Equipment comparison and abnormal equipment identification method and system based on network topology

Abstract

The invention belongs to the technical field of network security, and provides a device comparison and abnormal device identification method and system based on network topology, and the technical scheme is as follows: firstly, on the basis of an SNMP protocol, a network device topology active discovery method is designed to obtain a topology connection relationship, and secondly, the topology connection relationship is obtained through a topology device comparison method; and comparing the planning topology network with the real topology network, and finally constructing a method for identifying the abnormal key equipment based on a PageRank improved algorithm and time decay. According to the method, the problem that the difference between the actual topology and the planned topology cannot be compared in the prior art can be solved, the abnormal key equipment identification method is realized, and technical support is provided for automatically discovering assets and helping a user to master the network operation condition.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a method and system for device comparison and abnormal device identification based on network topology. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] With the rapid development and widespread application of network technology, computer networks have penetrated into all areas of social life and played an increasingly important role in social development. At the same time, with the emergence of large-scale networking needs, the types of network equipment are becoming more and more diverse, the network scale is expanding, and the network structure is becoming more and more complex. It is becoming more difficult to rely solely on manual maintenance of network topology maps. Therefore, network topology automatic discovery technology and abnormal device monitoring are technical issues in the current field of network asset management;

[0004] Existing network topology discovery technologies mainly include the following aspects:

[0005] The Address Resolution Protocol is ARP. The ARP table stores the correspondence between the network address and the physical address of the device. In the algorithm, the connection relationship of the devices in the network can be obtained by querying the table, and then the ARP table in other devices can be queried to obtain the connection relationship of other devices. In this way, the connection relationship of the entire network can be obtained.

[0006] The main principle of the network layer topology discovery method is to use the network layer topology method to obtain the information of the router and each network device and subnet connected to it. The network layer topology discovery is mainly based on two protocols: SNMP and OSPF. The SNMP protocol mainly uses the breadth-first algorithm to traverse the network layer devices. The topology discovery method based on SNMP has clear goals, high efficiency, high speed, and small load on the network; the OSPF protocol is based on the priority open shortest path link state selection. The topology discovery method based on OSPF is efficient and fast, and is suitable for large-scale network topology discovery.

[0007] Link layer topology discovery is mainly based on the LLDP protocol. The LLDP protocol can automatically discover the device and link information in the network, and can accurately discover which interfaces are attached to the devices in the network and the information about the connections between the devices, including device type, connection status, neighboring devices, etc. Therefore, the link layer discovery protocol greatly simplifies the management and maintenance of network devices and improves the manageability and reliability of the network. Due to the transparency of Ethernet switch hardware, link layer discovery is relatively complex and still deserves further study.

[0008] At present, some scholars have combined data mining and graph theory to discover new features from existing data. Complex network topology visualization can transform large amounts of data into graphical representations, thereby discovering patterns and associations in the data. Network topology based on graph algorithms can aggregate neighborhood information of nodes and capture complex features for community discovery from a global perspective.

[0009] However, the above solution has the following technical problems:

[0010] The ARP table generally contains the most recently active devices and is suitable for topology discovery in a local area network. If the network is too large, the data in the table will be constantly updated, and the network relationships of some devices will be overwritten and cannot be discovered, resulting in inaccurate collected data and inaccurate topology discovery.

[0011] Although network layer topology discovery technology is highly efficient and fast, the implementation of the shortest path priority algorithm is complex and the discovery cycle is long. In addition, the OSPF protocol is heavily dependent on the routing protocol, and routers that do not use the OSPF protocol are prohibited from obtaining the link status of other routers.

[0012] In summary, most existing network topology planning functions simply visualize the device topology connection relationship, cannot be associated with the actual on-site topology on the interface, and do not visualize the difference between the actual topology and the planned topology. If the configuration connection fails, engineers need to perform manual inspection, which is complicated. Summary of the invention

[0013] In order to solve at least one technical problem existing in the above-mentioned background technology, the present invention provides a method and system for device comparison and abnormal device identification based on network topology, which can solve the problem that the prior art cannot compare the actual topology with the planned topology, and realizes a method for identifying abnormal key equipment, providing technical support for automatic asset discovery and helping users control network operation status.

[0014] In order to achieve the above object, the present invention adopts the following technical solution:

[0015] A first aspect of the present invention provides a method for comparing devices and identifying abnormal devices based on network topology, comprising the following steps:

[0016] Receive a network scan request for a target area and obtain device information of network devices;

[0017] Based on the acquired device information of the network devices, a planned network topology diagram and a real data network topology diagram are drawn; wherein, in combination with the topological connection relationship corresponding to the network planning requirements, the topological device ports are connected to obtain the planned network topology diagram; and the network devices to be analyzed are connected and the real data network topology diagram is obtained;

[0018] Analyze the connection relationship between network devices and ports in the planned network topology diagram and the real data network topology diagram, and obtain the topology device difference data between the planned network topology diagram and the real data network topology diagram through node and link matching and node attribute matching;

[0019] Adjust the networking equipment in the target area based on topology equipment difference data;

[0020] Based on the real data network equipment topology relationship and graph algorithm to find abnormal paths, in the PageRank algorithm, the time decay coefficient is introduced to measure the importance of events that decrease over time to determine abnormal key devices.

[0021] Furthermore, the connection analysis of the network device to be analyzed is performed to obtain a real data network topology diagram, including:

[0022] Query the network address information of the configured network device, and select a network address to put into the access routing queue;

[0023] According to the network address in the selected queue, access the corresponding routing table and conditionally filter out useless data;

[0024] Determine the type of routing table. If it is the first type, put the next hop address into the queue and save the connection relationship. If it is the second type, calculate the subnet address and compare the subnet address with the address in the routing table. Determine the connection relationship between the selected network address and the subnet based on the comparison result. Access the network addresses in the queue in turn until the queue is empty, output the network topology connection information, and construct a real data network topology map based on the output network topology connection information.

[0025] Furthermore, the network device adopts a switch to establish a switch routing table, and the fields of the switch routing table include a destination network address, a destination network subnet mask, a next hop address and a type.

[0026] Furthermore, the connection relationship between the network devices and ports in the planned network topology diagram and the real data network topology diagram is analyzed, and the topology device difference data of the planned network topology diagram and the real data network topology diagram is obtained by node and link matching and node attribute matching, including:

[0027] Compare the nodes and links of the planned network topology diagram and the real data network topology diagram to see if they are consistent;

[0028] If the nodes and links of the two network topologies match each other, the node attributes are compared to determine whether there is a difference between the two network topologies.

[0029] Among them, the comparison method for matching nodes and links between the planned network topology diagram and the real data network topology diagram is:

[0030] Generate the corresponding minimum spanning trees of the planned network topology and the real data network topology, compare the total weights, vertex sets and edge sets of the two minimum spanning trees to see if they are consistent, and obtain the difference data of the two topology maps;

[0031] The comparison method of the node attributes of the planned network topology diagram and the real data network topology diagram is: based on the minimum spanning tree obtained by matching nodes and links, the node port number is selected for comparison to obtain the error data of the node port.

[0032] Furthermore, the planned network topology diagram and the real data network topology diagram are used to generate corresponding minimum spanning trees, including:

[0033] Obtain the node set V and edge set E of the planned network topology graph and the real data network topology graph;

[0034] Choose any vertex u from the graph as the starting point and add it to the minimum spanning tree U. Initialize the priority queue Q and use the edge weight as the priority.

[0035] If the weight of edge (v,u) is less than the weight of the current edge, update the edge in Q to (v,u);

[0036] Take the edge (v,u) from Q, where u is in U and v has not been added to U, add v to the minimum spanning tree U, add the edge from a node v in the node set V to the priority queue Q, and then sort by weight until the priority queue is updated according to the weight sorting;

[0037] When the priority queue Q is empty, that is, all vertices are added to U, the iteration ends and the corresponding minimum spanning tree is output.

[0038] Furthermore, the node port number is selected for comparison based on the minimum spanning tree obtained by matching nodes and links to obtain error data of the node port, including:

[0039] Scan and obtain the port data of the planned network topology diagram;

[0040] Based on the node information of the minimum spanning tree, the connection relationship table is queried to obtain the port data of the real network topology diagram;

[0041] Generate a port information set based on the port data of the planned network topology map and the port data of the actual network topology map;

[0042] Based on the port information set, the node port error data is obtained by using the set method to find the difference set.

[0043] Furthermore, the abnormal path is found based on the network device topology relationship and the graph algorithm, and in the PageRank algorithm, a time decay coefficient is introduced to measure the importance of events that decrease over time to determine abnormal key devices, including:

[0044] Initialize event weights and PageRank values, assign corresponding weights to events occurring on network devices according to their types and levels, and initialize all network topology nodes to Where N is the total number of nodes in the topology;

[0045] Calculate PageRank value, Among them, R is the PageRank vector, d is the damping factor, P is the transition probability matrix, k is the current node, and k+1 is the next node;

[0046] Calculate the time decay coefficient, Where α is the time decay factor, t h is the historical time, t c is the current time, w is the weight of the current time;

[0047] Improved PageRank algorithm based on time decay coefficient, R = w·R k-1 +R k , R k-1 is the PageRank value of the previous node, R k is the PageRank value of the current node;

[0048] The PageRank values ​​are sorted, and devices with PageRank values ​​greater than the set value are identified as abnormal key devices.

[0049] A second aspect of the present invention provides a device comparison and abnormal device identification system based on network topology, comprising:

[0050] A source data acquisition module, which is used to receive a network scan request about a target area and acquire device information of network devices;

[0051] A topology drawing module is used to draw a planned network topology map and a real data network topology map based on the acquired device information of the network devices; wherein, in combination with the topological connection relationship corresponding to the network planning requirements, the topological device ports are connected to obtain the planned network topology map; and the network devices to be analyzed are connected and the real data network topology map is obtained;

[0052] A topology comparison module is used to analyze the connection relationship between network devices and ports in the planned network topology map and the real data network topology map, and obtain the topology device difference data between the planned network topology map and the real data network topology map through node and link matching and node attribute matching; and adjust the networking devices in the target area based on the topology device difference data;

[0053] The abnormal device location module is used to find abnormal paths based on the real data network device topology relationship and graph algorithm. In the PageRank algorithm, the time decay coefficient is introduced to measure the importance of events that decrease over time to determine abnormal key devices.

[0054] A third aspect of the present invention provides a computer-readable storage medium.

[0055] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps in the above-mentioned method for device comparison and abnormal device identification based on network topology.

[0056] A fourth aspect of the present invention provides a computer device.

[0057] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps in the above-mentioned method for device comparison and abnormal device identification based on network topology are implemented.

[0058] Compared with the prior art, the present invention has the following beneficial effects:

[0059] The present invention associates the planned topology network with the actual topology on site, compares the difference between the actual topology and the planned topology, and at the same time, constructs a method for identifying abnormal key equipment based on the PageRank improved algorithm and time decay, and constructs a network topology comparison algorithm based on the priority queue improved Prim algorithm, which can improve the performance of the prim algorithm. Since the urgency and influence of an event may gradually decrease over time after it occurs, the time decay coefficient is introduced into the PageRank algorithm to measure the importance of the event that decreases over time, thereby improving the accuracy of the algorithm and providing technical support for automatic asset discovery and helping users control network operation.

[0060] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0062] Figure 1 This is a diagram of the network topology device comparison and anomaly location analysis architecture provided by an embodiment of the present invention;

[0063] Figure 2 It is a flow chart of network topology device comparison and abnormal location data analysis provided by an embodiment of the present invention;

[0064] Figure 3 This is a network topology diagram actually generated according to an embodiment of the present invention. DETAILED DESCRIPTION

[0065] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0066] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0067] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0068] Explanation of terms

[0069] SNMP Protocol: The original name of Simple Network Management Protocol (SNMP) is Simple Gateway Monitoring Protocol (SGMP). SNMP is characterized by simplicity and extensibility, which includes a database schema, an application layer protocol and some data files. SNMP management protocol can not only enhance the efficiency of network management system, but also be used to manage and monitor the resources in the network in real time.

[0070] PageRank: The basic idea of ​​the PageRank algorithm is to define a random walk model on a directed graph, namely a first-order Markov chain, which describes the behavior of a random walker randomly visiting each node along the directed graph; under certain conditions, the probability of visiting each node in the extreme case converges to a stable distribution. At this time, the equilibrium probability value of each node is its PageRank value, which indicates the importance of the node.

[0071] In view of the technical problems existing in the background technology, the present invention proposes a device comparison and abnormal device identification and monitoring method based on network topology. The present invention mainly discusses the problems of active discovery of network device topology, topology difference comparison and abnormal device monitoring, including designing a network device topology active discovery method based on the SNMP protocol to obtain the topological connection relationship, and then using the topological device comparison method to compare the planned topology network with the actual topology network, and finally constructing a method for identifying abnormal key devices based on the PageRank improved algorithm and time decay. This method can solve the problem that the existing technology cannot compare the actual topology with the planned topology difference, and realizes the abnormal key device identification method, providing technical support for automatic asset discovery and helping users control network operation.

[0072] Embodiment 1

[0073] like Figure 1-Figure 2 As shown, this embodiment provides a device comparison and abnormal device identification method based on network topology, including the following steps:

[0074] Step 1: Receive a network scan request for the target area and obtain device information of network devices;

[0075] In this embodiment, the network device takes a switch as an example, establishes a switch routing table, and sets fields such as destination network address (dipRoute), destination network subnet mask (dipRouteMask), next hop address (dipRouteNext), and type (dipRouteType).

[0076] Step 2: Based on the acquired device information of the network devices, draw a planned network topology map and a real data network topology map;

[0077] In this embodiment, a scheduled task for automatic topology drawing is constructed. The task is executed every half hour, and a breadth-first traversal algorithm is used to regularly refresh the network device connection table. Specifically, the following steps are included:

[0078] Step 201: Combine the topological connection relationship corresponding to the network planning requirements, connect the topological device ports, and obtain the planned network topology diagram;

[0079] Step 202, performing connection analysis on the network device to be analyzed to obtain a real data network topology diagram; specifically includes the following steps:

[0080] Step 2021, input switch IP, SNMP version, community name, port and other information;

[0081] Step 2022, query the configured switch IP information, select an IP and put it into the access routing queue routeQueue;

[0082] Step 2023: according to the IP in the selected queue, access the routing table of the IP, and conditionally filter out useless data such as loopback addresses;

[0083] Step 2024, determine the attribute information dipRouteType of the routing table. If it is a direct route, put dipRouteNext into routeQueue and save the connection relationship. If it is an indirect route, calculate the subnet address and compare it with the address in the routing table. If it is true, it means that this IP is not indirectly connected to the subnet, and save the connection relationship between the IP and the subnet.

[0084] Step 2025, access the IPs in routeQueue in sequence until the queue is empty;

[0085] Step 2026: Output network topology connection information.

[0086] Step 3: Analyze the connection relationship between the network devices and ports in the planned network topology diagram and the real data network topology diagram, and obtain the topology device difference data between the planned network topology diagram and the real data network topology diagram through node and link matching and node attribute matching; specifically, the following steps are included:

[0087] Step 301: Generate corresponding minimum spanning trees MST1 and MST2 from the planned network topology map and the real data network topology map, and compare whether the total weights, vertex sets and edge sets of the two minimum spanning trees are consistent to determine whether there is a difference between the two network topologies;

[0088] In this embodiment, the network topology graph is connected into a minimum spanning tree MST based on the Prim algorithm. In graph theory, the minimum spanning tree MST of the graph G is defined as a subgraph that connects all nodes in the graph G without forming a closed loop and has the smallest sum of weights of all edges.

[0089] MST can be expressed by the following formula:

[0090] MST={N,E,W} (1),

[0091] Where N is the node set, E is the edge set, and E ij (N i,N j ) is the connection node N i and N j , W is the weight set of the edges, and the out-degree of the edge is used as the weight;

[0092] In this embodiment, when processing large amounts of data, the Prim algorithm is optimized based on the priority queue, and the steps of generating a minimum spanning tree from the actual network topology map and the planned network topology map by the Prim algorithm include:

[0093] Step 3011, input the node set V and the edge set E;

[0094] Step 3012: arbitrarily select a vertex u from the graph as the starting point, add it to the minimum spanning tree U, initialize the priority queue Q, and use the edge weight as the priority;

[0095] Step 3013: If the weight of the edge (v,u) is less than the weight of the current edge, update the edge in Q to (v,u);

[0096] Step 3014: Take the edge (v,u) from Q, where u is in U and v has not been added to U, add v to the minimum spanning tree U, add the edge starting from a node v in the node set V to the priority queue Q, and then sort them according to weight;

[0097] Step 3015: Repeat step 3014 to ensure that the priority queue is updated according to the weight sorting;

[0098] Step 3016: When the priority queue Q is empty, that is, all vertices are added to U, the iteration ends;

[0099] Step 3017: Output the minimum spanning tree U.

[0100] Step 302: If the nodes and links of the two network topology maps match each other, then determine whether there is a difference between the two network topology maps by comparing the node attributes;

[0101] If the nodes and links of the two network topology maps match each other, the node attributes are compared to determine whether there is a difference between the two network topology maps. The present invention selects the node port number for comparison based on the minimum spanning tree obtained by matching the nodes and links; the node port comparison training method includes the following steps:

[0102] Step 3021: input the minimum spanning tree data obtained by matching nodes and links;

[0103] Step 3022: Obtain port data of the planned network topology map through nmap scanning;

[0104] Step 3023: query the connection relationship table based on the node information of the minimum spanning tree to obtain the port data of the real network topology diagram;

[0105] Step 3024, generating a port information set from the port data of the two network topology diagrams;

[0106] Step 3025: Use the set method to find the difference set, where differentA=listA-listB represents the elements in listA but not in listB; listA and listB represent the port information sets of the topology graphs, and differentA represents the different port information of the two topology graphs;

[0107] Step 3026: Output the node port error set.

[0108] Step 4: Adjust the networking devices in the target area based on the topology device difference data.

[0109] Step 5: Find abnormal paths based on the real data network device topology relationship and graph algorithm, and determine abnormal key devices through the PageRank improved algorithm and event time decay.

[0110] The present invention obtains abnormal key devices in the network topology based on the PageRank improved algorithm and event time decay. Since the urgency and influence of an event may gradually decrease over time after it occurs, the present invention introduces the time decay coefficient w into the PageRank algorithm to measure the importance of the event as time goes by. The steps of the abnormal key device detection method are as follows:

[0111] Step 501: Initialize event weights and PageRank values, assign corresponding weights to events occurring on network devices according to their types and levels, and initialize all network topology nodes to Where N is the total number of nodes in the topology;

[0112] Step 502: Calculate the PageRank value. Where R is the PageRank vector, d is the damping factor, P is the transition probability matrix, k is the current node, and k+1 is the next node;

[0113] Step 503: Calculate the time attenuation coefficient. Where α is the time decay factor, t h is the historical time, t c is the current time, w is the weight of the current time;

[0114] Step 504: construct an improved PageRank algorithm based on the time decay coefficient, R = w·R k-1 +R k , R k-1is the PageRank value of the previous node, R k is the PageRank value of the current node;

[0115] Step 505: sort the PageRank values, and devices with higher PageRank values ​​are identified as abnormal key devices.

[0116] The present invention selects the relevant network equipment data of a platform system area, and obtains the actual network topology diagram according to the connection relationship planned based on the topology requirements according to the configured switch and port information and the network topology information. Figure 3 shown.

[0117] Network topology comparison

[0118] The present invention is based on Figure 3 Compare the planned topology network with the actual topology network. First, determine whether the two topology diagrams are consistent by comparing nodes and links. The weights and node information of the two minimum spanning trees are consistent according to the Prim algorithm. Then further determine whether the two topology diagrams are consistent by matching node attributes. The comparison results show that the port number corresponding to the planned topology node 6 is Ethernet1 / 2, while the topology device port number corresponding to the actual detected topology network is Ethernet1 / 5, and the result is a match failure. After checking the device information and modifying it, re-comparison verification is performed. The port number corresponding to node 6 is Ethernet1 / 2, and the topology device port number corresponding to the actual topology network is also Ethernet1 / 2. It can be determined that the two topology information are successfully compared and matched.

[0119] Network topology abnormal device detection

[0120] The present invention performs abnormal key equipment detection and verifies the accuracy of the detection method through the recognition rate, and the calculation formula is as follows:

[0121]

[0122] Among them, TP is the number of abnormal devices correctly identified, and FN is the number of abnormal devices incorrectly identified.

[0123] Figure 3 The number of known abnormal devices is 8. The present invention correctly identifies 7 abnormal devices using the PageRank-based improved algorithm and event time decay method. The recognition rate of this method is 87.5% calculated by formula (2). The TOP3 abnormal key devices are selected according to the PageRank value. When the amount of data is large, the PageRank algorithm can be better trained to improve the recognition rate. The number of detections by this method is close to the actual number, indicating that the PageRank-based improved algorithm and event time decay provided by the present invention are effective in detecting abnormal devices in network topology.

[0124] Embodiment 2

[0125] This embodiment provides a device comparison and abnormal device identification system based on network topology, including:

[0126] A source data acquisition module, which is used to receive a network scan request about a target area and acquire device information of network devices;

[0127] A topology drawing module is used to draw a planned network topology map and a real data network topology map based on the acquired device information of the network devices; wherein, in combination with the topological connection relationship corresponding to the network planning requirements, the topological device ports are connected to obtain the planned network topology map; and the network devices to be analyzed are connected and the real data network topology map is obtained;

[0128] A topology comparison module is used to analyze the connection relationship between network devices and ports in the planned network topology map and the real data network topology map, and obtain the topology device difference data between the planned network topology map and the real data network topology map through node and link matching and node attribute matching; and adjust the networking devices in the target area based on the topology device difference data;

[0129] The abnormal device location module is used to find abnormal paths based on the real data network device topology relationship and graph algorithm. In the PageRank algorithm, the time decay coefficient is introduced to measure the importance of events that decrease over time to determine abnormal key devices.

[0130] Embodiment 3

[0131] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the device comparison and abnormal device identification method based on network topology as described above are implemented.

[0132] Embodiment 4

[0133] This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps in the method for device comparison and abnormal device identification based on network topology as described above are implemented.

[0134] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

[0135] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0136] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0137] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0138] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0139] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for comparing devices and identifying abnormal devices based on network topology, characterized in that: The steps include: Receive a network scan request for a target area and obtain device information of network devices; Based on the acquired device information of the network devices, a planned network topology diagram and a real data network topology diagram are drawn; wherein, in combination with the topological connection relationship corresponding to the network planning requirements, the topological device ports are connected to obtain the planned network topology diagram; and the network devices to be analyzed are connected and the real data network topology diagram is obtained; Analyze the connection relationship between network devices and ports in the planned network topology diagram and the real data network topology diagram, and obtain the topology device difference data between the planned network topology diagram and the real data network topology diagram through node and link matching and node attribute matching; Adjust the networking equipment in the target area based on topology equipment difference data; Based on the real data network equipment topology relationship and graph algorithm to find abnormal paths, in the PageRank algorithm, the time decay coefficient is introduced to measure the importance of events that decrease over time to determine abnormal key devices.

2. A method for comparing devices and identifying abnormal devices based on network topology as claimed in claim 1, characterized in that: The connection analysis of the network device to be analyzed is performed to obtain a real data network topology diagram, including: Query the network address information of the configured network device, and select a network address to put into the access routing queue; According to the network address in the selected queue, access the corresponding routing table and conditionally filter out useless data; Determine the type of routing table. If it is the first type, put the next hop address into the queue and save the connection relationship. If it is the second type, calculate the subnet address and compare the subnet address with the address in the routing table. Determine the connection relationship between the selected network address and the subnet based on the comparison result. The network addresses in the queue are accessed in sequence until the queue is empty, the network topology connection information is output, and the real data network topology map is constructed based on the output network topology connection information.

3. The method for comparing devices and identifying abnormal devices based on network topology according to claim 1, characterized in that: The network device uses a switch to establish a switch routing table. The fields of the switch routing table include the destination network address, the destination network subnet mask, the next hop address and the type.

4. The method for comparing devices and identifying abnormal devices based on network topology according to claim 1, characterized in that: The connection relationship between the network devices and ports in the planned network topology diagram and the real data network topology diagram is analyzed, and the topology device difference data between the planned network topology diagram and the real data network topology diagram is obtained through node and link matching and node attribute matching, including: Compare the nodes and links of the planned network topology diagram and the real data network topology diagram to see if they are consistent; If the nodes and links of the two network topologies match each other, the node attributes are compared to determine whether there is a difference between the two network topologies. Among them, the comparison method for matching nodes and links between the planned network topology diagram and the real data network topology diagram is: Generate the corresponding minimum spanning trees of the planned network topology and the real data network topology, compare the total weights, vertex sets and edge sets of the two minimum spanning trees to see if they are consistent, and obtain the difference data of the two topology maps; The comparison method of the node attributes of the planned network topology diagram and the real data network topology diagram is: based on the minimum spanning tree obtained by matching nodes and links, the node port number is selected for comparison to obtain the error data of the node port.

5. A method for comparing devices and identifying abnormal devices based on network topology as claimed in claim 4, characterized in that: Generate the corresponding minimum spanning tree of the planned network topology and the real data network topology, including: Obtain the node set V and edge set E of the planned network topology graph and the real data network topology graph; Select any vertex u from the graph as the starting point and add it to the minimum spanning tree U. Initialize the priority queue Q and use the edge weight as the priority. If the weight of edge (v,u) is less than the weight of the current edge, update the edge in Q to (v,u); Take the edge (v,u) from Q, where u is in U and v has not been added to U, add v to the minimum spanning tree U, add the edge from a node v in the node set V to the priority queue Q, and then sort by weight until the priority queue is updated according to the weight sorting; When the priority queue Q is empty, that is, all vertices are added to U, the iteration ends and the corresponding minimum spanning tree is output.

6. The method for comparing devices and identifying abnormal devices based on network topology according to claim 1, characterized in that: The node port number is selected for comparison based on the minimum spanning tree obtained by matching nodes and links to obtain error data of the node port, including: Scan and obtain the port data of the planned network topology diagram; Based on the node information of the minimum spanning tree, the connection relationship table is queried to obtain the port data of the real network topology diagram; Generate a port information set based on the port data of the planned network topology map and the port data of the actual network topology map; Based on the port information set, the node port error data is obtained by using the set method to find the difference set.

7. The method for comparing devices and identifying abnormal devices based on network topology according to claim 1, characterized in that: The abnormal path is found based on the network device topology relationship and graph algorithm. In the PageRank algorithm, the time decay coefficient is introduced to measure the importance of the event that decreases over time to determine the abnormal key devices, including: Initialize event weights and PageRank values, assign corresponding weights to events occurring on network devices according to their types and levels, and initialize all network topology nodes to Where N is the total number of nodes in the topology; Calculate PageRank value, Among them, R is the PageRank vector, d is the damping factor, P is the transition probability matrix, k is the current node, and k+1 is the next node; Calculate the time decay coefficient, Where α is the time decay factor, t h is the historical time, t c is the current time, w is the weight of the current time; Improved PageRank algorithm based on time decay coefficient, R = w·R k-1 +R k , R k-1 is the PageRank value of the previous node, R k is the PageRank value of the current node; The PageRank values ​​are sorted, and devices with PageRank values ​​greater than the set value are identified as abnormal key devices.

8. A device comparison and abnormal device identification system based on network topology, characterized in that: include: A source data acquisition module, which is used to receive a network scan request about a target area and acquire device information of network devices; A topology drawing module is used to draw a planned network topology map and a real data network topology map based on the acquired device information of the network devices; wherein, in combination with the topological connection relationship corresponding to the network planning requirements, the topological device ports are connected to obtain the planned network topology map; and the network devices to be analyzed are connected and the real data network topology map is obtained; A topology comparison module is used to analyze the connection relationship between network devices and ports in the planned network topology map and the real data network topology map, and obtain the topology device difference data between the planned network topology map and the real data network topology map through node and link matching and node attribute matching; and adjust the networking devices in the target area based on the topology device difference data; The abnormal device location module is used to find abnormal paths based on the real data network device topology relationship and graph algorithm. In the PageRank algorithm, the time decay coefficient is introduced to measure the importance of events that decrease over time to determine abnormal key devices.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps in a method for device comparison and abnormal device identification based on network topology as described in any one of claims 1 to 7 are implemented.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps in the method for device comparison and abnormal device identification based on network topology as described in any one of claims 1-7 are implemented.

Images