A method and apparatus for detecting session number overflow

Abstract

The application discloses a kind of session number over-limit detection method and device, to improve the accuracy of session number over-limit detection.The method comprises: receiving session number over-limit detection instruction, and according to the session number over-limit detection instruction, session data of pre-set time period is acquired;According to the session data of pre-set time period, determine the target abnormal time that meets screening condition, and according to the abnormal session quantity corresponding to the target abnormal time, determine session number threshold;The screening condition is used to select the highest confidence abnormal time from the abnormal time corresponding to the abnormal session data in the session data of pre-set time period;According to the session number threshold, determine the abnormal duration period that session quantity in the pre-set time period exceeds the session number threshold;According to the abnormal duration period, determine whether there is session number over-limit.

Description

Technical Field

[0001] This invention relates to the field of communications, and more particularly to a method and apparatus for detecting excessive session counts. Background Technology

[0002] With the continuous development and advancement of technology, the number of connected devices in users' homes is increasing. These devices establish a large number of sessions. If the network operator's session limit is exhausted, subsequent new connections will randomly fail, thus affecting the user's internet experience. Therefore, how to accurately detect session limit exceeding the limit has become an urgent problem to be solved.

[0003] Currently, the following methods are generally used in related technologies to detect excessive session counts:

[0004] Option 1: Use a clustering algorithm to determine the threshold for the number of sessions, and then determine whether there is a problem of exceeding the limit for the number of sessions based on this threshold.

[0005] However, when using Scheme 1, the clustering algorithm randomly selects cluster centers, meaning that the results of each clustering may be different. This may lead to the abnormal moment when the number of sessions exceeds the limit being judged as a normal moment, resulting in an incorrect judgment of the cause of the abnormal number of sessions. Consequently, the cause of network lag may be misidentified, thus affecting the user's online experience.

[0006] Option 2: Use manual estimation of the session count threshold, and then determine whether there is a session count exceeding the limit based on the session count threshold.

[0007] However, when using Option 2, different regions and different network operators have different limits on the number of sessions, and operators usually do not inform customers of the broadband session limit. Furthermore, the manually set session threshold is inaccurate and varies between different devices. Therefore, there is a possibility of incorrect estimation of the session threshold, which may lead to misidentification of the cause of network lag.

[0008] In summary, the relevant technologies have the problem of not being able to accurately determine the threshold for the number of sessions when detecting excessive session counts. Summary of the Invention

[0009] This invention provides a method and apparatus for detecting excessive session counts, which improves the accuracy of determining the session count threshold, thereby improving the accuracy of detecting excessive session counts.

[0010] Firstly, a method for detecting excessive session counts is provided, the method comprising:

[0011] Receive a session count exceeding limit detection instruction, and obtain session data for a preset time period according to the session count exceeding limit detection instruction;

[0012] Based on the session data within the preset time period, target abnormal moments that meet the filtering criteria are determined, and a session number threshold is determined based on the number of abnormal sessions corresponding to the target abnormal moments; the filtering criteria are used to select the abnormal moments with the highest confidence from the abnormal session data corresponding to the abnormal moments in the session data within the preset time period.

[0013] Based on the session count threshold, determine the abnormal duration period in which the number of sessions exceeds the session count threshold within the preset time period;

[0014] Based on the duration of the abnormality, determine whether the number of sessions has exceeded the limit.

[0015] In one possible implementation, determining the target abnormal time that meets the filtering criteria based on the session data within the preset time period includes:

[0016] At least two anomaly detection methods are used to detect the session data within the preset time period, and the anomaly time corresponding to at least one abnormal session data for each anomaly detection method is obtained.

[0017] From the abnormal times corresponding to the at least one abnormal session data obtained, the target abnormal times that meet the filtering conditions are determined.

[0018] In one possible implementation, at least two anomaly detection methods are used to detect session data within the preset time period, and the anomaly time corresponding to at least one abnormal session data for each anomaly detection method is obtained, including:

[0019] For each anomaly detection method, the following operations are performed on the session data:

[0020] The session data is inspected to obtain a first anomaly score corresponding to each moment within the preset time period; wherein, the first anomaly score is used to characterize the probability that the number of sessions exceeds the limit at any moment within the preset time period;

[0021] From the multiple first abnormal scores obtained, first candidate abnormal scores that meet the first preset conditions are selected, and the time corresponding to the first candidate abnormal score is taken as the abnormal time.

[0022] In one possible implementation, determining the target abnormal time that meets the filtering criteria from the abnormal times corresponding to the at least one abnormal session data time obtained includes:

[0023] Add the abnormal moments at the same time to a candidate abnormal moment set to obtain at least one candidate abnormal moment set;

[0024] From the at least one set of candidate abnormal times, select the set of candidate abnormal times that contains the most abnormal times as the first set of candidate abnormal times, and use the abnormal times contained in the first set of candidate abnormal times as the target abnormal times.

[0025] In one possible implementation, determining whether a session count limit has been exceeded based on the abnormal duration period includes:

[0026] The preset time period is divided into equal segments according to the chronological order to obtain the first sub-time period, the second sub-time period, and so on up to the Nth sub-time period, where N is not less than 2.

[0027] If the abnormal duration of the m-th sub-time period is greater than the abnormal duration of the n-th sub-time period, then it is determined that the number of sessions has exceeded the limit, where m is greater than n.

[0028] In one possible implementation, determining whether a session count limit has been exceeded based on the abnormal duration period includes:

[0029] The preset time period is divided into a first sub-time period and a second sub-time period; the first sub-time period and the second sub-time period have the same duration, and the first sub-time period is earlier than the second sub-time period;

[0030] If the abnormal duration of the second sub-time period is longer than the abnormal duration of the first sub-time period, then it is determined that the number of sessions has exceeded the limit.

[0031] In one possible implementation, after acquiring session data for a preset time period, the method further includes:

[0032] The session data is normalized to obtain processed session data.

[0033] In one possible implementation, the method further includes:

[0034] If it is determined that the number of sessions has exceeded the limit, a prompt message is issued, wherein the prompt message is used to indicate that the number of sessions has exceeded the limit.

[0035] Secondly, an apparatus for detecting excessive session counts is provided, the apparatus comprising:

[0036] The processing unit is used to receive a session count exceeding the limit detection instruction and, according to the session count exceeding the limit detection instruction, obtain session data for a preset time period;

[0037] The first detection unit determines the target abnormal time that meets the filtering conditions based on the session data of the preset time period, and determines the session number threshold based on the number of abnormal sessions corresponding to the target abnormal time. The filtering conditions are used to select the abnormal time with the highest confidence from the abnormal time corresponding to the abnormal session data in the session data of the preset time period.

[0038] The determining unit is configured to determine, based on the session count threshold, an abnormal duration period in which the number of sessions exceeds the session count threshold within the preset time period;

[0039] The second detection unit is used to determine whether the number of sessions exceeds the limit based on the abnormal duration period.

[0040] In one possible implementation, the first detection unit is specifically used for:

[0041] At least two anomaly detection methods are used to detect the session data within the preset time period, and the anomaly time corresponding to at least one abnormal session data for each anomaly detection method is obtained.

[0042] From the abnormal times corresponding to the at least one abnormal session data obtained, the target abnormal times that meet the filtering conditions are determined.

[0043] In one possible implementation, the first detection unit is specifically used for:

[0044] For each anomaly detection method, the following operations are performed on the session data:

[0045] The session data is inspected to obtain a first anomaly score corresponding to each moment within the preset time period; wherein, the first anomaly score is used to characterize the probability that the number of sessions exceeds the limit at any moment within the preset time period;

[0046] From the multiple first abnormal scores obtained, first candidate abnormal scores that meet the first preset conditions are selected, and the time corresponding to the first candidate abnormal score is taken as the abnormal time.

[0047] In one possible implementation, the first detection unit is specifically used for:

[0048] Add the abnormal moments at the same time to a candidate abnormal moment set to obtain at least one candidate abnormal moment set;

[0049] From the at least one set of candidate abnormal times, select the set of candidate abnormal times that contains the most abnormal times as the first set of candidate abnormal times, and use the abnormal times contained in the first set of candidate abnormal times as the target abnormal times.

[0050] In one possible implementation, the second detection unit is specifically used for:

[0051] The preset time period is divided into equal segments according to the chronological order to obtain the first sub-time period, the second sub-time period, and so on up to the Nth sub-time period, where N is not less than 2.

[0052] If the abnormal duration of the m-th sub-time period is greater than the abnormal duration of the n-th sub-time period, then it is determined that the number of sessions has exceeded the limit, where m is greater than n.

[0053] In one possible implementation, the second detection unit is specifically used for:

[0054] The preset time period is divided into a first sub-time period and a second sub-time period; the first sub-time period and the second sub-time period have the same duration, and the first sub-time period is earlier than the second sub-time period;

[0055] If the abnormal duration of the second sub-time period is longer than the abnormal duration of the first sub-time period, then it is determined that the number of sessions has exceeded the limit.

[0056] In one possible implementation, after acquiring session data for a preset time period, the processing unit is further configured to:

[0057] The session data is normalized to obtain processed session data.

[0058] In one possible implementation, the device further includes a prompting unit for:

[0059] If it is determined that the number of sessions has exceeded the limit, a prompt message is issued, wherein the prompt message is used to indicate that the number of sessions has exceeded the limit.

[0060] Thirdly, a network device is provided, the network device comprising:

[0061] Memory, used to store program instructions;

[0062] A processor is configured to invoke program instructions stored in the memory and execute the steps included in any of the methods in the first aspect according to the obtained program instructions.

[0063] Fourthly, a storage medium is provided that stores computer-executable instructions for causing a network device to perform the steps included in any of the methods in the first aspect.

[0064] Fifthly, a computer program product is provided that, when the computer program product is run on a network device, enables the network device to perform the steps included in any of the methods in the first aspect.

[0065] The technical solutions provided by the embodiments of the present invention bring at least the following beneficial effects:

[0066] Upon receiving a session count exceeding detection command, the network device automatically retrieves session data for a preset time period based on the command. Then, based on the session data within the preset time period, the network device determines the target abnormal time that meets the filtering criteria, and determines the session count threshold based on the number of abnormal sessions corresponding to the target abnormal time. Clearly, this embodiment of the invention selects the abnormal time with the highest confidence level from among the abnormal times determined by various methods, thereby obtaining a more accurate target abnormal time and consequently a more accurate session count threshold.

[0067] Furthermore, network devices can determine the abnormal duration period within a preset time period where the number of sessions exceeds the session count threshold, and then determine whether the session count has exceeded the limit based on the abnormal duration period. It is evident that network devices can determine whether the session count has exceeded the limit by comparing the abnormal duration period at different times within the preset time period, i.e., by using a year-on-year comparison method. Thus, by determining the abnormal duration period based on the relatively accurate session count threshold, and combining this with the changes in the abnormal duration period at different times, a more accurate determination of whether the session count has exceeded the limit can be made.

[0068] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practice. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings.

[0069] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description

[0070] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention, but do not constitute an undue limitation of the invention.

[0071] Figure 1 This is a schematic diagram of an application scenario in an embodiment of the present invention;

[0072] Figure 2 This is a flowchart of a method for detecting excessive session counts in an embodiment of the present invention;

[0073] Figure 3 This is a flowchart of another method for detecting excessive session counts in an embodiment of the present invention;

[0074] Figure 4 This is a structural block diagram of the device for detecting excessive session counts in an embodiment of the present invention;

[0075] Figure 5 This is a schematic diagram of the network device in an embodiment of the present invention. Detailed Implementation

[0076] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention. Unless otherwise specified, the embodiments and features in the embodiments of this invention can be arbitrarily combined with each other. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0077] The terms "first" and "second" in the specification, claims, and accompanying drawings of this invention are used for descriptive purposes only and should not be construed as indicating or implying relative importance or order. Furthermore, the term "comprising" and any variations thereof are intended to cover non-exclusive protection. For example, a process, method, system, product, or apparatus that comprises a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such processes, methods, products, or apparatus.

[0078] With the advent of the Internet of Things (IoT) era, the number of connected devices in homes is increasing, consuming a significant amount of session data. If this session count reaches the threshold set by network operators, it can cause network congestion and negatively impact the user's internet experience. Existing solutions primarily rely on manually setting session count thresholds or using algorithms such as clustering to identify abnormal sessions. These methods have the following limitations:

[0079] Currently, existing methods for detecting excessive session counts include manually determining the session count threshold or using clustering algorithms. However, the accuracy of the session count threshold determined by these existing methods is poor, resulting in poor accuracy in detecting excessive session counts.

[0080] In view of this, the present invention provides a method for detecting excessive session counts. This method employs at least two efficient unsupervised anomaly detection algorithms, based on a voting method, to comprehensively determine the abnormal time, and determines the session count threshold based on the number of sessions corresponding to the abnormal time. This allows for dynamic identification of the session count threshold. Furthermore, since the session count threshold is determined by combining multiple anomaly detection algorithms, the determined session count threshold is relatively accurate, thereby enabling relatively accurate detection of excessive session counts.

[0081] After introducing the design concept of the embodiments of the present invention, the following is a brief introduction to the application scenarios applicable to the technical solutions of the embodiments of the present invention. It should be noted that the application scenarios described in the embodiments of the present invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of the present invention, and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. As those skilled in the art will know, with the emergence of new application scenarios, the technical solutions provided by the embodiments of the present invention are also applicable to similar technical problems.

[0082] Please see Figure 1 The diagram illustrates a scenario to which the invention can be applied, including multiple network devices 101 and network equipment 102. Figure 1 The following example illustrates the interaction between three networked devices (e.g., networked device 101-1, networked device 101-2, and networked device 101-3) and one network device 102. In actual implementation, the number of networked devices 101 can also be four, sixteen, etc., and this embodiment of the invention is not limited thereto.

[0083] The network device 101 and the network device 102 can communicate with each other via network 103. This network 103 can be a wired network or a wireless network. For example, the wireless network can be a mobile cellular network or a Wi-Fi (Wireless-Fidelity) network. Of course, it can also be other possible networks, and this embodiment of the invention does not limit them.

[0084] The network device 101 can be any network-enabled device in the home, such as a mobile phone, tablet, laptop, or other portable network device. For example, this portable network device can be equipped with... Alternatively, it can be another operating system. Furthermore, the networked device can also be a wearable device such as a watch or bracelet; or it can be a smart home device such as a television or refrigerator. In short, the embodiments of this invention do not limit the specific type of networked device.

[0085] Network device 102 can be understood as a switch or gateway. The switch or gateway connects to the broadband network provided by the network operator, and users connect to the internet through networking device 101, which then connects to the switch or gateway. During the interaction between networking device 101 and the internet, sessions are generated and transmitted within the switch or gateway.

[0086] To further illustrate the method for detecting excessive session counts provided in the embodiments of the present invention, a detailed description is provided below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiments of the present invention provide method operation steps as shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on conventional or non-inventive methods. In steps where there is no logically necessary causal relationship, the execution order of these steps is not limited to the execution order provided in the embodiments of the present invention. In actual processing or device execution, the method may be executed sequentially according to the embodiments or drawings, or in parallel (e.g., in a parallel processor or multi-threaded processing application environment).

[0087] The following combination Figure 2 The flowchart shown illustrates the method for detecting excessive session counts in an embodiment of the present invention. Figure 2 The steps shown can be derived from, for example: Figure 1 The network device shown is executing.

[0088] Step 201: The network device receives a session count exceeding the limit detection command and obtains session data for a preset time period based on the session count exceeding the limit detection command.

[0089] In this embodiment of the invention, the network device can receive a session limit exceeding detection command sent by a user through any of their networked devices. In one embodiment, the session limit exceeding detection command may be triggered by the user selecting the function key for session limit exceeding detection on any of their networked devices when they discover network lag. In another embodiment, the session limit exceeding detection command may be triggered by the user performing a corresponding touch or click operation in the network diagnostic interface of any of their networked devices when they discover network lag. In one embodiment, in addition to the above-mentioned touch or click operation, it can also be a long press operation, a gravity press operation, a swipe operation, etc., and this embodiment of the invention does not limit the specific implementation form of the operation.

[0090] In this embodiment of the invention, when a network device receives a session count exceeding the limit detection command, it can obtain session data for a preset time period based on the command. Optionally, the preset time period may be, for example, 14 days prior to the time the session count exceeding the limit detection command is received, or one month prior to the time the command is received; this embodiment of the invention does not limit the preset time period. The network device can obtain the number of sessions within the network device at each moment within the preset time period.

[0091] In this embodiment of the invention, after the network device obtains session data for a preset time period, it can process the session data according to the following step 202.

[0092] Step 202: The network device determines the target abnormal time that meets the filtering criteria based on the session data of the preset time period, and determines the session number threshold based on the number of abnormal sessions corresponding to the target abnormal time. The filtering criteria are used to select the abnormal time with the highest confidence from the abnormal session data corresponding to the abnormal time in the session data of the preset time period.

[0093] In this embodiment of the invention, the network device employs at least two anomaly detection methods to detect session data over a preset time period, obtaining the anomaly time corresponding to at least one abnormal session data for each anomaly detection method. Then, the network device determines the target anomaly time that meets the filtering criteria from the at least one anomaly time corresponding to the obtained anomaly time of abnormal session data.

[0094] In this embodiment of the invention, each of at least two anomaly detection methods employs unsupervised learning to detect session data over a preset time period. Unsupervised learning allows the electronic device to autonomously analyze and find features or patterns in the session data within the preset time period without needing pre-labeled data. For example, since the anomaly of exceeding the session limit is a boundary anomaly, meaning a clear decision boundary is required to completely separate the anomaly, unsupervised learning can be used to analyze and find this decision boundary. Due to the rarity of outliers in session data, related technologies require manual labeling by professional maintenance personnel, increasing human resource costs. However, the unsupervised learning method used in this embodiment eliminates the need for manual labeling by professional maintenance personnel, reducing human resource costs and improving detection efficiency.

[0095] In this embodiment of the invention, the network device can determine at least two anomaly detection methods for detecting session data. Each of the at least two anomaly detection methods can be implemented based on an anomaly detection algorithm; that is, the network device can determine at least two anomaly detection algorithms for detecting session data. Optionally, the at least two anomaly detection algorithms include at least two of the following: cluster-based local outlier factor (CBLOF) anomaly detection algorithm, box-plot anomaly detection algorithm, isolation forest (iForest) anomaly detection algorithm, k-nearest neighbors anomaly detection algorithm, minimum covariance determinant (MCD) anomaly detection algorithm, and one-class support vector machine (OCSVM) anomaly detection algorithm.

[0096] Before introducing the method for detecting session data, the following example illustrates the anomaly detection algorithm provided in this embodiment of the invention.

[0097] The first anomaly detection algorithm: CBLOF anomaly detection algorithm.

[0098] The first step in the CBLOF anomaly detection algorithm is clustering, for example, using the k-means algorithm. Optionally, two principles can be used to distinguish between large and small clusters: the absolute logarithmic principle and the drop-off principle. The absolute logarithmic principle means that clusters are arranged in descending order of the number of samples within each cluster, starting with the largest cluster, and the number of samples in each cluster is added up sequentially. The number of large clusters should reach an absolute majority of the total number of samples. This absolute majority is a configurable parameter α, ranging from 0.5 to 1. The drop-off principle refers to whether there is a sudden drop in the number of samples among the clusters arranged by size. If a drop occurs, it is the dividing line between large and small clusters.

[0099] The second step of the CBLOF anomaly detection algorithm is to calculate the LOF factor, which is the distance from a given time point to the nearest large cluster. If the time point is within a large cluster, the distance from that time point to the cluster center is calculated to obtain the LOF factor; if the time point is not within a large cluster, the distance from that time point to all large clusters is calculated, and the smallest distance is selected as the LOF factor.

[0100] Using the first anomaly detection algorithm, the smaller the LOF factor corresponding to a time point, the higher the probability that the time point is close to a large cluster and is a normal time point; conversely, the larger the LOF factor corresponding to a time point, the higher the probability that the time point is far from a large cluster and is an anomalous time point. Thus, based on the magnitude of the LOF factor corresponding to a time point and the correspondence between the LOF factor and the anomaly score, the first anomaly score for that time point can be determined.

[0101] The second type of anomaly detection algorithm: box plot anomaly detection algorithm.

[0102] Box plots are primarily used to reflect the central location and distribution range of one or more sets of continuous quantitative data. A box plot is a graphical representation formed by the quartiles of the dataset. The upper and lower bands represent the boundaries of the data distribution; data points above the upper band or below the lower band are considered outliers or anomalies.

[0103] The lower quartile represents the value corresponding to the 25th percentile (e.g., Q1), and the upper quartile represents the value corresponding to the 75th percentile (e.g., Q3). The upper quartile represents Q3 + 1.5 (Q3 - Q1), and the lower quartile represents Q1 - 1.5 (Q3 - Q1).

[0104] If the second anomaly detection algorithm is adopted, considering that the time points when the number of sessions exceeds the limit are all time points when the number of sessions is abnormally high, the first anomaly score at that time point can be determined by the value of the session data corresponding to a certain time point that is higher than the upper limit, combined with the preset correspondence between the value higher than the upper limit and the anomaly score.

[0105] The third anomaly detection algorithm: iForest anomaly detection algorithm.

[0106] Like Random Forest, which consists of a large number of decision trees, the iForest algorithm is also composed of a large number of binary trees, making it a completely random process. Assuming the dataset has N time points, when constructing a binary tree, n samples are uniformly sampled from the N data points as training samples for the tree. Here, N and n are positive integers, and N is greater than n. From the training samples, a feature is randomly selected, and a value is randomly chosen within the range of all values ​​of this feature (e.g., between the minimum and maximum values). The training samples are then binary-parted, with values ​​less than the selected value assigned to the left of the node, and values ​​greater than or equal to the selected value assigned to the right. This results in a split condition and the left and right datasets. The above process is repeated on both the left and right datasets until the dataset contains only one record or the height limit of the binary tree is reached. The record corresponding to this outlier time point is then designated as the root.

[0107] Considering that the data at abnormal times is small and the feature values ​​differ significantly from normal data, when constructing the binary tree, data at abnormal times are closer to the root, while normal data are farther from the root. Since the result of a single binary tree is often unreliable, the iForest anomaly detection algorithm constructs multiple binary trees through multiple sampling. Finally, it integrates the results of all trees, takes the average depth as the final root, and calculates the first anomaly score for each abnormal time based on the distance of the data from the root at each time step.

[0108] The fourth type of anomaly detection algorithm: k-nearest neighbor anomaly detection algorithm.

[0109] The k-nearest neighbor algorithm states that if a sample point is most similar to k sample points in a dataset, and most of these k sample points belong to a certain class, then the sample point also belongs to that class.

[0110] The k-nearest neighbor anomaly detection algorithm mainly consists of three steps. The first step is to calculate the distance between the current point and every other point in the dataset for each sample point in the dataset. The distance is usually measured using Euclidean distance. The calculation is performed, where x2 represents the number of sessions at time 2 and x1 represents the number of sessions at time 1, where time 1 is earlier than time 2; the second step is to sort all the distances obtained in ascending order, where the smaller the distance, the more similar the points are; the third step is to take the mean of the distances of the first k sample points as the first outlier score of the current point.

[0111] The advantages of the k-nearest neighbor algorithm in detecting outliers in time series data are its short training time, lack of assumptions about the data, and high accuracy.

[0112] The fifth anomaly detection algorithm: MCD anomaly detection algorithm.

[0113] Consider an n x p matrix X n×p From this, h sample points are randomly selected, and the sample mean T1 and covariance matrix S1 of these h sample points are calculated. Then, through... Here, x represents the number of sessions. The Mahalanobis distance from these n sample points to the sample mean T1 is calculated. The h sample points with the smallest distances among these n points are selected, and then the sample mean T2 and covariance matrix S2 are calculated using these h sample points. At this point, it can be determined that det(S2) ≤ det(S1) if and only if T1 = T2 and S1 = S2, the equality holds. This process is iterated continuously until det(S1) ≤ det(S2). m ) = det(S m-1 Stop iteration when S is reached. Then proceed through S again. m By performing weighted calculations, we can obtain an estimate of the covariance matrix, which can be used as an anomaly moment.

[0114] For example, if we represent the fifth anomaly detection algorithm graphically, it can be understood as continuously searching for a hyperellipsoid containing h sample points with the shortest distance to the sample center, thus excluding the remaining nh sample points from the hyperellipsoid. In other words, the first anomaly score is determined based on the distance from the h sample points to the sample center.

[0115] The sixth anomaly detection algorithm: OCSVM anomaly detection algorithm.

[0116] The core idea of ​​the OCSVM algorithm is to find a hyperplane that encloses positive examples in the sample. The algorithm then uses this hyperplane to make decisions about the samples; samples within the enclosed hyperplane are considered positive. Assume the generated hypersphere parameters are the center o and the corresponding hypersphere radius r > 0, the hypersphere volume V(r) is minimized, and the center o is a linear combination of support lines. Similar to the traditional SVM method, it can be required that the distance from all training data points x_i to the center is strictly less than r. However, a slack variable ξ_i with a penalty coefficient C is constructed simultaneously. The optimization problem is as follows:

[0117]

[0118] ||x i -o‖2≤r+ξ i i = 1, 2, 3, ..., m

[0119] ξ i ≥0, i=1,2,…,m

[0120] After solving using Lagrange duality, it can be determined whether the new sample point z is inside the hypersphere. If the distance from z to the center is less than or equal to the radius r, it is not an outlier. If it is outside the hypersphere, it can be considered a candidate outlier. Furthermore, based on the distance of the new sample point z outside the hypersphere, combined with the correspondence between preset distance values ​​and outlier scores, the first outlier score corresponding to the new sample point can be determined.

[0121] In this embodiment of the invention, the network device may employ at least two of the aforementioned six anomaly detection algorithms to detect session data. In one embodiment, the electronic device may employ the CBLOF anomaly detection algorithm and the box plot anomaly detection algorithm to detect session data. In another embodiment, the network device may also employ the iForest anomaly detection algorithm, the k-nearest neighbor anomaly detection algorithm, and the MCD anomaly detection algorithm to detect session data. In yet another embodiment, the network device may also employ the CBLOF anomaly detection algorithm, the box plot anomaly detection algorithm, the iForest anomaly detection algorithm, the k-nearest neighbor anomaly detection algorithm, the MCD anomaly detection algorithm, and the OCSVM anomaly detection algorithm to detect session data. This embodiment of the invention does not limit the types or specific number of anomaly detection algorithms used.

[0122] The following text uses examples of network devices employing the CBLOF anomaly detection algorithm, box plot anomaly detection algorithm, iForest anomaly detection algorithm, k-nearest neighbor anomaly detection algorithm, MCD anomaly detection algorithm, and OCSVM anomaly detection algorithm to detect session data, to illustrate how to detect session data.

[0123] In this embodiment of the invention, the network device may use each of the aforementioned six anomaly detection algorithms to perform the following operations on the session data:

[0124] Step A: Detect the session data and obtain the first anomaly score corresponding to each moment within a preset time period; wherein, the first anomaly score is used to characterize the probability that the number of sessions exceeds the limit at any moment within the preset time period;

[0125] Step B: From the multiple first abnormal scores obtained, select the first candidate abnormal score that meets the first preset condition, and take the time corresponding to the first candidate abnormal score as the abnormal time.

[0126] In one possible embodiment, after acquiring session data for a preset time period, the network device can further normalize the session data to obtain processed data. Since the processed data falls within a fixed range—that is, the number of sessions within the preset time period is adjusted to a certain order of magnitude—it provides a good foundation for subsequent processing.

[0127] Accordingly, the anomaly detection algorithm can perform the following adjusted steps on the processed session data:

[0128] Step a: Detect the processed data to obtain the first anomaly score for each moment within a preset time period; wherein, the first anomaly score is used to characterize the probability that the number of sessions exceeds the limit at any moment within the preset time period;

[0129] Step b: From the multiple obtained first abnormal scores, select the first candidate abnormal scores that meet the first preset conditions, and take the time corresponding to the first candidate abnormal score as the abnormal time. In this way, a more accurate abnormal time can be obtained.

[0130] Optionally, the first preset condition corresponding to each anomaly detection method can be the same or different, and can be set according to the actual implementation. This embodiment of the invention does not impose any restrictions on this. For example, the first preset condition is that the first anomaly score is greater than a preset threshold, and the preset threshold is determined according to the anomaly detection method used.

[0131] In this embodiment of the invention, the specific process by which the network device uses the aforementioned six anomaly detection algorithms to process the processed session data can be found in the foregoing detailed description of the six anomaly detection algorithms, and will not be repeated here. In this way, the network device can obtain the first anomaly score corresponding to each of the six anomaly detection algorithms.

[0132] For example, the first anomaly score for each moment within 14 days corresponding to the first anomaly detection algorithm, the first anomaly score for each moment within 14 days corresponding to the second anomaly detection algorithm, the first anomaly score for each moment within 14 days corresponding to the third anomaly detection algorithm, the first anomaly score for each moment within 14 days corresponding to the fourth anomaly detection algorithm, the first anomaly score for each moment within 14 days corresponding to the fifth anomaly detection algorithm, and the first anomaly score for each moment within 14 days corresponding to the sixth anomaly detection algorithm.

[0133] After the network device obtains the first anomaly scores corresponding to the six anomaly detection algorithms, it can determine the corresponding first preset conditions for each. In one embodiment, the first preset condition can be understood as selecting the first anomaly score that is greater than the average score within a preset time period as the first candidate anomaly score. In another embodiment, the first preset condition can be understood as selecting the top M highest first anomaly scores, where M is a positive integer. Of course, the first preset condition can also be other conditions, and this embodiment of the invention does not limit them. The first preset conditions corresponding to each anomaly detection algorithm may be the same or different, and this embodiment of the invention does not limit them.

[0134] Once the network device determines the first preset conditions corresponding to each of the six anomaly detection algorithms, it can filter out at least one abnormal moment corresponding to each of the six anomaly detection algorithms based on the first preset conditions. Furthermore, once the network device determines at least one abnormal moment corresponding to each of the six anomaly detection algorithms, it can determine the target abnormal moment.

[0135] In this embodiment of the invention, the network device can select at least one candidate abnormal time set from at least one abnormal time corresponding to at least two different anomaly detection algorithms, and select the candidate abnormal time set containing the most abnormal times as the first candidate abnormal time set, and use the abnormal times contained in the first candidate abnormal time set as the target abnormal time.

[0136] Optionally, the network device can select at least one abnormal time from the at least one abnormal time corresponding to each of the six anomaly detection algorithms, and put the abnormal times at the same time into a candidate abnormal time set to obtain at least one candidate abnormal time set; from the at least one candidate abnormal time set, select the candidate abnormal time set containing the most abnormal times as the first candidate abnormal time set, and use the abnormal times contained in the first candidate abnormal time set as the target abnormal time.

[0137] For example, the first type of anomaly detection corresponds to at least one anomalous time including 3:05 AM on day 5 and 12:30 PM on day 7; the second type of anomaly detection corresponds to at least one anomalous time including 3:05 AM on day 5 and 12:30 PM on day 4; the third type of anomaly detection corresponds to at least one anomalous time including 3:05 AM on day 5 and 1:30 AM on day 1; the fourth type of anomaly detection corresponds to at least one anomalous time including 12:20 PM on day 4; the fifth type of anomaly detection corresponds to at least one anomalous time including 11:30 AM on day 7; and the sixth type... If at least one anomalous time corresponding to the anomaly detection includes 3:05 AM on day 5, 12:30 PM on day 6, and 1:30 AM on day 1, then two candidate anomalous time sets can be identified: one containing three anomalous times corresponding to 3:05 AM on day 5, and the other containing two anomalous times corresponding to 1:30 AM on day 1. Therefore, the candidate anomalous time set containing three anomalous times corresponding to 3:05 AM on day 5 can be determined as the first candidate anomalous time set, and the target anomalous time can be determined as 3:04 AM on day 5. In other words, the anomalous time of 3:04 AM on day 5 is determined by a vote of three out of six algorithms, meaning that the anomalous time of 3:04 AM on day 5 has the highest confidence level, thus the target anomalous time is determined to be 3:04 AM on day 5.

[0138] In this embodiment of the invention, after determining the target abnormal time, the number of abnormal sessions corresponding to the target abnormal time can be used as the session count threshold. For example, the number of abnormal sessions at 3:05 AM on the 5th day, which is 50, can be used as the session count threshold.

[0139] As can be seen, in this embodiment of the invention, based on historical data of the number of sessions, a variety of efficient anomaly detection algorithms are used to select the target anomaly moment based on the voting method, and the number of sessions at the target anomaly moment is used as the session number threshold, thereby realizing the dynamic identification of the session number threshold.

[0140] Step 203: The network device determines the abnormal duration period in which the number of sessions exceeds the session number threshold within a preset time period based on the session number threshold.

[0141] In this embodiment of the invention, after obtaining the session count threshold, the network device can determine the abnormal duration period in which the number of sessions exceeds the session count threshold within a preset time period based on the session count threshold.

[0142] In one embodiment, the network device can determine the duration of abnormal session counts each day within a preset time period based on a session count threshold. Optionally, since shorter abnormal session count durations generally do not affect the user's internet experience, cases with durations shorter than a preset value can be excluded. The preset value can be 10 minutes, 5 minutes, etc., and this is not limited in this embodiment of the invention.

[0143] Step 204: Determine whether the number of sessions exceeds the limit based on the abnormal duration period.

[0144] In this embodiment of the invention, a high number of sessions does not necessarily indicate that the session limit has been exceeded. User actions such as opening peer-to-peer (P2P) applications or connecting more devices can also increase the session count, but these increases may not necessarily reach the session count threshold set by the network operator, thus causing network lag. Furthermore, an increased session count can cause network lag, affecting the user's internet experience, which is why users will use the session count exceedance anomaly detection function to troubleshoot network issues.

[0145] This invention proposes a year-on-year comparison method. After the user runs the function to detect abnormal session counts, the trend of abnormal session count duration in sub-time periods within a preset time period is compared to determine whether abnormal session counts exist.

[0146] In one possible implementation, the network device divides a preset time period into equal segments according to chronological order, obtaining the first sub-time period, the second sub-time period, and so on up to the Nth sub-time period, where N is not less than 2. If the abnormal duration of the m-th sub-time period is longer than the abnormal duration of the n-th sub-time period, then it is determined that the number of sessions has exceeded the limit, where m is greater than n. Here, N, m, and n are positive integers. The proportion of the equal segments is determined based on the actual implementation, and is not limited in this embodiment of the invention.

[0147] Optionally, when comparing the abnormal time period in the m-th sub-time period and the abnormal time period in the n-th sub-time period, the abnormal time periods of each day in the aforementioned two sub-time periods can be compared, or the longest abnormal time period of each day in the aforementioned two sub-time periods can be compared. Of course, it is also possible to compare only specific abnormal time periods. This embodiment of the invention does not impose any restrictions on this.

[0148] In one embodiment, assuming a preset time period of 8 days (from March 1st to March 8th), the 8 days are divided into four equal sub-time periods. For example, March 1st to March 2nd is the first sub-time period, March 3rd to March 4th is the second sub-time period, March 5th to March 6th is the third sub-time period, and March 7th to March 8th is the fourth sub-time period. The network device can determine the longest duration of abnormal session counts per day in these four sub-time periods.

[0149] Optionally, if the abnormal duration of the second sub-time period is longer than the abnormal duration of the first sub-time period, it indicates that the number of sessions has exceeded the limit; otherwise, it does not, and the network failure is caused by other reasons.

[0150] Optionally, if the abnormal duration of the fourth sub-time period is longer than the abnormal duration of the third sub-time period, it indicates that the number of sessions has exceeded the limit.

[0151] Optionally, if the abnormal duration of the second sub-time period is equal to the abnormal duration of the first sub-time period, and the abnormal duration of the third sub-time period is equal to the abnormal duration of the second sub-time period, but the abnormal duration of the fourth sub-time period is greater than the abnormal duration of the first sub-time period, then it indicates that the number of sessions has exceeded the limit; otherwise, it does not, and the network failure is caused by other reasons.

[0152] Optionally, if the abnormal duration of the second sub-time period is equal to the abnormal duration of the first sub-time period, and the abnormal duration of the third sub-time period is less than the abnormal duration of the second sub-time period, but the abnormal duration of the fourth sub-time period is greater than the abnormal duration of the third sub-time period, then it indicates that the number of sessions has exceeded the limit; otherwise, it does not, and the network failure is caused by other reasons.

[0153] As can be seen, in this embodiment of the invention, if an abnormal duration in the next sub-time period is longer than the abnormal duration in the previous sub-time period, it is considered that the number of sessions has exceeded the limit.

[0154] In one possible implementation, the network device can divide a preset time period into a first sub-time period and a second sub-time period; the first sub-time period and the second sub-time period have the same duration, and the first sub-time period is earlier than the second sub-time period; if the abnormal duration of the second sub-time period is longer than the abnormal duration of the first sub-time period, it is determined that the number of sessions has exceeded the limit; if the abnormal duration of the second sub-time period is shorter than the abnormal duration of the first sub-time period, it is determined that the number of sessions has not exceeded the limit.

[0155] Optionally, when comparing the abnormal time periods in the second sub-time period and the abnormal time periods in the first sub-time period, the abnormal time periods of each day in the aforementioned two sub-time periods can be compared, or the longest abnormal time period of each day in the aforementioned two sub-time periods can be compared. Of course, it is also possible to compare only specific abnormal time periods. This embodiment of the invention does not impose any restrictions on this.

[0156] In one embodiment, assuming the preset time period is 14 days, the 14 days are divided into two sub-time periods, for example, the first 7 days are the first sub-time period and the last 7 days are the second sub-time period. The network device can determine the longest abnormal duration of the number of sessions per day in the first 7 days and the longest abnormal duration of the number of sessions per day in the last 7 days. If the abnormal duration of the number of sessions per day in the first 7 days shows a significant upward trend in the last 7 days, it indicates that the number of sessions has exceeded the limit. Otherwise, it does not, and the network failure is caused by other reasons.

[0157] In another embodiment, assuming the preset time period is 14 days, the 14 days are divided into two sub-time periods. For example, the first 7 days are taken as the first sub-time period and the last 7 days are taken as the second sub-time period. The network device can determine the abnormal duration of the daily session count for the first 7 days and the abnormal duration of the daily session count for the last 7 days. If the abnormal duration of the last 7 days is greater than that of the first 7 days, it indicates that there is a situation where the number of sessions exceeds the limit. Otherwise, there is no such situation, and the network failure is caused by other reasons.

[0158] In one possible implementation, if the network device determines that the session limit has been exceeded, it issues a notification message indicating that the session limit has been exceeded. That is, the network device can inform the user of the session limit detection result, and the user can then resolve the network problem by reducing the number of connected devices, ending applications that consume a large number of sessions, or increasing bandwidth.

[0159] In one possible implementation, if it is determined that the abnormal time period in the previous sub-time period is the same as the abnormal time period in the current sub-time period, another prompt message is issued to the user, which is used to inform the user that there may be a network failure.

[0160] To more clearly illustrate the method for detecting excessive session counts provided in this embodiment of the invention, a specific example is given below. Please refer to [link / reference]. Figure 3 .

[0161] Step 301: Receive a session count exceeding detection command, and obtain session data for a preset time period according to the session count exceeding detection command.

[0162] In this embodiment of the invention, step 301 can be performed with reference to the specific implementation of step 201 described above, and will not be repeated here.

[0163] Step 302: Normalize the session data to obtain the processed session data.

[0164] Step 303: Use six anomaly detection algorithms to detect the processed session data and obtain the anomaly time corresponding to at least one abnormal session data.

[0165] The specific methods by which the six anomaly detection algorithms detect the processed session data can be found in the aforementioned introduction to the six anomaly detection algorithms, and will not be repeated here.

[0166] Step 304: Using a voting method, determine the target abnormal time from the abnormal times corresponding to at least one abnormal session data obtained respectively, and use the number of abnormal sessions corresponding to the target abnormal time as the session number threshold.

[0167] Optionally, the voting method can be understood as the aforementioned method for filtering candidate abnormal time sets.

[0168] In one embodiment, if three of the at least one abnormal time corresponding to the six anomaly detection algorithms contains the same abnormal time (e.g., 18:30 on the third day), then it is determined that the three anomaly detection algorithms voted for the aforementioned same abnormal time, and the abnormal time can be taken as the target abnormal time.

[0169] In another embodiment, if at least one abnormal moment corresponding to each of the six anomaly detection algorithms contains the same abnormal moment (e.g., 6:30 AM on the 6th day), then it is determined that the six anomaly detection algorithms voted for the aforementioned same abnormal moment. Thus, the abnormal moment with the highest vote among all abnormal moments, i.e., the abnormal moment with the highest confidence, can be taken as the target abnormal moment.

[0170] Step 305: Based on the session count threshold, determine the abnormal duration period in which the number of sessions exceeds the session count threshold within a preset time period.

[0171] In this embodiment of the invention, step 305 can be performed with reference to the specific implementation of step 203 described above, and will not be repeated here.

[0172] Step 306: Determine whether the growth rate of the abnormal duration period is greater than the threshold. If the growth rate of the abnormal duration period is greater than the threshold, proceed to step 307; if the growth rate of the abnormal duration period is less than the threshold, proceed to step 308.

[0173] Optionally, the method for determining the growth rate of the abnormal duration period can be implemented with reference to the specific implementation of step 204 above, and will not be repeated here. The threshold can be determined according to the actual implementation, and is not limited in this embodiment of the invention.

[0174] For example, a preset time period can be divided into a first sub-time period and a second sub-time period; the first sub-time period and the second sub-time period have the same duration, and the first sub-time period is earlier than the second sub-time period; the corresponding growth rate can be determined based on the difference between the abnormal duration of the second sub-time period and the abnormal duration of the first sub-time period, and the relationship between the growth rate and the threshold can be used to determine whether the number of sessions exceeds the limit.

[0175] Step 307: Determine if the number of sessions exceeds the limit.

[0176] Step 308: Determine that there is no session limit exceeded.

[0177] As can be seen, the session count over-limit detection method provided in this embodiment of the invention can automatically collect user session count data and mine data features. Through multiple anomaly detection algorithms, it can efficiently and accurately detect the time points of session count anomalies. By comparing the longest duration of abnormal session counts each day using a year-on-year comparison method, if a sudden increase in the duration of abnormal session counts is found, it is identified as a session count over-limit anomaly. In intelligent network operation and maintenance, this method can help users locate the cause of network lag, improving operation and maintenance efficiency. Furthermore, this method also features high recognition accuracy, low implementation complexity, and short recognition time.

[0178] Based on the same inventive concept, embodiments of the present invention provide a device for detecting excessive session counts, which can achieve the functions corresponding to the aforementioned method for detecting excessive session counts. This device can be a hardware structure, a software module, or a hardware structure plus a software module. The device can be implemented using a chip system, which can consist of chips or include chips and other discrete components. Please refer to [link to previous document]. Figure 4 As shown, the device for detecting excessive session counts includes:

[0179] The processing unit 401 is used to receive a session count exceeding the limit detection instruction and to obtain session data for a preset time period according to the session count exceeding the limit detection instruction;

[0180] The first detection unit 402 is used to determine the target abnormal time that meets the filtering conditions based on the session data of the preset time period, and to determine the session number threshold based on the number of abnormal sessions corresponding to the target abnormal time; the filtering conditions are used to select the abnormal time with the highest confidence from the abnormal time corresponding to the abnormal session data in the session data of the preset time period.

[0181] The determining unit 403 is used to determine, based on the session number threshold, an abnormal duration period in which the number of sessions exceeds the session number threshold within the preset time period;

[0182] The second detection unit 404 is used to determine whether the number of sessions exceeds the limit based on the abnormal duration period.

[0183] In one possible implementation, the first detection unit 402 is specifically used for:

[0184] At least two anomaly detection methods are used to detect the session data within the preset time period, and the anomaly time corresponding to at least one abnormal session data for each anomaly detection method is obtained.

[0185] From the abnormal times corresponding to the at least one abnormal session data obtained, the target abnormal times that meet the filtering conditions are determined.

[0186] In one possible implementation, the first detection unit 402 is specifically used for:

[0187] For each anomaly detection method, the following operations are performed on the session data:

[0188] The session data is inspected to obtain a first anomaly score corresponding to each moment within the preset time period; wherein, the first anomaly score is used to characterize the probability that the number of sessions exceeds the limit at any moment within the preset time period;

[0189] From the multiple first abnormal scores obtained, first candidate abnormal scores that meet the first preset conditions are selected, and the time corresponding to the first candidate abnormal score is taken as the abnormal time.

[0190] In one possible implementation, the first detection unit 402 is specifically used for:

[0191] Add the abnormal moments at the same time to a candidate abnormal moment set to obtain at least one candidate abnormal moment set;

[0192] From the at least one set of candidate abnormal times, select the set of candidate abnormal times that contains the most abnormal times as the first set of candidate abnormal times, and use the abnormal times contained in the first set of candidate abnormal times as the target abnormal times.

[0193] In one possible implementation, the second detection unit 404 is specifically used for:

[0194] The preset time period is divided into equal segments according to the chronological order to obtain the first sub-time period, the second sub-time period, and so on up to the Nth sub-time period, where N is not less than 2.

[0195] If the abnormal duration of the m-th sub-time period is greater than the abnormal duration of the n-th sub-time period, then it is determined that the number of sessions has exceeded the limit, where m is greater than n.

[0196] In one possible implementation, the second detection unit 404 is specifically used for:

[0197] The preset time period is divided into a first sub-time period and a second sub-time period; the first sub-time period and the second sub-time period have the same duration, and the first sub-time period is earlier than the second sub-time period;

[0198] If the abnormal duration of the second sub-time period is longer than the abnormal duration of the first sub-time period, then it is determined that the number of sessions has exceeded the limit.

[0199] In one possible implementation, after acquiring session data for a preset time period, the processing unit 401 is further configured to:

[0200] The session data is normalized to obtain processed session data.

[0201] In one possible implementation, the device further includes a prompting unit for:

[0202] If it is determined that the number of sessions has exceeded the limit, a prompt message is issued, wherein the prompt message is used to indicate that the number of sessions has exceeded the limit.

[0203] All relevant content of each step involved in the aforementioned embodiments of the method for detecting excessive session counts can be referenced to the functional description of the corresponding functional module of the device for detecting excessive session counts in the embodiments of the present invention, and will not be repeated here.

[0204] The module division in this embodiment of the invention is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the various embodiments of the invention can be integrated into a single controller, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0205] Based on the same inventive concept, embodiments of the present invention provide a network device; please refer to [link / reference]. Figure 5 As shown, the network device includes at least one processor 501 and a memory 502 connected to the at least one processor. In this embodiment of the invention, the specific connection medium between the processor 501 and the memory 502 is not limited. Figure 5 Taking the connection between processor 501 and memory 502 via bus 500 as an example, bus 500 in... Figure 5 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The Bus 500 can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 5 The bus is represented by only one thick line, but this does not mean that there is only one bus or one type of bus. In addition, the device for detecting excessive session counts also includes a communication interface 503 for receiving or sending data.

[0206] In this embodiment of the invention, the memory 502 stores instructions that can be executed by at least one processor 501. By executing the instructions stored in the memory 502, at least one processor 501 can perform the steps included in the aforementioned method for detecting excessive session counts.

[0207] The processor 501 is the control center of the network device. It can connect to various parts of the network device through various interfaces and lines. By running or executing instructions stored in the memory 502 and calling data stored in the memory 502, it can monitor the various functions and data processing of the network device as a whole.

[0208] Optionally, processor 501 may include one or more processing units. Processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into processor 501. In some embodiments, processor 501 and memory 502 may be implemented on the same chip; in some embodiments, they may be implemented separately on independent chips.

[0209] Processor 501 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0210] Memory 502, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 502 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. Memory 502 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In embodiments of the present invention, memory 502 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0211] By designing and programming the processor 501, the code corresponding to the session number exceeding detection method described in the foregoing embodiments can be embedded into the chip, so that the chip can execute the steps of the aforementioned session number exceeding detection method when running. How to design and program the processor 501 is a well-known technique to those skilled in the art, and will not be described in detail here.

[0212] Based on the same inventive concept, embodiments of the present invention also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the steps of the aforementioned method for detecting excessive session counts.

[0213] In some possible implementations, various aspects of the session number exceeding detection method provided by the present invention can also be implemented in the form of a program product, which includes program code that, when the program product is run on a control network device, causes the control network device to perform the steps in the session number exceeding detection method according to various exemplary embodiments of the present invention described above.

[0214] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0215] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0216] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0217] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0218] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method of session number overrun detection, the method comprising: The method comprises: receiving a session number out-of-limit detection instruction, and obtaining session data of a preset time period according to the session number out-of-limit detection instruction; determining a target abnormal time meeting a screening condition according to the session data of the preset time period, and determining a session number threshold according to an abnormal session number corresponding to the target abnormal time; the screening condition is used to select an abnormal time with the highest confidence from abnormal times corresponding to abnormal session data in the session data of the preset time period; determining an abnormal duration period in which the session number exceeds the session number threshold within the preset time period according to the session number threshold; determining whether the session number is out-of-limit according to the abnormal duration period.

2. The method of claim 1, wherein, The method comprises: detecting the session data of the preset time period by using at least two abnormal detection methods to obtain at least one abnormal time corresponding to at least one abnormal session data corresponding to each abnormal detection method, respectively; determining a target abnormal time meeting a screening condition from the at least one abnormal time corresponding to the at least one session data abnormal time.

3. The method of claim 2, wherein, The method comprises: performing the following operations on the session data by using each abnormal detection method, respectively: detecting the session data to obtain a first abnormal score corresponding to each time within the preset time period; wherein the first abnormal score is used to represent the probability of the session number being out-of-limit at any time within the preset time period; selecting a first candidate abnormal score meeting a first preset condition from the obtained multiple first abnormal scores, and regarding the time corresponding to the first candidate abnormal score as an abnormal time.

4. The method of claim 3, wherein, The method comprises: putting the abnormal times of the same time into a candidate abnormal time set to obtain at least one candidate abnormal time set; selecting a candidate abnormal time set containing the most abnormal times from the at least one candidate abnormal time set as a first candidate abnormal time set, and regarding the abnormal times contained in the first candidate abnormal time set as target abnormal times.

5. The method according to any one of claims 1 to 4, characterized in that, The method comprises: equally dividing the preset time period according to time sequence to obtain a first sub-time period, a second sub-time period, and an Nth sub-time period in sequence, wherein N is not less than 2; if the abnormal duration period in the mth sub-time period is greater than the abnormal duration period in the nth sub-time period, it is determined that the session number is out-of-limit, wherein m is greater than n.

6. The method of claim 5, wherein, The method comprises: dividing the preset time period into a first sub-time period and a second sub-time period; the first sub-time period and the second sub-time period have the same time length, and the first sub-time period is earlier than the second sub-time period. If the abnormal duration of the second sub-time period is longer than the abnormal duration of the first sub-time period, then it is determined that the number of sessions has exceeded the limit.

7. The method of any one of claims 1-4, wherein, After acquiring session data for a preset time period, the method further includes: The session data is normalized to obtain processed session data.

8. An apparatus for session number overflow detection, the apparatus comprising: The device includes: The processing unit is used to receive a session count exceeding the limit detection instruction and, according to the session count exceeding the limit detection instruction, obtain session data for a preset time period; The first detection unit is used to determine the target abnormal time that meets the filtering conditions based on the session data of the preset time period, and to determine the session number threshold based on the number of abnormal sessions corresponding to the target abnormal time; the filtering conditions are used to select the abnormal time with the highest confidence from the abnormal time corresponding to the abnormal session data in the session data of the preset time period. The determining unit is configured to determine, based on the session count threshold, an abnormal duration period in which the number of sessions exceeds the session count threshold within the preset time period; The second detection unit is used to determine whether the number of sessions exceeds the limit based on the abnormal duration period.

9. A network device, comprising: The network device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the method for detecting excessive session counts as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method for detecting excessive session counts as described in any one of claims 1 to 7.

Images