Network anomaly monitoring method and apparatus

Abstract

The application discloses a network anomaly monitoring method and device. The method comprises the following steps: sending first monitoring index data of a network device to a management server, and when the sending fails, attempting to retransmit the first monitoring index data to the management server according to a preset retransmission time interval and a retransmission number threshold; when the retransmission number reaches the retransmission number threshold and the retransmission is still unsuccessful, calculating the similarity between the first monitoring index data and historical monitoring index data when the last network anomaly occurs between the network device and the management server; when the similarity is greater than a preset threshold, collecting first network state information in a networking area where the network device is located, and analyzing the first network state information according to a preset network anomaly prediction model to determine whether a network anomaly occurs in the networking area where the network device is located. The application solves the technical problems that data cannot be normally reported and the abnormal reason cannot be analyzed when a network anomaly occurs between a network device and a network server in the related art.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a method and apparatus for network anomaly monitoring. Background Technology

[0002] As digitalization deepens, the number of operational devices within enterprises or organizations is gradually increasing. Although maintenance equipment has evolved from manual maintenance to tool-based and platform-based maintenance, it still cannot meet the requirements of large-scale networks for maintenance and monitoring. This leads to numerous problems in data collection and storage when network anomalies occur between the management server and the managed devices.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This application provides a network anomaly monitoring method and apparatus to at least solve the technical problem in the related art that data cannot be reported normally and the cause of the anomaly cannot be analyzed when there is a network anomaly between network devices and network servers.

[0005] According to one aspect of the embodiments of this application, a network anomaly monitoring method is provided, comprising: sending first monitoring indicator data of a network device to a management server, and, if the sending fails, attempting to retransmit the first monitoring indicator data to the management server according to a preset retransmission time interval and a retransmission count threshold; when the retransmission count reaches the retransmission count threshold and still fails to retransmit successfully, calculating the similarity between the first monitoring indicator data and second monitoring indicator data, wherein the second monitoring indicator data is historical monitoring indicator data of the last time a network anomaly occurred between the network device and the management server; when the similarity is greater than the preset threshold, collecting first network status information within the network area where the network device is located, and analyzing the first network status information according to a preset network anomaly prediction model to determine whether a network anomaly has occurred within the network area where the network device is located.

[0006] Optionally, sending the first monitoring indicator data of the network device to the management server includes: sending the first monitoring indicator data of the network device to the management server according to the TR069 protocol, wherein the network device responds to the data monitoring request sent by the management server and sends the first monitoring indicator data to the management server, and the management server is used to perform management operations on the network device based on the first monitoring indicator data.

[0007] Optionally, before sending the first monitoring indicator data of the network device to the management server, the method further includes: the management server authenticating the communication configuration of the network device.

[0008] Optionally, calculating the similarity between the first monitoring indicator data and the second monitoring indicator data includes: determining a first set of keywords in the first monitoring indicator data and determining a second set of keywords in the second monitoring indicator data; calculating the Jaccard coefficient between the first set of keywords and the second set of keywords, and using the Jaccard coefficient as the similarity between the first monitoring indicator data and the second monitoring indicator data.

[0009] Optionally, if the similarity is greater than a preset threshold, it is determined that a network anomaly has occurred between the network device and the management server; if the similarity is not greater than the preset threshold, it is determined that network jitter has occurred between the network device and the management server, or that there is a false alarm of data transmission failure.

[0010] Optionally, collecting the first network status information within the network area where the network device is located includes: periodically collecting the first network status information within the network area where the network device is located based on the retransmission time interval.

[0011] Optionally, the network anomaly prediction model is constructed based on the Markov state transition matrix and is used to predict the target network state at the next moment based on the first network state information at the current moment and the historical network state information at the previous moment, so as to determine whether a network anomaly has occurred in the network area where the network device is located.

[0012] According to another aspect of the embodiments of this application, a network anomaly monitoring device is also provided, comprising: a sending module, configured to send first monitoring indicator data of a network device to a management server, and, when sending fails, attempt to retransmit the first monitoring indicator data to the management server according to a preset retransmission time interval and a retransmission count threshold; a calculation module, configured to calculate the similarity between the first monitoring indicator data and second monitoring indicator data when the retransmission count reaches the retransmission count threshold and retransmission is still unsuccessful, wherein the second monitoring indicator data is historical monitoring indicator data of the last time a network anomaly occurred between the network device and the management server; and a determination module, configured to collect first network status information within the network area where the network device is located when the similarity is greater than the preset threshold, and analyze the first network status information according to a preset network anomaly prediction model to determine whether a network anomaly has occurred within the network area where the network device is located.

[0013] According to another aspect of the embodiments of this application, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored program, wherein the device where the non-volatile storage medium is located executes the above-described network anomaly monitoring method by running the program.

[0014] According to another aspect of the embodiments of this application, an electronic device is also provided, the electronic device including: a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-described network anomaly monitoring method through the computer program.

[0015] In this embodiment, the first monitoring indicator data of the network device is sent to the management server. If the transmission fails, the first monitoring indicator data is retransmitted to the management server according to a preset retransmission time interval and a retransmission number threshold. If the retransmission number reaches the retransmission number threshold and still fails to retransmit successfully, the similarity between the first monitoring indicator data and the second monitoring indicator data is calculated. The second monitoring indicator data is the historical monitoring indicator data of the last time a network anomaly occurred between the network device and the management server. If the similarity is greater than the preset threshold, the first network status information in the network area where the network device is located is collected. The first network status information is analyzed according to a preset network anomaly prediction model to determine whether a network anomaly has occurred in the network area where the network device is located. Specifically, when the user-side network device is unable to send the first monitoring indicator data to the management server, a corresponding network anomaly retransmission mechanism can be set up to complete the transmission of the first monitoring indicator data. In addition, when a network anomaly occurs between the network device and the management server, and retransmission still fails even after the retransmission count reaches the retransmission threshold, a preset network anomaly prediction model can continuously collect and analyze the first network status information to accurately determine whether a network anomaly has occurred in the network area where the network device is located. This resolves the mechanism defect that prevents analysis of the cause of network anomalies after the network anomaly between the network device and the management server is restored, and thus solves the technical problem in related technologies where data cannot be reported normally and the cause of the anomaly cannot be analyzed when there is a network anomaly between the network device and the network server. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0017] Figure 1 This is a flowchart of an optional network anomaly monitoring method according to an embodiment of this application;

[0018] Figure 2 This is a schematic diagram of an optional network anomaly monitoring device according to an embodiment of this application. Detailed Implementation

[0019] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0020] It should be noted that the terms "first," "second," etc., used in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0021] To better understand the embodiments of this application, the following is a translation and explanation of some nouns or terms that appear in the description of the embodiments of this application:

[0022] The TR069 (Technical Report 069) protocol defines a completely new network management architecture, including a management model, interaction interface, and basic management parameters, enabling effective management of home network devices. In the TR069 protocol, the management server is called the ACS (Auto Configuration Server), which has a dedicated IP address and URL. Managed devices obtain the ACS URL through a DHCP server, and after obtaining the network management IP address, the managed device can establish an HTTP session based on the ACS URL. Furthermore, initialization is required after session establishment for authentication, ensuring the legitimacy of the managed device. After initialization, the management server can obtain various monitoring information from the network devices.

[0023] Example 1

[0024] According to an embodiment of this application, a network anomaly monitoring method applied in a network device is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0025] Figure 1 This is a flowchart of an optional network anomaly monitoring method according to an embodiment of this application, such as... Figure 1 As shown, the method includes at least steps S102-S106, wherein:

[0026] Step S102: Send the first monitoring indicator data of the network device to the management server, and if the sending fails, attempt to retransmit the first monitoring indicator data to the management server according to the preset retransmission time interval and retransmission number threshold.

[0027] In the technical solution provided in step S102 of the present invention, in the current data center operation and maintenance scenario, due to the large scale of business and complex application relationships, the first monitoring indicator data of the user-side network equipment (Customer Premise Equipment, CPE) can be sent to the management server (Auto-Configuration Server, ACS). When there is a network anomaly between the user-side network equipment and the management server, a network anomaly retransmission mechanism can be set to retransmit the first monitoring indicator data to the management server. Specifically, the program on the CPE can automatically send and search for the RetryCount (retransmission count) in the RPC (Remote Procedure Call Protocol) and set it. The retransmission threshold can be set to 5. At the same time, another parameter of the RPC, post-rebootsession retry count (retransmission interval), can be set. In this embodiment, the retransmission interval can be set to 5 seconds.

[0028] It should be noted that the retransmission time interval and retransmission number threshold can be set according to the actual situation. This is only an example and no specific restrictions are imposed.

[0029] Step S104: When the number of retransmissions reaches the retransmission threshold and the retransmission is still unsuccessful, calculate the similarity between the first monitoring indicator data and the second monitoring indicator data, wherein the second monitoring indicator data is the historical monitoring indicator data of the last time a network anomaly occurred between the network device and the management server.

[0030] In the technical solution provided by step S104 of the present invention, when a network anomaly occurs between the management server and the network device, and when the number of retransmissions of the first monitoring indicator data reaches the retransmission threshold and still fails to retransmit successfully, the similarity between the historical monitoring indicator data and the first monitoring indicator data at the last time a network anomaly occurred between the network device and the management server can be compared, thereby determining and analyzing the cause of the network anomaly between the management server and the network device based on the similarity.

[0031] Step S106: When the similarity is greater than a preset threshold, collect the first network status information in the network area where the network device is located, and analyze the first network status information according to the preset network anomaly prediction model to determine whether a network anomaly has occurred in the network area where the network device is located.

[0032] In the technical solution provided by step S106 of the present invention, when the number of retransmissions of the first monitoring indicator data reaches the retransmission threshold and still fails to retransmit successfully, it is impossible to directly determine whether the network in the network area where the network device is located is a real anomaly or a regional network anomaly caused by the abnormal connection between the edge network node and the network in the network area. Therefore, the first network status information in the network area where the network device is located will be collected, and the first network status information will be continuously collected and analyzed by the network anomaly prediction model deployed on the network device, so as to accurately predict whether a network anomaly has occurred in the network area where the network device is located.

[0033] In the technical solution provided in steps S102-S106 of this application, the first monitoring indicator data of the network device is sent to the management server. If the sending fails, the first monitoring indicator data is retransmitted to the management server according to the preset retransmission time interval and retransmission number threshold. If the retransmission number reaches the retransmission number threshold and still fails to retransmit successfully, the similarity between the first monitoring indicator data and the second monitoring indicator data is calculated. The second monitoring indicator data is the historical monitoring indicator data of the last time a network anomaly occurred between the network device and the management server. If the similarity is greater than the preset threshold, the first network status information in the network area where the network device is located is collected. The first network status information is analyzed according to the preset network anomaly prediction model to determine whether a network anomaly has occurred in the network area where the network device is located. Specifically, when the user-side network device is unable to send the first monitoring indicator data to the management server, a corresponding network anomaly retransmission mechanism can be set up to complete the transmission of the first monitoring indicator data. In addition, when a network anomaly occurs between the network device and the management server, and retransmission still fails even after the retransmission count reaches the retransmission threshold, a preset network anomaly prediction model can continuously collect and analyze the first network status information to accurately determine whether a network anomaly has occurred in the network area where the network device is located. This resolves the mechanism defect that prevents analysis of the cause of network anomalies after the network anomaly between the network device and the management server is restored, and thus solves the technical problem in related technologies where data cannot be reported normally and the cause of the anomaly cannot be analyzed when there is a network anomaly between the network device and the network server.

[0034] The method described in this embodiment will be further described below.

[0035] As an optional implementation, in the technical solution provided in step S102 of the present invention, the method includes: sending the first monitoring index data of the network device to the management server according to the TR069 protocol, wherein the network device responds to the data monitoring request sent by the management server and sends the first monitoring index data to the management server, and the management server is used to perform management operations on the network device based on the first monitoring index data.

[0036] In this embodiment, the management server sends a configuration file containing a request message in RPC format conforming to the TR069 protocol to the monitored network device using the TR069 protocol. This configuration file includes a request to obtain the first monitoring indicator data monitored by the network device according to the TR069 protocol. The network device then parses the configuration file, places the obtained first monitoring indicator data into it, and then sends another configuration file transmission request to the management server. The management server receives and parses the configuration file to obtain the first monitoring indicator data of the network device. Thus, the management server can perform management operations on the network device based on the first monitoring indicator data.

[0037] The TR069 protocol, also known as the CPE WAN management protocol, provides a general framework and protocol for managing and configuring home network devices in next-generation networks. It is typically used for remote centralized management of devices such as gateways, routers, and set-top boxes in a home network from the network side.

[0038] As an optional implementation, in the technical solution provided in step S102 of the present invention, before sending the first monitoring index data of the network device to the management server, the communication configuration of the network device can also be authenticated by the management server.

[0039] In this embodiment, in order to facilitate the management server to manage and monitor network devices that support the TR069 protocol via the TR069 protocol, the management server can also actively perform communication configuration on the network devices through a program deployed on the management server. Thus, the network devices and the management server can exchange request messages in the RPC format unique to the TR069 protocol to complete data transmission and monitoring.

[0040] As an optional implementation, in the technical solution provided by step S104 of the present invention, the method includes: determining a first set of keywords in the first monitoring indicator data, and determining a second set of keywords in the second monitoring indicator data; calculating the Jaccard coefficient between the first set of keywords and the second set of keywords, and using the Jaccard coefficient as the similarity between the first monitoring indicator data and the second monitoring indicator data.

[0041] In this embodiment, keywords are extracted from the first monitoring indicator data and the second monitoring indicator data, respectively. The Jaccard coefficient algorithm is used to calculate the Jaccard coefficient between the keywords in the first monitoring indicator data and the keywords in the second monitoring indicator data, and this coefficient is used as the similarity between the first and second monitoring indicator data. The Jaccard coefficient algorithm can be understood as using Jaccard distance to calculate the similarity between the vocabulary sets extracted from two text segments.

[0042] For example, suppose we have two sets, set A and set B. The Jaccard coefficient can be defined as the ratio of the size of the intersection of set A and set B to the size of the size of the union of set A and set B. The formula is as follows:

[0043]

[0044] When both set A and set B are empty sets, J(A,B) is defined as 1.

[0045] Therefore, the metric associated with the Jaccard coefficient can be called the Jaccard distance, which describes the similarity between sets. The larger the Jaccard distance, the lower the similarity between sample sets. Therefore, the formula for calculating the Jaccard distance is as follows:

[0046]

[0047] Where AΔB represents the symmetric difference, and its expression is: AΔB=|A∪B|-|A∩B|.

[0048] As an optional implementation, in the technical solution provided in step S106 of the present invention, after calculating the similarity, the method further includes: when the similarity is greater than a preset threshold, determining that a network anomaly has occurred between the network device and the management server; when the similarity is not greater than the preset threshold, determining that network jitter has occurred between the network device and the management server, or that there is a false alarm of data transmission failure.

[0049] In this embodiment, if the similarity between the first monitoring indicator data and the second monitoring indicator data is greater than a preset threshold, it indicates that a real network anomaly has occurred between the network device and the management server; otherwise, it may be due to network jitter between the network device and the management server, or a false alarm of failure in the transmission of the first monitoring indicator data.

[0050] As an optional implementation, in the technical solution provided by step S106 of the present invention, the method includes: periodically collecting first network status information within the network area where the network device is located according to the retransmission time interval.

[0051] In this embodiment, network devices within the regional network replace edge network nodes outside the network area, and the Netconf of the edge network nodes is used to periodically collect the first network status information of the regional network where the abnormal network device is located, according to the retransmission time interval set in the configuration file.

[0052] As an optional implementation, in the technical solution provided in step S106 of the present invention, the method includes: a network anomaly prediction model is constructed based on a Markov state transition matrix, used to predict the target network state at the next moment based on the first network state information at the current moment and the historical network state information at the previous moment, so as to determine whether a network anomaly has occurred in the network area where the network device is located.

[0053] In this embodiment, the network anomaly prediction model is constructed using a Markov state transition matrix; therefore, the calculation formula for the network anomaly prediction model is as follows:

[0054] Xk+1 =X k +P

[0055] Among them, X k X represents the state vector of the trend analysis and prediction object at time t=k, and P represents the transition probability matrix; k+1 This represents the state vector of the trend analysis and prediction object at time t = k+1.

[0056] Therefore, the target network state at the next moment can be predicted based on the current network state information and the historical network state information at the previous moment, thereby predicting whether a network anomaly will occur in the network area where the network device is located.

[0057] For example, if the monitoring transition probability at the previous moment is [0.3, 0.7], the transition probability from an abnormal state to a normal state at the current moment is [0.6, 0.4], and the transition probability from a normal state to an abnormal state at the current moment is [0.3, 0.7], then the monitoring anomaly transition probability at the next moment can be calculated using the above network anomaly prediction model as follows:

[0058] 0.3 * 0.6 + 0.3 * 0.7 = 0.39

[0059] The probability of a normal transfer in the next monitoring moment is:

[0060] 0.3 * 0.4 + 0.7 * 0.7 = 0.61

[0061] Therefore, the monitoring transfer probability at the next moment is [0.39, 0.61], and it can be determined whether a network anomaly has occurred in the network area where the network device is located by whether the monitoring transfer probability at the next moment is zero.

[0062] In the above steps, when a network anomaly occurs between the network device and the management server, causing the first monitoring indicator data of the network device to fail to be sent to the management server, the Jaccard coefficient algorithm is used to calculate the Jaccard coefficient between the first keyword set of the first monitoring indicator data and the second keyword set of the second monitoring indicator data. The Jaccard coefficient is then used as the similarity between the first and second monitoring indicator data. This allows for the determination of whether a genuine network anomaly, network jitter, or false data transmission failure has occurred between the network device and the management server, based on the similarity. Furthermore, to accurately determine whether a network anomaly has occurred within the network area where the network device is located, the first network status information within the network area can be periodically collected based on the retransmission interval. The first network status information is continuously collected and analyzed by a network anomaly prediction model deployed on the network device. This enables the analysis of the causes of network anomalies between the network device and the network server, thereby solving the technical problem in related technologies where data cannot be reported normally and the causes of anomalies cannot be analyzed when there are network anomalies between the network device and the network server.

[0063] Example 2

[0064] According to an embodiment of this application, a network anomaly monitoring device for implementing the network anomaly monitoring method in Embodiment 1 is also provided, such as... Figure 2 As shown, the network anomaly monitoring device includes at least a sending module 21, a calculation module 22, and a determination module 23, wherein:

[0065] The sending module 21 is used to send the first monitoring indicator data of the network device to the management server, and when the sending fails, it attempts to retransmit the monitoring indicator data to the management server according to the preset retransmission time interval and retransmission number threshold.

[0066] Specifically, in current data center operation and maintenance scenarios, due to the large scale of business and complex application relationships, the sending module 21 can send the first monitoring indicator data of the user-side network device (Customer Premise Equipment, CPE) to the management server (Auto-Configuration Server, ACS). When a network anomaly occurs between the user-side network device and the management server, a network anomaly retransmission mechanism can be set to retransmit the first monitoring indicator data to the management server. Specifically, the program on the CPE can automatically send and search for the RetryCount (retransmission count) in the RPC (Remote Procedure Call Protocol) and set it. The retransmission threshold can be set to 5. Simultaneously, another RPC parameter, post-reboot session retry count (retransmission interval), can be set. In this embodiment, the retransmission interval can be set to 5 seconds. It should be noted that the retransmission interval and retransmission count threshold can be set according to actual conditions; this is only an example and no specific restrictions are imposed.

[0067] As an optional implementation, the sending module 21 can send the first monitoring index data of the network device to the management server according to the TR069 protocol. In this case, the network device responds to the data monitoring request sent by the management server and sends the first monitoring index data to the management server. The management server is used to perform management operations on the network device based on the first monitoring index data.

[0068] In this embodiment, the management server sends a configuration file containing a request message in RPC format conforming to the TR069 protocol to the monitored network device using the TR069 protocol. This configuration file includes a request to obtain the first monitoring indicator data monitored by the network device according to the TR069 protocol. The network device then parses the configuration file, places the obtained first monitoring indicator data into it, and then sends another configuration file transmission request to the management server. The management server receives and parses the configuration file to obtain the first monitoring indicator data of the network device. Thus, the management server can perform management operations on the network device based on the first monitoring indicator data.

[0069] The TR069 protocol, also known as the CPE WAN management protocol, provides a general framework and protocol for managing and configuring home network devices in next-generation networks. It is typically used for remote centralized management of devices such as gateways, routers, and set-top boxes in a home network from the network side.

[0070] As an optional implementation, before sending the first monitoring index data of the network device to the management server, the sending module 21 can also authenticate the communication configuration of the network device through the management server.

[0071] In this embodiment, in order to facilitate the management server to manage and monitor network devices that support the TR069 protocol via the TR069 protocol, the management server can also actively perform communication configuration on the network devices through a program deployed on the management server. Thus, the network devices and the management server can exchange request messages in the RPC format unique to the TR069 protocol to complete data transmission and monitoring.

[0072] The calculation module 22 is used to calculate the similarity between the first monitoring indicator data and the second monitoring indicator data when the number of retransmissions reaches the retransmission threshold and the retransmission is still unsuccessful. The second monitoring indicator data is the historical monitoring indicator data when the network device and the management server last experienced a network anomaly.

[0073] Specifically, when a network anomaly occurs between the management server and the network device, and the number of retransmissions of the first monitoring indicator data reaches the retransmission threshold but still fails to retransmit successfully, the calculation module 22 can compare the similarity between the historical monitoring indicator data when the network anomaly occurred between the network device and the management server and the first monitoring indicator data, thereby determining and analyzing the cause of the network anomaly between the management server and the network device based on the similarity.

[0074] As an optional implementation, the calculation module 22 first determines the first set of keywords in the first monitoring indicator data and the second set of keywords in the second monitoring indicator data; then it calculates the Jaccard coefficient between the first set of keywords and the second set of keywords, and uses the Jaccard coefficient as the similarity between the first monitoring indicator data and the second monitoring indicator data.

[0075] In this embodiment, keywords are extracted from the first monitoring indicator data and the second monitoring indicator data, respectively. The Jaccard coefficient algorithm is used to calculate the Jaccard coefficient between the keywords in the first monitoring indicator data and the keywords in the second monitoring indicator data, and this coefficient is used as the similarity between the first and second monitoring indicator data. The Jaccard coefficient algorithm can be understood as using Jaccard distance to calculate the similarity between the vocabulary sets extracted from two text segments.

[0076] For example, suppose we have two sets, set A and set B. The Jaccard coefficient can be defined as the ratio of the size of the intersection of set A and set B to the size of the size of the union of set A and set B. The formula is as follows:

[0077]

[0078] When both set A and set B are empty sets, J(A,B) is defined as 1.

[0079] Therefore, the metric associated with the Jaccard coefficient can be called the Jaccard distance, which describes the similarity between sets. The larger the Jaccard distance, the lower the similarity between sample sets. Therefore, the formula for calculating the Jaccard distance is as follows:

[0080]

[0081] Where AΔB represents the symmetric difference, and its expression is: AΔB=|A∪B|-|A∩B|.

[0082] The determination module 23 is used to collect the first network status information in the network area where the network device is located when the similarity is greater than a preset threshold, and analyze the first network status information according to the preset network anomaly prediction model to determine whether a network anomaly has occurred in the network area where the network device is located.

[0083] Specifically, when the number of retransmissions of the first monitoring indicator data reaches the retransmission threshold and still fails to retransmit successfully, it is impossible to directly determine whether the network in the network area where the network device is located is a real anomaly or a regional network anomaly caused by an abnormal connection between the edge network node and the network in the network area. Therefore, the determination module 23 can collect the first network status information in the network area where the network device is located, and continuously collect and analyze the first network status information through the network anomaly prediction model deployed on the network device, thereby accurately predicting whether a network anomaly has occurred in the network area where the network device is located.

[0084] As an optional implementation, when the similarity is greater than a preset threshold, the determining module 23 can determine that a network anomaly has occurred between the network device and the management server; when the similarity is not greater than the preset threshold, the determining module 23 can determine that network jitter has occurred between the network device and the management server, or that there is a false alarm of data transmission failure.

[0085] As another optional implementation, the determining module 23 can also periodically collect the first network status information within the network area where the network device is located based on the retransmission time interval.

[0086] In this embodiment, network devices within the regional network replace edge network nodes outside the network area, and the Netconf of the edge network nodes is used to periodically collect the first network status information of the regional network where the abnormal network device is located, according to the retransmission time interval set in the configuration file.

[0087] As an optional implementation, the network anomaly prediction model is constructed based on the Markov state transition matrix. It is used to predict the target network state at the next moment based on the first network state information at the current moment and the historical network state information at the previous moment, so as to determine whether a network anomaly has occurred in the network area where the network device is located.

[0088] In this embodiment, the network anomaly prediction model is constructed using a Markov state transition matrix; therefore, the calculation formula for the network anomaly prediction model is as follows:

[0089] X k+1 =X k +P

[0090] Among them, X k X represents the state vector of the trend analysis and prediction object at time t=k, and P represents the transition probability matrix; k+1 This represents the state vector of the trend analysis and prediction object at time t = k+1.

[0091] Therefore, the target network state at the next moment can be predicted based on the current network state information and the historical network state information at the previous moment, thereby predicting whether a network anomaly will occur in the network area where the network device is located.

[0092] For example, if the monitoring transition probability at the previous moment is [0.3, 0.7], the transition probability from an abnormal state to a normal state at the current moment is [0.6, 0.4], and the transition probability from a normal state to an abnormal state at the current moment is [0.3, 0.7], then the monitoring anomaly transition probability at the next moment can be calculated using the above network anomaly prediction model as follows:

[0093] 0.3 * 0.6 + 0.3 * 0.7 = 0.39

[0094] The probability of a normal transfer in the next monitoring moment is:

[0095] 0.3 * 0.4 + 0.7 * 0.7 = 0.61

[0096] Therefore, the monitoring transfer probability at the next moment is [0.39, 0.61], and it can be determined whether a network anomaly has occurred in the network area where the network device is located by whether the monitoring transfer probability at the next moment is zero.

[0097] It should be noted that each module in the network anomaly monitoring device in this application embodiment corresponds one-to-one with each implementation step of the network anomaly monitoring method in embodiment 1. Since embodiment 1 has been described in detail, some details not shown in this embodiment can be referred to embodiment 1, and will not be elaborated further here.

[0098] Example 3

[0099] According to an embodiment of this application, a non-volatile storage medium is also provided, which includes a stored program, wherein the device where the non-volatile storage medium is located executes the network anomaly monitoring method in Embodiment 1 by running the program.

[0100] Optionally, the device containing the non-volatile storage medium executes the following steps by running the program: sending the first monitoring indicator data of the network device to the management server, and attempting to retransmit the first monitoring indicator data to the management server according to a preset retransmission time interval and retransmission number threshold when the retransmission number reaches the retransmission number threshold and still fails to retransmit successfully; calculating the similarity between the first monitoring indicator data and the second monitoring indicator data, wherein the second monitoring indicator data is the historical monitoring indicator data of the last time a network anomaly occurred between the network device and the management server; when the similarity is greater than the preset threshold, collecting the first network status information in the network area where the network device is located, and analyzing the first network status information according to a preset network anomaly prediction model to determine whether a network anomaly has occurred in the network area where the network device is located.

[0101] According to an embodiment of this application, a processor is also provided for running a program, wherein the program executes the network anomaly monitoring method in embodiment 1 during runtime.

[0102] Optionally, the program executes the following steps during runtime: sending the first monitoring indicator data of the network device to the management server, and attempting to retransmit the first monitoring indicator data to the management server according to a preset retransmission time interval and retransmission count threshold when the retransmission count reaches the retransmission count threshold and still fails to retransmit successfully; calculating the similarity between the first monitoring indicator data and the second monitoring indicator data, wherein the second monitoring indicator data is the historical monitoring indicator data of the last time a network anomaly occurred between the network device and the management server; when the similarity is greater than the preset threshold, collecting the first network status information in the network area where the network device is located, and analyzing the first network status information according to a preset network anomaly prediction model to determine whether a network anomaly has occurred in the network area where the network device is located.

[0103] According to an embodiment of this application, an electronic device is also provided, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the network anomaly monitoring method of embodiment 1 through the computer program.

[0104] Optionally, the processor is configured to execute the following steps via a computer program: sending first monitoring indicator data of the network device to the management server, and attempting to retransmit the first monitoring indicator data to the management server according to a preset retransmission time interval and retransmission count threshold when the transmission fails; when the retransmission count reaches the retransmission count threshold and still fails to retransmit successfully, calculating the similarity between the first monitoring indicator data and the second monitoring indicator data, wherein the second monitoring indicator data is the historical monitoring indicator data of the last time a network anomaly occurred between the network device and the management server; when the similarity is greater than the preset threshold, collecting first network status information in the network area where the network device is located, and analyzing the first network status information according to a preset network anomaly prediction model to determine whether a network anomaly has occurred in the network area where the network device is located.

[0105] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0106] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0107] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0108] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0109] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0110] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0111] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A network anomaly monitoring method, applied to network devices, characterized in that, include: The first monitoring index data of the network device is sent to the management server, and if the sending fails, the first monitoring index data is retransmitted to the management server according to the preset retransmission time interval and retransmission number threshold. When the number of retransmissions reaches the retransmission threshold and the retransmission is still unsuccessful, the similarity between the first monitoring indicator data and the second monitoring indicator data is calculated, wherein the second monitoring indicator data is the historical monitoring indicator data of the last time a network anomaly occurred between the network device and the management server. When the similarity is greater than a preset threshold, it is determined that a network anomaly has occurred between the network device and the management server. First network status information in the network area where the network device is located is collected, and the first network status information is analyzed according to a preset network anomaly prediction model to determine whether a network anomaly has occurred in the network area where the network device is located. When the similarity is not greater than the preset threshold, it is determined that network jitter has occurred between the network device and the management server, or there is a false alarm of data transmission failure.

2. The method according to claim 1, characterized in that, Sending the first monitoring indicator data of the network device to the management server includes: The network device sends the first monitoring indicator data to the management server in accordance with the TR069 protocol. The network device responds to the data monitoring request sent by the management server by sending the first monitoring indicator data to the management server. The management server is used to perform management operations on the network device based on the first monitoring indicator data.

3. The method according to claim 2, characterized in that, Before sending the first monitoring indicator data of the network device to the management server, the method further includes: The management server authenticates the communication configuration of the network devices.

4. The method according to claim 1, characterized in that, Calculating the similarity between the first monitoring indicator data and the second monitoring indicator data includes: Determine the first set of keywords in the first monitoring indicator data, and determine the second set of keywords in the second monitoring indicator data; Calculate the Jaccard coefficient between the first keyword set and the second keyword set, and use the Jaccard coefficient as the similarity between the first monitoring indicator data and the second monitoring indicator data.

5. The method according to claim 1, characterized in that, Collect the first network status information within the network area where the network device is located, including: The first network status information within the network area where the network device is located is periodically collected according to the retransmission time interval.

6. The method according to claim 1, characterized in that, The network anomaly prediction model is constructed based on the Markov state transition matrix and is used to predict the target network state at the next moment based on the first network state information at the current moment and the historical network state information at the previous moment, so as to determine whether a network anomaly has occurred in the network area where the network device is located.

7. A network anomaly monitoring device, applied to network equipment, characterized in that, include: The sending module is used to send the first monitoring indicator data of the network device to the management server, and when the sending fails, to attempt to retransmit the first monitoring indicator data to the management server according to the preset retransmission time interval and retransmission number threshold. The calculation module is used to calculate the similarity between the first monitoring indicator data and the second monitoring indicator data when the number of retransmissions reaches the retransmission number threshold and the retransmission is still unsuccessful. The second monitoring indicator data is the historical monitoring indicator data of the last time a network anomaly occurred between the network device and the management server. The determination module is used to determine whether a network anomaly has occurred between the network device and the management server when the similarity is greater than a preset threshold, collect first network status information in the network area where the network device is located, and analyze the first network status information according to a preset network anomaly prediction model to determine whether a network anomaly has occurred in the network area where the network device is located; when the similarity is not greater than the preset threshold, determine whether network jitter has occurred between the network device and the management server, or whether there is a false alarm of data transmission failure.

8. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored program, wherein the device containing the non-volatile storage medium executes the network anomaly monitoring method according to any one of claims 1 to 6 by running the program.

9. An electronic device, characterized in that, include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the network anomaly monitoring method according to any one of claims 1 to 6 through the computer program.

Images