Flow monitoring method and device

Abstract

The embodiment of the present invention provides a flow monitoring method and device, including: setting a flow monitoring module in each physical machine in a cloud platform; for each physical machine, mirroring all flows passing through the physical machine to the flow monitoring module in the physical machine, and calculating the inlet and outlet flow rates of at least one target network card through the flow monitoring module. The method realizes real-time acquisition of flow information, reduces response time, is applicable to different cloud platforms, reduces the time of connecting to the interface of the cloud platform flow rate statistics, and increases efficiency.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a flow monitoring method and device. Background Art

[0002] Traffic monitoring refers to the monitoring of data flow, usually including the speed of data in and out, and the total flow. With the development of cloud computing, various cloud platforms have emerged. Cloud platforms allow developers to either run written programs in the "cloud" or use the services provided in the "cloud".

[0003] At present, the traffic monitoring function of cloud platforms is mainly provided by cloud platform vendors. Third parties can only monitor traffic through the application program interface (API) provided by cloud platform vendors. Most cloud vendors cannot provide real-time traffic speed information, and the delay in obtaining traffic speed increases the response time to emergency events, which may cause serious consequences. Moreover, the traffic speed statistics APIs provided by each cloud platform vendor are inconsistent, which takes time to adapt one by one, and is inefficient. Summary of the invention

[0004] In view of the problems in the prior art, an embodiment of the present invention provides a flow monitoring method and device.

[0005] Specifically, the embodiment of the present invention provides the following technical solutions:

[0006] In a first aspect, an embodiment of the present invention provides a traffic monitoring method, comprising: setting a traffic monitoring module in each physical machine in a cloud platform; for each physical machine, mirroring all traffic passing through the physical machine to the traffic monitoring module in the physical machine, and calculating the import and export flow rates of at least one target network card through the traffic monitoring module.

[0007] Furthermore, at least one business virtual machine is set in each physical machine; and mirroring all the traffic passing through the physical machine to the traffic monitoring module in the physical machine includes: mirroring all the traffic passing through at least one business virtual machine in the physical machine to the traffic monitoring module in the physical machine.

[0008] Furthermore, setting a traffic monitoring module in each physical machine in the cloud platform includes: setting a security virtual machine in each physical machine in the cloud platform, and determining the security virtual machine as the traffic monitoring module.

[0009] Furthermore, mirroring all traffic passing through the physical machine to the traffic monitoring module in the physical machine includes: mirroring all traffic passing through the physical machine to the traffic monitoring module in the physical machine through the mirror port of the traffic monitoring module.

[0010] Furthermore, the calculation of the import and export flow rate of at least one target network card by the traffic monitoring module includes: the traffic monitoring module reads the traffic information of at least one target network card within a preset time period by means of a sliding window, and calculates the import and export flow rate of at least one target network card based on the traffic information and the preset time period.

[0011] Further, the flow information includes at least one source MAC address and the flow size corresponding to the at least one source MAC address, and at least one destination MAC address and the flow size corresponding to the at least one destination MAC address; and the flow monitoring module reads the flow information within a preset time period by means of a sliding window, and calculates the import and export flow rates of at least one target network card according to the flow information and the preset time period, including: the flow monitoring module reads at least one source MAC address of the at least one target network card within a preset time period and the flow size corresponding to the at least one source MAC address, and at least one destination MAC address of the at least one target network card and the flow size corresponding to the at least one destination MAC address by means of a sliding window; calculates the export flow rate of at least one target network card according to the at least one source MAC address of the at least one target network card and the flow size corresponding to the at least one source MAC address; calculates the import flow rate of at least one target network card according to the at least one destination MAC address of the at least one target network card and the flow size corresponding to the at least one destination MAC address.

[0012] Further, the method also includes: uploading the import and export flow rates of the at least one target network card to a web server so that the import and export flow rates are displayed in the web server; and / or, uploading the import and export flow rates of the at least one target network card to a web server, and uploading the import and export flow rates of the at least one target network card to a database through the web server so that the web server can query the historical import and export flow rates of the at least one target network card; and / or, querying the historical import and export flow rates of the at least one target network card includes: querying the historical import and export flow rates of the at least one target network card, determining the corresponding historical import and export flow rate trend chart based on the at least one target network card and the corresponding historical import and export flow rates, and sending the historical import and export flow rate trend chart to the web server so that the historical import and export flow rate trend chart can be displayed in the web server.

[0013] In the second aspect, an embodiment of the present invention also provides a flow monitoring device, including: a first processing module, used to set a flow monitoring module in each physical machine in the cloud platform; a second processing module, used to, for each physical machine, mirror all flows passing through the physical machine to the flow monitoring module in the physical machine, and calculate the import and export flow rates of at least one target network card through the flow monitoring module.

[0014] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the flow monitoring method described in the first aspect are implemented.

[0015] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the flow monitoring method described in the first aspect.

[0016] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of the traffic monitoring method described in the first aspect.

[0017] The flow monitoring method and device provided by the embodiment of the present invention sets a flow monitoring module in each physical machine in the cloud platform; for each physical machine, all flows passing through the physical machine are mirrored to the flow monitoring module in the physical machine, and the inlet and outlet flow rates of at least one target network card are calculated by the flow monitoring module. The flow information can be obtained in real time, the response time is reduced, and it is suitable for different cloud platforms, which reduces the time of connecting the interface of the cloud platform flow rate statistics and increases efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 is a flow chart of an embodiment of the flow monitoring method of the present invention;

[0020] Figure 2 Flow charts of other embodiments of the flow monitoring method of the present invention;

[0021] Figure 3-1 A schematic diagram of an application scenario in which data is mirrored to a traffic monitoring module;

[0022] Figure 3-2 A schematic diagram of an application scenario for reading traffic data in a sliding window manner;

[0023] Figure 3-3 A schematic diagram of an application scenario for obtaining non-flow data in the cloud and obtaining real-time flow data of the flow monitoring module;

[0024] Figure 3-4 This is a schematic diagram of an application scenario for obtaining cloud information through the API interface provided by the cloud platform;

[0025] Figure 4 It is a schematic diagram of the structure of some embodiments of the flow monitoring device of the present invention;

[0026] Figure 5 It is a schematic diagram of the structure of an electronic device provided according to the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0029] See also Figure 1 , Figure 1 FIG. 1 is a flow chart of an embodiment of the flow monitoring method of the present invention. Figure 1 As shown, the flow monitoring method comprises the following steps:

[0030] Step 101, setting a traffic monitoring module in each physical machine in the cloud platform.

[0031] Cloud computing platforms can be divided into three categories:

[0032] (1) Storage-based cloud platforms that focus on data storage;

[0033] (2) Computing cloud platforms that focus on data processing;

[0034] (3) A comprehensive cloud computing platform that takes into account both computing and data storage and processing.

[0035] Cloud platform refers to hardware-based services that provide computing, network and storage capabilities. The cloud platform provides at least one physical machine, and users can "borrow" the physical machine in the cloud platform to complete various businesses.

[0036] The cloud platform also provides some services, such as traffic monitoring services, which can be called by users through APIs. These services can better help users complete their business. As an example, the APIi interface information URL provided by the cloud platform manufacturer can be:

[0037] https: / / help.aliyun.com / document_detail / 25612.htm?spm=a2c4g.11186623.0.0.7d016a99sfiRmD#doc-api-Ecs-DescribeInstanceMonitorData

[0038] As an example, the traffic monitoring module can be a virtual machine installed in a physical machine of the cloud platform. The present invention does not limit the programming language of the traffic monitoring module, the environment of the virtual machine, etc., and can be selected according to specific needs.

[0039] Traffic is a digital record that records the number of bytes consumed by a web page on a mobile phone. The units are B, KB, MB, and GB.

[0040] Traffic monitoring can be interpreted as the number of bytes entering and leaving a certain network card, or the flow rate of the number of bytes entering and leaving a certain network card.

[0041] The present invention does not limit the specific operation of how to set the flow monitoring module.

[0042] Step 102: For each physical machine, all traffic passing through the physical machine is mirrored to a traffic monitoring module in the physical machine, and the inlet and outlet flow rates of at least one target network card are calculated by the traffic monitoring module.

[0043] Physical machine, a physical machine used to build the cloud platform and provide hardware resources for the traffic monitoring module.

[0044] As an example, to mirror all traffic passing through a physical machine to a traffic monitoring module within the physical machine, you can directly call an API with a mirror port function provided by the cloud platform, or you can use a virtual switch or Linux commands to achieve mirroring.

[0045] API (Application Programming Interface) is a set of predefined interfaces (such as functions, HTTP interfaces) that can be called and executed by other services.

[0046] Mirror port refers to the network card in the secure virtual machine used to receive traffic within the cloud. It can reduce the problem of connecting to the network flow statistics API of the cloud platform.

[0047] The traffic content mirrored to the physical machine includes: source MAC address, destination MAC address, and the corresponding traffic size.

[0048] MAC (Media Access Control or Medium Access Control) address, literally translated as media access control, or physical address, hardware address, is used to define the location of network devices. A host can have a MAC address. The MAC address is determined by the network card and is fixed.

[0049] The source mac address refers to the mac address from which the data traffic is sent, that is, the traffic information contains the mac address of the visitor, the mac address of the visitor's network card is called the source mac, and the traffic size corresponding to the source mac address is the egress traffic of the source mac address; the destination mac address refers to the mac address from which the data traffic is received, and the traffic size corresponding to the destination mac address is the ingress traffic of the destination mac address. The destination mac address, that is, the traffic information contains the mac address of the visited party, and the mac address of the visited party's network card is called the destination mac.

[0050] As an example, the traffic monitoring module can read the import and export traffic size of each target network card within three seconds, calculate the import and export traffic size and the divisor of the three seconds time, and obtain the import and export flow rate of each target network card in the fourth second.

[0051] As an example, the inlet and outlet traffic of each virtual machine's network card can be distinguished through MAC to calculate the flow rate information, and then stored in the database to display the real-time flow rate and historical flow rate trend chart of each network card of each virtual machine.

[0052] The flow monitoring method disclosed in some embodiments of the present invention sets a flow monitoring module in each physical machine in the cloud platform; for each physical machine, all flows passing through the physical machine are mirrored to the flow monitoring module in the physical machine, and the inlet and outlet flow rates of at least one target network card are calculated by the flow monitoring module. The method can obtain flow information in real time, reduce response time, be applicable to different cloud platforms, reduce the time of connecting to the interface of the cloud platform flow rate statistics, and increase efficiency.

[0053] See also Figure 2 , Figure 2 Flow charts of other embodiments of the flow monitoring method of the present invention. Figure 2 As shown, the flow monitoring method comprises the following steps:

[0054] Step 201, setting a traffic monitoring module in each physical machine in the cloud platform.

[0055] In some embodiments, the specific implementation of step 201 and the technical effects thereof can be referred to in Figure 1 The corresponding step 101 in the embodiment will not be described in detail here.

[0056] Step 202, for each physical machine, all traffic passing through the physical machine is mirrored to the traffic monitoring module in the physical machine. The traffic monitoring module reads the traffic information of at least one target network card within a preset time period through a sliding window, and calculates the import and export flow rate of at least one target network card based on the traffic information and the preset time period.

[0057] As an example, the traffic monitoring module can be deployed in a physical machine in the cloud in the form of a secure virtual machine. Each physical machine needs to deploy a secure virtual machine, and the traffic is fully mirrored to the mirror network card of the secure virtual machine through the traffic mirroring capability of the cloud. The traffic information is taken out from the mirror network card, and then the information is taken out from the traffic information. The import and export traffic size of the network card in the virtual machine corresponding to the mac is counted and accumulated according to the source and destination macs. According to the sliding window method, the import and export traffic size of each mac in every 1s (or every 10s or a custom time period) is recorded. The inlet and outlet flow rate information corresponding to each mac in the time period is calculated and uploaded to the web server. The inlet and outlet flow rate of each mac can be obtained by dividing the total size of the inlet and outlet traffic of each mac in the custom time period (greater than or equal to 1) by the custom time period.

[0058] like Figure 3-1 As shown in , the data in the physical machine will be mirrored to the traffic monitoring module in real time. The traffic data needs to be cached first, and then the traffic information within the preset time period is read in a sliding window manner. Figure 3-2 As shown in the figure, 4 seconds of data flow are cached, the flow data of the first second is read in a sliding window manner, and then the read data flow is divided by 1 second to obtain the flow rate of the second second. The flow data of the first second and the second second can also be read in a sliding window manner, and then the sum of the read data flow of the two seconds is divided by 2 seconds to obtain the flow rate of the third second. The specific flow rate calculation rules can be set according to the specific situation.

[0059] Still taking the above as an example, calculate the import and export flow rate of at least one target network card, that is, the cached 4 seconds of data flow includes the source MAC address, destination MAC address, and the corresponding flow size of the first second, as well as the source MAC address, destination MAC address, and the corresponding flow size of the second, third, and fourth seconds.

[0060] from Figure 2 It can be seen that Figure 1 Compared with the description of some corresponding embodiments, Figure 2The flow monitoring method in some corresponding embodiments reflects how the flow monitoring module reads the flow information. The flow monitoring module reads the flow information within a preset time period by means of a sliding window, and calculates the inlet and outlet flow rates of at least one target network card according to the flow information and the preset time period. The sliding window size can be set as needed to calculate the average flow rate within the preset time period.

[0061] In some optional implementations, at least one business virtual machine is set in each physical machine; and all traffic passing through the physical machine is mirrored to the traffic monitoring module in the physical machine, including: all traffic passing through at least one business virtual machine in the physical machine is mirrored to the traffic monitoring module in the physical machine.

[0062] Virtual machine technology is a type of virtualization technology. The so-called virtualization technology is to transform things from one form into another. The most commonly used virtualization technology is the virtualization of memory in the operating system. During actual operation, the memory space required by the user may be much larger than the memory size of the physical machine. Using memory virtualization technology, users can virtualize part of the hard disk into memory, which is transparent to the user.

[0063] A business virtual machine can be understood as a virtual machine that is dedicated to executing a certain business. Multiple virtual machines can be installed in a physical machine. The method of setting up a virtual machine in a physical machine can be selected according to specific needs.

[0064] In some optional implementations, a traffic monitoring module is set in each physical machine in the cloud platform, including: setting a security virtual machine in each physical machine in the cloud platform, and determining the security virtual machine as the traffic monitoring module.

[0065] A secure virtual machine is a virtual machine with security capabilities, such as a virtual machine dedicated to traffic monitoring.

[0066] In some optional implementations, all traffic passing through the physical machine is mirrored to a traffic monitoring module in the physical machine, including: through a mirror port of the traffic monitoring module, all traffic passing through the physical machine is mirrored to the traffic monitoring module in the physical machine.

[0067] As an example, the traffic monitoring module may correspond to multiple mirror ports. When counting traffic data, the traffic monitoring module counts the data received by the multiple mirror ports together according to the import and export traffic of different target network cards (or target network card addresses).

[0068] In some optional implementations, the traffic information includes at least one source MAC address and the traffic size corresponding to the at least one source MAC address (i.e., the egress traffic size of the source MAC address), and at least one destination MAC address and the traffic size corresponding to the at least one destination MAC address (i.e., the ingress traffic size of the destination MAC address); and the traffic monitoring module reads the traffic information within a preset time period by means of a sliding window, and calculates the ingress and egress flow rates of at least one target network card based on the traffic information and the preset time period, including: the traffic monitoring module reads at least one source MAC address of at least one target network card within a preset time period and the traffic size corresponding to the at least one source MAC address, and at least one destination MAC address of at least one target network card and the traffic size corresponding to the at least one destination MAC address by means of a sliding window; calculates the egress flow rate of at least one target network card based on the at least one source MAC address of at least one target network card and the traffic size corresponding to the at least one source MAC address; calculates the ingress flow rate of at least one target network card based on the at least one destination MAC address of at least one target network card and the traffic size corresponding to the at least one destination MAC address.

[0069] As an example, there are three addresses, mac1, mac2, and mac3, where mac1, mac2, and mac3 are the addresses of the target network card, and each target network card address corresponds to a target network card. mac1, mac2, and mac3 can be used as source mac addresses or destination mac addresses, respectively. If the source mac address, the destination mac address, and the corresponding flow size of the two in the first second are: mac1, mac2, 2kB; the source mac address, the destination mac address, and the corresponding flow size of the two in the second second can be: mac2, mac3, 4kB (that is, the flow information in the preset time period read by the flow monitoring module through a sliding window). Statistics of the import and export flows of mac1, mac2, and mac3 within two seconds (two seconds is the preset time period) (that is, the above flow information is read in a sliding window manner): mac1 is used as the source mac address in the first second, so the export flow size of mac1 as the target network card is 2kB (that is, according to at least one source mac address and the flow size corresponding to at least one source mac address, the export flow rate of at least one target network card is calculated), and the inlet flow size of mac1 as the target network card is 0kB. Similarly, mac2 is used as the destination mac address in the first second and as the source mac address in the second second. Therefore, the egress flow size of mac2 as the target network card is 4kB (i.e., the ingress flow rate of at least one target network card is calculated based on at least one destination mac address and the flow size corresponding to at least one destination mac address), and the ingress flow size of mac2 as the target network card is 2kB. Similarly, mac3 is used as the destination mac address in the second second. Therefore, the egress flow size of mac3 as the target network card is 0kB, and the ingress flow size of mac3 as the target network card is 4kB.

[0070] Still taking the above as an example, the traffic monitoring module reads the traffic information within the preset time period by means of a sliding window, and calculates the import and export flow rate of at least one target network card according to the traffic information and the preset time period. That is, after the traffic monitoring module reads the traffic information, it obtains the traffic information in the format of (target network card address, inlet traffic, outlet traffic), including: (mac1, 0kB, 2kB), and (mac2, 2kB, 4kB), and (mac3, 4kB, 0kB), that is, the sum of the data traffic of two seconds is obtained. The sum of the data traffic is divided by two seconds, and the import and export flow rates of at least one target network card are obtained as follows: (mac1, 0kB / s, 1kB / s), and (mac2, 1kB / s, 2kB / s), and (mac3, 2kB / s, 0kB / s).

[0071] In some optional implementations, the method also includes: uploading the import and export flow rates of at least one target network card to a web server so as to display the import and export flow rates in the web server; and / or, uploading the import and export flow rates of at least one target network card to a web server, and uploading the import and export flow rates of at least one target network card to a database through the web server so that the web server can query the historical import and export flow rates of at least one target network card; and / or, querying the historical import and export flow rates of at least one target network card, including: querying the historical import and export flow rates of at least one target network card, determining the corresponding historical import and export flow rate trend chart based on at least one target network card and the corresponding historical import and export flow rates, and sending the historical import and export flow rate trend chart to the web server so as to display the historical import and export flow rate trend chart in the web server.

[0072] Web services are platform-independent, low-coupling, self-contained, programmable web-based applications that can use the open XML (a subset of the standard generalized markup language) standard to describe, publish, discover, coordinate and configure these applications for the development of distributed interoperable applications. Web services can be uploaded to a web server.

[0073] Web service technology enables different applications running on different machines to exchange data or integrate with each other without the need for additional, specialized third-party software or hardware. Applications implemented according to web service specifications can exchange data with each other regardless of the language, platform or internal protocol they use.

[0074] As an example, the import and export flow rates of at least one target network card may also be directly uploaded to a database or other place, so that the web server can read and calculate the real-time import and export flow rate graph and the historical import and export flow rate trend graph.

[0075] As an example, the information of the target network card, the historical flow rate information of the target network card, and the import and export flow rates of the target network card may also be uploaded.

[0076] As an example, for each network card of at least one target network card, for a time period received through human-computer interaction, the historical import and export flow rate may be the import and export flow rate of the time period queried in the database.

[0077] As an example, the historical import and export flow rate trend chart can obtain all import and export flow rates and network card information of at least one target network card in the above time period, adjust the format to obtain the historical import and export flow rate trend chart, and display it, that is, display the historical import and export flow rate trend chart of at least one target network card. The historical import and export flow rate trend chart (or real-time import and export flow rate chart) corresponding to at least one target network card of each physical machine can also be displayed.

[0078] like Figure 3-3 As shown, the web service can obtain non-flow data in the cloud and real-time flow data of the flow monitoring module, and store them in a database (such as es, etc.) to facilitate subsequent query of flow history trend charts. As an example, the import and export flow rates can be sent to the web service through a communication port. As an example, the communication port can be a network card dedicated to sending flow. The number of communication ports can also be set according to specific needs.

[0079] As an example, after reporting to the web service, the web service can store the data to facilitate the display of the real-time flow rate and overall trend chart of the traffic of each network card of each virtual machine.

[0080] like Figure 3-4 As shown, the web service can obtain some cloud information through the API interface provided by the cloud platform, such as the number of virtual machines, the category of virtual machines, etc., and combine it with the flow rate data obtained from the communication port to display the real-time flow rate and overall trend chart of the traffic of each network card of each virtual machine.

[0081] By deploying secure virtual machines in cloud physical machines and calculating the flow rate information of virtual machines in secure virtual machines, it is possible to avoid connecting to the flow rate statistics API of the cloud platform to improve efficiency. The calculated data is more real-time than calling from the interface, and the response is faster. A web page is provided to facilitate the display and query of the real-time flow rate of each network card of each virtual machine and the historical flow rate trend chart, which can be used by operation and maintenance personnel to view in real time and analyze historical data.

[0082] See also Figure 4 , Figure 4 The schematic diagrams of the structures of some embodiments of the flow monitoring device of the present invention are as follows. As the implementation of the methods shown in the above figures, the present invention also provides some embodiments of the flow monitoring device. These device embodiments are similar to Figure 1 The embodiments of some methods shown correspond to each other, and the device can be applied to various electronic devices.

[0083] like Figure 4 As shown, the traffic monitoring device 400 of some embodiments includes a first processing module 401 and a second processing module 402: the first processing module 401 is used to set a traffic monitoring module in each physical machine in the cloud platform; the second processing module 402 is used to, for each physical machine, mirror all the traffic passing through the physical machine to the traffic monitoring module in the physical machine, and calculate the import and export flow rates of at least one target network card through the traffic monitoring module.

[0084] In an optional implementation of some embodiments, at least one service virtual machine is provided in each physical machine; and

[0085] The second processing module 402 is further used for:

[0086] All traffic passing through at least one business virtual machine in the physical machine is mirrored to the traffic monitoring module in the physical machine.

[0087] In an optional implementation of some embodiments, the first processing module 401 is further configured to:

[0088] A security virtual machine is set in each physical machine in the cloud platform, and the security virtual machine is determined as a traffic monitoring module.

[0089] In an optional implementation of some embodiments, the second processing module 402 is further configured to:

[0090] Through the mirror port of the traffic monitoring module, all traffic passing through the physical machine is mirrored to the traffic monitoring module in the physical machine.

[0091] In an optional implementation of some embodiments, the second processing module 402 is further configured to:

[0092] The flow monitoring module reads the flow information of at least one target network card within a preset time period by means of a sliding window, and calculates the inlet and outlet flow rates of at least one target network card according to the flow information and the preset time period.

[0093] In an optional implementation of some embodiments, the traffic information includes at least one source MAC address and a traffic size corresponding to the at least one source MAC address, and at least one destination MAC address and a traffic size corresponding to the at least one destination MAC address; and

[0094] The second processing module 402 is further used for:

[0095] The traffic monitoring module reads at least one source MAC address of at least one target network card and the traffic size corresponding to the at least one source MAC address, as well as at least one destination MAC address of at least one target network card and the traffic size corresponding to the at least one destination MAC address within a preset time period by means of a sliding window;

[0096] Calculate the egress flow rate of at least one target network card according to at least one source MAC address of at least one target network card and the flow size corresponding to the at least one source MAC address;

[0097] The inlet flow rate of at least one target network card is calculated according to at least one destination MAC address of at least one target network card and the flow size corresponding to the at least one destination MAC address.

[0098] In an optional implementation of some embodiments, the device also includes a third processing module, which is used to upload the import and export flow rates of at least one target network card to a web server so that the import and export flow rates are displayed in the web server; and / or, the import and export flow rates of at least one target network card are uploaded to the web server, and the import and export flow rates of at least one target network card are uploaded to a database through the web server so that the web server can query the historical import and export flow rates of at least one target network card; and / or, query the historical import and export flow rates of at least one target network card, including: querying the historical import and export flow rates of at least one target network card, determining the corresponding historical import and export flow rate trend chart based on at least one target network card and the corresponding historical import and export flow rates, and sending the historical import and export flow rate trend chart to the web server so that the historical import and export flow rate trend chart can be displayed in the web server.

[0099] It is understandable that the modules described in the device 400 are similar to those described in the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the device 400 and the modules and units contained therein, and will not be described in detail here.

[0100] Figure 5 Schematic diagram of the structure of the electronic device provided according to the present invention, Figure 5 As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communication interface 520 and the memory 530 communicate with each other through the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the flow monitoring method, for example, including: setting a flow monitoring module in each physical machine in the cloud platform; for each physical machine, mirroring all the flows passing through the physical machine to the flow monitoring module in the physical machine, and calculating the inlet and outlet flow rates of at least one target network card through the flow monitoring module.

[0101] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0102] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the traffic monitoring methods provided by the above methods, for example, including: setting a traffic monitoring module in each physical machine in the cloud platform; for each physical machine, mirroring all the traffic passing through the physical machine to the traffic monitoring module in the physical machine, and calculating the import and export flow rate of at least one target network card through the traffic monitoring module.

[0103] On the other hand, an embodiment of the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the traffic monitoring method provided by the above-mentioned embodiments, for example, including: setting a traffic monitoring module in each physical machine in the cloud platform; for each physical machine, mirroring all the traffic passing through the physical machine to the traffic monitoring module in the physical machine, and calculating the import and export flow rate of at least one target network card through the traffic monitoring module.

[0104] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0105] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0106] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A flow monitoring method, characterized in that: The method comprises: A flow monitoring module is set in each physical machine in the cloud platform; the flow monitoring module is set in each physical machine in the cloud platform, including: setting a security virtual machine in each physical machine in the cloud platform, and determining the security virtual machine as the flow monitoring module; For each physical machine, all traffic passing through the physical machine is mirrored to a traffic monitoring module in the physical machine, and the inlet and outlet flow rates of at least one target network card are calculated by the traffic monitoring module.

2. The flow monitoring method according to claim 1, characterized in that: At least one business virtual machine is set in each physical machine; as well as The mirroring of all traffic passing through the physical machine to the traffic monitoring module in the physical machine includes: All traffic passing through at least one business virtual machine in the physical machine is mirrored to a traffic monitoring module in the physical machine.

3. The flow monitoring method according to claim 1, characterized in that: The mirroring of all traffic passing through the physical machine to the traffic monitoring module in the physical machine includes: Through the mirror port of the traffic monitoring module, all traffic passing through the physical machine is mirrored to the traffic monitoring module in the physical machine.

4. The flow monitoring method according to claim 1, characterized in that: The calculating the inlet and outlet flow rates of at least one target network card by the flow monitoring module includes: The flow monitoring module reads the flow information of the at least one target network card within a preset time period by means of a sliding window, and calculates the inlet and outlet flow rates of the at least one target network card according to the flow information and the preset time period.

5. The flow monitoring method according to claim 4, characterized in that: The flow information includes at least one source MAC address and a flow size corresponding to the at least one source MAC address, and at least one destination MAC address and a flow size corresponding to the at least one destination MAC address; as well as The flow monitoring module reads the flow information within a preset time period by means of a sliding window, and calculates the inlet and outlet flow rates of at least one target network card according to the flow information and the preset time period, including: The traffic monitoring module reads at least one source MAC address of the at least one target network card and the traffic size corresponding to the at least one source MAC address within a preset time period, as well as at least one destination MAC address of the at least one target network card and the traffic size corresponding to the at least one destination MAC address by means of a sliding window; Calculate the egress flow rate of at least one target network card according to the preset time period, the at least one source MAC address and the flow size corresponding to the at least one source MAC address; The inlet flow rate of at least one target network card is calculated according to the preset time period, the at least one destination MAC address and the flow size corresponding to the at least one destination MAC address.

6. The flow monitoring method according to claim 1, characterized in that: The method further comprises: Uploading the inlet and outlet flow rates of the at least one target network card to a web server so as to display the inlet and outlet flow rates in the web server; and / or, Uploading the import and export flow rates of the at least one target network card to a web server, and uploading the import and export flow rates of the at least one target network card to a database through the web server, so that the web server can query the historical import and export flow rates of the at least one target network card; and / or, The querying of the historical import and export flow rate of the at least one target network card includes: Query the historical import and export flow rates of the at least one target network card, determine the corresponding historical import and export flow rate trend chart according to the at least one target network card and the corresponding historical import and export flow rates, and send the historical import and export flow rate trend chart to the web server so as to display the historical import and export flow rate trend chart in the web server.

7. A flow monitoring device, characterized in that: The device comprises: The first processing module is used to set a traffic monitoring module in each physical machine in the cloud platform; specifically including: setting a security virtual machine in each physical machine in the cloud platform, and determining the security virtual machine as the traffic monitoring module; The second processing module is used to mirror all the traffic passing through each physical machine to the traffic monitoring module in the physical machine, and calculate the import and export flow rate of at least one target network card through the traffic monitoring module.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the flow monitoring method according to any one of claims 1 to 6 are implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the flow monitoring method according to any one of claims 1 to 6 are implemented.

10. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor implements the steps of the flow monitoring method as claimed in any one of claims 1 to 6.

Images