A real-time analysis method and storage medium for topological relationships and abnormal nodes

Abstract

The invention provides a real-time analysis method and storage medium for topological relationships and abnormal nodes, step 1, establishing an underlying data algorithm; step 2, establishing a graph database; step 3, establishing a service layer; step 4, establishing a front-end user interface; step 5, the front-end software retrieves the network node relationship, and the network node relationship is displayed by the front-end user interface of the front-end software through a topology generation interface; step 6, the service layer matches the network abnormal nodes with the nodes in the current network node relationship in the graph database one by one, and if an unmatched abnormal node is found, it reports to the front-end software in real time, and sends a real-time report of the abnormal node to the user through the front-end user interface of the front-end software. The invention aims to be able to quickly analyze the topological structure of existing network nodes and changed network nodes; to be able to save the network node topological relationship and visualize it; and to achieve real-time monitoring of abnormal nodes in the network.

Description

Technical Field

[0001] The invention belongs to the technical field of network services, and in particular relates to a real-time analysis method of topological relationships and abnormal nodes. Background Art

[0002] In the actual complex network architecture, in order to maintain the topological relationship between network devices and the abnormal state of the network, a large amount of labor costs are required for network registration, and human errors may also cause delays in discovering abnormal problems in the network. Due to manual operation, it is impossible to quickly analyze the topological structure of existing network nodes and changed network nodes, and the topological relationship of network nodes cannot be saved in time, and it is not convenient for visualization and editing. In addition, the high cost of manual maintenance of complex networks is also a more realistic problem; at the same time, there is a lack of the ability to monitor abnormal nodes in the network in real time, resulting in great losses. Summary of the invention

[0003] In view of this, the invention aims to propose a real-time analysis method of topological relationships and abnormal nodes to quickly analyze existing network nodes and the topological structure of changed network nodes; it can save the topological relationship of network nodes and display it visually; and realize real-time monitoring of abnormal nodes in the network.

[0004] To achieve the above object, the technical solution created by the present invention is implemented as follows:

[0005] In a first aspect, the present invention provides a real-time analysis method of topological relationships and abnormal nodes, comprising the following steps:

[0006] Step 1, establishing an underlying data algorithm, the underlying data algorithm including a first algorithm for obtaining network node relationships and a second algorithm for obtaining network abnormal nodes;

[0007] Step 2, establishing a graph database, which stores the network node relationship and the network abnormal nodes, and performs real-time data update on the network node relationship to obtain the current network node relationship;

[0008] Step 3, establish a service layer, the service layer provides services for the front-end user interface through the back-end program, the service includes extracting the network node relationship and network abnormal nodes from the graph database, and processing the network node relationship and network abnormal nodes into the format required by the front-end software for the front-end user interface to retrieve; the format required by the front-end software includes a JSON format file, the content of which includes device type, MAC address, IP address and hierarchical relationship data;

[0009] Step 4, establishing a front-end user interface, the front-end user interface establishes communication with the service layer to retrieve the network node relationship and network abnormal nodes;

[0010] Step 5, network topology display: the front-end software retrieves the network node relationship, and displays the network node relationship through the topology generation interface by the front-end user interface of the front-end software;

[0011] Step 6, real-time report of abnormal nodes: the service layer matches the current network node with the nodes in the network node relationship one by one, and the matching method is: matching in sequence according to the network structure node order, and the matching content includes whether the device type, MAC address and IP address are consistent with those stored in the graph database; if an unmatched abnormal node is found, it will be reported to the front-end software in real time, and the real-time report of the abnormal node will be sent to the user through the front-end user interface of the front-end software.

[0012] In a second aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the method described in any one of the schemes of the first aspect are executed.

[0013] Compared with the prior art, the real-time analysis method of topological relationships and abnormal nodes created by the present invention has the following advantages:

[0014] The present invention provides a complete set of network topology algorithms and network anomaly analysis algorithm processes, as well as a complete user interface UI display system, which can display accurate topological relationships through simple user interface UI operations, and can receive various forms of real-time network anomaly messages. Specifically, by writing a complete set of network data analysis algorithms, according to standard network transmission protocols, the topological structure of existing network nodes and changed network nodes in the network can be quickly analyzed, and the topological relationship can be saved through graph database technology for visual display and editing, solving the problem of high manual maintenance costs for complex networks; at the same time, real-time monitoring of abnormal data packets in the network is also performed, and network anomalies are displayed after matching with network nodes in the graph database, and abnormal notifications are pushed in real time, solving the problem of delays in discovering abnormal network status. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings constituting part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments and descriptions of the present invention are used to explain the present invention and do not constitute an improper limitation on the present invention. In the drawings:

[0016] Figure 1 is a flowchart of steps of an embodiment of the present invention;

[0017] Figure 2 is a system framework diagram of an embodiment of the present invention;

[0018] Figure 3This is a front-end user interface diagram described in an embodiment of the present invention;

[0019] Figure 4 A second algorithm flow chart for obtaining abnormal network nodes according to an embodiment of the present invention;

[0020] Figure 5 This is an example of the network topology and anomaly analysis algorithm described in the embodiment of the present invention.

[0021] Description of reference numerals:

[0022] 100-underlying algorithm; 200-graph database; 300-backend program; 400-front-end user interface; 301-interface layer; 302-service layer; 303-data access layer; 304-basic layer; 401-access interface; 402-topology configuration interface; 403-topology generation interface; 404-configurable interface; 501-reliability list; 502-obtain inferred network model; 503-obtain inferred model of abnormal level; 504-obtain confirmation model correctness and node relationship. DETAILED DESCRIPTION

[0023] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0024] The present invention will be described in detail below with reference to the accompanying drawings and in combination with embodiments.

[0025] like Figure 1 As shown, a flowchart of a step of an embodiment of the invention, a real-time analysis method of topological relationships and abnormal nodes, comprises the following steps:

[0026] Step 1, establishing an underlying data algorithm, the underlying data algorithm including a first algorithm for obtaining network node relationships and a second algorithm for obtaining network abnormal nodes;

[0027] Step 2, establishing a graph database, which stores the network node relationship and the network abnormal nodes, and performs real-time data update on the network node relationship to obtain the current network node relationship;

[0028] Step 3, establish a service layer, the service layer provides services for the front-end user interface through the back-end program, the service includes extracting the network node relationship and network abnormal nodes from the graph database, and processing the network node relationship and network abnormal nodes into the format required by the front-end software for the front-end user interface to retrieve; the format required by the front-end software includes a JSON format file, the content of which includes device type, MAC address, IP address and hierarchical relationship data;

[0029] Step 4, establishing a front-end user interface, the front-end user interface establishes communication with the service layer to retrieve the network node relationship and network abnormal nodes;

[0030] Step 5, network topology display: the front-end software retrieves the network node relationship, and displays the network node relationship through the topology generation interface by the front-end user interface of the front-end software;

[0031] Step 6, real-time report of abnormal nodes: the service layer matches the current network node with the nodes in the network node relationship one by one. If an unmatched abnormal node is found, it will report it to the front-end software in real time, and send the real-time report of the abnormal node to the user through the front-end user interface of the front-end software; the matching method is: matching in sequence according to the order of network structure nodes, and the matching content includes whether the device type, MAC address and IP address are consistent with those stored in the graph database.

[0032] As one of the preferred implementations of the present invention, it also includes step 7, constructing an interface layer; the interface layer establishes communication with the front-end software, and the interface layer is used to encapsulate the queue service and SMS service of the open source software. The queue service and SMS service of the open source software are configured through the configurable interface of the front-end user interface.

[0033] like Figure 4 As shown, as one of the preferred embodiments of the present invention, in step 1, the first algorithm for obtaining the network node relationship includes the following steps:

[0034] Step 101, perform network detection of all network nodes, and establish a data model according to connection reliability and corresponding network node correlation; the connection reliability is the consistency of hop data obtained by multiple attempts of the same data model in the first algorithm; the network node correlation is based on the connection reliability, and the data model is tested, and the data model is used to determine the relevant hierarchical relationship between nodes;

[0035] It needs to be further explained that: the consistency of the hop data includes MAC address consistency and IP consistency. After multiple attempts at the same data model, the same correlation coefficient and reliability coefficient are determined. The number of groups is increased successively until the reliability and correlation system of each group of networks can be stably detected and the consistency is stopped. One or more inferred network models are obtained, and then it is verified whether the network model is an abnormal model.

[0036] Step 102, inferring a network model according to the correlation of the network nodes in step 101; further, solving the underdetermined equation of the data model according to the correlation coefficient of the network nodes to obtain a plurality of network models that satisfy the equation conditions;

[0037] Step 103, determining the model probability according to the total number of nodes and the correlation of the network nodes;

[0038] It should be further explained that the formula used to calculate the total number of nodes is:

[0039] L=j×m

[0040] Where L represents the total number of data flows in the network topology, j represents the number of data flows in the network, and m represents the number of network links in the core channel;

[0041] Step 104, different models push out different model fault tolerances to obtain an inference model of abnormal level; the inference model process of the different network models is carried out according to the steps 102 and 103, and the network node correlation and the connection reliability are calculated multiple times according to the data model to calculate different network models with the same probability;

[0042] Step 105, determine the network topology structure according to the network model, the number of network links, and the node network data transmission situation, and at the same time, according to the network monitoring situation, correspond to the network anomaly model, confirm the model correctness and node relationship.

[0043] As one of the preferred embodiments of the present invention, in step 1, the first algorithm includes an analysis algorithm for the main topology relationship, and the specific steps of the analysis algorithm are: injecting a group of data packets into the detected network, and obtaining the topological connection status of the network by analyzing the network feedback information; the network feedback information includes connection duration, connection hop data and hop type.

[0044] As one of the preferred embodiments of the present invention, in step 1, the first algorithm includes an analysis algorithm for the main topological relationship, and the specific steps of the analysis algorithm are: listening to the data between network elements, and analyzing the data obtained by listening to obtain the topological connection status of the network, and the specific method is: first detect all nodes in the network, and then group the nodes, two nodes as one group; then detect the network feedback information of the network result according to the data model injected by the group; the consistency of the hop data includes MAC address consistency and IP consistency, and after multiple tests and attempts on the same data model, it is determined that the same correlation coefficient and reliability coefficient are obtained; the number of groups is increased successively until the reliability and correlation system of each group of networks can be stably detected and stopped, and one or more inferred network models are obtained, and then it is verified whether the network model is an abnormal model.

[0045] Furthermore, network topology discovery can be classified into active network topology discovery and passive network topology discovery according to the discovery method. The so-called active network topology discovery refers to injecting a set of carefully designed datagrams into the detected network, and analyzing the network feedback information to obtain the network topology connection situation. For example, various network topology discovery methods based on Traceroute are typical active network topology discovery methods. Network topology discovery based on SNMP should also be classified as an active network topology discovery method in principle. Since active network topology discovery can be based on the detection needs, the detection initiator can design the detection datagram specifically, so it is applicable to a wide range of situations, the network range that can be detected can be very large, and the accuracy of network topology detection can be continuously improved by improving the scientificity and rationality of the injected data packets. Passive network topology discovery refers to listening to the data between network elements, and analyzing the data obtained by listening to it, and then obtaining the network topology connection situation. For example, the method of detecting network topology by listening to OSPF exchange data packets between routers is a passive topology discovery method.

[0046] Furthermore, for the analysis algorithm of the router in the network, the specific method includes: the first step, in the routing record of the router, the router type is 1 for other, the router type is 2 for invalid, the router type is 3 for direct, and the router type is 4 for indirect. If the router type is 3, it means that the IP address of the target subnet is directly connected to the router, and the subnet IP address is obtained by the next station address of the router and the subnet mask of the target network. The ipRouteIfIndex in the ipRouteTable is the index of the local interface, and its value corresponds to the ifIndex value in the interface table (ifTable). The type of the subnet can be obtained through the correspondence between ifIndex and ifType. The subnet and its related information are added to the subnet database. The second step, if the destination subnet is not directly connected to the router, the subnet can only be reached through the next hop router indicated by ipRouteNextHop. At this time, the next hop router is directly connected to this router, and it is added to the router database. The third step, for the newly discovered router, repeat the above steps to complete the search of all routers and subnets. Step 4: Searching the router table and subnet table in the database can reveal the main network topology.

[0047] As one of the preferred embodiments of the present invention, in step 1, the first algorithm also includes an analysis algorithm for sub-topology relationships, and the analysis algorithm includes the following steps: step 111, in the process of discovering the main topology, the network address and subnet mask of the subnet are recorded, and the subnet mask is used to perform an "and" operation with the IP address conversion table (ipNetToMediaNetAddress) in the corresponding router table to obtain the IP addresses of all nodes in the subnet, and then ICMP echo request packets are sent to these nodes in an asynchronous manner to determine the active host;

[0048] Step 112, determine the links between switches, obtain the address forwarding table of each switch and its own MAC address in turn by pinging all switches in the subnet, so as to obtain the uplink port, downlink port and local port of each switch; select the switch with the largest number of forwarding MAC addresses in its address forwarding table from each switch in the subnet, and set it as the root switch of the current "spanning tree"; then traverse all downlink ports of the root switch except the uplink port linked to the management station, determine other switches and corresponding ports that have a simple link relationship with each port of the root switch, and divide them into various subtrees; finally, after determining the switch directly linked to the downlink port of the root switch in the switch subtree corresponding to each port, delete the root switch from the spanning tree, and the newly generated tree is a subtree of the original spanning tree, and then use the subtree as the root switch of the new subtree, and recursively execute this process until each switch subtree contains only one switch, which is a leaf node;

[0049] Step 113, determine the link between the switch and the host, and for the local port set, check the forwarding table of each port. If the address forwarding table of a port contains the MAC address of the router, then this local port is connected to the corresponding router; if the address forwarding table of a port includes the MAC address of a host, then this local port is directly connected to the corresponding host.

[0050] As one of the preferred embodiments of the present invention, in step 1, the second algorithm for obtaining abnormal network nodes includes the following steps:

[0051] Step 121, obtaining information of all nodes in the network node relationship from the graph database, and then finding the detected node and its connected nodes;

[0052] Step 122, the detected node sends a network control information protocol to the node directly connected to it to determine whether it is connected. If it is connected, it is determined that the network status is normal; if it is not connected, it is determined that the network status of the nodes directly connected to it is abnormal;

[0053] Step 123, the nodes with normal network status recursively execute step 122 until a node with abnormal network status appears or the last node is reached.

[0054] As one of the preferred embodiments of the present invention, Figure 2 As shown, in step 3, the backend program includes an interface layer 301, a service layer 302 and a data access layer 303; the data access layer 303 is used to interact with the graph database to obtain the topological data of the network node relationship and the network abnormal nodes; the service layer 302 is used to perform business processing on the topological data to obtain the topological structure and abnormal information; the interface layer 301 is used to transmit the topological structure and abnormal information to the front-end user interface.

[0055] As one of the preferred embodiments of the present invention, Figure 3 As shown, the front-end user interface includes an access interface 401 , a topology configuration interface 402 , a topology generation interface 403 and a configurable interface 404 .

[0056] Figure 5 For the network topology and anomaly analysis algorithm example described in the embodiment of the present invention, according to the step 101, a network correlation and reliability list 501 is established; according to the step 102, an inferred network model 502 is obtained; according to the steps 103 to 104, an anomaly level calculation model 503 is obtained; according to the step 105, the correctness of the model and the node relationship are confirmed 504.

[0057] A computer-readable storage medium stores a computer program, which executes the steps of the above method when executed by a processor, and is used for real-time analysis of the topological relationship and abnormal nodes of a network.

[0058] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A real-time analysis method for topological relationships and abnormal nodes, characterized in that: The following steps are involved: Step 1, establishing an underlying data algorithm, the underlying data algorithm including a first algorithm for obtaining network node relationships and a second algorithm for obtaining network abnormal nodes; Step 2, establishing a graph database, which stores the network node relationship and the network abnormal nodes, and performs real-time data update on the network node relationship to obtain the current network node relationship; Step 3, establish a service layer, the service layer provides services for the front-end user interface through the back-end program, the service includes extracting the network node relationship and network abnormal nodes from the graph database, and processing the network node relationship and network abnormal nodes into the format required by the front-end software for the front-end user interface to retrieve; the format required by the front-end software includes a JSON format file, the content of which includes device type, MAC address, IP address and hierarchical relationship data; Step 4, establishing a front-end user interface: the front-end user interface establishes communication with the service layer to retrieve the network node relationship and network abnormal nodes; Step 5, network topology display: the front-end software retrieves the network node relationship, and displays the network node relationship through the topology generation interface of the front-end user interface of the front-end software; Step 6, real-time report of abnormal nodes: the service layer matches the current network node with the nodes in the network node relationship one by one, and the matching method is: matching in sequence according to the order of the network structure nodes, and the matching content includes whether the device type, MAC address and IP address are consistent; If a mismatch is found, a real-time report will be sent to the front-end software, and a real-time report of the abnormal node will be sent to the user through the front-end user interface of the front-end software; In step 1, the first algorithm includes an analysis algorithm of the main topology relationship, and the specific steps of the analysis algorithm are: injecting a group of datagrams into the detected network, and obtaining the topological connection status of the network by analyzing the network feedback information; the network feedback information includes connection duration, connection hop data and hop type; In step 1, the first algorithm also includes an analysis algorithm for sub-topological relationships, and the analysis algorithm includes the following steps: Step 111, the network address and subnet mask of the subnet are recorded in the discovery process of the main topology, and the subnet mask is used to perform an "AND" operation with the IP address conversion table in the corresponding router table to obtain the IP addresses of all nodes in the subnet, and then ICMP echo request packets are sent to these nodes in an asynchronous manner to determine the active host; Step 112, determine the links between switches, obtain the address forwarding table of each switch and its own MAC address in turn by pinging all switches in the subnet, so as to obtain the uplink port, downlink port and local port of each switch; select the switch with the largest number of forwarding MAC addresses in its address forwarding table from the switches in the subnet, and set it as the root switch of the current "spanning tree"; then traverse all the uplink ports and downlink ports of other switches except the root switch, determine other switches and corresponding ports that have a simple link relationship with each port of the root switch, and divide them into various subtrees; finally, after determining the switch directly linked to the downlink port of the root switch in the switch subtree corresponding to each port, delete the root switch from the spanning tree, and the newly generated tree is a subtree of the original spanning tree, and then use the subtree as the root switch of the new subtree, and recursively execute this process until each switch subtree contains only one switch, which is a leaf node; Step 113, determine the link between the switch and the host, for the local port set, check the forwarding table of each port, if the address forwarding table of a port contains the MAC address of the router, then this local port is connected to the corresponding router; if the address forwarding table of a port includes the MAC address of a host, then this local port is directly connected to the corresponding host; In step 1, the second algorithm for obtaining abnormal network nodes includes the following steps: Step 121, obtaining information of all nodes in the network node relationship from the graph database, and then finding the detected node and its connected nodes; Step 122, the detected node sends a network control information protocol to the node directly connected to it to determine whether it is connected. If it is connected, it is determined that the network status is normal; if it is not connected, it is determined that the network status of the nodes directly connected to it is abnormal; Step 123, the nodes with normal network status recursively execute step 122 until a node with abnormal network status appears or the last node is reached.

2. The real-time analysis method of topological relationships and abnormal nodes according to claim 1 is characterized in that: It also includes step 7, building an interface layer; the interface layer establishes communication with the front-end software, and the interface layer is used to encapsulate the queue service and SMS service of the open source software. The queue service and SMS service of the open source software are configured through the configurable interface of the front-end user interface.

3. The real-time analysis method of topological relationships and abnormal nodes according to claim 1 is characterized by: In step 3, the backend program includes an interface layer (301), a service layer (302) and a data access layer (303); the data access layer (303) is used to interact with the graph database to obtain the topological data of the network node relationship and the network abnormal nodes; the service layer (302) is used to perform business processing on the topological data to obtain the topological structure and abnormal information; the interface layer (301) is used to transmit the topological structure and abnormal information to the front-end user interface.

4. The real-time analysis method of topological relationships and abnormal nodes according to claim 1 is characterized by: The front-end user interface includes an access interface, a topology configuration interface, a topology generation interface and a configurable interface.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are executed.

6. A real-time analysis method for topological relationships and abnormal nodes, characterized in that: The following steps are involved: Step 1, establishing an underlying data algorithm, the underlying data algorithm including a first algorithm for obtaining network node relationships and a second algorithm for obtaining network abnormal nodes; Step 2, establishing a graph database, which stores the network node relationship and the network abnormal nodes, and performs real-time data update on the network node relationship to obtain the current network node relationship; Step 3, establish a service layer, the service layer provides services for the front-end user interface through the back-end program, the service includes extracting the network node relationship and network abnormal nodes from the graph database, and processing the network node relationship and network abnormal nodes into the format required by the front-end software for the front-end user interface to retrieve; the format required by the front-end software includes a JSON format file, the content of which includes device type, MAC address, IP address and hierarchical relationship data; Step 4, establishing a front-end user interface: the front-end user interface establishes communication with the service layer to retrieve the network node relationship and network abnormal nodes; Step 5, network topology display: the front-end software retrieves the network node relationship, and displays the network node relationship through the topology generation interface of the front-end user interface of the front-end software; Step 6, real-time report of abnormal nodes: the service layer matches the current network node with the nodes in the network node relationship one by one, and the matching method is: matching in sequence according to the order of the network structure nodes, and the matching content includes whether the device type, MAC address and IP address are consistent; If a mismatch is found, a real-time report will be sent to the front-end software, and a real-time report of the abnormal node will be sent to the user through the front-end user interface of the front-end software; In step 1, the first algorithm includes an analysis algorithm of the main topological relationship, and the specific steps of the analysis algorithm are: intercepting the data between network elements, and analyzing the intercepted data to obtain the topological connection of the network, and the specific method is: firstly detecting all nodes in the network, and then grouping the nodes, two nodes as one group; then injecting the data model into the group, and detecting the network feedback information of the network result; In step 1, the first algorithm also includes an analysis algorithm for sub-topological relationships, and the analysis algorithm includes the following steps: Step 111, the network address and subnet mask of the subnet are recorded in the discovery process of the main topology, and the subnet mask is used to perform an "AND" operation with the IP address conversion table in the corresponding router table to obtain the IP addresses of all nodes in the subnet, and then ICMP echo request packets are sent to these nodes in an asynchronous manner to determine the active host; Step 112, determine the links between switches, obtain the address forwarding table of each switch and its own MAC address in turn by pinging all switches in the subnet, so as to obtain the uplink port, downlink port and local port of each switch; select the switch with the largest number of forwarding MAC addresses in its address forwarding table from the switches in the subnet, and set it as the root switch of the current "spanning tree"; then traverse all the uplink ports and downlink ports of other switches except the root switch, determine other switches and corresponding ports that have a simple link relationship with each port of the root switch, and divide them into various subtrees; finally, after determining the switch directly linked to the downlink port of the root switch in the switch subtree corresponding to each port, delete the root switch from the spanning tree, and the newly generated tree is a subtree of the original spanning tree, and then use the subtree as the root switch of the new subtree, and recursively execute this process until each switch subtree contains only one switch, which is a leaf node; Step 113, determine the link between the switch and the host, for the local port set, check the forwarding table of each port, if the address forwarding table of a port contains the MAC address of the router, then this local port is connected to the corresponding router; if the address forwarding table of a port includes the MAC address of a host, then this local port is directly connected to the corresponding host; In step 1, the second algorithm for obtaining abnormal network nodes includes the following steps: Step 121, obtaining information of all nodes in the network node relationship from the graph database, and then finding the detected node and its connected nodes; Step 122, the detected node sends a network control information protocol to the node directly connected to it to determine whether it is connected. If it is connected, it is determined that the network status is normal; if it is not connected, it is determined that the network status of the nodes directly connected to it is abnormal; Step 123, the nodes with normal network status recursively execute step 122 until a node with abnormal network status appears or the last node is reached.

7. The real-time analysis method of topological relationships and abnormal nodes according to claim 6 is characterized in that: It also includes step 7, building an interface layer; the interface layer establishes communication with the front-end software, and the interface layer is used to encapsulate the queue service and SMS service of the open source software. The queue service and SMS service of the open source software are configured through the configurable interface of the front-end user interface.

8. The real-time analysis method of topological relationships and abnormal nodes according to claim 6 is characterized by: In step 3, the backend program includes an interface layer (301), a service layer (302) and a data access layer (303); the data access layer (303) is used to interact with the graph database to obtain the topological data of the network node relationship and the network abnormal nodes; the service layer (302) is used to perform business processing on the topological data to obtain the topological structure and abnormal information; the interface layer (301) is used to transmit the topological structure and abnormal information to the front-end user interface.

9. The real-time analysis method of topological relationships and abnormal nodes according to claim 6 is characterized by: The front-end user interface includes an access interface, a topology configuration interface, a topology generation interface and a configurable interface.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 6 to 9 are executed.

Images