A network anomaly detection method and related equipment for cloud network

Abstract

The disclosed embodiment provides a network anomaly detection method and related equipment for a cloud network, the method comprising: in response to a business anomaly of a cloud service, obtaining a cloud service transmission path corresponding to the abnormal business from a cloud network business controller; the cloud service transmission path represents a transmission path that forwards a data packet to a target device through a cloud server and a cloud network forwarding device; according to the transmission sequence of each device in the cloud service transmission path, determining the first-end cloud network forwarding device and the terminal cloud network forwarding device in the cloud service transmission path; receiving the data packet forwarding information of the first-end cloud network forwarding device collected by the first stateful network element and the data packet forwarding information of the terminal cloud network forwarding device collected by the second stateful network element; according to the data packet forwarding information of the first-end cloud network forwarding device and the data packet forwarding information of the terminal cloud network forwarding device, detecting the cloud network anomaly of the abnormal business. The efficiency of determining the abnormal situation can be improved.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the technical field of cloud computing, and in particular to a network anomaly detection method and related equipment for a cloud network. Background Art

[0002] With the rapid development of cloud computing technology, the business volume of users is also gradually increasing. Among them, if the user's data transmission business is abnormal, the devices that may be abnormal include: the cloud server corresponding to the user, other devices that interact with the cloud server for data, and the cloud network forwarding device used to forward data between the cloud computing node and other devices. In the cloud network operation and maintenance process, it is necessary to first determine which device has an abnormality.

[0003] In the prior art, the traffic changes of cloud servers, cloud network forwarding devices, and other devices that interact with cloud servers can be obtained to determine the device with the largest traffic change as an abnormal device. However, the traffic of user services fluctuates, which may affect the accuracy of judging abnormal devices based on traffic changes. Summary of the invention

[0004] The embodiments of the present disclosure provide a network anomaly detection method and related devices for a cloud network, which can improve the accuracy of determining abnormal devices.

[0005] In a first aspect, an embodiment of the present disclosure provides a network anomaly detection method for a cloud network, comprising:

[0006] In response to a business abnormality of the cloud service, a cloud service transmission path corresponding to the abnormal business is obtained from a cloud network business controller; the cloud service transmission path represents a transmission path for forwarding a data packet to a target device through a cloud server and a cloud network forwarding device;

[0007] Determine a first-end cloud network forwarding device and a terminal cloud network forwarding device in the cloud service transmission path according to the transmission order of each device in the cloud service transmission path;

[0008] Receive data packet forwarding information of a head-end cloud network forwarding device collected by a first stateful network element and data packet forwarding information of a terminal cloud network forwarding device collected by a second stateful network element; wherein a forwarding information collection function is pre-configured in the first stateful network element and the second stateful network element for collecting data packet forwarding information;

[0009] According to the data packet forwarding information of the head-end cloud network forwarding device and the data packet forwarding information of the end-end cloud network forwarding device, the cloud network abnormality of the abnormal service is detected.

[0010] In a second aspect, an embodiment of the present disclosure provides a network anomaly detection device for a cloud network, comprising:

[0011] An acquisition unit, configured to obtain, in response to a cloud service service abnormality, a cloud service transmission path corresponding to the abnormal service from a cloud network service controller; the cloud service transmission path represents a transmission path for forwarding a data packet to a target device through a cloud server and a cloud network forwarding device;

[0012] A determination unit, configured to determine a head-end cloud network forwarding device and an end-end cloud network forwarding device in the cloud service transmission path according to a transmission sequence of each device in the cloud service transmission path;

[0013] A receiving unit, configured to receive data packet forwarding information of a head-end cloud network forwarding device collected by a first stateful network element and data packet forwarding information of a terminal cloud network forwarding device collected by a second stateful network element; wherein a forwarding information collection function is pre-configured in the first stateful network element and the second stateful network element for collecting data packet forwarding information;

[0014] The detection unit is used to detect the cloud network abnormality of the abnormal service based on the data packet forwarding information of the head-end cloud network forwarding device and the data packet forwarding information of the end cloud network forwarding device.

[0015] In a third aspect, an embodiment of the present disclosure provides an electronic device, including: a processor and a memory;

[0016] The memory stores computer-executable instructions;

[0017] The processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the network anomaly detection method for the cloud network as described in the first aspect and various possible designs of the first aspect.

[0018] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, in which computer execution instructions are stored. When a processor executes the computer execution instructions, the network anomaly detection method for the cloud network as described in the first aspect and various possible designs of the first aspect is implemented.

[0019] In a fifth aspect, an embodiment of the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements the network anomaly detection method for the cloud network as described in the first aspect and various possible designs of the first aspect.

[0020] The present embodiment provides a network anomaly detection method and related equipment for a cloud network, the method comprising: in response to a business anomaly of a cloud service, obtaining a cloud service transmission path corresponding to the abnormal business from a cloud network business controller; the cloud service transmission path represents a transmission path that forwards a data packet to a target device through a cloud server and a cloud network forwarding device; according to the transmission order of each device in the cloud service transmission path, determining the head-end cloud network forwarding device and the terminal cloud network forwarding device in the cloud service transmission path; receiving the data packet forwarding information of the head-end cloud network forwarding device collected by the first stateful network element and the data packet forwarding information of the terminal cloud network forwarding device collected by the second stateful network element; wherein the first stateful network element and the second stateful network element are pre-configured with a forwarding information collection function for collecting data packet forwarding information; according to the data packet forwarding information of the head-end cloud network forwarding device and the data packet forwarding information of the terminal cloud network forwarding device, detecting the cloud network anomaly of the abnormal business. In the technical solution, since the data packet forwarding information of the cloud network forwarding device is obtained by reusing the deployed first stateful network element and the second stateful network element, the implementation difficulty of the solution can be simplified, making it very easy to implement and deploy, and the solution does not depend on the business model of the tenant on the cloud, can adapt to the changing business model, and has good compatibility. In addition, this solution can not only quickly determine whether the abnormal device is located in the cloud network environment, but also further analyze the impact of the abnormal device on the tenant instance, which helps to quickly locate and repair network problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0022] Figure 1 A schematic diagram of an application scenario of the network anomaly detection method for a cloud network provided by an embodiment of the present disclosure;

[0023] Figure 2 The process of the network anomaly detection method of the cloud network provided by the embodiment of the present disclosure is as follows: Figure 1 ;

[0024] Figure 3 Schematic diagram of a network anomaly detection method for a cloud network provided by an embodiment of the present disclosure Figure 1 ;

[0025] Figure 4 The process of the network anomaly detection method of the cloud network provided by the embodiment of the present disclosure is as follows: Figure 2 ;

[0026] Figure 5 A schematic diagram of the structure of a network anomaly detection device for a cloud network provided by an embodiment of the present disclosure;

[0027] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0029] First, the background technology and some terms involved in this application are explained:

[0030] ECS (Elastic Compute Service, cloud server): a simple, efficient, secure, reliable, and elastically scalable computing service.

[0031] Internet devices: can interact with cloud servers ECS. For example, an Internet device receives a search request from a cloud server, searches based on the search keywords in the search request, obtains search results, and feeds the search results back to the cloud server.

[0032] WAN (Wide Area Network) devices: Multiple cloud servers can be deployed in one ECS region. Two cloud servers across ECS regions can exchange data through WAN devices.

[0033] With the rapid development of cloud computing technology, the business volume of users is also gradually increasing. Among them, if the user's data transmission business is abnormal, the devices that may be abnormal include: the cloud server corresponding to the user, other devices that interact with the cloud server for data, and the cloud network forwarding device used to forward data between the cloud computing node and other devices. In the cloud network operation and maintenance process, it is necessary to first determine which device has an abnormality.

[0034] In the prior art, the traffic changes of cloud servers, cloud network forwarding devices, and other devices that interact with cloud servers can be obtained to determine the device with the largest traffic change as an abnormal device. However, the traffic of user services fluctuates, which may affect the accuracy of judging abnormal devices based on traffic changes.

[0035] It can be seen that how to accurately identify abnormal devices is a relatively challenging technical issue in cloud network operation and maintenance.

[0036] In view of the technical problems in the prior art, the inventor's technical conception is as follows: At the boundary of the cloud network, stateful network elements need to be deployed for security reasons, such as by analyzing network attacks or deploying access control lists (Stateful ACLs) of stateful authentication and authorization policies to achieve user network security. This application can reuse the deployed stateful network elements and add the TCP (Transmission Control Protocol) flow quality event analysis function to the stateful network elements. In this way, the data packet forwarding information of the cloud network forwarding device can be obtained through the stateful network elements, and then the abnormal devices in the cloud network can be determined.

[0037] Accordingly, the specific steps may include: first, in response to a business anomaly of the cloud service, obtaining a cloud service transmission path corresponding to the abnormal business from a cloud network business controller; the cloud service transmission path represents a transmission path that forwards data packets to a target device through a cloud server and a cloud network forwarding device. Then, according to the transmission sequence of each device in the cloud service transmission path, determine the first-end cloud network forwarding device and the terminal cloud network forwarding device in the cloud service transmission path; receive the data packet forwarding information of the first-end cloud network forwarding device collected by the first stateful network element and the data packet forwarding information of the terminal cloud network forwarding device collected by the second stateful network element; wherein the forwarding information collection function is pre-configured in the first stateful network element and the second stateful network element for collecting data packet forwarding information. Finally, according to the data packet forwarding information of the first-end cloud network forwarding device and the data packet forwarding information of the terminal cloud network forwarding device, detect the cloud network anomaly of the abnormal business.

[0038] In this technical solution, by reusing the deployed first stateful network element and the second stateful network element to obtain the data packet forwarding information of the cloud network forwarding device, the implementation difficulty of the solution can be simplified, making it extremely easy to deploy, and the solution does not depend on the business model of the tenants on the cloud, can adapt to the changing business model, and has good compatibility. In addition, the solution can quickly determine whether the abnormal device is located in the cloud network environment, and can further analyze the impact of the abnormal device on the tenant instance, which helps to quickly locate and repair network problems.

[0039] The application scenarios of the embodiments of the present disclosure are explained below:

[0040] The network anomaly detection method for a cloud network provided by the embodiments of the present disclosure can be applied in various cloud network maintenance scenarios. Figure 1 A schematic diagram of an application scenario of a network anomaly detection method for a cloud network provided by an embodiment of the present disclosure. Figure 1As shown, the target device for data interaction with cloud server 1 can be cloud server 2, wide area network device and Internet device. When the target device is cloud server 2, the cloud service transmission path corresponding to the data transmission service is: cloud server 1 → cloud network forwarding device 1 → cloud network forwarding device 2 → cloud server 2.

[0041] When the target device is a wide area network device, the cloud service transmission path corresponding to the data transmission service is: cloud server 1→cloud network forwarding device 1→cloud network forwarding device 3→wide area network device.

[0042] When the target device is an Internet device, the cloud service transmission path corresponding to the data transmission business is: cloud server 1→cloud network forwarding device 1→cloud network forwarding device 2 (or cloud network forwarding device 3)→cloud network forwarding device 4→Internet device.

[0043] Exemplarily, an abnormality occurs in the data transmission service between cloud server 1 and cloud server 2, and the cloud service transmission path corresponding to the data transmission service is: cloud server 1→cloud network forwarding device 1→cloud network forwarding device 2→cloud server 2. In this case, the data packet forwarding information of cloud network forwarding device 1 connected to cloud server 1 and the data packet forwarding information of cloud network forwarding device 2 connected to cloud server 2 can be obtained through the above cloud service transmission path. The abnormal device is determined through the data packet forwarding information of cloud network forwarding device 1 and the data packet forwarding information of cloud network forwarding device 2.

[0044] Figure 2 The network anomaly detection method process of the cloud network provided by the embodiment of the present disclosure Figure 1 In the embodiment of the present disclosure, the execution subject of the detection method may be an electronic device for performing abnormal analysis, and the electronic device may be a terminal or a server. Figure 2 As shown, the network anomaly detection method of the cloud network may include:

[0045] S201. In response to a business abnormality of a cloud service, obtain a cloud service transmission path corresponding to the abnormal business from a cloud network business controller; the cloud service transmission path represents a transmission path that forwards a data packet to a target device through a cloud server and a cloud network forwarding device.

[0046] In the embodiments of the present disclosure, the cloud server may include a virtual machine device. The target device for data interaction with the cloud server may be another cloud server, a wide area network device, and an Internet device. For example, a user may use a virtual machine device to interact with other users' virtual machine devices via a cloud network forwarding device.

[0047] The cloud network service controller may have the whole network equipment topology information and network instance information. The whole network equipment topology information includes the cloud service transmission paths of multiple data transmission services. Accordingly, in response to the cloud service service anomaly, the cloud service transmission path corresponding to the abnormal service can be obtained from the cloud network service controller.

[0048] In some embodiments, before the cloud server and the target device interact with each other, a network session between the cloud server and the target device needs to be established. The network session corresponds to a five-tuple information, and the data packet corresponding to the data transmission service can be transmitted through the cloud service transmission path corresponding to the five-tuple information.

[0049] When the cloud server transmits the data packet corresponding to the data transmission service through the established network session, it can carry the five-tuple information corresponding to the network session. When an abnormality occurs in the data transmission service of the cloud server, the five-tuple information corresponding to the data transmission service can be obtained.

[0050] In some embodiments, the cloud service transmission path corresponding to the data transmission service can be obtained through the five-tuple information. Accordingly, this step may include: in response to the service abnormality of the cloud service, obtaining the network communication unique identifier corresponding to the abnormal service, the network communication unique identifier is used to identify and distinguish different services; according to the network communication unique identifier, obtaining the data packet forwarding information about the abnormal service reported by each cloud network forwarding device from the cloud network service controller; according to the five-tuple information in the data packet forwarding information, the transmission order of each cloud network forwarding device is determined by the matching relationship between the address information output by the upstream device and the address information input by the downstream device, and the cloud service transmission path corresponding to the abnormal service is obtained.

[0051] For example, Figure 3 As shown, the cloud network service controller is configured with the correspondence between each five-tuple information and the cloud service transmission path. A flow quality information center module is deployed in the abnormal analysis server, and the cloud network service controller can send the correspondence between the five-tuple information and the cloud service transmission path to the flow quality information center module. When an abnormality occurs in the data transmission service of the cloud server, the above-mentioned flow quality information center module can determine the cloud service transmission path corresponding to the data transmission service based on the five-tuple information and the correspondence between the five-tuple information and the cloud service transmission path.

[0052] The target device for data interaction with cloud server 1 may be cloud server 2, wide area network device and Internet device. When the target device is cloud server 2, the cloud service transmission path corresponding to the data transmission service is: cloud server 1 → cloud network forwarding device 1 → cloud network forwarding device 2 → cloud server 2.

[0053] When the target device is a wide area network device, the cloud service transmission path corresponding to the data transmission service is: cloud server 1→cloud network forwarding device 1→cloud network forwarding device 3→wide area network device.

[0054] When the target device is an Internet device, the cloud service transmission path corresponding to the data transmission business is: cloud server 1→cloud network forwarding device 1→cloud network forwarding device 2 (or cloud network forwarding device 3)→cloud network forwarding device 4→Internet device.

[0055] S202. Determine the first-end cloud network forwarding device and the last-end cloud network forwarding device in the cloud service transmission path according to the transmission order of each device in the cloud service transmission path.

[0056] For example, the data transmission service of cloud server 1 is abnormal, and the target device for data interaction with cloud server 1 is cloud server 2. The data transmission order of multiple devices is: cloud server 1 → cloud network forwarding device 1 → cloud network forwarding device 2 → cloud server 2. In this case, it is determined that the first-end cloud network forwarding device in the cloud service transmission path is cloud network forwarding device 1, and the terminal cloud network forwarding device is cloud network forwarding device 2.

[0057] S203, receiving the data packet forwarding information of the head-end cloud network forwarding device collected by the first stateful network element and the data packet forwarding information of the terminal cloud network forwarding device collected by the second stateful network element; wherein, the first stateful network element and the second stateful network element are pre-configured with a forwarding information collection function for collecting data packet forwarding information.

[0058] At the edge of the cloud network, stateful network elements need to be deployed for security reasons. For example, network security can be achieved by analyzing network attacks or deploying stateful authentication and authorization policy access control lists (Stateful ACLs). This application can reuse the deployed stateful network elements and add the TCP (Transmission Control Protocol) flow quality event analysis function to the stateful network elements. The data packet forwarding information of the cloud network forwarding device can be obtained through the stateful network elements.

[0059] It should be noted that the stateful network element of the cloud network forwarding device can be deployed independently or in the cloud network forwarding device. For example, the stateful network element can be a virtual switch in the cloud network forwarding device, which is deployed in the cloud network forwarding device.

[0060] In some embodiments, the deployment method of the stateful network element is related to the amount of business that the cloud network forwarding device needs to process.

[0061] Exemplarily, the multiple cloud network forwarding devices include cloud network forwarding devices connected to cloud servers, cloud network forwarding devices connected to wide area network devices, and cloud network forwarding devices connected to Internet devices. Among them, the cloud network forwarding devices connected to wide area network devices and cloud network forwarding devices connected to Internet devices process a large amount of business, and the stateful network elements of the above cloud network forwarding devices can be deployed independently. Among them, the cloud network forwarding devices connected to cloud servers process a small amount of business, and the stateful network elements can be deployed in the cloud network forwarding devices.

[0062] S204. Detect cloud network anomalies of abnormal services based on the data packet forwarding information of the head-end cloud network forwarding device and the data packet forwarding information of the end-end cloud network forwarding device.

[0063] In the disclosed embodiment, the packet forwarding information includes one or more of the transmission delay of the packet, the number of retransmissions of the packet, the number of confirmation receptions of the packet, and the sending sequence number information of the sent packet. Through the above forwarding information, it can be determined whether there is an abnormality in the forwarding process of the cloud network forwarding device forwarding the packet. If there is an abnormality, it can be determined whether the abnormal device is located upstream or downstream of the forwarding of the cloud network forwarding device based on whether the abnormality occurs before or after the forwarding of the packet. The abnormal device can be determined by combining the upstream and downstream devices of the cloud network forwarding device on the cloud service transmission path.

[0064] The disclosed embodiment provides a network anomaly detection method for a cloud network: first, in response to a business anomaly of a cloud service, a cloud service transmission path corresponding to the abnormal business is obtained from a cloud network business controller; the cloud service transmission path represents a transmission path that forwards a data packet to a target device through a cloud server and a cloud network forwarding device. Then, according to the transmission order of each device in the cloud service transmission path, the head-end cloud network forwarding device and the terminal cloud network forwarding device in the cloud service transmission path are determined; the data packet forwarding information of the head-end cloud network forwarding device collected by the first stateful network element and the data packet forwarding information of the terminal cloud network forwarding device collected by the second stateful network element are received; wherein the forwarding information collection function is pre-configured in the first stateful network element and the second stateful network element for collecting data packet forwarding information. Finally, the cloud network anomaly of the abnormal business is detected according to the data packet forwarding information of the head-end cloud network forwarding device and the data packet forwarding information of the terminal cloud network forwarding device. In this technical solution, since the data packet forwarding information of the cloud network forwarding device is obtained by reusing the deployed first stateful network element and the second stateful network element, the implementation difficulty of the solution can be simplified, making it very easy to implement and deploy, and the solution does not depend on the business model of the tenants on the cloud, can adapt to the changing business model, and has good compatibility. In addition, this solution can not only quickly determine whether the abnormal device is located in the cloud network environment, but also further analyze the impact of the abnormal device on the tenant instance, which helps to quickly locate and repair network problems.

[0065] Figure 4 The network anomaly detection method process of the cloud network provided by the embodiment of the present disclosure Figure 2 In the embodiment of the present disclosure, taking the data packet forwarding information including one or more of the data packet transmission delay, the number of data packet retransmissions, the number of data packet confirmation receptions, and the sending sequence number information of the sent data packet as an example, the method of detecting the cloud network abnormality of abnormal services according to the data packet forwarding information of the head-end cloud network forwarding device and the data packet forwarding information of the terminal cloud network forwarding device in step S204 is described in detail. Figure 4 As shown, the method includes:

[0066] S401. Determine the transmission direction of the data packet according to the data forwarding direction in the data packet forwarding information of the head-end cloud network forwarding device and the data forwarding direction in the data packet forwarding information of the end cloud network forwarding device.

[0067] In an embodiment of the present disclosure, this step may include: determining the sending device and receiving device of the data packet based on the data forwarding direction in the data packet forwarding information of the head-end cloud network forwarding device and the data forwarding direction in the data packet forwarding information of the end cloud network forwarding device; and then determining the transmission direction of the data packet through the determined sending device and receiving device.

[0068] For example, Figure 3 As shown, the head-end cloud network forwarding device is cloud network forwarding device 1, and the end-end cloud network forwarding device is cloud network forwarding device 2.

[0069] If the data forwarding direction in the data packet forwarding information of cloud network forwarding device 1 is: from cloud server 1 to cloud network forwarding device 1, and the data forwarding direction in the data packet forwarding information of cloud network forwarding device 2 is: from cloud network forwarding device 2 to cloud server 2, then the sending device of the data packet is determined to be cloud server 1, and the receiving device is cloud server 2. In this case, the transmission direction of the data packet is determined to be: from cloud server 1 to cloud server 2.

[0070] If the data forwarding direction in the data packet forwarding information of cloud network forwarding device 1 is: from cloud network forwarding device 1 to cloud server 1, and the data forwarding direction in the data packet forwarding information of cloud network forwarding device 2 is: from cloud server 2 to cloud network forwarding device 2, then the sending device of the data packet is determined to be cloud server 2, and the receiving device is cloud server 1. In this case, the transmission direction of the data packet is determined to be: from cloud server 2 to cloud server 1.

[0071] S402: Determine abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device and abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device.

[0072] In the disclosed embodiment, the frequently forwarded information includes one or more of the following: the transmission delay of the data packet is greater than a first preset duration, the number of retransmissions of the data packet is greater than a first preset number, the number of confirmation receptions of the data packet is greater than a second preset number, and there is disorder in the sending sequence number information.

[0073] In the embodiment of the present disclosure, the first preset duration, the first preset number of times, and the second preset number of times are not specifically limited and can be set and modified as needed. For example, the first preset duration can be 0.5 seconds, 1 second, 1.5 seconds, etc. The first preset number of times can be 2 times, 3 times, 4 times, etc. The second preset number of times can be 2 times, 3 times, 4 times, etc.

[0074] For example, Figure 3 As shown, a forwarding information analysis module is deployed in the abnormal analysis server, and the forwarding information analysis module is used to determine abnormal forwarding information in the data packet forwarding information of the first cloud network forwarding device and abnormal forwarding information in the data packet forwarding information of the second cloud network forwarding device.

[0075] In some embodiments, the same abnormal forwarding information can be merged to reduce the number of abnormal forwarding information. Accordingly, this step may include: determining multiple abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device within the second preset time length, combining and compressing the same abnormal forwarding information according to the information sequence, and obtaining the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device; and determining multiple abnormal forwarding information of the terminal cloud network forwarding device within the second preset time length, combining and compressing the same abnormal forwarding information according to the information sequence, and obtaining the abnormal forwarding information in the data packet forwarding information of the terminal cloud network forwarding device.

[0076] In the embodiment of the present disclosure, the second preset time length is not specifically limited and can be set and modified as needed. For example, the second preset time length can be 5 seconds, 10 seconds, 15 seconds, etc.

[0077] S403, detecting cloud network anomalies of abnormal services based on abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device, abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device, and the transmission direction of the data packet.

[0078] In some embodiments, abnormal forwarding information and data transmission direction may be combined to detect abnormal devices among multiple devices. Figure 3 As shown, an abnormal information analysis module is deployed in the abnormal analysis server, and the abnormal information analysis module is combined with abnormal forwarding information and data transmission direction to detect abnormal devices among multiple devices.

[0079] The following describes a method for detecting abnormal devices by combining abnormal forwarding information and data transmission direction through two cases.

[0080] The first case: If the transmission direction of the data packet is from the cloud server to the target device, then based on the data packet forwarding information from the cloud server to the head-end cloud network forwarding device and the data packet forwarding information from the end cloud network forwarding device to the target device, detect whether the abnormal service occurs in the cloud network. Accordingly, based on the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device, the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device and the transmission direction of the data packet, detect the cloud network abnormality of the abnormal service, including:

[0081] If the abnormal forwarding information in the data packet forwarding information from the end cloud network forwarding device to the target device is: the number of confirmation reception times of the data packet is greater than the second preset number or there is disorder in the sending sequence number information, and the abnormal forwarding information in the data packet forwarding information from the cloud server to the head-end cloud network forwarding device is: the transmission delay of the data packet is greater than the first preset time length or the number of retransmissions of the data packet is greater than the first preset number, then it is determined that the business anomaly occurs in the cloud network.

[0082] It should be noted that when the anomaly occurs in a cloud network forwarding device, it indicates that the anomaly occurs in the cloud network. That is, if the abnormal device is a cloud network forwarding device, it is determined that the service anomaly occurs in the cloud network.

[0083] If the abnormal forwarding information in the data packet forwarding information from the cloud server to the head-end cloud network forwarding device is: the number of confirmed reception times of the data packet is greater than the second preset number or there is disorder in the sending sequence number information, then it is determined that the cloud server is an abnormal device and has not occurred in the cloud network;

[0084] If the abnormal forwarding information in the data packet forwarding information from the end cloud network forwarding device to the target device is: the transmission delay of the data packet is greater than the first preset time length or the number of retransmissions of the data packet is greater than the first preset number of times, then the target device is determined to be an abnormal device and did not occur in the cloud network.

[0085] The second case: if the data packet is transmitted in the direction from the target device to the cloud server, then based on the data packet forwarding information from the target device to the end cloud network forwarding device and the data packet forwarding information from the head-end cloud network forwarding device to the cloud server, detect whether the abnormal service occurs in the cloud network. Accordingly, based on the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device, the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device and the transmission direction of the data packet, detect the cloud network abnormality of the abnormal service, including:

[0086] If the abnormal forwarding information in the data packet forwarding information from the head-end cloud network forwarding device to the cloud server is: the number of confirmed reception times of the data packet is greater than the second preset number or there is disorder in the sending sequence number information, and the abnormal forwarding information in the data packet forwarding information from the target device to the terminal cloud network forwarding device is: the transmission delay of the data packet is greater than the first preset time length or the number of retransmissions of the data packet is greater than the first preset number, it is determined that the abnormal service is detected in the cloud network;

[0087] If the abnormal forwarding information in the data packet forwarding information from the head-end cloud network forwarding device to the cloud server is: the transmission delay of the data packet is greater than the first preset time length or the number of retransmissions of the data packet is greater than the first preset number of times, then it is determined that the cloud server is an abnormal device and has not occurred in the cloud network;

[0088] If the abnormal forwarding information in the data packet forwarding information from the target device to the end cloud network forwarding device is: the number of confirmed reception times of the data packet is greater than the second preset number or there is disorder in the sending sequence number information, then the target device is determined to be an abnormal device and has not occurred in the cloud network.

[0089] It should be noted that if the abnormal device is a cloud network forwarding device, the impact range of the cloud network forwarding device can also be determined. Accordingly, the method can also include: when determining that the service anomaly occurs in the cloud network, determining the number of multiple cloud servers connected to the abnormal device in the cloud network and the abnormal duration of the abnormal device; determining the impact level of the abnormal device according to the number of multiple cloud servers and the abnormal duration of the abnormal device, wherein the impact level represents the impact range of the anomaly. Among them, the abnormal device in the cloud network can be a cloud network forwarding device.

[0090] For example, Figure 3 As shown, the abnormal device in the cloud network may be a cloud network forwarding device 1, and an abnormality delimitation analysis module is deployed in the abnormality analysis server. The impact range of the cloud network forwarding device 1 is determined through the abnormality delimitation analysis module.

[0091] Figure 5 A schematic diagram of the structure of a network anomaly detection device for a cloud network provided by an embodiment of the present disclosure, such as Figure 5 As shown, the network anomaly detection device includes:

[0092] The acquisition unit 501 is used to obtain a cloud service transmission path corresponding to the abnormal service from the cloud network service controller in response to the abnormal service of the cloud service; the cloud service transmission path represents a transmission path for forwarding a data packet to a target device through a cloud server and a cloud network forwarding device;

[0093] A determination unit 502 is used to determine a head-end cloud network forwarding device and an end-end cloud network forwarding device in the cloud service transmission path according to a transmission order of each device in the cloud service transmission path;

[0094] The receiving unit 503 is used to receive the data packet forwarding information of the head-end cloud network forwarding device collected by the first stateful network element and the data packet forwarding information of the terminal cloud network forwarding device collected by the second stateful network element; wherein the forwarding information collection function is pre-configured in the first stateful network element and the second stateful network element for collecting the data packet forwarding information;

[0095] The detection unit 504 is used to detect the cloud network abnormality of the abnormal service based on the data packet forwarding information of the head-end cloud network forwarding device and the data packet forwarding information of the end-end cloud network forwarding device.

[0096] According to one or more embodiments of the present disclosure, the acquisition unit 501, in response to a business abnormality of the cloud service, obtains the cloud service transmission path corresponding to the abnormal business from the cloud network business controller, including: in response to the business abnormality of the cloud service, obtaining a network communication unique identifier corresponding to the abnormal business, the network communication unique identifier is used to identify and distinguish different businesses; according to the network communication unique identifier, obtaining data packet forwarding information about the abnormal business reported by each cloud network forwarding device from the cloud network business controller; according to the five-tuple information in the data packet forwarding information, the transmission order of each cloud network forwarding device is determined with the matching relationship between the address information output by the upstream device and the address information input by the downstream device, so as to obtain the cloud service transmission path corresponding to the abnormal business.

[0097] According to one or more embodiments of the present disclosure, the detection unit 504 detects the cloud network abnormality of the abnormal service based on the data packet forwarding information of the head-end cloud network forwarding device and the data packet forwarding information of the end cloud network forwarding device, including: determining the transmission direction of the data packet based on the data forwarding direction in the data packet forwarding information of the head-end cloud network forwarding device and the data forwarding direction in the data packet forwarding information of the end cloud network forwarding device; determining the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device and the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device; detecting the cloud network abnormality of the abnormal service based on the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device, the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device and the transmission direction of the data packet.

[0098] According to one or more embodiments of the present disclosure, the detection unit 504 detects the cloud network abnormality of the abnormal service based on the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device, the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device and the transmission direction of the data packet, including: if the transmission direction of the data packet is from the cloud server to the target device, then based on the data packet forwarding information from the cloud server to the head-end cloud network forwarding device and the data packet forwarding information from the end cloud network forwarding device to the target device, it is detected whether the abnormal service occurs in the cloud network; if the transmission direction of the data packet is from the target device to the cloud server, then based on the data packet forwarding information from the target device to the end cloud network forwarding device and the data packet forwarding information from the head-end cloud network forwarding device to the cloud server, it is detected whether the abnormal service occurs in the cloud network.

[0099] According to one or more embodiments of the present disclosure, the detection unit detects whether the abnormal business occurs in the cloud network based on the data packet forwarding information from the cloud server to the head-end cloud network forwarding device and the data packet forwarding information from the end cloud network forwarding device to the target device, including: the abnormal forwarding information in the data packet forwarding information from the end cloud network forwarding device to the target device is: the number of confirmed reception times of the data packet is greater than a second preset number or there is disorder in the sending sequence number information, and the abnormal forwarding information in the data packet forwarding information from the cloud server to the head-end cloud network forwarding device is: the transmission delay of the data packet is greater than a first preset time length or the number of retransmissions of the data packet is greater than a first preset number, then it is determined that the business anomaly occurs in the cloud network.

[0100] According to one or more embodiments of the present disclosure, the detection unit 504 detects whether the abnormal service occurs in the cloud network based on the data packet forwarding information from the target device to the end cloud network forwarding device and the data packet forwarding information from the head-end cloud network forwarding device to the cloud server, including: if the abnormal forwarding information in the data packet forwarding information from the head-end cloud network forwarding device to the cloud server is: the number of confirmed reception times of the data packet is greater than the second preset number or there is disorder in the sending sequence number information, and the abnormal forwarding information in the data packet forwarding information from the target device to the end cloud network forwarding device is: the transmission delay of the data packet is greater than the first preset time length or the number of retransmissions of the data packet is greater than the first preset number, then it is determined that the abnormal service is detected to occur in the cloud network.

[0101] According to one or more embodiments of the present disclosure, the detection unit 504 determines abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device and abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device, including: determining multiple abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device within a second preset time length, combining and compressing the same abnormal forwarding information according to the information sequence, and obtaining the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device; and determining multiple abnormal forwarding information of the end cloud network forwarding device within the second preset time length, combining and compressing the same abnormal forwarding information according to the information sequence, and obtaining the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device.

[0102] According to one or more embodiments of the present disclosure, the device also includes: an anomaly delimitation analysis unit, which is used to determine the number of multiple cloud servers connected to the abnormal device in the cloud network and the abnormal duration of the abnormal device when determining that the business anomaly occurs in the cloud network; determine the impact level of the abnormal device based on the number of the multiple cloud servers and the abnormal duration of the abnormal device, wherein the impact level represents the impact range of the anomaly.

[0103] refer to Figure 6 , which shows a schematic diagram of the structure of an electronic device 600 suitable for implementing the embodiment of the present disclosure, and the electronic device 600 may be a terminal device or a server. The terminal device may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, personal digital assistants (PDAs), tablet computers, portable multimedia players (PMPs), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0104] like Figure 6 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 to a random access memory (RAM) 603. Various programs and data required for the operation of the electronic device 600 are also stored in the RAM 603. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0105] Typically, the following devices may be connected to the I / O interface 605: input devices 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 608 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0106] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0107] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0108] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0109] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device executes the method shown in the above embodiment.

[0110] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0111] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0112] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a unit does not limit the unit itself in some cases. For example, the first acquisition unit may also be described as a "unit for acquiring at least two Internet Protocol addresses".

[0113] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0114] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0115] In a first aspect, according to one or more embodiments of the present disclosure, a network anomaly detection method for a cloud network is provided, comprising:

[0116] In response to a business abnormality of the cloud service, a cloud service transmission path corresponding to the abnormal business is obtained from a cloud network business controller; the cloud service transmission path represents a transmission path for forwarding a data packet to a target device through a cloud server and a cloud network forwarding device;

[0117] Determine a first-end cloud network forwarding device and a terminal cloud network forwarding device in the cloud service transmission path according to the transmission order of each device in the cloud service transmission path;

[0118] Receive data packet forwarding information of a head-end cloud network forwarding device collected by a first stateful network element and data packet forwarding information of a terminal cloud network forwarding device collected by a second stateful network element; wherein a forwarding information collection function is pre-configured in the first stateful network element and the second stateful network element for collecting data packet forwarding information;

[0119] According to the data packet forwarding information of the head-end cloud network forwarding device and the data packet forwarding information of the end-end cloud network forwarding device, the cloud network abnormality of the abnormal service is detected.

[0120] According to one or more embodiments of the present disclosure, in response to a business anomaly of a cloud service, obtaining a cloud service transmission path corresponding to the abnormal business from a cloud network business controller includes: in response to a business anomaly of a cloud service, obtaining a network communication unique identifier corresponding to the abnormal business, the network communication unique identifier being used to identify and distinguish different businesses; obtaining, from a cloud network business controller, data packet forwarding information about the abnormal business reported by each cloud network forwarding device based on the network communication unique identifier; and determining, based on the five-tuple information in the data packet forwarding information, a transmission order of each cloud network forwarding device with a matching relationship between the address information output by an upstream device and the address information input by a downstream device, to obtain the cloud service transmission path corresponding to the abnormal business.

[0121] According to one or more embodiments of the present disclosure, the method of detecting the cloud network abnormality of the abnormal service based on the data packet forwarding information of the head-end cloud network forwarding device and the data packet forwarding information of the end cloud network forwarding device includes: determining the transmission direction of the data packet based on the data forwarding direction in the data packet forwarding information of the head-end cloud network forwarding device and the data forwarding direction in the data packet forwarding information of the end cloud network forwarding device; determining the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device and the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device; detecting the cloud network abnormality of the abnormal service based on the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device, the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device and the transmission direction of the data packet.

[0122] According to one or more embodiments of the present disclosure, the cloud network abnormality of the abnormal service is detected based on the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device, the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device and the transmission direction of the data packet, including: if the transmission direction of the data packet is from the cloud server to the target device, then based on the data packet forwarding information from the cloud server to the head-end cloud network forwarding device and the data packet forwarding information from the end cloud network forwarding device to the target device, it is detected whether the abnormal service occurs in the cloud network; if the transmission direction of the data packet is from the target device to the cloud server, then based on the data packet forwarding information from the target device to the end cloud network forwarding device and the data packet forwarding information from the head-end cloud network forwarding device to the cloud server, it is detected whether the abnormal service occurs in the cloud network.

[0123] According to one or more embodiments of the present disclosure, the detection of whether the abnormal business occurs in the cloud network is based on the data packet forwarding information from the cloud server to the head-end cloud network forwarding device and the data packet forwarding information from the end cloud network forwarding device to the target device, including: the abnormal forwarding information in the data packet forwarding information from the end cloud network forwarding device to the target device is: the number of confirmed reception times of the data packet is greater than a second preset number or there is disorder in the sending sequence number information, and the abnormal forwarding information in the data packet forwarding information from the cloud server to the head-end cloud network forwarding device is: the transmission delay of the data packet is greater than a first preset time length or the number of retransmissions of the data packet is greater than a first preset number, then it is determined that the business anomaly occurs in the cloud network.

[0124] According to one or more embodiments of the present disclosure, the detection of whether the abnormal service occurs in the cloud network based on the data packet forwarding information from the target device to the end cloud network forwarding device and the data packet forwarding information from the head-end cloud network forwarding device to the cloud server includes: if the abnormal forwarding information in the data packet forwarding information from the head-end cloud network forwarding device to the cloud server is: the number of confirmed reception times of the data packet is greater than a second preset number or there is disorder in the sending sequence number information, and the abnormal forwarding information in the data packet forwarding information from the target device to the end cloud network forwarding device is: the transmission delay of the data packet is greater than a first preset time length or the number of retransmissions of the data packet is greater than a first preset number, then it is determined that the abnormal service is detected to occur in the cloud network.

[0125] According to one or more embodiments of the present disclosure, the determining of abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device and abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device includes: determining multiple abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device within a second preset time length, combining and compressing the same abnormal forwarding information according to an information sequence, and obtaining the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device; and determining multiple abnormal forwarding information of the end cloud network forwarding device within the second preset time length, combining and compressing the same abnormal forwarding information according to an information sequence, and obtaining the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device.

[0126] According to one or more embodiments of the present disclosure, the method further includes: when determining that a business anomaly occurs in a cloud network, determining the number of multiple cloud servers connected to an abnormal device in the cloud network and the abnormal duration of the abnormal device; determining an impact level of the abnormal device based on the number of the multiple cloud servers and the abnormal duration of the abnormal device, wherein the impact level characterizes the impact range of the anomaly.

[0127] In a second aspect, according to one or more embodiments of the present disclosure, a network anomaly detection device for a cloud network is provided, comprising:

[0128] An acquisition unit, configured to obtain, in response to a cloud service service abnormality, a cloud service transmission path corresponding to the abnormal service from a cloud network service controller; the cloud service transmission path represents a transmission path for forwarding a data packet to a target device through a cloud server and a cloud network forwarding device;

[0129] A determination unit, configured to determine a head-end cloud network forwarding device and an end-end cloud network forwarding device in the cloud service transmission path according to a transmission sequence of each device in the cloud service transmission path;

[0130] A receiving unit, configured to receive data packet forwarding information of a head-end cloud network forwarding device collected by a first stateful network element and data packet forwarding information of a terminal cloud network forwarding device collected by a second stateful network element; wherein a forwarding information collection function is pre-configured in the first stateful network element and the second stateful network element for collecting data packet forwarding information;

[0131] The detection unit is used to detect the cloud network abnormality of the abnormal service based on the data packet forwarding information of the head-end cloud network forwarding device and the data packet forwarding information of the end cloud network forwarding device.

[0132] According to one or more embodiments of the present disclosure, the acquisition unit, in response to a business abnormality of the cloud service, obtains the cloud service transmission path corresponding to the abnormal business from the cloud network business controller, including: in response to the business abnormality of the cloud service, obtaining a network communication unique identifier corresponding to the abnormal business, the network communication unique identifier is used to identify and distinguish different businesses; according to the network communication unique identifier, obtaining data packet forwarding information about the abnormal business reported by each cloud network forwarding device from the cloud network business controller; according to the five-tuple information in the data packet forwarding information, the transmission order of each cloud network forwarding device is determined with the matching relationship between the address information output by the upstream device and the address information input by the downstream device, so as to obtain the cloud service transmission path corresponding to the abnormal business.

[0133] According to one or more embodiments of the present disclosure, the detection unit detects the cloud network abnormality of the abnormal service based on the data packet forwarding information of the head-end cloud network forwarding device and the data packet forwarding information of the end cloud network forwarding device, including: determining the transmission direction of the data packet based on the data forwarding direction in the data packet forwarding information of the head-end cloud network forwarding device and the data forwarding direction in the data packet forwarding information of the end cloud network forwarding device; determining the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device and the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device; detecting the cloud network abnormality of the abnormal service based on the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device, the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device and the transmission direction of the data packet.

[0134] According to one or more embodiments of the present disclosure, the detection unit detects the cloud network abnormality of the abnormal service based on the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device, the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device, and the transmission direction of the data packet, including: if the transmission direction of the data packet is from the cloud server to the target device, then based on the data packet forwarding information from the cloud server to the head-end cloud network forwarding device and the data packet forwarding information from the end cloud network forwarding device to the target device, it is detected whether the abnormal service occurs in the cloud network; if the transmission direction of the data packet is from the target device to the cloud server, then based on the data packet forwarding information from the target device to the end cloud network forwarding device and the data packet forwarding information from the head-end cloud network forwarding device to the cloud server, it is detected whether the abnormal service occurs in the cloud network.

[0135] According to one or more embodiments of the present disclosure, the detection unit detects whether the abnormal business occurs in the cloud network based on the data packet forwarding information from the cloud server to the head-end cloud network forwarding device and the data packet forwarding information from the end cloud network forwarding device to the target device, including: the abnormal forwarding information in the data packet forwarding information from the end cloud network forwarding device to the target device is: the number of confirmed reception times of the data packet is greater than a second preset number or there is disorder in the sending sequence number information, and the abnormal forwarding information in the data packet forwarding information from the cloud server to the head-end cloud network forwarding device is: the transmission delay of the data packet is greater than a first preset time length or the number of retransmissions of the data packet is greater than a first preset number, then it is determined that the business anomaly occurs in the cloud network.

[0136] According to one or more embodiments of the present disclosure, the detection unit detects whether the abnormal service occurs in the cloud network based on the data packet forwarding information from the target device to the end cloud network forwarding device and the data packet forwarding information from the head-end cloud network forwarding device to the cloud server, including: if the abnormal forwarding information in the data packet forwarding information from the head-end cloud network forwarding device to the cloud server is: the number of confirmed reception times of the data packet is greater than a second preset number or there is disorder in the sending sequence number information, and the abnormal forwarding information in the data packet forwarding information from the target device to the end cloud network forwarding device is: the transmission delay of the data packet is greater than a first preset time length or the number of retransmissions of the data packet is greater than a first preset number, then it is determined that the abnormal service is detected to occur in the cloud network.

[0137] According to one or more embodiments of the present disclosure, the detection unit determines abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device and abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device, including: determining multiple abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device within a second preset time length, combining and compressing the same abnormal forwarding information according to the information sequence, and obtaining the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device; and determining multiple abnormal forwarding information of the end cloud network forwarding device within the second preset time length, combining and compressing the same abnormal forwarding information according to the information sequence, and obtaining the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device.

[0138] According to one or more embodiments of the present disclosure, the device also includes: an anomaly delimitation analysis unit, which is used to determine the number of multiple cloud servers connected to the abnormal device in the cloud network and the abnormal duration of the abnormal device when determining that the business anomaly occurs in the cloud network; determine the impact level of the abnormal device based on the number of the multiple cloud servers and the abnormal duration of the abnormal device, wherein the impact level represents the impact range of the anomaly.

[0139] In a third aspect, according to one or more embodiments of the present disclosure, there is provided an electronic device, comprising: at least one processor and a memory;

[0140] The memory stores computer-executable instructions;

[0141] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the network anomaly detection method for the cloud network as described in the first aspect and various possible designs of the first aspect.

[0142] In a fourth aspect, according to one or more embodiments of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer execution instructions. When a processor executes the computer execution instructions, the network anomaly detection method for the cloud network as described in the first aspect and various possible designs of the first aspect is implemented.

[0143] In a fifth aspect, according to one or more embodiments of the present disclosure, a computer program product is provided, including a computer program, which, when executed by a processor, implements the network anomaly detection method for the cloud network as described in the first aspect and various possible designs of the first aspect.

[0144] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0145] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0146] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A network anomaly detection method for a cloud network, characterized in that: include: In response to a service abnormality of the cloud service, obtaining a cloud service transmission path corresponding to the abnormal service from a cloud network service controller; The cloud service transmission path represents a transmission path that forwards a data packet to a target device through a cloud server and a cloud network forwarding device; Determine a first-end cloud network forwarding device and a terminal cloud network forwarding device in the cloud service transmission path according to the transmission order of each device in the cloud service transmission path; Receive data packet forwarding information of a head-end cloud network forwarding device collected by a first stateful network element and data packet forwarding information of a terminal cloud network forwarding device collected by a second stateful network element; wherein a forwarding information collection function is pre-configured in the first stateful network element and the second stateful network element for collecting data packet forwarding information; Determine the transmission direction of the data packet according to the data forwarding direction in the data packet forwarding information of the head-end cloud network forwarding device and the data forwarding direction in the data packet forwarding information of the end cloud network forwarding device; determine the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device and the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device; Based on the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device, the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device and the transmission direction of the data packet, the cloud network abnormality of the abnormal service is detected.

2. The network anomaly detection method according to claim 1, characterized in that: The step of obtaining, in response to a cloud service service abnormality, a cloud service transmission path corresponding to the abnormal service from a cloud network service controller includes: In response to a business abnormality of the cloud service, obtaining a network communication unique identifier corresponding to the abnormal business, wherein the network communication unique identifier is used to identify and distinguish different businesses; According to the network communication unique identifier, obtaining data packet forwarding information about the abnormal service reported by each cloud network forwarding device from the cloud network service controller; According to the five-tuple information in the data packet forwarding information, the transmission order of each cloud network forwarding device is determined by matching the address information output by the upstream device with the address information input by the downstream device, and the cloud service transmission path corresponding to the abnormal business is obtained.

3. The network anomaly detection method according to claim 1, characterized in that: The detecting the cloud network abnormality of the abnormal service according to the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device, the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device and the transmission direction of the data packet comprises: If the transmission direction of the data packet is from the cloud server to the target device, then based on the data packet forwarding information from the cloud server to the head-end cloud network forwarding device and the data packet forwarding information from the end cloud network forwarding device to the target device, detect whether the abnormal service occurs in the cloud network; If the transmission direction of the data packet is from the target device to the cloud server, it is detected whether the abnormal business occurs in the cloud network based on the data packet forwarding information from the target device to the end cloud network forwarding device and the data packet forwarding information from the head-end cloud network forwarding device to the cloud server.

4. The network anomaly detection method according to claim 3, characterized in that: The detecting whether the abnormal service occurs in the cloud network according to the data packet forwarding information from the cloud server to the head-end cloud network forwarding device and the data packet forwarding information from the end cloud network forwarding device to the target device comprises: If the abnormal forwarding information in the data packet forwarding information from the end cloud network forwarding device to the target device is: the number of confirmed reception times of the data packet is greater than the second preset number or there is disorder in the sending sequence number information, and the abnormal forwarding information in the data packet forwarding information from the cloud server to the head-end cloud network forwarding device is: the transmission delay of the data packet is greater than the first preset time length or the number of retransmissions of the data packet is greater than the first preset number, then it is determined that the business anomaly occurs in the cloud network.

5. The network anomaly detection method according to claim 3, characterized in that: The detecting whether the abnormal service occurs in the cloud network according to the data packet forwarding information from the target device to the end cloud network forwarding device and the data packet forwarding information from the head-end cloud network forwarding device to the cloud server comprises: If the abnormal forwarding information in the data packet forwarding information from the head-end cloud network forwarding device to the cloud server is: the number of confirmed reception times of the data packet is greater than the second preset number or there is disorder in the sending sequence number information, and the abnormal forwarding information in the data packet forwarding information from the target device to the end cloud network forwarding device is: the transmission delay of the data packet is greater than the first preset time length or the number of retransmissions of the data packet is greater than the first preset number, then it is determined that the abnormal business is detected to occur in the cloud network.

6. The network anomaly detection method according to claim 1, characterized in that: The determining of abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device and abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device includes: Determine multiple abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device within a second preset time length, combine and compress the same abnormal forwarding information according to the information sequence, and obtain the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device; and determine multiple abnormal forwarding information of the terminal cloud network forwarding device within a second preset time length, combine and compress the same abnormal forwarding information according to the information sequence, and obtain the abnormal forwarding information in the data packet forwarding information of the terminal cloud network forwarding device.

7. The network anomaly detection method according to any one of claims 1 to 6, characterized in that: The method further comprises: When it is determined that the service anomaly occurs in the cloud network, determine the number of multiple cloud servers connected to the abnormal device in the cloud network and the abnormal duration of the abnormal device; An impact level of the abnormal device is determined according to the number of the plurality of cloud servers and the abnormal duration of the abnormal device, wherein the impact level represents an impact range of the abnormality.

8. A network anomaly detection device for a cloud network, characterized in that: include: An acquisition unit, configured to acquire, in response to a cloud service service abnormality, a cloud service transmission path corresponding to the abnormal service from a cloud network service controller; The cloud service transmission path represents a transmission path that forwards a data packet to a target device through a cloud server and a cloud network forwarding device; A determination unit, configured to determine a head-end cloud network forwarding device and an end-end cloud network forwarding device in the cloud service transmission path according to a transmission sequence of each device in the cloud service transmission path; A receiving unit, configured to receive data packet forwarding information of a head-end cloud network forwarding device collected by a first stateful network element and data packet forwarding information of a terminal cloud network forwarding device collected by a second stateful network element; wherein a forwarding information collection function is pre-configured in the first stateful network element and the second stateful network element for collecting data packet forwarding information; A detection unit is used to determine the transmission direction of a data packet based on the data forwarding direction in the data packet forwarding information of the head-end cloud network forwarding device and the data forwarding direction in the data packet forwarding information of the end cloud network forwarding device; determine abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device and the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device; and detect the cloud network abnormality of the abnormal service based on the abnormal forwarding information in the data packet forwarding information of the head-end cloud network forwarding device, the abnormal forwarding information in the data packet forwarding information of the end cloud network forwarding device and the transmission direction of the data packet.

9. An electronic device, characterized in that: include: Processor and memory; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor executes the network anomaly detection method for the cloud network according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions. When the processor executes the computer-executable instructions, the network anomaly detection method for the cloud network according to any one of claims 1 to 7 is implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the network anomaly detection method for a cloud network as described in any one of claims 1 to 7 is implemented.

Images