Content distribution network flow alarm method and device and electronic equipment

Abstract

The invention provides a content distribution network traffic alarm method and device and electronic equipment, and aims to solve the problem of insufficient accuracy of abnormal traffic detection. The method comprises the following steps: acquiring a content delivery network (CDN) real-time traffic log, wherein the CDN real-time traffic log is generated by a CDN server; analyzing a plurality of dimension labels from the CDN real-time traffic log; for each label combination determined by the plurality of dimension labels, calculating the CDN real-time traffic log according to the label combination to obtain the peak traffic of the label combination; obtaining a CDN historical flow log, and calculating the baseline flow of the label combination according to the CDN historical flow log; and generating an alarm message of the CDN real-time traffic log according to the peak traffic of the label combination and the baseline traffic of the label combination, wherein the alarm message comprises the label combination and the peak traffic of the label combination.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer networks, information security and content distribution networks, in particular to a content distribution network traffic alarm method and device and electronic equipment. BACKGROUND

[0002] At present, the alarm of a content distribution network (CDN) is usually based on overall traffic data, for example, the bandwidth occupancy value of CDN traffic every 5 minutes (min) is recorded in real time within a month, a plurality of bandwidth occupancy values are obtained, and then when the sum of the plurality of bandwidth occupancy values is greater than a preset threshold, an alarm message is sent to a user terminal. This alarm mechanism based on a fixed threshold may have false positives and false negatives, and therefore cannot dynamically adapt to business fluctuations (such as promotions and live broadcasts), resulting in insufficient accuracy of abnormal traffic detection. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a content distribution network traffic alarm method, device and electronic equipment to improve the problem of insufficient accuracy of abnormal traffic detection.

[0004] The embodiments of the present application provide a content distribution network traffic alarm method, comprising: obtaining a content distribution network (CDN) real-time traffic log, wherein the CDN real-time traffic log is generated by a CDN server; parsing a plurality of dimension labels from the CDN real-time traffic log; for each label combination determined according to the plurality of dimension labels, calculating the peak traffic of the label combination according to the CDN real-time traffic log; obtaining a CDN historical traffic log, and calculating the baseline traffic of the label combination according to the CDN historical traffic log; and generating an alarm message of the CDN real-time traffic log according to the peak traffic of the label combination and the baseline traffic of the label combination, wherein the alarm message comprises the label combination and the peak traffic of the label combination. In the implementation process of the above scheme, the alarm message is generated by combining multi-dimensional label combinations for fine-grained modeling of traffic and dynamic comparison of differences between CDN real-time traffic and historical traffic, which can more sensitively capture abnormal fluctuations in specific scenarios. The multi-dimensional labels can divide the traffic into finer-grained combinations, and the peak traffic of real-time traffic and the historical baseline traffic are calculated for each label combination. Therefore, this differential analysis based on label combinations considers both the long-term regularity of traffic and the short-term mutation, and at the same time, the correlation of multi-dimensional label combinations enhances the recognition ability of complex attack patterns, thereby reducing the probability of false positives and false negatives and improving the accuracy of abnormal traffic detection.

[0005] Optionally, in the embodiment of the present application, before the plurality of dimension labels are parsed from the CDN real-time traffic log, the method further comprises: receiving a dimension label request sent by a terminal device; obtaining all dimension labels according to the dimension label request; and sending the all dimension labels to the terminal device, so that the terminal device sets a user agent field value of a CDN traffic request to a target dimension label filtered from the all dimension labels after generating the CDN traffic request for the CDN server, and sends the CDN traffic request to the CDN server, so that the CDN server generates the CDN real-time traffic log according to the CDN traffic request. In the implementation process of the above scheme, by pre-receiving the dimension label request of the terminal device and returning all dimension labels, the terminal device can filter based on the complete dimension label set, thereby ensuring the accuracy and comprehensiveness of the target dimension label, avoiding the analysis deviation of the traffic request caused by incomplete dimension labels, and improving the data quality of the CDN traffic log.

[0006] Optionally, in the embodiment of the present application, the peak traffic of the label combination is obtained by calculating the CDN real-time traffic log according to the label combination, comprising: segmenting and counting the access traffic value of the label combination in the CDN real-time traffic log in a sliding time window unit period; and determining the maximum traffic value in the plurality of access traffic values counted in the sliding time window as the peak traffic of the label combination. In the implementation process of the above scheme, by using sliding time window for segmenting and counting, the traffic change characteristics of different time periods can be dynamically captured, thereby avoiding the problems of peak traffic omission or inaccurate statistics caused by fixed time window, and improving the accuracy and timeliness of peak traffic calculation.

[0007] Optionally, in the embodiment of the present application, the alarm message of the CDN real-time traffic log is generated according to the peak traffic of the label combination and the baseline traffic of the label combination, comprising: judging whether the peak traffic of the label combination and the baseline traffic of the label combination satisfy a preset alarm condition, the preset alarm condition comprising: the absolute value of the difference between the peak traffic of the label combination and the baseline traffic of the label combination, and the ratio value between the baseline traffic of the label combination are greater than a preset ratio threshold; and if yes, generating the alarm message of the CDN real-time traffic log according to the peak traffic of the label combination. In the implementation process of the above scheme, by setting the absolute value of the difference between the peak traffic and the baseline traffic and the ratio threshold of the baseline traffic as the alarm condition, the adaptability of different traffic scale label combinations can be dynamically adapted, thereby improving the accuracy and flexibility of the alarm.

[0008] Optionally, in the embodiments of the present application, the alarm message of the CDN real-time traffic log is generated according to the peak traffic of the label combination, comprising: calculating the CDN traffic cost corresponding to the label combination according to the peak traffic of the label combination; and generating the alarm message of the label combination according to the CDN traffic cost corresponding to the label combination. In the implementation process of the above scheme, by directly associating the peak traffic of the label combination with the CDN traffic cost, the accurate identification and alarm of the abnormal traffic cost are realized, avoiding the limitation of the traditional method of only focusing on the absolute value of the traffic and ignoring the cost factor, so that the operation cost of the CDN service can be more effectively controlled. Further, based on the traffic cost of the label combination, the alarm message is generated, so that the alarm information has stronger business relevance, which can help the operation and maintenance personnel to quickly attribute and locate to the specific business scenario or user group with high cost consumption, thereby improving the pertinence and operability of the alarm.

[0009] Optionally, in the embodiments of the present application, the multiple dimension labels include: an operating system type parsed from a user agent (UA) field value of the CDN real-time traffic log, an application program version parsed from the UA field value of the CDN real-time traffic log, a business scenario domain name parsed from a uniform resource locator (URL) field value of the CDN real-time traffic log, and a CDN vendor type pre-configured in the CDN real-time traffic log; and the CDN traffic cost corresponding to the label combination is calculated according to the peak traffic of the label combination, comprising: calculating a CDN baseline cost of the label combination according to a CDN historical traffic log; obtaining a user number of the label combination composed of the operating system type and the application program version in the CDN real-time traffic, and calculating a weight ratio between the user number and a total user number of the CDN historical traffic log; obtaining an occurrence number of the business scenario domain name in the CDN real-time traffic log, and calculating a possession ratio value between the occurrence number and a total domain name number in the CDN historical traffic log; obtaining a traffic statistical value of the CDN vendor type in the CDN real-time traffic log, and calculating a sharing ratio value between the traffic statistical value and a total traffic value of the CDN real-time traffic log; and calculating the CDN traffic cost corresponding to the label combination according to the CDN baseline cost, the weight ratio, the possession ratio value, a preset business fluctuation coefficient, and the sharing ratio value. In the implementation process of the above scheme, the operating system type and the application program version are parsed from the UA field, and the business scenario domain name of the URL field and the CDN vendor type are combined to construct the multi-dimensional label combination, so as to realize the fine calculation of the CDN traffic cost. This multi-dimensional cross analysis can more accurately reflect the differential influence of different user groups, business scenarios, and CDN service providers on the traffic cost, thereby overcoming the limitation of the traditional single-dimensional traffic statistics.

[0010] The embodiment of the application further provides a content distribution network traffic alarm method, applied to a terminal device, comprising: generating a CDN traffic request for a content distribution network (CDN) server; setting a user agent field value of the CDN traffic request as a target dimension label, the target dimension label being selected from all dimension labels sent by an electronic device; sending the CDN traffic request to the CDN server, so that the CDN server generates a CDN real-time traffic log according to the CDN traffic request, the user agent field value in the CDN real-time traffic log being used to determine and calculate peak traffic of a label combination, and an alarm message of the CDN real-time traffic log being generated according to the peak traffic of the label combination and baseline traffic of the label combination, the baseline traffic of the label combination being obtained by calculation according to a CDN historical traffic log. In the implementation process of the above scheme, the user agent field value of the CDN traffic request is set as the target dimension label, thereby realizing fine classification and identification of traffic data, enabling subsequent traffic analysis and alarm to be based on specific dimension labels, and thereby improving the pertinence and accuracy of traffic monitoring. This design avoids the alarm false alarm or missing alarm problem caused by unclear dimension labels in the traditional method. Further, the user agent field value in the CDN real-time traffic log is used to determine and calculate the peak traffic of the label combination, and the alarm message is generated in combination with the baseline traffic, thereby realizing dynamic detection and rapid response of abnormal traffic, not only enabling real-time capture of traffic anomalies, but also reducing false alarms caused by temporary fluctuations through comparative analysis of historical data, and improving the reliability and timeliness of the alarm.

[0011] The embodiment of the application further provides a content distribution network traffic alarm device, comprising: a real-time traffic acquisition module, configured to acquire a content distribution network (CDN) real-time traffic log, the CDN real-time traffic log being generated by a CDN server; a dimension label analysis module, configured to analyze a plurality of dimension labels from the CDN real-time traffic log; a peak traffic acquisition module, configured to, for each label combination determined according to the plurality of dimension labels, acquire peak traffic of the label combination by calculation according to the label combination on the CDN real-time traffic log; a historical traffic acquisition module, configured to acquire a CDN historical traffic log, and calculate baseline traffic of the label combination according to the CDN historical traffic log; and an alarm message generation module, configured to generate an alarm message of the CDN real-time traffic log according to the peak traffic of the label combination and the baseline traffic of the label combination, the alarm message comprising the label combination and the peak traffic of the label combination.

[0012] Optionally, in the embodiment of the present application, the content distribution network traffic alarm device further comprises: a label request receiving module configured to receive a dimension label request sent by the terminal device; a dimension label obtaining module configured to obtain all dimension labels according to the dimension label request; and a dimension label sending module configured to send the all dimension labels to the terminal device, so that the terminal device sets a target dimension label filtered from the all dimension labels as a user agent field value of a CDN traffic request after generating the CDN traffic request for the CDN server, and sends the CDN traffic request to the CDN server, so that the CDN server generates a CDN real-time traffic log according to the CDN traffic request.

[0013] Optionally, in the embodiment of the present application, the peak traffic obtaining module comprises: a traffic segment statistical sub-module configured to periodically perform segment statistics on an access traffic value of the label combination in the CDN real-time traffic log in a sliding time window; and a peak traffic determining sub-module configured to determine a maximum traffic value in the multiple access traffic values counted in the sliding time window as the peak traffic of the label combination.

[0014] Optionally, in the embodiment of the present application, the alarm message generating module comprises: an alarm condition judging sub-module configured to judge whether the peak traffic of the label combination and the baseline traffic of the label combination satisfy a preset alarm condition, the preset alarm condition comprising: an absolute value of a difference between the peak traffic of the label combination and the baseline traffic of the label combination, and a ratio value between the peak traffic of the label combination and the baseline traffic of the label combination are greater than a preset ratio threshold; and an alarm message generating sub-module configured to generate an alarm message of the CDN real-time traffic log according to the peak traffic of the label combination if the peak traffic of the label combination and the baseline traffic of the label combination satisfy the preset alarm condition.

[0015] Optionally, in the embodiment of the present application, the alarm message generating sub-module comprises: a traffic cost calculating unit configured to calculate a CDN traffic cost corresponding to the label combination according to the peak traffic of the label combination; and an alarm message generating unit configured to generate an alarm message of the label combination according to the CDN traffic cost corresponding to the label combination.

[0016] Optionally, in the embodiment of the present application, the multiple dimension labels comprise: an operating system type parsed from a user agent (UA) field value of the CDN real-time traffic log, an application version parsed from the UA field value of the CDN real-time traffic log, a business scenario domain name parsed from a uniform resource locator (URL) field value of the CDN real-time traffic log, and a CDN vendor type pre-configured in the CDN real-time traffic log; and the traffic cost calculation unit comprises: a baseline cost calculation sub-unit configured to calculate a CDN baseline cost of the label combination according to a CDN historical traffic log; a weight proportion calculation sub-unit configured to obtain a number of users of the label combination constituted by the operating system type and the application version in the CDN real-time traffic, and calculate a weight proportion between the number of users and a total number of users in the CDN historical traffic log; an occupancy proportion calculation sub-unit configured to obtain a number of occurrences of the business scenario domain name in the CDN real-time traffic log, and calculate an occupancy proportion value between the number of occurrences and a total number of domain names in the CDN historical traffic log; a sharing ratio calculation sub-unit configured to obtain a traffic statistical value of the CDN vendor type in the CDN real-time traffic log, and calculate a sharing ratio value between the traffic statistical value and a total traffic value of the CDN real-time traffic log; and a traffic cost calculation sub-unit configured to calculate a CDN traffic cost corresponding to the label combination according to the CDN baseline cost, the weight proportion, the occupancy proportion value, a preset business fluctuation coefficient, and the sharing ratio value.

[0017] The embodiment of the present application further provides a content distribution network (CDN) traffic alarm device applied to a terminal device, comprising: a traffic request generation module configured to generate a CDN traffic request for a CDN server; a target label setting module configured to set a user agent field value of the CDN traffic request as a target dimension label, the target dimension label being selected from all dimension labels sent by an electronic device; and a traffic request sending module configured to send the CDN traffic request to the CDN server, so that the CDN server generates a CDN real-time traffic log according to the CDN traffic request, the user agent field value in the CDN real-time traffic log being used to determine and calculate a peak traffic of a label combination, and an alarm message of the CDN real-time traffic log being generated according to the peak traffic of the label combination and a baseline traffic of the label combination, the baseline traffic of the label combination being calculated according to a CDN historical traffic log.

[0018] The embodiment of the present application further provides an electronic device, comprising: a processor and a memory, the memory storing machine readable instructions executable by the processor, and the machine readable instructions being executed by the processor to perform the method described above.

[0019] The embodiment of the present application further provides a computer readable storage medium, the computer readable storage medium storing a computer program, and the computer program being executed by the processor to perform the method described above.

[0020] The embodiment of the present application further provides a computer program product, comprising: a computer program or computer instruction, which, when executed by a processor, performs the method described above. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some of the embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0022] Figure 1 The flowchart of the content distribution network traffic alarm method executed by the electronic device provided by the embodiment of the present application is shown; Figure 2 The flowchart of the content distribution network traffic alarm method executed by the terminal device provided by the embodiment of the present application is shown; Figure 3 The structural diagram of the content distribution network traffic alarm device provided by the embodiment of the present application is shown; Figure 4 The structural diagram of the electronic device provided by the embodiment of the present application is shown. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solutions and advantages of the embodiments of the present application more clear, the following will combine the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. It should be understood that the drawings in the embodiments of the present application only serve the purpose of description and illustration, and do not limit the scope of protection of the embodiments of the present application. In addition, it should be understood that the schematic drawings are not drawn to scale. The flowchart used in the embodiments of the present application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented in sequence, and the steps without logical context relationship can be reversed in sequence or implemented simultaneously. In addition, one or more other operations can be added to the flowchart or removed from the flowchart under the guidance of the content of the embodiments of the present application.

[0024] In addition, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. The components of the embodiments of the present application described and shown in the drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed embodiments of the present application, but only represents selected embodiments of the present application.

[0025] It can be understood that, in the embodiments of the present application, "first", "second" are used to distinguish similar objects. Those skilled in the art can understand that "first", "second" and the like do not limit the quantity and execution order, and "first", "second" and the like do not necessarily mean different. In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the three cases of A alone, A and B together, and B alone. In addition, the character " / " in this paper generally represents that the front and rear associated objects are a "or" relationship. The term "multiple" refers to two or more (including two), and similarly, "multiple groups" refers to two or more groups (including two groups).

[0026] It should be noted that the content distribution network traffic alarm method provided by the embodiments of the present application can be executed by an electronic device, and the electronic device herein refers to a device terminal or a server having the function of executing a computer program, for example: a smart phone, a personal computer, a tablet computer, a personal digital assistant or a mobile Internet device. The server refers to a device that provides computing services through a network, and the server includes: x86 servers and non-x86 servers, non-x86 servers include: mainframes, minicomputers and UNIX servers.

[0027] At present, the traffic alarm mechanism commonly used by content distribution network (CDN) service providers is based on the comparison between the monitoring of overall traffic data and the preset fixed threshold. Specifically, this mechanism usually continuously collects and records the bandwidth occupation values of the CDN network at every five-minute (min) time interval within an operation period (for example, one month). The system calculates and monitors the aggregation indicators (for example, the sum, average or peak value of multiple bandwidth occupation values within a certain time period) of these discrete bandwidth data points in real time. When the aggregation indicator exceeds the preset fixed threshold, the alarm process is triggered, and an alarm message is sent to the user terminal. At the same time, in terms of billing mode, the mainstream CDN manufacturers calculate the bandwidth value at the 95th percentile within the month as the basis for charging based on the same granularity of five-minute bandwidth value records, that is, the "month 95 bandwidth" principle.

[0028] However, the prior art solution has significant defects. First, the alarm mechanism based on fixed threshold lacks dynamic adaptability. Since the traffic carried by CDN naturally fluctuates, during business peak periods such as e-commerce promotion activities, large online live broadcasts, etc., the traffic will show significant normal growth. At this time, the fixed threshold is easily triggered by normal peak traffic, generating a large number of invalid alarms (false positives), seriously interfering with the judgment of operation and maintenance, and reducing the alarm credibility. In order to avoid frequent false positives, the threshold is often set relatively high in practice, but this leads to the fact that during non-peak periods or business stable periods, real abnormal traffic (such as malicious crawlers, distributed denial of service attacks, traffic leakage caused by program errors, etc.) cannot be effectively identified (i.e. missed) because it does not reach the high threshold. Second, in terms of cost analysis, the limited and fragmented log data provided by manufacturers, mostly only the first 1000 data, cannot achieve business-level analysis capabilities. These log data lack the ability to associate and map with specific business lines, application programs (such as App applications, HTML5 page access), or traffic source types (such as algorithm machine traffic), and cannot support in-depth business dimension analysis.

[0029] From the above analysis, it can be seen that the existing alarm mechanism based on fixed threshold cannot effectively distinguish between normal business fluctuations and real abnormal traffic, resulting in a serious lack of accuracy in abnormal traffic detection. Specifically, the lack of adaptability of fixed threshold to business dynamics is the root cause of frequent false positives and false negatives. False positives result from the inability to identify reasonable high business load, and false negatives result from the forced setting of a loose threshold to avoid false positives. This lack of detection accuracy is further magnified under the multi-cloud CDN deployment and "month 95" billing mode: when the 95 peak of a certain CDN node abnormally rises, due to the inability to accurately and quickly identify the specific abnormal source that constitutes the peak from the massive traffic, it is impossible to perform business-level traffic effective decomposition, cost attribution and root cause positioning, such as identifying which App function, which HTML5 page or which type of algorithm machine traffic exists unreasonable consumption, and distinguishing whether it belongs to attack or configuration error. Therefore, enterprises have difficulty in implementing targeted cost optimization measures (such as governing specific businesses, banning malicious sources, and repairing configuration errors), ultimately leading to uncontrollable growth of CDN cloud costs. The existing alarm mechanism based on fixed threshold cannot effectively distinguish between normal business fluctuations and real abnormal traffic, and the limited analysis tools provided by existing manufacturers cannot make up for this core capability gap. It can be seen that the accuracy of current abnormal traffic detection is seriously insufficient.

[0030] See Figure 1The content distribution network traffic alarm method provided by the embodiment of the application is shown in the flowchart of the electronic device; the main idea of the content distribution network traffic alarm method is to generate an alarm message by combining multi-dimensional label combination for fine modeling of traffic and dynamic comparison of differences between real-time traffic and historical traffic of the content distribution network (CDN), and the correlation of multi-dimensional label combination enhances the recognition ability of complex attack patterns, thereby reducing the probability of false positives and false negatives and improving the accuracy of abnormal traffic detection. The implementation of the content distribution network traffic alarm method described above can include: Step S110: Obtain a content distribution network (CDN) real-time traffic log, which is generated by a CDN server.

[0031] Content distribution network (CDN) is a technology that distributes static or dynamic resources of a website or application to the nearest node from the user through distributed node technology, thereby improving access speed and stability, reducing network delay and congestion. Through caching mechanism, intelligent routing and load balancing, the user's access experience is optimized.

[0032] The CDN real-time traffic log is a real-time record of user access behavior generated by the CDN server. The traffic log can include fields such as user agent (User-Agent, UA), access IP address, access URL, etc. For example, when a user accesses a video website through CDN, the CDN server will record the user's access time, requested URL (such as example.com / video.mp4), client IP (such as 192.168.1.1), etc. to form a real-time traffic log.

[0033] In the specific practice process, in view of the log differences of different CDN manufacturers, the logs of different CDN manufacturers can be standardized through a field mapping table, so as to uniformly process the log data formats of different CDN manufacturers. Similarly, there may be sampling rate differences or time zone differences among various CDN manufacturers. After collecting the real-time traffic logs of various CDN manufacturers, all timestamps in the real-time traffic logs of various CDN manufacturers can be converted into a unified format, and low sampling rate logs can also be enlarged according to the proportion, so as to be counted according to the same sampling rate.

[0034] Step S120: Parse a plurality of dimensional labels from the CDN real-time traffic log.

[0035] The multi-dimensional label is a plurality of feature fields extracted from the CDN log and used to identify different business scenarios or user attributes. The multi-dimensional label can include an operating system type, an application version, a business scenario domain name, and a CDN vendor type. The operating system type can be parsed from a User-Agent (UA) field value in the CDN real-time traffic log (e.g., iOS 14.5). The application version can be parsed from the UA field value in the CDN real-time traffic log (e.g., App v2.3.0). The business scenario domain name can be parsed from a uniform resource locator (URL) field value in the CDN real-time traffic log (e.g., example.com / video). The CDN vendor type can be a log source identifier pre-configured in the CDN real-time traffic log. Through analysis and alarm generation of the multi-dimensional label combination, various possible traffic anomaly scenarios in the CDN network can be covered, including but not limited to abnormal traffic in a specific region, specific content, or specific time period, thereby enhancing the overall monitoring capability and response speed of the system.

[0036] Step S130: For each label combination determined for the plurality of dimensions, a peak traffic of the label combination is obtained by calculating the CDN real-time traffic log according to the label combination.

[0037] The label combination is a business scenario uniquely identified by a plurality of dimension labels (e.g., operating system, domain name, and CDN vendor). For example, if the label combination is "iOS + App v2.3.0 + example.com / video + A vendor CDN", the label combination corresponds to a business scenario of "iOS user accessing a video through A vendor CDN".

[0038] The peak traffic can be the highest traffic value of the label combination in a sliding time window (e.g., 30 minutes or 1 hour), or a monthly 95th percentile bandwidth value.

[0039] Step S140: Obtain a CDN historical traffic log and calculate a baseline traffic of the label combination according to the CDN historical traffic log.

[0040] The baseline traffic is a normal traffic reference value of the label combination calculated according to the CDN historical traffic log. The CDN historical traffic log is historical data of user access behaviors generated by the CDN server for the same label combination.

[0041] It can be understood that when there is no CDN historical traffic log or the CDN historical traffic log cannot be obtained, the baseline traffic of the same type of business tag combination can be used as the baseline traffic of the tag combination, for example: if there is no historical traffic log when a new version of a short video App is put into operation, it is impossible to calculate its "baseline traffic", at this time, an existing tag combination with similar business type and similar user behavior can be found, and its baseline traffic can be borrowed as a reference (such as a highly similar tag combination in business scene, user group and access mode).

[0042] Step S150: generating an alarm message of the CDN real-time traffic log according to the peak traffic of the tag combination and the baseline traffic of the tag combination, the alarm message including the tag combination and the peak traffic of the tag combination.

[0043] The alarm message is an abnormal information alarm notification message automatically generated by the system when the peak traffic of the tag combination and the baseline traffic of the tag combination meet the preset alarm condition. The alarm message can include the tag combination and the peak traffic of the tag combination. It can be understood that the above-mentioned alarm message contains the tag combination and the peak traffic information, so that the operation and maintenance personnel can quickly locate the specific source and characteristics of the abnormal traffic, reduce the time and complexity of troubleshooting, and improve the operation and maintenance efficiency.

[0044] In the implementation process of the above scheme, by combining multi-dimensional tag combination for fine-grained modeling of traffic, and dynamically comparing differences between content distribution network CDN real-time traffic and historical traffic to generate an alarm message, abnormal fluctuations in specific scenarios can be more sensitively captured. The multi-dimensional tags can divide the traffic into finer-grained combinations, and the peak traffic and historical baseline traffic of real-time traffic are calculated for each tag combination. Therefore, this differential analysis based on tag combination not only considers the long-term regularity of traffic, but also focuses on short-term mutations, and at the same time, the recognition ability for complex attack patterns is enhanced through the correlation of tags, thereby reducing the probability of false positives and omissions, and improving the accuracy of abnormal traffic detection.

[0045] As an optional implementation of the above step S110, for example: the CDN server can send the content distribution network CDN real-time traffic log to the electronic device (such as a private domain server) at a regular time. Of course, the electronic device can also directly pull or obtain the content distribution network CDN real-time traffic log from the CDN server.

[0046] As an optional implementation of the above step S120, before the multi-dimensional tags are parsed from the CDN real-time traffic log, the User-Agent (User-Agent, UA) field value in the CDN traffic request can also be modified. The specific modification process can include: Step S121: The electronic device receives the dimension label request sent by the terminal device.

[0047] For example, the terminal device can request the dimension label according to specific conditions, that is, the terminal device can generate a dimension label request according to specific conditions, and then send the dimension label request to the electronic device through the HyperText Transfer Protocol (HTTP). The electronic device can be a server, and all dimension labels are stored on the server. The electronic device can receive the dimension label request sent by the terminal device through the HTTP protocol.

[0048] Step S122: The electronic device obtains all dimension labels according to the dimension label request.

[0049] For example, all dimension labels can be set according to specific conditions. Assuming that the dimension labels include operating system type, application version, accompanying version number, and business purpose, after receiving the dimension label request sent by the terminal device, the electronic device can read the operating system type, application version, accompanying version number, and business purpose corresponding to the dimension label request from the database or file system.

[0050] Step S123: The electronic device sends all dimension labels to the terminal device, so that the terminal device sets the user agent field value of the CDN traffic request to the target dimension label filtered from all dimension labels after generating the CDN traffic request to the CDN server, and sends the CDN traffic request to the CDN server, so that the CDN server generates a CDN real-time traffic log according to the CDN traffic request.

[0051] For example, the electronic device sends all dimension labels to the terminal device. The terminal device can set the user agent field value of the CDN traffic request to the target dimension label filtered from all dimension labels after generating the CDN traffic request to the CDN server, and send the CDN traffic request to the CDN server. It can be understood that through the cooperative interaction of the terminal device and the CDN server, the dynamic transmission and log generation of the dimension label are realized, so that the dimension information of the traffic log can reflect the actual demand of the terminal device in real time, and the real-time and pertinence of the CDN traffic analysis are enhanced, providing more accurate data support for subsequent traffic optimization. In the implementation process of the above scheme, the target dimension label is dynamically set to the user agent field value of the CDN traffic request, realizing flexible binding of the dimension label and the traffic request, so that the CDN server can directly generate a real-time traffic log containing multi-dimensional information according to the request, simplifying the complexity of subsequent log analysis and improving the data processing efficiency.

[0052] As an optional implementation of the above step S120, for example, after the electronic device described above obtains the CDN real-time traffic log, it can further parse multiple dimension tags from the CDN real-time traffic log. The multiple dimension tags can include operating system type, application program version, business scenario domain name, CDN vendor type, etc. The rules of the multiple dimension tags can be pre-set tagging rules, such as standardized data tagging rules established by using access URL address, access IP address, and user agent (UA) field value. Alternatively, traffic source data information can also be analyzed from the CDN real-time traffic log. The traffic source data information can include 5-minute online user number, video playback time length, picture loading time length, file download number, and APP release situation, etc. By parsing multiple dimension tags from the CDN real-time traffic log and calculating peak traffic for each tag combination, fine-grained monitoring and analysis of CDN traffic can be achieved, so as to more accurately identify abnormal traffic patterns and avoid potential problems that may be missed by traditional single-dimension monitoring, thereby improving the accuracy and comprehensiveness of the alarm.

[0053] As an optional implementation of the above step S130, the implementation of calculating the peak traffic of the tag combination from the CDN real-time traffic log according to the tag combination can include: Step S131: segmentally count the access traffic value of the tag combination in the CDN real-time traffic log in a sliding time window unit period.

[0054] The sliding time window is a time period (such as 10 minutes, 20 minutes, or 30 minutes). The system slides forward every certain time (such as every minute) to count the traffic data in the time period, so as to realize continuous and dynamic monitoring of the traffic and avoid missing sudden peaks.

[0055] It can be understood that the window length and step length of the sliding time window can be dynamically configured according to the business scenario. For example, during the large promotion of e-commerce activities, the window length of the sliding time window can be set to 5 minutes, and the step length of the sliding time window can be set to 1 minute. During monthly cost analysis, the window length of the sliding time window can be set to 30 days, and the step length of the sliding time window can be set to 1 day.

[0056] The implementation of the above step S131 is, for example: assuming that the service to be analyzed is a certain short video App, and the above label combination is operating system type = Android, application version = v3.1.0, service scenario domain name = shortvideo.com, CDN vendor type = A vendor, hereinafter referred to as label combination A, and the monitoring time is August 5, 2025 18:00-19:00, the sliding time window is 30 minutes (i.e. statistics once every 30 minutes), and the access traffic value (such as bandwidth number) of the label combination in the CDN real-time traffic log is segmented and counted. By segmenting and counting the access traffic value of the label combination, the peak traffic can be calculated for different label combinations, thereby realizing fine-grained monitoring and analysis of CDN traffic and providing a reliable data foundation for subsequent traffic prediction and anomaly detection.

[0057] It can be understood that the above-mentioned access traffic value is, for example, the network traffic generated by a certain label combination within a certain period of time, which is usually expressed in “bandwidth” (such as Mbps) or “traffic volume” (such as GB). The system divides the time into multiple 30-minute sliding windows and counts the total traffic (in “GB”) of label combination A in each window, and the statistical results are as follows:

[0058] Step S132: determining the maximum traffic value in the multiple access traffic values counted in the sliding time window as the peak traffic of the label combination.

[0059] The implementation of the above step S132 is, for example: in all the above sliding windows, find the maximum access traffic value of label combination A: the maximum value appears in the 18:30-19:00 window, and the traffic is 18 GB. Therefore, the system determines 18 GB as the peak traffic of the label combination in the current monitoring period. Among them, the peak traffic is the maximum value in the access traffic value of the label combination in the sliding time window, to reflect the highest load faced by the label combination in a short time. It can be understood that determining the maximum traffic value counted in the sliding time window as the peak traffic can effectively identify the traffic burst in a short time, provide more accurate data support for CDN resource scheduling and traffic management, and help optimize the allocation and utilization of network resources.

[0060] Optionally, after determining the peak traffic of the label combination, the peak traffic of the label combination can be compared with a preset standard threshold. If the peak traffic of the label combination exceeds the preset standard threshold, the service change of the label combination is disassembled, and a custom disassembly rule is formulated, for example, a custom data consumption rule of the business scenario domain name-operation system type-user agent (UA)-access path (URL), and then the custom data consumption rule is used to analyze the service change of the label combination.

[0061] As an optional implementation of the above step S140, for example, the CDN historical traffic log is obtained from the traffic log database or the traffic log file, and the baseline traffic of the label combination is calculated according to the CDN historical traffic log. It can be understood that the process of calculating the baseline traffic of the label combination according to the CDN historical traffic log here is the same as the process of calculating the baseline traffic of the label combination according to the CDN real-time traffic log in the above step S130, and therefore, the above step S130 is not repeated here, and if there is any unclear place, it can be referred to the implementation of calculating the baseline traffic of the label combination according to the CDN real-time traffic log in the above step S130. Optionally, the baseline traffic can be calculated by combining the CDN historical traffic log, and compared with the real-time peak traffic to generate an alarm message, which can dynamically adjust the alarm threshold to avoid false positives or false negatives caused by the static threshold, thereby improving the reliability and adaptability of the alarm.

[0062] As an optional implementation of the above step S150, the above implementation of generating the alarm message of the CDN real-time traffic log according to the peak traffic of the label combination and the baseline traffic of the label combination can include: Step S151: determining whether the peak traffic of the label combination and the baseline traffic of the label combination satisfy a preset alarm condition. The preset alarm condition includes that the absolute value of the difference between the peak traffic of the label combination and the baseline traffic of the label combination, and the proportional value between the peak traffic of the label combination and the baseline traffic of the label combination are greater than a preset proportional threshold.

[0063] An implementation of the step S151 can be, for example, that the electronic device (e.g., a server) can determine whether the peak traffic of the label combination and the baseline traffic of the label combination satisfy a preset alarm condition. The preset alarm condition can include that an absolute value of a difference between the peak traffic of the label combination and the baseline traffic of the label combination and a ratio value between the peak traffic of the label combination and the baseline traffic of the label combination are greater than a preset ratio threshold. The preset ratio threshold can be set according to specific conditions, for example, 5% or 10%, and of course, in the specific implementation process, the preset ratio threshold can also be dynamically adjusted according to business events, for example, when a new version of a short video application is put into operation, the preset ratio threshold can be relaxed to 20%. It can be understood that, in the above scheme, the ratio threshold is used instead of a fixed threshold for alarm determination, that is, the absolute value of the difference between the peak traffic of the label combination and the baseline traffic of the label combination and the ratio value between the peak traffic of the label combination and the baseline traffic of the label combination are used for alarm determination, which can effectively distinguish normal traffic fluctuations and abnormal traffic mutations, reduce false positives caused by natural traffic fluctuations, and improve the accuracy and reliability of the alarm system.

[0064] Step S152: If the peak traffic of the label combination and the baseline traffic of the label combination satisfy the preset alarm condition, an alarm message of the CDN real-time traffic log is generated according to the peak traffic of the label combination.

[0065] It can be understood that, if the preset ratio threshold is set to 5%, when the absolute value of the difference between the peak traffic of the label combination and the baseline traffic of the label combination and the ratio value between the peak traffic of the label combination and the baseline traffic of the label combination are greater than 5%, the alarm message of the CDN real-time traffic log can be generated according to the peak traffic of the label combination. In the above implementation, the workload of manual monitoring is reduced, the operation and maintenance efficiency is improved, and the timely discovery and processing of abnormal conditions are ensured. Further, by combining the relative changes of the peak traffic and the baseline traffic for alarm determination, the traffic anomaly pattern can be more accurately captured, potential network attacks or system failures can be timely discovered, and the security and stability of the CDN system are improved.

[0066] As an optional implementation of the step S152, the implementation of generating the alarm message of the CDN real-time traffic log according to the peak traffic of the label combination can include: Step S152a: The CDN traffic cost corresponding to the label combination is calculated according to the peak traffic of the label combination.

[0067] Step S152b: The alarm message of the label combination is generated according to the CDN traffic cost corresponding to the label combination.

[0068] In the implementation process of the above scheme, the traffic cost is generated based on the label combination to generate an alarm message, so that the alarm information has stronger business relevance, can help the operation and maintenance personnel to quickly attribute and locate the specific business scenario or user group with high cost consumption, and improves the pertinence and operability of the alarm.

[0069] As an optional implementation of the above step S152a, the multiple dimension labels can include: an operating system type parsed from a user agent (UA) field value of the CDN real-time traffic log, an application version parsed from the UA field value of the CDN real-time traffic log, a business scenario domain name parsed from a uniform resource locator (URL) field value of the CDN real-time traffic log, and a CDN vendor type pre-configured in the CDN real-time traffic log. The implementation of calculating the CDN traffic cost corresponding to the label combination according to the peak traffic of the label combination can include: Step S152c: calculating the CDN baseline cost of the label combination according to the CDN historical traffic log.

[0070] The CDN baseline cost is calculated from the CDN historical traffic data according to a preset period. For example, if the preset period is a month, the CDN traffic cost of the last month or the CDN traffic cost of the last month allocated to each domain name can be obtained.

[0071] For example, assuming that the traffic surge scenario occurs, the data analysis device can be used to analyze the CDN real-time traffic log and the CDN historical traffic log according to the pre-configured tagging rule. For example, the CDN baseline cost corresponding to the last month of the label combination is calculated according to the CDN historical traffic log, and the online user number, video play time, picture loading amount, file download number, and CDN vendor type in the sliding window can also be queried.

[0072] Step S152d: obtaining the user number of the label combination composed of the operating system type and the application version in the CDN real-time traffic, and calculating the weight ratio between the user number and the total user number of the CDN historical traffic log.

[0073] The implementation of step S152d is as follows: The electronic device can analyze the number of users of the label combination of the operating system type and the application program version in the CDN real-time traffic from the CDN real-time traffic log. Then, the total number of users of the label combination in the CDN historical traffic log is analyzed, and the weight ratio between the number of users and the total number of users in the CDN historical traffic log is calculated, that is, the weight ratio between the number of access users in the peak period of the CDN real-time traffic log and the number of access users in the peak period of the CDN historical traffic log is calculated. In the implementation of the above scheme, by calculating the weight ratio of the number of users of the operating system type and the application program version combination, the change of the traffic contribution of different terminal user groups can be dynamically reflected. This weight calculation method based on user group subdivision can more accurately identify the user group with high traffic consumption, and provide targeted basis for cost optimization. Further, through the cost alarm of the label combination dimension, the abnormal traffic pattern of a specific business or user can be found in time, which provides data support for subsequent traffic optimization and cost allocation, and helps to realize more refined CDN resource management and cost control.

[0074] Step S152e: Obtain the number of occurrences of the business scenario domain name in the CDN real-time traffic log, and calculate the possession ratio value between the number of occurrences and the total number of domain names in the CDN historical traffic log.

[0075] The implementation of step S152e is as follows: The number of occurrences of the business scenario domain name is counted from the CDN real-time traffic log, and the possession ratio value between the number of occurrences and the total number of domain names in the CDN historical traffic log is calculated. The CDN real-time traffic log here can be the traffic of Android / ios devices of the client (C end) or the access traffic of python intranet machines of the browser end (B end). By using the occurrence possession ratio value calculation of the business scenario domain name, the traffic characteristics of different business scenarios can be effectively captured. This traffic analysis based on the business dimension can identify high-frequency access business scenarios, help optimize resource allocation, and reduce the cost waste caused by business fluctuations.

[0076] Step S152f: Obtain the traffic statistical value of the CDN manufacturer type in the CDN real-time traffic log, and calculate the sharing ratio value between the traffic statistical value and the total traffic value of the CDN real-time traffic log.

[0077] The implementation of step S152f is, for example, obtaining the CDN provider type traffic statistics value in the CDN real-time traffic log through an executable program, and calculating the sharing ratio value between the traffic statistics value and the total traffic value of the CDN real-time traffic log. The sharing ratio value can be a PCDN sharing rate value, that is, the proportion value of content sharing and dissemination between the private content delivery network (PCDN) and the CDN. Through the calculation of the CDN provider type traffic sharing ratio value, the differentiated evaluation of the traffic cost of different CDN service providers is realized. This service provider dimension-based cost analysis can compare the actual traffic performance of each CDN provider, providing data support for service provider selection and cost control.

[0078] Step S152g: Calculate the CDN traffic cost corresponding to the label combination according to the CDN baseline cost, the weight proportion, the possession proportion value, the preset business fluctuation coefficient and the sharing ratio value.

[0079] The implementation of step S152g is, for example, using the formula The CDN baseline cost, the weight proportion, the possession proportion value, the preset business fluctuation coefficient and the sharing ratio value are calculated to obtain the CDN traffic cost corresponding to the label combination. Among them, The label combination corresponds to the CDN traffic cost, b represents the CDN baseline cost (Baseline cost), such as the preset period is month, which can be the CDN traffic cost of last month, or the CDN traffic cost of last month allocated to each domain name, w represents the weight ratio (Weight ratio), which can be understood as the weight ratio between the number of access users in the peak period of the CDN real-time traffic log and the number of access users in the peak period of the CDN historical traffic log, o represents the occupancy ratio value (Occupancy ratio value), such as the occupancy ratio value of a certain business scenario domain name, p represents the preset business fluctuation coefficient (Preset business fluctuation coefficient), which is a fluctuation coefficient set by a person according to the situation, which can be set as a fluctuation coefficient within 5% (such as-5% to +5%), and s represents the sharing ratio value (Sharing ratio value). The above preset business fluctuation includes: the APP download installation package becomes larger when a new product is released, the video playback time becomes longer when a new video playback entrance is online, and the business impact indicators such as abnormal App picture cropping and non-splicing picture scaling parameters. In the above scheme implementation process, by comprehensively considering the CDN baseline cost, the weight ratio, the occupancy ratio value and the sharing ratio value and introducing the preset business fluctuation coefficient, a dynamic traffic cost calculation model is constructed. This multi-dimensional cost calculation method can more comprehensively reflect the traffic cost composition in the actual business scenario, and improve the accuracy of cost prediction.

[0080] Optionally, the billing period of the CDN cost can be gradually disassembled through the above formula. Here, only domain names are taken as examples to illustrate that the CDN traffic cost corresponding to the label combination can be attributed to the CDN traffic cost of specific subdomain names. For example, the "monthly 95 bandwidth" traffic cost corresponding to the business domain name field in the label combination can be converted into the weighted result of the "monthly 95 bandwidth" traffic cost of each subdomain name. The formula can be expressed as ; wherein, represents the "monthly 95 bandwidth" traffic cost of the i-th subdomain name in the label combination, represents the "monthly 95 bandwidth" of the i-th subdomain name in the label combination, represents the sum value of the "monthly 95 bandwidth" of each subdomain name in the label combination, represents the CDN traffic cost corresponding to the label combination.

[0081] In the implementation process of the above scheme, the operating system type and the application program version are parsed from the UA field, and a multi-dimensional label combination is constructed by combining the service scenario domain name and the CDN manufacturer type of the URL field, so that the fine calculation of the CDN traffic cost is realized. The multi-dimensional cross analysis can more accurately reflect the differentiated influence of different user groups, service scenarios and CDN service providers on the traffic cost, thereby overcoming the limitations of the traditional single-dimensional traffic statistics.

[0082] As an optional implementation of the above step S152b, for example: judging whether the CDN traffic cost corresponding to the label combination and the CDN baseline cost corresponding to the label combination exceed a preset threshold, if the CDN traffic cost corresponding to the label combination and the CDN baseline cost corresponding to the label combination exceed the preset threshold, generating an alarm message of the label combination according to the label combination and the CDN traffic cost corresponding to the label combination. The traffic cost of the label combination is used to generate the alarm message, so that the alarm information has stronger business relevance, can help the operation and maintenance personnel to quickly locate the specific business scenario or user group with high cost consumption, improves the pertinence and operability of the alarm, thereby realizing the automatic conversion from the original traffic data to the business cost index, reducing the manual calculation and judgment link, improving the response speed and accuracy of the alarm system, and reducing the work burden of the operation and maintenance personnel.

[0083] In the implementation process of the above scheme, the CDN real-time traffic log and the CDN historical traffic log are decomposed into multiple dimension labels such as operating system type, application program version, service scenario domain name and CDN manufacturer type, so as to map and aggregate these multiple dimension labels into various label combinations according to the dynamic rules pre-configured by the system, and generate the alarm message of the CDN real-time traffic log according to the peak traffic and the baseline traffic of the label combination, so as to effectively perform traffic decomposition, cost attribution and root cause positioning to the corresponding business scenario corresponding to the label combination.

[0084] Please refer to Figure 2 The terminal device executes the content distribution network traffic alarm method provided by the embodiment of the application. The embodiment of the application also provides a content distribution network traffic alarm method executed by a terminal device. The implementation manner of the method can include: Step S210: The terminal device generates a CDN traffic request for a content distribution network (CDN) server.

[0085] The implementation of the step S210 is, for example, that the terminal device can request the dimension label according to the specific situation, that is, the terminal device can generate a dimension label request according to the specific situation, and then the terminal device can send the dimension label request to the electronic device through the hypertext transfer protocol (HTTP). The electronic device receives the dimension label request sent by the terminal device, obtains all the dimension labels according to the dimension label request, and then sends all the dimension labels to the terminal device.

[0086] The step S220 is that the terminal device sets the user agent field value of the CDN traffic request to the target dimension label, and the target dimension label is selected from the all dimension labels sent by the electronic device.

[0087] The implementation of the step S210 is, for example, that after the terminal device generates the CDN traffic request to the CDN server, the terminal device sets the user agent field value of the CDN traffic request to the target dimension label selected from the all dimension labels, and sends the CDN traffic request to the CDN server. It can be understood that by selecting the target dimension label from the all dimension labels sent by the electronic device, the priority monitoring and alarm of the key dimension are realized, and the resource allocation and monitoring efficiency are optimized. This selection mechanism ensures that the system can concentrate resources to process the dimension label that is most likely to cause problems, thereby improving the efficiency and response speed of the overall monitoring system.

[0088] The step S230 is that the terminal device sends the CDN traffic request to the CDN server, so that the CDN server generates the CDN real-time traffic log according to the CDN traffic request, the user agent field value of the CDN real-time traffic log is used to determine and calculate the peak traffic of the label combination, and the alarm message of the CDN real-time traffic log is generated according to the peak traffic of the label combination and the baseline traffic of the label combination, and the baseline traffic of the label combination is calculated according to the CDN historical traffic log.

[0089] It can be understood that the implementation of the step S230 is the same as or similar to the implementation of the steps S110 to S150, and details are not repeated here. If there is any unclear place, please refer to the implementation of the steps S110 to S150.

[0090] In the implementation process of the above scheme, the user agent field value of the CDN traffic request is set as the target dimension label, thereby realizing fine classification and identification of the traffic data, enabling subsequent traffic analysis and alarm to be based on specific dimension labels, and improving the pertinence and accuracy of traffic monitoring. This design avoids the false alarm or missed alarm problem caused by unclear dimension labels in the traditional method. In addition, the user agent field value in the CDN real-time traffic log is used to determine and calculate the peak traffic of the label combination, and an alarm message is generated in combination with the baseline traffic, thereby realizing dynamic detection and rapid response of abnormal traffic, which not only can capture traffic abnormalities in real time, but also can reduce false alarms caused by temporary fluctuations through comparison and analysis of historical data, and improve the reliability and timeliness of the alarm.

[0091] Referring to Figure 3 The content distribution network traffic alarm device provided by the embodiment of the application is shown in the structural schematic diagram; the embodiment of the application provides a content distribution network traffic alarm device 300, which comprises: The real-time traffic acquisition module 310 is configured to acquire a content distribution network (CDN) real-time traffic log, wherein the CDN real-time traffic log is generated by a CDN server.

[0092] The dimension label analysis module 320 is configured to analyze a plurality of dimension labels from the CDN real-time traffic log.

[0093] The peak traffic obtaining module 330 is configured to, for each label combination determined according to the plurality of dimension labels, calculate the peak traffic of the label combination according to the CDN real-time traffic log.

[0094] The historical traffic acquisition module 340 is configured to acquire a CDN historical traffic log, and calculate the baseline traffic of the label combination according to the CDN historical traffic log.

[0095] The alarm message generation module 350 is configured to generate an alarm message of the CDN real-time traffic log according to the peak traffic of the label combination and the baseline traffic of the label combination, wherein the alarm message comprises the label combination and the peak traffic of the label combination.

[0096] As an optional implementation of the above device, the content distribution network traffic alarm device further comprises: The label request receiving module is configured to receive a dimension label request sent by a terminal device.

[0097] The dimension label acquisition module is configured to acquire all dimension labels according to the dimension label request.

[0098] The dimension label sending module is configured to send all the dimension labels to the terminal device, so that the terminal device sets a target dimension label filtered from the all dimension labels as a user agent field value of a CDN traffic request after generating the CDN traffic request for the CDN server, and sends the CDN traffic request to the CDN server, so that the CDN server generates a CDN real-time traffic log according to the CDN traffic request.

[0099] As an optional implementation of the above device, the peak traffic obtaining module comprises: The traffic segment statistical sub-module is configured to periodically perform segment statistics on the access traffic value of the label combination in the CDN real-time traffic log in a sliding time window.

[0100] The peak traffic determining sub-module is configured to determine a maximum traffic value in the plurality of access traffic values obtained in the sliding time window as the peak traffic of the label combination.

[0101] As an optional implementation of the above device, the alarm message generating module comprises: The alarm condition judging sub-module is configured to judge whether the peak traffic of the label combination and the baseline traffic of the label combination satisfy a preset alarm condition, and the preset alarm condition comprises that an absolute value of a difference between the peak traffic of the label combination and the baseline traffic of the label combination is greater than a preset absolute threshold, and a ratio value between the peak traffic of the label combination and the baseline traffic of the label combination is greater than a preset ratio threshold.

[0102] The alarm message generating sub-module is configured to generate an alarm message of the CDN real-time traffic log according to the peak traffic of the label combination if the peak traffic of the label combination and the baseline traffic of the label combination satisfy the preset alarm condition.

[0103] As an optional implementation of the above device, the alarm message generating sub-module comprises: The traffic cost calculation unit is configured to calculate a CDN traffic cost corresponding to the label combination according to the peak traffic of the label combination.

[0104] The alarm message generating unit is configured to generate an alarm message of the label combination according to the CDN traffic cost corresponding to the label combination.

[0105] As an optional implementation of the above device, the plurality of dimension labels comprise an operating system type parsed from a user agent (UA) field value of the CDN real-time traffic log, an application program version parsed from the UA field value of the CDN real-time traffic log, a business scenario domain name parsed from a uniform resource locator (URL) field value of the CDN real-time traffic log, and a CDN vendor type pre-configured in the CDN real-time traffic log; and the traffic cost calculation unit comprises: The baseline cost calculation sub-unit is configured to calculate CDN baseline cost of the label combination according to CDN historical traffic logs.

[0106] The weight ratio calculation sub-unit is configured to obtain the number of users of the label combination composed of the operating system type and the application version in CDN real-time traffic, and calculate the weight ratio between the number of users and the total number of users in CDN historical traffic logs.

[0107] The possession ratio calculation sub-unit is configured to obtain the number of occurrences of the business scenario domain name in CDN real-time traffic logs, and calculate the possession ratio value between the number of occurrences and the total number of domain names in CDN historical traffic logs.

[0108] The sharing ratio calculation sub-unit is configured to obtain the traffic statistics value of the CDN vendor type in CDN real-time traffic logs, and calculate the sharing ratio value between the traffic statistics value and the total traffic value in CDN real-time traffic logs.

[0109] The traffic cost calculation sub-unit is configured to calculate CDN traffic cost corresponding to the label combination according to CDN baseline cost, weight ratio, possession ratio value, preset business fluctuation coefficient and sharing ratio value.

[0110] Embodiments of the present application also provide a content distribution network traffic alarm device, comprising: The traffic request generation module is configured to generate a CDN traffic request for a content distribution network CDN server.

[0111] The target label setting module is configured to set the user agent field value of the CDN traffic request as a target dimension label, which is selected from all dimension labels sent by the electronic device.

[0112] The traffic request sending module is configured to send the CDN traffic request to the CDN server, so that the CDN server generates CDN real-time traffic logs according to the CDN traffic request, the user agent field value in the CDN real-time traffic logs is used to determine and calculate peak traffic of the label combination, and an alarm message of the CDN real-time traffic logs is generated according to the peak traffic of the label combination and baseline traffic of the label combination, the baseline traffic of the label combination being calculated according to CDN historical traffic logs.

[0113] It should be understood that the device corresponds to the content distribution network traffic alarm method embodiments described above, and can perform each step involved in the method embodiments described above. The specific functions of the device can be referred to the description in the above, and the detailed description is appropriately omitted here. The device includes at least one software function module stored in the memory in the form of software or firmware or solidified in the operating system (OS) of the device.

[0114] Please refer to Figure 4 The electronic device provided by the embodiment of the present application is shown in the structural schematic diagram. The electronic device 400 provided by the embodiment of the present application comprises a processor 410 and a memory 420, the memory 420 stores machine readable instructions executable by the processor 410, and the machine readable instructions are executed by the processor 410 to perform the method as above.

[0115] The embodiment of the present application further provides a computer readable storage medium 430, the computer readable storage medium 430 stores a computer program, and the computer program is run by the processor 410 to perform the method as above. Wherein, the computer readable storage medium 430 can be realized by any type of volatile or non-volatile storage device or their combination, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0116] The embodiment of the present application further provides a computer program product, comprising: a computer program or computer instructions, the computer program or computer instructions are run by the processor to perform the method described above.

[0117] It should be noted that each embodiment in the present specification adopts a progressive manner for description, and each embodiment focuses on the difference from other embodiments, and the same and similar parts of each embodiment can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0118] It should be understood that all the apparatus and methods disclosed in the embodiments of the present application can be implemented by other ways. The apparatus embodiments described above are only schematic. For instance, the flowcharts and block diagrams in the embodiments of the present application illustrate the possible implementation ways of the apparatus, methods and computer program products according to the embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, a segment or a portion of code which comprises one or more executable instructions for implementing the specified logic function. It should also be noted that in some alternative implementation ways, the functions shown in the blocks can be performed in a different order from the described order. For example, the blocks in succession can actually be executed in parallel or in reverse order, depending on the functions involved.

[0119] In addition, each functional module in each embodiment of the present application can be integrated together to form a separate part, or each module can exist independently, or two or more modules can be integrated to form a separate part. In addition, in the description of the specification, the description of the terms "one embodiment", "some embodiments", "example", "specific example", "some examples" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are contained in at least one embodiment or example of the present application. In the specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, the different embodiments or examples described in the specification and the features of the different embodiments or examples can be combined and combined by those skilled in the art without contradiction.

[0120] The above description is only an optional implementation of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered by the protection scope of the present application.

Claims

1. A method of content delivery network traffic alerting, the method comprising: The method comprises: obtaining a CDN real-time traffic log generated by a content distribution network (CDN) server; parsing a plurality of dimension labels from the CDN real-time traffic log; for each label combination determined according to the plurality of dimension labels, calculating a peak traffic of the label combination according to the CDN real-time traffic log; obtaining a CDN historical traffic log, and calculating a baseline traffic of the label combination according to the CDN historical traffic log; generating an alarm message of the CDN real-time traffic log according to the peak traffic of the label combination and the baseline traffic of the label combination, wherein the alarm message comprises the label combination and the peak traffic of the label combination.

2. The method of claim 1, wherein, Before the parsing of the plurality of dimension labels from the CDN real-time traffic log, the method further comprises: receiving a dimension label request sent by a terminal device; obtaining all dimension labels according to the dimension label request; sending the all dimension labels to the terminal device, so that the terminal device sets a target dimension label filtered from the all dimension labels to a user agent field value of a CDN traffic request after generating the CDN traffic request for the CDN server, and sends the CDN traffic request to the CDN server, so that the CDN server generates the CDN real-time traffic log according to the CDN traffic request.

3. The method of claim 1, wherein, The calculation of the peak traffic of the label combination according to the CDN real-time traffic log comprises: segmenting and counting access traffic values of the label combination in the CDN real-time traffic log in a sliding time window unit period; determining a maximum traffic value in the plurality of access traffic values counted in the sliding time window as the peak traffic of the label combination.

4. The method of claim 1, wherein, The generation of the alarm message of the CDN real-time traffic log according to the peak traffic of the label combination and the baseline traffic of the label combination comprises: determining whether the peak traffic of the label combination and the baseline traffic of the label combination satisfy a preset alarm condition, wherein the preset alarm condition comprises: an absolute value of a difference between the peak traffic of the label combination and the baseline traffic of the label combination is greater than a preset proportion threshold value; if yes, generating the alarm message of the CDN real-time traffic log according to the peak traffic of the label combination.

5. The method of claim 4, wherein, The generation of the alarm message of the CDN real-time traffic log according to the peak traffic of the label combination comprises: calculating a CDN traffic cost corresponding to the label combination according to the peak traffic of the label combination; generating the alarm message of the label combination according to the CDN traffic cost corresponding to the label combination.

6. The method of claim 5, wherein, The multiple dimension labels include: an operating system type parsed from a user agent (UA) field value of the CDN real-time traffic log, an application version parsed from the UA field value of the CDN real-time traffic log, a service scenario domain name parsed from a uniform resource locator (URL) field value of the CDN real-time traffic log, and a CDN manufacturer type pre-configured in the CDN real-time traffic log; and the CDN traffic cost corresponding to the label combination is calculated according to the peak traffic of the label combination, including: calculating a CDN baseline cost of the label combination according to the CDN historical traffic log; obtaining a user quantity of the label combination formed by the operating system type and the application version in the CDN real-time traffic, and calculating a weight ratio between the user quantity and a total user quantity of the CDN historical traffic log; obtaining an occurrence quantity of the service scenario domain name in the CDN real-time traffic log, and calculating a possession ratio value between the occurrence quantity and a total domain name quantity in the CDN historical traffic log; obtaining a traffic statistical value of the CDN manufacturer type in the CDN real-time traffic log, and calculating a sharing ratio value between the traffic statistical value and a total traffic value of the CDN real-time traffic log; calculating the CDN traffic cost corresponding to the label combination according to the CDN baseline cost, the weight ratio, the possession ratio value, a preset service fluctuation coefficient, and the sharing ratio value.

7. A content distribution network traffic alerting method, characterized by, Applied to a terminal device, including: generating a CDN traffic request for a content distribution network (CDN) server; setting a user agent field value of the CDN traffic request as a target dimension label, the target dimension label being selected from all dimension labels sent by an electronic device; sending the CDN traffic request to the CDN server, so that the CDN server generates a CDN real-time traffic log according to the CDN traffic request, a user agent field value in the CDN real-time traffic log being used to determine and calculate peak traffic of a label combination, and an alarm message of the CDN real-time traffic log being generated according to the peak traffic of the label combination and baseline traffic of the label combination, the baseline traffic of the label combination being calculated according to a CDN historical traffic log.

8. A content distribution network traffic alerting apparatus characterized by, including: a real-time traffic obtaining module, configured to obtain a content distribution network (CDN) real-time traffic log generated by a CDN server; a dimension label parsing module, configured to parse multiple dimension labels from the CDN real-time traffic log; a peak traffic obtaining module, configured to, for each label combination determined according to the multiple dimension labels, calculate peak traffic of the label combination according to the CDN real-time traffic log; a historical traffic obtaining module, configured to obtain a CDN historical traffic log, and calculate baseline traffic of the label combination according to the CDN historical traffic log; and An alarm message generation module is configured to generate an alarm message of the CDN real-time traffic log according to the peak traffic of the label combination and the baseline traffic of the label combination, wherein the alarm message comprises the label combination and the peak traffic of the label combination.

9. A content distribution network traffic alerting apparatus characterized by, Applied to a terminal device, comprising: A traffic request generation module is configured to generate a CDN traffic request for a content distribution network (CDN) server; A target label setting module is configured to set a user agent field value of the CDN traffic request as a target dimension label, wherein the target dimension label is selected from all dimension labels sent by an electronic device; A traffic request sending module is configured to send the CDN traffic request to the CDN server, so that the CDN server generates a CDN real-time traffic log according to the CDN traffic request, wherein a user agent field value in the CDN real-time traffic log is used to determine and calculate a peak traffic of a label combination, and an alarm message of the CDN real-time traffic log is generated according to the peak traffic of the label combination and a baseline traffic of the label combination, wherein the baseline traffic of the label combination is obtained by calculating a CDN historical traffic log.

10. An electronic device, comprising: Comprising: A processor and a memory, wherein the memory stores machine readable instructions executable by the processor, and the machine readable instructions are executed by the processor to perform the method in any one of claims 1 to 7.

11. A computer readable storage medium, characterized in that, A computer program is stored on the computer readable storage medium, and the computer program is executed by the processor to perform the method in any one of claims 1 to 7.

12. A computer program product, characterised in that, Comprising: A computer program or computer instructions, wherein the computer program or the computer instructions are executed by the processor to perform the method in any one of claims 1 to 7.

Images