Network data prediction analysis method and system

Abstract

The invention discloses a network data prediction analysis method and system, and belongs to the technical field of network data analysis processing. Comprising the following steps: acquiring preprocessed network data; based on the preprocessed network data, extracting an instantaneous flow rate value, a flow rate difference value and a transmission data flow total value of the network data transmission node in the supervision time period, and obtaining a transmission flow evaluation coefficient of the network data transmission node in the supervision time period according to the instantaneous flow rate value, the flow rate difference value and the transmission data flow total value; and acquiring transmission data volumes during uninterrupted transmission and interrupted transmission in the network data transmission process, and performing optimization early warning on the network data transmission nodes based on the transmission flow evaluation coefficient and the transmission data volumes. Transmission supervision evaluation analysis can be carried out on the network data, early warning optimization can be carried out in time according to the analysis result, and the problem that the transmission safety performance and the transmission efficiency of the network data cannot be improved through existing transmission condition analysis is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of network data analysis and processing, and in particular to a network data prediction and analysis method and system. Background Art

[0002] Network data predictive analysis refers to the monitoring, recording and analysis of various information during data transmission over the network in order to evaluate network performance, identify potential security threats, optimize the use of network resources, etc.

[0003] A Chinese invention patent with application publication number CN116150288A and application publication date 2023.05.23 discloses a computer-based network data analysis and processing system, which uses a data acquisition module, a preprocessing module, a storage module, an analysis module and a visualization module to collect and process the data source files to be analyzed of the network data provider, associate the data during the data analysis process, and analyze the data through a first data analysis model and a second data analysis model and display it in a visual interface, so that key data can be automatically extracted, the efficiency and accuracy of data analysis can be improved, and the data can be effectively managed automatically.

[0004] However, when analyzing the transmission status during network data transmission, the existing technologies mostly only analyze the transmission status from the perspective of transmission flow, and the judgment of network data transmission status is not comprehensive enough, and it is not possible to conduct in-depth analysis of the data packet status during the abnormal transmission flow stage. It is unable to deal with the abnormal data packet situation accordingly, and cannot guarantee the transmission security performance and transmission efficiency of network data, resulting in transmission anomalies of network data, causing data loss and data corruption. It is also unable to predict the abnormal situation during network data transmission, and cannot perform corresponding optimization operations in advance according to the prediction results, and cannot improve the transmission security performance and transmission efficiency of network data. Summary of the invention In order to address the deficiencies in the prior art, the present invention provides a network data prediction and analysis method, system, electronic device, computer-readable storage medium and computer program product, which comprehensively analyze the network data transmission status from the perspective of transmission flow and transmission data, and perform optimization and early warning based on the analysis results, so as to ensure the transmission security performance and transmission efficiency of the network data.

[0005] In a first aspect, the present invention provides a network data prediction and analysis method; A network data prediction and analysis method, comprising: Get preprocessed network data; Based on the preprocessed network data, the instantaneous flow rate value, flow rate difference and total value of the transmission data flow of the network data transmission node in the supervision period are extracted, and the transmission flow evaluation coefficient of the network data transmission node in the supervision period is obtained according to the instantaneous flow rate value, flow rate difference and total value of the transmission data flow; The amount of data transmitted during uninterrupted and intermittent transmission in the network data transmission process is obtained, and the network data transmission nodes are optimized and warned based on the transmission flow evaluation coefficient and the amount of data transmitted.

[0006] In some embodiments, if the transmission traffic assessment coefficient is not less than a preset transmission traffic assessment coefficient threshold, there is a transmission traffic anomaly during the supervision period; the amount of data packets sent and the amount of data packets received by the network data transmission node during the supervision period are extracted to generate a data packet reception and transmission ratio; based on the comparison result of the data packet reception and transmission ratio and the preset data packet reception and transmission ratio threshold, it is determined whether the network data transmission node is under a network attack.

[0007] In some embodiments, if the data packet receiving and sending ratio is less than a preset data packet receiving and sending ratio threshold, it is determined that the network data transmission node is under a network attack during the supervision period, and a security protection signal is generated and sent to the early warning display module; If the data packet receiving and sending ratio is greater than or equal to the preset data packet receiving and sending ratio threshold, it is determined that the network data transmission node has network congestion during the supervision period, and a network optimization signal is generated and sent to the early warning display module.

[0008] In some implementations, obtaining the transmission data volume during uninterrupted transmission and discontinuous transmission during network data transmission, and optimizing and warning the network data transmission nodes respectively based on the transmission data volume includes: Obtain the number of data covered by transmission and the number of data actually identified by transmission during uninterrupted transmission, and generate a deviation value based on the number of data covered by transmission and the number of data actually identified by transmission; Get the maximum decrease span value of the network data transmission volume corresponding to the network data transmission disconnection moment during intermittent transmission; Based on the comparison result between the deviation value and the preset deviation value threshold and the comparison result between the maximum drop span value and the preset maximum drop span value threshold, it is determined whether the transmission data volume of the network data is normal.

[0009] In some implementations, if the deviation value is greater than a preset deviation value threshold or the maximum drop span value is less than a preset maximum drop span value threshold, a transmission data volume abnormality signal is generated and sent to the early warning display module.

[0010] In some embodiments, it further comprises: Anomaly prediction is performed based on the preprocessed network data, anomaly prediction results are obtained, and a protection system is constructed based on the anomaly prediction results.

[0011] In a second aspect, the present invention provides a network data prediction and analysis system; A network data prediction and analysis system, comprising: The data supervision and analysis module is configured to: obtain preprocessed network data; based on the preprocessed network data, extract the instantaneous flow rate value, flow rate difference and total value of the transmission data flow of the network data transmission node in the supervision period, and obtain the transmission flow evaluation coefficient of the network data transmission node in the supervision period according to the instantaneous flow rate value, flow rate difference and total value of the transmission data flow; Based on the comparison results of the transmission flow evaluation coefficient and the preset threshold, the network data transmission nodes are optimized and warned.

[0012] In a third aspect, the present invention provides an electronic device; An electronic device includes a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above-mentioned network data prediction and analysis method.

[0013] In a fourth aspect, the present invention provides a computer-readable storage medium; A computer-readable storage medium stores a computer program / instruction, which implements the steps of the above-mentioned network data prediction and analysis method when executed by a processor.

[0014] In a fifth aspect, the present invention provides a computer program product; A computer program product includes a computer program / instruction, which implements the steps of the above-mentioned network data prediction and analysis method when executed by a processor.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. The technical solution provided by the present invention conducts transmission supervision, evaluation and analysis on network data, provides positive feedback on the analysis of network data transmission status from the perspective of transmission traffic, determines whether there is any abnormality in the network data transmission status, and if there is any abnormality, promptly issues an early warning and takes corresponding processing measures, provides side feedback on the analysis of network data transmission status from the perspective of transmission data, and then comprehensively evaluates the network data transmission status, can conduct in-depth analysis of the data packet status in the abnormal transmission traffic stage, can take corresponding measures to deal with the abnormal data packet status, ensure the transmission security performance and transmission efficiency of network data, and avoid data loss and data damage caused by transmission abnormality of network data.

[0016] 2. The technical solution provided by the present invention predicts abnormal conditions in the process of network data transmission, builds a targeted protection system based on the abnormal prediction results, and can continuously update the protection system in conjunction with the learning of the learning model. It can perform corresponding optimization operations in advance according to the prediction results, thereby improving the transmission security performance and transmission efficiency of network data. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0018] Figure 1 A schematic diagram of a process flow provided in Embodiment 1 of the present invention; Figure 2 A schematic diagram of a flow chart provided for Embodiment 2 of the present invention; Figure 3 A schematic diagram of the system framework provided in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0019] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used in the present invention have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0020] It should be noted that the terms used herein are only for describing specific embodiments, and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that the terms "include" and "have" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0021] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0022] Embodiment 1 The existing network data analysis and processing methods have a single analysis dimension, and it is difficult to comprehensively and accurately evaluate and predict the network data transmission status; therefore, the present invention provides a network data prediction and analysis method, which analyzes the network data transmission status from the perspective of transmission flow and the perspective of transmission data respectively, to achieve a comprehensive evaluation of the network data transmission status, so as to perform timely processing in the event of anomalies and ensure the transmission security performance and transmission efficiency of network data.

[0023] Next, combine Figure 1 , a network data prediction and analysis method disclosed in this embodiment is described in detail. The network data prediction and analysis method includes the following steps: S1. Obtain preprocessed network data, wherein the network data includes node information, edge information, flow data, transmission performance indicators and supervision period. Node information includes node ID, node type and node characteristics. Edge information includes edge ID, source node, target node and edge capacity. Flow data includes timestamp, data packet size and data flow direction. Transmission performance indicators include network delay, packet loss rate and network status. Supervision period includes start time and end time.

[0024] In this embodiment, the required network data is collected through the Internet of Things terminal and the network data is preprocessed by the data preprocessing module. The preprocessed network data is transmitted to the data transmission supervision and analysis module via the management platform and the data transmission module.

[0025] As an implementation method, the specific process of preprocessing network data by the data preprocessing module is as follows: (1) Data reception and verification: Receive network data collected from IoT terminals, perform preliminary processing on the network data, including data format conversion and standardization, and perform preliminary verification of the data.

[0026] (2) Data cleaning: Utilize the distributed storage and computing resources provided by the data preprocessing module to perform in-depth cleaning of network data. By comparing and analyzing the records in the data set, duplicate or redundant data can be found and deleted. For missing values ​​in the data, interpolation and regression methods are used to fill or delete them according to the characteristics of the data and business needs. Statistical methods or machine learning algorithms are used to identify outliers in the data, and they are corrected and deleted.

[0027] (3) Data correction: Utilize the high-performance computing capabilities of the data preprocessing module to perform fine correction on the cleaned data, convert network data from different sources and formats into a unified format, and adjust and optimize the parameters in the processing process based on the characteristics of the data and business needs.

[0028] (4) Result output: Send the preprocessed network data to the management platform.

[0029] The collected network data is processed and verified, cleaned and corrected in turn through the data preprocessing module, and finally output in a unified format to facilitate subsequent transmission, processing and analysis of the network data.

[0030] S2. Generate a supervision cycle and divide the supervision cycle T into several supervision periods {t1, t2, ..., tn}, that is, T = {t1, t2, ..., tn}, so as to extract data corresponding to the supervision period in subsequent steps.

[0031] S3. Based on the preprocessed network data, the instantaneous flow rate value, flow rate difference and total value of the transmitted data flow of the network data transmission node during the supervision period are extracted; according to the instantaneous flow rate value, flow rate difference and total value of the transmitted data flow, the transmission flow evaluation coefficient of the network data transmission node during the supervision period is obtained.

[0032] Specifically, the instantaneous flow rate values ​​of the network data transmission nodes in the preprocessed network data during the supervision period are extracted to construct a set A of instantaneous flow rate values, and the mean of the difference between the maximum subset and the minimum subset in set A is recorded as the flow rate difference LC. The larger the value of the flow rate difference LC, the greater the traffic fluctuation during network data transmission and the worse the network data transmission effect.

[0033] The total transmission data flow LZ of the network data transmission nodes during the supervision period is extracted from the preprocessed network data. The total transmission data flow LZ is the total transmission data flow of the network data transmission nodes during the supervision period. The larger the value of the total transmission data flow LZ, the more flow is required to transmit the same amount of network data, and the worse the network data transmission effect is.

[0034] Obtain the flow rate time difference data LS of the network data transmission node during the supervision period. The flow rate time difference data LS represents the absolute value of the difference between the highest flow rate time point and the lowest flow rate time point. The highest flow rate time point represents the transmission time of the highest flow rate, and the lowest flow rate time point represents the transmission time of the lowest flow rate. S4. According to the flow rate difference, flow rate time difference data and the total value of the transmitted data flow, obtain the transmission flow evaluation coefficient CPX of the network data transmission node in the supervision period, compare the transmission flow evaluation coefficient CPX with the preset transmission flow evaluation coefficient threshold, if the transmission flow evaluation coefficient CPX is less than the preset transmission flow evaluation coefficient threshold, then it is determined that the data transmission flow of the network data transmission node in the supervision period meets the requirements, and the corresponding supervision period is marked as a normal transmission flow period; if the transmission flow evaluation coefficient CPX is greater than or equal to the preset transmission flow evaluation coefficient threshold, then it is determined that the data transmission flow of the network data transmission node in the supervision period does not meet the requirements, and the corresponding supervision period is marked as an abnormal transmission flow period; at the same time, execute S5.

[0035] Among them, the transmission flow evaluation coefficient is expressed as: ; In the formula, b1, b2 and b3 are all proportional coefficients, and b1>b2>b3>1.

[0036] The larger the value of the transmission flow evaluation coefficient is, the more transmission flow is required to transmit the same network data, and the worse the transmission effect of the network data is.

[0037] S5. Extract the amount of data packets sent and received by the network data transmission node in the supervision period from the preprocessed network data, mark the ratio of the amount of data packets received to the amount of data packets sent as the data packet receiving and sending ratio, and compare the data packet receiving and sending ratio with a preset data packet receiving and sending ratio threshold.

[0038] If the data packet receiving and sending ratio is less than the preset data packet receiving and sending ratio threshold, it is determined that the network data transmission node encounters a network attack during the period of abnormal transmission traffic, and a security protection signal is generated and sent to the early warning display module; after receiving the security protection signal, the early warning display module generates a display text indicating that protection is required due to a network attack, and immediately pops up a window to remind you to choose whether to interrupt transmission and start security protection software when encountering a network attack, and records the occurrence time, type, source and location of the unreceived data packets of the above events through the operation log, and sends them separately through a signal channel with no format requirements.

[0039] If the data packet receiving and sending ratio is greater than or equal to the preset data packet receiving and sending ratio threshold, it is determined that the network data transmission node has network congestion during the period of abnormal transmission traffic, and a network optimization signal is generated. The network optimization signal is sent to the early warning display module via the management platform; after receiving the network optimization signal, the early warning display module generates a network congestion optimization display text, and immediately pops up a window to remind the selection option: whether the current network congestion interrupts the transmission for network optimization processing, and records the occurrence time, type, source and location of the repeatedly sent data packets of the above events through the operation log, retains one of the complete data packets, and deletes the excess data packets.

[0040] S6. Obtain the number of data covered by transmission and the number of data actually identified by transmission during uninterrupted transmission, and generate a deviation value based on the number of data covered by transmission and the number of data actually identified by transmission; at the same time, obtain the maximum reduction span value of the network data transmission data volume corresponding to the moment when the network data transmission is disconnected during intermittent transmission; and compare the deviation value between the number of data covered by transmission and the number of data actually identified by transmission during uninterrupted transmission and the maximum reduction span value of the network data transmission data volume corresponding to the moment when the network data transmission is disconnected during intermittent transmission with the preset data volume deviation value threshold and the preset maximum reduction span value threshold, respectively.

[0041] If the deviation between the transmission coverage quantity and the actual transmission identification data quantity during uninterrupted transmission in the network data transmission process exceeds the preset data volume deviation value threshold, or the maximum decrease span value of the network data transmission data volume corresponding to the network data transmission disconnection moment during intermittent transmission in the network data transmission process does not exceed the preset maximum decrease span value threshold, then the network data transmission data volume is judged to be abnormal, and an abnormal transmission data volume signal is generated and sent to the early warning display module; after receiving the abnormal transmission data volume signal, the early warning display module generates a display text that the transmission data volume is abnormal and needs to be checked, and immediately pops up a window to remind and propose options: whether to interrupt the transmission for inspection and maintenance if there is an abnormality in the current transmission data volume, and record the occurrence time, type, and source of the above events through the operation log, and inspect and maintain the transmission equipment, transmission network and transmission medium.

[0042] If the deviation value between the transmission coverage quantity and the actual transmission identification data quantity during uninterrupted transmission in the network data transmission process does not exceed the preset data volume deviation value threshold, and the maximum decrease span value of the network data transmission data volume corresponding to the network data transmission disconnection moment during intermittent transmission in the network data transmission process exceeds the preset maximum decrease span value threshold, then the transmission data volume of the network data is determined to be normal, and no signal is generated; the early warning display module receives the transmission data volume abnormality signal, the safety protection signal and the network optimization signal, and sends out the corresponding display text respectively.

[0043] Relevant personnel conduct corresponding inspections on abnormal data transmission volume, network attacks and network congestion, and handle corresponding problems based on the inspection results to ensure the security performance and efficiency of network data transmission.

[0044] Embodiment 2 Based on Example 1, in order to take precautions in advance against abnormal conditions that may occur during network data transmission, in this embodiment, the preprocessed network data is also used to predict abnormal conditions that may occur during network data transmission, obtain abnormal prediction results, and construct a protection system for the abnormal conditions in the abnormal prediction results, thereby further improving the transmission security performance and transmission efficiency of the network data.

[0045] As an implementation method, combined with Figure 2 The preprocessed network data is used to predict abnormal conditions that may occur during the transmission of network data. The abnormal prediction results include: S7. Extract the transmission environment between network data transmission nodes in the preprocessed network data, and match the transmission time of the network data with the time interval of the transmission environment.

[0046] S8. Obtain the number of abnormal conditions and the proportion of abnormal condition types within a transmission environment time interval.

[0047] S9. Obtain the communication protocol used for network data transmission, which is the TSL protocol and the CoAP protocol, and analyze whether the transmission security information of the communication protocol matches the abnormal condition type.

[0048] For example, the specific process is as follows: (1) Record and collect TLS and CoAP security communication related logs, including the handshake process, encryption algorithm selection, and abnormal situations.

[0049] (2) Determine the type of abnormal condition that may result from each transmission of security information. For example, if the TLS handshake fails, the possible abnormal conditions are "handshake failure" or "certificate verification failure".

[0050] (3) Through data monitoring and anomaly detection tools, analyze the frequency and type of anomalies under different security information conditions, and use statistical analysis techniques to find the correlation between the transmission of security information (such as handshake failure) and the type of anomalies (such as timeout, packet loss).

[0051] Specifically, to determine the correlation between transmission security information (such as handshake failure) and abnormal condition types (such as timeout, packet loss), a logistic regression analysis method can be used. First, data including handshake status (success / failure), timeout (timeout / no timeout) and packet loss (packet loss / no packet loss) are collected and marked as binary variables; then, a logistic regression model is established to express the probability of timeout, in which the handshake status is used as the independent variable. The model is trained and the coefficients are estimated by dividing the data into a training set and a test set, thereby calculating the probability of timeout under different handshake states. The significance of the handshake status coefficient in the model is determined by the Wald test. If the p-value is less than 0.05, it means that there is a significant correlation between the handshake status and the timeout; finally, a scatter plot and a probability curve can be drawn to visualize the results, so as to clarify whether the handshake failure is directly related to the timeout or packet loss.

[0052] (4) Based on the analysis results, verify whether various types of anomalies match specific security information, and perform repairs and optimizations. For example, when a handshake failure is found, check whether the relevant keys and certificates are configured correctly.

[0053] S10, retrieve the abnormal conditions of the same abnormal state type and the same communication protocol as the network data in the learning model, and predict the abnormal prediction results according to the time interval.

[0054] Specifically, in this embodiment, the learning model is a supervised learning model, such as a decision tree, a random forest, and a neural network. In the prediction of abnormal states of network data, the learning model is an important tool for making predictions by learning patterns of historical data. The input of the model is usually composed of feature vectors. These features include timestamps, traffic values, network status, communication protocols (such as TLS or CoAP), and labels of abnormal events. In addition, historical data is also an important part of the input, which is used to capture trends and patterns. The output is the abnormal state predicted by the model, including the type of abnormality, the probability score of the occurrence of the abnormality, and the timestamp associated with the prediction result.

[0055] The data processing steps include data collection, data cleaning, feature engineering, and division into training sets and test sets. In the data collection stage, network data and its abnormal status are obtained and stored in the database. Data cleaning involves processing missing values ​​and outliers to ensure data quality and encoding non-numerical features. Feature engineering extracts meaningful features, such as time features and traffic statistics features. In addition, the data needs to be divided into training sets and test sets based on the time sliding window technology to ensure the learning effect of the model.

[0056] When making anomaly predictions for a time interval, first determine the time interval to be predicted (such as the past hour) and use the sliding window technology to extract data samples for this time period. Next, use the training data (including historical data and marked anomalies) to train the model. Within a specific time interval, input the latest feature data and generate prediction results to evaluate the accuracy of the model. Evaluation indicators usually include accuracy, recall, precision, and F1-score. Through the above steps, a learning model is constructed to predict abnormal states in network data.

[0057] In this embodiment, the learning model learns the abnormal conditions encountered by different types of network data, divides the abnormal conditions according to different time intervals, and records the abnormal conditions. When retrieving the abnormal conditions in the learning model, the learning model retrieves the abnormal conditions according to the time interval of the corresponding network data.

[0058] In this embodiment, S7-S10 and S3-S6 can be executed in parallel.

[0059] As an implementation method, the protection system is constructed for abnormal conditions in abnormal prediction results as follows: Apply the trained anomaly prediction model for real-time monitoring to identify potential abnormal states in network traffic. Then, collect security information from network devices, communication protocols, and traffic management systems, including encryption protocols used for transmission, authentication and authorization information, and operation logs. After data cleaning and feature extraction, use statistical analysis methods (such as chi-square test and logistic regression) to evaluate the association between security information and abnormal results. The association analysis between security information and abnormal results has been analyzed in the previous article and will not be analyzed here. Through this association analysis, identify the missing security measures when anomalies occur, and then design targeted protection strategies, such as implementing abnormal traffic detection, dynamically adjusting network configuration, and building a multi-layer protection mechanism, including security strategies at the network layer and application layer.

[0060] In summary, by updating abnormal conditions in real time through learning models, abnormal conditions are predicted, and a targeted protection system is built based on the abnormal prediction results, so that routine abnormal conditions that occur during network data transmission can be automatically handled without human intervention, and new abnormal conditions and their processing measures can be recorded and learned, continuously improving the transmission security performance and transmission efficiency of network data.

[0061] Embodiment 3 Combination Figure 3 The present embodiment discloses a network data prediction and analysis system, including a management platform, a data acquisition module, a data preprocessing module, a data transmission module, a data transmission supervision and analysis module, a data analysis and prediction module and an early warning display module; the management platform and the data acquisition module, the data preprocessing module and the early warning display module are all connected in one-way communication, the data acquisition module and the data preprocessing module are connected in one-way communication, the management platform and the data transmission module are connected in two-way communication, and the data transmission module and the data transmission supervision module and the data analysis and prediction module are all connected in one-way communication.

[0062] The data acquisition module is used to collect the required network data from the IoT terminal, and the data preprocessing module is used to perform data preprocessing operations on the collected network data; the data transmission module is used to obtain the preprocessed network data, encrypt it using the TSL protocol, and transmit it to the distributed database using the CoAP protocol; the data transmission supervision and analysis module is used to perform transmission supervision, evaluation and analysis on the network data; the early warning display module is used to receive the transmission data volume abnormality signal, security protection signal and network optimization signal sent by the data transmission supervision and analysis module, generate the corresponding display text and send it to the relevant personnel in a timely manner, and the relevant personnel conduct corresponding inspections on the problems of abnormal data transmission volume, network attacks and network congestion, and deal with the corresponding problems according to the inspection results to ensure the network data transmission security performance and transmission efficiency; the data analysis and prediction module is used to analyze the transmission status during the network data transmission process, predict the abnormal conditions that may occur during the network data transmission process, obtain the abnormal prediction results, and build a protection system for the abnormal conditions in the abnormal prediction results based on the abnormal prediction results.

[0063] It should be noted that the above data acquisition module, data preprocessing module, data transmission module, data transmission supervision and analysis module, data analysis and prediction module and early warning display module correspond to the steps in Embodiment 1, and the examples and application scenarios implemented by the above modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above Embodiment 1. It should be noted that the above modules, as part of the system, can be executed in a computer system such as a set of computer executable instructions.

[0064] Embodiment 4 Embodiment 4 of the present invention provides an electronic device, including a memory and a processor, and computer instructions stored in the memory and executed on the processor. When the computer instructions are executed by the processor, the steps of the above-mentioned network data prediction and analysis method are completed.

[0065] Embodiment 5 Embodiment 5 of the present invention provides a computer-readable storage medium for storing computer instructions. When the computer instructions are executed by a processor, the steps of the above-mentioned network data prediction and analysis method are completed.

[0066] Embodiment 6 Embodiment 6 of the present invention provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned network data prediction and analysis method when executed by a processor.

[0067] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0068] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0069] These computer program instructions can also be loaded onto a computer or other programmable data processing device, and a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0070] The description of each embodiment in the above embodiments has different emphases. For parts not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0071] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A network data prediction and analysis method, characterized in that: include: Get preprocessed network data; Based on the preprocessed network data, the instantaneous flow rate value, flow rate difference and total value of the transmission data flow of the network data transmission node in the supervision period are extracted, and the transmission flow evaluation coefficient of the network data transmission node in the supervision period is obtained according to the instantaneous flow rate value, flow rate difference and total value of the transmission data flow; The amount of data transmitted during uninterrupted and intermittent transmission in the network data transmission process is obtained, and the network data transmission nodes are optimized and warned based on the transmission flow evaluation coefficient and the amount of data transmitted.

2. The network data prediction and analysis method according to claim 1, characterized in that: If the transmission flow assessment coefficient is not less than the preset transmission flow assessment coefficient threshold, then there is a transmission flow anomaly during the supervision period; Extract the data packet sending amount and data packet receiving amount of the network data transmission node during the supervision period to generate a data packet sending and receiving ratio; Based on the comparison result of the data packet sending and receiving ratio and the preset data packet sending and receiving ratio threshold, it is determined whether the network data transmission node is under network attack.

3. The network data prediction and analysis method according to claim 2, characterized in that: If the data packet receiving and sending ratio is less than the preset data packet receiving and sending ratio threshold, it is determined that the network data transmission node has been attacked by the network during the supervision period, and a security protection signal is generated and sent to the early warning display module; If the data packet receiving and sending ratio is greater than or equal to the preset data packet receiving and sending ratio threshold, it is determined that the network data transmission node has network congestion during the supervision period, and a network optimization signal is generated and sent to the early warning display module.

4. The network data prediction and analysis method according to claim 1, characterized in that: Obtain the amount of data transmitted during uninterrupted and intermittent transmission in the network data transmission process, and optimize and warn the network data transmission nodes based on the amount of data transmitted, including: Obtain the number of data covered by transmission and the number of data actually identified by transmission during uninterrupted transmission, and generate a deviation value based on the number of data covered by transmission and the number of data actually identified by transmission; Get the maximum decrease span value of the network data transmission volume corresponding to the network data transmission disconnection moment during intermittent transmission; Based on the comparison result between the deviation value and the preset deviation value threshold and the comparison result between the maximum drop span value and the preset maximum drop span value threshold, it is determined whether the transmission data volume of the network data is normal.

5. The network data prediction and analysis method according to claim 4, characterized in that: If the deviation value is greater than the preset deviation value threshold or the maximum drop span value is less than the preset maximum drop span value threshold, a transmission data volume abnormal signal is generated and sent to the early warning display module.

6. The network data prediction and analysis method according to claim 1, characterized in that: Also includes: Anomaly prediction is performed based on the preprocessed network data, anomaly prediction results are obtained, and a protection system is constructed based on the anomaly prediction results.

7. A network data prediction and analysis system, characterized in that: include: The data supervision and analysis module is configured to: obtain pre-processed network data; Based on the preprocessed network data, the instantaneous flow rate value, flow rate difference and total value of the transmission data flow of the network data transmission node in the supervision period are extracted, and the transmission flow evaluation coefficient of the network data transmission node in the supervision period is obtained according to the instantaneous flow rate value, flow rate difference and total value of the transmission data flow; The amount of data transmitted during uninterrupted and intermittent transmission in the network data transmission process is obtained, and the network data transmission nodes are optimized and warned based on the transmission flow evaluation coefficient and the amount of data transmitted.

8. An electronic device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the network data prediction and analysis method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instruction is executed by a processor, the steps of the network data prediction and analysis method described in any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the network data prediction and analysis method described in any one of claims 1 to 6 are implemented.

Images