A system that can accurately analyze users' real traffic conditions

Abstract

The present invention relates to the technical field of network traffic analysis, and proposes a system capable of accurately analyzing the real traffic situation of users, including a traffic analysis system, wherein the traffic analysis system includes a core module, a protocol analysis module, and a business logic layer service module, wherein the terminal of the protocol analysis module is respectively provided with an LDAP server, a ZAZHE service, and a logic model retrieval, and the terminal of the LDAP server is provided with a user system; the core module includes a data packet capture module, which is used to capture the data packets of the protocol; a single packet DNA generation module, which is used to generate the protocol packet DNA captured by the data packet capture module; a protocol packet restoration module, which is used to restore the protocol packet of the application; and a packet forwarding control module, which is used to forward and control the protocol packet. Through the above technical scheme, the problem that the existing system for analyzing the traffic situation cannot accurately know the real traffic situation of each system, cannot match the corresponding business, and is difficult to form analysis data of the business dimension is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic analysis, and in particular to a system capable of accurately analyzing the real traffic situation of a user. Background Art

[0002] Current traffic monitoring methods can only monitor device port traffic, and the monitoring granularity is relatively coarse, which cannot achieve the monitoring goal of differentiating traffic by business.

[0003] The existing systems for analyzing traffic conditions are unable to accurately know the real traffic conditions of each system, cannot match the corresponding business, and it is difficult to form business-dimensional analysis data. For this reason, we propose a system that can accurately analyze the real traffic conditions of users. Summary of the invention

[0004] The present invention proposes a system that can accurately analyze the real traffic situation of users, which solves the problem that the existing system for analyzing traffic situation in the related technology cannot accurately know the real traffic situation of each system, cannot match the corresponding business, and is difficult to form analysis data in the business dimension.

[0005] The technical solution of the present invention is as follows:

[0006] A system capable of accurately analyzing the real traffic situation of a user, comprising a traffic analysis system, the traffic analysis system comprising a core module, a protocol analysis module and a business logic layer service module, the terminals of the protocol analysis module are respectively provided with an LDAP server, a ZAZHE service and a logic model retrieval module, and the terminals of the LDAP server are provided with a user system;

[0007] The core module includes a data packet capture module, a single packet DNA generation module, a protocol packet restoration module and a packet forwarding control module, wherein the data packet capture module is used to capture the data packets of the protocol;

[0008] The single packet DNA generation module is used to generate the protocol packet DNA captured by the data packet capture module;

[0009] The protocol package restoration module is used to restore the protocol package of the application;

[0010] The packet forwarding control module is used to forward and control the protocol packets;

[0011] The user system includes a management module, a real-time traffic module, an analysis module, an alarm module, an audit module, a configuration module and an export module, wherein the management module is used to manage the system of the user system, and manage users, roles, operation audits, alarm thresholds, sensitive settings and group configurations respectively;

[0012] The real-time traffic module is used to implement two sub-functions: 1) to implement real-time total traffic, number of connections, and traffic by province; 2) to provide real-time alarms and indicate status, i.e., whether a message has been sent to the network management or not;

[0013] Analysis module, including analysis of total traffic, TOP protocol traffic, TOP address traffic, business traffic and business ranking;

[0014] The alarm module is used to synchronize the specified warning information to a third-party system according to the set threshold and data interface configuration;

[0015] Audit module, used to audit the original data packets of HTTP services in the total export;

[0016] Configuration module, used to configure alarm interface, data interface and page interface;

[0017] The export module is used to meet the needs of exporting economic data. The specific data format and data items are implemented according to the needs.

[0018] As a further technical solution of the present invention, the protocol parsing module is signal-connected to the core module and the business logic layer service module, the protocol parsing module is signal-connected to the LDAP server, ZAZHE service and logical model retrieval module, and the user system is built on an independent LDAP server.

[0019] As a further technical solution of the present invention, the real-time traffic module and the management module are interconnected, the analysis module and the real-time traffic module are interconnected, the alarm module and the analysis module are interconnected, the audit module and the alarm module are interconnected, the configuration module and the audit module are interconnected, and the export module and the configuration module are interconnected.

[0020] As a further technical solution of the present invention, system configuration includes distinguishing between upstream and downstream configurations, time management and IP address library management; user management includes providing export function, adding table items such as name, email, telephone and department; role management is permission management; operation audit includes providing export function, and the exported content specifically includes login name, source IP and operation log.

[0021] As a further technical solution of the present invention, the authorization method of permission management is implemented through roles, and the authorization scope is the first-level function and the second-level sub-function. The authorization is implemented by loading the function items permitted by the role according to the user role after the user logs in.

[0022] As a further technical solution of the present invention, the delay of real-time traffic and connection number is within 15 seconds.

[0023] As a further technical solution of the present invention,

[0024] Business traffic includes:

[0025] Statistics by source: including network type, others, and statistics by date, business group, and operator;

[0026] Statistics by business traffic: Statistics are collected by established business groups, by date, and on a month-on-month basis;

[0027] Business ranking: Select several business groups and rank the business traffic of the subgroups.

[0028] As a further technical solution of the present invention, the audit of the audit module includes requests and responses; the request original data and response original data of the corresponding content of the server are fuzzy matched, and the export module is used to export daily data as needed.

[0029] The working principle and beneficial effects of the present invention are:

[0030] 1. The present invention solves the deficiencies in traffic monitoring and analysis through the cooperation between the core module and the user system, so that business operations personnel can accurately know the real traffic conditions of each system.

[0031] 2. The system of the present invention adopts a modular design and has good encapsulation, which makes the system have strong scalability. Through different modules of the software, each group of modules can be split and run on different servers according to the needs of actual applications, so as to achieve load sharing. Therefore, the system can be customized according to needs and user usage patterns.

[0032] 3. After the system of the present invention has been running for a period of time, the logic model of the business can be solidified according to the data packet interaction process of the business logic, so that the operating efficiency of the system can be greatly improved after the business data logic model is formed.

[0033] 4. The system of the present invention can form a distributed user system according to the needs of use, and has high user management efficiency and scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0035] Figure 1 is a system block diagram of the present invention;

[0036] Figure 2 This is a principle block diagram of the present invention;

[0037] Figure 3A system block diagram of the user system and the LDAP server of the present invention;

[0038] Figure 4 It is a principle block diagram of the user system of the present invention;

[0039] Figure 5 Analyze the schematic diagram of the present invention.

[0040] In the figure: 1. Traffic analysis system;

[0041] 2. Core module; 21. Data packet capture module; 22. Single packet DNA generation module; 23. Protocol packet restoration module; 24. Packet forwarding control module;

[0042] 3. Protocol parsing module; 4. Business logic layer service module; 5. LDAP server;

[0043] 6. User system; 61. Management module; 62. Real-time traffic module; 63. Analysis module; 64. Alarm module; 65. Audit module; 66. Configuration module; 67. Export module. DETAILED DESCRIPTION

[0044] The following will be combined with the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Example 1

[0045] like Figure 1~Figure 3 and Figure 5 As shown, this embodiment proposes a system that can accurately analyze the actual traffic situation of users, including a traffic analysis system 1, the traffic analysis system 1 includes a core module 2, a protocol analysis module 3 and a business logic layer service module 4, the terminal of the protocol analysis module 3 is respectively provided with an LDAP server 5, a ZAZHE service and a logical model retrieval module, the terminal of the LDAP server 5 is provided with a user system 6, the protocol analysis module 3 is signal-connected to the core module 2 and the business logic layer service module 4, the protocol analysis module 3 is signal-connected to the LDAP server 5, the ZAZHE service and the logical model retrieval module, and the user system 6 is constructed based on an independent LDAP server 5. Example 2

[0046] like Figure 1~Figure 2As shown, on the basis of Example 1, it is also proposed that the core module 2 includes a data packet capture module 21, a single packet DNA generation module 22, a protocol packet restoration module 23 and a packet forwarding control module 24, the data packet capture module 21 is used to capture the data packets of the protocol; the single packet DNA generation module 22 is used to generate the protocol packet DNA captured by the data packet capture module 21; the protocol packet restoration module 23 is used to restore the protocol packet of the application; the packet forwarding control module 24 is used to forward and control the protocol packet. By adopting a modular design, it has good encapsulation and makes the system have strong scalability; through different modules of the software, such as various protocol analysis, packet capture and grouping, various services of the business logic layer, etc., they can be run on different machines and equipment respectively to complete the functions of the entire system together; according to the needs of actual applications, each group of modules can be split and run on different servers, so as to achieve load sharing, so the system can be customized according to needs and user usage patterns. Example 3

[0047] like Figure 4~Figure 5As shown, on the basis of Example 2, it is also proposed that the user system 6 includes a management module 61, a real-time traffic module 62, an analysis module 63, an alarm module 64, an audit module 65, a configuration module 66 and an export module 67, including a management module 61 for managing the system of the user system 6, and managing users, roles, operation audits, alarm thresholds, sensitive settings and group configurations respectively; a real-time traffic module 62, for realizing two sub-functions: 1) realizing real-time total traffic, number of connections, and provincial traffic; 2) playing the role of real-time alarm and indicating status, that is, whether it has been sent to the network management or not; an analysis module 63, including analysis of total traffic, TOP protocol traffic, TOP address traffic, business traffic and business ranking Analysis; Alarm module 64, used to synchronize the specified warning information to the third-party system according to the set threshold and data interface configuration; Audit module 65, used to audit the original data packets of HTTP service in the total export; Configuration module 66, used to configure the alarm interface, data interface and page interface; Export module 67, used to solve the demand for exporting economic data, the specific data format and data items are implemented according to the demand, the real-time traffic module 62 and the management module 61 are interconnected, the analysis module 63 and the real-time traffic module 62 are interconnected, the alarm module 64 and the analysis module 63 are interconnected, the audit module 65 and the alarm module 64 are interconnected, the configuration module 66 and the audit module 65 are interconnected, and the export module 67 is used to solve the demand for exporting economic data. The specific data format and data items are implemented according to the demand. The real-time traffic module 62 and the management module 61 are interconnected, the analysis module 63 and the real-time traffic module 62 are interconnected, the alarm module 64 and the analysis module 63 are interconnected, the audit module 65 and the alarm module 64 are interconnected, and the configuration module 66 and the audit module 65 are interconnected. The output module 67 and the configuration module 66 are interconnected. The system configuration includes distinguishing upstream and downstream configurations, time management, and IP address library management; user management includes providing export functions, adding table items such as name, email, phone number, and department; role management is permission management; operation auditing includes providing export functions, and the export content specifically includes login name, source IP, and operation log. The authorization method of permission management is implemented through roles, and the authorization scope is the first-level function and the second-level sub-function. The authorization is implemented by loading the function items permitted by the role according to the user role after the user logs in. The delay of real-time traffic and number of connections is within 15 seconds. The analysis module 63 includes total traffic: distinguishing optional upstream and downstream, trend chart, and optional granularity of 1min, 5min, and 30min ,1H, optional time period, export, optional month-on-month comparison; TOP protocol traffic: TOP10+1, the eleventh is other traffic, distinguish between optional uplink and downlink, optional time period is distinguished to minutes, click on the specific protocol to give details, export; TOP address traffic: TOP10+1, the eleventh is other traffic, distinguish between optional uplink and downlink, optional time period is distinguished to minutes, click on the specific address to give details and export; Business traffic: display traffic by selected application group, multiple selection of application group, optional time period, optional month-on-month comparison; Business ranking: display traffic by selected application group, multiple selection of application group, optional time period; Business traffic includes: statistics by source: including network type, others, statistics by date, business group; statistics can also be made by operator;Statistics by business flow: Statistics are made by established business groups and by date, and can be compared with the same period last year; Business ranking: Several business groups can be selected, and business flow rankings can be made for subgroups. The audit module 65 audits requests and responses. The original request data and original response data of the corresponding content of the query server are obtained through fuzzy matching. The export module 67 can export daily data as needed. The user system 6 can be built on an independent LDAP server 5 according to the needs of use, and a distributed user system 6 can be formed, which has high user management efficiency and scalability. ;

[0048] In summary, the present invention solves the deficiencies in traffic monitoring and analysis through the cooperation between the core module 2 and the user system 6, so that business operations personnel can accurately know the real traffic conditions of each system.

[0049] It should be noted that after running for a period of time, this system can solidify the business logic model according to the data packet interaction process of the business logic. Once the business data logic model is formed, the system packet analysis will be greatly accelerated and the system performance will be greatly improved. The business data logic model needs to be gradually formed based on the data packet interaction history of specific businesses and combined with DNA technology, which can greatly improve the system's operating efficiency after the business data logic model is formed.

[0050] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A system capable of accurately analyzing the actual traffic situation of users, characterized in that: The invention comprises a traffic analysis system (1), wherein the traffic analysis system (1) comprises a core module (2), a protocol analysis module (3) and a business logic layer service module (4), wherein the terminal of the protocol analysis module (3) is respectively provided with an LDAP server (5), a ZAZHE service and a logic model retrieval module, and the terminal of the LDAP server (5) is provided with a user system (6); The core module (2) comprises a data packet capture module (21), a single packet DNA generation module (22), a protocol packet restoration module (23) and a packet forwarding control module (24), wherein the data packet capture module (21) is used to capture the data packets of the protocol; The single packet DNA generation module (22) is used to generate the protocol packet DNA captured by the data packet capture module (21); The protocol packet restoration module (23) is used to restore the protocol packet of the application; The packet forwarding control module (24) is used to forward and control the protocol packets; The user system (6) comprises a management module (61), a real-time traffic module (62), an analysis module (63), an alarm module (64), an audit module (65), a configuration module (66) and an export module (67), wherein the management module (61) is used to manage the system of the user system (6), and to manage users, roles, operation audits, alarm thresholds, sensitive settings and group configurations respectively; The real-time traffic module (62) is used to realize two sub-functions: 1) to realize the real-time total traffic, number of connections, and provincial traffic; 2) to play the role of real-time alarm and status indication, that is, whether the network management has been sent or not; An analysis module (63), including analysis of total traffic, TOP protocol traffic, TOP address traffic, business traffic and business ranking; An alarm module (64) is used to synchronize the designated alarm information to a third-party system according to the set threshold value and data interface configuration; An audit module (65) is used to audit the original data packets of the HTTP service in the total export; A configuration module (66), used to configure an alarm interface, a data interface and a page interface; The export module (67) is used to meet the needs of exporting the classified data, and the specific data format and data items are implemented according to the needs.

2. A system capable of accurately analyzing the real traffic situation of a user according to claim 1, characterized in that: The protocol analysis module (3) is connected to the core module (2) and the business logic layer service module (4) through signal connections, the protocol analysis module (3) is connected to the LDAP server (5), the ZAZHE service and the logic model retrieval module through signal connections, and the user system (6) is constructed based on an independent LDAP server (5).

3. A system capable of accurately analyzing the real traffic situation of a user according to claim 1, characterized in that: The real-time traffic module (62) and the management module (61) are interconnected, the analysis module (63) and the real-time traffic module (62) are interconnected, the alarm module (64) and the analysis module (63) are interconnected, the audit module (65) and the alarm module (64) are interconnected, the configuration module (66) and the audit module (65) are interconnected, and the export module (67) and the configuration module (66) are interconnected.

4. A system capable of accurately analyzing the real traffic situation of a user according to claim 1, characterized in that: System configuration includes distinguishing upstream and downstream configurations, time management and IP address library management; user management includes providing export functions, adding table items such as name, email, phone number and department; role management is permission management; operation auditing includes providing export functions, and the exported content specifically includes login name, source IP and operation log.

5. A system capable of accurately analyzing the real traffic situation of a user according to claim 4, characterized in that: The authorization method of permission management is implemented through roles. The authorization scope is the first-level function and the second-level sub-function. Authorization is implemented by loading the function items permitted by the role according to the user role after the user logs in.

6. A system capable of accurately analyzing the real traffic situation of users according to claim 5, characterized in that: The delay of real-time traffic and connection number is within 15 seconds.

7. A system capable of accurately analyzing the real traffic situation of a user according to claim 6, characterized in that: Business traffic includes: Statistics by source: including network type, others, and statistics by date, business group, and operator; Statistics by business traffic: Statistics are collected by established business groups, by date, and on a month-on-month basis; Business ranking: Select several business groups and rank the business traffic of the subgroups.

8. A system capable of accurately analyzing the real traffic situation of users according to claim 7, characterized in that: The audit of the audit module (65) includes requests and responses; the request original data and response original data of the corresponding content of the query server are fuzzy matched, and the export module (67) is used to export daily data as needed.

Images