Computer network core node detection method

Abstract

The application discloses a computer network core node detection method, comprising the following steps: step S1, acquiring computer network data; step S2, calculating the intermediate centrality of all nodes to generate an intermediate centrality priority traversal tree; step S3, deleting the leaf nodes of the intermediate centrality priority traversal tree according to the node structure characteristics; and step S4, performing hierarchical pruning according to the characteristics of the intermediate centrality priority traversal tree to finally obtain a subtree, and all nodes in the subtree are the detection results of the computer network core nodes. The application solves the problems of high irrelevant node false detection rate, incomplete core node detection and long detection time of the existing computer network core node detection method.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network graph data analysis, and particularly relates to a computer network core node detection method. BACKGROUND

[0002] A network is a common data representation method, which is composed of nodes and edges, and is often used to represent data with complex many-to-many relationships, such as social networks, biological information networks, computer networks, etc. A computer network uses nodes to represent computer devices and edges to represent the connection state between computers, which intuitively expresses the mutual connection of computer devices constituting the network. The devices in the computer network often have downtime, causing high overall transmission delay, network fluctuation and other problems of the network. If the core device connected to more devices is down, it may cause the network to collapse. Therefore, it is necessary to detect the core nodes in the computer network, and in daily maintenance work, the devices represented by these core nodes need to be focused on, and in the event of network failure, the devices represented by these core nodes need to be prioritized for troubleshooting to ensure long-term stable operation of the network.

[0003] At present, some core node detection methods have been proposed by related researches, which can be mainly divided into structure feature detection method and statistical feature detection method. The structure feature detection method detects the structure of the computer network, such as cut point detection, center detection, etc., and then screens out nodes that meet the structure feature of the core node. The statistical feature detection method calculates the statistical properties of the nodes in the computer network, such as the degree of the node, the clustering coefficient of the node, etc., and can screen out nodes that meet the statistical properties of the core node.

[0004] Both the above two methods detect core nodes according to certain features of core nodes in the computer network, but not all nodes that meet the features are core nodes, and the detection results are not all core nodes, which leads to the introduction of many irrelevant nodes in the detection structure, affecting the efficiency of daily maintenance or troubleshooting.

[0005] Considering that core nodes have multiple features in structure and statistical properties, and irrelevant nodes in the computer network may be similar to certain features of core nodes, considering only a certain type or a certain feature will obviously introduce many irrelevant nodes in the detection process of core nodes in the computer network, and it is difficult to cover the detection of core nodes comprehensively. In order to further improve the detection results of core nodes, that is, to detect as many core nodes in the computer network as possible while reducing the possibility of mis-detection of irrelevant nodes, a more accurate and efficient computer network core node detection method is urgently needed. SUMMARY

[0006] The embodiment of the present application aims to provide a computer network core node detection method with high accuracy and efficiency, so as to solve the problems of high irrelevant node false detection rate, incomplete core node detection and long detection time of the existing computer network core node detection methods.

[0007] To solve the above technical problems, the technical solution adopted by the present application is a computer network core node detection method, comprising the following steps:

[0008] Step S1, obtaining computer network data;

[0009] Step S2, calculating the betweenness centrality of all nodes to generate a betweenness centrality priority traversal tree;

[0010] Step S3, deleting the leaf nodes of the betweenness centrality priority traversal tree according to the node structure characteristics;

[0011] Step S4, performing hierarchical pruning according to the characteristics of the betweenness centrality priority traversal tree to finally obtain a subtree, and all nodes in the subtree are the detection results of the computer network core nodes.

[0012] Further, the computer network data in step S1 comprises all network devices and the connection relationship between the network devices, wherein each network device is a node.

[0013] Further, the calculation method of the betweenness centrality is:

[0014] For any node v, two different nodes are selected as the starting node and the terminal node from all possible nodes in the computer network, the number of all shortest paths of the starting node and the terminal node is calculated, then the ratio of the number of the shortest paths containing the arbitrary node v to the number of all shortest paths is calculated, finally the ratios obtained by all possible starting nodes and terminal nodes are added to obtain the betweenness centrality of the arbitrary node v.

[0015] Further, the generation method of the betweenness centrality priority traversal tree is:

[0016] Step S2.1, selecting the node with the maximum betweenness centrality value as the tree root, and performing breadth-first traversal from the tree root, wherein the tree root is the top layer;

[0017] Step S2.2, all neighbor nodes of the tree root are added to the first layer of the tree, at this time all nodes of the first layer represent all devices directly connected to the tree root in the computer network, all nodes of the first layer are direct child nodes of the tree root; then the nodes in the first layer are iterated from high to low according to the intermediate centrality, the neighbor nodes of the nodes in the first layer are added to the second layer of the intermediate centrality priority traversal tree as the direct child nodes of the nodes in the first layer; the nodes in the first layer of the intermediate centrality priority traversal tree have been traversed, then the second layer of the tree is started to be traversed, and the steps are repeated recursively for each layer until all nodes of the computer network are added to the intermediate centrality priority traversal tree, and finally a complete intermediate centrality priority traversal tree is generated.

[0018] Further, in the step S2.2, if part of the neighbor nodes of a node x in a layer have been added to the second layer in advance, the part of the neighbor nodes are not added to the next layer again, and the part of the neighbor nodes do not belong to the direct child nodes of the node x.

[0019] Further, the step S3 is specifically:

[0020] The intermediate centrality priority traversal tree obtained in the step S2 is queried from the tree root top-down to determine whether each node is a leaf node, if yes, the node is reserved, and if no, the node is deleted.

[0021] The leaf node refers to a node having direct child nodes in the intermediate centrality priority traversal tree.

[0022] Further, in the step S3, after the leaf nodes of the intermediate centrality priority traversal tree are deleted once, the intermediate centrality priority traversal tree after the deletion is subjected to leaf node deletion again.

[0023] Further, the step S4 is specifically: starting from the bottom of the intermediate centrality priority traversal tree after the leaf nodes are deleted, the bottom layer of the tree is deleted from bottom to top until the number of remaining nodes in the intermediate centrality priority traversal tree is within the control number in daily maintenance or fault diagnosis.

[0024] The bottom of the intermediate centrality priority traversal tree refers to the layer where the node with the minimum intermediate centrality is located.

[0025] The beneficial effects of the present application are:

[0026] The application realizes accurate and efficient detection of core nodes in a computer network, can reduce the false detection rate of irrelevant nodes, improve the detection strength and effect of core nodes, and improve the detection efficiency; users can accurately and efficiently detect core nodes in a computer network, eliminate a large number of irrelevant nodes caused by using a single feature to detect computer network core nodes, improve the maintenance and troubleshooting efficiency of the computer network, and provide a reliable and long-term stable computing service to the outside. BRIEF DESCRIPTION OF DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0028] Figure 1 The flow chart of the computer network core node detection method of the embodiment of the present application. DETAILED DESCRIPTION

[0029] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0030] In a computer network, it is very important to find core nodes, which usually represent a large number of other network devices connected, and if a failure occurs, it will have a huge impact on the local network, but it is usually difficult to find the core nodes in the network, so the method of the application can be used, taking the cloud computing service network of an Internet company as an example, there are a large number of server devices in the cloud service network, the server devices are connected with each other to provide cloud computing services for users, and there are network devices connected with a large number of other devices, which are the core nodes in the computer network, using a single feature to detect these core nodes will introduce a large number of irrelevant nodes, which are the nodes that have a generally small impact on the overall service when a failure occurs in the service network, and the mixing of a large number of irrelevant nodes in the detection result of the core nodes will affect the daily maintenance and troubleshooting efficiency, resulting in long-term network fluctuations in the efficiency and experience of users using cloud computing, causing user traffic to decline and network maintenance costs to increase. To this end, the embodiment of the application provides a computer network core node detection method, which specifically comprises the following steps:

[0031] Step 1: Obtain computer network data:

[0032] Obtain the cloud computing service network device cluster data of Internet company A from March 7, 2022 to March 8, 2022, the cloud computing service network includes 5908 network devices, and 41729 network device connections are established, in this embodiment, the network device x is stored and represented by using the node x, the network device y is stored and represented by using the node y, and the connection between the network devices x and y is stored and represented by using the edge <node x, node y>, if there is no connection between the network devices, the edge information is not stored, and the core node detection of the computer network is to detect the network devices connected with a large number of other devices in the service network.

[0033] After this step, a computer network including nodes and node edges can be obtained, and the corresponding network device of the cloud computing service network can be located according to the node, and the device information directly or indirectly connected with a certain network device can be inquired through the edge.

[0034] Step 2: Generate an intermediate center priority traversal tree:

[0035] An intermediate center priority traversal tree is generated for the computer network in Step 1, considering that the core nodes are usually connected with a large number of devices, and have the characteristic of strong bridging ability in statistical characteristics, first, the intermediate center value of all nodes is calculated, then the computer network is breadth-first traversed according to the intermediate center size of the node, and a tree is obtained, the node with larger intermediate center is closer to the top layer of the tree, and the node with smaller intermediate center is located at the bottom layer of the tree.

[0036] The main steps are as follows:

[0037] Step 2.1: Calculate the betweenness centrality of all nodes:

[0038] First, calculate the betweenness centrality of all nodes in the computer network. For a node v in the computer network, represents a network device in the cloud computing service network. For any starting node s and terminating node t, device s in the cloud computing service network can indirectly access device t through other devices, which forms an access path. Due to the complexity of device connection in the network, the number of different access paths between them is represented as σ st , where σ st (v) is the number of paths containing node v. Then the calculation method of the betweenness centrality of node v is:

[0039]

[0040] According to the calculation formula, for any node, select all possible two different nodes from the computer network as the starting node and the terminating node, calculate the number of all shortest paths of them, then calculate the ratio of the number of shortest paths containing the node to the number of all shortest paths, and finally add all possible ratios to obtain the betweenness centrality of the node.

[0041] Step 2.2: Breadth-first traversal of the computer network according to the betweenness centrality of the nodes:

[0042] Considering that nodes with strong bridging ability usually have two characteristics, one is that the paths between nodes with strong bridging ability are usually short to ensure efficient communication of the network, and the other is that nodes with strong bridging ability are usually connected to more other nodes. After obtaining the betweenness centrality of each node in the computer network, breadth-first traversal of the computer network is performed according to the betweenness centrality, which can obtain a tree with moderate depth and large betweenness centrality of nodes located in the top layer. The specific method is as follows:

[0043] Step 2.2.1: Tree initialization:

[0044] Select the node with the largest betweenness centrality value as the root of the tree, and perform breadth-first traversal from the tree root. The tree root is the top layer, and the tree root is the network device with the strongest bridging ability in the cloud computing service network.

[0045] Step 2.2.2: Prior traversal according to betweenness centrality:

[0046] All the neighbor nodes of the tree root are added to the first layer of the tree, at this time the first layer has multiple nodes, representing all the devices directly connected to the tree root in the cloud computing service network, all the nodes in the first layer are direct child nodes of the tree root. Then the nodes in the first layer are traversed from high to low according to the intermediate centrality, and their neighbor nodes are added to the second layer of the tree as the direct child nodes of the nodes. Due to the complex association relationship of nodes in the computer network, multiple nodes often share neighbor nodes. If part of the neighbor nodes of a node in the first layer have been added to the second layer in advance, these neighbor nodes will not be added to the second layer again and will not be the direct child nodes of the node. If the nodes in the first layer of the tree have been traversed, the second layer of the tree is traversed. The above steps are recursively repeated for each layer until all the nodes of the computer network are added to the tree.

[0047] In this step, all the nodes of the computer network are sorted according to the intermediate centrality, which is a statistical feature. After this step, an intermediate centrality priority traversal tree is obtained, which contains node information, node level information, and direct child node information. Nodes with high intermediate centrality are close to the top layer of the tree, and nodes with low intermediate centrality are far from the top layer of the tree. In the cloud computing service network, devices with strong bridging ability are concentrated in the top layer of the tree, and irrelevant nodes are distributed in the bottom layer of the tree.

[0048] Step3: Multi-strategy tree pruning:

[0049] In this step, the intermediate centrality priority traversal tree obtained in Step2 is pruned according to two strategies. One is to prune the leaf nodes of the tree, i.e. to delete all the network devices that are last accessed in the cloud computing service network traversal process. The second is to prune the bottom layer nodes of the tree, i.e. to delete the network devices that are far from the devices with the strongest bridging ability in the cloud computing service network. The main steps are as follows:

[0050] Step3.1: Delete leaf nodes according to node structure characteristics:

[0051] According to the structural characteristics of the core nodes of the computer network, the core nodes of the computer network are often connected to a large number of other nodes, which means that from any starting point, the core devices are difficult to be accessed last in the cloud computing service network traversal process. Combined with the traversal of the tree according to the intermediate centrality priority order, nodes with high intermediate centrality are often accessed first, further amplifying the structural characteristics of the core nodes. For the intermediate centrality priority traversal tree obtained in Step2, query whether each node is a leaf node from the top down starting from the tree root, i.e. whether the node has direct child nodes in the tree. If yes, keep it, if no, delete it. This can delete a large number of irrelevant nodes.

[0052] In some embodiments, the user can choose to delete the leaf nodes multiple times according to the filtering strength, i.e., after deleting the leaf nodes of the tree once, the remaining tree is subjected to leaf node deletion again. Deleting the leaf nodes once means deleting the network devices that are accessed last when traversing the cloud computing service network, and deleting twice means deleting the network devices that are accessed second last when traversing the cloud computing service network.

[0053] Step 3.2: Pruning according to the tree characteristic hierarchy:

[0054] After a large number of leaf nodes are deleted, the remaining nodes in the tree represent the network devices that are preferentially accessed in the centrality priority traversal of the cloud computing service network, i.e., the devices with large centrality, and the nodes with large centrality are close to the top layer of the tree. Therefore, this step starts from the bottom of the tree and continuously deletes the bottom layer of the tree from bottom to top, and the user can choose the strength of deletion until the number of remaining network devices in the tree is within the control number for daily maintenance or troubleshooting.

[0055] After this step, a subtree is obtained, and all nodes in the tree are the detection results of the computer network core nodes. According to the detection strength of the user in the previous steps (the filtering strength of the leaf nodes in Step 3.1 combined with the deletion strength in Step 3.2 together constitute the detection strength), the size of the tree can be large or small, indicating the devices with different degrees of connection capability in the cloud computing service network. The more important the network device is, the smaller the size of the obtained tree is. In addition, since the tree is generated by traversing according to the centrality priority order, when performing daily maintenance or troubleshooting, the tree can also be traversed from top to bottom according to the hierarchy, which is beneficial to improve the efficiency of maintenance and troubleshooting.

[0056] Embodiment:

[0057] There are many researches on the detection method of computer network core nodes. The current mainstream detection methods include: degree detection based on nodes (DD), clustering coefficient detection (CC), page rank detection (PR), and Jacob coefficient detection (JI). This embodiment selects these four mainstream detection methods as the performance and effect comparison of the method of the present application.

[0058] Experimental design and process:

[0059] The experimental data are all from the cloud computing service network cluster data of an Internet company obtained in step 1, the running time is taken as the performance evaluation index, the proportion of the number of nodes directly connected to the core nodes is taken as the effect index (the larger the proportion, the more network devices that can be directly connected by the core nodes), five different core node detection quantities are selected, each detection method is run 10 times on each core node detection quantity, and the average running time and the average number of directly connected network devices are taken as the final index results. The experimental process is carried out on a host computer with a 3.6GHz Intel i9 CPU, 32GB memory and a 1920x1080 resolution display.

[0060] Experimental result verification and analysis:

[0061] It can be found from Table 1 that the computer network core device detection method of the present application has the largest number of directly connected devices, which means that under the same number of computer network core device detections, the core devices detected by the present application can be directly connected to the most network devices, which means that routine maintenance or troubleshooting of these devices can most efficiently cover more network devices in the computer network; in the average running time, the present application method has no significant advantage, because compared with the simple sorting of other algorithms, the present application introduces additional operations on the basis of sorting, sacrificing part of the performance for better detection effect, which is acceptable for the field, because the computer network is not frequently changed for stability, and a more time-consuming but more accurate detection result can be used for a long time.

[0062] Table 1 Experimental verification results of computer network core nodes

[0063]

[0064] Each embodiment in the specification is described in a related manner, and the same or similar parts of each embodiment can be referred to each other, and each embodiment mainly explains the difference from other embodiments. Especially, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the related parts can be referred to the part of the method embodiment.

[0065] The above only describes the preferred embodiments of the present application, and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application is included in the protection scope of the present application.

Claims

1. A computer network core node detection method, characterized by, The method comprises the following steps: Step S1, obtaining computer network data; the computer network data comprises all network devices and connection relationships between the network devices, wherein each network device is a node; Step S2, calculating the betweenness centrality of all nodes to generate a betweenness centrality priority traversal tree; The generating method of the betweenness centrality priority traversal tree is as follows: Step S2.1, selecting a node with the maximum betweenness centrality value as a tree root, and performing breadth-first traversal from the tree root; the tree root is the top layer; Step S2.2, adding all neighbor nodes of the tree root to the first layer of the tree; at this time, all nodes in the first layer represent all devices directly connected to the tree root in the computer network, and all nodes in the first layer are direct child nodes of the tree root; then, the nodes in the first layer are sequentially traversed from high to low according to the betweenness centrality, neighbor nodes of the nodes in the first layer are added to the second layer of the betweenness centrality priority traversal tree as direct child nodes of the nodes in the first layer, the nodes in the first layer of the betweenness centrality priority traversal tree have been traversed, and then the second layer of the tree is traversed, and the steps are repeated for each layer recursively until all nodes of the computer network are added to the betweenness centrality priority traversal tree, and finally a complete betweenness centrality priority traversal tree is generated; Step S3, deleting leaf nodes of the betweenness centrality priority traversal tree according to node structure characteristics; Specifically: The betweenness centrality priority traversal tree obtained in step S2 is queried from the tree root top-down to determine whether each node is a leaf node, and if yes, the node is retained, and if no, the node is deleted; The leaf node refers to a node having direct child nodes in the betweenness centrality priority traversal tree; After the leaf nodes of the betweenness centrality priority traversal tree are deleted once, the betweenness centrality priority traversal tree after the deletion is subjected to leaf node deletion again; Step S4, performing hierarchical pruning according to characteristics of the betweenness centrality priority traversal tree, and finally obtaining a subtree, and all nodes in the subtree are detection results of core nodes of the computer network; Specifically, the bottom layer of the betweenness centrality priority traversal tree after the leaf nodes are deleted is taken as a starting point, and the bottom layer of the tree is deleted from bottom to top until the number of remaining nodes in the betweenness centrality priority traversal tree is within a control number in daily maintenance or fault diagnosis; The bottom layer of the betweenness centrality priority traversal tree refers to a layer in which nodes with the minimum betweenness centrality are located.

2. The method of claim 1, wherein, The calculation method of the betweenness centrality is as follows: For an arbitrary node v, two different nodes are selected as a starting node and a terminal node from all possible nodes in the computer network, the number of all shortest paths of the starting node and the terminal node is calculated, then the ratio of the number of the shortest paths containing the arbitrary node v to the number of all shortest paths is calculated, and finally the betweenness centrality of the arbitrary node v is obtained by adding the ratios obtained by all possible starting nodes and terminal nodes.

3. The method of claim 1, wherein, In step S2.2, if part of neighbor nodes of a node x in a layer have been added to the second layer in advance, the part of neighbor nodes is not added to the next layer again, and the part of neighbor nodes does not belong to direct child nodes of the node x.

Images