A cloud traffic collection strategy management method, device and server

Abstract

The application discloses a cloud flow collection strategy management method and device and a server, relates to the technical field of communication, and solves the problems that virtual port management is complex and difficult to be synchronized in real time when cloud flow is collected.The technical scheme points are as follows: the method comprises a collection probe and a collection controller deployed in a cloud environment; the collection probe detects a local virtual port according to a first set frequency; when the local virtual port changes, the collection probe sends a notification to the collection controller; the collection controller synchronizes cloud resources according to the notification, compares the cloud resources with cloud resources at a previous moment, and if the virtual port changes, the associated virtual port is updated and is sent to the collection probe; the collection probe and the collection controller are deployed to realize the functions of cloud flow collection and forwarding, the collection probe is used to query the changes of an interface in real time, the collection controller is timely informed to check the cloud resources, the collection strategy is updated, and the synchronous update and management of the interface are realized.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and more specifically, to a cloud traffic collection strategy management method, apparatus, and server. Background Technology

[0002] In existing technologies, cloud traffic collection is achieved by replicating and forwarding traffic through port mirroring in OVS or by creating flow tables. This mirroring can be done locally to a local port or remotely via tunneling protocols. A traffic receiving program is then started on the peer end to receive data packets, thus completing the collection of cloud traffic. While existing technologies can collect cloud traffic, they require configuring mirroring for each virtual port, leading to complex management. Furthermore, virtual ports are dynamically created and destroyed, making it difficult to promptly delete old interface mirrors and create new ones.

[0003] Based on this, the present invention provides a cloud traffic collection strategy management method, device and server to solve the above problems. Summary of the Invention

[0004] The purpose of this application is to provide a cloud traffic collection strategy management method, device, and server to solve the problems of complex virtual port management and difficulty in real-time synchronization during cloud traffic collection. The method realizes the cloud traffic collection and forwarding function through the deployment of collection controller and collection probe. At the same time, the collection probe queries the interface changes in real time, promptly notifies the collection controller to check cloud resources, and then updates the collection strategy to achieve synchronous update and management of the interface.

[0005] This application first provides a cloud traffic collection strategy management method, which is executed by a collection probe and a collection controller deployed in a cloud environment. The method includes: the collection controller synchronizing cloud resources, determining a collection strategy based on the type of cloud resources, the collection strategy including at least four parameters: strategy type, collection object, distribution target, and distribution protocol; determining associated virtual ports based on the strategy type and collection object, and sending the associated virtual ports, distribution target, and distribution protocol to the collection probe; the collection probe collecting cloud traffic from the associated virtual ports and forwarding it to the distribution target according to the distribution protocol; the collection probe detecting local virtual ports at a first set frequency, and sending a notification to the collection controller when the local virtual ports change; the collection controller synchronizing cloud resources based on the notification, comparing the cloud resources with the cloud resources at the previous moment, and updating the associated virtual ports if the virtual ports have changed, and sending the updates to the collection probe.

[0006] The above technical solution deploys a data acquisition controller and data acquisition probes in a cloud environment. The data acquisition controller interfaces with the cloud API of the cloud resource pool to synchronize cloud resources. Data acquisition policies are defined according to the type of cloud resource. When a data acquisition policy is configured, the data acquisition controller identifies all associated virtual ports based on the policy type and acquisition target, and sends the virtual ports, distribution targets, and distribution protocols to the corresponding data acquisition probes. The data acquisition probes find the corresponding virtual ports based on the data acquisition policy parameters received from the data acquisition controller and perform traffic acquisition and forwarding. The data acquisition probes dynamically detect changes in their local virtual ports in real time. When a local virtual port changes, they notify the data acquisition controller to update cloud resources, thereby updating the data acquisition policy. This solution, on the one hand, implements cloud traffic acquisition and forwarding functions by deploying data acquisition probes and a data acquisition controller in the cloud environment; on the other hand, it enables real-time monitoring of local virtual ports through data acquisition probes. When a virtual port changes, it notifies the data acquisition controller to update cloud resources to determine whether to update the data acquisition policy, thus achieving virtual port management and synchronization.

[0007] In one possible implementation, the acquisition controller synchronizes cloud resources according to a second set frequency and compares the cloud resources with the cloud resources at the previous moment. If the virtual port has changed, the associated virtual port is updated and sent to the acquisition probe.

[0008] In one possible implementation, the acquisition controller synchronizes cloud resources by: the acquisition controller connecting to the cloud API of the cloud resource pool, and realizing cloud resource synchronization by inputting the connection parameters of the cloud resource pool.

[0009] In one possible implementation, the collection strategy is determined according to the type of cloud resource, including: defining the collection strategy for host-type cloud resources as collecting traffic from all virtual machines on the host; defining the collection strategy for VPC-type cloud resources as collecting traffic from all virtual machines under the VPC; defining the collection strategy for Service-type cloud resources as collecting traffic from all Pods associated with the Service; and defining the general collection strategy as collecting traffic from communication between a specified network interface card of the host and external systems.

[0010] In one possible implementation, the changes to the virtual port include: adding, drifting, and deleting.

[0011] This application also provides a cloud traffic collection strategy management device, which is used to implement the cloud traffic collection strategy management method described above. The device includes: a collection probe and a collection controller deployed in a cloud environment; the collection controller is used to synchronize cloud resources, determine a collection strategy according to the type of cloud resources, the collection strategy includes at least four parameters: strategy type, collection object, distribution target, and distribution protocol, determine the associated virtual port according to the strategy type and collection object, and send the associated virtual port, distribution target, and distribution protocol to the collection probe; the collection probe is used to collect cloud traffic from the associated virtual port and forward it to the distribution target according to the distribution protocol; the collection probe is used to detect the local virtual port according to a first set frequency, and send a notification to the collection controller when the local virtual port changes; the collection controller is used to synchronize cloud resources according to the notification, compare the cloud resources with the cloud resources at the previous moment, and if the virtual port changes, update the associated virtual port and send it to the collection probe.

[0012] In one possible implementation, the acquisition controller is further configured to synchronize cloud resources according to a second set frequency, compare the cloud resources with the cloud resources at the previous moment, and if there is a change in the virtual port, update the associated virtual port and send it to the acquisition probe.

[0013] In one possible implementation, the acquisition controller is specifically used to: interface with the cloud API of the cloud resource pool, and realize cloud resource synchronization by inputting the interface parameters of the cloud resource pool.

[0014] In one possible implementation, the acquisition controller is specifically configured to: define the acquisition strategy for host-type cloud resources as acquiring traffic from all virtual machines on the host; define the acquisition strategy for VPC-type cloud resources as acquiring traffic from all virtual machines under the VPC; define the acquisition strategy for Service-type cloud resources as acquiring traffic from all Pods associated with the Service; and define the general acquisition strategy as acquiring traffic from communication between a specified network interface card of the host and external systems.

[0015] This application also provides a server, including a processor and a memory, wherein the memory is used to store a computer program, the computer program including program instructions, and the processor is used to call the program instructions to execute a cloud traffic collection strategy management method as described above.

[0016] Compared with existing technologies, this application has the following advantages: it realizes the collection and forwarding function of cloud traffic by deploying collection probes and collection controllers in the cloud environment; it monitors the changes of local virtual ports in real time by collecting probes, and notifies the collection controller to update cloud resources when the virtual ports change, so as to determine whether to update the collection policy and realize the management and synchronization of virtual ports; it strengthens the management and synchronization of virtual ports by periodically updating cloud resources by the collection controller and actively determining whether to update the collection policy. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of embodiments of the invention and form part of this application, do not constitute a limitation thereof. In the drawings:

[0018] Figure 1 A flowchart of a cloud traffic collection strategy management method provided in an embodiment of the present invention;

[0019] Figure 2 This is a schematic diagram of the cloud traffic collection strategy management device provided in an embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the embodiments and accompanying drawings. The illustrative embodiments and descriptions of this application are only for explaining this application and are not intended to limit this application.

[0021] Example 1 provides a cloud traffic collection strategy management method; please refer to [link / reference]. Figure 1 As shown, Figure 1 This is a flowchart of a cloud traffic collection strategy management method. The method is executed by a collection probe and a collection controller deployed in the cloud environment. The method includes: the collection controller synchronizing cloud resources; determining a collection strategy based on the type of cloud resources; the collection strategy including at least four parameters: strategy type, collection object, distribution target, and distribution protocol; determining the associated virtual port based on the strategy type and collection object; and sending the associated virtual port, distribution target, and distribution protocol to the collection probe; the collection probe collecting cloud traffic from the associated virtual port and forwarding it to the distribution target according to the distribution protocol; the collection probe detecting its own virtual port at a first set frequency; and sending a notification to the collection controller when the local virtual port changes; and the collection controller synchronizing cloud resources based on the notification, comparing the cloud resources with the previous cloud resources, and updating the associated virtual port if the virtual port has changed, and then sending the update to the collection probe.

[0022] When this solution is implemented: the data acquisition controller interfaces with the cloud API of the hybrid cloud resource pool to synchronize cloud resources; data acquisition policies are defined according to the type of cloud resource; after a data acquisition policy is configured, the data acquisition controller finds all associated virtual ports based on the policy type and acquisition target, and sends the virtual ports, distribution targets, and distribution protocols to the corresponding data acquisition probes; the data acquisition probes find the corresponding virtual ports based on the data acquisition policy parameters received from the data acquisition controller and perform traffic acquisition and forwarding. In addition, the data acquisition probes dynamically detect changes in their local virtual ports in real time. When a local virtual port changes, the probes notify the data acquisition controller to update cloud resources, and thus update the data acquisition policy.

[0023] The improvement of this solution lies in two aspects: firstly, by deploying acquisition probes and acquisition controllers in the cloud environment, the function of cloud traffic acquisition and forwarding is realized; secondly, the acquisition probes realize real-time monitoring of local virtual ports, and when the virtual port changes, the acquisition controller is notified to update cloud resources to determine whether to update the acquisition policy, thereby realizing the management and synchronization of virtual ports.

[0024] In one possible implementation, the acquisition controller synchronizes cloud resources according to a second set frequency and compares the cloud resources with the cloud resources at the previous moment. If there is a change in the virtual port, the associated virtual port is updated and sent to the acquisition probe.

[0025] Understandably, this solution not only monitors changes in the local virtual port in real time through acquisition probes and updates the acquisition strategy accordingly to achieve virtual port management and synchronization, but also strengthens virtual port management and synchronization by periodically updating cloud resources through the acquisition controller and proactively determining whether to update the acquisition strategy.

[0026] The following section provides a detailed explanation of each step in the cloud traffic collection strategy management method.

[0027] The data collection probes in this solution can be deployed on the host machine, virtual machine, or container node, while the data collection controller, as the policy management terminal, can be deployed on the server.

[0028] In one possible implementation, the acquisition controller synchronizes cloud resources. Specifically, the acquisition controller interfaces with the cloud API of the hybrid cloud resource pool, inputs the interface parameters of the cloud resource pool, and synchronizes the cloud resources. Cloud resource types include: availability zones, host machines, virtual machines, VPCs, subnets, virtual ports, Kubernetes nodes, pods, namespaces, ingress, services, workloads, etc.

[0029] In one possible implementation, the collection strategy is determined based on the type of cloud resource. Specifically, for example: 1) the collection strategy for host-type cloud resources is defined as collecting traffic from all virtual machines on that host; 2) the collection strategy for VPC-type cloud resources is defined as collecting traffic from all virtual machines under that VPC; 3) the collection strategy for Service-type cloud resources is defined as collecting traffic from all Pods associated with the Service; 4) other types of cloud resources can correspond to a general collection strategy, which is defined as collecting traffic from communication between the specified network interface card of the host and the external environment.

[0030] Once a collection strategy is configured, the collection controller identifies all associated virtual ports based on the strategy type and the collection target. These virtual ports can also refer to Pods. The virtual ports, distribution targets, and distribution protocols are then sent to the corresponding collection probes.

[0031] The acquisition probe finds the corresponding virtual port based on the acquisition strategy parameters sent by the acquisition controller, and performs traffic acquisition and forwarding to the corresponding distribution target.

[0032] It should be noted that multiple collection strategies can be configured for the same data collection object to distribute traffic to different receiving targets. For example, for a virtual machine, multiple collection strategies can be configured to collect the traffic of the virtual machine and distribute it to different traffic receiving targets for analysis. Collection strategy 1 is distributed to traffic receiving target 1, and collection strategy 2 is distributed to traffic receiving target 2.

[0033] Simultaneously, the data acquisition probe detects changes in the local virtual port at a first set frequency, such as once per second. When the local virtual port differs from the virtual port acquired at the previous moment, it indicates a change in the virtual machine or Pod (changes include addition, migration, and deletion). The data acquisition probe notifies the data acquisition controller to synchronize the latest cloud resource information from the cloud platform. After synchronization, the data acquisition controller compares it with the cloud resources synchronized at the previous moment. If a virtual machine or Pod has been added, deleted, or migrated, the data acquisition probe is notified to update the data acquisition strategy. Additionally, the data acquisition controller also synchronizes the latest cloud resources from the cloud platform at a second set frequency, such as once every 10 minutes, and compares it with the cloud resources synchronized at the previous moment. When a virtual port or Pod changes, the data acquisition probe is notified in real time to update the strategy.

[0034] It should be noted that this solution achieves cloud traffic collection and forwarding by deploying collection probes and collection controllers in the cloud environment; the collection probes monitor changes to the local virtual ports in real time, and when the virtual ports change, they notify the collection controller to update cloud resources to determine whether to update the collection policy, thereby achieving virtual port management and synchronization; the collection controller updates cloud resources periodically and proactively determines whether to update the collection policy, thereby strengthening the management and synchronization of virtual ports.

[0035] Example 2 provides a cloud traffic collection strategy management device. Please refer to [link / reference]. Figure 2 As shown, Figure 2 This is a schematic diagram of a cloud traffic acquisition strategy management device. The device implements the cloud traffic acquisition strategy management method described above. The device includes: an acquisition probe and an acquisition controller deployed in the cloud environment; the acquisition controller synchronizes cloud resources, determines an acquisition strategy based on the type of cloud resources, and the acquisition strategy includes at least four parameters: strategy type, acquisition object, distribution target, and distribution protocol. Based on the strategy type and acquisition object, it determines the associated virtual port and sends the associated virtual port, along with the distribution target and distribution protocol, to the acquisition probe; the acquisition probe collects cloud traffic from the associated virtual port and forwards it to the distribution target according to the distribution protocol; the acquisition probe detects local virtual ports at a first set frequency, and sends a notification to the acquisition controller when a change occurs in the local virtual port; the acquisition controller synchronizes cloud resources based on the notification, compares the cloud resources with the previous cloud resources, and updates the associated virtual port if a change occurs, sending the update information to the acquisition probe.

[0036] In one possible implementation, the acquisition controller is further configured to synchronize cloud resources according to a second set frequency, compare the cloud resources with the cloud resources at the previous moment, and if there is a change in the virtual port, update the associated virtual port and send it to the acquisition probe.

[0037] In one possible implementation, the acquisition controller is specifically used to: interface with the cloud API of the cloud resource pool, and realize cloud resource synchronization by inputting the interface parameters of the cloud resource pool.

[0038] In one possible implementation, the acquisition controller is specifically configured to: define the acquisition strategy for host-type cloud resources as acquiring traffic from all virtual machines on the host; define the acquisition strategy for VPC-type cloud resources as acquiring traffic from all virtual machines under the VPC; define the acquisition strategy for Service-type cloud resources as acquiring traffic from all Pods associated with the Service; and define the general acquisition strategy as acquiring traffic from communication between a specified network interface card of the host and external systems.

[0039] Example 3 provides a server, including a processor and a memory, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is used to call the program instructions to execute the cloud traffic collection strategy management method described above.

[0040] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A cloud traffic collection strategy management method, characterized in that, The method is executed by a data acquisition probe and a data acquisition controller deployed in a cloud environment, and the method includes: The acquisition controller synchronizes cloud resources and determines an acquisition strategy based on the type of the cloud resources. The acquisition strategy includes at least four parameters: strategy type, acquisition object, distribution target, and distribution protocol. Based on the strategy type and acquisition object, it determines the associated virtual port and sends the associated virtual port, distribution target, and distribution protocol to the acquisition probe. Specifically, determining the acquisition strategy based on the type of cloud resources includes: defining the acquisition strategy for host-type cloud resources as acquiring traffic from all virtual machines on that host; defining the acquisition strategy for VPC-type cloud resources as acquiring traffic from all virtual machines under that VPC; defining the acquisition strategy for Service-type cloud resources as acquiring traffic from all Pods associated with the Service; and defining a general acquisition strategy as acquiring traffic from communication between a specified network interface card of the host and external systems. The acquisition probe collects cloud traffic from the associated virtual ports and forwards it to the distribution target according to the distribution protocol; The acquisition probe detects the local virtual port according to a first set frequency, and sends a notification to the acquisition controller when the local virtual port changes. The acquisition controller synchronizes cloud resources according to the notification, compares the cloud resources with the cloud resources at the previous moment, and if the virtual port has changed, it updates the associated virtual port and sends it to the acquisition probe.

2. The cloud traffic collection strategy management method according to claim 1, characterized in that, Also includes: The acquisition controller synchronizes cloud resources according to the second set frequency and compares the cloud resources with the cloud resources at the previous moment. If the virtual port has changed, the associated virtual port is updated and sent to the acquisition probe.

3. The cloud traffic collection strategy management method according to claim 1, characterized in that, The acquisition controller synchronizes cloud resources, including: the acquisition controller interfaces with the cloud API of the hybrid cloud resource pool, and realizes cloud resource synchronization by inputting the interface parameters of the cloud resource pool.

4. The cloud traffic collection strategy management method according to claim 1, characterized in that, The changes to the virtual ports include: addition, migration, and deletion.

5. A cloud traffic collection strategy management device, characterized in that, The device is used to implement a cloud traffic acquisition strategy management method as described in any one of claims 1-4, and the device includes: an acquisition probe and an acquisition controller deployed in a cloud environment; The acquisition controller is used to synchronize cloud resources and determine acquisition strategies based on the type of cloud resources. Each acquisition strategy includes at least four parameters: strategy type, acquisition object, distribution target, and distribution protocol. It determines the associated virtual port based on the strategy type and acquisition object, and sends the associated virtual port, distribution target, and distribution protocol to the acquisition probe. Specifically, the acquisition controller is used to: define the acquisition strategy for host-type cloud resources as acquiring traffic from all virtual machines on that host; define the acquisition strategy for VPC-type cloud resources as acquiring traffic from all virtual machines under that VPC; define the acquisition strategy for Service-type cloud resources as acquiring traffic from all Pods associated with the Service; and define a general acquisition strategy as acquiring traffic from communication between a specified network interface card of the host and external systems. The acquisition probe is used to collect cloud traffic from the associated virtual ports and forward it to the distribution target according to the distribution protocol; The acquisition probe is used to detect the local virtual port according to a first set frequency, and send a notification to the acquisition controller when the local virtual port changes. The acquisition controller is used to synchronize cloud resources according to the notification, compare the cloud resources with the cloud resources at the previous moment, and if the virtual port has changed, update the associated virtual port and send it to the acquisition probe.

6. The cloud traffic collection strategy management device according to claim 5, characterized in that, The acquisition controller is also used to synchronize cloud resources according to a second set frequency, and compare the cloud resources with the cloud resources at the previous moment. If the virtual port has changed, the associated virtual port is updated and sent to the acquisition probe.

7. The cloud traffic collection strategy management device according to claim 5, characterized in that, The acquisition controller is specifically used to: connect to the cloud API of the hybrid cloud resource pool, and realize cloud resource synchronization by inputting the connection parameters of the cloud resource pool.

8. A server, characterized in that, include: A processor and a memory, wherein the memory is used to store a computer program, the computer program including program instructions, and the processor is used to invoke the program instructions to execute a cloud traffic collection strategy management method as described in any one of claims 1 to 4.

Images