Fault alarm processing method and device based on cascade network, equipment and medium

Abstract

The invention provides a fault alarm processing method and device based on a cascade network, equipment and a medium, relates to the technical field of network security, and is used for solving the technical problems of alarm flooding and influence on management efficiency caused by the fact that a fault alarm system in the prior art is difficult to locate a network fault in time. The method comprises the following steps: acquiring the operation state and adjacency information of each device in the cascade network; according to the operation state and the adjacency information, generating a network topology feature, the network topology feature representing a connection mode and a dependency relationship between devices in the cascade network; in response to a fault of the cascade network, determining a fault influence range according to the network topology characteristics; and based on the fault influence range, sending an effective alarm triggered by the fault equipment, and inhibiting an ineffective alarm triggered by lower equipment of the fault equipment.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and more specifically, to a fault alarm processing method, device, equipment and medium based on a cascade network. Background Art

[0002] Cascading is one of the most basic and simple switch network structures. In a cascade structure, multiple switches are connected in series through ports, and network data is transmitted between switches in sequence until it reaches the destination. The advantages of cascading are that it is simple and easy to use, has low deployment costs, and is suitable for small LANs. However, cascading also has some disadvantages. For example, data is prone to delays when transmitted on the cascade link, affecting network performance. Secondly, if a switch in the cascade link fails, it may cause communication interruption in the entire network and trigger an alarm.

[0003] In the process of realizing the concept of the present disclosure, the inventors found that there are at least the following defects in the related technology: the fault alarm system in the prior art is difficult to locate network faults in a timely manner, which leads to alarm flooding and affects management efficiency. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a fault alarm processing method, device, equipment and medium based on a cascade network, which is used to solve the technical problem that the fault alarm system in the prior art is difficult to locate network faults in a timely manner, thereby causing alarm flooding and affecting management efficiency.

[0005] One aspect of the present disclosure provides a fault alarm processing method based on a cascade network, including: obtaining the operating status and adjacency information of each device in the cascade network; generating network topology characteristics based on the operating status and adjacency information, wherein the network topology characteristics characterize the connection mode and dependency relationship between each device in the cascade network; in response to a fault in the cascade network, determining the fault impact scope based on the network topology characteristics; based on the fault impact scope, sending a valid alarm triggered by the faulty device, and suppressing invalid alarms triggered by downstream devices of the faulty device.

[0006] According to an embodiment of the present disclosure, obtaining the operating status and neighbor information of each device in the cascade network includes: obtaining the operating status of each device in the cascade network based on the SNMP protocol; obtaining the neighbor information of each device in the cascade network based on the LLDP / CDP protocol.

[0007] According to an embodiment of the present disclosure, obtaining the operating status and adjacency information of each device in a cascade network also includes: preprocessing data corresponding to the operating status and adjacency information; and storing the preprocessed operating status data and adjacency information data in a relational database management system.

[0008] According to an embodiment of the present disclosure, generating network topology features based on operating status and adjacency information includes: creating an undirected graph based on the operating status and adjacency information, wherein the nodes of the undirected graph represent devices and the edges of the undirected graph represent connection relationships between devices; generating network topology features based on the undirected graph.

[0009] According to an embodiment of the present disclosure, in response to a fault in a cascade network, determining the scope of impact of the fault based on network topology characteristics includes: real-time monitoring of the operating status of each device in the cascade network; in response to an abnormality in the operating status, determining the faulty device corresponding to the abnormal point; determining the upper and lower connection relationships of the faulty device based on the network topology characteristics; and determining the scope of impact of the fault based on the upper and lower connection relationships.

[0010] According to an embodiment of the present disclosure, the method also includes: in response to the neighbor device of the faulty device being a normal device, sending a valid alarm triggered by the faulty device; in response to the neighbor devices of the faulty device being all faulty devices, or the faulty device having no neighbor devices, suppressing an invalid alarm triggered by the faulty device.

[0011] According to an embodiment of the present disclosure, sending a valid alarm triggered by a faulty device includes: sending the valid alarm to a designated receiving end through an application program interface of a mobile office software.

[0012] Another aspect of the present disclosure provides a fault alarm processing device based on a cascade network, the device comprising: an acquisition module, used to acquire the operating status and adjacency information of each device in the cascade network; a generation module, used to generate network topology characteristics according to the operating status and adjacency information, wherein the network topology characteristics characterize the connection mode and dependency relationship between each device in the cascade network; a determination module, used to determine the fault impact scope according to the network topology characteristics in response to a fault in the cascade network; an alarm processing module, used to send a valid alarm triggered by the faulty device based on the fault impact scope, and suppress invalid alarms triggered by downstream devices of the faulty device.

[0013] Another aspect of the present disclosure provides an electronic device, including: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the above method.

[0014] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the above method when executed.

[0015] Another aspect of the present disclosure provides a computer program product, which includes computer executable instructions, and the instructions are used to implement the above method when executed.

[0016] Compared with the prior art, the fault alarm processing method, device, equipment and medium based on the cascade network provided by the present disclosure have at least the following beneficial effects:

[0017] (1) The present disclosure provides a fault alarm processing method, device, equipment and medium based on a cascade network. In a cascade network, when an uplink link fails, all devices connected to the cascade link will be disconnected, resulting in a large amount of invalid alarm information. This not only increases the burden on network administrators, but also easily conceals the alarm information that really needs attention. The method can quickly find the location of the faulty device or link and determine the scope of the fault by automatically analyzing the network topology structure. In the case of an uplink link interruption, the method automatically suppresses invalid alarms of the downlink devices to avoid the flooding of alarm information, thereby reducing the work pressure of network administrators and improving management efficiency.

[0018] (2) The fault alarm processing method, device, equipment and medium based on the cascade network provided by the present invention monitor the working status and adjacency relationship of network equipment in real time through the SNMP protocol and the LLDP / CDP protocol, and intelligently process the collected data, thereby reducing the workload of manual intervention and manual analysis and improving data processing efficiency.

[0019] (3) The fault alarm processing method, device, equipment and medium based on the cascade network provided by the present disclosure use automated algorithms and tools to dynamically analyze the topological structure of the network to ensure that the upper and lower connection relationships between devices can be quickly identified. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0021] Figure 1 A flowchart of a fault alarm processing method based on a cascade network according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 2 The schematic diagram shows a principle diagram of a fault alarm processing method based on a cascade network according to an embodiment of the present disclosure;

[0023] Figure 3 A schematic diagram showing a principle diagram of sending a valid alarm and suppressing an invalid alarm based on a fault impact range according to an embodiment of the present disclosure;

[0024] Figure 4 A structural block diagram of a fault alarm processing device based on a cascade network according to an embodiment of the present disclosure is schematically shown; and

[0025] Figure 5The structural block diagram of an electronic device suitable for implementing a fault alarm processing method based on a cascade network according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0026] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0027] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0028] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0029] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0030] In the embodiments of the present disclosure, the collection, updating, analysis, processing, use, transmission, provision, disclosure, storage, etc. of the data involved (for example, including but not limited to user personal information) are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. In particular, necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information, network security, and national security.

[0031] Cascading is one of the most basic and simple switch network structures. In a cascade structure, multiple switches are connected in series through ports, and network data is transmitted between switches in sequence until it reaches the destination. The advantages of cascading are that it is simple and easy to use, has low deployment costs, and is suitable for small LANs. However, cascading also has some disadvantages. For example, data is prone to delays when transmitted on the cascade link, affecting network performance. Secondly, if a switch in the cascade link fails, it may cause communication interruption in the entire network and trigger an alarm.

[0032] In the process of realizing the concept of the present disclosure, the inventors found that there are at least the following defects in the related technology: the fault alarm system in the prior art is difficult to locate network faults in a timely manner, which leads to alarm flooding and affects management efficiency.

[0033] Based on this, the present disclosure provides a fault alarm processing method based on a cascade network, the method comprising: obtaining the operating status and adjacency information of each device in the cascade network; generating network topology characteristics based on the operating status and adjacency information, wherein the network topology characteristics characterize the connection mode and dependency relationship between each device in the cascade network; in response to a fault in the cascade network, determining the fault impact scope based on the network topology characteristics; based on the fault impact scope, sending a valid alarm triggered by the faulty device, and suppressing invalid alarms triggered by downstream devices of the faulty device.

[0034] The fault alarm processing method based on the cascade network provided by the present invention can quickly find the location of the faulty device or link and determine the scope of the fault impact by automatically analyzing the network topology structure. In the case of an uplink link interruption, it can automatically suppress invalid alarms of the downlink device to avoid the flood of alarm information, reduce the work pressure of the network administrator, and improve management efficiency.

[0035] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0036] Figure 1 The flowchart of the fault alarm processing method based on the cascade network according to the embodiment of the present disclosure is schematically shown.

[0037] like Figure 1 As shown, the fault alarm processing method based on the cascade network of this embodiment may include operations S1 to S4, for example.

[0038] In operation S1, the operating status and adjacency information of each device in the cascade network is obtained.

[0039] In operation S2, a network topology feature is generated according to the operating state and the adjacency information, wherein the network topology feature represents a connection mode and dependency relationship between various devices in the cascade network.

[0040] In operation S3, in response to a failure of the cascade network, a failure impact range is determined according to the network topology characteristics.

[0041] In operation S4, based on the fault impact range, a valid alarm triggered by the faulty device is sent, and an invalid alarm triggered by a downstream device of the faulty device is suppressed.

[0042] In this embodiment, first, the operating status and adjacency information of each device in the cascade network is obtained.

[0043] The running status of the device includes, for example, the port status and the health status of the device. The adjacency information of the device refers to the adjacency relationship between the devices, that is, the direct connection or adjacency between the device and other devices. This information usually includes:

[0044] Identification of the neighboring device: IP address, MAC address, host name, etc. of the neighboring device.

[0045] Interface information: port number or interface name (such as eth0, gig0 / 1, etc.) connected to the adjacent device.

[0046] Connection status: whether the connection with the adjacent device is active or disconnected, and what the connection quality is.

[0047] Protocol information: Network protocols used to establish adjacency, such as OSPF (Open Shortest Path First) and EIGRP (Enhanced Interior Gateway Routing Protocol).

[0048] Then, a network topology is generated based on the above information to characterize the connection mode and dependency relationship between various devices in the cascade network, that is, the network topology characteristics.

[0049] When a cascade network fails, the fault impact range is determined from the network topology. Normally, when an uplink link (such as a link connected to a main switch or router) fails, all devices downstream of the cascade link will go offline, resulting in a large number of invalid alarm messages. At this time, based on the fault impact range, only valid alarms triggered by the faulty device are sent, and invalid alarms of downstream devices are automatically suppressed, avoiding the flooding of alarm information, reducing the workload of network administrators, and improving management efficiency.

[0050] According to an embodiment of the present disclosure, operation S1 of acquiring the operating status and adjacency information of each device in the cascade network may include, for example:

[0051] Based on the SNMP protocol, the operating status of each device in the cascade network can be obtained. For example, through Python's pysnmp library, the OID (object identifier) ​​of the device can be accessed to obtain the device status and performance data.

[0052] Based on the LLDP / CDP protocol, obtain the neighbor information of each device in the cascade network. For example, through the device command (such as show lldp neighbors), you can dynamically obtain the neighbor information of each device and understand its connection relationship. The subprocess library in Python can be used to execute these commands and collect the results.

[0053] SNMP (Simple Network Management Protocol) is an application layer protocol used for network management. It allows network administrators to monitor and manage the status, configuration, and statistics of network devices. SNMP is an Internet standard (RFC 3410) and is widely used in various network devices, including routers, switches, servers, printers, etc.

[0054] SNMP is currently divided into three versions, among which SNMPv1 is the initial version, which provides basic network management functions but has no security. SNMPv2c has made improvements and added some new functions, such as more efficient data transmission and better error reporting, and has improved security. SNMPv3 introduces important security features, such as user authentication, data encryption, and access control, and is currently the most secure version. Therefore, in this embodiment, the SNMPv3 protocol is selected to obtain the operating status of each device in the cascade network.

[0055] CDP (Cisco Discovery Protocol) and LLDP (Link Layer Discovery Protocol) are both network protocols used to discover and identify network devices and their capabilities, but they have some key differences:

[0056] CDP is a Cisco proprietary protocol used for discovery between Cisco devices. It runs at the data link layer (the second layer of the OSI model) and allows devices to share their configuration information, such as device name, IP address, platform type, software version, etc.

[0057] LLDP is an open standard protocol (IEEE 802.1AB) for discovering network devices at the link layer. Similar to CDP, LLDP also allows devices to share their configuration information, but it is cross-vendor and can work between devices from different manufacturers.

[0058] In this embodiment, the network administrator can choose to use CDP or LLDP, or both, according to the types and requirements of network devices.

[0059] The fault alarm processing method based on the cascade network provided by the embodiment of the present disclosure monitors the working status and adjacency relationship of network devices in real time through the SNMP protocol and the LLDP / CDP protocol, and intelligently processes the collected data, thereby reducing the workload of manual intervention and manual analysis and improving data processing efficiency.

[0060] According to an embodiment of the present disclosure, operation S1 of acquiring the operating status and adjacency information of each device in the cascade network may also include:

[0061] Preprocess the data corresponding to the running status and adjacency information. For example, clean invalid and duplicate data to ensure that clean data is stored in the database.

[0062] The pre-processed operation status data and adjacency information data are stored in a relational database management system. For example, the processed data is saved in a MariaDB database for subsequent analysis and use.

[0063] According to an embodiment of the present disclosure, operation S2 may generate network topology features according to the operating status and adjacency information, for example, including:

[0064] An undirected graph is created according to the running status and adjacency information, wherein the nodes of the undirected graph represent devices, and the edges of the undirected graph represent the connection relationship between the devices.

[0065] Generate network topology features based on the undirected graph.

[0066] In this embodiment, automated algorithms and tools (such as Python libraries Netmiko and NetworkX) are used to dynamically analyze the topology of the network to ensure that the upper and lower connection relationships between devices can be quickly identified. Netmiko is used to connect to network devices through SSH and execute commands to obtain adjacency information. NetworkX is used to generate and operate undirected graphs to represent the connection relationship and topology of devices.

[0067] Specifically, use Netmiko to connect to the device and execute commands such as show lldp neighbors to collect device neighbor information.

[0068] By using NetworkX to generate a network topology diagram of the device with this adjacency information, you can analyze the connection status, connectivity, key nodes, etc. between devices. When a network failure occurs, you can perform connectivity analysis to determine the relative position of the device and the scope of the failure by checking the connected components and key nodes of the network.

[0069] In this embodiment, the nodes of the undirected graph may include: computers, routers, switches, firewalls, intrusion detection systems (IDS) and intrusion prevention systems (IPS), etc. Connection methods may include: wired connection (Ethernet), wireless connection (Wi-Fi), point-to-point connection (VPN), etc. Network relationships include: relationships between servers and clients, relationships between devices, relationships between subnets, etc. The collected information is classified and organized according to different standards (such as device type, connection type, subnet, etc.).

[0070] In this embodiment, the method can also be adjusted according to the specific situation and requirements of the cascade network. For example, if the connection between network devices has weights (e.g., link bandwidth or reliability), it is necessary to add weights when constructing the undirected graph and consider these weights in the analysis function.

[0071] The fault alarm processing method based on the cascade network provided by the embodiment of the present disclosure utilizes automated algorithms and tools to dynamically analyze the topological structure of the network to ensure that the upper and lower connection relationships between devices can be quickly identified.

[0072] According to an embodiment of the present disclosure, in response to a failure in the cascade network, determining the impact range of the failure according to network topology characteristics may include:

[0073] Monitor the operating status of each device in the cascade network in real time.

[0074] In response to an abnormality in the operating state, a faulty device corresponding to the abnormal point is determined.

[0075] Determine the upstream and downstream connection relationships of the faulty device based on the network topology characteristics.

[0076] Determine the scope of fault impact based on the relationship between the upper and lower links.

[0077] In this embodiment, the operating status of each device in the cascade network is monitored in real time, and an alarm is triggered when a device fails.

[0078] When an abnormality is detected in the operating status of a device, determine which faulty device corresponds to the abnormal point, and then determine the upper and lower connection relationships of the faulty device in the network topology. Based on the upper and lower connection relationships, the impact range of the faulty device can be known.

[0079] According to an embodiment of the present disclosure, the fault alarm processing method based on the cascade network may further include:

[0080] In response to a neighbor device of the faulty device being a normal device, a valid alarm triggered by the faulty device is sent.

[0081] In response to all neighboring devices of the faulty device being faulty devices, or the faulty device having no neighboring devices, invalid alarms triggered by the faulty device are suppressed.

[0082] In this embodiment, the sending of valid alarms and the suppression of invalid alarms are as follows:

[0083] If the faulty device still has a normally connected neighboring device, it means that the alarm is valid. At this time, the alarm is sent by calling the send_alert() function.

[0084] If the faulty device is not connected, or all its neighboring devices are also down (processing fault state), it is considered an invalid alarm and suppressed. Specifically: If fault_device is not connected or all connected devices are also in a faulty state, this may be a normal fault propagation of the device in the topology, so the alarm is suppressed and no invalid notification is sent. Check all neighbors of the faulty device through all(neighbor not in topology for neighbor in topology[fault_device]). If all neighbors are inaccessible, it means that the entire network part has been isolated, so there is no need to send additional alarms.

[0085] According to an embodiment of the present disclosure, sending a valid alarm triggered by a faulty device may include, for example:

[0086] Send effective alarms to designated recipients through the application program interface of the mobile office software.

[0087] In this embodiment, the effective alarm can be sent to a specified group chat through the DingTalk API, for example. The format of the alarm message can be customized according to the message type supported by the DingTalk robot, specifically:

[0088] Send a message to the specified group chat through the DingTalk robot's Webhook URL. YOUR_ACCESS_TOKEN in the URL needs to be replaced with the access_token of the actual DingTalk robot of the corresponding network administrator.

[0089] Use the requests library to send a POST request to send the alarm message to the DingTalk group chat. Set the request headers to 'Content-Type': 'application / json' to ensure that the message body is in JSON format. The message body data contains msgtype, which specifies that the message type to be sent is text, and defines the alarm content in content.

[0090] If the alert is sent successfully, the returned response will have the response.ok flag. Depending on this flag, the script will output a notification of success or failure.

[0091] Figure 2 The schematic diagram shows a principle diagram of a fault alarm processing method based on a cascade network according to an embodiment of the present disclosure.

[0092] like Figure 2 As shown, the principle of the fault alarm processing method based on the cascade network embodiment of the present disclosure is as follows:

[0093] First, the network administrator sends a data collection request and interacts with the network device to obtain the current network device's operating status, adjacency information, and related performance data. After receiving the collection request, the network device begins to collect relevant network information based on the SNMP protocol and LLDP / CDP protocol. The collected data will be pre-processed and stored in the MariaDB database.

[0094] Then, algorithms are used to analyze the logical relationships between devices, establish network topology, and record the connections and dependencies between devices.

[0095] Finally, detect equipment failures and determine the validity of alarms based on network topology, and use the DingTalk robot API to send alarm information to avoid interference from invalid alarms.

[0096] Figure 3 The schematic diagram shows a principle diagram of sending a valid alarm and suppressing an invalid alarm based on a fault impact range according to an embodiment of the present disclosure.

[0097] like Figure 3 As shown, the principle of sending a valid alarm and suppressing an invalid alarm based on the fault impact range in the embodiment of the present disclosure may be, for example:

[0098] When device3 or device4 fails, an alarm for device3 or device4 is sent.

[0099] When device2 fails, the alarm of device2 is sent and the alarms of device3 and device4 are suppressed.

[0100] When device1 fails, the alarm of device1 is sent and the alarms of device2, device3, and device4 are suppressed.

[0101] Among them, Figure 3 In the example, device refers to the faulty device.

[0102] Figure 4The structural block diagram of a fault alarm processing device based on a cascade network according to an embodiment of the present disclosure is schematically shown.

[0103] like Figure 4 As shown, the fault alarm processing device 400 based on the cascade network according to the embodiment of the present disclosure includes: an acquisition module 410 , a generation module 420 , a determination module 430 and an alarm processing module 440 .

[0104] The acquisition module 410 is used to acquire the operating status and adjacency information of each device in the cascade network.

[0105] The generation module 420 is used to generate network topology features according to the operation status and adjacency information, wherein the network topology features represent the connection mode and dependency relationship between various devices in the cascade network.

[0106] The determination module 430 is used to determine the impact range of the fault according to the network topology characteristics in response to a fault occurring in the cascade network.

[0107] The alarm processing module 440 is used to send valid alarms triggered by the faulty device based on the fault impact range, and suppress invalid alarms triggered by the downstream devices of the faulty device.

[0108] According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits, or at least part of the functions of any one of them can be implemented in one module. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be split into multiple modules for implementation. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be at least partially implemented as hardware circuits, such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems on chips, systems on substrates, systems on packages, application specific integrated circuits (ASICs), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging circuits, or can be implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, according to the embodiments of the present invention, one or more of the modules, submodules, units, and subunits can be at least partially implemented as computer program modules, and when the computer program modules are run, the corresponding functions can be performed.

[0109] For example, any multiple of the acquisition module 410, the generation module 420, the determination module 430, and the alarm processing module 440 can be combined in one module / unit / sub-unit for implementation, or any one of the modules / units / sub-units can be split into multiple modules / units / sub-units. Alternatively, at least part of the functions of one or more of these modules / units / sub-units can be combined with at least part of the functions of other modules / units / sub-units and implemented in one module / unit / sub-unit. According to an embodiment of the present disclosure, at least one of the acquisition module 410, the generation module 420, the determination module 430, and the alarm processing module 440 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or by any one of the three implementation methods of software, hardware, and firmware, or by a suitable combination of any of them. Alternatively, at least one of the acquisition module 410, the generation module 420, the determination module 430 and the alarm processing module 440 may be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function may be executed.

[0110] It should be noted that the threat intelligence detection device part based on honeypot trapping in the embodiments of the present disclosure corresponds to the threat intelligence detection method part based on honeypot trapping in the embodiments of the present disclosure. The description of the threat intelligence detection device part based on honeypot trapping specifically refers to the threat intelligence detection method part based on honeypot trapping, which will not be repeated here.

[0111] Figure 5 The structural block diagram of an electronic device suitable for implementing a fault alarm processing method based on a cascade network according to an embodiment of the present disclosure is schematically shown. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0112] like Figure 5As shown, the electronic device 500 according to an embodiment of the present disclosure includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 to a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include an onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0113] In RAM 503, various programs and data required for the operation of electronic device 500 are stored. Processor 501, ROM 502 and RAM 503 are connected to each other via bus 504. Processor 501 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 502 and / or RAM 503. It should be noted that the program can also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0114] According to an embodiment of the present disclosure, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 may further include one or more of the following components connected to the input / output (I / O) interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output (I / O) interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage portion 508 as needed.

[0115] According to an embodiment of the present disclosure, the method flow according to an embodiment of the present disclosure can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the processor 501, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to an embodiment of the present disclosure, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0116] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0117] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium. For example, it may include, but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device.

[0118] For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 502 and / or the RAM 503 described above and / or one or more memories other than the ROM 502 and the RAM 503 .

[0119] The embodiments of the present disclosure also include a computer program product, which includes a computer program, and the computer program contains program code for executing the method provided by the embodiments of the present disclosure. When the computer program product runs on an electronic device, the program code is used to enable the electronic device to implement the method provided by the embodiments of the present disclosure.

[0120] When the computer program is executed by the processor 501, the above functions defined in the system / device of the embodiment of the present disclosure are executed. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0121] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 509, and / or installed from the removable medium 511. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0122] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0123] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram may represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box may also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions. It can be understood by those skilled in the art that the features recorded in the various embodiments of the present disclosure can be combined and / or combined in a variety of ways, even if such a combination or combination is not explicitly recorded in the present disclosure. In particular, without departing from the spirit and teaching of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0124] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A fault alarm processing method based on a cascade network, characterized in that: The method comprises: Obtain the operating status and adjacency information of each device in the cascade network; Generate a network topology feature according to the operating state and the adjacency information, wherein the network topology feature represents the connection mode and dependency relationship between various devices in the cascade network; In response to a fault occurring in the cascade network, determining a fault impact range according to the network topology characteristics; Based on the fault impact range, a valid alarm triggered by the faulty device is sent, and an invalid alarm triggered by a downstream device of the faulty device is suppressed.

2. The method according to claim 1, characterized in that The obtaining of the operating status and adjacency information of each device in the cascade network includes: Based on the SNMP protocol, obtain the operating status of each device in the cascade network; Based on the LLDP / CDP protocol, obtain the adjacency information of each device in the cascade network.

3. The method according to claim 2, characterized in that The obtaining of the operating status and adjacency information of each device in the cascade network also includes: Preprocessing the data corresponding to the running status and the adjacency information; The preprocessed operation status data and adjacency information data are stored in a relational database management system.

4. The method according to claim 1, characterized in that: The generating of network topology features according to the running state and the adjacency information includes: Creating an undirected graph according to the running status and the adjacency information, wherein the nodes of the undirected graph represent devices, and the edges of the undirected graph represent connection relationships between devices; A network topology feature is generated according to the undirected graph.

5. The method according to claim 1, characterized in that In response to a fault occurring in the cascade network, determining a fault impact range according to the network topology feature includes: Real-time monitoring of the operating status of each device in the cascade network; In response to an abnormality in the operating state, determining a faulty device corresponding to the abnormal point; Determine the upper and lower connection relationship of the faulty device according to the network topology characteristics; The fault impact range is determined based on the upper and lower connection relationships.

6. The method according to claim 1, characterized in that The method further comprises: In response to a neighbor device of the faulty device being a normal device, sending a valid alarm triggered by the faulty device; In response to the fact that all neighboring devices of the faulty device are faulty devices, or the faulty device has no neighboring devices, invalid alarms triggered by the faulty device are suppressed.

7. The method according to claim 1, characterized in that The sending of a valid alarm triggered by a faulty device includes: The effective alarm is sent to a designated receiving terminal through the application program interface of the mobile office software.

8. A fault alarm processing device based on a cascade network, characterized in that: The device comprises: An acquisition module is used to obtain the operating status and adjacency information of each device in the cascade network; A generating module, configured to generate a network topology feature according to the operating state and the adjacency information, wherein the network topology feature represents a connection mode and dependency relationship between various devices in the cascade network; A determination module, configured to determine, in response to a failure of the cascade network, a failure impact range according to the network topology characteristics; The alarm processing module is used to send a valid alarm triggered by the faulty device based on the fault impact range, and suppress invalid alarms triggered by the downstream devices of the faulty device.

9. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor executes the method according to any one of claims 1 to 7.

Images