of paths to be screened, and obtain a set of difference values ​​of paths that exceed the limit; S213: Based on the set of exceeding path difference values, identify the path that first exceeds the network jitter tolerance, perform a screening operation, mark all paths that have not historically exceeded the limit and record the path numbers, and obtain the delay offset abnormal traffic path.

5. The method for detecting abnormal traffic in a data center switch according to claim 1, wherein: The steps for obtaining the statistical results of the composite characteristic abnormal traffic path are as follows: S311: Based on each path in the number of delay offset abnormal traffic paths, generate a node characteristic time series quantity list based on the average flow rate, inter-packet arrival time, MAC address change frequency, and direction jump number of the node ports in the path in the current cycle; S312: Based on the node characteristic time series quantity list, the numerical values ​​of the four indicators of average flow rate, inter-packet arrival time, MAC address change frequency, and direction jump number are judged against their respective baseline levels within the period, and whether three or more indicators in the path are in an abnormal state are determined, and the path count value that meets the baseline condition is obtained; S313: Based on the path count value that meets the baseline condition, the path numbers that meet three or more characteristics and are abnormal at the same time are extracted, and their corresponding recording periods, path identifiers and abnormal states are classified and organized to form composite table items, and summary statistical processing is performed to obtain statistical results of composite characteristic abnormal traffic paths.

6. The method for detecting abnormal traffic in a data center switch according to claim 1, wherein: The steps for obtaining the total number of link disturbance type abnormal traffic paths are as follows: S411: Based on the identified paths in the statistical results of the composite feature abnormal traffic paths, detect the changes in the communication traffic direction of each path within the current analysis period one by one, extract the forwarding direction information between the starting node and the destination node corresponding to the path, establish a communication direction sequence sorted by time, mark the index position of each direction reversal in sequence, and record the number of times it occurs within the period to obtain the number of path direction switching times; S412: Based on the number of path direction switching times, determining in sequence whether the number of communication direction changes for each path within the analysis period satisfies a condition of two or more reciprocating flips. If two or more reciprocating flips occur, the path is determined to exhibit bidirectional oscillation. The path numbers that meet the condition are archived and recorded to obtain a set of path numbers exhibiting routing oscillation. S413: Based on the set of path numbers with routing oscillation characteristics, record the link segment numbers covered by the paths, count the number of oscillating paths carried on each link, and associate and map the path numbers, link numbers, and oscillation states to obtain the total number of link disturbance type abnormal traffic paths.

7. The method for detecting abnormal traffic in a data center switch according to claim 1, wherein: The steps for obtaining the abnormal traffic detection result of the switch are: S511: Based on the total number of link disturbance-type abnormal traffic paths, determine the numbers of all involved links and the corresponding path structures, extract the communication node device information traversed by each link, identify the starting device number and ending device number of each path, and the numbers of all relay switches in the path through the binding relationship between the path and the topology structure, establish a mapping relationship between the path number and the device number, and generate a path-associated switch node number set; S512: Extract the port status information corresponding to each switch number in the current analysis period based on the path-associated switch node number set, establish an association structure between the period identifier and the device port status record, aggregate the indicator records of the ports included in the device number, determine whether the device has an abnormal port status in the period, mark the abnormal device, and record the number and period identifier together to obtain a set of period-abnormal switch numbers; S513: Based on the set of periodic abnormal switch numbers, the total number of paths involved in each abnormal device is counted, and whether there is a multi-path cross-aggregation phenomenon is determined. Combined with the position and direction identification of the path in the network topology, the consistency of the source and destination of the device traffic is determined, and the aggregation and division of each abnormal path at the device level is completed. The abnormal path attribution set is established with the device number as the index, and the switch abnormal traffic detection result is obtained.

8. A data center switch abnormal traffic detection device, characterized in that: The data center switch abnormal traffic detection device is used to perform the data center switch abnormal traffic detection method according to any one of claims 1 to 7, and the data center switch abnormal traffic detection device includes: The port hopping identification module is used to execute S1: obtain the adjacent period traffic data of the upstream and downstream ports of the data center switch, calculate the traffic hopping ratio and filter the ports that exceed the dynamic traffic threshold, and generate the number of ports with sudden abnormal traffic; The path delay analysis module is used to execute S2: extracting the port traffic response delay of the continuous switching nodes of the path according to the number of the sudden abnormal traffic ports, calculating the difference between the maximum and minimum values, screening the path that first breaks the network jitter tolerance, and generating the delay offset abnormal traffic path; The composite path screening module is used to execute S3: extract the average flow rate of the node port, the inter-packet arrival time, the MAC address change frequency and the number of direction jumps based on the delay offset abnormal traffic path, count the number of paths where any three indicators simultaneously exceed the corresponding baseline anomaly detection, and generate composite feature abnormal traffic path statistics; The disturbance link identification module is used to execute S4: based on the statistical results of the composite characteristic abnormal traffic path, detect and record the traffic channel with BGP route oscillation, count the total number of path links, and generate the total number of link disturbance type abnormal traffic paths; The anomaly detection output module is used to execute S5: determine the corresponding communication path and node information based on the total number of link disturbance type abnormal traffic paths, complete abnormal traffic chain attribution aggregation in the device dimension, and generate the switch abnormal traffic detection result.

9. A data center switch abnormal traffic detection device, comprising a memory and a processor, characterized in that: The memory stores a computer program, and the processor implements the data center switch abnormal traffic detection device according to claim 8 when executing the computer program.

10. A computer-readable medium having a computer program stored thereon, characterized in that When the computer program is executed by a processor, the steps of the method for detecting abnormal traffic in a data center switch according to any one of claims 1 to 7 are implemented.

Images