Network operation and maintenance management system based on big data analysis

Abstract

The invention relates to the technical field of network operation and maintenance management, and discloses a network operation and maintenance management system based on big data analysis, and the system comprises a user data analysis module which comprises a user behavior deviation analysis unit, a link environment interference analysis unit and an abnormal congestion analysis unit. And when abnormity occurs, an abnormal congestion analysis unit is scheduled to perform secondary analysis. According to the system, a user habit list in a user data acquisition module is read, a user behavior deviation coefficient is analyzed and constructed for primary judgment, a waiting period is set in the primary judgment process, an abnormal congestion coefficient is constructed in the waiting period, and the construction of the abnormal congestion coefficient can ensure that when a user behavior deviation analysis unit waits, the user behavior deviation analysis unit does not wait. And entering a secondary risk assessment process, so that resource waste caused by long-time waiting when the user behavior deviates from the analysis unit for judgment and is always in a waiting state is avoided, and a system can be forced to make a decision.

Description

Technical Field

[0001] This invention relates to the field of network operation and maintenance management technology, specifically a network operation and maintenance management system based on big data analysis. Background Technology

[0002] Network operation and maintenance management refers to the management of the daily operation of the network by relevant departments, including real-time monitoring of network equipment and systems, troubleshooting, performance optimization, security hardening, resource allocation, and daily maintenance, in order to ensure the stable, secure, and efficient operation of the network. Routers are crucial network devices that connect to external networks, allowing multiple devices to access the internet through the same network for data transmission and information sharing. However, for devices with high security requirements, the risk of data leakage cannot be identified in real time through network data and operator actions when the corresponding operators are at risk of leaking information. This can easily lead to inaccurate detection results. Furthermore, network devices can usually only be repaired after a fault occurs, making it impossible to predict potential fault risks. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides a network operation and maintenance management system based on big data analysis, which has the advantages of real-time risk identification through network data and operator behavior, thus solving the aforementioned technical problems.

[0004] To achieve the above objectives, the present invention provides the following technical solution: a network operation and maintenance management system based on big data analysis, comprising: The user data acquisition module is used to read data from the i-th terminal within the recognition area and construct a user habit list and a link environment dataset. The user data analysis module includes a user behavior deviation analysis unit, a link environment interference analysis unit, and an abnormal congestion analysis unit. The user behavior deviation analysis unit is used to read the user habit list in the user data collection module and analyze and construct the user behavior deviation coefficient. At the same time, it analyzes whether the user behavior is abnormal. When an abnormality occurs, it schedules the abnormal congestion analysis unit to construct the abnormal congestion coefficient and perform secondary analysis. If no abnormality occurs, it calls the link environment interference analysis unit to perform environmental analysis. The management and early warning module executes different instructions during abnormal and normal times to provide early warnings of network risks.

[0005] As a preferred embodiment of the present invention, the user data acquisition module includes a user behavior acquisition unit and a link environment acquisition unit. The user behavior acquisition unit is used to read data from the i-th terminal within the identification area and construct a user habit list. The specific steps are as follows: Get the Each terminal usage period is divided into equal intervals. Each sub-use period, and based on the first The terminal The operation frequency of each sub-use period and the first The terminal CPU utilization during each usage period is used to construct the first The terminal Clustering coefficient of usage during individual usage periods And store them according to the corresponding time period; The link environment acquisition unit is used to construct the link environment dataset.

[0006] As a preferred embodiment of the present invention, the user behavior deviation analysis unit is used to read the user habit list in the user data collection module and analyze and construct the user behavior deviation coefficient. The specific steps are as follows: Get the individual terminals Clustering coefficient of time period In essence, time period t refers to the current sampling time period, and is based on the first sampling period. A total of 1 terminal The usage clustering coefficient of each sub-use period corresponds to the t-th time period. The terminal Clustering coefficient of usage during individual usage periods Aggregation bias is used to construct the overall structure for time period t; Based on the individual terminals User behavior vectors for different time periods and the first individual terminals Constructing the Euclidean distance between the historical behavior vectors of the time period individual terminals Variation in habits over time ; Using clustering bias and the first time interval t, time period t will be used. individual terminals Variation in habits over time Weighted construction of the first individual terminals User behavior deviation coefficient during the time period .

[0007] As a preferred technical solution of the present invention, the first individual terminals User behavior vectors for different time periods and the first individual terminals The historical behavior vectors of each time period correspond one-to-one, and the first... individual terminals User behavior vectors for different time periods include the first individual terminals Operational intensity indicators for different time periods, the first individual terminals Page dwell time metrics for different time periods and Indicates the first individual terminals The indicator of overlapping active time periods.

[0008] As a preferred technical solution of the present invention, the user behavior deviation analysis unit reads the first... individual terminals User behavior deviation coefficient during the time period When, determine whether it exceeds the first... individual terminals User behavior deviation from threshold during a certain period If the time limit is not exceeded, the judgment will terminate and wait for the judgment of the next time period; if the time limit is exceeded, the judgment will proceed to the next time period. individual terminals User behavior deviation coefficient during the time period Store and calculate the first... Deviation growth coefficient between adjacent time periods of each terminal ; when And the first individual terminals User behavior deviation coefficient during the time period If so, the first risk instruction will be executed, which specifically outputs a user exception; when ,and Then execute the second risk instruction, specifically, to... individual terminals User behavior deviation coefficient during the time period Delete and extract the corresponding parameters for storage; when ,and The system waits for the next time period to be determined, and at the same time calls the abnormal congestion analysis unit. The management and early warning module then combines the abnormal congestion coefficient to determine and execute the third or fourth risk instruction.

[0009] As a preferred embodiment of the present invention, the management early warning module is invoked after the user behavior deviation analysis unit outputs user anomalies, and the deviation management strategy is executed, specifically: for the first... The system locks each terminal, calls an odd number of administrators to investigate, and uses a voting mechanism to determine whether to unlock it.

[0010] As a preferred embodiment of the present invention, after the second risk instruction is issued, the link environment interference analysis unit constructs link environment interference analysis coefficients based on the link environment dataset in the user data acquisition module. Specifically, it constructs the link environment interference analysis coefficients corresponding to the i-th port based on the physical parameters stored in the link environment dataset. Specifically, it is constructed by summing the deviation rates between all collected standard parameters of the link interface and the actual collected values ​​of the physical parameters of the link interface.

[0011] As a preferred technical solution of the present invention, the management and early warning module receives the link environment interference analysis coefficient corresponding to the i-th port. The judgment is made at the appropriate time, and the link environment interference analysis coefficient corresponding to the i-th port is used. If the environmental impact threshold is exceeded, an early warning will be issued and staff will be dispatched for maintenance. If the staff fails to report the maintenance log or find the fault after maintenance, the environmental impact threshold will be increased by 5% to 10%. If the port has already triggered the scheduled maintenance within K time periods, the staff will be replaced for maintenance, and the environmental impact threshold will not be increased.

[0012] As a preferred embodiment of the present invention, the abnormal congestion analysis unit constructs an abnormal congestion coefficient based on the link environment dataset and the user behavior deviation analysis unit. The specific steps are as follows: constructing the first abnormal congestion coefficient based on the number of abnormal port accesses and the number of concurrent connections. individual terminals The impact coefficient of abnormal congestion during a given time period, combined with the first... Deviation growth coefficient between adjacent time periods of each terminal Construct the first individual terminals Abnormal congestion coefficient during the time period .

[0013] As a preferred technical solution of the present invention, the management and early warning module analyzes the abnormal congestion coefficient after reading it, and when the first... individual terminals Abnormal congestion coefficient during the time period If the corresponding threshold is exceeded, execute the third risk instruction; otherwise, execute the fourth risk instruction. The third risk instruction specifically refers to cutting off the first... If the network connection of a terminal is abnormal, the fourth risk instruction is to wait for the next time period and then call the user behavior deviation analysis unit again.

[0014] Compared with existing technologies, this invention provides a network operation and maintenance management system based on big data analysis, which has the following beneficial effects: This invention reads the user habit list from the user data collection module and analyzes and constructs a user behavior deviation coefficient for an initial judgment. During this initial judgment, a waiting period is set, during which an abnormal congestion coefficient is constructed. The construction of the abnormal congestion coefficient ensures that when the user behavior deviation analysis unit is waiting, a secondary risk assessment process is initiated. This avoids the system being in a waiting state for an extended period, thus preventing resource waste. Furthermore, it forces the system to make a decision and, after comprehensive judgment, identifies risks in real time based on network data and operator behavior. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the structure of the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] Please see Figure 1 A network operation and maintenance management system based on big data analytics includes: The user data acquisition module includes a user behavior acquisition unit and a link environment acquisition unit. The user behavior acquisition unit is used to read the data in the i-th terminal within the recognition area and build a user habit list. The link environment acquisition unit is used to build a link environment dataset. The user data analysis module includes a user behavior deviation analysis unit, a link environment interference analysis unit, and an abnormal congestion analysis unit. The user behavior deviation analysis unit is used to read the user habit list in the user data collection module, analyze and construct the user behavior deviation coefficient, and analyze whether user behavior is abnormal. The link environment interference analysis unit constructs link environment interference analysis coefficients based on the link environment dataset in the user data acquisition module; The abnormal congestion analysis unit constructs an abnormal congestion coefficient based on the link environment dataset and the user behavior deviation analysis unit; The management early warning module is invoked after the user behavior deviation analysis unit outputs user anomalies, and deviation management strategies are executed. After reading the link environment interference analysis coefficients, perform the analysis and determine whether to execute the link environment management policy; After reading the abnormal congestion coefficient, the system analyzes it and determines whether to implement the abnormal congestion management strategy. The system reads the user habit list from the user data collection module and analyzes and constructs a user behavior deviation coefficient for the first judgment. During the first judgment, a waiting period is set, during which the abnormal congestion coefficient is constructed. The construction of the abnormal congestion coefficient can ensure that when the user behavior deviation analysis unit waits, it enters the process of secondary risk assessment. This avoids the resource waste caused by the user behavior deviation analysis unit being in a waiting state for a long time. It can also further force the system to make a decision. After comprehensive judgment, the system identifies risks in real time through network data and operator operation.

[0018] Furthermore, the user behavior collection unit is used to read data from the i-th terminal within the recognition area and construct a user habit list. The specific steps are as follows: Step A1: Obtain the first Each terminal usage period is divided into equal intervals. Each sub-use period, and construct the first The terminal Clustering coefficient of usage during individual usage periods The specific expression is as follows: in, , These represent the weight coefficients that sum to 1. This represents the average frequency of operation across all historical terminals. Indicates the first The terminal Operation frequency during individual usage periods This represents the historical average CPU utilization across all terminals. Indicates the first The terminal By analyzing CPU utilization during specific usage periods, it effectively identifies issues such as abnormal users, overload behavior, or resource abuse. This is particularly useful in network operation and maintenance management systems, assisting in the formulation of intelligent scheduling, alarm, and resource allocation strategies. In this embodiment... , ; Step A2: According to the first A total of 1 terminal The usage clustering coefficient of each sub-use period is used to construct the first Each terminal uses a time-period distribution dataset (which can be stored as a chart or encoded and encrypted for later decoding), and combines the data with the first... The usage logs of each terminal are combined and stored as a list of user habits.

[0019] Furthermore, the user behavior deviation analysis unit is used to read the user habit list from the user data collection module and analyze and construct the user behavior deviation coefficient. The specific steps are as follows: Step B1: Obtain the first individual terminals Clustering coefficient of time period In essence, time period t refers to the current sampling time period, and is based on the first sampling period. A total of 1 terminal The usage clustering coefficient of each sub-use period corresponds to the t-th time period. The terminal Clustering coefficient of usage during individual usage periods The aggregation bias is used to construct the overall structure for time period t, and the specific expression is as follows: in, express The absolute value of the difference will be compared and analyzed with the clustering coefficient of the current time period and the clustering coefficient of the historical sub-time periods to clarify the current time period; Step B2: Construct the first individual terminals Variation in habits over time The specific expression is as follows: in, Indicates the first individual terminals User behavior vectors over a given time period Indicates the first individual terminals Historical behavior vectors for a given period Represents Euclidean distance; Step B3: Comprehensive Construction of the First individual terminals User behavior deviation coefficient during the time period The specific expression is as follows: in, , These represent weight coefficients that sum to 1, respectively, in this embodiment. , .

[0020] Furthermore, the specific first individual terminals User behavior vectors for different time periods It contains multidimensional data, and the data in each dimension has been dimensionless. Those skilled in the art can add or replace it as needed. The specific data given in this embodiment is as follows: individual terminals The user behavior vector for a given time period is: ,in Indicates the first individual terminals Indicators related to trading intensity over a given period Indicates the first individual terminals The specific expressions for the page dwell time metric for different time periods are as follows: in, Indicates the first individual terminals Click metrics for operations during a specific time period. Indicates the first individual terminals Number of clicks during the time period Indicates the first individual terminals Number of times the application is switched during a time period express Sampling duration for each time period Indicates the time spent on the page. Indicates the duration of overlap. Indicates the first individual terminals The active time overlap duration metric is calculated by matching the port startup time with the current time period and retaining the overlapping portion. These represent weight coefficients that sum to 1. This embodiment only considers the number of operation clicks. Those skilled in the art can extend the number of operation clicks to: , Represents the a-th parameter The weight, Indicates the first individual terminals Operation parameters for the time period (any parameter related to the number of operations is acceptable); Please refer to Table 1 below for specific data: Table 1. Parameters related to the user behavior deviation coefficient. In this embodiment , , , And calculate 0.613, at this time .

[0021] Furthermore, the user behavior deviation analysis unit reads the first... individual terminals User behavior deviation coefficient during the time period When, determine whether it exceeds the first... individual terminals User behavior deviation from threshold during a certain period If the time limit is not exceeded, the judgment will terminate and wait for the judgment of the next time period; if the time limit is exceeded, the judgment will proceed to the next time period. individual terminals User behavior deviation coefficient during the time period Store and calculate the first... Deviation growth coefficient between adjacent time periods of each terminal The specific expression is: when ,and This indicates that the user's behavior deviates from the norm at this point. It is still growing over time, and in If user behavior still deviates during the specified time period, the first risk instruction will be executed, specifically by outputting a user anomaly. when ,and This indicates that the user's behavior deviates from the norm at this point. It decreased over time, and in If user behavior does not deviate during the time period, execute the second risk instruction, specifically by... individual terminals User behavior deviation coefficient during the time period Delete and extract the corresponding user logs and other relevant parameters for storage; when ,and This indicates that the user's behavior deviates from the norm at this point. It decreased over time, and in If user behavior still deviates during a given time period, a decision is made to wait for the next time period. Simultaneously, the abnormal congestion analysis unit is invoked. The management and early warning module, based on the abnormal congestion coefficient, determines whether to execute a third or fourth risk instruction. Specifically, the third risk instruction involves cutting off the... The network connection of each terminal is abnormal. The fourth risk instruction is to wait for the next time period and call the user behavior deviation analysis unit again. In this embodiment Beyond the first individual terminals User behavior deviation from threshold during a certain period At this point, the calculation of the first... Deviation growth coefficient between adjacent time periods of each terminal , No. individual terminals User behavior deviation coefficient during the time period At this point, the abnormal congestion analysis unit is invoked.

[0022] The abnormal congestion analysis unit constructs an abnormal congestion coefficient based on the link environment dataset and the user behavior deviation analysis unit. The specific steps are as follows: Step C1: Based on the network parameters centrally stored in the link environment data set, see Table 2 below for details: Table 2 shows the network parameters stored in the link environment dataset. Construct the first individual terminals The impact coefficient of abnormal congestion during a specific time period is expressed as follows: in, Indicates the first individual terminals Impact coefficient of abnormal congestion during a specific time period. and The weight coefficients that sum to 1 are specifically, and By analyzing the sum of the impact coefficients of abnormal congestion access, we can roughly determine whether the number of user accesses has increased. When a user initiates multiple port connection attempts, it is because an attacker or automated attack tool quickly accesses a large number of ports on the target device to detect which ports are open or services are available. This is a preliminary action for launching an attack. Normal users or applications usually do not access a large number of unrelated ports. Step C2: Combine with the first Deviation growth coefficient between adjacent time periods of each terminal The abnormal congestion coefficient is constructed, and the specific expression is as follows: in, Indicates the first individual terminals The abnormal congestion coefficient for a given time period is calculated at this point.

[0023] Furthermore, the management and early warning module analyzes the abnormal congestion coefficient after reading it, and when the first... individual terminals Abnormal congestion coefficient during the time period When the preset safety value is exceeded, the third risk instruction is executed; otherwise, the fourth risk instruction is executed. By constructing the abnormal congestion coefficient, it can be ensured that when the user behavior deviation analysis unit is waiting, the process of secondary risk assessment is entered. This avoids the system being in a waiting state when the user behavior deviation analysis unit is making a judgment, thus avoiding the waste of resources caused by long waiting time. It can also further force the system to make a decision.

[0024] Furthermore, the management early warning module is invoked after the user behavior deviation analysis unit outputs user anomalies, and the deviation management strategy is executed. The specific steps are as follows: For the The system locks each terminal and calls an odd number of administrators (at least 3; if 3 cannot be scheduled, then 1 will be scheduled, and the other two will be scheduled after a time interval) to investigate. A voting mechanism is used to determine whether to unlock the terminal, with the minority obeying the majority.

[0025] Furthermore, after the second risk instruction is issued, it indicates that the user's behavior deviates from the expected level at this point. It decreased over time, and in If user behavior did not deviate during the specified time period, then the potential impact of other environmental factors needs to be considered. Therefore, the link environment interference analysis unit constructs link environment interference analysis coefficients based on the link environment dataset in the user data acquisition module to analyze the link status from another dimension. The specific steps are as follows: <s>，< / s> Based on the centralized storage of physical parameters in the link environment dataset, the link environment interference analysis coefficients corresponding to the i-th port are constructed. The sum of deviations in the physical parameters of the link interface is determined by the following expression; in, This represents the standard parameters of the link interface, specifically the standard parameter range. Represents the midpoint of the interval. This represents the absolute value operation. This represents the actual collected values ​​of the physical parameters of the link interface, for example... The interval is [a, b], and What it reflects is the difference between the two ends of the interval. Higher than b, What it reflects is for ,like Below a, What it reflects is for , See Table 3 below, but not limited to only the following parameters: Table 3 shows the physical parameters stored in the link environment dataset. Furthermore, the management and early warning module receives the link environment interference analysis coefficients corresponding to the i-th port. The judgment is made at the appropriate time, and the link environment interference analysis coefficient corresponding to the i-th port is used. If the environmental impact threshold is exceeded (obtained through logs of the maintenance and error reporting process), an early warning will be issued and staff will be dispatched for maintenance. If the staff fails to report the maintenance log or find the fault after maintenance, the environmental impact threshold will be increased by 5% to 10%. If the port that has triggered the scheduling of maintenance within K time periods has been replaced, the staff will be replaced for maintenance, and the environmental impact threshold will not be increased. When the link environment interference analysis coefficient corresponding to the i-th port No warning will be issued if the environmental impact threshold is not exceeded.

[0026] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A network operation and management system based on big data analysis, characterized in that: Comprise: The user data acquisition module is used for reading the data in the i-th terminal in the identification area and constructing the user habit list and the link environment data set; The user data analysis module comprises a user behavior deviation analysis unit, a link environment interference analysis unit and an abnormal congestion analysis unit, the user behavior deviation analysis unit is used for reading the user habit list in the user data acquisition module, and a user behavior deviation coefficient is analyzed and constructed, whether the user behavior is abnormal is analyzed, when the abnormality occurs, the abnormal congestion analysis unit is dispatched to construct an abnormal congestion coefficient, secondary analysis is carried out, if the abnormality does not occur, the link environment interference analysis unit is called to analyze the environment; The management early warning module executes different instructions in abnormal and non-abnormal time, and is used for early warning of network risk. 2.The network operation administration and management system based on big data analysis of claim 1, wherein: The user data acquisition module comprises a user behavior acquisition unit and a link environment acquisition unit, the user behavior acquisition unit is used for reading the data in the i-th terminal in the identification area and constructing the user habit list, and the specific steps are as follows: Get the Each terminal usage period is divided into equal intervals. Each sub-use period, and based on the first The terminal The operation frequency of each sub-use period and the first The terminal CPU utilization during each usage period is used to construct the first The terminal Clustering coefficient of usage during individual usage periods And store them according to the corresponding time period; The link environment acquisition unit is used for constructing the link environment data set. 3.The network operation administration and management system based on big data analysis of claim 2, wherein: The user behavior deviation analysis unit is used for reading the user habit list in the user data acquisition module, and a user behavior deviation coefficient is analyzed and constructed, and the specific steps are as follows: The use aggregation coefficient of the first terminal in the t period is obtained The t period refers to a current sampling period, and the use aggregation coefficient of the first terminal in the first sub-use period corresponding to the t period among the use aggregation coefficients of the first terminal in the k sub-use periods of the first terminal is obtained The use aggregation coefficient of the first terminal in the t period is obtained The use aggregation coefficient of the first terminal in the t period is obtained The t period use aggregation deviation is constructed​​​​ Based on the Euclidean distance between the user behavior vector of the first terminal in the first time period and the historical behavior vector of the first terminal in the first time period, a habit change range of the first terminal in the first time period is constructed. ;​​​​​​ using the aggregated bias and the first terminal habit change range of the time period weighting to construct the user behavior deviation coefficient of the first terminal of the time period . 4.The network operation administration and management system based on big data analysis of claim 3, wherein: The first individual terminals User behavior vectors for different time periods and the first individual terminals The historical behavior vectors of each time period correspond one-to-one, and the first... individual terminals User behavior vectors for different time periods include the first individual terminals Operational intensity indicators for different time periods, the first individual terminals Page dwell time metrics for different time periods and Indicates the first individual terminals The indicator of overlapping active time periods. 5.The network operation administration and maintenance system based on big data analysis of claim 3, wherein: The user behavior deviation analysis unit reads the user behavior deviation coefficient of the first terminal in the first time period , and judges whether it exceeds the preset user behavior deviation threshold of the first terminal in the first time period . If not, the judgment is terminated, and the next time period is waited for the judgment. If yes, the user behavior deviation coefficient of the first terminal in the first time period is stored, and the deviation growth coefficient of the first terminal in the adjacent time period is calculated . ​​​​​​​​ When , and the first terminal period of user behavior deviation coefficient , the first risk instruction is executed, specifically outputting user abnormalities; when ,and Then execute the second risk instruction, specifically, to... individual terminals User behavior deviation coefficient during the time period Delete and extract the corresponding parameters for storage; When , and , the next period of waiting for the determination, while calling the abnormal congestion analysis unit, the management of the early warning module combined with the abnormal congestion coefficient judgment to execute the third risk instruction or the fourth risk instruction. 6.The network operation administration and maintenance system based on big data analysis of claim 5, wherein: The management warning module is called after the user behavior deviation analysis unit outputs user abnormalities, and executes a deviation management strategy, specifically: locking the first terminal, and calling an odd number of managers to investigate, and using a voting mechanism to determine whether to release the lock. 7.The network operation administration and maintenance system based on big data analysis of claim 5, wherein: After the second risk instruction is sent out, the link environment interference analysis unit constructs a link environment interference analysis coefficient based on a link environment data set in the user data acquisition module, specifically, constructs a link environment interference analysis coefficient corresponding to the i th port based on the physical parameters stored in the link environment data set Specifically, the link environment interference analysis coefficient is constructed by summing the deviation rates between all collected link interface standard parameters and actual collected values of link interface physical parameters. 8.The network operation administration and maintenance system based on big data analysis of claim 7, wherein: The management early warning module judges when the link environment interference analysis coefficient corresponding to the ith port is received The management early warning module judges when the link environment interference analysis coefficient corresponding to the ith port is received When the link environment interference analysis coefficient corresponding to the ith port exceeds the preset environment influence threshold value, an early warning is performed, and a worker is dispatched to perform maintenance. If the worker does not report a maintenance log or does not troubleshoot a fault after maintenance, the environment influence threshold value is increased by 5% to 10%, and the worker is replaced to perform maintenance when the port has triggered dispatching of maintenance within K time periods, and the environment influence threshold value is not increased. 9.The network operation administration and maintenance system based on big data analysis of claim 5, wherein: The abnormal congestion analysis unit constructs an abnormal congestion coefficient based on the link environment data set and the user behavior deviation analysis unit. The specific steps are as follows: based on the abnormal port access number and the concurrent connection number, the first terminal time period abnormal congestion access influence coefficient is constructed , and the first terminal adjacent time period deviation growth coefficient is combined to construct the first terminal time period abnormal congestion coefficient . ​ 10.The network operation administration and maintenance system based on big data analysis of claim 9, wherein: The management and early warning module analyzes the abnormal congestion coefficient after reading it, and when the first... individual terminals Abnormal congestion coefficient during the time period If the corresponding threshold is exceeded, execute the third risk instruction; otherwise, execute the fourth risk instruction. The third risk instruction specifically refers to cutting off the first... If the network connection of a terminal is abnormal, the fourth risk instruction is to wait for the next time period and then call the user behavior deviation analysis unit again.

Images