A computer network intelligent analysis platform based on big data

Abstract

The present invention discloses a computer network intelligent analysis platform based on big data, which relates to the field of computer network technology and solves the problem that the network fluctuations generated by the relevant access items of the computer itself are not taken into account, resulting in errors in the abnormal situation assessed. The present invention sets two processing stages to consider and analyze the data access waveform of the computer itself in advance to lock the regular waveform existing in the access waveform. For a single-wave waveform, feature confirmation is directly performed, and the regular waveform is locked based on the features of the corresponding waveform and the periodic interval. For a multi-wave waveform, feature confirmation is performed synchronously to identify whether it is a regular waveform. If it is not a regular waveform, waveform division is performed to decompose it into a number of single-wave waveforms, and relevant confirmation is performed on whether the single-wave waveform is a regular waveform. This related method of analysis and confirmation processing can achieve a more accurate regular waveform related confirmation effect.

Description

Technical Field

[0001] The present invention relates to the field of computer network technology, and in particular to a computer network intelligent analysis platform based on big data. Background Art

[0002] A computer network refers to a computer system that connects multiple computers and their external devices with independent functions in different geographical locations through communication lines and communication equipment, and realizes resource sharing and information transmission under the management and coordination of a network operating system, network management software and network communication protocols.

[0003] The application with publication number CN116684149A discloses a computer network intelligent analysis platform based on big data, including a big data acquisition module, a big data analysis module, a tracing module, a display module, a security management system and a computer processor; the big data of various websites are collected by the big data acquisition module, and sent to the big data analysis module to analyze the big data of various websites to obtain websites with abnormal data, and then the computer processor controls the tracing module to perform path tracing, and after obtaining the path, controls the security management system to intercept and receive the data transmitted by the path, which can effectively prevent attacks from malicious websites, thereby avoiding computer network failures. At the same time, by controlling the display module to display the websites with abnormal data, the cause of the failure can be understood in time, so as to restore the computer system in time.

[0004] When conducting relevant intelligent analysis on the computer network, it generally focuses on security issues. It monitors network fluctuations in real time based on relevant network monitoring items and provides real-time feedback to confirm whether the network fluctuations are abnormal. However, this original network fluctuation monitoring method is not comprehensive enough and does not take into account the network fluctuations caused by the relevant access items of the computer itself. As a result, the abnormal situation assessed is inaccurate and inaccurate. Because the computer itself also has relevant access items, there will be corresponding numerical fluctuations, and some access items are periodic, so it is very likely to affect the fluctuation of network traffic data during use. Summary of the invention

[0005] In view of the deficiencies of the prior art, the present invention provides a computer network intelligent analysis platform based on big data, which solves the problem that the network fluctuations caused by the relevant access items of the computer itself are not taken into account, resulting in errors in the assessment of abnormal situations.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: A computer network intelligent analysis platform based on big data, comprising:

[0007] The initial monitoring end, after the computer is turned on, monitors the network value fluctuations generated by the computer's own data access, and transmits the network value fluctuation curve generated by the monitoring to the characteristic wave analysis end. The monitoring period is T, where T is a preset value. The specific method is:

[0008] After the computer is turned on, the timing starts, and the network value fluctuation curve of the computer is recorded in real time. When the computer has an active access item, the recording process of the network value fluctuation curve is stopped. When the active access item ends, the network value fluctuation curve is recorded again until the recorded cycle length reaches T, and the recorded network value fluctuation curve is transmitted to the characteristic wave analysis end;

[0009] The characteristic wave analysis end performs waveform analysis on the network value fluctuation curve, identifies regular related waveforms from the network value fluctuation curve, and first divides several waveforms inside the network value fluctuation curve into single-wave waveforms or multi-wave waveforms through the waveform classification unit. The specific method is as follows:

[0010] From the network value fluctuation curve, identify the relevant waveform inside it. The network flow at the initial point of the relevant waveform is 0, and the network flow at the end point is also 0.

[0011] If there is only one turning point in the correlation waveform, the correlation waveform is calibrated as a single-wave waveform;

[0012] If there are multiple turning points in the correlation waveform, the correlation waveform is marked as a multi-wave waveform;

[0013] The divided single-wave waveform is transmitted to the single-wave analysis unit for feature analysis to identify whether it is a regular waveform. The specific method is as follows:

[0014] Confirm the network traffic peak value F in this single-wave waveform, and then determine the time interval J between the initial point and the end point in this single-wave waveform, and use Ts=F×C1+J×C2 to determine the waveform characteristic value Ts, where C1 and C2 are both preset fixed coefficient factors, and identify whether the waveform characteristic values ​​of other subsequent single-wave waveforms are consistent with Ts. If they are consistent, the corresponding single-wave waveform is calibrated as a similar waveform, and the interval time period t1 between the similar waveform and the current single-wave waveform is identified, and then identify whether there are similar waveforms in the subsequent similar waveforms. If they still exist and the interval time period is consistent, this single-wave waveform and related similar waveforms are all calibrated as similar regular waveforms, and the interval time period of this similar regular waveform is determined;

[0015] The other single-wave waveforms are processed one by one in the same way. The single-wave waveforms that have been marked as regular waveforms do not participate in the processing process. The same type of regular waveforms are confirmed one by one and the interval time periods related to the same type of regular waveforms are synchronously confirmed, and then the relevant records are made through the recording end;

[0016] The divided multi-wave waveform is transmitted to the multi-wave analysis unit for feature analysis, specifically in the following way:

[0017] The same characteristic processing method as the single-wave analysis unit is used to process the single-wave waveform to confirm the waveform characteristic value Ts of the multi-wave waveform, and the same comparison analysis method is used to identify whether the multi-wave waveform is a regular waveform of the same type:

[0018] If it belongs to the same type of regular waveform, then determine the corresponding interval time period and record it through the relevant recording terminal;

[0019] If it does not belong to the same type of regular waveform, split this waveform into single-wave waveforms: based on several turning points marked in the multi-wave waveform, mark the initial point and the end point of the multi-wave waveform as turning points, intercept the waveform between the first group of turning points and the third group of turning points and mark it as the first group of single-wave waveforms, intercept the waveform between the third group of turning points and the fifth group of turning points and mark it as the second group of single-wave waveforms, and so on, so that the multi-wave waveform is divided into several single-wave waveforms. If the network flow of the endpoint of the single-wave waveform is not 0, extend it according to the relevant trend of the line segment where the corresponding endpoint is located, and stop when the network flow of the relevant endpoint is 0. The divided single-wave waveform is confirmed as a regular waveform by a single-wave analysis unit and the recognition result is recorded by the corresponding recording end;

[0020] The numerical monitoring center starts to start within the monitoring period T, monitors the network fluctuation traffic of the computer, and transmits the real-time monitored network fluctuation traffic to the numerical analysis center;

[0021] The numerical analysis center, based on the real-time network fluctuation traffic, identifies whether the fluctuation traffic difference between adjacent moments meets the process analysis conditions. If it does, it conducts process analysis to determine whether there are abnormal conditions. If it does not, it continues to analyze the fluctuation traffic difference between adjacent moments. The specific method is as follows:

[0022] Based on the different network fluctuation flows LLq corresponding to different moments, where q represents different moments, identify the fluctuation flow difference CZ of adjacent moments, and identify whether CZ satisfies: |CZ|≥Y1, where Y1 is a preset value. If it satisfies, process analysis is performed; if not, difference analysis is continued;

[0023] Process analysis: confirm a set of monitoring periods, where the monitoring period is a preset period. After the current moment, determine whether the network throughput W1 generated by the network and the process reading volume W2 generated by the computer in the monitoring period are consistent. If W1 and W2 are consistent, no processing is performed. If W1 and W2 are inconsistent, the abnormal segment processing center is executed;

[0024] The abnormal segment processing center confirms the network throughput and process reading volume generated at different times during the monitoring period one by one, identifies the maximum flow fluctuation value generated by the two at the same time, and then finds the regular waveform from the recording end based on this maximum flow fluctuation value to identify whether the computer network is truly abnormal; the specific method is:

[0025] The network throughput generated at different times during this monitoring period is calibrated as W1 k , the process reading amount generated at different times is calibrated as W2 k , where k represents different moments, and identifies the flow data difference C at different moments k , and C k =|W1 k -W2 k |, from several groups C k A set of maximum values ​​is selected, and the determined maximum value is marked as the maximum flow fluctuation value, and the time corresponding to the maximum value is marked as the maximum flow fluctuation time;

[0026] Based on several groups of regular waveforms recorded in the recording end, identify whether there is a network traffic peak value consistent with the maximum traffic fluctuation value. If so, mark the corresponding regular waveform as a related waveform. If not, directly generate a network fluctuation abnormal signal for direct display;

[0027] Based on this related waveform, the interval duration period of this related waveform is identified from the recording end, and then the time of maximum traffic fluctuation is used for time tracing to determine the tracing time. The time length of the tracing is the interval duration period. It is identified whether there is a similar related waveform at the tracing time. If so, a normal signal of network value fluctuation is generated. If not, an abnormal network fluctuation signal is directly generated and displayed.

[0028] The present invention provides a computer network intelligent analysis platform based on big data. Compared with the prior art, it has the following beneficial effects:

[0029] The present invention sets two processing stages, considers and analyzes the data access waveform of the computer itself in advance, so as to lock the regular waveform existing in the access waveform. For a single-wave waveform, directly confirms the characteristics, and locks the regular waveform based on the characteristics of the corresponding waveform and the period interval. For a multi-wave waveform, confirms the characteristics synchronously to identify whether it is a regular waveform. If it is not a regular waveform, the waveform is divided and decomposed into a plurality of single-wave waveforms, and relevant confirmation is performed on whether the single-wave waveform is a regular waveform. This kind of analysis and confirmation processing related mode considers more comprehensively, and the waveform analysis of the computer itself is wider, which can achieve a more accurate regular waveform related confirmation effect.

[0030] For subsequent fluctuations in network values, it is necessary to identify whether the fluctuations are caused by related regular waveforms, so as to make the network intelligent analysis more accurate and avoid misjudgment, thereby improving the overall intelligent analysis effect of this network intelligent analysis platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a schematic diagram of the principle framework of the present invention;

[0032] Figure 2 It is a schematic diagram showing the multi-wave waveform of the present invention. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] See also Figure 1 , the present application provides a computer network intelligent analysis platform based on big data, including an initial monitoring terminal, a characteristic wave analysis terminal, a numerical monitoring center, a numerical analysis center, an abnormal segment processing center and a recording terminal, wherein the initial monitoring terminal is electrically connected to an input node of the characteristic wave analysis terminal, and the characteristic wave analysis terminal is electrically connected to an input node of the recording terminal, and the numerical monitoring center, the numerical analysis center and the abnormal segment processing center are electrically connected in sequence from an output node to an input node, and the recording terminal is electrically connected to an input node of the abnormal segment processing center;

[0035] The characteristic wave analysis end includes a waveform classification unit, a single wave analysis unit and a multi-wave analysis unit, and the waveform classification unit is electrically connected to the single wave analysis unit and the multi-wave analysis unit input node respectively;

[0036] During the analysis process, this intelligent analysis platform needs to execute two groups of analysis stages. The first group of analysis stages is: the initial analysis stage, which is executed by the initial monitoring end and the characteristic wave analysis end. The initial analysis stage is a stage without any operation process. The network fluctuations generated are all stimulated by the data access of the computer itself, without any human intervention.

[0037] Reanalysis stage: This is the network fluctuation analysis stage with human intervention. It identifies whether there are abnormal fluctuations in the network during human operation, analyzes the specific abnormal conditions of the abnormal fluctuations, and displays the relevant results based on the specific analysis results. The specific execution ends are the numerical monitoring center, numerical analysis center, and abnormal segment processing center.

[0038] Initial analysis stage:

[0039] The initial monitoring end monitors the network value fluctuations generated by the computer's own data access after the computer is turned on, and transmits the network value fluctuation curve generated by the monitoring to the characteristic wave analysis end. The monitoring period T, where T is a preset value, is generally very short, perhaps 10 minutes, and can be set during the corresponding computer startup process. After the computer is turned on, in order to communicate with relevant external websites, it is necessary to perform relevant data access. This type of data access process is initiated autonomously by the computer itself, and does not belong to the network fluctuations caused by human operation. In addition, during the subsequent long-term use of the computer, some data access items are intermittent access items, that is, they are accessed once at each time point.

[0040] The specific monitoring methods are:

[0041] The timing starts after the computer is turned on, and the network value fluctuation curve of this computer is recorded in real time. When there is an active access item on the computer (that is, a network item that is manually controlled), the recording process of the network value fluctuation curve is stopped. When the active access item ends, the network value fluctuation curve is recorded again until the recorded cycle duration reaches T. The recorded network value fluctuation curve is transmitted to the characteristic wave analysis end. Here, a periodic characteristic access item existing in the computer itself is analyzed to avoid subsequent intelligent analysis of network fluctuations, exclude network fluctuations of such periodic characteristic access items, determine the actual network fluctuations, and make relevant abnormal judgments.

[0042] Among them, the characteristic wave analysis end performs waveform analysis on the network value fluctuation curve, identifies regular related waveforms from the network value fluctuation curve, firstly divides several waveforms inside the network value fluctuation curve into single-wave waveforms or multi-wave waveforms through the waveform classification unit, transmits the divided single-wave waveform to the single-wave analysis unit for characteristic analysis, identifies whether it is a regular waveform, and transmits the divided multi-wave waveform to the multi-wave analysis unit for characteristic analysis, identifies whether it is a regular waveform;

[0043] Among them, the waveform classification unit divides several waveforms inside the network value fluctuation curve in the following specific way:

[0044] From the network value fluctuation curve, identify the relevant waveform inside it. The network flow at the initial point of the relevant waveform is 0, and the network flow at the end point is also 0.

[0045] If there is only one turning point in the correlation waveform, the correlation waveform is calibrated as a single-wave waveform;

[0046] If there are multiple turning points in the relevant waveform, the relevant waveform will be marked as a multi-wave waveform. The so-called turning point is also a fluctuation point. The trend of the line segments before and after the fluctuation point is opposite. When the front line segment climbs and the rear line segment falls, the intersection of the two segments is the corresponding fluctuation point. This turning point can be determined according to the previous and next trends of the waveform.

[0047] The single wave analysis unit analyzes the calibrated single wave waveforms one by one to identify whether they are regular waveforms in the following specific manner:

[0048] Confirm the network traffic peak value F in this single-wave waveform, and then determine the time interval J between the initial point and the end point in this single-wave waveform, and use Ts=F×C1+J×C2 to determine the waveform characteristic value Ts, where C1 and C2 are both preset fixed coefficient factors, and their specific values ​​are determined by the operator based on experience. Identify whether the waveform characteristic values ​​of other subsequent single-wave waveforms are consistent with Ts. If they are consistent, calibrate the corresponding single-wave waveform as a similar waveform, and identify the interval time period t1 between the similar waveform and the current single-wave waveform, and then identify whether there are similar waveforms in the subsequent similar waveforms. If they still exist and the interval time period is consistent, calibrate this single-wave waveform and related similar waveforms as similar regular waveforms, and determine the interval time period of this similar regular waveform;

[0049] The same method is used to process other single-wave waveforms one by one. Single-wave waveforms that have been calibrated as regular waveforms do not participate in the processing process. Regular waveforms of the same type are confirmed one by one and the interval time periods related to them are synchronously confirmed, and then relevant records are made through the recording end. The so-called regular waveform is a waveform that appears at regular intervals and the characteristics of this waveform are consistent each time it appears. In this case, this type of waveform is a regular waveform, and any subsequent network fluctuations are likely to be caused by regular waveforms.

[0050] The multi-wave analysis unit analyzes the calibrated multi-wave waveforms one by one to identify whether they are regular waveforms in the following specific manner:

[0051] The same characteristic processing method as the single-wave analysis unit is used to process the single-wave waveform to confirm the waveform characteristic value Ts of the multi-wave waveform, and the same comparison analysis method is used to identify whether the multi-wave waveform is a regular waveform of the same type:

[0052] If it belongs to the same type of regular waveform, then determine the corresponding interval time period and record it through the relevant recording terminal;

[0053] If it does not belong to the same type of regular waveform, split this waveform into single-wave waveforms: based on several turning points marked in the multi-wave waveform, mark the initial point and the end point of the multi-wave waveform as turning points, intercept the waveform between the first group of turning points and the third group of turning points and mark it as the first group of single-wave waveforms, intercept the waveform between the third group of turning points and the fifth group of turning points and mark it as the second group of single-wave waveforms, and so on, so that the multi-wave waveform is divided into several single-wave waveforms. If the network flow of the endpoint of the single-wave waveform is not 0, extend it according to the relevant trend of the line segment where the corresponding endpoint is located, and stop when the network flow of the relevant endpoint is 0 (the line segments at both ends of the waveform are linearly changing, and there is no nonlinear change process), and use the single-wave analysis unit to confirm the regular waveform and record the recognition result through the corresponding recording end;

[0054] Specifically, Figure 2 As shown, first of all, the starting point is why we need to divide the multi-wave waveform into single-wave waveforms. This is because due to the difference in interval time, multiple single-wave waveforms may appear simultaneously in the same period of time. Based on the numerical changes between their waveforms, a multi-wave waveform is generated; decomposing the multi-wave waveform into related single-wave waveforms is to extract the single-wave waveforms related to the multi-wave waveform one by one.

[0055] The secondary analysis phase is the phase related to traffic anomaly determination;

[0056] The numerical monitoring center starts to start within the monitoring period T, monitors the network fluctuation traffic of the computer, and transmits the real-time monitored network fluctuation traffic to the numerical analysis center;

[0057] The numerical analysis center, based on the real-time network fluctuation flow, identifies whether the fluctuation flow difference between adjacent moments meets the process analysis conditions. If so, the process analysis is performed to determine whether there is an abnormality. If not, the fluctuation flow difference between adjacent moments is continuously analyzed. The specific method of identification is as follows:

[0058] Based on the different network fluctuation flows LLq corresponding to different moments, where q represents different moments, identify the fluctuation flow difference CZ of adjacent moments, and identify whether CZ satisfies: |CZ|≥Y1, where Y1 is a preset value, and its specific value is determined by the operator based on experience. If it satisfies, process analysis is performed; if not, difference analysis is continued;

[0059] Process analysis: confirm a set of monitoring periods, where the monitoring period is a preset period. After the current moment (the current moment is the corresponding moment of confirming the process analysis), determine whether the network throughput W1 generated by the network during the monitoring period and the process reading volume W2 generated by the computer are consistent. If W1 and W2 are consistent, no processing is performed. If W1 and W2 are inconsistent, it means that there is an abnormal network value, that is, there is an abnormal network value fluctuation. The relevant network fluctuation that does not belong to this process intervenes in this traffic data, causing the traffic data to be abnormal, and execute the abnormal segment processing center;

[0060] Among them, the abnormal section processing center confirms the network throughput and process reading volume generated at different times during the monitoring period one by one, identifies the maximum flow fluctuation value generated by the two at the same time, and then finds the regular waveform from the recording end based on this maximum flow fluctuation value, identifies whether the computer network is truly abnormal, and displays the signal. The specific method of identification is:

[0061] The network throughput generated at different times during this monitoring period is calibrated as W1 k , the process reading amount generated at different times is calibrated as W2 k , where k represents different moments, and identifies the flow data difference C at different moments k , and C k =|W1 k -W2 k |, from several groups C k A set of maximum values ​​is selected, and the determined maximum value is marked as the maximum flow fluctuation value, and the time corresponding to the maximum value is marked as the maximum flow fluctuation time;

[0062] Based on several groups of regular waveforms recorded in the recording end, identify whether there is a network traffic peak value consistent with the maximum traffic fluctuation value. If so, mark the corresponding regular waveform as the relevant waveform. If not, directly generate a network fluctuation abnormal signal for direct display for relevant operators to view and take timely response measures.

[0063] Based on this related waveform, the interval time period of this related waveform is identified from the recording end, and then the time of maximum traffic fluctuation is used for time tracing to determine the tracing time. The tracing time length is the interval time period (that is, confirmation is made from the current moment. For example, the current moment is 8:35, and the interval time period is 2h, then the generated tracing time is 6:35, tracing back two hours). It is identified whether there is a similar related waveform at the tracing time. If so, a normal signal of network value fluctuation is generated. If not, a network fluctuation abnormal signal is directly generated and displayed for relevant operators to view and take timely response measures.

[0064] Specifically, the relevant analysis made here is to identify whether the generated network fluctuations are caused by the access process of the computer itself. If it is the corresponding network fluctuations caused by the data access of the computer itself, then there is no abnormal network value fluctuation, and no relevant protective measures are needed. If it is not caused by the data access of the computer itself, then there is a corresponding numerical abnormality, and relevant protective measures need to be taken in time to prevent the computer from being corroded by the corresponding related viruses.

[0065] Some of the data in the above formulas are dimensionless and numerically calculated. Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art.

[0066] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A computer network intelligent analysis platform based on big data, characterized in that: include: The initial monitoring end, after the computer is turned on, monitors the network value fluctuations generated by the computer's own data access, and transmits the network value fluctuation curve generated by the monitoring to the characteristic wave analysis end. The monitoring period is T, where T is a preset value; The characteristic wave analysis end performs waveform analysis on the network value fluctuation curve, and identifies regular waveforms from the network value fluctuation curve. The specific method of the identification is: first, the waveform classification unit divides the multiple waveforms inside the network value fluctuation curve into single-wave waveforms or multi-wave waveforms, and transmits the divided single-wave waveforms to the single-wave analysis unit for characteristic analysis to identify whether they are regular waveforms, and transmits the divided multi-wave waveforms to the multi-wave analysis unit for characteristic analysis to identify whether they are regular waveforms; The recording end, after the characteristic wave analysis end identifies the existence of a regular waveform, records the regular waveform; The numerical monitoring center starts to start within the monitoring period T, monitors the network fluctuation traffic of the computer, and transmits the real-time monitored network fluctuation traffic to the numerical analysis center; The numerical analysis center, based on the real-time monitoring of network fluctuation traffic, identifies whether the fluctuation traffic difference between adjacent moments meets the process analysis conditions. If so, it conducts process analysis to determine whether there are abnormal conditions. If not, it continues to analyze the fluctuation traffic difference between adjacent moments. The abnormal segment processing center confirms the network throughput and process reading volume generated at different times during the monitoring period one by one, identifies the maximum flow fluctuation value generated by the above two at the same time, and then searches for regular waveforms from the recording end based on this maximum flow fluctuation value to identify whether this computer network is truly abnormal.

2. According to the big data-based computer network intelligent analysis platform of claim 1, it is characterized in that: The specific method of monitoring at the initial monitoring end is as follows: The timing starts after the computer is turned on, and the network value fluctuation curve of this computer is recorded in real time. When there is an active access item on the computer, the recording process of the network value fluctuation curve is stopped. When the active access item ends, the network value fluctuation curve is recorded again until the recorded cycle length reaches T, and the recorded network value fluctuation curve is transmitted to the characteristic wave analysis terminal.

3. According to the computer network intelligent analysis platform based on big data in claim 1, it is characterized in that: The specific manner in which the waveform classification unit divides the plurality of waveforms within the network value fluctuation curve is as follows: From the network value fluctuation curve, identify the waveform existing inside, the network flow at the initial point of the waveform is 0, and the network flow at the end point is also 0; If there is only one turning point in the waveform, the waveform is marked as a single-wave waveform; If there are multiple turning points in a waveform, the waveform is marked as a multi-wave waveform.

4. A computer network intelligent analysis platform based on big data according to claim 3, characterized in that: The specific method of the single wave analysis unit for identifying whether the single wave waveform is a regular waveform is: Confirm the network traffic peak value F in this single-wave waveform, then determine the time interval J between the initial point and the end point in this single-wave waveform, and use Ts=F×C1+J×C2 to determine the waveform characteristic value Ts, where C1 and C2 are both preset fixed coefficient factors, identify whether the waveform characteristic values ​​of other subsequent single-wave waveforms are consistent with Ts, if they are consistent, calibrate the corresponding single-wave waveform as a similar waveform, and identify the interval time period t1 between the similar waveform and the current single-wave waveform, and then identify whether there are similar waveforms in the subsequent similar waveforms, if they still exist and the interval time period is consistent, calibrate this single-wave waveform and the similar waveform as similar regular waveforms, and determine the interval time period of this similar regular waveform; The same method is used to process other single-wave waveforms one by one. Single-wave waveforms that have been calibrated as similar regular waveforms do not participate in the processing process. Similar regular waveforms are confirmed one by one and the interval time period of similar regular waveforms is synchronously confirmed, and then recorded through the recording end.

5. A computer network intelligent analysis platform based on big data according to claim 4, characterized in that: The multi-wave analysis unit identifies whether the multi-wave waveform is a regular waveform in the following specific manner: The same identification method as the single wave analysis unit to identify whether the single wave waveform is a regular waveform is used to confirm the waveform characteristic value Ts of the multi-wave waveform and identify whether the multi-wave waveform is a regular waveform of the same type: If it belongs to the same regular waveform, the corresponding interval time period is determined and recorded through the recording end; If it does not belong to the same type of regular waveform, split this waveform into single-wave waveforms: based on several turning points marked in the multi-wave waveform, the initial point and the end point of the multi-wave waveform are also marked as turning points, the waveform between the first group of turning points and the third group of turning points is intercepted and marked as the first group of single-wave waveforms, the waveform between the third group of turning points and the fifth group of turning points is intercepted and marked as the second group of single-wave waveforms, and so on, so that the multi-wave waveform is divided into several single-wave waveforms. If the network traffic of the endpoint of the single-wave waveform is not 0, it is extended according to the trend of the line segment where the endpoint is located, and the extension stops when the network traffic at the endpoint is 0. The split single-wave waveform is confirmed as a regular waveform through the single-wave analysis unit and the recognition result is recorded through the recording end.

6. The computer network intelligent analysis platform based on big data according to claim 1 is characterized in that: The specific method for the numerical analysis center to identify whether the fluctuation flow difference between adjacent moments meets the process analysis condition is: Based on different network fluctuation flows LLq corresponding to different moments, where q represents different moments, identify the fluctuation flow difference CZ at adjacent moments, and identify whether CZ satisfies: |CZ|≥Y1, where Y1 is a preset value. If it satisfies, process analysis is performed; if not, difference analysis is continued; Process analysis: Confirm a set of monitoring periods, which are preset periods. After the current moment, determine whether the network throughput W1 generated by the network during the monitoring period and the process reading volume W2 generated by this computer are consistent. If W1 and W2 are consistent, no processing is performed. If W1 and W2 are inconsistent, the abnormal segment processing center is executed.

7. A computer network intelligent analysis platform based on big data according to any one of claims 5 or 6, characterized in that: The specific method for the abnormal segment processing center to identify whether the computer network is truly abnormal is: The network throughput generated at different times during this monitoring period is calibrated as W1 k , the process reading amount generated at different times is calibrated as W2 k , where k represents different moments, and identifies the flow data difference C at different moments k , and C k =|W1 k -W2 k |, from several groups C k A set of maximum values ​​is selected, and the determined maximum value is marked as the maximum flow fluctuation value, and the time corresponding to the maximum value is marked as the maximum flow fluctuation time; Based on several groups of regular waveforms recorded in the recording end, identify whether there is a network traffic peak value consistent with the maximum traffic fluctuation value. If so, mark the corresponding regular waveform as a related waveform. If not, directly generate a network fluctuation abnormal signal for direct display; Based on this related waveform, identify the interval duration period of this related waveform from the recording end, and then use the maximum traffic fluctuation moment to trace the source to determine the tracing time. The tracing time length is the interval duration period of the related waveform. Identify whether there is a similar regular waveform at the tracing time. If so, generate a normal signal for network value fluctuation. If not, directly generate an abnormal network fluctuation signal for direct display.

Images