Network line flow monitoring method, device, equipment, medium and program product

Abstract

The present application relates to a method, device, equipment, medium and program product for monitoring the flow of a network line, which can be used in the financial field. The method comprises: based on the date attribute of the target monitoring period, obtaining the historical flow data of the target monitoring period and the network line status when the historical flow data is formed; the aforementioned target monitoring period includes multiple target monitoring moments; according to the network line status, filtering the abnormal flow data in the historical flow data; clustering the filtered historical flow data to obtain the flow upper limit threshold and flow lower limit threshold of each target monitoring moment; based on the flow upper limit threshold and flow lower limit threshold, processing the real-time flow monitoring value of each target monitoring moment to obtain the first alarm information of each target monitoring moment; inputting the first alarm information into the alarm grading model to obtain the alarm level of the first alarm information; integrating the first alarm information and the alarm level to obtain the alarm information set of each target monitoring moment.

Description

Technical Field

[0001] The present application relates to the field of intelligent operation and maintenance technology, and in particular to a method, device, equipment, medium and program product for monitoring the flow of a network line. Background Art

[0002] Existing network line monitoring technology usually adopts the method of setting fixed upper and lower flow thresholds for each network line to achieve flow monitoring for each network line. However, when monitoring the flow of network lines based on this method, there are a large number of monitoring blind spots, and it is difficult to adapt to the objective law that the flow of network lines changes over time. Therefore, it is difficult to obtain accurate alarm information based on existing technology.

[0003] In addition, since the existing technology does not configure a corresponding alarm information filtering mechanism for monitoring moments with different monitoring requirements, this problem directly leads to the frequent sending of a large amount of unnecessary alarm information, affecting the efficiency of network operation and maintenance work. Summary of the invention

[0004] Based on this, it is necessary to provide a network line traffic monitoring method, device, equipment, medium and program product to address the above technical problems.

[0005] In a first aspect, the present application provides a method for monitoring the flow of a network line. The method comprises:

[0006] Based on the date attribute of the target monitoring period, acquiring the historical traffic data corresponding to the target monitoring period and the network line status when the historical traffic data was formed; the target monitoring period includes multiple target monitoring moments;

[0007] Filtering abnormal traffic data in the historical traffic data according to the network line status;

[0008] Performing clustering processing on the filtered historical traffic data to obtain the upper and lower traffic thresholds corresponding to each target monitoring time and the lower and upper traffic thresholds corresponding to each target monitoring time;

[0009] Based on the flow upper limit threshold and the flow lower limit threshold, processing the real-time flow monitoring value corresponding to each target monitoring moment, and obtaining the first alarm information corresponding to each target monitoring moment;

[0010] Inputting the first alarm information into an alarm rating model to obtain an alarm level corresponding to the first alarm information;

[0011] The first alarm information and the alarm level are integrated to obtain an alarm information set corresponding to each target monitoring moment.

[0012] In one embodiment, the historical traffic data and the network line status are obtained based on a preset sampling frequency; the filtered historical traffic data is clustered to obtain the upper flow threshold corresponding to each target monitoring time, and the lower flow threshold corresponding to each target monitoring time, including:

[0013] A DBSCAN clustering algorithm is used to obtain the to-be-corrected traffic data in the filtered historical traffic data; based on the first traffic standard deviation corresponding to the filtered historical traffic data and the first traffic average corresponding to the filtered historical traffic data, the to-be-corrected traffic data is reset; based on a preset weight parameter, the first traffic average, the second traffic average corresponding to the reset historical traffic data, and the discrete index value of the reset historical traffic data relative to the second traffic average, the upper traffic limit threshold corresponding to each of the target monitoring moments and the lower traffic limit threshold corresponding to each of the target monitoring moments are obtained.

[0014] In one embodiment, the flow upper limit threshold corresponding to each target monitoring moment and the flow lower limit threshold corresponding to each target monitoring moment are obtained based on the preset weight parameter, the first flow average, the second flow average corresponding to the reset historical flow data, and the discrete index value of the reset historical flow data relative to the second flow average, including:

[0015] According to the reset historical traffic data that is greater than the second traffic average, a first discrete indicator value of the reset historical traffic data relative to the second traffic average is obtained; according to the reset historical traffic data that is less than the second traffic average, a second discrete indicator value of the reset historical traffic data relative to the second traffic average is obtained; based on the preset weight parameter, the first discrete indicator value, the average value of the first discrete indicator value corresponding to each target monitoring moment and the first traffic average, the upper limit threshold of the traffic corresponding to each target monitoring moment is obtained; based on the preset weight parameter, the second discrete indicator value, the average value of the second discrete indicator value corresponding to each target monitoring moment and the second traffic average, the lower limit threshold of the traffic corresponding to each target monitoring moment is obtained.

[0016] In one of the embodiments, the method further includes: when the number of times the same alarm information appears in each of the target monitoring moments is greater than a preset alarm level adjustment threshold, adjusting the alarm level corresponding to each of the same alarm information.

[0017] In one embodiment, the first alarm information includes an alarm line logical address, an alarm line port number, an alarm device name, an alarm generation time, and an alarm content; the method further includes:

[0018] If the real-time traffic value obtained at any of the target monitoring moments is less than the traffic lower limit threshold and the current line status is abnormal, the first alarm information is shielded and a line failure alarm information is output; if the real-time traffic value obtained at any of the target monitoring moments is less than the traffic lower limit threshold and the target monitoring moment is in a non-business period, the first alarm information is shielded.

[0019] In one embodiment, filtering abnormal traffic data in the historical traffic data according to the network line status includes:

[0020] The historical traffic data generated when the network line status is abnormal is used as the abnormal traffic data, and the abnormal traffic data in the historical traffic data is filtered.

[0021] In a second aspect, the present application also provides a network line flow monitoring device. The device comprises:

[0022] A flow data acquisition module, used to acquire historical flow data corresponding to the target monitoring period and the network line status when the historical flow data is formed based on the date attribute of the target monitoring period; the target monitoring period includes multiple target monitoring moments;

[0023] An abnormal traffic filtering module, used for filtering abnormal traffic data in the historical traffic data according to the network line status;

[0024] A flow threshold acquisition module is used to perform clustering processing on the filtered historical flow data to obtain the flow upper limit threshold corresponding to each target monitoring moment and the flow lower limit threshold corresponding to each target monitoring moment;

[0025] An alarm information acquisition module, used to process the real-time flow monitoring value corresponding to each target monitoring moment based on the flow upper limit threshold and the flow lower limit threshold, and obtain the first alarm information corresponding to each target monitoring moment;

[0026] An alarm level acquisition module, used for inputting the first alarm information into an alarm rating model to obtain an alarm level corresponding to the first alarm information;

[0027] The alarm information set output module is used to integrate the first alarm information and the alarm level to obtain the alarm information set corresponding to each target monitoring moment.

[0028] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0029] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0030] In a fifth aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0031] The above-mentioned network line traffic monitoring method, device, equipment, medium and program product first obtain the historical traffic data corresponding to the target monitoring period and the network line status when the historical traffic data is formed based on the date attribute of the target monitoring period; the aforementioned target monitoring period includes multiple target monitoring moments. Then, according to the network line status, the abnormal traffic data in the historical traffic data is filtered. Next, the filtered historical traffic data is clustered to obtain the upper flow threshold corresponding to each target monitoring moment and the lower flow threshold corresponding to each target monitoring moment. After that, based on the upper flow threshold and the lower flow threshold, the real-time traffic monitoring value corresponding to each target monitoring moment is processed to obtain the first alarm information corresponding to each target monitoring moment. After that, the first alarm information is input into the alarm grading model to obtain the alarm level corresponding to the first alarm information. Finally, the first alarm information and the alarm level are integrated to obtain the alarm information set corresponding to each target monitoring moment. This application avoids the problem of frequent sending of unnecessary alarm information in the prior art by setting corresponding upper and lower limit thresholds of dynamic traffic for target monitoring time and configuring corresponding alarm information filtering mechanism. It not only improves the accuracy of alarm information of network lines, but also effectively improves the efficiency of network operation and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A diagram of an application environment of a method for monitoring network line traffic in one embodiment;

[0033] Figure 2 A schematic diagram of a flow chart of a method for monitoring network line traffic in one embodiment;

[0034] Figure 3 A flowchart of a specific method for obtaining the upper flow threshold and the lower flow threshold corresponding to each target monitoring time in one embodiment;

[0035] Figure 4 A flowchart of a specific method for obtaining the upper flow threshold and the lower flow threshold corresponding to each target monitoring time in another embodiment;

[0036] Figure 5 A flowchart of a specific method of shielding the first warning information in an embodiment;

[0037] Figure 6 It is a structural block diagram of a flow monitoring device of a network line in one embodiment;

[0038] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0040] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0041] When used herein, the singular forms "a", "an", and "said / the" may also include plural forms, unless the context clearly indicates otherwise. It should also be understood that the terms "include / comprise" or "have" and the like specify the presence of stated features, wholes, steps, operations, components, parts, or combinations thereof, but do not exclude the possibility of the presence or addition of one or more other features, wholes, steps, operations, components, parts, or combinations thereof. At the same time, the term "and / or" used in this specification includes any and all combinations of the relevant listed items.

[0042] The network line flow monitoring method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, the terminal 102 communicates with the server 104 through the network, the data storage system can store the data that the server 104 needs to process, and the data storage system can be integrated on the server 104, or placed on the cloud or other network servers; the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, and tablet computers; the server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0043] In one embodiment, Figure 2 As shown, a method for monitoring the flow of a network line is provided, and the method is applied to Figure 1 The server in the example is used to illustrate the following steps:

[0044] Step S210, based on the date attribute of the target monitoring period, obtain the historical traffic data corresponding to the target monitoring period and the network line status when the historical traffic data is formed; the aforementioned target monitoring period includes multiple target monitoring times.

[0045] In this step, the target monitoring period refers to the target monitoring period with the real-time monitoring demand of the network line traffic, and the period can be a certain day with the real-time monitoring demand of the network line traffic; the date attribute refers to the date attribute that characterizes whether the target monitoring period has the possibility of a surge in network line traffic, and the attribute can be used to characterize whether the target monitoring period is a weekday, weekend, holiday or other special date (for example, the "Double 11" Shopping Festival, the "618" Shopping Festival, the Chinese Valentine's Day, etc.); the historical traffic data corresponding to the target monitoring period refers to the historical traffic data corresponding to the target monitoring period obtained based on the date attribute of the target monitoring period, that is, based on the date attribute of the target monitoring period, the historical traffic data with the same or similar date attribute as the date attribute is obtained as the historical traffic data corresponding to the target monitoring period; the network line state when the historical traffic data is formed refers to the state of the network line when the historical traffic data corresponding to the target monitoring period is formed.

[0046] Exemplarily, assuming that based on the date attributes of the target monitoring period, the target monitoring period is a working day, for example, October 10, 2022 (working day, Monday), then the historical traffic data generated on each working Monday in the 6 months before this date (i.e., the time period with the same date attributes as the target monitoring period) can be obtained as the historical traffic data corresponding to the target monitoring period; assuming that based on the date attributes of the target monitoring period, the target monitoring period is other special dates, for example, November 11, 2022 ("Double 11" Shopping Festival), then the historical traffic data generated by the time period with similar date attributes as the "Double 11" Shopping Festival (for example, "618" Shopping Festival, Chinese Valentine's Day, etc.) in the 6 months before this date can be obtained as the historical traffic data corresponding to the target monitoring period, and the historical traffic data generated by the "Double 11" Shopping Festivals in previous years before this date (i.e., the time period with the same date attributes as the target monitoring period) can be obtained as the historical traffic data corresponding to the target monitoring period.

[0047] Furthermore, assuming that the target monitoring period is set to October 10, 2022 (working day, Monday), and in the 6 months before this date, there are 22 working day Mondays with the same date attributes as the corresponding date, then the historical traffic data generated on the 22 working day Mondays in the 6 months before this date can be obtained, and the corresponding records will be kept of the network line status when the aforementioned historical traffic data was formed.

[0048] Step S220: filtering abnormal traffic data in historical traffic data according to the network line status.

[0049] In this step, the network line state refers to the network line state when the historical traffic data is formed, that is, the state of the network line when the historical traffic data corresponding to the target monitoring period is formed; abnormal traffic data refers to the historical traffic data generated when the network line state is abnormal; the specific method of filtering the abnormal traffic data in the historical traffic data according to the network line state can be to filter the historical traffic data generated when the network line state is abnormal, so as to remove the abnormal traffic data in the historical traffic data.

[0050] In actual applications, the above-mentioned abnormal network line status may include specific situations such as ping interruption, neighbor relationship down, port down, etc., which represent the abnormal network line status.

[0051] Step S230, clustering the filtered historical traffic data to obtain the upper and lower traffic thresholds corresponding to each target monitoring moment, and the lower and upper traffic thresholds corresponding to each target monitoring moment.

[0052] In this step, the filtered historical traffic data refers to the remaining historical traffic data after removing the above-mentioned abnormal traffic data; each target monitoring moment refers to each target monitoring moment in the target monitoring period, and each target monitoring period includes multiple target monitoring moments; the upper limit traffic threshold corresponding to each target monitoring moment refers to the upper limit traffic threshold corresponding to each target monitoring moment obtained by clustering the filtered historical traffic data; the lower limit traffic threshold corresponding to each target monitoring moment refers to the lower limit traffic threshold corresponding to each target monitoring moment obtained by clustering the filtered historical traffic data.

[0053] Step S240, based on the flow upper limit threshold and the flow lower limit threshold, the real-time flow monitoring value corresponding to each target monitoring moment is processed to obtain the first alarm information corresponding to each target monitoring moment.

[0054] In this step, the upper flow threshold refers to the upper flow threshold corresponding to each target monitoring moment, that is, the upper flow threshold corresponding to each target monitoring moment is obtained by clustering the filtered historical flow data; the lower flow threshold refers to the lower flow threshold corresponding to each target monitoring moment, that is, the lower flow threshold corresponding to each target monitoring moment is obtained by clustering the filtered historical flow data; the first alarm information corresponding to each target monitoring moment refers to the first alarm information corresponding to each target monitoring moment generated when the real-time flow monitoring value corresponding to each target monitoring moment is greater than the upper flow threshold, or when the real-time flow monitoring value corresponding to each target monitoring moment is less than the lower flow threshold.

[0055] Step S250: input the first alarm information into the alarm rating model to obtain the alarm level corresponding to the first alarm information.

[0056] In this step, the first alarm information refers to the first alarm information corresponding to each target monitoring moment, which is generated when the real-time traffic monitoring value corresponding to each target monitoring moment is greater than the upper limit threshold of the traffic, or the real-time traffic monitoring value corresponding to each target monitoring moment is less than the lower limit threshold of the traffic; the alarm rating model refers to an alarm rating model used to output an alarm level representing the importance of the first alarm information, and the model can be a neural network model, which can be composed of an input layer, a linear connection layer, an activation layer, and an output layer. The training samples of the neural network model can be composed of the above-mentioned historical traffic data and the above-mentioned network line status. After the above-mentioned training sample training and parameter optimization, the neural network model can be used to predict the alarm level corresponding to the above-mentioned first alarm information (that is, as the above-mentioned alarm rating model); the alarm level corresponding to the first alarm information refers to the alarm level corresponding to the first alarm information obtained by inputting the first alarm information into the alarm rating model.

[0057] In actual applications, the above-mentioned training samples can be obtained from an automatic alarm classification knowledge base, and the aforementioned automatic alarm classification knowledge base can be an automatic alarm classification knowledge base that stores historical alarms and related event sheets; the aforementioned historical alarms and related event sheets may include network line logical addresses, network line ports, network equipment names, operator names, alarm generation time, alarm content, number of alarms, alarm levels, alarm handling opinions and other contents; the aforementioned historical alarms and related event sheets can be used as training samples for the above-mentioned alarm classification model, and the alarm level corresponding to each historical alarm can be used as a sample label.

[0058] Step S260: Integrate the first alarm information and the alarm level to obtain an alarm information set corresponding to each target monitoring moment.

[0059] In this step, the first alarm information refers to the first alarm information corresponding to each target monitoring moment, which is generated when the real-time flow monitoring value corresponding to each target monitoring moment is greater than the flow upper limit threshold, or the real-time flow monitoring value corresponding to each target monitoring moment is less than the flow lower limit threshold; the alarm level refers to the alarm level corresponding to the first alarm information, which refers to the alarm level corresponding to the first alarm information obtained by inputting the first alarm information into the alarm rating model; the alarm information set corresponding to each target monitoring moment refers to the alarm information set corresponding to each target monitoring moment obtained after integrating the first alarm information and the alarm level, in which the first alarm information and the alarm level have a one-to-one correspondence, that is, one first alarm information corresponds to a corresponding alarm level.

[0060] The above-mentioned network line traffic monitoring method, device, equipment, medium and program product first obtain the historical traffic data corresponding to the target monitoring period and the network line status when the historical traffic data is formed based on the date attribute of the target monitoring period; the aforementioned target monitoring period includes multiple target monitoring moments. Then, according to the network line status, the abnormal traffic data in the historical traffic data is filtered. Next, the filtered historical traffic data is clustered to obtain the upper flow threshold corresponding to each target monitoring moment and the lower flow threshold corresponding to each target monitoring moment. After that, based on the upper flow threshold and the lower flow threshold, the real-time traffic monitoring value corresponding to each target monitoring moment is processed to obtain the first alarm information corresponding to each target monitoring moment. After that, the first alarm information is input into the alarm grading model to obtain the alarm level corresponding to the first alarm information. Finally, the first alarm information and the alarm level are integrated to obtain the alarm information set corresponding to each target monitoring moment. This application avoids the problem of frequent sending of unnecessary alarm information in the prior art by setting corresponding upper and lower limit thresholds of dynamic traffic for target monitoring time and configuring corresponding alarm information filtering mechanism. It not only improves the accuracy of alarm information of network lines, but also effectively improves the efficiency of network operation and maintenance.

[0061] Regarding the specific method of obtaining the upper flow threshold and the lower flow threshold corresponding to each target monitoring time, in one embodiment, the above historical flow data and the above network line status are obtained based on a preset sampling frequency; Figure 3 As shown, the above step S230 specifically includes:

[0062] Step S310: using the DBSCAN clustering algorithm to obtain the flow data to be corrected in the filtered historical flow data.

[0063] In this step, the DBSCAN clustering algorithm is a spatial clustering algorithm based on data density and robust to noise. By setting the parameters of the domain radius (R) and the minimum number of points (MinPoints), abnormal sample individuals can be detected from the data sample cluster; the flow data to be corrected, that is, the flow data to be corrected in the filtered historical flow data, refers to the use of the DBSCAN clustering algorithm to obtain each historical flow data sample individual that represents the abnormal historical flow value in the filtered historical flow data.

[0064] Exemplarily, the minimum number of points (MinPoints) can be set to 80% of the total number of individuals in the filtered historical traffic data; the parameter domain radius (R) can be obtained by using the following expression:

[0065]

[0066] Among them, σ is the standard deviation of each historical flow value in the filtered historical flow data, μ 1 It is the average of each historical flow value in the filtered historical flow data.

[0067] In practical applications, the preset sampling frequency for obtaining the historical traffic data and network line status can be 30 seconds (i.e., 30 seconds is used as the time period for one data sampling). On this basis, the historical traffic data can be obtained by deploying a collection script on the server (the aforementioned collection script can be a script written in Python) with 30 seconds as the time period for one data sampling to obtain the accumulated traffic value; the accumulated traffic value can be obtained by monitoring the port traffic values ​​in the outbound and inbound directions of the network line based on the SNMP protocol (for example, MIB value: 1.3.6.1.2.1.31.1.1.1.6); the network line status can be obtained by deploying a detection script on the server (the aforementioned detection script can be a script written in Python) ) method, with 30 seconds as the time period for a data sampling, to obtain the network line status, the aforementioned network line status may include specific situations such as normal network line status, network line delay, ping interruption, packet loss, neighbor relationship down, port down, monitoring not enabled, monitoring enabled, monitoring failure, etc.; after obtaining the historical traffic data and the network line status based on the above preset sampling frequency, a corresponding relationship between the historical traffic value and the network line status at each time point can be established according to the historical traffic data and the correlation relationship between the network line status at the time point when the historical traffic data was formed. After the aforementioned corresponding relationship is established, the aforementioned historical traffic data and the network line status when the historical traffic data was formed can be stored in a data storage device based on ElasticSearch for preservation.

[0068] Furthermore, the real-time flow value at the current collection moment can be obtained by dividing the difference between the cumulative flow value obtained at the current collection moment and the cumulative flow value obtained at the previous collection moment by the time interval between the two collection moments to obtain the real-time flow value at the current collection moment; for example, assuming that the cumulative flow value corresponding to the current collection moment on the outbound port of a certain network line is 2234 bits, the cumulative flow value corresponding to the previous collection moment is 1934 bits, and the time interval between the two collection moments is 30 seconds, then the real-time flow value in the outbound direction of the line is (2234-1934) / 30=10 bits / second.

[0069] Step S320: reset the flow data to be corrected based on the first flow standard deviation corresponding to the filtered historical flow data and the first flow average corresponding to the filtered historical flow data.

[0070] In this step, the flow data to be corrected, that is, the flow data to be corrected in the filtered historical flow data, refers to the use of the DBSCAN clustering algorithm to obtain each historical flow data individual that represents the abnormal historical flow value in the filtered historical flow data; based on the first flow standard deviation corresponding to the filtered historical flow data and the first flow average corresponding to the filtered historical flow data, the specific method of resetting the flow data to be corrected can be to use the sum of the first flow standard deviation corresponding to the filtered historical flow data and the first flow average corresponding to the filtered historical flow data to reset the flow data to be corrected in the filtered historical flow data.

[0071] In practical applications, the first flow standard deviation corresponding to the filtered historical flow data can be σ in the expression of the parameter domain radius (R) (i.e., the standard deviation of each historical flow value in the filtered historical flow data); the first flow average corresponding to the filtered historical flow data can be μ in the expression of the parameter domain radius (R). 1 (i.e., the average of each historical flow value in the filtered historical flow data); on this basis, the above-mentioned flow data to be corrected can be reset to μ 1 The flow data to be corrected in the filtered historical flow data is reset in a ±σ manner.

[0072] Step S330, based on the preset weight parameters, the first flow average, the second flow average corresponding to the reset historical flow data, and the discrete index value of the reset historical flow data relative to the second flow average, obtain the flow upper limit threshold corresponding to each target monitoring moment and the flow lower limit threshold corresponding to each target monitoring moment.

[0073] In this step, the first flow average refers to the first flow average corresponding to the filtered historical flow data; the flow upper limit threshold corresponding to each target monitoring moment refers to the flow upper limit threshold corresponding to each target monitoring moment obtained based on the preset weight parameter, the first flow average, the second flow average corresponding to the reset historical flow data, and the discrete index value of the reset historical flow data relative to the second flow average; the flow lower limit threshold corresponding to each target monitoring moment refers to the flow lower limit threshold corresponding to each target monitoring moment obtained based on the preset weight parameter, the first flow average, the second flow average corresponding to the reset historical flow data, and the discrete index value of the reset historical flow data relative to the second flow average.

[0074] The above embodiment effectively improves the accuracy of the alarm information of the network line by determining the upper and lower flow thresholds corresponding to each target monitoring time based on the preset weight parameter, the first flow average, the second flow average corresponding to the reset historical flow data, and the discrete index value of the reset historical flow data relative to the second flow average.

[0075] Regarding the specific method of obtaining the flow upper limit threshold and flow lower limit threshold corresponding to each target monitoring time, in one embodiment, as Figure 4 As shown, the above step S330 specifically includes:

[0076] Step S410: obtaining a first discrete indicator value of the reset historical traffic data relative to the second traffic average according to the reset historical traffic data that is greater than the second traffic average.

[0077] In this step, the second flow average refers to the second flow average corresponding to the reset historical flow data; the reset historical flow data greater than the second flow average refers to the actual historical flow value greater than the second flow average in the reset historical flow data; the first discrete indicator value refers to the first discrete indicator value of the reset historical flow data greater than the second flow average relative to the second flow average.

[0078] In practical applications, the above first discrete index value can be calculated using the following expression:

[0079]

[0080] Among them, σ h is the first discrete index value; x h is any actual historical flow value greater than the second flow average in the historical flow data after reset; n h is the total number of actual historical flow values ​​greater than the second flow average in the historical flow data after reset; it should be noted that when n h = 0, σ h =0.

[0081] Step S420: obtaining a second discrete indicator value of the reset historical traffic data relative to the second traffic average according to the reset historical traffic data that is less than the second traffic average.

[0082] In this step, the second flow average refers to the second flow average corresponding to the reset historical flow data; the reset historical flow data that is less than the second flow average refers to the actual historical flow value in the reset historical flow data that is less than the second flow average; the second discrete indicator value refers to the second discrete indicator value of the reset historical flow data that is less than the second flow average relative to the second flow average.

[0083] In practical applications, the second discrete index value can be calculated using the following expression:

[0084]

[0085] Among them, σ l is the second discrete index value; x l Any actual historical flow value that is less than the second flow average in the historical flow data after reset; n l The total number of actual historical flow values ​​that are less than the second flow average in the reset historical flow data.

[0086] Step S430, based on the preset weight parameter, the first discrete indicator value, the average value of the first discrete indicator value corresponding to each target monitoring moment and the first flow average, obtain the flow upper limit threshold corresponding to each target monitoring moment.

[0087] In this step, the number of preset weight parameters corresponds to the number of first discrete indicator values ​​and the average values ​​of the first discrete indicator values ​​corresponding to each target monitoring moment, that is, the first discrete indicator value and the average value of the first discrete indicator value respectively correspond to a preset weight parameter; the first discrete indicator value refers to the reset historical traffic data that is greater than the second traffic average, relative to the first discrete indicator value of the second traffic average; the first traffic average refers to the first traffic average corresponding to the filtered historical traffic data.

[0088] In practical applications, the upper flow threshold corresponding to each target monitoring time can be calculated using the following expression:

[0089]

[0090] Among them, μ in is the upper flow threshold corresponding to each target monitoring moment; μ 1 is the first flow average; 1 and λ 2 is the preset weight parameter, which can be set based on actual needs; h is the first discrete index value; It is the average value of the first discrete indicator value corresponding to each target monitoring moment.

[0091] Step S440, based on the preset weight parameter, the second discrete indicator value, the average value of the second discrete indicator value corresponding to each target monitoring moment and the second flow average, obtain the flow lower limit threshold corresponding to each target monitoring moment.

[0092] In this step, the number of preset weight parameters corresponds to the second discrete indicator value and the average value of the second discrete indicator value corresponding to each target monitoring moment, that is, the second discrete indicator value and the average value of the second discrete indicator value respectively correspond to a preset weight parameter; the second discrete indicator value refers to the second discrete indicator value of the reset historical flow data that is less than the second flow average relative to the second flow average; the second flow average refers to the second flow average corresponding to the reset historical flow data.

[0093] In practical applications, the lower flow threshold corresponding to each target monitoring time can be calculated using the following expression:

[0094]

[0095] Among them, μ out is the lower flow threshold corresponding to each target monitoring moment; μ 2 is the second flow average; 1 and λ 2 is the preset weight parameter, which can be set based on actual needs; l is the second discrete index value; is the average value of the second discrete indicator value corresponding to each target monitoring moment.

[0096] The above embodiment effectively improves the robustness of the dynamic threshold against abnormal noise points by determining the upper and lower limit thresholds of the traffic flow corresponding to each target monitoring moment based on the individual fluctuations and common fluctuations of the historical traffic data corresponding to each target monitoring moment, thereby ensuring the accuracy of the alarm information of the network line obtained based on the dynamic threshold.

[0097] Regarding the specific manner of adjusting the alarm level corresponding to each identical alarm information, in one embodiment, the above method further includes:

[0098] When the number of times the same alarm information appears at each target monitoring moment is greater than a preset alarm level adjustment threshold, the alarm level corresponding to each same alarm information is adjusted.

[0099] Among them, the same alarm information refers to the alarm information with the same content generated at each target monitoring moment because the real-time traffic value is greater than the above-mentioned upper traffic threshold or less than the above-mentioned lower traffic threshold; the specific method of adjusting the alarm level corresponding to each identical alarm information may be to increase the alarm level corresponding to each identical alarm information, so that each identical alarm information has a higher processing priority.

[0100] In actual applications, assuming that the total number of target monitoring moments is 10, the granularity of each target monitoring moment is 30 seconds, the preset alarm level adjustment threshold is 6 times, and the alarm level obtained by inputting the same alarm information into the above alarm classification model is 7 (non-concern alarm), then within five consecutive minutes (that is, ten consecutive target monitoring moments), the same alarm information appears a total of 7 times, the alarm level corresponding to each identical alarm information can be adjusted to 6 (alarm requiring attention).

[0101] The above-mentioned embodiment ensures the data accuracy of the alarm level corresponding to the alarm information by adjusting the alarm level corresponding to each identical alarm information when the number of times the same alarm information appears at each target monitoring moment is greater than the preset alarm level adjustment threshold, thereby effectively improving the efficiency of network operation and maintenance.

[0102] Regarding the specific method of shielding the first alarm information, in one embodiment, the first alarm information includes the alarm line logical address, the alarm line port number, the alarm device name, the alarm generation time and the alarm content; Figure 5 As shown, the above method also includes:

[0103] Step S510: When the real-time flow value obtained at any target monitoring time is less than the flow lower limit threshold and the current line state is abnormal, the first alarm information is shielded and the line fault alarm information is output.

[0104] In this step, the current line status is abnormal, which may include specific situations such as ping interruption, packet loss, neighbor relationship down, port down, etc. that characterize the abnormal network line status; the line fault alarm information may be line fault alarm information used to remind network operation and maintenance personnel to perform corresponding maintenance on the network line in a timely manner.

[0105] In actual applications, when obtaining the real-time flow value at any target monitoring moment, if it is impossible to synchronously obtain the network line status when the real-time flow value is formed, corresponding content can be added to the alarm information corresponding to the real-time flow value to remind the operation and maintenance personnel to check and protect the line.

[0106] Step S520: When the real-time traffic value obtained at any target monitoring time is less than the lower traffic threshold and the target monitoring time is in a non-business period, the first alarm information is shielded.

[0107] In this step, the non-business period refers to a monitoring period when the network line has little or no access. The real-time traffic value obtained during this period is often less than the lower traffic threshold. However, in this case, the alarm information indicating that the real-time traffic value is less than the lower traffic threshold has little practical significance for the operation and maintenance of the network line. Therefore, in order to improve the efficiency of network operation and maintenance, when the real-time traffic value obtained at any target monitoring time is less than the lower traffic threshold and the target monitoring time is in a non-business period, the first alarm information generated in this case can be shielded.

[0108] In actual applications, the business time period information corresponding to the network lines of the WAN is usually maintained by the WAN line rule library, while the network lines that are not included in the WAN line rule library for management can be set through the default non-business time period. For example, if the default non-business time period is set to 07:00-22:00, the non-business time period corresponding to the network lines that are not included in the WAN line rule library for management is 07:00-22:00.

[0109] The above embodiment effectively improves the efficiency of network operation and maintenance work by shielding unnecessary first alarm information based on the network line status at the real-time traffic value obtained at the target monitoring time and the time period to which the target monitoring time belongs.

[0110] Regarding the specific method of filtering abnormal traffic data in historical traffic data, in one embodiment, the above step S220 specifically includes:

[0111] The historical traffic data generated when the network line status is abnormal is used as abnormal traffic data, and the abnormal traffic data in the historical traffic data is filtered.

[0112] Among them, the abnormal network line status may include specific situations such as ping interruption, neighbor relationship down, port down, etc. that characterize the abnormal network line status; the historical traffic data formed when the network line status is abnormal may include historical traffic data formed when the network line status is abnormal, such as ping interruption, neighbor relationship down, port down, etc.; abnormal traffic data refers to historical traffic data formed when the network line status is abnormal; filtering abnormal traffic data in historical traffic data refers to removing the historical traffic data (i.e. the above-mentioned abnormal traffic data) formed when the network line status is abnormal in the historical traffic data.

[0113] The above-mentioned embodiment improves the data accuracy of the historical traffic data corresponding to the target monitoring period by filtering the historical traffic data generated when the network line status is abnormal in the historical traffic data corresponding to the target monitoring period, thereby effectively ensuring the accuracy of the alarm information obtained based on the dynamic traffic upper and lower limit thresholds.

[0114] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0115] Based on the same inventive concept, the embodiment of the present application also provides a network line flow monitoring device for implementing the network line flow monitoring method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of one or more network line flow monitoring devices provided below can refer to the limitations of the network line flow monitoring method above, and will not be repeated here.

[0116] In one embodiment, Figure 6 As shown, a network line flow monitoring device is provided, and the device 600 includes:

[0117] The flow data acquisition module 610 is used to acquire the historical flow data corresponding to the target monitoring period and the network line status when the historical flow data is formed based on the date attribute of the target monitoring period; the target monitoring period includes multiple target monitoring times;

[0118] The abnormal traffic filtering module 620 is used to filter the abnormal traffic data in the historical traffic data according to the network line status;

[0119] The flow threshold acquisition module 630 is used to perform clustering processing on the filtered historical flow data to obtain the flow upper limit threshold corresponding to each target monitoring time and the flow lower limit threshold corresponding to each target monitoring time;

[0120] The alarm information acquisition module 640 is used to process the real-time flow monitoring value corresponding to each target monitoring moment based on the flow upper limit threshold and the flow lower limit threshold to obtain the first alarm information corresponding to each target monitoring moment;

[0121] An alarm level acquisition module 650 is used to input the first alarm information into an alarm rating model to obtain an alarm level corresponding to the first alarm information;

[0122] The alarm information set output module 660 is used to integrate the first alarm information and the alarm level to obtain the alarm information set corresponding to each target monitoring moment.

[0123] In one embodiment, the historical traffic data and network line status are acquired based on a preset sampling frequency; the traffic threshold acquisition module 630 is specifically used to adopt the DBSCAN clustering algorithm to acquire the traffic data to be corrected in the filtered historical traffic data; based on the first traffic standard deviation corresponding to the filtered historical traffic data and the first traffic average corresponding to the filtered historical traffic data, the traffic data to be corrected is reset; based on the preset weight parameter, the first traffic average, the second traffic average corresponding to the reset historical traffic data, and the discrete index value of the reset historical traffic data relative to the second traffic average, the upper limit traffic threshold corresponding to each target monitoring moment and the lower limit traffic threshold corresponding to each target monitoring moment are obtained.

[0124] In one embodiment, the traffic threshold acquisition module 630 is also used to obtain a first discrete indicator value of the reset historical traffic data relative to the second traffic average based on the reset historical traffic data that is greater than the second traffic average; to obtain a second discrete indicator value of the reset historical traffic data relative to the second traffic average based on the reset historical traffic data that is less than the second traffic average; to obtain an upper traffic limit threshold corresponding to each target monitoring moment based on a preset weight parameter, the first discrete indicator value, the average value of the first discrete indicator value corresponding to each target monitoring moment, and the first traffic average; to obtain a lower traffic limit threshold corresponding to each target monitoring moment based on a preset weight parameter, the second discrete indicator value, the average value of the second discrete indicator value corresponding to each target monitoring moment, and the second traffic average.

[0125] In one of the embodiments, the above-mentioned device also includes: an alarm level adjustment module, which is used to adjust the alarm level corresponding to each of the same alarm information when the number of times the same alarm information appears in each of the target monitoring moments is greater than a preset alarm level adjustment threshold.

[0126] In one of the embodiments, the first alarm information includes the alarm line logical address, the alarm line port number, the alarm device name, the alarm generation time and the alarm content; the above-mentioned device also includes: a non-essential alarm information shielding module, which is used to shield the first alarm information and output the line fault alarm information when the real-time flow value obtained at any of the target monitoring moments is less than the flow lower limit threshold and the current line state is abnormal; the first alarm information is shielded when the real-time flow value obtained at any of the target monitoring moments is less than the flow lower limit threshold and the target monitoring moment is in a non-business period.

[0127] In one embodiment, the abnormal traffic filtering module 620 is specifically used to use the historical traffic data generated when the network line status is abnormal as the abnormal traffic data, and filter the abnormal traffic data in the historical traffic data.

[0128] Each module in the above-mentioned network line flow monitoring device can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0129] It should be noted that the network line traffic monitoring method and device of the present application can be used for network line traffic monitoring in the financial field, and can also be used in any field other than the financial field. The application field of the network line traffic monitoring method and device of the present application is not limited.

[0130] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as data related to traffic monitoring of network lines. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for monitoring the traffic of a network line is implemented.

[0131] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0132] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above-mentioned method embodiments when executing the computer program.

[0133] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned method embodiments are implemented.

[0134] In one embodiment, a computer program product is provided, including a computer program, which implements the steps of the above method embodiments when executed by a processor.

[0135] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0136] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0137] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0138] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for monitoring the flow of a network line, characterized in that: The method comprises: Based on the date attribute of the target monitoring period, acquiring the historical traffic data corresponding to the target monitoring period and the network line status when the historical traffic data was formed; the target monitoring period includes multiple target monitoring moments; According to the network line state, filtering abnormal traffic data in the historical traffic data includes: using the historical traffic data formed when the network line state is abnormal as the abnormal traffic data, and filtering the abnormal traffic data in the historical traffic data; Performing clustering processing on the filtered historical traffic data to obtain the upper and lower traffic thresholds corresponding to each target monitoring time and the lower and upper traffic thresholds corresponding to each target monitoring time; Based on the flow upper limit threshold and the flow lower limit threshold, processing the real-time flow monitoring value corresponding to each target monitoring moment, and obtaining the first alarm information corresponding to each target monitoring moment; When the real-time flow monitoring value obtained at any of the target monitoring moments is less than the flow lower limit threshold and the current line state is abnormal, shielding the first alarm information and outputting line fault alarm information; When the real-time traffic monitoring value obtained at any of the target monitoring moments is less than the lower traffic threshold and the target monitoring moment is in a non-business period, shielding the first alarm information; Inputting the first alarm information into an alarm rating model to obtain an alarm level corresponding to the first alarm information; The first alarm information and the alarm level are integrated to obtain an alarm information set corresponding to each target monitoring moment.

2. The method according to claim 1, characterized in that The historical traffic data and the network line status are obtained based on a preset sampling frequency; The clustering process is performed on the filtered historical traffic data to obtain the upper flow threshold corresponding to each target monitoring time and the lower flow threshold corresponding to each target monitoring time, including: The DBSCAN clustering algorithm is used to obtain the flow data to be corrected in the filtered historical flow data; Resetting the to-be-corrected flow data based on a first flow standard deviation corresponding to the filtered historical flow data and a first flow average corresponding to the filtered historical flow data; Based on the preset weight parameters, the first traffic average, the second traffic average corresponding to the reset historical traffic data, and the discrete index value of the reset historical traffic data relative to the second traffic average, the upper traffic limit threshold corresponding to each target monitoring moment and the lower traffic limit threshold corresponding to each target monitoring moment are obtained.

3. The method according to claim 2, characterized in that The method of obtaining the flow upper limit threshold corresponding to each target monitoring moment and the flow lower limit threshold corresponding to each target monitoring moment based on the preset weight parameter, the first flow average, the second flow average corresponding to the reset historical flow data, and the discrete index value of the reset historical flow data relative to the second flow average includes: According to the reset historical traffic data greater than the second traffic average, a first discrete indicator value of the reset historical traffic data relative to the second traffic average is obtained; According to the reset historical traffic data which is smaller than the second traffic average, a second discrete indicator value of the reset historical traffic data relative to the second traffic average is obtained; Based on the preset weight parameter, the first discrete indicator value, the average value of the first discrete indicator value corresponding to each target monitoring moment, and the first flow average, the flow upper limit threshold value corresponding to each target monitoring moment is obtained; Based on the preset weight parameter, the second discrete indicator value, the average value of the second discrete indicator value corresponding to each target monitoring moment and the second flow average, the flow lower limit threshold corresponding to each target monitoring moment is obtained.

4. The method according to claim 1, characterized in that The method further comprises: When the number of times the same alarm information appears in each of the target monitoring moments is greater than a preset alarm level adjustment threshold, the alarm level corresponding to each of the same alarm information is adjusted.

5. The method according to claim 1, characterized in that The first alarm information includes the alarm line logical address, the alarm line port number, the alarm device name, the alarm generation time and the alarm content.

6. A network line flow monitoring device, characterized in that: The device comprises: A flow data acquisition module, used to acquire historical flow data corresponding to the target monitoring period and the network line status when the historical flow data is formed based on the date attribute of the target monitoring period; the target monitoring period includes multiple target monitoring moments; An abnormal traffic filtering module is used to filter abnormal traffic data in the historical traffic data according to the network line state, including: using the historical traffic data formed when the network line state is abnormal as the abnormal traffic data, and filtering the abnormal traffic data in the historical traffic data; A flow threshold acquisition module is used to perform clustering processing on the filtered historical flow data to obtain the flow upper limit threshold corresponding to each target monitoring moment and the flow lower limit threshold corresponding to each target monitoring moment; An alarm information acquisition module, used to process the real-time flow monitoring value corresponding to each target monitoring moment based on the flow upper limit threshold and the flow lower limit threshold, and obtain the first alarm information corresponding to each target monitoring moment; A non-essential alarm information shielding module, used for shielding the first alarm information and outputting line fault alarm information when the real-time traffic monitoring value obtained at any of the target monitoring moments is less than the traffic lower limit threshold and the current line state is abnormal; shielding the first alarm information when the real-time traffic monitoring value obtained at any of the target monitoring moments is less than the traffic lower limit threshold and the target monitoring moment is in a non-business period; An alarm level acquisition module, used for inputting the first alarm information into an alarm rating model to obtain an alarm level corresponding to the first alarm information; The alarm information set output module is used to integrate the first alarm information and the alarm level to obtain the alarm information set corresponding to each target monitoring moment.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images