A device anomaly detection method, system, apparatus and network protection device

Abstract

The application discloses a device exception detection method, system and device and network protection equipment, and is applied to the field of device maintenance, obtains the running state of the service of the device, and the running state comprises normal and exception; determines whether the device appears an exception event according to the running state and an exception condition; if the exception event appears, determines the influence factor causing the exception event according to the corresponding relationship between the exception event and the influence factor and the appearing exception event; and generates an analysis report of the influence factor and the exception event and outputs. The device whether appears the exception event can be automatically determined, the factor causing the exception event is obtained according to the corresponding relationship between the previously appearing exception event and the influence factor, and the analysis report is generated at the same time, so that the user can accurately determine the influence factor according to the analysis report and carries out subsequent maintenance.

Description

Technical Field

[0001] This invention relates to the field of equipment maintenance, and in particular to a method, system, device, and network protection device for detecting equipment malfunctions. Background Technology

[0002] Many network protection devices, such as firewalls, are deployed in users' network environments. Some are connected in series between clients and servers, providing security protection and traffic proxying for user servers. Once these devices malfunction, it can lead to serious consequences such as network outages or server attacks. However, in reality, devices are not immune to malfunctions. Therefore, the timeliness of device anomaly detection and root cause analysis is increasingly important, as it ultimately determines the resolution of device anomalies. Manual detection and root cause analysis of network protection device anomalies requires highly skilled personnel, and it's difficult to pass on this experience and analytical methods if personnel change. Furthermore, problem detection is often not timely; reliance on experience can easily overlook some issues. Moreover, the environment may have been updated after the problem occurred, making it impossible to know the device's status at that time, increasing the difficulty of problem analysis and localization. It's also possible that the device has its own protection mechanisms that, when an anomaly occurs, are not observed by maintenance personnel, and the device's own protection mechanisms restore the device, making it difficult to detect the problem. Summary of the Invention

[0003] The purpose of this invention is to provide a method, system, device, and network protection device for detecting equipment anomalies. This device can automatically determine whether an abnormal event has occurred, and obtain the factors causing the abnormal event based on the correspondence between the pre-occurring abnormal event and the influencing factors. At the same time, it generates an analysis report so that users can accurately determine the influencing factors based on the analysis report and perform subsequent maintenance.

[0004] To address the aforementioned technical problems, this invention provides a method for detecting equipment malfunctions, comprising:

[0005] Obtain the operational status of the device's services, including normal and abnormal operational status;

[0006] Determine whether the device has experienced an abnormal event based on the described operating status and abnormal conditions;

[0007] If an abnormal event occurs, the influencing factors that caused the abnormal event are determined based on the correspondence between the abnormal event and the influencing factors. The influencing factors include one or more combinations of system resource utilization, interface status, and forwarding engine.

[0008] The analysis report will be generated and output based on the influencing factors and the abnormal events.

[0009] Preferably, the service includes one or more of the following: processes, microservices, traffic proxies, and protection detection. The microservices are used to provide multiple running processes, the traffic proxies are used to provide TCP transmission between the server and the user so that the server and the user can communicate, and the protection detection is used to detect whether the packets communicating between the server and the user contain attack information.

[0010] Obtain the operational status of the device's services, including:

[0011] Obtain the running status of the device's processes, microservices, traffic proxies, and protection detection.

[0012] Preferably, the operational status of the device's services is obtained, including:

[0013] The system obtains the survival status of the process, the survival status of the processes in the microserver, the microservice execution log, the access log, and the protection log. The survival status includes whether the process exists and whether it is working properly.

[0014] Preferably, after determining whether the device has experienced an abnormal event based on the operating status and abnormal conditions, the method further includes:

[0015] Generate a number and description information corresponding to the abnormal event, wherein the number corresponds one-to-one with the abnormal event.

[0016] Preferably, the influencing factors that caused the abnormal event are determined based on the correspondence between the abnormal event and the influencing factors, including:

[0017] The influencing factors are determined based on the correspondence between the abnormal event number and the influencing factors, and the abnormal event number itself.

[0018] Preferably, after determining the influencing factors that triggered the abnormal event based on the correspondence between the abnormal event and the influencing factors and the occurrence of the abnormal event, the method further includes:

[0019] Obtain the parameters of the influencing factors;

[0020] The parameters of the influencing factors are determined according to pre-stored rules. The rules include the parameters of the influencing factors, the data types corresponding to the parameters, and the range of the parameters. The data types include int and bool.

[0021] The analysis report is generated and output, including the influencing factors and the abnormal events, and includes:

[0022] If the parameters of the influencing factors are not within the normal range, an analysis report will be generated and output for the influencing factors whose parameters are not within the normal range and for the abnormal events.

[0023] Preferably, the rule also includes the weights of the influencing factors;

[0024] The analysis report output includes the following: Factors affecting parameters outside the normal range and abnormal events.

[0025] After sorting the influencing factors and abnormal events whose parameters are outside the normal range according to their weight from high to low, an analysis report is generated.

[0026] To address the aforementioned technical problems, the present invention also provides a device malfunction detection system, comprising:

[0027] The acquisition unit is used to acquire the operating status of the device's services, including normal and abnormal operating status.

[0028] The judgment unit is used to determine whether the device has experienced an abnormal event based on the operating status and abnormal conditions; if so, the determination unit is triggered.

[0029] The determining unit is used to determine the influencing factors that caused the abnormal event based on the correspondence between the abnormal event and the influencing factors and the abnormal event that occurred. The influencing factors include one or more combinations of system resource utilization, interface status and forwarding engine.

[0030] The output unit is used to generate and output an analysis report on the influencing factors and the abnormal events.

[0031] To address the aforementioned technical problems, the present invention also provides a device for detecting equipment malfunctions, comprising:

[0032] Memory, used to store computer programs;

[0033] A processor is used to implement the steps of the above-described device malfunction detection method when executing the computer program.

[0034] To address the aforementioned technical problems, the present invention also provides a network protection device, including a device for detecting device malfunctions.

[0035] This application provides a method, system, device, and network protection equipment for detecting equipment anomalies, applied in the field of equipment maintenance. It acquires the operational status of the equipment's services, including normal and abnormal status; determines whether an abnormal event has occurred based on the operational status and abnormal conditions; if an abnormal event occurs, it identifies the influencing factors that caused the abnormal event based on the correspondence between the abnormal event and influencing factors; and generates an analysis report outputting the influencing factors and the abnormal event. It can automatically determine whether an abnormal event has occurred and, based on the correspondence between pre-occurring abnormal events and influencing factors, obtain the factors causing the abnormal event, while simultaneously generating an analysis report. This allows users to accurately identify the influencing factors based on the analysis report and perform subsequent maintenance. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the prior art and embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 A flowchart of a device malfunction detection method provided by the present invention;

[0038] Figure 2 A schematic diagram illustrating the correspondence between the numbering and description information of abnormal events provided by the present invention;

[0039] Figure 3 A diagram showing the correspondence between abnormal events and influencing factors provided by this invention;

[0040] Figure 4 A rule diagram of influencing factors provided for this invention;

[0041] Figure 5 A schematic diagram of the structure of a device malfunction detection system provided by the present invention;

[0042] Figure 6 This is a schematic diagram of the structure of a device for detecting equipment malfunctions provided by the present invention. Detailed Implementation

[0043] The core of this invention is to provide a method, system, device, and network protection device for detecting equipment anomalies. It can automatically determine whether an abnormal event has occurred in the equipment, and obtain the factors causing the abnormal event based on the correspondence between the pre-occurring abnormal event and the influencing factors. At the same time, it generates an analysis report so that users can accurately determine the influencing factors based on the analysis report and perform subsequent maintenance.

[0044] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] Figure 1 A flowchart of a device malfunction detection method provided by the present invention, the method comprising:

[0046] S11: Obtain the operating status of the device's services, including normal and abnormal status;

[0047] The purpose of this application is to detect whether the equipment is malfunctioning. Equipment malfunctions can be reflected in the operational status of the services executed on the equipment. It is understood that if all services on the equipment are running normally, then it proves that the equipment has not experienced any abnormal events.

[0048] Starting with potential or past anomalies of the equipment, such as if a certain anomaly has occurred before, then that anomaly can be used as the operational status of the service to be acquired.

[0049] S12: Determine whether an abnormal event has occurred in the equipment based on the operating status and abnormal conditions; if so, proceed to step S13.

[0050] The status of the service is obtained, and this can be determined based on the exception conditions for each service. Each exception corresponds to a method for obtaining the operational status of a device's service, and each method has specific conditions for the exception to occur. If the operational status of the device's service does not meet the exception conditions, it is considered normal; if the operational status of the device's service meets the corresponding exception conditions, then the exception corresponding to the current monitoring method is considered to have occurred.

[0051] S13: Determine the influencing factors that caused the abnormal event based on the correspondence between the abnormal event and the influencing factors and the abnormal event that occurred. The influencing factors include system resource utilization, interface status and one or more combinations of forwarding engines.

[0052] Each abnormal event may be caused by one or more influencing factors. The pre-obtained correspondence between abnormal events and influencing factors can reveal the influencing factors that caused each abnormal event. For example, if the influencing factors for abnormal event A are X, Y, and Z, and the influencing factors for abnormal event B are W, X, and U, then when abnormal event B occurs, it is necessary to check whether W, X, and U are normal.

[0053] Specifically, influencing factors include, but are not limited to, system resource utilization, interface status, and one or more combinations of forwarding engines. Additional factors can be added based on problems encountered during actual use.

[0054] S14: Generate and output an analysis report on influencing factors and abnormal events.

[0055] Because of limitations in existing technology, the environment at the time of an incident may be updated, making it impossible to know the device's status at that moment, increasing the difficulty of problem analysis and localization. It's also possible that the device has its own protection mechanisms; if an anomaly occurs and maintenance personnel fail to observe it, the device's own protection mechanisms may restore the device, making it even harder to detect the problem.

[0056] Therefore, after detecting an abnormal event, this application will generate an analysis report on the abnormal event and its influencing factors, so that maintenance personnel can accurately find the abnormal event and the influencing factors that caused it based on the analysis report.

[0057] This application provides a method for detecting equipment anomalies, applied in the field of equipment maintenance. The method acquires the operational status of the equipment, including normal and abnormal states; determines whether an abnormal event has occurred based on the operational status and abnormal conditions; if an abnormal event occurs, it identifies the influencing factors that caused the abnormal event based on the correspondence between the abnormal event and its influencing factors; and generates an analysis report outputting the influencing factors and the abnormal event. This method can automatically determine whether an abnormal event has occurred and, based on the correspondence between pre-occurring abnormal events and their influencing factors, identify the factors causing the abnormal event, while simultaneously generating an analysis report. This allows users to accurately identify the influencing factors and perform subsequent maintenance based on the analysis report.

[0058] Based on the above embodiments:

[0059] As a preferred embodiment, the service includes one or more of the following combinations: processes, microservices, traffic proxies, and protection detection. Microservices are used to provide multiple running processes, traffic proxies are used to provide TCP transmission between the server and the user so that the server and the user can communicate, and protection detection is used to detect whether the packets communicating between the server and the user contain attack information.

[0060] Obtain the operational status of the device's services, including:

[0061] Obtain the running status of device processes, microservices, traffic proxies, and protection detection.

[0062] Network protection devices are installed between the server and the user's client. These devices maintain server security by acting as intermediaries, relaying messages sent by users to the server, and detecting any malicious attacks within those messages. Through processes, microservices, traffic proxying, and protection detection, network protection devices enhance server security.

[0063] As a preferred embodiment, obtaining the operating status of the device's services includes:

[0064] Obtain the survival status of processes, the survival status of processes in microservers, microservice execution logs, access logs, and protection logs. Survival status includes whether the process exists and whether it is working properly.

[0065] The detection process is performed from two dimensions: existence and whether it is functioning correctly. Since a microservice consists of multiple running processes, the business state of a microservice can be determined by the state of its individual processes.

[0066] Access logs: In a business network, access logs refer to detailed logs of user access traffic, including: request time, client IP, client port, access domain name, server IP, server port, access path, HTTP status code, HTTP request method, protocol type, etc.

[0067] Protection Log: An interception log recorded by the device after intercepting attack packets. This includes attack type, attack content, attack time, client IP, client port, accessed domain name, server IP, server port, access path, HTTP status code, HTTP request method, and protocol type.

[0068] Figure 2 A schematic diagram illustrating the correspondence between the numbering and description information of abnormal events provided by the present invention;

[0069] As a preferred embodiment, after determining whether an abnormal event has occurred in the device based on the operating status and abnormal conditions, the method further includes:

[0070] Generate the corresponding number and description information of the abnormal event, with each number corresponding to a specific abnormal event.

[0071] Because there are many factors influencing abnormal events, and the timeliness of the content of each factor varies, a timeout period is added after each acquisition of the influencing factor content. If the timeout period expires, the content needs to be acquired again; otherwise, the recorded content is used. For example, for abnormal event number 1, the corresponding description is 1, the timeout period is T1, and the method 1 for detecting abnormal event 1 corresponds to condition 1 for the abnormal event to be established.

[0072] As a preferred embodiment, the influencing factors that caused the abnormal event are determined based on the correspondence between the abnormal event and the influencing factors, including:

[0073] The influencing factors are determined based on the correspondence between the abnormal event number and the influencing factors, and the abnormal event number itself.

[0074] The following three examples illustrate three types of abnormal events.

[0075] Example 1:

[0076] Access log monitoring detects that when the proportion of HTTP request response codes of 5xx (502, 503, etc., indicate that the server responded abnormally when the client accesses the server) reaches 900 out of 1000 consecutive entries, an exception event is triggered.

[0077] Factors affecting access exceptions include: 1. Forwarding engine status; 2. Interface status; 3. System resource status; 4. Engine configuration status.

[0078] Example 2:

[0079] If the protection log monitoring detects that no protection logs have been generated within a certain period (one week, configurable), an abnormal event is triggered. (In a live network environment, if this occurs, it most likely indicates a protection anomaly, meaning the device lacks protection capabilities.)

[0080] Factors affecting protection anomalies include: 1. Protection engine status; 2. System resource status; 3. Protection engine configuration status.

[0081] Example 3:

[0082] If the configuration execution monitoring detects that the microservice fails to execute the configuration, an exception event is triggered.

[0083] Factors affecting configuration execution failure exceptions include: 1. System resource status; 2. Microservice status.

[0084] Figure 3 A diagram showing the correspondence between abnormal events and influencing factors provided by this invention;

[0085] Figure 4 A rule diagram of influencing factors provided for this invention;

[0086] As a preferred embodiment, after determining the influencing factors that triggered the abnormal event based on the correspondence between the abnormal event and the influencing factors and the occurrence of the abnormal event, the method further includes:

[0087] Obtain the parameters of the influencing factors;

[0088] The system determines whether the parameters of the influencing factors are within the normal range based on pre-stored rules. The rules include the parameters of the influencing factors, the data types of the parameters, and the range of the parameters. The data types include int and bool.

[0089] The system generates and outputs analysis reports on influencing factors and abnormal events, including:

[0090] If the parameters of the influencing factors are outside the normal range, an analysis report will be generated and output for the influencing factors and abnormal events whose parameters are outside the normal range.

[0091] Once the influencing factors are identified, their parameters are obtained using the corresponding acquisition methods. All parameters of the influencing factors fall within a normal range. If the parameters of the influencing factors are outside this normal range, it may lead to the occurrence of abnormal events.

[0092] Considering that an abnormal event may correspond to multiple influencing factors, but not all influencing factors may be outside the normal range, it is necessary to determine the actual influencing factors that caused the event to occur.

[0093] Specifically, the methods for obtaining the aforementioned influencing factors are as follows:

[0094] 1. Forwarding engine status

[0095] The system communicates with the forwarding engine via Unix sockets, and its status is determined based on the communication. If communication fails, the forwarding engine is considered to be malfunctioning.

[0096] Use Linux commands to check if a process exists.

[0097] 2. Interface Status

[0098] Use Linux commands to check the connection status of the interface.

[0099] Check the recorded interface status change logs.

[0100] 3. System resource status

[0101] Use Linux commands to check CPU, memory, and disk usage.

[0102] Use Linux commands to view processes with high system resource usage.

[0103] 4. Engine configuration active status

[0104] Check the logs to see if the engine configuration has taken effect.

[0105] bool type: bool represents a boolean variable, which is the definition symbol for a logical variable. bool can take the values ​​false and true, where 0 is false and non-zero is true.

[0106] int type: The most commonly used type in programs is the general integer type (abbreviated as "integer type" or "int").

[0107] AGENT refers to the engine status, representing the engine's condition; it's a naming convention. It has two values: True and False. True indicates the engine is functioning normally, while False indicates the engine is malfunctioning.

[0108] Usage refers to the utilization rate, and CPU_USAGE is the name for CPU utilization. The utilization rate ranges from 0% to 100%. The higher the utilization rate, the higher the system load.

[0109] For example, the obtained parameters for CPU_USAGE are 90, RAM_USAGE are 85, and AGENT is False. However, according to the rules, the range for CPU_USAGE is 0-80, the range for RAM_USAGE is 0-90, and the normal value for AGENT is True. Therefore, the parameters for CPU_USAGE are outside the normal range, while the parameters for RAM_USAGE are within the normal range, and the parameters for AGENT are outside the normal range.

[0110] The influencing factors corresponding to abnormal event 3 are system resources and engine status. The actual influencing factors that triggered abnormal event 3 are CPU utilization and engine status in the system resources.

[0111] As a preferred embodiment, the rule also includes the weights of the influencing factors;

[0112] This report generates analysis findings on factors and events that cause parameters to fall outside the normal range, including:

[0113] After sorting the influencing factors and abnormal events whose parameters are outside the normal range according to their weight from high to low, an analysis report is generated.

[0114] Considering that different influencing factors may trigger different abnormal events, weights are assigned. A higher weight indicates that the influencing factor is more likely to cause an abnormal event. For example, if the weight of engine status is 90 and the weight of system resources is 50, then it proves that engine status is more likely to cause abnormal event 3 than system resources.

[0115] In the final analysis report, the engine status will appear before the system resources.

[0116] Figure 5This is a schematic diagram of a device malfunction detection system provided by the present invention. The system includes:

[0117] The acquisition unit 51 is used to acquire the operating status of the device's services, including normal and abnormal operating status.

[0118] Judgment unit 52 is used to determine whether an abnormal event has occurred in the equipment based on the operating status and abnormal conditions; if so, the determination unit is triggered.

[0119] The determination unit 53 is used to determine the influencing factors that caused the abnormal event based on the correspondence between the abnormal event and the influencing factors and the abnormal event that occurred. The influencing factors include one or more combinations of system resource utilization, interface status and forwarding engine.

[0120] Output unit 54 is used to generate and output analysis reports on influencing factors and abnormal events.

[0121] The business includes one or more of the following: processes, microservices, traffic proxies, and protection detection. Microservices are used to provide multiple running processes, traffic proxies are used to provide TCP transmission between the server and the user so that the server and the user can communicate, and protection detection is used to detect whether the packets communicating between the server and the user contain attack information.

[0122] The acquisition unit 51 is specifically used to acquire the running status of the device's processes, microservices, traffic proxies, and protection detection.

[0123] The acquisition unit 51 is specifically used to acquire the survival status of processes, the survival status of processes in the microserver, microservice execution logs, access logs, and protection logs. The survival status includes whether the process exists and whether it is working properly.

[0124] The generation unit is used to generate the corresponding number and description information of the abnormal event, with each number corresponding to a specific abnormal event.

[0125] The determination unit is specifically used to determine the influencing factors based on the correspondence between the abnormal event number and the influencing factors, as well as the abnormal event number.

[0126] The second acquisition unit is used to acquire parameters of the influencing factors;

[0127] The second judgment unit is used to determine whether the parameters of the influencing factors are within the normal range according to the pre-stored rules. The rules include the parameters of the influencing factors, the data types corresponding to the parameters, and the range of the parameters. The data types include int and bool.

[0128] The output unit is specifically used to generate analysis reports for influencing factors and abnormal events whose parameters are outside the normal range.

[0129] The rules also include the weights of the influencing factors;

[0130] The output unit is specifically used to sort the influencing factors and abnormal events whose parameters are outside the normal range according to their weight from high to low, and then generate an analysis report output.

[0131] The description of the equipment malfunction detection system provided in this application is given in the above embodiments and will not be repeated here.

[0132] Figure 6 This invention provides a schematic diagram of the structure of a device for detecting equipment malfunctions. The device includes:

[0133] Memory 61 is used to store computer programs;

[0134] The processor 62 is used to implement the steps of the above-described device malfunction detection method when executing a computer program.

[0135] The description of the device for detecting equipment malfunctions provided in this application is given in the above embodiments and will not be repeated here.

[0136] This application provides a network protection device, including a device for detecting abnormalities in the aforementioned device.

[0137] Please refer to the above embodiments for a description of the network protection equipment provided in this application, and it will not be repeated here.

[0138] It should also be noted that, in this specification, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0139] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0140] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting equipment malfunctions, characterized in that, include: Obtain the operational status of the device's services, including normal and abnormal operational status; Determine whether the device has experienced an abnormal event based on the described operating status and abnormal conditions; If an abnormal event occurs, the influencing factors that caused the abnormal event are determined based on the correspondence between the abnormal event and the influencing factors. The influencing factors include one or more combinations of system resource utilization, interface status, and forwarding engine. The analysis report will be generated and output based on the influencing factors and the abnormal events. The service includes one or more of the following: processes, microservices, traffic proxies, and protection detection. The microservices are used to provide multiple running processes. The traffic proxies are used to provide TCP transmission between the server and the user so that the server and the user can communicate. The protection detection is used to detect whether the packets communicating between the server and the user contain attack information. Obtain the operational status of the device's services, including: Obtain the running status of the device's processes, microservices, traffic proxy, and protection detection; Obtain the operational status of the device's services, including: The system obtains the survival status of the process, the survival status of the processes in the microservice, the microservice execution log, access log, and protection log. The survival status includes whether the process exists and whether it is working normally. The business status of the microservice is determined by the status of its processes. In a business network, the access log refers to a detailed log of a user's access to access traffic, and the protection log is an interception log recorded by the device after intercepting attack packets. The timeliness of the influencing factors for each abnormal event varies. Each time the influencing factors of an abnormal event are retrieved, a timeout period is added. If the timeout period is exceeded, the data needs to be retrieved again. If the timeout period is not exceeded, the recorded data is used.

2. The method for detecting equipment malfunctions as described in claim 1, characterized in that, After determining whether the device has experienced an abnormal event based on the operating status and abnormal conditions, the process further includes: Generate a number corresponding to the abnormal event and a description of the abnormal event, wherein the number corresponds one-to-one with the abnormal event.

3. The equipment malfunction detection method as described in claim 2, characterized in that, Based on the correspondence between abnormal events and influencing factors, and the occurrence of abnormal events, the influencing factors that triggered the abnormal events are determined, including: The influencing factors are determined based on the correspondence between the abnormal event number and the influencing factors, and the abnormal event number itself.

4. The method for detecting equipment malfunctions as described in any one of claims 1 to 3, characterized in that, After determining the influencing factors that triggered the abnormal event based on the correspondence between the abnormal event and the influencing factors, the process also includes: Obtain the parameters of the influencing factors; The parameters of the influencing factors are determined according to pre-stored rules. The rules include the parameters of the influencing factors, the data types corresponding to the parameters, and the range of the parameters. The data types include int and bool. The analysis report is generated and output, including the influencing factors and the abnormal events, and includes: If the parameters of the influencing factors are not within the normal range, an analysis report will be generated and output for the influencing factors whose parameters are not within the normal range and for the abnormal events.

5. The equipment malfunction detection method as described in claim 4, characterized in that, The rules also include the weights of the influencing factors; The analysis report output includes the following: Factors affecting parameters outside the normal range and abnormal events. After sorting the influencing factors and abnormal events whose parameters are outside the normal range according to their weight from high to low, an analysis report is generated.

6. A system for detecting equipment malfunctions, characterized in that, include: The acquisition unit is used to acquire the operating status of the device's services, including normal and abnormal operating status. The judgment unit is used to determine whether the device has experienced an abnormal event based on the operating status and abnormal conditions. If so, then trigger the determination unit; The determining unit is used to determine the influencing factors that caused the abnormal event based on the correspondence between the abnormal event and the influencing factors and the abnormal event that occurred. The influencing factors include one or more combinations of system resource utilization, interface status and forwarding engine. The output unit is used to generate and output an analysis report on the influencing factors and the abnormal events. The service includes one or more of the following: processes, microservices, traffic proxies, and protection detection. The microservices are used to provide multiple running processes. The traffic proxies are used to provide TCP transmission between the server and the user so that the server and the user can communicate. The protection detection is used to detect whether the packets communicating between the server and the user contain attack information. The acquisition unit 51 is specifically used to acquire the running status of the device's processes, microservices, traffic proxy, and protection detection. The system obtains the survival status of the process, the survival status of the processes in the microservice, the microservice execution log, access log, and protection log. The survival status includes whether the process exists and whether it is working normally. The business status of the microservice is determined by the status of its processes. In a business network, the access log refers to a detailed log of a user's access to access traffic, and the protection log is an interception log recorded by the device after intercepting attack packets. The equipment malfunction detection system is also used for: The timeliness of the influencing factors for each abnormal event varies. Each time the influencing factors of an abnormal event are retrieved, a timeout period is added. If the timeout period is exceeded, the data needs to be retrieved again. If the timeout period is not exceeded, the recorded data is used.

7. A device for detecting equipment malfunctions, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the device anomaly detection method as described in any one of claims 1 to 5 when executing the computer program.

8. A network protection device, characterized in that, Includes the device for detecting equipment malfunctions as described in claim 7.

Images