Device analysis system and method

Abstract

A device analysis system and method, the system includes: a data collection unit, used to collect source data of all connected network devices, a business center unit, used to establish N tags based on the source data of all network devices, filter out tags belonging to each network device from the N tags, construct a tag set corresponding to each network device, and send each network device and the corresponding tag set to a data warehouse; the data warehouse is used to store source data and tag sets. When analyzing the device, not only the inherent attribute source data of the network device is collected, but also at least one of the flow, risk monitoring, and operation management source data of the network device is collected, and data related to the operation and maintenance of the network device is added, making the maintenance of the network device more comprehensive and accurate.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a device analysis system and method. Background Art

[0002] With the development of the Internet industry, the scale of the network is constantly expanding, and the number of network devices is increasing rapidly. In traditional network equipment operation and maintenance, network equipment operation and maintenance personnel mainly rely on their own experience to check various parameters of network equipment. However, network equipment operation and maintenance personnel cannot be familiar with all equipment and the services they carry. When performing operation and maintenance, they need to spend a lot of time to familiarize themselves with the equipment to be operated and maintained, which leads to high time and labor costs for network equipment operation and maintenance.

[0003] In the prior art, the operation analysis of network equipment is mainly carried out by network management systems, that is, network management stations and network management protocols are used to manage network equipment connected to the network management system. However, these network management stations and network management protocols mainly monitor inherent attribute information such as port traffic, central processing unit (CPU) occupancy and memory occupancy of network equipment, but lack key data for equipment operation and maintenance, making it difficult to comprehensively maintain network equipment.

[0004] Based on this, there is a need for an equipment analysis system to improve the comprehensiveness of equipment analysis and maintenance. Summary of the invention

[0005] In a first aspect, the present application provides a device analysis system, comprising: a data acquisition unit, a data warehouse and a business center unit; one end of the data warehouse is connected to the business center unit, and the other end of the data warehouse is connected to the data acquisition unit; the data acquisition unit is used to collect source data of all connected network devices, and the source data of each network device includes at least one of inherent attribute source data, traffic source data, risk monitoring source data and operation management source data; the business center unit is used to establish N labels based on the source data of all network devices, filter out the label belonging to each network device from the N labels, construct a label set corresponding to the network device, and send each network device and the corresponding label set to the data warehouse; N is a positive integer; the data warehouse is used to store the correspondence between each network device and each label set.

[0006] Through the above method, when analyzing the equipment, not only the inherent attribute source data of the network equipment is collected, but also at least one of the flow, risk monitoring and operation management source data of the network equipment is collected. By adding data related to the operation and maintenance of the network equipment, the maintenance of the network equipment can be more comprehensive and accurate. Moreover, by establishing labels with reference to comprehensive source data and constructing a label set corresponding to the network equipment, it is also helpful to manage the network equipment by label, thereby helping to improve the flexibility of equipment operation and maintenance.

[0007] In a possible implementation, the data collection unit includes: a network device management module, a traffic analysis module, a security control module and an operation management module; the network device module is used to collect inherent attribute source data of the network device, and the inherent attribute source data includes at least one of the device name, device IP address, device type, device operation or device location; the traffic analysis module is used to collect traffic source data of the network device, and the traffic source data includes business traffic size and / or business traffic classification; the security control module is used to collect risk monitoring source data of the network device, and the risk monitoring source data includes at least one of the device security scanning record, device vulnerability repair record or device version evaluation record; the operation management module is used to collect operation management source data of the network device, and the operation management source data includes at least one of the device historical fault report, device emergency manual, device maintenance manual or device operation manual.

[0008] Through the above methods, collecting the inherent attribute source data of network equipment can more comprehensively monitor the operation of network equipment; collecting traffic source data can accurately detect the business processing status of the equipment; collecting risk monitoring source data can understand the risks of the equipment and help to troubleshoot it in time; collecting operation management source data is helpful for operating and maintaining the equipment.

[0009] A possible implementation method is that the business center unit includes a customization module, a retrieval engine module and a customization module, which is used to establish K sub-tags based on the source data of all network devices, and divide the K sub-tags into N tags, where N is a positive integer less than or equal to K in the tag classification; the retrieval engine module is used to filter out the tags belonging to each network device from the N tags, construct a tag set corresponding to the network device, establish a corresponding relationship between the tag set and the unique identifier of the network device, and send the corresponding relationship between the tag set and the unique identifier of the network device to the data warehouse.

[0010] In the above manner, sub-tags are established based on the source data of all network devices, and these sub-tags are divided into large tag categories, which is helpful for the maintenance and management of sub-tags. Moreover, by filtering out the tags belonging to each network device from the large tag category and constructing the tag set corresponding to the network device, it is also helpful to manage the network devices by tags and improve the efficiency of network device operation and maintenance.

[0011] In a possible implementation, the business center unit also includes an operation center module and a data engine module; the retrieval engine module is further used to receive a user's search instruction, the search instruction includes a first tag set or a first network device set, and send a retrieval instruction to the operation center module according to the search instruction, the retrieval instruction includes the first tag set or the first network device set; the operation center module is used to receive the retrieval instruction, search for a second network device set corresponding to the first tag set in the data warehouse through the data engine module, or search for a second tag set corresponding to the first network device set in the data warehouse through the data engine module, and return the found second tag set or second network device set to the retrieval engine module; the retrieval engine module is also used to inform the user of the second tag set or the second network device set.

[0012] Through the above method, users can find the corresponding tag set based on the known device set; they can also find the corresponding device set based on the tag set, thereby realizing forward or reverse management of network devices, increasing the convenience of network device operation and maintenance.

[0013] In a possible implementation, the N tags include: a network device operation tag, a network device attribute tag, a network device service carrying tag, a network device risk control tag, and a network device operation management tag.

[0014] Through the above method, the labels of network equipment are divided into five categories, which can cover most of the labels required for operation and management of network equipment, making the operation and maintenance of network equipment more convenient.

[0015] In one possible implementation, the search instruction includes a first network device set; before the retrieval engine module informs the user of the second tag set, it is also used to: determine duplicate tags based on the tags included in each tag set; determine the number of duplicate tags and the proportion of duplicate tags in all tags included in each tag set; the retrieval engine module informs the user of the second tag set, including: informing the user of the second tag set, the number of duplicate tags and the proportion of each duplicate tag.

[0016] Through the above method, users can obtain duplicate label information of network devices and analyze network devices according to the duplicate labels, which helps to save analysis resources and improve device analysis efficiency.

[0017] In one possible implementation, after the retrieval engine module informs the user of the second network device set, it is also used to: receive attribute definitions sent by the user and send the attribute definitions to the data engine module; the attribute definitions include the name of the second network device set, the creation time of the second network device set, and the creator of the second network device set.

[0018] Through the above method, the user can define the attributes of the device set and store them, so that the user can directly call the set next time he uses it, thereby improving the efficiency of network device operation and maintenance.

[0019] On the second aspect, the present application also provides a network equipment analysis method, including: collecting source data of all connected network devices, the source data of each network device including inherent attribute source data, and at least one of traffic source data, risk monitoring source data and operation management source data; establishing N labels based on the source data of all network devices, filtering out labels belonging to each network device from the N labels, constructing a label set corresponding to the network device, and sending each network device and the corresponding label set to a data warehouse; N is a positive integer; storing the label set and the network device set.

[0020] In a possible implementation, the data collection unit includes: a network device management module, a traffic analysis module, a security control module and an operation management module; the network device module collects inherent attribute source data of the network device, and the inherent attribute source data includes at least one of the device name, device IP address, device type, device operation or device location; the traffic analysis module collects traffic source data of the network device, and the traffic source data includes business traffic size and / or business traffic classification; the security control module collects risk monitoring source data of the network device, and the risk monitoring source data includes at least one of the device security scanning record, device vulnerability repair record or device version evaluation record; the operation management module collects operation management source data of the network device, and the operation management source data includes at least one of the device historical fault report, device emergency manual, device maintenance manual or device operation manual.

[0021] A possible implementation method is that the business center unit includes a customization module and a retrieval engine module. The customization module establishes K sub-tags based on the source data of all network devices, and divides the K sub-tags into N tags, where N is a positive integer less than or equal to K in the tag classification; the retrieval engine module filters out the tags belonging to each network device from the N tags, constructs a tag set corresponding to the network device, establishes a corresponding relationship between the tag set and the unique identifier of the network device, and sends the corresponding relationship between the tag set and the unique identifier of the network device to the data warehouse.

[0022] In a possible implementation, the business center unit also includes an operation center module and a data engine module; the retrieval engine module receives a user's search instruction, the search instruction includes a first tag set or a first network device set, and sends a retrieval instruction to the operation center module according to the search instruction, the retrieval instruction includes the first tag set or the first network device set; the operation center module receives the retrieval instruction, and searches for a second network device set corresponding to the first tag set in the data warehouse through the data engine module, or searches for a second tag set corresponding to the first network device set in the data warehouse through the data engine module, and returns the found second tag set or second network device set to the retrieval engine module; the retrieval engine module informs the user of the second tag set or the second network device set.

[0023] In one possible implementation, the search instruction includes a first network device set; before the retrieval engine module notifies the user of the second tag set, it also includes determining duplicate tags based on the tags included in each tag set; determining the number of duplicate tags and the proportion of duplicate tags in all tags included in each tag set; the retrieval engine module notifies the user of the second tag set, including: notifying the user of the second tag set, the number of duplicate tags and the proportion of each duplicate tag.

[0024] A possible implementation method is that after the retrieval engine module informs the user of the second network device set, it also includes: receiving the attribute definition sent by the user, and sending the attribute definition to the data engine module; the attribute definition includes the name of the second network device set, the creation time of the second network device set, and the creator of the second network device set.

[0025] In a third aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is run, any one of the methods in the first aspect is executed.

[0026] In a fourth aspect, the present application provides a computing device, comprising: a memory for storing program instructions; a processor for calling the program instructions stored in the memory, and executing the method in any one of the designs in the above-mentioned first aspect according to the obtained program.

[0027] In a fifth aspect, the present application provides a computer program product, which, when executed on a processor, implements a method as in any one of the designs of the first aspect.

[0028] The beneficial effects of the second to fifth aspects mentioned above can be specifically referred to the beneficial effects that can be achieved by any design of the first aspect mentioned above, and will not be described in detail here. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1A schematic diagram of a scenario architecture provided by an embodiment of the present application is exemplarily shown;

[0030] Figure 2 A schematic diagram of a device analysis system provided in an embodiment of the present application is exemplarily shown;

[0031] Figure 3 A schematic diagram of a data unit structure provided in an embodiment of the present application is exemplarily shown;

[0032] Figure 4 A schematic diagram of a service center unit provided in an embodiment of the present application is exemplarily shown;

[0033] Figure 5 A schematic diagram of a process for performing equipment analysis and maintenance using the equipment analysis system provided in an embodiment of the present application is exemplarily shown;

[0034] Figure 6 A schematic diagram of a user front end provided in an embodiment of the present application is exemplarily shown;

[0035] Figure 7 A schematic diagram of a device analysis method provided in an embodiment of the present application is exemplarily shown. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] Figure 1 A schematic diagram of a scenario architecture provided by an embodiment of the present application is exemplarily shown, such as Figure 1 As shown, the scenario includes: a user, a user front end, a device analysis system, and M network devices connected to the device analysis system, where M is a positive integer.

[0038] For example, the user may be an operator and maintenance personnel of the network equipment. These operators and maintenance personnel can control the use of the equipment analysis system to maintain each network equipment through the user front-end operation page. The equipment analysis system can provide network equipment operation and maintenance services for users. The network equipment can be all network equipment in a computer room, and the type can be a server, computer, router, gateway, etc. The types of different network equipment can be the same or different, and there is no specific limitation.

[0039] Figure 2 A schematic diagram of a device analysis system provided in an embodiment of the present application is shown as an example. Figure 2As shown, the device analysis system includes: a data acquisition unit 203, a data warehouse 202 and a business center unit 201. Among them, one end of the data warehouse 202 is connected to the business center unit 201, and the other end of the data warehouse 202 is connected to the data acquisition unit 203. The data acquisition unit 203 is also connected to multiple network devices, such as network device 1, network device 2 and network device 3. It should be noted that the connection here can be a wired connection or a wireless connection, which is not specifically limited.

[0040] The following is a detailed introduction to each unit.

[0041] Data acquisition unit 203

[0042] The data collection unit 203 is used to collect source data of all connected network devices, such as Figure 1 After collecting the source data of network device 1, network device 2 and network device 3 as shown, the collected source data is stored in the data warehouse 202. The source data of each network device includes inherent attribute source data, and at least one of flow source data, risk monitoring source data and operation management source data, and preferably includes inherent attribute source data, flow source data, risk monitoring source data and operation management source data at the same time.

[0043] Figure 3 A schematic diagram of the structure of a data unit provided in an embodiment of the present application is exemplarily shown, such as Figure 3 As shown, the data collection unit 203 may include: a network device management module 2031, a traffic analysis module 2032, a security control module 2033 and an operation management module 2034, and the network device management module 2031, the traffic analysis module 2032, the security control module 2033 and the operation management module 2034 are connected to each network device respectively. Among them:

[0044] The network device management module 2031 is used to collect the inherent attribute source data of the network device. The inherent attribute source data may include the device name, the device Internet Protocol (IP) address, the device type, the device operation information or the device location, and may also include some other information, such as the brand information of the network device, the serial number of the network device, etc. Among them, the device name is used to uniquely identify a network device. The IP address is the address used by the device to communicate with other devices. The device location refers to the geographical location of the device. For example, if a server is located in Beijing and another server connected to it is in Shanghai, then the device location of the server is Beijing, and the device location of the other server is Shanghai. The device type refers to the type of device, which can be one of the server, computer, firewall, router, gateway, etc. Device operation refers to information related to device operation, such as the startup time of the device, the number of alarms of the device in the past week, etc.

[0045] The traffic analysis module 2032 is used to collect traffic source data of network devices, and the traffic source data may include service traffic size and / or service traffic classification, etc. The service traffic size refers to the size of the traffic flowing through a certain interface when the network device processes a certain service. Exemplarily, the service traffic classification can be divided into north-south traffic and east-west traffic, the north-south traffic is the traffic between multiple terminals and servers, and the east-west traffic is the traffic between multiple servers.

[0046] The security control module 2033 is used to collect risk monitoring source data of network devices, and the risk monitoring source data may include network device security scanning records, device vulnerability repair records or device version evaluation records, etc. Among them, the device security scanning record refers to the record of security scanning of network devices, which may include at least one of the following contents: whether to perform a security scan on the device, the scan items of each security scan, the time of each security scan, and the results of each security scan. Taking virus scanning of network devices as an example, the network device security scanning record may include the time of each virus scan and the type of virus that appears in each scan. The device vulnerability repair record refers to the record of repairing the vulnerabilities of network devices, such as the content of network device vulnerability repairs and the time when network device vulnerabilities appear. The network device version evaluation record refers to the record of evaluating the version of the device, such as the time of each device version evaluation and the results of the evaluation.

[0047] The operation management module 2034 is used to collect the operation management source data of the network device, and the operation management source data may include equipment historical fault reports, equipment emergency manuals, equipment maintenance manuals or equipment operation manuals, etc. Among them, the equipment historical fault report is used to record the report generated by the equipment when a fault occurs, including but not limited to the specific cause of the fault, the location of the fault and the fault record, etc. The equipment emergency manual is used to record the method of handling emergency situations of network equipment. The equipment maintenance manual is used to record the method of performing daily maintenance on the equipment. The equipment operation manual records the operation method of the equipment.

[0048] It should be noted that the above example only provides an example of a data acquisition unit 203. The types of modules included in the data acquisition unit 203 and the source data collected by each module can be determined according to the type of network device to which the device analysis system is connected. For example, in other examples, when the network device is a service-class network device, the data acquisition unit 203 may also include a configuration management database (CMDB), which is used to collect configuration information of the service-class network device and information about the connection between the network device and other network devices.

[0049] Business Center Unit 201

[0050] The business center unit 201 is used to establish N tags based on the source data of all network devices from the data collection unit 203, and filter out the tags belonging to each network device from the N tags, construct a tag set corresponding to each network device, and then send each network device and the corresponding tag set to the data warehouse. Wherein, N is a positive integer.

[0051] Figure 4 The structural diagram of a service center unit provided in an embodiment of the present application is exemplarily shown as follows: Figure 4 As shown, the business center unit 201 may include a customization module 2011 and a search engine module 2012, and may also include a data engine module 2013 and an operation center module 2014. The operation center module 2014 is respectively connected to the customization module 2011, the search engine module 2012 and the data engine module 2013. Each module is introduced below:

[0052] In a possible implementation, the customization module 2011 can establish K sub-tags based on the source data of all network devices, and divide the K sub-tags into N tags, where N is a positive integer less than or equal to K. In addition, the customization center 201 can not only establish new tags, but also manage and maintain the established tags, including but not limited to editing or deleting a tag. In addition, the tags to be established can also be determined by the user. For example, after the user completes the script for tag development, the script of the tag is submitted to the customization center module. The customization center module defines and configures the script, generates a new tag, and stores the newly generated tag in the data warehouse 202.

[0053] Exemplarily, the N tags may include: network equipment operation tags, network equipment attribute tags, network equipment service tags, network equipment risk control tags, network equipment operation management tags, and other tags may also be included, which are not specifically limited. Among them, the source data of the sub-tags in the network equipment operation tags are mainly inherent attribute source data and traffic source data, such as the traffic of each port of the network equipment, the routing configuration of the network equipment, etc. The source data of the sub-tags of the network equipment attribute tags are mainly inherent attribute source data, such as the network equipment name, network equipment IP address, network equipment brand, network equipment location, etc. The source data of the sub-tags of the network equipment service tag are mainly traffic source data, such as the traffic size of the service system carried by the network equipment, service traffic classification, service traffic composition, etc. The source data of the sub-tags of the network equipment risk control tags are mainly risk monitoring source data, such as network equipment security scanning records, equipment vulnerability repair records, equipment version evaluation records, etc. The source data of the sub-tags of the network equipment operation management tags are mainly operation management source data, such as equipment historical fault reports, equipment emergency manuals, equipment maintenance manuals, equipment operation manuals, etc.

[0054] Further exemplary, the content of the subtag may include: subtag identity document (ID), subtag name, tag to which the subtag is divided, primary classification of the subtag, subtag creation time and subtag creator, etc. Among them, the primary classification of the subtag is used to further divide the tag to which the subtag belongs, for example, the network device operation tag can be further divided into startup information and operation information.

[0055] Table 1 exemplarily shows a schematic diagram of a sub-tag structure established in a specific application scenario. The structure of a sub-tag is described below by taking a sub-tag as an example:

[0056] As shown in Table 1, based on the device name information in the device's inherent attribute source data, a "router" sub-tag can be established, and the tag can be assigned an ID: DEVICE_TYPE_002, and the tag can be classified into the device attribute tag. The first-level classification of the tag is device type, and the creation time is November 1, 2020, and the creator is Zhang San.

[0057] Table 1

[0058]

[0059] The search engine module 2012 is used to filter out the label belonging to each network device from the N labels, construct a label set corresponding to each network device, establish a corresponding relationship between the label set and the unique identifier of the network device, and send this corresponding relationship to the data warehouse 202. For example, assuming that the network device is a router, and the labels belonging to the router include network device operation label, network device attribute label, and network device bearer service label, then the search engine module 2012 can filter out the label belonging to the router from the five labels of network device operation label, network device attribute label, network device bearer service label, network device risk control label, and network device operation management label, aggregate them, establish a label set, establish a corresponding relationship with the unique identifier of the router, and send the router and the corresponding label set to the data warehouse 202 for storage. Among them, the unique identifier of the router can be the IP address of the router.

[0060] Data Warehouse 202

[0061] The data warehouse 202 is used to store source data, various tag sets, and corresponding relationships between various network devices and various tag sets. The call to the data warehouse 202 is implemented through the data engine module 2013.

[0062] For example, Table 2 shows a possible structural diagram of a data warehouse. As shown in Table 2, the contents stored in the database include source data, equipment groups, operation label tables, service tables, equipment attribute tables, risk control tables, and operation management tables, and add description information of the contents and modules that will call this content. For example, the description of the source data is "the source data of the label's own attributes", and the source data can be called by a custom module.

[0063] Table 2

[0064] content describe Calling object Source Data The attribute source data of the tag itself Custom modules Device Groups The device collection corresponding to the tag collection Search engine module Run Tag Table Run the topic class label aggregation table Search engine module, custom module Bearer Service Table Label aggregation table for bearer services Search engine module, custom module Device Properties Table Device attribute class label aggregation table Search engine module, custom module Risk Control Table Risk control label aggregation table Search engine module, custom module Operation Management Table Operation management tag aggregation table Search engine module, custom module

[0065] The following is based on Figure 2 The device analysis system and Figure 4 The business center unit shown in the figure introduces the specific process of each module in the equipment analysis system when performing equipment analysis.

[0066] Figure 5 A schematic diagram of a process for performing equipment analysis and maintenance using the equipment analysis system provided in an embodiment of the present application is exemplarily shown, and the process includes:

[0067] Step 501, the search engine module 2012 receives the user's search instruction, and sends a search instruction to the operation center module 2014 according to the search instruction.

[0068] Step 502 , the operation center module 2014 receives the instruction from the search engine module 2012 .

[0069] Step 503 , the data engine module 2013 receives the instruction from the operation center module 2014 .

[0070] Step 504 : the data engine module 2013 searches the data warehouse 202 for the second network device set corresponding to the first tag set, or searches the data warehouse 202 for the second tag set corresponding to the first network device set through the data engine module 2013 .

[0071] The second tag set or the second network device set found in step 505 is returned to the search engine module 2012 and notified to the user.

[0072] Exemplarily, the search engine module 2012 receives a search instruction sent by a user through the user front end. The search instruction can be in two cases:

[0073] In case one, the search instruction includes a first tag set. The search engine module 2012 generates a search instruction based on the first tag set in the search instruction and sends it to the operation center module 2014. The search instruction includes the first tag set. After receiving the search instruction, the operation center module 2014 searches for the second network device set corresponding to the first tag set in the data warehouse 202 through the data engine module 2013 based on the correspondence between the first tag set and the network device identifier, and returns the second network device set to the search engine module 2012. The search engine module 2012 then informs the user of the second network device set.

[0074] Exemplarily, after receiving the second network device set, the user can also define the attributes of the second network device set, establish the name, creation time, creator information and other information of the second network device set, and send the attribute definition containing this information to the search engine module 2012. The search engine module 2012 receives the attribute definition sent by the user, and sends the attribute definition to the data engine module 2013, and then the data engine module 2013 stores the attribute definition in the data warehouse 202. In this way, subsequent users can call the attribute definition in the data warehouse through the interaction between these modules when needed, and obtain relevant information of previous queries.

[0075] Further illustratively, Figure 6 A schematic diagram of a user front end provided in an embodiment of the present application is shown as follows: Figure 6 As shown in (a), in this example, the user front end may include a tag name and a first-level classification button of the tag. When querying according to situation one, the user can select the device operation tag in the tag, then select the button with a running time greater than 100 days, continue to select the device attribute button, and then select the firewall in the device type, thereby generating a search instruction. In this way, the tag set of the search instruction includes the network device operation tag and the network device attribute tag. The search instruction is to find all firewall devices with a running time greater than 100 days. After receiving the search instruction, the search engine module 2012 sends it to the operation center module 2014. The operation center module 2014 finds all firewall devices that meet this tag set in the database 203 through the data engine module 2013, forms a firewall device set, and informs the user of the firewall device set. Afterwards, the user defines the attributes of the firewall device set, such as setting the name of the firewall device set, and recording the creator information, and sends the attribute definition to the search engine module 2012, which is then stored in the data warehouse 202 by the search engine module 2012, so as to facilitate the direct call of the firewall device set for maintenance and management next time.

[0076] In case 2, the search instruction includes the first network device set. The search engine module 2012 generates a search instruction based on the first network device set in the search instruction and sends it to the operation center module 2014. The search instruction includes the first network device set. After receiving the search instruction, the operation center module searches the data warehouse 202 for the second label set corresponding to the first network device set through the data engine module 2013 according to the correspondence between the first label set and the network device identifier, and determines the repeated labels, the number of repeated labels, and the proportion of repeated labels according to the labels included in each label set; the search engine module 2012 informs the user of the second label set, the number of repeated labels, and the proportion of each repeated label, so that the user can maintain the network devices according to the labels.

[0077] Further illustratively, Figure 6 (b) shows another user front-end schematic diagram provided in the embodiment of the present application, such as Figure 6As shown in (b), in this example, the user's front-end page may include network device buttons: firewall button, router button, computer button, server button, and gateway button. When querying according to situation 2, the user can select the firewall button and the router button to form a known device set, and send the search instruction corresponding to this device set to the search engine module 2012. The search engine module 2012 then sends the search instruction to the operation center module 2014. The operation center module 2014 searches for the tags of all firewall devices and all router devices in the data warehouse 202 through the data engine module 2013. The tags of firewall devices include network device attribute tags, network device operation tags, and network device bearer service tags; the tags of router devices include network device attribute tags, network device operation tags, and network device operation management tags. The operation center module forms these found tags into a tag set, and analyzes the repeated tags and sub-tags in this tag set. For example, there are 80 firewall devices and 40 router devices in this device set, of which 30 firewall devices and 10 router devices have network device operation tags, and 20 firewall devices have startup duration tags. These repeated tags and sub-tags are sorted according to the number of occurrences, and the proportion of repeated tags in all tags is calculated. The result is notified to the user, so that the user can manage the network devices according to these tags.

[0078] In the above embodiment, the data acquisition unit is used to collect the source data of all connected network devices, and the business center unit is used to establish N tags based on the source data of all network devices, filter out the tags belonging to each network device from the N tags, construct a tag set corresponding to the network device, and send each network device and the corresponding tag set to the data warehouse; the data warehouse is used to store the source data and the tag set. When analyzing the equipment, not only the inherent attribute source data of the network equipment is collected, but also the traffic, risk monitoring, and operation management source data of the network equipment are collected, and the data related to the operation and maintenance of the network equipment are added, making the maintenance of the network equipment more comprehensive and accurate. In addition, tags are established based on these source data, and a tag set corresponding to the network equipment is constructed, which helps to manage the network equipment by tags and improve the efficiency of equipment operation and maintenance.

[0079] Based on the same technical concept, an embodiment of the present application also provides a device analysis method. Figure 7 A schematic diagram of a device analysis method provided in an embodiment of the present application is exemplarily shown, and the method can be executed by the aforementioned device analysis system, such as Figure 7 As shown, the method includes:

[0080] Step 701, collecting source data of all connected network devices, where the source data of each network device includes inherent attribute source data, and at least one of flow source data, risk monitoring source data, and operation management source data;

[0081] Step 702, establish N tags according to the source data of all network devices, filter out the tag belonging to each network device from the N tags, construct a tag set corresponding to each network device, and send each network device and the corresponding tag set to the data warehouse 202; N is a positive integer;

[0082] Step 703: store the tag set and the network device set.

[0083] In a possible implementation, the data collection unit includes: a network device management module, a traffic analysis module, a security control module and an operation management module; the network device module collects inherent attribute source data of the network device, and the inherent attribute source data includes at least one of the device name, device IP address, device type, device operation or device location; the traffic analysis module collects traffic source data of the network device, and the traffic source data includes business traffic size and / or business traffic classification; the security control module collects risk monitoring source data of the network device, and the risk monitoring source data includes at least one of the device security scanning record, device vulnerability repair record or device version evaluation record; the operation management module collects operation management source data of the network device, and the operation management source data includes at least one of the device historical fault report, device emergency manual, device maintenance manual or device operation manual.

[0084] A possible implementation method is that the business center unit includes a customization module and a retrieval engine module. The customization module establishes K sub-tags based on the source data of all network devices, and divides the K sub-tags into N tags, where N is a positive integer less than or equal to K in the tag classification; the retrieval engine module filters out the tags belonging to each network device from the N tags, constructs a tag set corresponding to the network device, establishes a corresponding relationship between the tag set and the unique identifier of the network device, and sends the corresponding relationship between the tag set and the unique identifier of the network device to the data warehouse.

[0085] In a possible implementation, the business center unit also includes an operation center module and a data engine module; the retrieval engine module receives a user's search instruction, the search instruction includes a first tag set or a first network device set, and sends a retrieval instruction to the operation center module according to the search instruction, the retrieval instruction includes the first tag set or the first network device set; the operation center module receives the retrieval instruction, and searches for a second network device set corresponding to the first tag set in the data warehouse through the data engine module, or searches for a second tag set corresponding to the first network device set in the data warehouse through the data engine module, and returns the found second tag set or second network device set to the retrieval engine module; the retrieval engine module informs the user of the second tag set or the second network device set.

[0086] In one possible implementation, the search instruction includes a first network device set; before the retrieval engine module notifies the user of the second tag set, it also includes determining duplicate tags based on the tags included in each tag set; determining the number of duplicate tags and the proportion of duplicate tags in all tags included in each tag set; the retrieval engine module notifies the user of the second tag set, including: notifying the user of the second tag set, the number of duplicate tags and the proportion of each duplicate tag.

[0087] A possible implementation method is that after the retrieval engine module informs the user of the second network device set, it also includes: receiving the attribute definition sent by the user, and sending the attribute definition to the data engine module; the attribute definition includes the name of the second network device set, the creation time of the second network device set, and the creator of the second network device set.

[0088] Based on the same technical concept, an embodiment of the present invention further provides a computing device, including: a memory for storing program instructions;

[0089] A processor is used to call the program instructions stored in the memory and execute the following according to the obtained program: Figure 7 The method indicated.

[0090] Based on the same technical concept, the embodiment of the present invention further provides a computer-readable storage medium, when the computer program product is run on a processor, Figure 7 The method indicated.

[0091] Based on the same technical concept, an embodiment of the present invention further provides a computer program product, which, when executed on a processor, implements the following Figure 7 The method indicated.

[0092] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0093] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0094] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0095] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0096] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A device analysis system, characterized in that: include: A data collection unit, a data warehouse and a business center unit; one end of the data warehouse is connected to the business center unit, and the other end of the data warehouse is connected to the data collection unit; The data collection unit is used to collect source data of all connected network devices, and the source data of each network device includes inherent attribute source data, and also includes at least one of traffic source data, risk monitoring source data and operation management source data; wherein the inherent attribute source data includes at least one of device name, device IP address, device type, device operation or device location, the traffic source data includes business traffic size and / or business traffic classification, the risk monitoring source data includes at least one of device security scanning record, device vulnerability repair record or device version evaluation record, and the operation management source data includes at least one of device historical fault report, device emergency manual, device maintenance manual or device operation manual; The business center unit is used to establish N tags according to the source data of all the network devices, filter out the tags belonging to each network device from the N tags, construct a tag set corresponding to each network device, and send each network device and the corresponding tag set to the data warehouse; N is a positive integer; The data warehouse is used to store the corresponding relationship between each network device and each label set.

2. The device analysis system according to claim 1, characterized in that: The data collection unit includes: a network equipment management module, a traffic analysis module, a security control module and an operation management module; The network device management module is used to collect the inherent attribute source data of the network device; The traffic analysis module is used to collect traffic source data of the network device; The security management and control module is used to collect risk monitoring source data of the network device; The operation management module is used to collect operation management source data of the network equipment.

3. The device analysis system according to claim 2, characterized in that: The business center unit includes a customization module and a search engine module; The customization module is used to establish K sub-labels according to the source data of all the network devices, and divide the K sub-labels into N labels, where N is a positive integer less than or equal to K; The retrieval engine module is used to filter out tags belonging to any network device from the N tags, construct a tag set corresponding to the network device, establish a corresponding relationship between the tag set and the unique identifier of the network device, and send the corresponding relationship between the tag set and the unique identifier of the network device to the data warehouse.

4. The device analysis system according to claim 3, characterized in that: The business center unit also includes an operation center module and a data engine module; The search engine module is further used to receive a search instruction from a user, the search instruction including a first tag set or a first network device set, and send a search instruction to the operation center module according to the search instruction, the search instruction including the first tag set or the first network device set; The operation center module is used to receive the search instruction, search the data warehouse for the second network device set corresponding to the first tag set through the data engine module, or search the data warehouse for the second tag set corresponding to the first network device set through the data engine module, and return the found second tag set or second network device set to the search engine module; The search engine module is further used to inform the user of the second tag set or the second network device set.

5. The device analysis system according to claim 3, characterized in that: The N tags include: Network equipment operation label, network equipment attribute label, network equipment service carrying label, network equipment risk control label, network equipment operation management label.

6. The device analysis system according to claim 4, characterized in that: The search instruction includes a first network device set; Before the search engine module notifies the user of the second tag set, the search engine module is further configured to: Determine duplicate tags based on tags included in each tag set; Determine the number of duplicate tags and the proportion of duplicate tags in all tags contained in each tag set; The search engine module notifies the user of the second tag set, including: The second tag set, the number of the repeated tags, and the proportion of each repeated tag are informed to the user.

7. The device analysis system according to claim 4, characterized in that: After the search engine module notifies the user of the second network device set, the search engine module is further used to: receiving the attribute definition sent by the user, and sending the attribute definition to the data engine module; the attribute definition includes the name of the second network device set, the creation time of the second network device set, and the creator of the second network device set; The data engine module receives the attribute definition and stores the attribute definition in the data warehouse.

8. A device analysis method, characterized in that: The method comprises: Collect source data of all connected network devices, where the source data of each network device includes inherent attribute source data, and at least one of traffic source data, risk monitoring source data, and operation management source data; wherein the inherent attribute source data includes at least one of device name, device IP address, device type, device operation, or device location; the traffic source data includes business traffic size and / or business traffic classification; the risk monitoring source data includes at least one of device security scan records, device vulnerability repair records, or device version evaluation records; and the operation management source data includes at least one of device historical fault reports, device emergency manuals, device maintenance manuals, or device operation manuals; Establish N tags according to the source data of all the network devices, filter out the tags belonging to each network device from the N tags, construct a tag set corresponding to each network device, and send each network device and the corresponding tag set to the data warehouse; N is a positive integer; The tag set and the network device set are stored, wherein the network device set includes each network device.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to claim 8 is performed.

10. A computing device, characterized in that include: A memory for storing program instructions; The processor is used to call the program instructions stored in the memory and execute the method according to claim 8 according to the obtained program.

Images