Method for identifying abnormal traffic drop, and device, storage medium and program

Abstract

The embodiments of the present disclosure provide a method for identifying abnormal traffic drop, and a device, a storage medium and a program. The method comprises: determining a target traffic type corresponding to a target network device port, and a traffic threshold value corresponding to the target traffic type; sequentially collecting real-time traffic values of the target network device port within first time slices at a set first time slice granularity; if a plurality of first real-time traffic values collected within a plurality of consecutive first time slices are all lower than the traffic threshold value, determining as a plurality of second real-time traffic values lower traffic values among real-time traffic values which are collected prior to the plurality of first real-time traffic values; and if a statistical value of the plurality of second real-time traffic values is greater than the traffic threshold value multiplied by a set multiple, determining that the plurality of first real-time traffic values correspond to an abnormal traffic drop event. The identification based on traffic types and setting different traffic threshold values for different traffic types improve the accuracy of abnormal traffic drop identification.

Description

[0001] TECHNICAL FIELD The present disclosure relates to the field of Internet technology, and more particularly to a method, device, storage medium, and program for identifying abnormal traffic drops. Background: Network device traffic, as one of the key indicators of a network device's operational status, reflects the data transmission and flow conditions of the network device, directly reflecting the network device's load, performance, and health. In terms of network stability, there is a close relationship between network device failures and traffic drops. Network device failures often lead to abnormal traffic drops, which can also be a symptom of a network device failure. Therefore, abnormal traffic drops can serve as a "signal" for detecting network device failures. By identifying abnormal traffic drops, the risk of network device failure can be quickly determined, allowing appropriate measures to be taken to restore normal network traffic transmission, thereby reducing the impact of network device stability issues on applications. Therefore, there is an urgent need for an effective solution that can promptly and accurately detect abnormal traffic drops in network devices. SUMMARY OF THE INVENTION The present disclosure provides a method, device, storage medium, and program for identifying abnormal traffic drops, to accurately identify abnormal traffic drops. In a first aspect, an embodiment of the present disclosure provides a method for identifying an abnormal traffic drop, the method comprising: determining a target traffic type corresponding to a target network device port and a traffic threshold corresponding to the target traffic type; sequentially collecting real-time traffic values ​​of the target network device port in each first time slice at a set first time slice granularity; if multiple first real-time traffic values ​​collected in multiple consecutive first time slices are all lower than the traffic threshold, determining a first statistical value of multiple second real-time traffic values ​​collected before the multiple first real-time traffic values, the multiple second real-time traffic values ​​being lower traffic values ​​among the real-time traffic values ​​collected in a first set number of first time slices before the multiple first time slices; if the first statistical value is greater than a set multiple of the traffic threshold, determining that the multiple first real-time traffic values ​​correspond to an abnormal traffic drop event.In a second aspect, embodiments of the present disclosure provide a device for identifying an abnormal traffic drop. The device comprises: a determination module configured to determine a target traffic type corresponding to a target network device port and a traffic threshold corresponding to the target traffic type; a collection module configured to sequentially collect real-time traffic values ​​of the target network device port within each first time slice at a predetermined first time slice granularity; and an identification module configured to, if multiple first real-time traffic values ​​collected within multiple consecutive first time slices are all lower than the traffic threshold, determine a first statistic of multiple second real-time traffic values ​​collected prior to the multiple first real-time traffic values; and if the first statistic is greater than a predetermined multiple of the traffic threshold, determine that the multiple first real-time traffic values ​​correspond to an abnormal traffic drop event, wherein the multiple second real-time traffic values ​​are lower traffic values ​​among the real-time traffic values ​​collected within a predetermined number of first time slices prior to the multiple first time slices. In a third aspect, embodiments of the present disclosure provide an electronic device comprising: a memory, a processor, and a communication interface; wherein the memory stores executable code that, when executed by the processor, enables the processor to at least implement the method for identifying an abnormal traffic drop as described in the first aspect. In a fourth aspect, embodiments of the present disclosure provide a non-transitory machine-readable storage medium storing executable code. When the executable code is executed by a processor of an electronic device, the processor is enabled to implement at least the method for identifying an abnormal traffic drop as described in the first aspect. In a fifth aspect, embodiments of the present disclosure provide a computer program product containing a computer program. When executed by a processor of an electronic device, the processor is enabled to implement at least the method for identifying an abnormal traffic drop as described in the first aspect. In the abnormal traffic drop identification solution provided in embodiments of the present disclosure, a target traffic type corresponding to a target network device port and a traffic threshold corresponding to the target traffic type are pre-determined offline. That is, for a target network device port, the target traffic type corresponding to the target network device port is analyzed, and then, based on the target traffic type, a traffic threshold corresponding to the target traffic type applicable only to the target network device port is determined. Afterwards, in the process of identifying an abnormal decrease in real-time traffic flow for the target network device port, the real-time traffic flow value of the target network device port in each first time slice is collected in sequence at a set first time slice granularity (for example, minute level: 1 minute). If it is found that multiple (for example, 3) first real-time traffic flow values ​​collected continuously are all lower than the traffic threshold corresponding to the target network device port, it indicates that an abnormal traffic flow decrease event may have occurred, and further judgment is required to confirm it.Specifically, a first statistical value (e.g., mean, percentile, median, etc.) of multiple second real-time traffic values ​​collected prior to the multiple first real-time traffic values ​​is first determined. The multiple second real-time traffic values ​​are lower traffic values ​​among the real-time traffic values ​​collected within a first set number of first time slots (e.g., 20) prior to the multiple first time slots. In other words, the multiple second real-time traffic values ​​are traffic values ​​with lower values ​​prior to the multiple first real-time traffic values. If the first statistical value is greater than a set traffic threshold by a multiple, then the multiple first real-time traffic values ​​are determined to correspond to an abnormal traffic drop event. In other words, if the first statistical value (e.g., mean) of the multiple second real-time traffic values ​​with lower values ​​prior to the multiple first real-time traffic values ​​is significantly greater than the traffic threshold, while the multiple first real-time traffic values ​​are below the traffic threshold, then it can be determined that a sudden and significant traffic drop has occurred on the target network device port. In this solution, by identifying the traffic type of the network device port and setting different traffic thresholds for different traffic types, targeted abnormal traffic drop event identification can be performed based on the traffic type of the network device port, thereby improving the accuracy of abnormal traffic drop event identification results. Furthermore, as traffic is generated on the network device port, real-time identification is performed at the first time slice granularity (e.g., 1 minute), ensuring the timeliness of identification. BRIEF DESCRIPTION OF THE DRAWINGS To more clearly illustrate the technical solutions in the embodiments of the present disclosure, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below illustrate some embodiments of the present disclosure. Those skilled in the art can derive other drawings based on these drawings without inventive effort. Figure 1 is a flowchart of a method for identifying an abnormal drop in traffic provided by an embodiment of the present disclosure; Figure 2 is a schematic diagram of different traffic types provided by an embodiment of the present disclosure; Figure 3 is a schematic diagram of a traffic threshold mechanism corresponding to different traffic types provided by an embodiment of the present disclosure; Figure 4 is a schematic diagram of an abnormal drop in traffic event provided by an embodiment of the present disclosure; Figure 5 is a flowchart of a method for identifying a traffic type provided by an embodiment of the present disclosure; Figure 6 is a flowchart of a method for identifying an abnormal drop in traffic provided by an embodiment of the present disclosure; Figure 7 is a schematic diagram of an abnormal drop in traffic event provided by an embodiment of the present disclosure; Figure 8 is a schematic diagram of a process for identifying an abnormal drop in traffic provided by an embodiment of the present disclosure; Figure 9 is a structural schematic diagram of a device for identifying an abnormal drop in traffic provided by an embodiment of the present disclosure; Figure 10 is a structural schematic diagram of an electronic device provided by an embodiment of the present disclosure.DETAILED DESCRIPTION To further clarify the objectives, technical solutions, and advantages of the embodiments of the present disclosure, the technical solutions of the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings. It should be noted that the described embodiments represent only a portion of the embodiments of the present disclosure, and are not exhaustive. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present disclosure without inventive effort are within the scope of protection of the present disclosure. It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, storage, and display) involved in the embodiments of the present disclosure are all authorized by the user or fully authorized by all parties. The collection, use, and processing of such data must comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or reject such data. The following detailed description of some embodiments of the present disclosure is provided in conjunction with the accompanying drawings. The following embodiments and features may be combined unless there is a conflict between them. Furthermore, the sequence of steps in the following method embodiments is provided for illustrative purposes only and is not intended to be a strict limitation. The abnormal traffic drop identification solution provided in the embodiments of the present disclosure can be applied to identify abnormal traffic fluctuations on ports of any type of network device. A network device refers to a hardware device with computer network functions (such as routing and forwarding), commonly including routers and switches. A network device may have one or more ports, and the network traffic on different ports is independent of each other. Traffic refers to the amount of data transmitted by a communication subject in a network. In the embodiments of the present disclosure, it primarily refers to the amount of data transmitted by a network device port. Common units of measurement for data volume include bits and bytes. As mentioned above, an abnormal traffic drop on a network device port is often associated with a network device failure. Therefore, by identifying abnormal traffic drop events on network device ports, network device failure risks can be promptly detected and alerts can be issued. In practical applications, network environments are diverse, and the traffic characteristics of different ports on the same network device are not uniform. Therefore, with so many network device ports, it is necessary to provide an effective abnormal traffic drop event identification solution that meets the requirements of fault detection in terms of identification accuracy, fault coverage, and timeliness.Based on this, the abnormal traffic drop identification scheme proposed in the embodiments of the present disclosure utilizes statistical methods to identify the traffic type of a network device port. Based on the traffic type of a network device port, a dynamic traffic threshold mechanism matching the traffic type is designed. This traffic threshold mechanism is combined with a real-time clustering mechanism to achieve real-time, accurate, and comprehensive identification of abnormal traffic drop events on network device ports. In summary, the embodiments of the present disclosure introduce a traffic type identification mechanism to classify and identify the corresponding traffic type for each network device port, including, for example, steady-state, periodic, and irregular traffic types. For steady-state and periodic traffic types, a threshold mechanism using hourly precise traffic thresholds can be designed, while for irregular traffic types, a threshold mechanism using daily baseline traffic thresholds can be designed. Consequently, during real-time traffic monitoring of a network device port, abnormal traffic drop events on that network device port can be identified using a traffic threshold that matches the traffic type of the network device port, resulting in accurate identification results. Furthermore, to address potential shortcomings of the aforementioned threshold mechanism and ensure coverage of scenarios where traffic levels drop abnormally (for example, where traffic thresholds fail to identify sudden abnormalities or rapidly changing traffic levels above the threshold), embodiments of the present disclosure also provide a real-time clustering mechanism. The calculation processes for both the aforementioned traffic threshold mechanism and the real-time clustering mechanism are relatively simple, thus ensuring the timeliness of identifying abnormal traffic levels. The following details the abnormal traffic level identification solution provided by embodiments of the present disclosure. This solution can be implemented by a monitoring service responsible for traffic monitoring on network device ports, which can be deployed on a cloud server. Figure 1 is a flow chart of a method for identifying abnormal traffic levels provided by embodiments of the present disclosure. As shown in Figure 1, the method may include the following steps:

[0002] 101. Determine a target traffic type corresponding to a target network device port and a traffic threshold corresponding to the target traffic type.

[0003] 102. At the set first time slice granularity, sequentially collect the real-time traffic value of the target network device port in each first time slice.

[0004] 103. If multiple first real-time flow values ​​collected in multiple consecutive first time slices are all lower than the flow threshold, determine a first statistical value of multiple second real-time flow values ​​collected before the multiple first real-time flow values, where the multiple second real-time flow values ​​are lower flow values ​​among the real-time flow values ​​collected in a first set number of first time slices before the multiple first time slices.

[0005] 104. If the first statistical value is greater than a set multiple of the traffic threshold, determine that the multiple first real-time traffic values ​​correspond to an abnormal traffic drop event. In the embodiments of the present disclosure, the target network device port can be a port on a router, a port on a switch, or the like. In other words, the target network device port refers to a port on a network device. When monitoring ports on multiple network devices for abnormal traffic drop events, each port on each network device must be processed independently. Therefore, the embodiments of the present disclosure use any port on any network device as the target network device port as an example. Since traffic on a network device port often fluctuates in actual applications, for example, changes in an application program using the network device port for traffic transmission may cause the traffic type on the network device port to change from one traffic type to another. Therefore, in actual applications, the traffic type of the network device port can be dynamically determined. The traffic type corresponding to the target network device port is referred to herein as the target traffic type. In practical applications, when it is necessary to monitor the real-time traffic values ​​generated by a target network device port on a particular day, the target traffic type corresponding to the target network device port and the traffic threshold corresponding to the target traffic type can be determined based on an analysis of the historical traffic values ​​generated by the target network device port over the past few days (e.g., the past two or three days). Therefore, it can be understood that the target traffic type and traffic threshold of the target network device port are dynamically determined. The traffic threshold is used to identify abnormal traffic drop events. It can be simply assumed that if the real-time traffic value generated by the target network device port is continuously lower than the corresponding traffic threshold, it is likely that an abnormal traffic drop event has occurred at the target network device port. In the disclosed embodiments, traffic types are: steady, periodic, and irregular. Irregular refers to traffic types other than steady and periodic. These traffic types can be understood with reference to FIG2 . Assuming that the day on which the traffic flow of the target network device port is currently monitored is denoted as day T, FIG2 shows the traffic flow values ​​of the target network device port at different times in the past two days, day T-1 and day T-2.As shown in Figure 2, for a steady traffic type, the traffic values ​​corresponding to different times on days T-1 and T-2 do not fluctuate much, remaining steady. For a periodic traffic type, the traffic values ​​corresponding to the same times on days T-1 and T-2 do not fluctuate much, exhibiting periodicity. For an irregular traffic type, the traffic values ​​at different times on days T-1 and T-2 exhibit irregularity. Simply put, the process of determining the traffic type corresponding to the target network device port on the current day (T in the above example) includes obtaining a historical traffic value sequence generated by the target network device port within a target historical time period, analyzing the historical traffic value sequence to determine the target traffic type corresponding to the target network device port. The historical traffic value sequence indicates normal operation of the target network device port (i.e., no abnormal traffic drop). The target traffic type of the target network device port is one of the following: steady, periodic, or irregular. In the above example, the target historical time period is the traffic values ​​collected at different times on the past two days, T-1 and T-2. In contrast to the real-time traffic monitoring of the target network device port on the current day, T, the traffic values ​​collected at different times within the target historical time period are referred to as historical traffic values. Thus, the above historical traffic value sequence is composed of the historical traffic values ​​corresponding to different times within the target historical time period, arranged in sequence. The analysis of the historical traffic value sequence primarily involves determining whether it exhibits periodicity or stability, thereby determining whether the target traffic type corresponding to the target network device port at that time is periodic, stable, or irregular. The specific analysis process will be described in detail in subsequent embodiments. Here, it is emphasized that the determination of the target traffic type of the target network device port will determine the traffic threshold used for the target network device port when monitoring the target network device port's real-time traffic for abnormal traffic drop events on the current day, T. As shown in Figure 3, in summary, after the target network device port's traffic type is identified based on its historical traffic value sequence, if the target network device port's traffic type is periodic or steady, the traffic threshold used for the target network device port is determined to be an hourly precise traffic threshold. If the target network device port's traffic type is irregular, the traffic threshold used for the target network device port is determined to be a daily baseline traffic threshold. The hourly and daily levels correspond to two different time slice granularities: hourly and daily, respectively. The hourly and daily levels are merely examples and are not intended to be limiting. The following describes how to determine the traffic threshold corresponding to the target traffic type based on the target network device port's historical traffic value sequence.In practical applications, the historical traffic value sequence of a target network device port includes historical traffic values ​​obtained by collecting traffic values ​​from the target network device port at a first time slice granularity within a target historical time period. The target historical time period corresponds to a second time slice granularity. The first time slice granularity is smaller than the second time slice granularity. For example, the first time slice granularity is minute-level (for ease of description, 1 minute is used as an example below), while the second time slice granularity is day-level (i.e., 1 day). In practical applications, the target historical time period includes at least two second time slices, each corresponding to the second time slice granularity. These at least two second time slices correspond to at least two historical traffic value sequences. In conjunction with the above example, assuming that real-time traffic generated within T days needs to be monitored, the target historical time period may be T-1 and T-2 (only two days are used as an example herein), meaning that the at least two second time slices may be T-1 and T-2. The target network device port can be sampled at a sampling granularity of 1 minute (the first time slice granularity) to collect the traffic values ​​required to be transmitted per minute on both days T-1 and T-2, thereby obtaining historical traffic value sequences corresponding to each of these days. It is understood that if a historical traffic value is generated every minute, and there are 24 hours in a day, then the historical traffic value sequence corresponding to day T-1 (referred to as the first historical traffic value sequence for ease of description) and the historical traffic value sequence corresponding to day T-2 (referred to as the second historical traffic value sequence for ease of description) each include 1440 historical traffic values. These two historical traffic value sequences are time-aligned, meaning each historical traffic value sequence corresponds to the same multiple first time slices (1 minute). After collecting the first and second historical traffic value sequences corresponding to days T-1 and T-2 at 1-minute intervals, respectively, the traffic threshold corresponding to the target traffic type of the target network device port can be determined based on the first and second historical traffic value sequences. Specifically, when the target traffic type is steady or periodic, the process of determining the traffic threshold corresponding to the target traffic type includes: aggregating each historical traffic value in the target historical traffic value sequence according to a set third time slice granularity to obtain multiple historical aggregated traffic values ​​corresponding to multiple third time slices; multiplying each of the multiple historical aggregated traffic values ​​corresponding to the multiple third time slices by a set drop coefficient to obtain multiple first traffic thresholds corresponding to the target network device port at the third time slice granularity, wherein the multiple first traffic thresholds each correspond to a different third time slice. A third time slice includes multiple consecutive first time slices, and the third time slice granularity is smaller than the second time slice granularity. In other words, the third time slice granularity is between the first time slice granularity and the second time slice granularity.In practical applications, corresponding to the first time slice granularity of 1 minute and the second time slice granularity of 1 day, the third time slice granularity can be 1 hour, i.e., hourly granularity. When the third time slice granularity is at the hourly level (e.g., 1 hour), the first traffic threshold is the hourly precise traffic threshold mentioned above. When determining whether the target traffic type corresponding to the target network device port is periodic or steady, the target historical traffic value sequence used for traffic threshold determination can be one or both of the first and second historical traffic value sequences. When using two historical traffic value sequences, they can be merged into a single historical traffic value sequence in chronological order. Here, we use the first historical traffic value sequence as an example. In actual applications, the first historical traffic value sequence includes a historical traffic value corresponding to each minute within a day, for a total of 1440 historical traffic values ​​(corresponding to 1440 one-minute intervals). The third time slice granularity is 1 hour. These 1440 historical traffic values ​​are aggregated hourly to obtain the historical aggregated traffic value corresponding to each hour, resulting in a total of 24 historical aggregated traffic values. Assume that the first time slices corresponding to the 1440 historical traffic values ​​are 00:01, 00:02, ..., and 24:00, respectively. The historical traffic values ​​corresponding to each of the 60 one-minute intervals within each hour are aggregated to obtain the historical aggregated traffic value corresponding to each hour. This aggregation process can be any calculation method, such as averaging, median, or a specific quantile (quintile or deciles). Subsequently, the historical aggregated traffic values ​​corresponding to each of the 24 hours are multiplied by a set drop coefficient (e.g., 0.5) to obtain multiple first traffic thresholds corresponding to the target network device port at the third time slice granularity (hourly level), i.e., the first traffic threshold corresponding to each of the 24 hours. The above-mentioned hourly precise traffic threshold means that when the target network device port has a periodic or steady traffic type, the traffic threshold corresponding to each hour is different when monitoring the real-time traffic value of the target network device port during the current T days. When the target traffic type of the target network device port is irregular, the process of determining the traffic threshold corresponding to the target network device port under this target traffic type includes: clustering the target historical traffic value sequence to obtain multiple clusters, determining a first target cluster with the smallest center point among the multiple clusters, determining a second statistical value of the multiple historical traffic values ​​included in the first target cluster, and multiplying the second statistical value by the set drop coefficient to obtain a second traffic threshold corresponding to the target network device port at the second time slice granularity.Similarly, the target historical traffic value sequence is at least one of the at least two historical traffic value sequences described above. Taking the first historical traffic value sequence as an example, a clustering algorithm (such as K-means clustering) can be used to cluster the first historical traffic value sequence to obtain N clusters (N>1). oThe value of N can be determined using a clustering method. After obtaining N clusters, each containing multiple historical traffic values, with one cluster serving as the center point, a first target cluster with the smallest center point is determined from the N clusters. Next, a second statistical value (such as the mean, median, or a specific quantile (quintile, decile)) is determined for the multiple historical traffic values ​​contained in the first target cluster. This second statistical value is then multiplied by a set drop coefficient (such as 0.5) to obtain a second traffic threshold for the second time slice granularity (daily) corresponding to the target network device port, thereby obtaining the daily bottom-line traffic threshold. The term "bottom-line" refers to the lower limit, corresponding to the "cluster with the smallest center point" mentioned above. For traffic types with large fluctuations, irregularities, and no obvious characteristics, a "bottom-line approach" is employed to identify abnormal drops. Above this "bottom-line," traffic fluctuations are permitted. However, once it falls below this bottom-line by a certain margin, an abnormal traffic drop can be determined. The above-mentioned daily bottom-line traffic threshold means that if the target network device port exhibits irregular traffic patterns, the traffic threshold corresponding to each hour of the day will be the same when monitoring the target network device port's real-time traffic values ​​for the current day (T days). The aforementioned "drop coefficient" is primarily used to identify obvious abnormal traffic drops, without focusing on reasonable low traffic conditions. When monitoring the target network device's real-time traffic values ​​for the current day (T days), the real-time traffic values ​​for each first time slice (i.e., 1 minute each) within the target network device port can be collected sequentially at the first time slice granularity (e.g., 1 minute in the example above). In other words, the real-time traffic value transmitted by the target network device port every minute within the T days can be collected in real time. Each collected real-time traffic value can be compared with the traffic threshold corresponding to the target network device port. If multiple first real-time traffic values ​​collected within multiple consecutive first time slices are all below the traffic threshold, a first statistical value of multiple second real-time traffic values ​​collected prior to the multiple first real-time traffic values ​​is determined. If the first statistical value is greater than a predetermined multiple of the traffic threshold, the multiple first real-time traffic values ​​are determined to correspond to an abnormal traffic drop event. If the target traffic type of the target network device port is periodic or steady, the traffic threshold used is the aforementioned "hourly precise traffic threshold," i.e., the first traffic threshold corresponding to each of the 24 hours. If the target traffic type of the target network device port is irregular, the traffic threshold used is the aforementioned "daily baseline traffic threshold," i.e., the second traffic threshold corresponding to each day.Based on this, if the target traffic type corresponding to the target network device port is steady or periodic, the first traffic threshold corresponding to each of the multiple first real-time traffic values ​​is determined based on the third time slice to which the first time slices corresponding to each of the multiple first real-time traffic values ​​belong. If the multiple first real-time traffic values ​​are all below their respective first traffic thresholds, the first statistical value of the multiple second real-time traffic values ​​collected before the multiple first real-time traffic values ​​is determined. For example, assuming the number of the multiple first real-time traffic values ​​is set to three, then within T days, whenever a real-time traffic value is collected at intervals of one minute (the first time slice), the hour (the third time slice) to which this minute belongs is determined, and the real-time traffic value is compared with the first traffic threshold corresponding to this hour. If three consecutive real-time traffic values ​​(which may correspond to the same hour or different hours) are all below the corresponding first traffic threshold, it indicates that an abnormal traffic drop event may have occurred. Whether this has actually occurred needs to be determined in conjunction with the traffic values ​​before these three real-time traffic values. If the target traffic type corresponding to the target network device port is irregular, and the first time slices (1 minute) corresponding to multiple first real-time traffic values ​​all fall within the same second time slice (1 day), then the traffic thresholds corresponding to the multiple first real-time traffic values ​​are determined to be the second traffic threshold. Therefore, if the multiple first real-time traffic values ​​are all below the second traffic threshold, the first statistical value of the multiple second real-time traffic values ​​collected before the multiple first real-time traffic values ​​is determined. In other words, when using a daily baseline traffic threshold, each time a real-time traffic value is collected at 1-minute intervals (first time slices) within T days, the real-time traffic value is compared with the second traffic threshold corresponding to T days. If three consecutive real-time traffic values ​​are all below the corresponding second traffic threshold, it indicates that an abnormal traffic drop may have occurred. Whether this has occurred requires consideration of the traffic values ​​preceding these three real-time traffic values ​​to determine. In the present embodiment, the real-time traffic value that is continuously below the corresponding traffic threshold is referred to as the first real-time traffic value. Then, real-time flow values ​​collected within a first set number (eg, 15, 20) of first time slices before the multiple first real-time flow values ​​are obtained, that is, flow values ​​collected within, for example, 20, one minute before the multiple first real-time flow values ​​are obtained.It should be noted that, assuming that, shortly after the start time (00:00) of the current day T, three consecutive real-time traffic values ​​appear that are less than the corresponding traffic threshold, then the 20 traffic values ​​traced back may not all have occurred within T days and may include some traffic values ​​from day T-1. In the disclosed embodiment, for ease of description, these traffic values ​​are also referred to as real-time traffic values. After obtaining the 20 real-time traffic values, they are sorted in order of magnitude, for example, from smallest to largest. The sorted real-time traffic values ​​are then grouped into a set number of groups. For example, if the number of groups is four, four groups are obtained, each containing five real-time traffic values. The target group containing the lowest real-time traffic value is selected; in the above example, this is the first group. The real-time traffic values ​​contained in this target group are used as the multiple second real-time traffic values, and a first statistical value of the multiple second real-time traffic values, such as a mean, a median, or a certain quantile, is determined. The above method for determining multiple second real-time traffic values ​​is merely an example. In practice, other methods can also be used to obtain lower traffic values ​​among a set number of real-time traffic values ​​preceding the multiple first real-time traffic values ​​as the multiple second real-time traffic values. Finally, if the first statistical value of the multiple second real-time traffic values ​​is greater than a set multiple of the traffic threshold, the multiple first real-time traffic values ​​are determined to correspond to an abnormal traffic drop event. In this case, an alarm can be output to indicate an abnormal traffic drop on the target network device port. Assuming the set multiple is 1.5 times, if a daily baseline traffic threshold is used, then if the ratio of the first statistical value to the second traffic threshold corresponding to T days is greater than 1.5 times, the multiple first real-time traffic values ​​are determined to correspond to an abnormal traffic drop event. If an hourly precise traffic threshold is used, a threshold statistical value of the first traffic threshold corresponding to the multiple first real-time traffic values ​​can be determined. If the ratio of the first statistical value to the threshold statistical value is greater than 1.5 times, the multiple first real-time traffic values ​​are determined to correspond to an abnormal traffic drop event. The threshold statistical value refers to the average, maximum, etc. of the first traffic threshold corresponding to the multiple first real-time traffic values. It is understandable that if multiple first real-time traffic values ​​belong to the same hour, they correspond to the same first traffic threshold. To facilitate understanding of the above determination logic, a schematic illustration is provided in conjunction with FIG4 . As shown in FIG4 , assume that three black squares represent three consecutive real-time traffic values ​​below the traffic threshold (daily baseline traffic threshold or hourly precise traffic threshold). The previous multiple real-time traffic values ​​are represented by dots, with the group with the lower traffic values ​​represented by black dots and the remaining traffic values ​​represented by white dots. All of the dots correspond to traffic values ​​that are greater than the traffic threshold.If multiple first real-time traffic values ​​(black squares) below the traffic threshold are significantly lower than a set of lower second real-time traffic values ​​(black circles) previously above the traffic threshold, an abnormal traffic drop event has occurred. This "significantly lower" is reflected by the aforementioned set multiples (e.g., 1.5 times, 2 times). In summary, in the above solution, by identifying the traffic type of the target network device port and setting different types of traffic thresholds for different traffic types, targeted abnormal traffic drop event identification can be performed based on the traffic type of the target network device port using traffic thresholds with different time slice granularities, helping to improve the accuracy of abnormal traffic drop event identification results. Furthermore, as traffic is generated on the network device port, real-time identification is performed at the first time slice granularity (e.g., 1 minute), ensuring the timeliness of identification. Figure 5 is a flow chart of a traffic type identification method provided in an embodiment of the present disclosure. As shown in Figure 5, the method may include the following steps:

[0006] 501. Obtain a historical traffic value sequence generated by a target network device port within a target historical time period, where the target historical time period includes at least two second time slices each corresponding to a second time slice granularity, and the at least two second time slices correspond to at least two historical traffic value sequences.

[0007] 502. Determine the ratio of two adjacent historical flow values ​​in any historical flow value sequence in sequence to obtain multiple ratios corresponding to the historical flow value sequence. If the cumulative sum of the multiple ratios is within a set value range, determine that the target flow type corresponding to the target network device port is a steady type.

[0008] 503. Determine the correlation coefficient between at least two historical traffic value sequences. If the correlation coefficient falls within a set positive correlation coefficient range, determine that the target traffic type corresponding to the target network device port is periodic. As described above, the target historical time period corresponds to a second time slice granularity (e.g., 1 day). The at least two second time slices may be days T-1 and T-2 as described above, with each day corresponding to a historical traffic value sequence. Each historical traffic value sequence includes historical traffic values ​​obtained by collecting traffic values ​​from the target network device port at the first time slice granularity (e.g., 1 minute) during the target historical time period. Furthermore, the historical traffic value sequence corresponds to the normal operating state of the target network device port, that is, it is collected when the target network device port has not experienced an abnormal operating state such as an abnormal traffic drop. As described above, the target traffic type can be one of the following: stable, periodic, or irregular. Therefore, in practical applications, it is possible to first determine whether the target traffic type of the target network device port is stable, and then determine whether it is periodic. If it is neither stable nor periodic, it is determined to be irregular. The order of determination for steady-state and periodic traffic types is not restricted. For example, consider a historical traffic value sequence formed by collecting historical traffic values ​​from a target network device port every minute for a specific day (e.g., day T-1). This historical traffic value sequence contains 1440 historical traffic values. These 1440 historical traffic values ​​can be arranged in chronological order, and the ratio of two adjacent historical traffic values ​​can be calculated to obtain multiple ratios corresponding to the historical traffic value sequence. Specifically, 1439 ratios can be obtained. The ratio calculation process is to calculate the ratio of the i-th historical traffic value to the i+1-th historical traffic value. It's understandable that if these 1440 historical traffic values ​​are perfectly stable (i.e., equal), then the resulting cumulative sum of the ratios is 1439. A value range can be set based on this. For example, if 1439 fluctuates by 10, the value range is [1429, 1449]. In practice, this value range is related to the number of historical traffic values ​​contained in the historical traffic value sequence and can be obtained by fluctuating within a certain range based on this number. Therefore, if the cumulative sum of the multiple ratios actually calculated falls within this set value range, the target traffic type corresponding to the target network device port is determined to be stable. If the cumulative sum of the ratios does not fall within this value range, a further determination is made as to whether the target traffic type corresponding to the target network device port is periodic. Determining whether the target traffic type is periodic requires at least two historical traffic value sequences corresponding to the second time slice. For ease of description, the following assumes that a first historical traffic value sequence from day T-1 and a second historical traffic value sequence from day T-2 were collected.Calculate the correlation coefficient between the first historical traffic value sequence and the second historical traffic value sequence. If the correlation coefficient is within a set positive correlation coefficient range, determine that the target traffic type corresponding to the target network device port is periodic. In the disclosed embodiment, a positive correlation coefficient range can be set, for example, to [0.5, 1]. That is, if the correlation coefficient between two historical traffic value sequences is greater than 0.5, the target traffic type corresponding to the target network device port is determined to be periodic. In practical applications, traffic threshold mechanisms based on the aforementioned different time granularities may not cover all practical application scenarios of abnormal traffic drop events. For example, in an e-commerce application scenario, the target network device runs an e-commerce application. During certain promotional days, traffic on the target network device port may surge several times, and traffic fluctuations may be more significant than usual. For example, if a promotion lasts for five consecutive days, traffic may be very high on the first three days, and then suddenly drop significantly on the fourth day, but it does not exceed the hourly precise traffic threshold or daily bottom-line traffic threshold determined based on the traffic of the previous three days. In this case, the hourly precise traffic threshold or daily bottom-line traffic threshold will not be able to accurately identify this abnormal traffic drop event. Therefore, the disclosed embodiment provides a "real-time clustering mechanism" to complement the traffic threshold mechanism, thereby fully covering possible abnormal traffic drop scenarios. This real-time clustering mechanism is described in conjunction with Figure 6. FIG6 is a flow chart of a method for identifying an abnormal traffic drop according to an embodiment of the present disclosure. As shown in FIG6 , the method may include the following steps:

[0009] 601. Determine a target traffic type corresponding to a target network device port and a traffic threshold corresponding to the target traffic type.

[0010] 602. Collect the real-time traffic value of the target network device port in each first time slice in sequence at the set first time slice granularity.

[0011] 603. If the multiple first real-time flow values ​​collected in multiple consecutive first time slices are all higher than the flow threshold, then obtain the real-time flow values ​​collected in a second set number of first time slices, where the second set number of first time slices includes the first time slices corresponding to the multiple first real-time flow values.

[0012] 604. Perform clustering processing on the real-time traffic values ​​collected in the second set number of first time slices to obtain multiple clusters, and determine a second target cluster with a minimum center point and a third target cluster with a second minimum center point among the multiple clusters.

[0013] 605. If the second target cluster includes multiple first real-time traffic values, determine a third statistical value corresponding to the real-time traffic values ​​included in the second target cluster and a fourth statistical value corresponding to the real-time traffic values ​​included in the third target cluster.

[0014] 606. If the fourth statistical value is greater than the third statistical value by a predetermined multiple, the multiple first real-time traffic values ​​are determined to correspond to an abnormal traffic drop event. In this embodiment, following the example in the previous embodiment, the first time slice granularity is 1 minute. During the current T days, real-time traffic values ​​of the target network device port are collected every 1 minute and then compared with the corresponding traffic threshold. When the target traffic type corresponding to the target network device port is periodic or steady, the traffic threshold is an hourly precise traffic threshold (i.e., the first traffic threshold corresponding to each hour described above). When the target traffic type corresponding to the target network device port is irregular, the traffic threshold is a daily baseline traffic threshold (i.e., the second traffic threshold corresponding to T days described above). If the currently collected real-time traffic value is less than the traffic threshold, the next several (e.g., two or three) real-time traffic values ​​are observed to see if they are all below the traffic threshold. If so, the processing flow in the previous embodiment is executed. If the currently collected real-time flow rate value is higher than the flow rate threshold, the next several (e.g., two or three) real-time flow rate values ​​are observed to see if they are all higher than the flow rate threshold. If so, the process flow of this embodiment is executed. Specifically, if multiple first real-time flow rate values ​​(e.g., three) collected within multiple consecutive first time slices are all higher than the flow rate threshold, real-time flow rate values ​​collected within a second set number of first time slices may be obtained. The second set number of first time slices includes first time slices corresponding to multiple first real-time flow values. For example, the second set number is 180. For example, assuming that the real-time flow rate values ​​collected within minutes t1, t2, and t3 on day T are all higher than the flow rate threshold, then starting from minute t3 and going back 180 minutes, 180 real-time flow values ​​are obtained, including the three real-time flow values ​​collected at minutes t1, t2, and t3. It should be noted that some of these 180 traffic values ​​may be from day T-1, not from day T. For ease of description, in this embodiment, they are collectively referred to as real-time traffic values. Subsequently, these 180 real-time traffic values ​​are clustered to obtain multiple clusters (assuming M, M>1). oEach cluster contains multiple real-time flow values ​​and has a center point. Optionally, after obtaining M clusters, invalid clusters can be removed. Invalid clusters are clusters containing fewer than a set number of real-time flow values. This eliminates extreme flow values, such as occasional sudden increases or decreases. Next, a second target cluster with the smallest center point and a third target cluster with the next smallest center point are determined among the M clusters. Specifically, the M clusters can be sorted from smallest to largest based on the size of their centers, with the top two clusters identified as the second and third target clusters. Next, a determination is made as to whether the three real-time flow values ​​collected within minutes t1, t2, and t3 are all in the second target cluster. If all three real-time flow values ​​are in the second target cluster, this indicates a significant downward trend in flow values ​​compared to other real-time flow values ​​collected before these three real-time flow values. The extent of the decline needs to be determined in conjunction with the third target cluster. Conversely, if the three real-time traffic values ​​are not located in the second target cluster, this means that no sudden significant drop in traffic values ​​has been detected. The collection and assessment of subsequent real-time traffic values ​​can be continued. Calculating the degree of the drop includes determining a third statistical value corresponding to the real-time traffic values ​​in the second target cluster and a fourth statistical value corresponding to the real-time traffic values ​​in the third target cluster. The third and fourth statistical values ​​can be any of the following: means, medians, quantiles, etc. If the ratio of the fourth statistical value to the third statistical value is greater than a preset multiple (e.g., 1.5 times or 2 times), it indicates a significant drop in traffic values, indicating an abnormal traffic drop event has occurred, and an alarm is issued. Furthermore, in the disclosed embodiment, to reduce alarm noise and avoid frequent alarms for the target network device port, an alarm may be issued upon the first abnormal traffic drop event identified within the current T days. Subsequently, if an abnormal traffic drop event is identified again within a preset time period (e.g., 3 hours), the alarm may not be repeated. The scenario of an abnormal traffic drop event under the above-mentioned real-time clustering mechanism can be understood with reference to Figure 7. In Figure 7, although the real-time traffic values ​​of the target network device ports are all above the traffic threshold, the black dots in the figure still show a significant abnormal traffic drop compared to the traffic values ​​represented by the white dots. In summary, the embodiments of the present disclosure provide both a traffic threshold mechanism and a real-time clustering mechanism to achieve comprehensive coverage of abnormal traffic drop events. As shown in Figure 8, the execution process of these two mechanisms can be simply described as: collecting traffic values ​​from the target network device ports and comparing them with the traffic threshold.If the traffic flow rate is below the traffic threshold, an abnormal traffic drop identification method based on a traffic threshold concentration is used to further identify whether an abnormal traffic drop event has occurred. If the traffic flow rate is above the traffic threshold, a real-time clustering mechanism is used to identify whether an abnormal traffic drop event has occurred. This combined dynamic traffic threshold mechanism and real-time clustering mechanism achieves comprehensive coverage of abnormal traffic drop scenarios on network device ports, improving the ability to identify abnormal traffic drops. Furthermore, based on the identification of traffic types on network device ports, traffic thresholds with different time granularities are used for different traffic types, improving the accuracy and real-time nature of identifying abnormal traffic drop events on network device ports. The following describes in detail one or more embodiments of the present disclosure regarding abnormal traffic drop identification devices. Those skilled in the art will appreciate that these devices can be constructed using commercially available hardware components and configured according to the steps taught in this solution. Figure 9 is a schematic diagram of the structure of an abnormal traffic drop identification device provided in an embodiment of the present disclosure. This abnormal traffic drop identification device is applied to a server. As shown in Figure 9, the device includes a determination module 11, a collection module 12, and an identification module 13. oThe determination module 11 is configured to determine a target traffic type corresponding to a target network device port and a traffic threshold corresponding to the target traffic type. The collection module 12 is configured to sequentially collect real-time traffic values ​​of the target network device port within each first time slice at a predetermined first time slice granularity. The identification module 13 is configured to, if multiple first real-time traffic values ​​collected within multiple consecutive first time slices are all lower than the traffic threshold, determine a first statistical value of multiple second real-time traffic values ​​collected prior to the multiple first real-time traffic values. If the first statistical value is greater than a predetermined multiple of the traffic threshold, determine that the multiple first real-time traffic values ​​correspond to an abnormal traffic drop event, and the multiple second real-time traffic values ​​are lower traffic values ​​among the real-time traffic values ​​collected within a first predetermined number of first time slices prior to the multiple first time slices. The device shown in FIG. 9 can perform the steps of the aforementioned embodiment. The detailed execution process and technical effects are described in the aforementioned embodiment and are not further elaborated here. In one possible design, the structure of the device shown in FIG. 9 can be implemented as an electronic device. As shown in Figure 10 , the electronic device may include: a processor 21, a memory 22, and a communication interface 23. Memory 22 stores executable code. When executed by processor 21, processor 21 can implement at least the method for identifying an abnormal traffic drop as provided in the aforementioned embodiments. Furthermore, embodiments of the present disclosure provide a non-transitory machine-readable storage medium storing executable code. When executed by the processor of the electronic device, the processor can implement at least the method for identifying an abnormal traffic drop as provided in the aforementioned embodiments. The device embodiments described above are merely illustrative. The network elements described as separate components may or may not be physically separate. Some or all of these modules can be selected to achieve the objectives of the present embodiments as needed. Persons skilled in the art can understand and implement the present embodiments without inventive effort. Through the above description of the embodiments, persons skilled in the art can clearly understand that each embodiment can be implemented using a necessary general-purpose hardware platform, or alternatively, through a combination of hardware and software. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a computer product. The present disclosure can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.Finally, it should be noted that the above embodiments are merely illustrative of the technical solutions of the present disclosure and are not intended to limit the present disclosure. Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they may modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein with equivalents. However, such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present disclosure.

Claims

Claims 1. A method for identifying an abnormal traffic drop, the method comprising: Determine a target traffic type corresponding to a target network device port and a traffic threshold corresponding to the target traffic type; sequentially collecting real-time traffic values ​​of the target network device port in each first time slice at a set first time slice granularity; if multiple first real-time traffic values ​​collected in multiple consecutive first time slices are all lower than the traffic threshold, determining first statistical values ​​of multiple second real-time traffic values ​​collected before the multiple first real-time traffic values, where the multiple second real-time traffic values ​​are lower traffic values ​​among the real-time traffic values ​​collected in a first set number of first time slices before the multiple first time slices; If the first statistical value is greater than the traffic threshold value by a set multiple, it is determined that the multiple first real-time traffic values ​​correspond to an abnormal traffic drop event.

2. The method according to claim 1, wherein: The determining of the first statistical value of the multiple second real-time flow values ​​collected before the multiple first real-time flow values ​​includes: obtaining the real-time flow values ​​collected within a first set number of first time slices before the multiple first time slices; sorting the real-time flow values ​​collected within the first set number of first time slices; performing grouping processing on the sorted real-time flow values ​​with a set number of groups to obtain a target group containing the multiple second real-time flow values; and determining the first statistical value of the multiple second real-time flow values ​​contained in the target group.

3. The method according to claim 1, wherein: The determining of the target traffic type corresponding to the target network device port includes: obtaining a historical traffic value sequence generated by the target network device port within a target historical time period, the historical traffic value sequence corresponding to the normal operating status of the target network device port, the historical traffic value sequence including each historical traffic value obtained by collecting traffic values ​​for the target network device port at the first time slice granularity within the target historical time period, and the target historical time period corresponding to the second time slice granularity; analyzing the historical traffic value sequence to determine the target traffic type corresponding to the target network device port, the target traffic type being one of the following: a steady type, a periodic type, and an irregular type, wherein the irregular type refers to a traffic type other than the steady type and the periodic type.

4. The method according to claim 3, wherein: The analyzing the historical flow value sequence to determine the target traffic type corresponding to the target network device port, comprising: sequentially determining the ratio of two adjacent historical flow values ​​in the historical flow value sequence to obtain a plurality of ratios corresponding to the historical flow value sequence; If the cumulative sum of the multiple ratios is within a set value range, it is determined that the target traffic type corresponding to the target network device port is a steady type, wherein the value range is related to the number of historical traffic values ​​included in the historical traffic value sequence.

5. The method according to claim 3, wherein: The target historical time period includes at least two second time slices corresponding to the second time slice granularity, and the at least two second time slices correspond to at least two historical traffic value sequences; analyzing the historical traffic value sequence to determine the target traffic type corresponding to the target network device port includes: determining a correlation coefficient of the at least two historical traffic value sequences; if the correlation coefficient is within a set positive correlation coefficient range, determining that the target traffic type corresponding to the target network device port is a periodic type.

6. The method according to claim 4 or 5, wherein: The target flow type is the steady type or the periodic type; Determining the traffic threshold corresponding to the target traffic type includes: aggregating each historical traffic value in the historical traffic value sequence according to the set third time slice granularity to obtain multiple historical aggregated traffic values ​​corresponding to multiple third time slices, wherein a third time slice contains multiple consecutive first time slices, and the third time slice granularity is smaller than the second time slice granularity; multiplying the multiple historical aggregated traffic values ​​corresponding to the multiple third time slices by the set drop coefficient to obtain multiple first traffic thresholds of the third time slice granularity corresponding to the target network device port, and the multiple first traffic thresholds respectively correspond to different third time slices.

7. The method according to claim 5, wherein: The target flow type is the irregular type; Determining a traffic threshold corresponding to a target traffic type includes: clustering a target historical traffic value sequence to obtain multiple clusters, where the target historical traffic value sequence is at least one of the at least two historical traffic value sequences; determining a first target cluster having a minimum center point among the multiple clusters; determining a second statistical value of the multiple historical traffic values ​​included in the first target cluster; and multiplying the second statistical value by a set drop coefficient to obtain a second traffic threshold of a second time slice granularity corresponding to the target network device port.

8. The method according to claim 6, wherein: If the multiple first real-time flow values ​​collected in multiple consecutive first time slices are all lower than the flow threshold, determining the first statistical value of the multiple second real-time flow values ​​collected before the multiple first real-time flow values, including: if the target flow type is the steady type or the periodic type, determining the first flow threshold corresponding to each of the multiple first real-time flow values ​​according to the third time slice to which the first time slice corresponding to each of the multiple first real-time flow values ​​belongs; If the plurality of first real-time flow values ​​are all lower than their corresponding first flow thresholds, first statistical values ​​of a plurality of second real-time flow values ​​collected before the plurality of first real-time flow values ​​are determined.

9. The method according to claim 7, wherein: If the multiple first real-time flow values ​​collected within multiple consecutive first time slices are all lower than the flow threshold, then the first statistical value of the multiple second real-time flow values ​​collected before the multiple first real-time flow values ​​is determined, including: if the target flow type is the irregular type, the first time slices corresponding to the multiple first real-time flow values ​​all belong to the same second time slice, then it is determined that the flow thresholds corresponding to the multiple first real-time flow values ​​are all the second flow threshold; if the multiple first real-time flow values ​​are all lower than the second flow threshold, then the first statistical value of the multiple second real-time flow values ​​collected before the multiple first real-time flow values ​​is determined.

10. The method according to any one of claims 1 to 9, wherein: The method also includes: if the multiple first real-time flow values ​​collected in multiple consecutive first time slices are all higher than the flow threshold, then obtaining the real-time flow values ​​collected in a second set number of first time slices, and the second set number of first time slices include the first time slices corresponding to the multiple first real-time flow values; clustering the real-time flow values ​​collected in the second set number of first time slices to obtain multiple clusters; determining a second target cluster with a minimum center point and a third target cluster with a second minimum center point in the multiple clusters; if the second target cluster includes the multiple first real-time flow values, then determining a third statistical value corresponding to the real-time flow value included in the second target cluster and a fourth statistical value corresponding to the real-time flow value included in the third target cluster; if the fourth statistical value is greater than the third statistical value by a set multiple, then determining that the multiple first real-time flow values ​​correspond to an abnormal flow drop event.

11. An electronic device, comprising: A memory, a processor, and a communication interface; wherein the memory stores executable code, and when the executable code is executed by the processor, the processor executes the method for identifying abnormal flow rate drop according to any one of claims 1 to 10.

12. A non-transitory machine-readable storage medium having executable code stored thereon, which, when executed by a processor of an electronic device, causes the processor to execute the method for identifying an abnormal traffic drop according to any one of claims 1 to 10.

13. A computer program product comprising: A computer program, when executed by a processor of an electronic device, causes the processor to execute the method for identifying abnormal flow rate drop according to any one of claims 1 to 10. 18

Images