Flow monitoring method and device, flow probe implementation method and device, equipment

Abstract

The embodiments of this specification provide a flow monitoring method and device, a flow probe implementation method and device, a computer-readable storage medium, and a computing device. The flow monitoring method includes: obtaining the network information of the virtual private network from the control layer of the cloud platform; sending a detection message to each network service in the virtual private network according to the network information, and receiving a response message returned by each network service; performing flow anomaly analysis according to the flow information in the response message and the network information, obtaining an anomaly analysis result, and reporting the anomaly analysis result to the control layer. The embodiments of the present invention can realize comprehensive and effective flow monitoring of virtual private networks.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of network monitoring technology, and in particular, to a flow monitoring method and device, a flow probe implementation method and device, a computer-readable storage medium, and a computing device. Background Art

[0002] Network traffic probes play a huge role in network platform traffic monitoring, abnormal traffic analysis, traffic collection, deep packet analysis, and traffic analysis.

[0003] However, with the expansion of network scale, the improvement of link speed and the popularization of cloud platforms, most of the current network traffic probes have many difficulties in monitoring traffic, such as dependence on hardware, complex deployment, specificity to specific networks and devices, and inability to conduct comprehensive and effective monitoring of VPC (i.e. virtual private network) from the perspective of cloud platform tenants, inability to monitor tenants' east-west and north-south traffic anomalies in real time, and inability to issue warnings for network anomalies caused by some abnormal user operations. At the same time, with the expansion of cloud platform scale, the number of tenants increases, the number of VPCs is very large, and the complexity of tenant business increases. Traditional traffic probes have poor scalability and cannot be elastically scaled or quickly deployed as the network scale expands. Summary of the invention

[0004] In order to solve at least one of the above problems, the embodiments of this specification describe a flow monitoring method and device, a flow probe implementation method and device, a computer-readable storage medium, and a computing device.

[0005] According to a first aspect, a flow monitoring method is provided, comprising:

[0006] Obtaining network information of the virtual private network from the control layer of the cloud platform;

[0007] Sending a detection message to each network service in the virtual private network according to the network information, and receiving a response message returned by each network service;

[0008] Perform traffic anomaly analysis based on the traffic information in the response message and the network information to obtain an anomaly analysis result, and report the anomaly analysis result to the control layer.

[0009] According to a second aspect, there is provided a flow monitoring device, comprising:

[0010] A management agent module, used to obtain network information of the virtual private network from the control layer of the cloud platform;

[0011] A data collection module, used to send a detection message to each network service in the virtual private network according to the network information, and receive a response message returned by each network service;

[0012] The probe analysis module is used to perform traffic anomaly analysis based on the traffic information in the response message and the network information, obtain an anomaly analysis result, and report the anomaly analysis result to the control layer.

[0013] According to a third aspect, a method for implementing a flow probe is provided. The flow probe is the flow monitoring device provided in the second aspect. The method is executed by a control layer of a cloud platform. The method includes:

[0014] When the creation of a first virtual private network is monitored in the cloud platform, a preset network segment is created in the first virtual private network, and the image into which the traffic probe is pre-packaged is started in the preset network segment to form a traffic probe virtual machine corresponding to the first virtual private network, and a corresponding network card is allocated to the traffic probe virtual machine corresponding to the first virtual private network in the preset network segment;

[0015] When it is detected that the second virtual private network is deleted in the cloud platform, the flow probe virtual machine corresponding to the second virtual private network is deleted.

[0016] According to a fourth aspect, a flow probe implementation device is provided, wherein the flow probe is the flow monitoring device provided in the second aspect, and the flow probe implementation device is deployed on a control layer of a cloud platform, and the device includes:

[0017] A probe creation module is used to create a preset network segment in the first virtual private network when monitoring the creation of the first virtual private network in the cloud platform, start the image pre-packaged with the flow probe in the preset network segment to form a flow probe virtual machine corresponding to the first virtual private network, and allocate a corresponding network card to the flow probe virtual machine corresponding to the first virtual private network in the preset network segment;

[0018] The probe deletion module is used to delete the flow probe virtual machine corresponding to the second virtual private network when it is detected that the second virtual private network is deleted in the cloud platform.

[0019] According to a fifth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method provided in the first aspect.

[0020] According to a sixth aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method provided in the first aspect is implemented.

[0021] The flow monitoring method and device, flow probe implementation method and device, computer-readable storage medium, and computing device provided in the embodiments of this specification have the following technical effects:

[0022] (1) First, the traffic probe obtains the network information of the virtual private network from the control layer of the cloud platform, and then sends a detection message to each network service in the virtual private network according to the network information, and receives the response message returned by each network service; finally, the traffic anomaly analysis is performed according to the traffic information in the response message and the network information, the anomaly analysis result is obtained, and the anomaly analysis result is reported to the control layer. It can be seen that the method provided by the embodiment of the present invention can perform traffic detection on each network service in the virtual private network, find out whether each network service has anomalies, and realize comprehensive and effective traffic monitoring of the virtual private network, including monitoring the abnormal conditions of the tenant's east-west and north-south traffic, and uploading the anomaly analysis results to the control layer, so as to realize warning of network anomalies.

[0023] (2) First, when the creation of the first virtual private network in the cloud platform is detected, a preset network segment is created in the first virtual private network, and the image pre-packaged with the traffic probe is started in the preset network segment to form a traffic probe virtual machine corresponding to the first virtual private network. It can be seen that the corresponding traffic probe can be created as the first virtual private network is created. When the deletion of the second virtual private network in the cloud platform is detected, the traffic probe virtual machine corresponding to the second virtual private network is deleted. It can be seen that the corresponding traffic probe can be deleted as the first virtual private network is deleted. It can be seen that the method provided in the embodiment of the present invention can enable the traffic probe to be created or deleted as the network scales, that is, it has very good scalability and is suitable for scenarios where the scale of the cloud platform is expanded and the number of tenants increases. Moreover, a traffic probe virtual machine is created by starting a mirror in a specific network segment, and deployment is also very convenient. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0025] Figure 1 is a flow chart of a flow monitoring method in one embodiment of the present specification;

[0026] Figure 2It is a schematic diagram of the architecture of an application scenario of a flow probe in one embodiment of this specification;

[0027] Figure 3 It is a structural block diagram of a flow monitoring device in one embodiment of this specification. DETAILED DESCRIPTION

[0028] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0029] In a first aspect, an embodiment of the present invention provides a flow monitoring method. The method can be performed by a network flow probe. Figure 1 The method may include the following steps S110 to S130:

[0030] S110, obtaining network information of the virtual private network from the control layer of the cloud platform;

[0031] The virtual private network is a virtual private network to which the execution entity, namely the network traffic probe, belongs. The virtual private network can be represented by the English abbreviation VPC.

[0032] Each network traffic probe is only responsible for detecting the tenant traffic within the VPC where it is located, and will not monitor other VPCs, nor will it affect the traffic within other VPCs. Moreover, when the tenant's VPC is deleted, the corresponding network traffic probe will also be destroyed by the control layer, so it can be flexibly controlled and save resources.

[0033] Among them, the network information of the virtual private network may include: the IP address of the cloud host within the virtual private network, the internal subnet gateway of the virtual private network, the VPN gateway, the DHCP service address, the elastic public IP address bound to the virtual private network, the NAT gateway, the security group rules and at least one of the service port number.

[0034] Generally speaking, the information included in the network information can be divided into several categories: tenant information, security group rules, business port numbers, and network service addresses. Here, a network service address corresponds to a network service. The network service address generally includes the IP address of the cloud host, the internal subnet gateway of the VPC, the VPN gateway, the DHCP service address, the elastic public network IP address bound to the VPC, the NAT gateway, etc. Of course, it can also include the address information of the database, the east-west traffic path, the north-south traffic path, etc. All the information that needs to be monitored can be included in the network information. This information can be stored in the control layer, and only needs to be obtained from the control layer, so as to obtain the fine-grained global network information of the tenants in the VPC.

[0035] It is understandable that the control layer of the cloud platform stores the network information of each VPC in the cloud platform.

[0036] S120, sending a detection message to each network service in the virtual private network according to the network information, and receiving a response message returned by each network service;

[0037] That is to say, in S120, each network service is probed. Specifically, a probe message is sent to each network service in the VPC where the network traffic probe is located. More specifically, a probe message is sent to the network service address corresponding to each network service. Then, each network service address performs a probe operation upon receiving the corresponding probe message, and feeds back the probe situation to the network traffic probe as a response message.

[0038] The response message includes data flow information during the detection process, which can be called flow information. From the flow information, we can know which IP routes have been experienced.

[0039] S130. Perform traffic anomaly analysis according to the traffic information in the response message and the network information to obtain an anomaly analysis result, and report the anomaly analysis result to the control layer.

[0040] That is to say, based on the flow information in the response message and the network information obtained from the control layer, it is possible to know in which network element the abnormality occurred, thereby obtaining the abnormality analysis result, and then uploading the abnormality analysis result to the control layer.

[0041] In one embodiment, S130 may specifically include the following steps S131 to S133:

[0042] S131, classifying the flow information according to each network element in the network information to obtain flow information corresponding to different network elements;

[0043] For example, the network elements in the network information include: the IP address of the cloud host, the internal subnet gateway of the VPC, the VPN gateway, the DHCP service address, the elastic public IP address bound to the VPC, the NAT gateway, etc. Therefore, the traffic information in each response message can be classified according to these network elements to obtain the traffic information corresponding to each network element.

[0044] S132, forming a global traffic topology within the virtual private network from the classified traffic information according to the topology structure formed by each network element in the network information;

[0045] It is understandable that each network element in a virtual private network forms a certain topology structure, in which the data transmission relationship between each network element can be known, and the topology structure can be called a network element topology structure. Therefore, here, the classified traffic information is formed into a traffic topology structure according to the network element topology structure. The traffic topology structure is the global traffic topology corresponding to this VPC, and the data flow relationship of each category of traffic can be seen from the global traffic topology.

[0046] S133. Determine the network element where the abnormality occurs according to the response message and the global traffic topology, and report the network element where the abnormality occurs as the abnormality analysis result to the control layer.

[0047] That is to say, the network element with abnormality can be determined based on the global wandering topology, and then the control layer is informed of which network element or elements have faults.

[0048] In one embodiment, the detection message includes multiple first ping packets, each of which is used to detect whether a corresponding network service address in the network information is reachable.

[0049] That is, in S110, each detection message sent by the network traffic probe includes a first ping packet, and each first ping packet is used to detect whether a network service address is reachable. In S120, the network traffic probe can receive a response message returned by each first ping packet.

[0050] Based on the first ping packet, S133 may specifically include:

[0051] If it is learned from a response message of the first ping packet that the corresponding network service address is unreachable, the IP route blocked by the first ping packet is determined, and the network element to which the blocked IP route belongs is determined from the global traffic topology, and the abnormality of the network element is reported to the control layer as the abnormality analysis result.

[0052] That is to say, based on the response message of the first ping packet, it is possible to know whether the corresponding network service address is reachable based on whether the traffic information is complete. If it is reachable, it means that there is no abnormality in the network element involved in the network service address. If it is not reachable, it is necessary to further determine which network element has a problem. Specifically, determine which IP route is blocked, and then determine which network element the blocked IP route belongs to from the global traffic topology, and then determine which network element has the abnormality, and obtain the abnormality analysis result.

[0053] Among them, it is possible to know which IP route is blocked by route tracking (ie, traceroute) through the response message, thereby knowing which IP route is blocked.

[0054] For example, firstly, a first ping packet is used to detect whether the cloud host IP is reachable. If it is not reachable, the route is traced to find out which specific IP route is blocked. Then the global traffic topology is matched to determine which network element function the blocked IP route belongs to. If it is a gateway, a gateway fault is reported. If it is a host node, a host node fault is reported.

[0055] For other network services, such as VPN gateway, NAT gateway, load balancing service, DHCP service, etc., the above process can also be used for detection processing.

[0056] In one embodiment, the method provided by the embodiment of the present invention may further include steps S140 to S160:

[0057] S140. When all network service addresses are reachable, send a second ping packet; wherein the second ping packet is used to detect whether the service port corresponding to the service port number in the virtual private network is connectable;

[0058] S150, determining whether the service port corresponding to the service port number is connectable according to the response message of the second ping packet;

[0059] S160. If the connection is not possible, determine whether the service port number in the security group rule is in a released state. If it is not released, determine that an error occurs in the security group rule, and report the security group rule error to the control layer; if it is released, determine that an abnormality occurs in the service port corresponding to the service port number, and report the service port abnormality to the control layer.

[0060] That is to say, after the detection of the network service is completed, it is known that each network service address is reachable, and then it is possible to detect whether the service port number in the network information is connected. Specifically, a second ping packet can be sent to the service port corresponding to the service port number in the network information. After receiving the second ping packet, the service port will perform the corresponding detection operation and then return a response message to the network traffic probe. From the response message, it can be known whether the service port is connectable. If it is connectable, it means that there is no abnormality in the service port. If it is not connectable, it is necessary to continue to determine the cause of the abnormality.

[0061] Specifically, first determine whether the service port number in the security group rule is in a released state. If it is in a released state, it means that there is no error in the security group rule, and it can be determined that the problem is the service port itself, so the service port abnormality is reported to the control layer. If it is not in a released state, it means that there is an error in the security group rule, and the security group rule error is reported to the control layer.

[0062] In the embodiment of the present invention, each VPC in the cloud platform represents a two-layer private network, which is completely isolated from other networks. Each VPC has multiple subnets. The subnets within the VPC can communicate with each other, but the subnets between VPCs cannot communicate. Figure 2 The communication between the cloud hosts in the VPC and the external network depends on the elastic public IP, that is, the cloud host bound to the elastic public IP can access the external network or be accessed by the external host. The traffic between the cloud hosts in the VPC is called the east-west traffic, and the traffic between the cloud hosts in the VPC and the external network is called the north-south traffic.

[0063] In an embodiment of the present invention, first, the flow probe obtains the network information of the virtual private network from the control layer of the cloud platform, and then sends a detection message to each network service in the virtual private network according to the network information, and receives the response message returned by each network service; finally, the flow anomaly analysis is performed according to the flow information in the response message and the network information, the anomaly analysis result is obtained, and the anomaly analysis result is reported to the control layer. It can be seen that the method provided by the embodiment of the present invention can perform flow detection on each network service in the virtual private network, find out whether each network service has anomalies, and realize comprehensive and effective flow monitoring of the virtual private network, including monitoring the abnormal conditions of the tenant's east-west and north-south flow, and uploading the anomaly analysis results to the control layer, so as to realize the warning of network anomalies. The method provided by the embodiment of the present invention can perform comprehensive and fine-grained monitoring of tenant-level flow in the VPC, which can cover north-south flow, east-west flow, and flow of all network services in the VPC, and locate the specific faulty network element according to the global path provided by the control layer.

[0064] Among them, the security group is a virtual firewall that is used to control the inbound and outbound traffic of instances within the security group, thereby improving the security of the instance. The security group has state detection and packet filtering capabilities, and can divide security domains in the cloud based on the characteristics of the security group and the configuration of security group rules.

[0065] Among them, DHCP (Dynamic Host Configuration Protocol) is a network protocol for LAN, which is controlled by the server for a range of IP addresses. When the client logs in to the server, it can automatically obtain the IP address and subnet mask assigned by the server. NAT Gateway is a network address translation service that provides NAT proxy capabilities. VPN Gateway can realize the interconnection of different networks through VPN technology, and is the best form of network interconnection between headquarters and branches.

[0066] Among them, ping is a communication protocol, which refers to sending a test data packet to a domain name to see whether the URL can respond normally and count the time, so as to see whether the test network is connected, which can help us analyze network failures.

[0067] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0068] In a second aspect, an embodiment of the present invention provides a flow monitoring device.

[0069] See also Figure 3 , the device comprises:

[0070] A management agent module, used to obtain network information of the virtual private network from the control layer of the cloud platform;

[0071] A data collection module, used to send a detection message to each network service in the virtual private network according to the network information, and receive a response message returned by each network service;

[0072] The probe analysis module is used to perform traffic anomaly analysis based on the traffic information in the response message and the network information, obtain an anomaly analysis result, and report the anomaly analysis result to the control layer.

[0073] Among them, the management agent module is an upper-layer module that can interact directly with the control layer. Therefore, after obtaining the anomaly analysis result, the probe analysis module sends the anomaly analysis result to the control layer through the management agent module. The management agent module can provide a northbound API, which can interact with the control layer on the cloud platform to obtain the network information of the VPC where it is located, and then provide the network information to the probe analysis module so that the probe analysis module can match the collected response messages with the network information to obtain the global traffic topology, realize the analysis and classification of each type of anomaly, and report the anomaly analysis result to the management agent module. The management agent module sends the anomaly analysis result to the control layer through the northbound API.

[0074] The data collection module is a bottom-level module, which is mainly used to send probe messages and collect response messages. It can also send the collected response messages to the database for storage. The data collection module will send probe messages to all network service addresses that need traffic monitoring in the VPC to achieve traffic monitoring of all network services that need to be monitored. The network information obtained in the data collection module can be obtained from the probe analysis module.

[0075] Among them, the probe analysis module is a middle-level module, which is mainly used for anomaly analysis. Specifically, it can classify traffic information to form a global traffic topology within the VPC, and then analyze abnormal network elements and report them to the control layer of the cloud platform through the management agent module. After classifying the traffic information, you can get the east-west traffic information, north-south traffic information, user service port traffic information, VPN gateway traffic information, NAT gateway traffic information, DHCP traffic information, etc.

[0076] In one embodiment, the network information may include: the IP address of the cloud host within the virtual private network, the internal subnet gateway of the virtual private network, the VPN gateway, the DHCP service address, the elastic public IP address bound to the virtual private network, the NAT gateway, the security group rules and at least one of the service port number.

[0077] In one embodiment, the probe analysis module includes:

[0078] A traffic classification unit, used to classify the traffic information according to each network element in the network information to obtain traffic information corresponding to different network elements;

[0079] A topology forming unit, configured to form a global traffic topology within the virtual private network from the classified traffic information according to a topology structure formed by each network element in the network information;

[0080] An abnormality determination unit is used to determine the network element where the abnormality occurs according to the response message and the global traffic topology, and report the network element where the abnormality occurs as the abnormality analysis result to the control layer.

[0081] Furthermore, the detection message includes multiple first ping packets, each first ping packet is used to detect whether a corresponding network service address in the network information is reachable; correspondingly, the abnormality determination unit is specifically used to: if it is learned from a response message of one of the first ping packets that the corresponding network service address is unreachable, then determine the IP route blocked by the first ping packet, determine the network element to which the blocked IP route belongs from the global traffic topology, and report the abnormality of the network element as the abnormality analysis result to the control layer.

[0082] In one embodiment, the data collection module is also used to: send a second ping packet when all network service addresses are reachable; wherein the second ping packet is used to detect whether the service port corresponding to the service port number in the virtual private network is connectable; the probe analysis module is also used to: determine whether the service port corresponding to the service port number is connectable based on the response message of the second ping packet; if it is not connectable, determine whether the service port number in the security group rule is in a released state; if it is not released, determine that an error occurs in the security group rule, and report the security group rule error to the control layer; if it is released, determine that an abnormality occurs in the service port corresponding to the service port number, and report the service port abnormality to the control layer.

[0083] In a third aspect, an embodiment of the present invention provides a method for implementing a flow probe, wherein the flow probe is the flow monitoring device provided in the second aspect, and the method is executed by the control layer of the cloud platform. The method comprises the following steps S210 to S220:

[0084] S210. When the creation of a first virtual private network is detected in the cloud platform, a preset network segment is created in the first virtual private network, and the image into which the traffic probe is pre-packaged is started in the preset network segment to form a traffic probe virtual machine corresponding to the first virtual private network, and a corresponding network card is allocated to the traffic probe virtual machine corresponding to the first virtual private network in the preset network segment;

[0085] S220: When it is detected that the second virtual private network is deleted in the cloud platform, the flow probe virtual machine corresponding to the second virtual private network is deleted.

[0086] In one embodiment, the traffic probe virtual machine corresponding to the first virtual private network is bound to the elastic public IP of the first virtual private network, so that the traffic probe virtual machine corresponding to the first virtual private network can detect north-south traffic through the bound elastic public IP.

[0087] For example, the traffic probe is packaged as an image in advance and controlled by the control layer. When the control layer detects the creation of a new VPC in the cloud platform, the control layer creates an additional 11.0.0.0 / 24 network segment in the new VPC and starts the image in this network segment. Therefore, a traffic probe virtual machine is formed in the new VPC, and then a network card is allocated in the network segment for the traffic probe virtual machine to use. At the same time, in order to detect abnormalities in north-south traffic, an elastic public IP will be automatically bound, which will be hidden from users.

[0088] In the method provided in the embodiment of the present invention, first, when the creation of the first virtual private network in the cloud platform is detected, a preset network segment is created in the first virtual private network, and the image pre-packaged with the traffic probe is started in the preset network segment to form a traffic probe virtual machine corresponding to the first virtual private network. It can be seen that the corresponding traffic probe can be created as the first virtual private network is created. When the deletion of the second virtual private network in the cloud platform is detected, the traffic probe virtual machine corresponding to the second virtual private network is deleted. It can be seen that the corresponding traffic probe can be deleted as the first virtual private network is deleted. It can be seen that the method provided in the embodiment of the present invention can enable the traffic probe to be created or deleted as the network scales, that is, it has very good scalability and is suitable for scenarios where the scale of the cloud platform is expanded and the number of tenants increases. Moreover, a traffic probe virtual machine is created by starting the image in a specific network segment, and deployment is also very convenient.

[0089] The embodiment of the present invention addresses the problem that the current network platform's traffic probes cannot be flexibly expanded according to the network scale and cannot flexibly monitor tenant-level traffic. A method for implementing a scalable virtual private network traffic probe is proposed. The probe can be quickly deployed or deleted according to the creation and deletion of a virtual private network, and can be elastically scalable. It can solve the monitoring and analysis of tenant traffic in a fine-grained manner within the virtual private network, and can meet the traffic monitoring needs of large-scale networks. At the same time, it can save resources and dynamically scale. It does not need to target specific network devices and is not dependent on hardware. In addition, the probe is started as a lightweight image and does not occupy too many resources of the cloud platform.

[0090] In a fourth aspect, an embodiment of the present specification provides a flow probe implementation device, wherein the flow probe is the flow monitoring device provided in the second aspect, and the flow probe implementation device is deployed on the control layer of the cloud platform. The device includes:

[0091] A probe creation module is used to create a preset network segment in the first virtual private network when monitoring the creation of the first virtual private network in the cloud platform, start the image pre-packaged with the flow probe in the preset network segment to form a flow probe virtual machine corresponding to the first virtual private network, and allocate a corresponding network card to the flow probe virtual machine corresponding to the first virtual private network in the preset network segment;

[0092] The probe deletion module is used to delete the flow probe virtual machine corresponding to the second virtual private network when it is detected that the second virtual private network is deleted in the cloud platform.

[0093] In one embodiment, the probe creation module is also used to: bind the traffic probe virtual machine corresponding to the first virtual private network to the elastic public IP of the first virtual private network, so that the traffic probe virtual machine corresponding to the first virtual private network can detect north-south traffic through the bound elastic public IP.

[0094] In a fifth aspect, an embodiment of the present specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a method in any one of the embodiments in the specification.

[0095] In a sixth aspect, an embodiment of the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements the method in any one of the embodiments in the specification.

[0096] It is to be understood that the structures illustrated in the embodiments of this specification do not constitute specific limitations on the devices of the embodiments of this specification. In other embodiments of the specification, the above-mentioned device may include more or fewer components than those shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0097] Since the information interaction, execution process, etc. between the modules in the above-mentioned devices and systems are based on the same concept as the method embodiments of this specification, the specific contents can be found in the description of the method embodiments of this specification and will not be repeated here.

[0098] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0099] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, widgets, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0100] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A flow monitoring method, characterized in that: include: Obtain network information of the virtual private network from the control layer of the cloud platform; Sending a detection message to each network service in the virtual private network according to the network information, and receiving a response message returned by each network service; Performing traffic anomaly analysis according to the traffic information in the response message and the network information to obtain an anomaly analysis result, and reporting the anomaly analysis result to the control layer; The network information includes: at least one of the IP address of the cloud host in the virtual private network, the internal subnet gateway of the virtual private network, the VPN gateway, the DHCP service address, the elastic public network IP address bound to the virtual private network, the NAT gateway, the security group rule and the service port number; The performing traffic anomaly analysis according to the traffic information in the response message and the network information to obtain an anomaly analysis result, and reporting the anomaly analysis result to the control layer includes: Classifying the flow information according to each network element in the network information to obtain flow information corresponding to different network elements; According to the topological structure formed by each network element in the network information, the classified traffic information forms a global traffic topology within the virtual private network; Determine the network element where the abnormality occurs according to the response message and the global traffic topology, and report the network element where the abnormality occurs as the abnormality analysis result to the control layer; The detection message includes a plurality of first ping packets, each of which is used to detect whether a corresponding network service address in the network information is reachable; correspondingly, determining the network element where the abnormality occurs according to the response message and the global traffic topology, and reporting the network element where the abnormality occurs as the abnormality analysis result to the control layer, includes: If it is known from a response message of the first ping packet that the corresponding network service address is unreachable, the IP route blocked by the first ping packet is determined, and the network element to which the blocked IP route belongs is determined from the global traffic topology, and an abnormality of the network element is reported to the control layer as the abnormality analysis result; The method further comprises: When all network service addresses are reachable, sending a second ping packet; wherein the second ping packet is used to detect whether the service port corresponding to the service port number in the virtual private network is connectable; Determine whether the service port corresponding to the service port number is connected according to the response message of the second ping packet; if not, determine whether the service port number in the security group rule is in a released state; if not, determine that an error occurs in the security group rule, and report the security group rule error to the control layer; if released, determine that an abnormality occurs in the service port corresponding to the service port number, and report the service port abnormality to the control layer.

Images