End-to-end traffic health management storm control method and device, equipment and storage medium

Abstract

The invention discloses an end-to-end traffic health management storm control method, device and equipment and a storage medium, and relates to the technical field of network management, and the method comprises the steps: obtaining traffic data of each switch; on the basis of the traffic data, abnormal traffic detection is carried out through a preset algorithm, and a detection result is obtained; when the detection result is that the traffic is abnormal, generating a storm control strategy; and performing end-to-end traffic health management according to the storm control strategy. Through global traffic monitoring and strategy coordination, traffic abnormality is identified in time, and the storm control strategy is automatically adjusted, so that efficient utilization of network resources can be realized, the security and stability of the network are improved, and the overall efficiency and response capability of network management are improved.

Description

Technical Field

[0001] The present application relates to the field of network management technology, and in particular to an end-to-end traffic health management storm control method, device, equipment and storage medium. Background Art

[0002] Currently, traditional storm control technology is mainly focused on the level of a single switch, relying on local policies to detect and suppress network storms. However, this approach has significant flaws in a multi-switch environment. First, when the storm spreads between different switches, local protection measures are often unable to effectively prevent the collapse of the overall network. Second, the lack of cross-device coordination makes traffic monitoring and management fragmented and unable to respond to global traffic changes in real time. In addition, traditional storm control technology usually cannot provide comprehensive traffic health analysis, resulting in potential risks that cannot be identified and handled in a timely manner. Summary of the invention

[0003] The main purpose of this application is to provide an end-to-end traffic health management storm control method, device, equipment and storage medium, aiming to solve the technical problem of how to achieve efficient utilization of network resources, improve network security and stability, and enhance the overall efficiency and responsiveness of network management.

[0004] To achieve the above objectives, the present application proposes an end-to-end traffic health management storm control method, the method comprising: Obtain traffic data of each switch; Based on the traffic data, abnormal traffic detection is performed using a preset algorithm to obtain a detection result; When the detection result is that the flow is abnormal, generating a storm control strategy; End-to-end traffic health management is performed according to the storm control strategy.

[0005] In one embodiment, the step of performing abnormal traffic detection based on the traffic data by a preset algorithm to obtain a detection result includes: According to the traffic data, a global traffic view is obtained; According to the global traffic view, abnormal traffic detection is performed using a preset algorithm to obtain a detection result.

[0006] In one embodiment, the step of performing abnormal traffic detection by a preset algorithm according to the global traffic view to obtain a detection result includes: According to the global traffic view, abnormal traffic detection is performed by a preset algorithm; When no abnormal traffic pattern is detected, the detection result is that the traffic is normal; When the abnormal traffic pattern is detected, the detection result is obtained as traffic abnormality.

[0007] In one embodiment, when the detection result is that the traffic is abnormal, the step of generating a storm control strategy includes: When the detection result is that the flow is abnormal, an alarm is generated and abnormal event information is recorded, wherein the abnormal event information includes the type of flow abnormality, triggering time, related switches and port information; A storm control strategy is generated according to the traffic anomaly type, the trigger time, the related switches and the port information.

[0008] In one embodiment, the step of generating a storm control strategy according to the traffic anomaly type, the trigger time, the related switch and the port information includes: Get the current network status and preset response strategy; A storm control strategy is generated according to the traffic anomaly type, the trigger time, the related switches, the port information, the current network status and the preset response strategy.

[0009] In one embodiment, the step of performing end-to-end traffic health management according to the storm control strategy includes: issuing the storm control strategy; Obtain policy execution results and adjust the storm control policy to perform end-to-end traffic health management.

[0010] In one embodiment, the step of obtaining the strategy execution effect and adjusting the storm control strategy includes: Get the strategy execution effect; Obtaining feedback information based on the execution effect of the strategy; The storm control strategy is adjusted according to the feedback information.

[0011] In addition, to achieve the above objectives, the present application also proposes an end-to-end traffic health management storm control device, the device comprising: A data acquisition module, used to acquire the flow data of each switch; An abnormality detection module, used to perform abnormal flow detection based on the flow data by using a preset algorithm to obtain a detection result; A strategy generation module, used for generating a storm control strategy when the detection result is a traffic anomaly; The traffic management module is used to perform end-to-end traffic health management according to the storm control strategy.

[0012] In addition, to achieve the above-mentioned objectives, the present application also proposes an end-to-end traffic health management storm control device, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the end-to-end traffic health management storm control method as described above.

[0013] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the end-to-end traffic health management storm control method as described above are implemented.

[0014] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the end-to-end traffic health management storm control method as described above.

[0015] One or more technical solutions proposed in this application have at least the following technical effects: Due to the adoption of global traffic monitoring and policy coordination, traffic anomalies can be identified in a timely manner and storm control strategies can be automatically adjusted. This solves the technical problems that traditional storm control technology cannot effectively prevent the collapse of the entire network, lacks the ability to coordinate across devices, and potential risks cannot be identified and handled in a timely manner. Compared with existing technologies, it can achieve efficient utilization of network resources, improve network security and stability, and enhance the overall efficiency and responsiveness of network management. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0018] Figure 1 A flow chart of the first embodiment of the end-to-end traffic health management storm control method of the present application; Figure 2 A schematic diagram of the software architecture of the end-to-end traffic health management storm control method provided in Example 1 of the present application; Figure 3 A flow chart of the second embodiment of the end-to-end traffic health management storm control method of the present application; Figure 4 A flow chart of the third embodiment of the end-to-end traffic health management storm control method of the present application; Figure 5 A flow chart of the fourth embodiment of the end-to-end traffic health management storm control method of the present application; Figure 6 This is a schematic diagram of the module structure of the end-to-end traffic health management storm control device according to an embodiment of the present application; Figure 7 This is a schematic diagram of the device structure of the hardware operating environment involved in the end-to-end traffic health management storm control method in the embodiment of the present application.

[0019] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0020] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0021] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0022] The main solution of the embodiment of the present application is: obtaining the flow data of each switch; based on the flow data, performing abnormal flow detection through a preset algorithm to obtain a detection result; when the detection result is abnormal flow, generating a storm control strategy; performing end-to-end flow health management according to the storm control strategy.

[0023] In this embodiment, for ease of description, the following description is made by taking the internal executor of the end-to-end traffic health management storm control system as the execution subject.

[0024] Since traditional storm control technologies in existing technologies cannot effectively prevent the collapse of the entire network and lack the ability to coordinate across devices, potential risks cannot be identified and handled in a timely manner.

[0025] The present application provides a solution that adopts global traffic monitoring and policy coordination to timely identify traffic anomalies and automatically adjust storm control strategies, which can achieve efficient utilization of network resources, improve network security and stability, and enhance the overall efficiency and responsiveness of network management.

[0026] It can be seen from the above embodiments that the present application adopts global traffic monitoring and policy coordination, timely identifies traffic anomalies, and automatically adjusts storm control strategies, thereby solving the technical problems that traditional storm control technology cannot effectively prevent the collapse of the overall network, lacks the ability to coordinate across devices, and potential risks cannot be identified and handled in a timely manner. It can achieve efficient use of network resources, improve network security and stability, and enhance the overall efficiency and responsiveness of network management.

[0027] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, etc. The following takes the internal actuator of the end-to-end traffic health management storm control system as an example to illustrate this embodiment and the following embodiments.

[0028] Based on this, the embodiment of the present application provides an end-to-end traffic health management storm control method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the end-to-end traffic health management storm control method of the present application.

[0029] In this embodiment, the end-to-end traffic health management storm control method includes steps S10 to S40: Step S10, obtaining the flow data of each switch.

[0030] It should be noted that a switch is a network device that is mainly used to connect multiple devices in a computer network and realize data exchange. It works at the data link layer, can identify the MAC address in the data frame, and forward the data frame according to the pre-established MAC address table. When the switch receives a data frame, it will check its destination MAC address, and then compare it with the MAC address table to send the data frame from the corresponding port, thereby realizing accurate communication between devices. Switches can greatly improve the efficiency and performance of the network, reduce conflict domains, and allow multiple devices to transmit data at the same time. It has many types, such as Ethernet switches and three-layer switches. Ethernet switches are mainly used to connect Ethernet devices to realize two-layer network communication. On the basis of having two-layer switching functions, three-layer switches can also perform three-layer routing forwarding, which can be used to build more complex network architectures. In various network environments such as enterprise networks, data centers, and home networks, switches play a vital role and are one of the key devices to ensure smooth transmission of network data.

[0031] In addition, it should be noted that traffic data refers to the collection of relevant information such as the number, size and transmission rate of data packets passing through a specific device or network node in a network environment. It is an important indicator for measuring network activities and communication volume. In terms of data representation, traffic data can be quantified in units such as bytes, kilobytes, megabytes, and gigabytes, and its dynamic changes can also be expressed in units of data transmission rates such as bits per second (bps), kilobits per second (Kbps), and megabits per second (Mbps). The collection of traffic data is usually achieved through network devices (such as routers, switches), network monitoring tools, or the network statistics function of the operating system. Analysis of traffic data can help network administrators monitor network performance, discover network failures, and perform capacity planning.

[0032] The software architecture diagram is as follows Figure 2 As shown in the figure, it includes a global monitoring module (GMM), an anomaly detection module (ADM) and a policy management module (PMM). The global monitoring module is used to collect and analyze network traffic data, the anomaly detection module is used to detect abnormal traffic patterns based on machine learning or statistical methods, and the policy management module is used to formulate and issue storm control strategies according to traffic analysis results.

[0033] Each switch initiates data transmission operations to the global detection module at a certain time period with the help of its own supported API interface, and sends the collected traffic data to it. After receiving the traffic data from different switches, the global detection module will summarize the traffic data and integrate the scattered data together, such as sorting the traffic data according to different dimensions such as regions and network segments, so that it forms a clear format that is easy to analyze and use later, thereby providing strong data support for further understanding the traffic status of the entire network, discovering potential problems, and formulating corresponding network optimization strategies. Step S20: Based on the flow data, abnormal flow detection is performed using a preset algorithm to obtain a detection result.

[0034] It should be noted that the preset algorithm is an anomaly detection algorithm, which is a type of algorithm used to identify data points or patterns in a data set that deviate significantly from normal patterns or expected behaviors. It can include statistical methods, such as Z-score, which is also called a standard score. It indicates the degree of deviation of a data point in a data set relative to the average value, and the unit is standard deviation. By calculating the Z-score, the data of different data sets can be converted to the same scale for easy comparison and analysis. It also includes a decision tree algorithm, which is a widely used machine learning algorithm that constructs a tree-like structure for decision analysis. The core is to analyze the characteristics of the data set, select appropriate features as split attributes at each node according to specific selection criteria, such as information gain, information gain rate or Gini index, and then divide the data set. This process is continuously recursive, starting from the root node, and gradually subdividing along different branches according to the characteristic test results of the sample until the leaf node is reached to obtain the final decision result, such as the classification category or the regression value. Storm control strategies can include increasing the bandwidth limit of a specific port, filtering the traffic of a specific IP address, or adjusting the priority of data packets.

[0035] In addition, it should be noted that the detection results include normal traffic and abnormal traffic. When there is no abnormal traffic in the network, the detection result is normal traffic. When an abnormal traffic condition occurs in the network and is detected, the detection result is abnormal traffic.

[0036] Step S30, when the detection result is that the flow is abnormal, generate a storm control strategy.

[0037] It should be noted that the storm control strategy can cope with sudden growth, abnormal fluctuations or storm-like traffic shocks in network traffic, and can grasp the traffic status in real time and issue alarms in time through traffic monitoring and early warning. Traffic scheduling and optimization technologies, such as load balancing and traffic shaping, can be used to reasonably allocate and manage traffic, implement network resource expansion and elasticity strategies, ensure that there are enough resources to cope with traffic peaks, strengthen security protection to prevent malicious attacks from causing traffic anomalies, and use caching and content distribution to ensure stable and efficient operation of the network and avoid network congestion and paralysis.

[0038] Step S40: performing end-to-end traffic health management according to the storm control strategy.

[0039] The policy management module sends the storm control policy to the direct memory access (DMA) registered in each switch through the API interface, so that the DMA of each switch can perform localized traffic management according to the received policy. After receiving the policy, the DMA will monitor and regulate the traffic of its port in real time according to the specific provisions and parameters in the policy. For example, when an abnormal increase in traffic is detected, which may cause an abnormal storm, the DMA can automatically take measures such as limiting traffic, adjusting priority, or redirecting traffic according to the storm control policy to ensure the stable operation of the network and the reasonable allocation of resources. At the same time, the DMA will also monitor the execution effect of the storm control policy in real time, maintain real-time communication with the policy management module, and send relevant information about the policy execution effect to the policy management module. With this information, the policy management module can gain an in-depth understanding of the implementation of the policy in the actual network environment, including whether the policy has been correctly executed, whether it has played an effective role in controlling traffic, and whether there are some unexpected problems. In addition, the policy management module will adjust and optimize the storm control policy accordingly based on the relevant information about the policy execution effect. If it is found that a certain policy fails to achieve the expected effect during execution, or a new trend of network traffic changes, the policy management module will adjust the storm control policy based on the analysis of these situations. For example, it may adjust the traffic threshold, change the priority setting, add new control measures, etc., to continuously adapt to the dynamic changes of network traffic and ensure that the network is always in a healthy and stable operating state.

[0040] It should be noted that Direct Memory Access (DMA) is an extremely important data transmission mechanism in computer systems. It aims to establish a direct channel between external devices (such as hard disks, network cards, graphics cards and other hardware devices) and computer memory, so that data can be directly transferred between the two without the CPU continuously intervening in each specific link of data transmission.

[0041] This embodiment provides an end-to-end traffic health management storm control method, which adopts global traffic monitoring and policy coordination, timely identifies traffic anomalies, and automatically adjusts storm control policies. It solves the technical problems that traditional storm control technology cannot effectively prevent the collapse of the entire network, lacks the ability to coordinate across devices, and potential risks cannot be identified and handled in a timely manner. It can achieve efficient use of network resources, improve network security and stability, and enhance the overall efficiency and responsiveness of network management.

[0042] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 3, step S20 includes steps S21-S22: Step S21, obtaining a global traffic view according to the traffic data.

[0043] It should be noted that the global traffic view is a collection of traffic data in the form of a visual chart formed by the global monitoring module summarizing the traffic data of all switches. It aims to break the limitations of local and single-point traffic observation in the network, and integrate the traffic conditions between different areas and different devices in the entire network to form a macro and complete display form. By collecting traffic data from each switch, such as traffic size, direction, protocol type, port usage and other information, and summarizing, sorting and correlating these massive data, it can clearly show the overall distribution of traffic in the network, such as which links carry large traffic, which areas are traffic convergence points or key forwarding nodes, etc., and can also reflect the traffic proportion corresponding to different business applications.

[0044] The global traffic view uses visual presentation methods, such as topology diagrams combined with traffic charts, traffic heat maps, etc., to intuitively display the dynamic change trend of network traffic. After obtaining the global traffic view, it can be displayed through a human-computer interaction interface so that managers can also detect traffic anomalies in time and take measures to ensure efficient, stable and secure operation of the network.

[0045] Step S22: According to the global traffic view, abnormal traffic detection is performed by a preset algorithm to obtain a detection result.

[0046] The global traffic view can be used to comprehensively understand the traffic status of the entire network. On this basis, the anomaly detection algorithm can be used to conduct in-depth analysis of these traffic data. The anomaly detection algorithm will process the data in the global traffic view one by one based on different principles and methods, and constantly compare and evaluate whether each data point conforms to the normal traffic pattern. After a series of calculations and judgment processes, the detection results are finally obtained.

[0047] In a feasible implementation manner, step S22 includes steps S221 to S223: Step S221: performing abnormal traffic detection using a preset algorithm according to the global traffic view.

[0048] Taking the preset algorithm as the statistical method Z-score as an example, the global traffic view can provide comprehensive network traffic information, including traffic data of different time periods and different network nodes. The anomaly detection module uses the Z-score method to determine whether it is an outlier by calculating the degree of deviation between the data point and the mean of the data set. First, extract relevant traffic feature data from the global traffic view, such as traffic size, number of data packets, etc. Then, calculate the mean and standard deviation of these data. The following is the Z-score formula:

[0049] Where X is the value of the data point, is the mean, is the standard deviation.

[0050] For each data point, the Z-score value is calculated according to the Z-score formula. If the absolute value of the Z-score is large, for example, it exceeds a certain threshold, such as 3 or -3, then the traffic corresponding to the data point is considered to be an abnormal traffic pattern. This method can more accurately identify traffic conditions that deviate significantly from normal traffic patterns, providing an important basis for network administrators to promptly discover potential network problems, perform troubleshooting, and provide security protection.

[0051] Step S222, when no abnormal traffic pattern is detected, the detection result is that the traffic is normal.

[0052] When abnormal traffic detection is performed based on the global traffic view, if no traffic pattern that meets the abnormal judgment criteria is found in the entire detection process, it means that the traffic in the current network is in a normal state, and the corresponding detection result is that the traffic is normal. From the data level, when analyzing various characteristic data such as traffic size, flow direction, number of packets extracted from the global traffic view, whether through statistical analysis of whether the traffic exceeds the normal mean range, or using other rule-based and model-based detection methods, no characteristic situation that violates the definition of the normal traffic pattern occurs. This shows that the traffic interaction between each link and each node in the network is within the expected and normal range, and the distribution of traffic, transmission rate, and protocols involved in the traffic are all in line with the general rules under normal network operation. There are no abnormal performances such as sudden and large fluctuations in traffic, abnormal flow convergence, or traffic peaks that do not meet the needs of regular business applications, which may indicate network failures, security risks, or configuration errors. Therefore, it can be determined that the detection result is that the traffic is normal.

[0053] Step S223, when the abnormal traffic pattern is detected, the detection result is obtained as abnormal traffic.

[0054] When abnormal traffic detection is performed, when certain features in the traffic data of the global traffic view begin to deviate from the normal traffic behavior pattern, such as a sharp increase or decrease in the traffic size, exceeding the normal range of fluctuations, or abnormal traffic flow, such as a large amount of traffic that should flow in a specific area suddenly flows to other unexpected directions, or the characteristics of the data packets change, such as the size distribution of the data packets, the proportion of protocol types, etc., which are inconsistent with the normal situation. Once these anomalies are identified by the detection algorithm, it indicates that there are potential problems or risks in the network, which may be caused by network attacks, equipment failures, software errors, or sudden high-traffic business needs, and the detection result is traffic anomaly.

[0055] By detecting abnormal traffic patterns, it is determined whether the traffic is abnormal, thereby improving the responsiveness of network management.

[0056] This embodiment provides an end-to-end traffic health management storm control method, which obtains a global traffic view based on the traffic data; based on the global traffic view, abnormal traffic detection is performed through a preset algorithm to obtain a detection result, which can improve the overall efficiency and responsiveness of network management.

[0057] Based on the first embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 4 , step S30 includes steps S31-S32: Step S31, when the detection result is that the flow is abnormal, an alarm is generated and abnormal event information is recorded, and the abnormal event information includes the type of flow abnormality, triggering time, related switches and port information.

[0058] It should be noted that abnormal event information is key data recorded when traffic anomalies are detected, which is used to help network administrators quickly locate problems, analyze causes and take corresponding measures. It includes traffic anomaly type, trigger time, related switches and port information.

[0059] When the detection result is abnormal traffic, the abnormal detection module will generate an alarm to attract the attention of relevant personnel. The alarm can be presented in various forms, such as issuing a specific sound prompt, popping up a striking notification window on the monitoring interface, or sending text messages or push messages to the mobile devices of relevant personnel. At the same time, the system will record the abnormal event information in detail. For the type of traffic anomaly, it will be classified according to the specific situation detected. It may be a sudden high-traffic attack, such as a sharp increase in traffic caused by a DDoS attack, or it may be an abnormal traffic flow, such as abnormal traffic on a path that should not have a large amount of traffic. The trigger time is recorded accurately to the specific moment, so as to analyze the development process of the abnormal event later. The information of the relevant switches includes the identification, model, location, etc. of the switches involved in the abnormal traffic, which can quickly locate the network location where the anomaly occurs. The port information records the specific port number involved in the abnormal traffic, providing specific clues for further troubleshooting.

[0060] Step S32: Generate a storm control strategy according to the traffic anomaly type, the trigger time, the related switches and the port information.

[0061] Generate corresponding storm control strategies based on the recorded traffic anomaly type, trigger time, related switches and port information. Storm control strategies can include increasing bandwidth limits for specific ports, filtering traffic from specific IP addresses, or adjusting data packet priorities. The policy management module formulates different strategies based on specific anomalies and network requirements, and can combine different policy measures to form new storm control strategies to ensure that appropriate countermeasures can be taken for storms of multiple types.

[0062] For example, when a specific port is overloaded and congested, a strategy of increasing the bandwidth limit of a specific port can be adopted to ensure smooth data transmission of key services by increasing the port bandwidth, and avoid network jams caused by insufficient bandwidth that affect normal business operations. If malicious traffic injection from suspicious IP addresses is detected, a traffic strategy for filtering specific IP addresses can be implemented to block the traffic of these IPs in a timely manner, protect network security, prevent sensitive information leakage and server attacks. When bandwidth resources are tight and multiple business flows compete for bandwidth, a data packet priority adjustment strategy is used to set priorities for different business data packets according to the importance of the business, ensure that core businesses are transmitted first, and ensure the efficient operation of key businesses.

[0063] In a feasible implementation manner, step S32 includes steps S321-S322: Step S321, obtaining the current network status and preset response strategy.

[0064] It should be noted that the current network status is a description of the network's operation at the current moment, covering the network's traffic characteristics, the smoothness of data transmission, and whether there is abnormal traffic. The network status can include changes in bandwidth usage, different manifestations of network latency, such as high network latency will cause freezes and unsmoothness, and packet loss rate. Packet loss may cause incomplete data and network application interruptions, such as freezes and audio interruptions in video calls.

[0065] In addition, it should be noted that the preset response strategy is a series of measures formulated in advance to cope with different network conditions, and the storm control strategy is a strategy obtained by optimizing the preset response strategy and integrating multiple measures according to actual conditions.

[0066] Step S322, generating a storm control strategy according to the traffic anomaly type, the trigger time, the related switch, the port information, the current network status and the preset response strategy.

[0067] For example, when users in a certain area collectively report network jams, it is found that the switch ports connected to the office computers in the area frequently experience traffic congestion during the office peak hours (i.e., trigger time) from 10 a.m. to 11 a.m. every day. The abnormal traffic type is characterized by continuous high bandwidth occupation. The culprit is the convergence of a large amount of file transfer and video conferencing traffic. At this time, in order to ensure that key businesses are not affected, the specific ports of the switch are increased by 30% on the original basic bandwidth configuration to ensure that data packets can be transmitted smoothly and avoid the risk of network paralysis caused by insufficient bandwidth. For example, if the core switch of the company's internal network detects an influx of abnormal traffic between 2 a.m. and 4 a.m. (special trigger time), analysis shows that the traffic comes from several unfamiliar external IP addresses, and these IPs continue to send a large number of suspected attack packets to the internal server. The abnormal traffic type is malicious traffic injection. At this time, quickly set up traffic filtering for these specific IP addresses in the firewall rules to block all their connection requests, just like setting up a solid line of defense at the network boundary to protect the security and stability of the internal network and prevent sensitive information from being leaked and the server from being further damaged. For example, during an e-commerce promotion, starting at 10 a.m. (the critical trigger time), the switch port responsible for processing order services was overwhelmed with traffic. The traffic anomaly was caused by a mixture of business traffic competing for bandwidth, including transaction traffic generated by user orders, as well as background synchronization data, customer service system response, and other traffic. At this time, the priority of order processing-related data packets is set to the highest to ensure a smooth and fast response to customer ordering processes; while the priority of data packets with non-immediate requirements such as data synchronization is lowered to allow them to be transmitted during network idle periods. In this way, through reasonable priority sorting, the efficient operation of core services at critical moments is guaranteed, allowing the entire network service to proceed in an orderly manner.

[0068] By formulating storm control strategies according to actual conditions, the diversity and flexibility of storm control strategies can be enhanced.

[0069] This embodiment provides an end-to-end traffic health management storm control method. When the detection result is a traffic abnormality, an alarm is generated and abnormal event information is recorded. The abnormal event information includes the traffic abnormality type, trigger time, related switches and port information; a storm control strategy is generated based on the traffic abnormality type, the trigger time, the related switches and the port information, which can enhance the diversity and flexibility of the storm control strategy.

[0070] Based on the first embodiment of the present application, in the fourth embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be described in detail later. Figure 5 , step S40 includes steps S41-S42: Step S41, issuing the storm control strategy.

[0071] After the policy management module generates the storm control policy, it will send these policies to the DMA of each switch through a secure API interface. After receiving these policy contents, the DMA of the switch can quickly process the subsequent data flowing into and out of the switch according to the policy. For example, if the policy requires limiting the bandwidth of a certain port, the DMA can quickly coordinate and adjust the memory data read and write speed corresponding to the port to achieve bandwidth limitation; if it is necessary to filter the traffic of a specific IP, the DMA can cooperate with the relevant filtering rules to accurately intercept or release the data packets from the corresponding IP, ensuring that the network can respond in time according to the storm control policy, quickly adapt to the traffic changes that may occur at any time, ensure the overall smooth and efficient operation of the network, and minimize the negative impact of traffic anomalies on the quality of network services.

[0072] Step S42, obtaining the policy execution effect and adjusting the storm control policy to perform end-to-end traffic health management.

[0073] After DMA executes the storm control strategy, it continuously communicates with the policy management module to maintain the consistency of the policy. It also monitors the execution effect of the policy in real time and transmits relevant information of the execution effect to the policy management module for policy adjustment to achieve healthy management of traffic.

[0074] In a feasible implementation manner, step S42 includes steps S421 to S423: Step S421, obtaining the policy execution effect.

[0075] After the storm control policy generated by the policy management module is sent to the DMA of each switch, it can suppress broadcast storms, control multicast traffic, avoid port congestion, prevent the uncontrolled spread of broadcast packets, ensure that multicast data transmission does not occupy too many resources, and prevent individual ports from being congested due to large traffic. In terms of data transmission efficiency, it can optimize bandwidth allocation, reduce data delays, and improve transmission reliability. It can dynamically adjust bandwidth according to business priorities and needs, reduce data transmission delays, and ensure data integrity and accuracy. In terms of network security, it can prevent malicious attacks and protect network resources. It can prevent network attacks by filtering specific IP addresses or suspicious traffic and ensure that network resources are used legally.

[0076] However, due to insufficient consideration of certain special applications or burst traffic scenarios in the network when the policy was formulated, the storm control policy cannot effectively deal with all traffic anomalies in actual implementation. For example, some video conferencing applications with extremely high real-time requirements still experience freezes during network peak hours. At the same time, there are differences in the DMA hardware performance of each switch and compatibility issues with the network environment, which makes it impossible for some switches to perform traffic control according to the policy well, causing congestion on some ports when traffic surges, which in turn causes a significant increase in data packet loss and delay, affecting the overall network communication quality. In addition, there is a lack of real-time dynamic adjustment mechanism during the policy execution process. Faced with the ever-changing network traffic patterns and newly emerging abnormal traffic types, adaptive changes cannot be made in time, resulting in a gradual deterioration in the policy execution effect, and the inability to continuously and effectively guarantee the stable operation of the network and the data transmission efficiency. DMA will monitor the changes in network traffic in real time, and record the execution effect of the storm control strategy accordingly. It will summarize the strategy execution effect and send it to the strategy management module so that the strategy management module can adjust and optimize the storm control strategy.

[0077] Step S422: obtaining feedback information according to the execution effect of the strategy.

[0078] It should be noted that the feedback information is a strategy adjustment suggestion obtained based on the abnormal traffic conditions that cannot be completely resolved by the storm control strategy recorded in the strategy execution effect.

[0079] According to the abnormal traffic conditions that cannot be completely resolved by the storm control policy recorded in the policy execution effect, the policy management module will obtain corresponding feedback information based on the policy execution effect, such as large network traffic and suggestions for adjusting the network traffic limit.

[0080] Step S423: adjusting the storm control strategy according to the feedback information.

[0081] According to the content of the feedback information, the policy management module adjusts the storm control strategy accordingly to obtain a new storm control strategy. The new storm control strategy can achieve better storm control effect based on the previous storm control to achieve healthy management of network traffic.

[0082] By real-time monitoring and corresponding adjustment of storm control strategies, the security and stability of the network can be effectively improved.

[0083] This embodiment provides an end-to-end traffic health management storm control method, which issues the storm control strategy; obtains the strategy execution effect and adjusts the storm control strategy to perform end-to-end traffic health management, which can achieve efficient use of network resources and improve network security and stability.

[0084] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the end-to-end traffic health management storm control method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0085] This application also provides an end-to-end traffic health management storm control device, please refer to Figure 6 , the end-to-end traffic health management storm control device comprises: The data acquisition module 10 is used to acquire the flow data of each switch.

[0086] The abnormality detection module 20 is used to perform abnormal flow detection based on the flow data by using a preset algorithm to obtain a detection result.

[0087] The strategy generation module 30 is used to generate a storm control strategy when the detection result is that the traffic is abnormal.

[0088] The traffic management module 40 is used to perform end-to-end traffic health management according to the storm control strategy.

[0089] In one embodiment, the anomaly detection module 20 is further used to obtain a global traffic view based on the traffic data; and to perform abnormal traffic detection using a preset algorithm based on the global traffic view to obtain a detection result.

[0090] In one embodiment, the anomaly detection module 20 is also used to perform abnormal traffic detection through a preset algorithm based on the global traffic view; when no abnormal traffic pattern is detected, the detection result is that the traffic is normal; when the abnormal traffic pattern is detected, the detection result is that the traffic is abnormal.

[0091] In one embodiment, the strategy production module 30 is also used to generate an alarm and record abnormal event information when the detection result is a traffic abnormality, and the abnormal event information includes the traffic abnormality type, trigger time, related switches and port information; generate a storm control strategy based on the traffic abnormality type, the trigger time, the related switches and the port information.

[0092] In one embodiment, the strategy generation module 30 is also used to obtain the current network status and the preset response strategy; generate a storm control strategy according to the traffic anomaly type, the trigger time, the relevant switch, the port information, the current network status and the preset response strategy.

[0093] In one embodiment, the traffic management module 40 is further used to issue the storm control strategy; obtain the strategy execution effect and adjust the storm control strategy to perform end-to-end traffic health management.

[0094] In one embodiment, the traffic management module 40 is further used to obtain a policy execution effect; obtain feedback information according to the policy execution effect; and adjust the storm control policy according to the feedback information.

[0095] The end-to-end traffic health management storm control device provided by the present application adopts the end-to-end traffic health management storm control method in the above-mentioned embodiment, which can solve the technical problem of how to achieve efficient utilization of network resources, improve network security and stability, and enhance the overall efficiency and responsiveness of network management. Compared with the prior art, the beneficial effects of the end-to-end traffic health management storm control device provided by the present application are the same as the beneficial effects of the end-to-end traffic health management storm control method provided by the above-mentioned embodiment, and the other technical features in the end-to-end traffic health management storm control device are the same as the features disclosed in the above-mentioned embodiment method, which will not be repeated here.

[0096] The present application provides an end-to-end traffic health management storm control device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the end-to-end traffic health management storm control method in the above-mentioned embodiment one.

[0097] Reference below Figure 7 , which shows a schematic diagram of the structure of an end-to-end traffic health management storm control device suitable for implementing an embodiment of the present application. The end-to-end traffic health management storm control device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The end-to-end traffic health management storm control device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0098] like Figure 7As shown, the end-to-end traffic health management storm control device may include a processing device 1001 (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. Various programs and data required for the operation of the end-to-end traffic health management storm control device are also stored in RAM1004. The processing device 1001, ROM1002 and RAM1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 can allow the end-to-end traffic health management storm control device to communicate wirelessly or wired with other devices to exchange data. Although the figure shows an end-to-end traffic health management storm control device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have instead.

[0099] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0100] The end-to-end traffic health management storm control device provided by the present application adopts the end-to-end traffic health management storm control method in the above-mentioned embodiment, which can solve the technical problem of how to achieve efficient utilization of network resources, improve network security and stability, and enhance the overall efficiency and responsiveness of network management. Compared with the prior art, the beneficial effects of the end-to-end traffic health management storm control device provided by the present application are the same as the beneficial effects of the end-to-end traffic health management storm control method provided by the above-mentioned embodiment, and the other technical features in the end-to-end traffic health management storm control device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0101] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0102] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0103] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, the computer-readable program instructions being used to execute the end-to-end traffic health management storm control method in the above-mentioned embodiment.

[0104] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM: Random Access Memory), a read-only memory (ROM: Read Only Memory), an erasable programmable read-only memory (EPROM: Erasable Programmable Read Only Memory or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM: CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency: Radio Frequency), etc., or any suitable combination of the above.

[0105] The computer-readable storage medium may be included in the end-to-end traffic health management storm control device; or may exist independently without being assembled into the end-to-end traffic health management storm control device.

[0106] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the end-to-end traffic health management storm control device, the end-to-end traffic health management storm control device: obtains the traffic data of each switch; based on the traffic data, performs abnormal traffic detection through a preset algorithm to obtain a detection result; when the detection result is abnormal traffic, generates a storm control strategy; and performs end-to-end traffic health management according to the storm control strategy.

[0107] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0108] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0109] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0110] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned end-to-end traffic health management storm control method, and can solve the technical problems of how to achieve efficient utilization of network resources, improve network security and stability, and enhance the overall efficiency and responsiveness of network management. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the end-to-end traffic health management storm control method provided by the above-mentioned embodiment, and will not be repeated here.

[0111] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned end-to-end traffic health management storm control method when executed by a processor.

[0112] The computer program product provided by this application can solve the technical problem of how to achieve efficient use of network resources, improve network security and stability, and enhance the overall efficiency and responsiveness of network management. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the end-to-end traffic health management storm control method provided by the above embodiment, and will not be repeated here.

[0113] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. An end-to-end traffic health management storm control method, characterized in that: The method comprises: Obtain traffic data of each switch; Based on the traffic data, abnormal traffic detection is performed using a preset algorithm to obtain a detection result; When the detection result is that the flow is abnormal, generating a storm control strategy; End-to-end traffic health management is performed according to the storm control strategy.

2. The method according to claim 1, characterized in that The step of performing abnormal flow detection based on the flow data by using a preset algorithm to obtain a detection result comprises: According to the traffic data, a global traffic view is obtained; According to the global traffic view, abnormal traffic detection is performed using a preset algorithm to obtain a detection result.

3. The method according to claim 2, characterized in that The step of performing abnormal traffic detection by a preset algorithm according to the global traffic view to obtain a detection result comprises: According to the global traffic view, abnormal traffic detection is performed by a preset algorithm; When no abnormal traffic pattern is detected, the detection result is that the traffic is normal; When the abnormal traffic pattern is detected, the detection result is obtained as traffic abnormality.

4. The method according to claim 1, characterized in that When the detection result is that the traffic is abnormal, the step of generating a storm control strategy includes: When the detection result is that the flow is abnormal, an alarm is generated and abnormal event information is recorded, wherein the abnormal event information includes the type of flow abnormality, triggering time, related switches and port information; A storm control strategy is generated according to the traffic anomaly type, the trigger time, the related switches and the port information.

5. The method according to claim 4, characterized in that The step of generating a storm control strategy according to the traffic anomaly type, the trigger time, the related switch and the port information comprises: Get the current network status and preset response strategy; A storm control strategy is generated according to the traffic anomaly type, the trigger time, the related switches, the port information, the current network status and the preset response strategy.

6. The method according to claim 1, characterized in that The step of performing end-to-end traffic health management according to the storm control strategy includes: issuing the storm control strategy; Obtain policy execution results and adjust the storm control policy to perform end-to-end traffic health management.

7. The method according to claim 6, characterized in that The steps of obtaining the strategy execution effect and adjusting the storm control strategy include: Get the strategy execution effect; Obtaining feedback information based on the execution effect of the strategy; The storm control strategy is adjusted according to the feedback information.

8. An end-to-end traffic health management storm control device, characterized in that: The device comprises: A data acquisition module, used to acquire the flow data of each switch; An abnormality detection module, used to perform abnormal flow detection based on the flow data by using a preset algorithm to obtain a detection result; A strategy generation module, used for generating a storm control strategy when the detection result is a traffic anomaly; The traffic management module is used to perform end-to-end traffic health management according to the storm control strategy.

9. An end-to-end traffic health management storm control device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the end-to-end traffic health management storm control method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the end-to-end traffic health management storm control method according to any one of claims 1 to 7 are implemented.

Images