A method and device for distributed network optimization anomaly detection alarm reporting

Abstract

The present invention discloses a method and device for distributed network optimization anomaly detection alarm reporting, the method comprising: through interactive signaling between a controller and a detector, the controller counts the number of detectors; the controller calculates the potential over-limit threshold of each detector based on the number of detectors and a user-configured threshold, and sends it to each detector; the detector saves the potential over-limit threshold; the detector saves traffic statistics data for a certain period, and when the calculation exceeds the potential over-limit threshold, the segment of statistics is added to the reporting queue; when the traffic statistics reporting queue on the detector reaches a certain interval or length, the statistics in the queue are reported to the controller; after receiving the traffic statistics of the detector, the controller collects periodic traffic statistics from other detectors; after receiving the traffic statistics of other detectors, the controller calculates whether the sum of the traffic reported by each detector exceeds the global threshold, and reports an alarm if it exceeds. The present invention avoids the problem of missed alarm reporting caused by the sum of multiple detectors exceeding the threshold, and can also improve the accuracy of alarm reporting.

Description

Technical Field

[0001] The present invention relates to the field of network detection, and in particular to a method and device for distributed network optimization anomaly detection alarm reporting. Background Art

[0002] like Figure 1 In the distributed network architecture of the existing technology, it is often difficult to calculate whether the sum of multiple detectors exceeds the detection threshold. It is often necessary to use FLB, namely Flow Load Balance, to balance the xFlow load to different detectors. Because the detector only has local detection data, when the cumulative sum of multiple detectors exceeds the threshold, it is impossible to determine whether an alarm needs to be triggered. The division of detection thresholds for each detector based on the number of routers to which the detector is connected or the interface bandwidth is not scientific enough and is prone to missed reports or false alarms. Reporting the full statistical data of the detector to the controller will increase the communication volume and burden between the controller and the detector. Summary of the Invention

[0003] In order to solve the problems existing in the prior art, the present invention provides a method and device for distributed network optimization anomaly detection alarm reporting, which adopts the method of conditional reporting of the Detector to the Controller, that is, when the traffic of a certain Detector exceeds the potential over-limit threshold, it actively collects traffic from other Detectors. The Controller uniformly calculates the traffic information through the number of bytes or packets in xFlow, avoiding the problem of missed alarm reporting due to the fact that a single Detector does not exceed the threshold but the sum of multiple Detectors exceeds the threshold, and at the same time can improve the accuracy of alarm reporting.

[0004] To achieve the above object, the present invention adopts the following technical solutions:

[0005] In one embodiment of the present invention, a method for distributed network optimization anomaly detection alarm reporting is proposed, the method comprising:

[0006] S01. Through the interactive signaling between the Controller and the Detector, the Controller counts the number of Detectors.

[0007] S02: The Controller calculates the potential threshold for each detector based on the number of detectors and the user-configured threshold, and sends it to each detector.

[0008] S03,Detector saves the potential threshold;

[0009] S04. The detector saves traffic statistics for a certain period. When the calculated traffic exceeds the potential crossing threshold, the statistics for that section are added to the reporting queue.

[0010] S05: When the traffic statistics reporting queue on the Detector reaches a certain interval or length, the statistics in the queue are reported to the Controller;

[0011] S06. After receiving the traffic statistics from the Detector, the Controller collects periodic traffic statistics from other Detectors.

[0012] S07. After receiving traffic statistics from other detectors, the Controller calculates whether the total traffic reported by each detector exceeds the global threshold. If so, an alarm is reported.

[0013] Furthermore, the interval or length in S05 is pre-configured by the Detector.

[0014] Furthermore, the traffic statistics in S06 are calculated by the number of bytes and the number of packets in xFlow.

[0015] In one embodiment of the present invention, a device for distributed network optimization anomaly detection alarm reporting is also proposed, the device comprising:

[0016] The Detector statistics module uses the interactive signaling between the Controller and the Detector to count the number of Detectors.

[0017] The threshold calculation module and the controller calculate the potential threshold for each detector based on the number of detectors and the user-configured threshold, and send it to each detector.

[0018] The threshold-crossing storage module and the Detector store potential threshold-crossing;

[0019] The Detector statistics module and the Detector save traffic statistics for a certain period. When the calculated traffic exceeds the potential crossing threshold, the statistics for that segment are added to the reporting queue.

[0020] The reporting module reports the statistics in the traffic statistics reporting queue on the Detector to the Controller when the interval or length reaches a certain value.

[0021] After receiving traffic statistics from the detector, the periodic collection module and the controller collect periodic traffic statistics from other detectors.

[0022] The threshold judgment module and the Controller calculate whether the total traffic reported by each detector exceeds the global threshold based on the traffic statistics received from other detectors. If so, an alarm is reported.

[0023] Furthermore, the interval or length in the reporting module is pre-configured by the Detector.

[0024] Furthermore, the traffic statistics in the periodic collection module are calculated by the number of bytes and packets in xFlow.

[0025] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the computer program, the aforementioned distributed network optimization anomaly detection alarm reporting method is implemented.

[0026] In one embodiment of the present invention, a computer-readable storage medium is further provided. The computer-readable storage medium stores a computer program for executing a method for anomaly detection and alarm reporting for distributed network optimization.

[0027] Beneficial effects:

[0028] 1. The present invention can perform accurate calculations based on the traffic statistics of each Detector, without causing missed or false alarms, and the alarm reporting is scientific and accurate;

[0029] 2. When the Detector's traffic statistics do not exceed the potential over-limit threshold, statistics reporting is not performed, which reduces the communication volume between the Detector and the Controller;

[0030] 3. Support conditional packaging and regular reporting, which can also reduce the communication volume between the Detector and the Controller and the processing pressure of the Controller. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a schematic diagram of the attack detection scheme of the prior art;

[0032] Figure 2 This is a flow chart of the method for distributed network optimization anomaly detection and alarm reporting of the present invention;

[0033] Figure 3 Schematic diagram of the method and equipment for distributed network optimization anomaly detection and alarm reporting of the present invention;

[0034] Figure 4 This is a schematic diagram of the structure of the device for distributed network optimization anomaly detection and alarm reporting of the present invention;

[0035] Figure 5 It is a schematic diagram of the structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0036] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided solely to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. Rather, these embodiments are provided to make this disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0037] Those skilled in the art will appreciate that the embodiments of the present invention may be implemented as a system, apparatus, device, method, or computer program product. Therefore, the present disclosure may be implemented in the following forms: entirely in hardware, entirely in software (including firmware, resident software, microcode, etc.), or in a combination of hardware and software.

[0038] According to an embodiment of the present invention, a method and device for distributed network optimization anomaly detection alarm reporting are proposed, which adopts a method of conditional reporting by the Detector to the Controller, that is, when the traffic of a certain Detector exceeds the potential over-limit threshold, it actively collects traffic from other Detectors. The Controller uniformly calculates the traffic information through the number of bytes or packets in xFlow, avoiding the problem of missed alarm reporting due to the fact that a single Detector does not exceed the threshold but the sum of multiple Detectors exceeds the threshold, and at the same time can improve the accuracy of alarm reporting.

[0039] The principles and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0040] like Figure 2 As shown, the method includes:

[0041] S01. Through the interactive signaling between the Controller and the Detector, the Controller counts the number of Detectors.

[0042] S02: The Controller calculates the potential threshold for each detector based on the number of detectors and the user-configured threshold, and sends it to each detector.

[0043] S03,Detector saves the potential threshold;

[0044] S04. The detector saves traffic statistics for a certain period. When the calculated traffic exceeds the potential crossing threshold, the statistics for that section are added to the reporting queue.

[0045] S05: When the traffic statistics reporting queue on the Detector reaches a certain interval or length, the statistics in the queue are reported to the Controller;

[0046] S06. After receiving the traffic statistics from the Detector, the Controller collects periodic traffic statistics from other Detectors.

[0047] S07. After receiving traffic statistics from other detectors, the Controller calculates whether the total traffic reported by each detector exceeds the global threshold. If so, an alarm is reported.

[0048] The interval or length in S05 is pre-configured by the Detector.

[0049] The traffic statistics in S06 are calculated by the number of bytes and packets in xFlow.

[0050] It should be noted that although the operations of the method of the present invention are described in a specific order in the above embodiments and drawings, this does not require or imply that these operations must be performed in this specific order, or that all illustrated operations must be performed to achieve the desired results. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0051] In order to explain the above-mentioned distributed network optimization anomaly detection alarm reporting method more clearly, a specific embodiment is used for illustration below. However, it should be noted that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.

[0052] 1. Export the required xFlow messages to the message parsing unit through the router;

[0053] According to the business scope and data range that need to be detected by the business, the xFlow messages exported by the corresponding router are imported into the message parsing unit.

[0054] 2. The message parsing unit (affiliated with the detection machine) parses and processes the xFlow object

[0055] After receiving xFlow messages from the router, the message parsing unit distributes the xFlow load to different detectors through the FLB. Each detector parses the relevant xFlow message fields, generates and stores the corresponding flow session (source / destination IP, source / destination port, protocol, etc.) and flow information (byte count, packet count, etc.) in a cache, and generates the corresponding xFlow object description information.

[0056] 3. The data calculation unit (affiliated to the detection machine) performs local traffic calculation and threshold comparison

[0057] The data calculation unit periodically evaluates the generated xFlow object description information and, based on the flow session and traffic information, calculates the rate of the corresponding session within a specified period (number of bytes or packets divided by the calculation period). After calculating the rate for this period, it determines whether it exceeds the potential over-limit threshold issued by the controller. If so, the flow is proactively reported to the controller; otherwise, the flow information for this period is stored locally (the cache period can be configured as needed).

[0058] 4. The controller summarizes and generates attack results

[0059] The controller periodically groups and aggregates the traffic information reported by each detector based on session statistics, ultimately deriving session-based traffic information. For detectors that do not actively report traffic, the controller proactively requests collection and retrieves their locally cached traffic information. The controller then groups and aggregates the requested traffic to derive the final aggregated traffic rate. The controller then determines whether the traffic rate (which can be either flow rate or packet rate) exceeds the configured global threshold. If so, it issues an attack alert.

[0060] Based on the same inventive concept, the present invention also proposes a device for distributed network optimization anomaly detection and alarm reporting. The implementation of this device can refer to the implementation of the above method, and the repeated parts will not be repeated. The term "module" used below can be a combination of software and / or hardware that implements the predetermined function. Although the device described in the following embodiments is preferably implemented in software, implementation in hardware, or a combination of software and hardware, is also possible and conceivable.

[0061] Figure 4 This is a schematic diagram of the structure of the device for distributed network optimization anomaly detection and alarm reporting of the present invention. Figure 4 As shown, the device includes:

[0062] The Detector number counting module 110 uses the interactive signaling between the Controller and the Detector to count the number of Detectors.

[0063] The threshold calculation module 120 and the controller calculate the potential threshold of each detector based on the number of detectors and the threshold configured by the user, and send it to each detector;

[0064] The threshold-crossing storage module 130 and the Detector store potential threshold-crossing values;

[0065] The Detector statistics module 140 and the Detector save traffic statistics for a certain period. When the calculation exceeds the potential crossing threshold, the statistics for that segment are added to the reporting queue;

[0066] The reporting module 150 reports the statistics in the queue to the Controller when the traffic statistics reporting queue on the Detector reaches a certain interval or length;

[0067] After receiving the traffic statistics from the Detector, the periodic collection module 160 and the Controller collect periodic traffic statistics from other Detectors;

[0068] The threshold judgment module 170 and the Controller calculate whether the total traffic reported by each detector exceeds the global threshold based on the traffic statistics received from other detectors. If so, an alarm is reported.

[0069] The interval or length in the reporting module 150 is pre-configured by the Detector.

[0070] The traffic statistics in the periodic collection module 160 are calculated by the number of bytes and packets in xFlow.

[0071] It should be noted that while the detailed description above mentions several modules of the distributed network optimization anomaly detection and alarm reporting apparatus, this division is merely exemplary and not mandatory. In practice, according to embodiments of the present invention, the features and functions of two or more modules described above may be embodied in a single module. Conversely, the features and functions of a single module described above may be further divided and embodied by multiple modules.

[0072] Based on the above invention concept, Figure 5 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220 and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, the aforementioned method for distributed network optimization anomaly detection alarm reporting is implemented.

[0073] Based on the aforementioned inventive concept, the present invention further proposes a computer-readable storage medium, which stores a computer program for executing the aforementioned distributed network optimization anomaly detection alarm reporting method.

[0074] The present invention can perform accurate calculations based on the traffic statistics of each Detector, without causing missed or false alarms, and the alarm reporting is scientific and accurate; when the traffic statistics of the Detector do not exceed the potential over-limit threshold, no statistical reporting is performed, reducing the communication volume between the Detector and the Controller; it supports conditional packaged periodic reporting, which can also reduce the communication volume between the Detector and the Controller and the processing pressure of the Controller.

[0075] Although the spirit and principles of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the specific embodiments disclosed, and the division into various aspects does not mean that the features of these aspects cannot be combined to benefit. Such division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

[0076] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0077] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0078] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0079] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0080] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0081] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship arises through computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, a server in a distributed system, or a server integrated with a blockchain.

[0082] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved. This is not a limitation herein.

[0083] The above specific embodiments do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the scope of protection of this disclosure.

[0084] Regarding the limitation of the protection scope of the present invention, those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.

Claims

1. A method for distributed network optimization anomaly detection alarm reporting, characterized in that: The method includes: S01. Through the interactive signaling between the Controller and the Detector, the Controller counts the number of Detectors. S02: The Controller calculates the potential threshold for each detector based on the number of detectors and the user-configured threshold, and sends it to each detector. S03,Detector saves the potential threshold; S04. The detector saves traffic statistics for a certain period. When the calculated traffic exceeds the potential crossing threshold, the statistics for that section are added to the reporting queue. S05: When the traffic statistics reporting queue on the Detector reaches a certain interval or length, the statistics in the queue are reported to the Controller; S06. After receiving the traffic statistics from the Detector, the Controller collects periodic traffic statistics from other Detectors. S07. After receiving traffic statistics from other detectors, the Controller calculates whether the total traffic reported by each detector exceeds the global threshold. If so, an alarm is reported.

2. The method for distributed network optimization anomaly detection and alarm reporting according to claim 1, characterized in that: The interval or length in S05 is pre-configured by the Detector.

3. The method for distributed network optimization anomaly detection and alarm reporting according to claim 1, characterized in that: The traffic statistics in S06 are calculated by the number of bytes and packets in xFlow.

4. A distributed network optimization anomaly detection alarm reporting device, characterized in that: The device includes: The Detector statistics module uses the interactive signaling between the Controller and Detectors to count the number of Detectors. In the threshold calculation module, the Controller calculates the potential threshold for each detector based on the number of detectors and the user-configured threshold, and sends it to each detector. The threshold value storage module, the Detector saves the potential threshold value; Detector statistics module: The detector saves traffic statistics for a certain period. When the calculated traffic exceeds the potential crossing threshold, the statistics for that segment are added to the reporting queue. The reporting module reports the statistics in the traffic statistics reporting queue on the Detector to the Controller when the interval or length reaches a certain value. Periodic collection module: After receiving traffic statistics from the detector, the controller collects periodic traffic statistics from other detectors. In the threshold judgment module, the Controller calculates whether the total traffic reported by each detector exceeds the global threshold based on the traffic statistics received from other detectors. If so, an alarm is reported.

5. The device for distributed network optimization anomaly detection and alarm reporting according to claim 4, characterized in that: The interval or length in the reporting module is pre-configured by the Detector.

6. The device for distributed network optimization anomaly detection and alarm reporting according to claim 4, characterized in that: The traffic statistics in the periodic collection module are calculated by the number of bytes and packets in xFlow.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 3 is implemented.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 3.

Images